tokenmaxxing 0.14.0 → 0.16.0

package/DESIGN.md

@@ -1,6 +1,6 @@
 # tokenmaxxing - design
 
-Automatic Claude Code account switching. You run `claude` exactly as always; when the active account crosses its swap threshold (**95%** of the 5h session window, **98%** of a weekly window), tokenmaxxing swaps to a fresh account and - at the next safe turn boundary - **restarts your session resumed on it, automatically**. Works across many concurrent sessions at once.
+Automatic Claude Code account switching. You run `claude` exactly as always; when the active account crosses its swap threshold (**95%** of the 5h session window, **98%** of a weekly window), tokenmaxxing swaps the credential to a fresh account at a safe turn boundary and **your running session adopts it in place - no restart**. Works across many concurrent sessions at once; a fully depleted pool pauses with a countdown and auto-resumes at the soonest reset.
 
 > Scope: **Claude Code only, macOS first.** Codex and other CLIs deferred (see `.memory/cc-codex-auth-mechanics.md`).
 >
@@ -10,11 +10,11 @@ Automatic Claude Code account switching. You run `claude` exactly as always; whe
 
 ## 1. Why there is a thin supervisor (and why that's the whole trick)
 
-A **running** `claude` DOES adopt an externally swapped credential (verified live 2026-07-10, correcting this document's original claim): an ensure-fresh poll re-reads the credential store around every request, so a swap lands within ~30s on macOS (raw keychain cache) and on the next request on Linux. What a swap alone cannot give you is a *clean cutover*: a mid-flight 429 retry keeps its already-snapshotted token, and an account already at the wall still needs the session paused until something resets.
+A **running** `claude` DOES adopt an externally swapped credential (verified live 2026-07-10, correcting this document's original claim): an ensure-fresh poll re-reads the credential store around every request, so a swap lands within ~30s on macOS (raw keychain cache) and on the next request on Linux. A plain swap therefore needs no process management at all (since 0.15.0, 2026-07-16; earlier versions respawned on every swap): the Stop hook swaps the credential and the session keeps running. What adoption cannot give you is the depleted case: when every account is at the wall the session must be PAUSED until something resets, and a live `claude` cannot pause itself.
 
-So the supervisor's job is to **replace the process at a salvageable moment**: after a turn completes, the conversation is fully written to the transcript JSONL and `claude` is idle at the prompt - killing it there loses nothing, and a `claude --resume <session-id>` comes back cold on the new account and continues exactly where it left off. **This is why we swap below 100%: the headroom is the budget to reach a clean turn boundary and respawn before the account actually hits the wall.** The session window swaps at 95 (a 5h reset is cheap to sit out) while the weekly windows drain to 98 (weekly allowance is use-it-or-lose-it).
+So the supervisor's job is narrow: on a depleted pool it **replaces the process at a salvageable moment** - after a turn completes, the conversation is fully written to the transcript JSONL and `claude` is idle at the prompt, so killing it there loses nothing - shows an interruptible countdown to the soonest reset, and relaunches `claude --resume <session-id>` when it passes. **Thresholds still sit below 100%: the headroom is the budget to reach a clean turn boundary (plus up to one turn of adoption lag on macOS) before the account actually hits the wall.** The session window swaps at 95 (a 5h reset is cheap to sit out) while the weekly windows drain to 98 (weekly allowance is use-it-or-lose-it).
 
-A hook can't do the respawn - when `claude` exits, the shell owns the terminal. So tokenmaxxing installs a **supervisor** (aliased to `claude`) that owns the process lifecycle:
+A hook can't do the pause-and-relaunch - when `claude` exits, the shell owns the terminal. So tokenmaxxing installs a **supervisor** (aliased to `claude`) that owns the process lifecycle:
 
 ```
 supervisor (you type `claude`)  →  real claude (in a PTY)  →  Stop hook
@@ -33,7 +33,7 @@ It is a process/PTY manager only - spawn, forward the terminal, wait, restore te
   - `config.json` - threshold, account order/policy.
   - `accounts.json` - non-secret index `{email, organizationUuid, accountUuid, lastUsage, resetsAt, needs_reauth}`.
   - `usage.json` - live usage, written by the statusLine shim.
-  - `respawn/<session-id>` - per-session respawn markers (the hook→supervisor signal).
+  - `respawn/<session-id>` - per-session respawn markers (the hook→supervisor signal, depleted-pool waits only).
   - `bin/claude` - the supervisor.
 - Per-account **credentials** follow the platform's Claude Code store: macOS = login-keychain items `tokenmaxxing-cred-<accountUuid[:8]>` (never plaintext on disk); Linux = 0600 files `creds/tokenmaxxing-cred-<accountUuid[:8]>.json` (the same plaintext model claude itself uses - its Linux build has no keyring path at all, binary-verified 2.1.205). One `credstore` facade dispatches on a `{kind: keychain|file}` target; call sites never branch on platform.
 
@@ -49,10 +49,10 @@ The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limi
 ### 3.2 Detect + swap + signal (Stop hook, per turn)
 1. Read `usage.json`; `exit 0` fast if every window is under its threshold (metered per `organizationUuid`).
 2. Else take a `flock` on `~/.config/tokenmaxxing/lock`, re-check under it (parallel sessions race - first winner already swapped), pick the best parked account (not rate-limited, furthest behind its own weekly pace first: highest remaining% / time-to-weekly-reset, since unused allowance is forfeited at the fixed per-account reset; tiebreak soonest expiry then lowest 7-day usage), and **swap the credential** (§3.4).
-3. Write `respawn/<session_id>` (atomic temp+rename) and `SIGTERM` the parent `claude` (`kill -TERM $PPID`). The turn is already committed, so this is a clean stop.
+3. Done - the running session adopts the new credential on its own within a request or two. Only when the pool is depleted (the decision returned a `waitUntil`: pre-parked on the soonest-recovering account, or staying on the current one when it recovers first) does the hook write `respawn/<session_id>` (atomic temp+rename).
 
-### 3.3 Respawn (supervisor)
-The supervisor's `claude` call returns; it sees `respawn/<sid>`, deletes it, resets the terminal, prints `↻ switched to <account>`, and relaunches `claude --resume <sid>`. The resumed process reads the keychain cold → runs on the new account, same conversation. The `SessionStart` hook (source `resume`) re-checks the account before the first turn as a backstop.
+### 3.3 Depleted-pool pause (supervisor)
+The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed turn boundary, deletes the marker, resets the terminal, shows an interruptible countdown to the reset, and relaunches `claude --resume <sid>` when it passes. The resumed process reads the keychain cold → runs on the recovered account, same conversation. The `SessionStart` hook (source `resume`) re-checks the account before the first turn as a backstop.
 
 ### 3.4 Swap sequence (under the lock)
 1. **Harvest the live credential into its TRUE owner's backup** - read the current `Claude Code-credentials` blob and resolve which account it actually belongs to via the roles endpoint (`GET /api/oauth/claude_cli/roles`), NOT the `accounts.json` active label. The label drifts from the live blob (a kill mid-swap, a manual `/login`), and harvesting by label once overwrote another account's backup and destroyed its only credential. Mandatory anyway: Claude rotates the refresh token in place, so older backups are dead. Refuse the swap if the live credential belongs to no pooled account.
@@ -62,7 +62,7 @@ The supervisor's `claude` call returns; it sees `respawn/<sid>`, deletes it, res
 5. Do steps 1, 3, 4 inside Claude's own `~/.claude.lock` so the writes can't collide with a token refresh.
 
 ### 3.5 Multiple concurrent sessions
-Each terminal ran the supervisor, so each has its own child `claude`, its own `--session-id`, and its own respawn marker. When the shared account hits a threshold, the first Stop hook to win the `flock` performs the one swap; **every** session's Stop hook writes its own respawn marker and SIGTERMs its own `claude`; **every** supervisor independently relaunches `claude --resume <its-own-sid>`. All of them come back on the new account, each continuing its own conversation. (They share one credential, so they always move together - consistent with "one current account, many windows.")
+Each terminal ran the supervisor, so each has its own child `claude` and its own `--session-id`. When the shared account hits a threshold, the first Stop hook to win the `flock` performs the one swap; every running session then adopts the new credential in place - no restarts. (They share one credential, so they always move together - consistent with "one current account, many windows.") Only a depleted pool fans out: each supervised session's Stop hook writes its own `respawn/<sid>` marker, and each supervisor independently pauses and later relaunches `claude --resume <its-own-sid>`.
 
 ---
 
@@ -83,10 +83,11 @@ The decision engages at `five_hour >= 50%` (policy.greedySessionFloor): from the
 ---
 
 ## 6. Honest papercuts
-- **Respawn hiccup.** At the swap turn you see `claude` restart (~1–2s) and resume. Anything you typed in the split second before respawn is lost - mitigate by respawning fast and showing a clear "switching" state; the supervisor resets terminal mode so nothing is left garbled.
-- **One cold turn.** Prompt cache is org-scoped: the first turn after resuming on B re-uploads context once (bigger on long transcripts).
-- **Single-turn overshoot.** If one turn jumps from under the threshold straight past the wall, that turn can end rate-limited before the Stop hook swaps; the respawn then still recovers it. Projected threshold reduces this.
-- **Shared blast radius.** All default-profile sessions share one keychain item, so a swap moves them all (each via its own respawn). The `flock` + re-check is mandatory or racing hooks burn two accounts at once.
+- **Respawn hiccup (depleted pause only).** Plain swaps never restart the session. When the whole pool is depleted you see `claude` stop, a countdown, and a resume; anything typed in the split second before the SIGTERM is lost, and the supervisor resets terminal mode so nothing is left garbled.
+- **Adoption lag.** macOS reads the keychain through a raw 30s cache, so at most the first turn after a swap can still meter the old account. The bars' headroom absorbs it.
+- **One cold turn.** Prompt cache is org-scoped: the first turn on B re-uploads context once (bigger on long transcripts).
+- **Single-turn overshoot.** If one turn jumps from under the threshold straight past the wall, that turn can end rate-limited before the Stop hook swaps; the swap then still recovers the session (its next turn adopts the fresh account). Projected threshold reduces this.
+- **Shared blast radius.** All default-profile sessions share one keychain item, so a swap moves them all (each adopts in place). The `flock` + re-check is mandatory or racing hooks burn two accounts at once.
 - **Refresh-token rotation / parked-token rot.** Step 1 re-harvest is mandatory; a parked refresh token can be invalidated by logging in elsewhere → picker must catch `invalid_grant`, mark `needs_reauth`, fall through.
 - **statusLine fragility.** The shim is the most visible surface - a bug flickers or breaks your real status line. Keep it O(ms), write-on-change.
 - **Keychain blob size & ps-safety.** The live `Claude Code-credentials` item also holds per-MCP-server OAuth state, so it can exceed `security -i`'s ~4KB interactive line buffer (verified on a real machine - a 4.3KB blob truncated). tokenmaxxing therefore stores parked backups as **`claudeAiOauth`-only** (small → always the ps-safe stdin write) and, on a swap, **merges** the fresh `claudeAiOauth` into the *current* live blob so MCP tokens survive the switch - using the argv write path (secret briefly visible in `ps` on your own machine) only for that one oversized live write.

package/README.md

@@ -1,19 +1,18 @@
 # tokenmaxxing
 
-**Automatic Claude Code account switching.** Run `claude` exactly as you always do; when the active account crosses its usage limit, tokenmaxxing swaps to a fresh account and - at the next safe turn boundary - restarts your session *resumed on it*, automatically. Works across many concurrent sessions.
+**Automatic Claude Code account switching.** Run `claude` exactly as you always do; when the active account nears its usage limit, tokenmaxxing swaps the credential to a fresher account at a safe turn boundary and your session keeps running on it - no restart, same conversation. Works across many concurrent sessions. Only when the whole pool is at its limit does anything visible happen: a countdown that auto-resumes at the soonest reset.
 
 > **Scope:** Claude Code only, macOS and Linux. It pools **subscription** accounts (Pro/Max), not API keys.
 
 ```
 $ claude
-  ...you work normally...
-  ↻ tokenmaxxing: switched to work@acme.com - resuming...
-  ...same conversation, fresh quota...
+  ...you work normally; swaps are invisible (watch the statusline account flip)...
+  ⏳ tokenmaxxing: all accounts at their limit. Resuming on work@acme.com when it resets (Ctrl-C to resume now).
 ```
 
 ## Why
 
-A running `claude` re-checks the credential store between requests, so a swapped credential is adopted in-place (within ~30s on macOS, the next request on Linux). tokenmaxxing performs the swap at a committed turn boundary and **respawns** `claude --resume <id>` (the transcript is already on disk, so nothing is lost) - the respawn is what gives you a clean cutover and, when the whole pool is depleted, a countdown that auto-resumes at the soonest reset. A thin `claude` supervisor on your PATH owns that respawn; everything else about `claude` is unchanged - all flags, MCP, hooks, and skills pass through.
+A running `claude` re-checks the credential store between requests, so a swapped credential is adopted in-place (within ~30s on macOS, the next request on Linux) - a swap never restarts your session. The one case that still needs process management is a fully depleted pool: a session cannot pause itself, so a thin `claude` supervisor on your PATH stops it at a committed turn boundary (the transcript is already on disk, nothing is lost), shows a countdown, and auto-resumes `claude --resume <id>` at the soonest reset. Everything else about `claude` is unchanged - all flags, MCP, hooks, and skills pass through.
 
 ## Install
 
@@ -46,7 +45,7 @@ claude                  # use claude as always
 | `tokenmaxxing watch [seconds]` | live status: re-render every N seconds (default 120, floor 30; never pings) |
 | `tokenmaxxing config` | effective config with sources; `get`/`set`/`unset` dotted keys, `tidy` prunes unknown keys |
 | `tokenmaxxing doctor` | verify the supervisor + settings entries survived |
-| `tokenmaxxing rename <sel> <label>` · `rm <sel>` | manage the pool |
+| `tokenmaxxing rename [--codex] <sel> <label>` / `rm <sel>` | manage the pool (`--codex` targets the codex pool: one email can hold both a claude and a codex account) |
 | `tokenmaxxing uninstall` | remove supervisor + settings entries (accounts/credentials kept) |
 
 ## How switching decides
@@ -56,7 +55,7 @@ Switching engages (configurable) once the active account's 5-hour session window
 - **Session** (5-hour) or **week (all models)** - the aggregate windows, fed free/push-based by the statusLine.
 - **Per-model weekly cap** - the most capable model (Fable) has its own tighter weekly limit that binds *before* the aggregate (per-model caps currently exist only for Sonnet and Fable, and Sonnet's is generous). tokenmaxxing reads it from `claude -p '/usage'` (free, 0 tokens, TTL-cached) whenever the active model is one of `policy.switchModels`, so a Fable session switches on the Fable cap while a Sonnet session rides the aggregate.
 
-The bars' headroom is deliberate: it's the budget to reach a clean turn boundary and respawn before the wall. The session bar sits lower (95) because a 5-hour reset is cheap to sit out; weekly quota is use-it-or-lose-it, so it drains closer to the wall (98). The greedy engagement floor sits far below both: weekly allowance is forfeited at each account's fixed reset, so once half a session window justifies the swap, quota is best burned on whichever account has the most at risk.
+The bars' headroom is deliberate: it's the budget to reach a clean turn boundary (plus up to one turn of adoption lag on macOS) before the wall. The session bar sits lower (95) because a 5-hour reset is cheap to sit out; weekly quota is use-it-or-lose-it, so it drains closer to the wall (98). The greedy engagement floor sits far below both: weekly allowance is forfeited at each account's fixed reset, so once half a session window justifies the swap, quota is best burned on whichever account has the most at risk.
 
 The **target** is chosen greedily off each account's cached windows: among usable accounts (every window under its bar, or past its reset), the one **furthest behind its own weekly pace** - highest remaining% divided by time to its weekly reset - because unused weekly allowance is forfeited at the fixed per-account reset. Cached resets are absolute UTC epochs, so a stale snapshot still resolves correctly: a weekly reset that has passed extrapolates forward in 7-day steps, and a session window past its reset counts as empty. Both `tokenmaxxing switch` and the automatic path rank the current account too and do nothing when it already wins, so they are idempotent - evaluating periodically converges on the right account.
 
@@ -121,9 +120,10 @@ Two codex-specific facts worth knowing: codex does not run hooks it has not been
 
 ## Honest limitations
 
-- **One cold turn.** The first turn after resuming on a new account re-uploads context once (prompt cache is org-scoped).
-- **Respawn hiccup.** At the swap you see `claude` restart (~1–2s); anything typed in that split second is lost.
-- **Shared blast radius.** All default-profile sessions share one live credential, so a swap moves them all together (each respawns its own session). A `flock` + re-check keeps racing hooks from burning two accounts.
+- **One cold turn.** The first turn on a new account re-uploads context once (prompt cache is org-scoped).
+- **Depleted-pause hiccup.** Plain swaps never restart the session. Only when the whole pool is at its limit does `claude` stop for the countdown; anything typed in that split second is lost.
+- **Adoption lag.** On macOS the first turn within ~30s of a swap can still meter the old account; the bars' headroom absorbs it.
+- **Shared blast radius.** All default-profile sessions share one live credential, so a swap moves them all together (each adopts in place). A `flock` + re-check keeps racing hooks from burning two accounts.
 - **Keychain ACL (macOS).** `init`/`add` touch the keychain interactively so the first `security` access isn't cold inside a headless hook.
 - **Plaintext credentials (Linux).** Claude Code itself stores Linux credentials as a 0600 plaintext file; tokenmaxxing's parked copies follow the same model.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",

package/src/cli/add.ts

@@ -15,7 +15,7 @@ import { withLock } from "../lib/lock.ts";
 import { loadAccounts, saveAccounts } from "../lib/state.ts";
 import { credItemFor, paths } from "../lib/paths.ts";
 import { CredentialBlobSchema, OAuthAccountSchema, type Account } from "../lib/types.ts";
-import { c, count } from "./render.ts";
+import { c, claudeTierLabel, count } from "./render.ts";
 
 /** True once `/login` has written a usable identity into the onboard dir. */
 function identityReady(cjPath: string): boolean {
@@ -115,6 +115,7 @@ export async function cmdAdd(): Promise<number> {
       oauthAccount,
       addedAt: existing?.addedAt ?? new Date().toISOString(),
       subscriptionType: blob.claudeAiOauth.subscriptionType,
+      rateLimitTier: blob.claudeAiOauth.rateLimitTier,
       needsReauth: false,
       lastUsage: sampled ? { fiveHour: sampled.session, sevenDay: sampled.weekAll } : existing?.lastUsage,
       lastPerModel: sampled && Object.keys(sampled.perModel).length > 0 ? sampled.perModel : existing?.lastPerModel,
@@ -130,6 +131,6 @@ export async function cmdAdd(): Promise<number> {
 
   console.log();
   const usageNote = sampled ? ` (session ${sampled.session.usedPercentage}% / week ${sampled.weekAll.usedPercentage}%)` : "";
-  console.log(`${c.green("✓")} added ${c.bold(account.email)} (${account.subscriptionType ?? "?"})${usageNote} → pool now has ${count({ n: poolSize, noun: "account" })}`);
+  console.log(`${c.green("✓")} added ${c.bold(account.email)} (${claudeTierLabel(account) ?? "?"})${usageNote} → pool now has ${count({ n: poolSize, noun: "account" })}`);
   return 0;
 }

package/src/cli/init.ts

@@ -10,7 +10,7 @@ import { installSupervisor, shellRcPath, ensurePathInRc, timerActivationHint, ty
 import { resolveVerifiedClaude } from "../lib/claudebin.ts";
 import { credItemFor, paths } from "../lib/paths.ts";
 import { CredentialBlobSchema, type Account } from "../lib/types.ts";
-import { c } from "./render.ts";
+import { c, claudeTierLabel } from "./render.ts";
 
 /** Put the supervisor bin dir on PATH via the user's shell rc (idempotent).
  *  Falls back to the manual instruction when the shell is unknown. */
@@ -121,6 +121,7 @@ export async function cmdInit(): Promise<number> {
     oauthAccount,
     addedAt: existing?.addedAt ?? new Date().toISOString(),
     subscriptionType: blob.claudeAiOauth.subscriptionType,
+    rateLimitTier: blob.claudeAiOauth.rateLimitTier,
     needsReauth: false,
   };
   if (existing) Object.assign(existing, account);
@@ -134,7 +135,7 @@ export async function cmdInit(): Promise<number> {
 
   const out = installSupervisor();
 
-  console.log(`${c.green("✓")} imported current account → ${c.bold(account.email)} (${account.subscriptionType ?? "?"})`);
+  console.log(`${c.green("✓")} imported current account → ${c.bold(account.email)} (${claudeTierLabel(account) ?? "?"})`);
   console.log(`${c.green("✓")} installed ${c.bold("claude")} supervisor + statusLine/Stop/SessionStart hooks`);
   reportTimer(out);
   if (!out.pathAhead) {

package/src/cli/ls.ts

@@ -3,7 +3,7 @@
 import { loadAccounts } from "../lib/state.ts";
 import { loadCodexAccounts } from "../lib/codexstate.ts";
 import { liveCodexAccountId } from "../lib/codexsample.ts";
-import { c } from "./render.ts";
+import { c, claudeTierLabel } from "./render.ts";
 
 export function cmdLs(): number {
   const idx = loadAccounts();
@@ -19,7 +19,7 @@ export function cmdLs(): number {
     const tag = flags.length ? ` ${flags.join(" ")}` : "";
     const label = a.label || a.email;
     console.log(`${marker} ${c.bold(label)}${tag}`);
-    console.log(`  ${c.dim(`org ${a.organizationUuid.slice(0, 8)}, ${a.subscriptionType ?? "?"}, uuid ${a.accountUuid.slice(0, 8)}`)}`);
+    console.log(`  ${c.dim(`org ${a.organizationUuid.slice(0, 8)}, ${claudeTierLabel(a) ?? "?"}, uuid ${a.accountUuid.slice(0, 8)}`)}`);
   }
 
   const codex = loadCodexAccounts();

package/src/cli/rename.ts

@@ -1,12 +1,16 @@
-// `tokenmaxxing rename <selector> <new-label>` - relabel a pooled account.
+// `tokenmaxxing rename [--codex] <selector> <new-label>` - relabel a pooled
+// account. The pools are separate namespaces and one email can hold both a
+// claude and a codex account, so the codex pool is targeted explicitly via
+// `--codex` (mirroring `switch --codex`), never by searching both pools.
 
 import { withLock } from "../lib/lock.ts";
-import { paths } from "../lib/paths.ts";
+import { codexPaths, paths } from "../lib/paths.ts";
 import { loadAccounts, saveAccounts } from "../lib/state.ts";
+import { loadCodexAccounts, saveCodexAccounts } from "../lib/codexstate.ts";
 import { c } from "./render.ts";
-import type { Account } from "../lib/types.ts";
+import type { Account, CodexAccount } from "../lib/types.ts";
 
-/** Resolve an account by email, label, or accountUuid prefix. */
+/** Resolve a claude account by email, label, or accountUuid prefix. */
 export function findAccount(accounts: Account[], selector: string): Account | undefined {
   const s = selector.toLowerCase();
   return (
@@ -16,17 +20,47 @@ export function findAccount(accounts: Account[], selector: string): Account | un
   );
 }
 
-export async function cmdRename(selector?: string, newLabel?: string): Promise<number> {
+/** Resolve a codex account by email, label, or accountId prefix. */
+export function findCodexAccount(accounts: CodexAccount[], selector: string): CodexAccount | undefined {
+  const s = selector.toLowerCase();
+  return (
+    accounts.find((a) => a.email?.toLowerCase() === s) ??
+    accounts.find((a) => a.label.toLowerCase() === s) ??
+    accounts.find((a) => a.accountId.toLowerCase().startsWith(s))
+  );
+}
+
+async function renameCodexAccount(input: { selector: string; newLabel: string }): Promise<number> {
+  // under the codex flock: a concurrent codex swap's index write must not be clobbered.
+  return withLock(codexPaths.lockFile, async () => {
+    const index = loadCodexAccounts();
+    const account = findCodexAccount(index.accounts, input.selector);
+    if (!account) {
+      console.error(c.red(`no codex account matches "${input.selector}"`));
+      return 1;
+    }
+    const old = account.label;
+    account.label = input.newLabel;
+    saveCodexAccounts({ index });
+    console.log(`renamed codex account ${c.dim(old)} → ${c.bold(input.newLabel)}`);
+    return 0;
+  });
+}
+
+export async function cmdRename(argv: string[]): Promise<number> {
+  const codex = argv.includes("--codex");
+  const [selector, newLabel] = argv.filter((a) => a !== "--codex");
   if (!selector || !newLabel) {
-    console.error("usage: tokenmaxxing rename <email|label|uuid> <new-label>");
+    console.error("usage: tokenmaxxing rename [--codex] <email|label|id> <new-label>");
     return 2;
   }
+  if (codex) return renameCodexAccount({ selector, newLabel });
   // under the flock: a concurrent swap's index write must not be clobbered.
   return withLock(paths.lockFile, async () => {
     const idx = loadAccounts();
     const a = findAccount(idx.accounts, selector);
     if (!a) {
-      console.error(c.red(`no account matches "${selector}"`));
+      console.error(c.red(`no claude account matches "${selector}" (codex accounts rename via --codex)`));
       return 1;
     }
     const old = a.label;

package/src/cli/render.ts

@@ -18,6 +18,19 @@ export function makeColors(enabled: boolean) {
 
 export const c = makeColors(!process.env.NO_COLOR && !!process.stdout.isTTY);
 
+/** Plan label for a claude account, e.g. "max 20x": subscription name plus the
+ *  multiplier segment of the rate-limit tier id ("default_claude_max_20x").
+ *  Structural, never exact-string: the multiplier is any <digits>x segment, so
+ *  tiers without one (e.g. "default_claude_zero") fall back to the bare
+ *  subscription name, and an absent blob field falls back to null (unmeasured
+ *  must not look like a tier). */
+export function claudeTierLabel(input: { subscriptionType?: string; rateLimitTier?: string }): string | null {
+  const segments = input.rateLimitTier?.split("_") ?? [];
+  const multiplier = segments.find((seg) => seg.length > 1 && seg.endsWith("x") && Number.isInteger(Number(seg.slice(0, -1))));
+  if (input.subscriptionType == null) return multiplier ?? null;
+  return multiplier ? `${input.subscriptionType} ${multiplier}` : input.subscriptionType;
+}
+
 /** "1 account" / "3 accounts": counted nouns always pluralize properly. */
 export function count(input: { n: number; noun: string }): string {
   return `${input.n} ${input.noun}${input.n === 1 ? "" : "s"}`;

package/src/cli/status.ts

@@ -21,8 +21,8 @@ import { effectiveBars, isExhausted, nextWeeklyReset } from "../lib/picker.ts";
 import { loadCodexAccounts, saveCodexAccounts } from "../lib/codexstate.ts";
 import { liveCodexAccountId, sampleCodexAccount, type CodexSampleOutcome } from "../lib/codexsample.ts";
 import { isCodexExhausted } from "../lib/codexpick.ts";
-import { isSessionWindow } from "../lib/codexusage.ts";
-import { bar, c, count, fmtAgo, fmtReset } from "./render.ts";
+import { codexLimitLabel, isSessionWindow } from "../lib/codexusage.ts";
+import { bar, c, claudeTierLabel, count, fmtAgo, fmtReset } from "./render.ts";
 import type { FullUsage } from "../lib/usage.ts";
 import type { Config, CodexWindow, UsageWindow } from "../lib/types.ts";
 
@@ -48,10 +48,15 @@ export async function cmdStatus(force = false, preRender?: () => void): Promise<
     idx = loadAccounts();
     const live = loadUsage();
     const modelUsage = loadModelUsage();
-    const activeOrg = readOAuthAccount()?.organizationUuid ?? null;
+    const liveOAuth = readOAuthAccount();
+    const activeOrg = liveOAuth?.organizationUuid ?? null;
     await Promise.all(
       idx.accounts.map(async (a) => {
         const isActive = a.accountUuid === idx.activeAccountUuid && activeOrg === a.organizationUuid;
+        // The tee path never opens the credential blob, so the active account's
+        // tier comes from the live oauthAccount instead - it names this very org
+        // (uuid-matched above), so the tier is attributed to its own identity.
+        if (isActive && liveOAuth?.organizationRateLimitTier != null) a.rateLimitTier = liveOAuth.organizationRateLimitTier;
         // Active account: prefer the free statusLine push (usage.json) so we never
         // poll its own token, which is busy exactly when it matters. per-model
         // comes from model-usage.json (also statusLine-driven).
@@ -126,12 +131,15 @@ export async function cmdStatus(force = false, preRender?: () => void): Promise<
     if (isExhausted(a, { now, thresholds: effectiveBars(cfg), currentAccountUuid: idx.activeAccountUuid, switchFamilies: cfg.policy.switchModels }))
       badges.push(c.yellow("exhausted"));
 
-    console.log(`${marker} ${c.bold(a.label || a.email)} ${badges.join(" ")}`);
+    const tier = claudeTierLabel(a);
+    console.log(`${marker} ${c.bold(a.label || a.email)}${tier ? ` ${c.dim(tier)}` : ""}${badges.length ? ` ${badges.join(" ")}` : ""}`);
+    // Chart label convention (user rule 2026-07-17): everything lowercase,
+    // model names short ("fable", "spark").
     if (aggregate) {
       row("5h", aggregate.fiveHour, false);
       row("week", aggregate.sevenDay, true);
     }
-    if (perModel) for (const [name, w] of Object.entries(perModel)) row(name, w, true);
+    if (perModel) for (const [name, w] of Object.entries(perModel)) row(name.toLowerCase(), w, true);
     if (failed && outcome && !outcome.ok) {
       const cached = aggregate || perModel ? `cached${a.lastUsageAt != null ? ` ${fmtAgo(a.lastUsageAt, now)}` : ""}, ` : "";
       console.log(`    ${c.yellow(`${cached}live sample failed`)}: ${c.dim(outcome.reason)}`);
@@ -199,13 +207,13 @@ async function renderCodexSection(input: {
     if (active) badges.push(c.green("active"));
     if (account.needsReauth) badges.push(c.red("needs-reauth"));
     if (isCodexExhausted({ account, thresholds: effectiveBars(cfg), now })) badges.push(c.yellow("exhausted"));
-    console.log(`${marker} ${c.bold(account.label)} ${account.planType ? c.dim(account.planType) : ""} ${badges.join(" ")}`);
+    console.log(`${marker} ${c.bold(account.label)}${account.planType ? ` ${c.dim(account.planType)}` : ""}${badges.length ? ` ${badges.join(" ")}` : ""}`);
 
     const usage = account.lastUsage;
     if (usage) {
       for (const window of usage.aggregate) row(windowLabel(window), window, !isSessionWindow({ window }));
       for (const [name, windows] of Object.entries(usage.perLimit)) {
-        for (const window of windows) row(name, window, !isSessionWindow({ window }));
+        for (const window of windows) row(codexLimitLabel({ limitName: name }), window, !isSessionWindow({ window }));
       }
     }
     const outcome = outcomes.get(account.accountId);

package/src/entries/stophook.ts

@@ -1,8 +1,10 @@
 // Stop hook. Fires when claude finishes a turn (transcript already committed).
-// If the active account crossed the threshold, swap the credential and - when
-// running under the supervisor - drop a respawn marker keyed by this session id.
-// The supervisor watches for the marker and SIGTERMs its child at this clean
-// boundary, then relaunches `--resume`. We never kill claude ourselves.
+// A plain swap needs no respawn: the running session adopts the swapped
+// credential on its own (<=30s on macOS, next request on Linux). Only a
+// depleted-pool wait - when running under the supervisor - drops a respawn
+// marker keyed by this session id: the supervisor SIGTERMs its child at this
+// clean boundary, counts down to the reset, then relaunches `--resume`. We
+// never kill claude ourselves.
 
 import { join } from "node:path";
 import { z } from "zod";
@@ -34,10 +36,11 @@ export async function runStopHook(): Promise<number> {
     // will actually pause the session until the reset.
     const canPause = process.env.TOKENMAXXING_SUPERVISED === "1" && sessionId != null;
     const decision = await evaluateAndMaybeSwap(Date.now(), canPause);
-    // Respawn on a swap, or on a depleted-pool wait (relaunch after the reset).
     if (decision.account && (decision.swapped || decision.waitUntil !== undefined)) {
       log(decision.swapped ? "stop.swapped" : "stop.wait", { account: decision.account.accountUuid.slice(0, 8), waitUntil: decision.waitUntil });
-      if (process.env.TOKENMAXXING_SUPERVISED === "1" && sessionId) {
+      // Respawn only for a depleted-pool wait: pausing until the reset requires
+      // killing the child. A plain swap leaves the session running to adopt.
+      if (decision.waitUntil !== undefined && process.env.TOKENMAXXING_SUPERVISED === "1" && sessionId) {
         const marker = join(paths.respawnDir, sessionId);
         const payload = RespawnMarkerSchema.parse({ account: decision.account.label, ts: Date.now(), waitUntil: decision.waitUntil });
         writeFileAtomic(marker, JSON.stringify(payload));

package/src/entries/supervisor.ts

@@ -1,10 +1,11 @@
 // The `claude` supervisor. Invoked in place of claude (via ~/.config/tokenmaxxing/
 // bin/claude on PATH). Runs the REAL claude with inherited stdio (claude owns the
 // real terminal exactly as if run directly), pins a session id, and watches for a
-// respawn marker dropped by the Stop/SessionStart hook. When the marker appears it
-// SIGTERMs its own child at the (already-committed) turn boundary and relaunches
-// `claude --resume <id>` on the freshly-swapped account. Process/terminal manager
-// only - it never reads or proxies tokens.
+// respawn marker dropped by the Stop hook on a depleted-pool wait (plain swaps
+// adopt in place and never respawn). When the marker appears it SIGTERMs its own
+// child at the (already-committed) turn boundary, counts down to the reset, and
+// relaunches `claude --resume <id>`. Process/terminal manager only - it never
+// reads or proxies tokens.
 
 import { existsSync, mkdirSync, rmSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
@@ -213,7 +214,7 @@ export async function runSupervisor(argv: string[]): Promise<number> {
       const m = RespawnMarkerSchema.parse(await Bun.file(marker).json());
       rmSync(marker, { force: true });
       respawns++;
-      if (m.waitUntil && m.waitUntil > Date.now()) await countdownWait(m.account, m.waitUntil);
+      if (m.waitUntil > Date.now()) await countdownWait(m.account, m.waitUntil);
       else process.stdout.write(`\n\x1b[36m↻ tokenmaxxing: switched to ${m.account} - resuming...\x1b[0m\n`);
       launchArgs = ["--resume", sid, ...base];
       continue;

package/src/lib/codexusage.ts

@@ -14,6 +14,7 @@ import { z } from "zod";
 import { http, safeErrorDetail } from "./http.ts";
 import { CodexUsageSchema, type CodexAuthJson, type CodexUsage, type CodexWindow } from "./types.ts";
 import { codexIdentityOf } from "./codexauth.ts";
+import { familyTokens } from "./usage.ts";
 
 const EnvOverrideSchema = z.string().min(1).optional().catch(undefined);
 const USAGE_URL = EnvOverrideSchema.parse(process.env.TOKENMAXXING_CODEX_USAGE_URL) ?? "https://chatgpt.com/backend-api/wham/usage";
@@ -114,6 +115,15 @@ export async function fetchCodexUsage(input: { auth: CodexAuthJson }): Promise<C
   });
 }
 
+/** Quota-chart label for an additional_rate_limits row: the model family,
+ *  lowercase ("GPT-5.3-Codex-Spark" -> "spark"). Wire names are versioned, so
+ *  the label is derived structurally (last non-numeric token), never by exact
+ *  string (user rule 2026-07-17: chart names are lowercase, e.g. "spark"). */
+export function codexLimitLabel(input: { limitName: string }): string {
+  const tokens = familyTokens(input.limitName).filter((t) => Number.isNaN(Number(t)));
+  return tokens.at(-1) ?? input.limitName.trim().toLowerCase();
+}
+
 const SESSION_WINDOW_MAX_S = 6 * 3600;
 
 /** A window's screening bar: short windows (5h-class) screen at the session

package/src/lib/sample.ts

@@ -49,6 +49,14 @@ async function identityMismatch(creds: OAuthCreds, account: Account): Promise<st
   return `credential actually belongs to ${org.organization_name} (org ${org.organization_uuid.slice(0, 8)})`;
 }
 
+/** Stamp the blob's plan fields onto the account (caller persists). Runs only
+ *  after the identity check passed, so a drifted credential can never write
+ *  another account's tier. Absent blob fields keep the last-known values. */
+function refreshPlanFields(account: Account, creds: OAuthCreds): void {
+  if (creds.subscriptionType != null) account.subscriptionType = creds.subscriptionType;
+  if (creds.rateLimitTier != null) account.rateLimitTier = creds.rateLimitTier;
+}
+
 /**
  * Live-sample `account`'s `/usage` in isolation. On a dead refresh token or a
  * mislabeled credential it sets `account.needsReauth` in place (the caller
@@ -89,6 +97,7 @@ export async function probeParkedUsage(account: Account, opts: { ping?: boolean
     account.needsReauth = true;
     return { ok: false, reason: `${mismatch} - this account's own credential is gone; re-auth with \`tokenmaxxing add\`` };
   }
+  refreshPlanFields(account, creds);
 
   const dir = join(paths.sampleDir, credItemFor(account.accountUuid));
   rmSync(dir, { recursive: true, force: true });
@@ -149,6 +158,7 @@ export async function probeActiveUsage(account: Account, opts: { ping?: boolean
 
   const mismatch = await identityMismatch(creds, account);
   if (mismatch) return { ok: false, reason: `live ${mismatch} - active label drifted; run \`tokenmaxxing switch\`` };
+  refreshPlanFields(account, creds);
 
   const pingError = opts.ping ? await pingSession() : null;
   const usage = await probeUsage();

package/src/lib/types.ts

@@ -36,6 +36,9 @@ export const OAuthAccountSchema = z.looseObject({
   seatTier: z.string().nullish(),
   billingType: z.string().nullish(),
   displayName: z.string().nullish(),
+  /** rate-limit tier id ("default_claude_max_20x"), same value the credential
+   *  blob carries; claude fills it in on profile fetch (live-verified 2.1.211). */
+  organizationRateLimitTier: z.string().nullish(),
 });
 export type OAuthAccount = z.infer<typeof OAuthAccountSchema>;
 
@@ -90,6 +93,10 @@ export const AccountSchema = z.object({
   lastUsageAt: z.number().optional(),
   needsReauth: z.boolean().optional(),
   subscriptionType: z.string().optional(),
+  /** the blob's rate-limit tier id (e.g. "default_claude_max_20x"): the only
+   *  field that distinguishes max 5x from max 20x (subscriptionType is just
+   *  "max" for both). Refreshed on every verified sample. */
+  rateLimitTier: z.string().optional(),
 });
 export type Account = z.infer<typeof AccountSchema>;
 
@@ -141,12 +148,13 @@ export const ConfigSchema = z.object({
 });
 export type Config = z.infer<typeof ConfigSchema>;
 
-/** The hook -> supervisor respawn marker at respawn/<session-id>. */
+/** The hook -> supervisor respawn marker at respawn/<session-id>. Written only
+ *  for a depleted-pool wait (plain swaps adopt in place, no respawn). */
 export const RespawnMarkerSchema = z.object({
   account: z.string(),
   ts: z.number(),
-  /** when set, the supervisor waits until this epoch ms before relaunching. */
-  waitUntil: z.number().optional(),
+  /** the supervisor waits until this epoch ms before relaunching. */
+  waitUntil: z.number(),
 });
 export type RespawnMarker = z.infer<typeof RespawnMarkerSchema>;
 

package/src/main.ts

@@ -44,7 +44,7 @@ function printHelp(): void {
   ${c.cyan("tokenmaxxing watch")} [seconds]  live status: re-render every N seconds (default 120, never pings)
   ${c.cyan("tokenmaxxing config")} [get|set|unset|tidy]  inspect and edit config.json (bare = effective config with sources)
   ${c.cyan("tokenmaxxing doctor")}     verify the install is intact
-  ${c.cyan("tokenmaxxing rename")} <sel> <label>
+  ${c.cyan("tokenmaxxing rename")} [--codex] <sel> <label>
   ${c.cyan("tokenmaxxing rm")} <sel>
   ${c.cyan("tokenmaxxing uninstall")}  remove supervisor + settings entries
 
@@ -85,7 +85,7 @@ async function main(): Promise<number> {
     case "watch": return cmdWatch(args[1]);
     case "doctor": return cmdDoctor();
     case "rm": return cmdRm(args[1]);
-    case "rename": return cmdRename(args[1], args[2]);
+    case "rename": return cmdRename(args.slice(1));
     case "uninstall":
       uninstallSupervisor();
       console.log("removed supervisor wrapper + settings entries (accounts/credentials kept)");