tokenmaxxing 0.16.0 → 0.17.0

package/DESIGN.md

@@ -71,6 +71,7 @@ Each terminal ran the supervisor, so each has its own child `claude` and its own
 - **`tokenmaxxing init` imports the account you're already on - automatically, no prompts, no re-login.** It reads the live `Claude Code-credentials` keychain blob plus the `oauthAccount` object in `~/.claude.json` (email, `organizationUuid`, `accountUuid`, plan tier) and writes them as **account #1** into tokenmaxxing's store (`tokenmaxxing-cred-<accountUuid[:8]>` + an `accounts.json` index entry). Nothing about your current session changes - that account stays active; it's now just also a registered pool member. After this one command you already have a working (single-account) pool. `init` also installs the supervisor + the three settings entries.
   - If the current auth is API-key mode (`ANTHROPIC_API_KEY`/`apiKeyHelper`) rather than a subscription `/login`, there's no quota-poolable subscription credential to import - `init` says so and points you to `/login` first (per-token API billing isn't what tokenmaxxing pools).
 - **`tokenmaxxing add`** - registers *additional* accounts: logs one in via a throwaway `CLAUDE_CONFIG_DIR=~/.config/tokenmaxxing/onboard` (your primary login untouched), harvests it into the store, deletes the temp dir + its namespaced item. This is the **only** time `CLAUDE_CONFIG_DIR` is ever used.
+- **`tokenmaxxing auth [sel | --all]`** - reauthenticates an *existing* pool member whose refresh token died (a needs-reauth account can never heal through a swap: the dead token is exactly what a swap would need). Same isolated-login harvest as `add`, but it states which email to sign in with and **requires the login to land on the target account** (harvested `accountUuid` must match, else nothing changes) - the credential write and the needs-reauth clear happen in one flock critical section so a concurrent swap's harvest cannot clobber the fresh backup. Bare `auth` lists the pool with emails and asks which; `--all` walks every flagged account one by one.
 - Both commands exercise `security` reads/writes interactively (where a macOS keychain ACL prompt is acceptable), so the first access never happens cold inside a headless hook.
 
 ---

package/README.md

@@ -38,6 +38,7 @@ claude                  # use claude as always
 | `tokenmaxxing init --codex` | same for codex: import login, install codex supervisor + Stop hook |
 | `tokenmaxxing add` | register an additional account (isolated login, harvested into the pool) |
 | `tokenmaxxing add --codex` | register an additional codex account (isolated login) |
+| `tokenmaxxing auth [sel \| --all]` | reauthenticate a pooled account in place: bare lists the pool (emails shown) and asks which; a selector targets one account and tells you the email to sign in with; `--all` walks every needs-reauth account one by one |
 | `tokenmaxxing switch --codex [sel]` | switch the codex pool (takes effect on the next codex start) |
 | `tokenmaxxing ls` | list pooled accounts |
 | `tokenmaxxing status` | accounts with 5h / weekly usage bars, active + exhausted-until-reset |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",

package/src/cli/add.ts

@@ -1,109 +1,32 @@
-// `tokenmaxxing add` - register an ADDITIONAL account. Logs one in inside a
-// throwaway CLAUDE_CONFIG_DIR (the ONLY use of CLAUDE_CONFIG_DIR), auto-exits the
-// moment the login lands, samples that account's usage, then harvests its
-// credential + identity into the pool and deletes the temp dir + isolated
-// credential. Your primary login is never touched.
+// `tokenmaxxing add` - register an ADDITIONAL account. Drives one isolated
+// login (see onboard.ts), then pools whatever account it landed on. Your
+// primary login is never touched.
 
-import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { z } from "zod";
-import { readItem, writeItem, deleteItem, parkedTarget, isolatedTarget, claudeAiOauthOnly } from "../lib/credstore.ts";
-import { resolveRealClaude } from "../lib/claudebin.ts";
-import { probeUsage } from "../lib/usage.ts";
-import { saveTermios, restoreTermios } from "../lib/tty.ts";
 import { withLock } from "../lib/lock.ts";
 import { loadAccounts, saveAccounts } from "../lib/state.ts";
 import { credItemFor, paths } from "../lib/paths.ts";
-import { CredentialBlobSchema, OAuthAccountSchema, type Account } from "../lib/types.ts";
+import { writeItem, parkedTarget, claudeAiOauthOnly } from "../lib/credstore.ts";
+import { harvestIsolatedLogin } from "./onboard.ts";
+import { type Account } from "../lib/types.ts";
 import { c, claudeTierLabel, count } from "./render.ts";
 
-/** True once `/login` has written a usable identity into the onboard dir. */
-function identityReady(cjPath: string): boolean {
-  if (!existsSync(cjPath)) return false;
-  try {
-    const oauthAccount = JSON.parse(readFileSync(cjPath, "utf8")).oauthAccount;
-    return z.object({ accountUuid: z.string().min(1) }).safeParse(oauthAccount).success;
-  } catch {
-    return false;
-  }
-}
-
 export async function cmdAdd(): Promise<number> {
-  const onboardDir = paths.onboardDir;
-  rmSync(onboardDir, { recursive: true, force: true });
-  mkdirSync(onboardDir, { recursive: true });
-  const iso = isolatedTarget(onboardDir);
-  const cjPath = join(onboardDir, ".claude.json");
-  const real = resolveRealClaude();
-
   console.log(c.cyan("Opening an isolated Claude login - your primary login is untouched."));
   console.log(c.dim(`In the session that opens, run  ${c.bold("/login")}  with the account to add. It closes itself once you're in.`));
   console.log();
 
-  const savedTermios = saveTermios();
-  // Scrub the ambient credential/identity overrides claude honors BEFORE its
-  // keychain lookup (verified 2.1.205) - the onboard session must authenticate
-  // only via the /login the user performs inside it.
-  const env: Record<string, string> = { ...process.env, CLAUDE_CONFIG_DIR: onboardDir, TOKENMAXXING_PROBE: "1", TOKENMAXXING_SUPERVISED: "" };
-  delete env.ANTHROPIC_API_KEY;
-  delete env.ANTHROPIC_AUTH_TOKEN;
-  delete env.CLAUDE_CODE_OAUTH_TOKEN;
-  delete env.CLAUDE_SECURESTORAGE_CONFIG_DIR;
-  const p = Bun.spawn([real], {
-    stdin: "inherit",
-    stdout: "inherit",
-    stderr: "inherit",
-    env,
-  });
-
-  // Auto-exit (#17): watch for a completed login - identity written AND the
-  // isolated credential present - then SIGTERM claude. No manual /exit.
-  let exited = false;
-  const onExit = p.exited.then(() => { exited = true; });
-  while (!exited) {
-    await Bun.sleep(400);
-    if (identityReady(cjPath) && (await readItem(iso))) {
-      p.kill();
-      break;
-    }
-  }
-  await p.exited;
-  await onExit;
-  restoreTermios(savedTermios);
-
-  const cleanup = async () => {
-    await deleteItem(iso);
-    rmSync(onboardDir, { recursive: true, force: true });
-  };
-
-  const blobRaw = await readItem(iso);
-  if (!blobRaw || !identityReady(cjPath)) {
-    console.error(c.red("no login detected in the isolated session - nothing added."));
-    await cleanup();
-    return 1;
-  }
-
-  let blob, oauthAccount;
-  try {
-    blob = CredentialBlobSchema.parse(JSON.parse(blobRaw));
-    oauthAccount = OAuthAccountSchema.parse(JSON.parse(readFileSync(cjPath, "utf8")).oauthAccount);
-  } catch {
-    console.error(c.red("could not parse the onboarded account's credential/identity."));
-    await cleanup();
-    return 1;
-  }
-
-  // Sample usage now (#16) so the account isn't "not sampled yet" in status/ls.
-  console.log(c.dim("sampling usage..."));
-  const sampled = await probeUsage(onboardDir);
-  if (!sampled) console.log(c.yellow("could not sample usage now - it will fill in on first use."));
+  const harvested = await harvestIsolatedLogin();
+  if (!harvested) return 1;
+  const { blobRaw, blob, oauthAccount, sampled } = harvested;
 
   const uuid = oauthAccount.accountUuid;
   const keychainItem = credItemFor(uuid);
-  await writeItem(parkedTarget(keychainItem), claudeAiOauthOnly(blobRaw)); // park a small backup
 
-  // under the flock: a concurrent swap's index write must not be clobbered.
+  // under the flock: a concurrent swap both harvests into parked items and
+  // writes the index, so the backup write and the index upsert must land in
+  // one critical section.
   const { account, poolSize } = await withLock(paths.lockFile, async () => {
+    await writeItem(parkedTarget(keychainItem), claudeAiOauthOnly(blobRaw)); // park a small backup
     const idx = loadAccounts();
     const existing = idx.accounts.find((a) => a.accountUuid === uuid);
     const fresh: Account = {
@@ -127,8 +50,6 @@ export async function cmdAdd(): Promise<number> {
     return { account: fresh, poolSize: idx.accounts.length };
   });
 
-  await cleanup();
-
   console.log();
   const usageNote = sampled ? ` (session ${sampled.session.usedPercentage}% / week ${sampled.weekAll.usedPercentage}%)` : "";
   console.log(`${c.green("✓")} added ${c.bold(account.email)} (${claudeTierLabel(account) ?? "?"})${usageNote} → pool now has ${count({ n: poolSize, noun: "account" })}`);

package/src/cli/auth.ts

@@ -0,0 +1,177 @@
+// `tokenmaxxing auth` - reauthenticate a pooled account in place. The dead
+// refresh token cannot heal itself (a needs-reauth account can never win a
+// swap), so this drives one isolated login per target and REQUIRES the login
+// to land on the target account: the harvested identity must match, otherwise
+// nothing changes. Bare `auth` lists the pool (emails shown) and asks which;
+// `auth <sel>` targets one account, stating the email to sign in with;
+// `auth --all` walks every needs-reauth account one by one.
+
+import { partition } from "es-toolkit";
+import { z } from "zod";
+import { withLock } from "../lib/lock.ts";
+import { loadAccounts, saveAccounts } from "../lib/state.ts";
+import { paths } from "../lib/paths.ts";
+import { writeItem, parkedTarget, claudeAiOauthOnly } from "../lib/credstore.ts";
+import { findAccount } from "./rename.ts";
+import { harvestIsolatedLogin } from "./onboard.ts";
+import { c, claudeTierLabel, count } from "./render.ts";
+import type { Account, AccountsIndex } from "../lib/types.ts";
+
+const AUTH_USAGE = "usage: tokenmaxxing auth [<email|label|id> | --all]";
+
+export const AuthPlanSchema = z.discriminatedUnion("kind", [
+  /** malformed argv: print AUTH_USAGE, exit 2. */
+  z.object({ kind: z.literal("usage") }),
+  /** unresolvable state (empty pool, unknown selector): exit 1. */
+  z.object({ kind: z.literal("error"), message: z.string() }),
+  /** bare `auth`: ask interactively. */
+  z.object({ kind: z.literal("pick") }),
+  z.object({ kind: z.literal("targets"), uuids: z.array(z.string()) }),
+]);
+export type AuthPlan = z.infer<typeof AuthPlanSchema>;
+
+/** Resolve argv into a reauth plan (pure - unit-tested). Argv shape is
+ *  validated before any pool state is consulted. */
+export function planAuth(input: { accounts: Account[]; argv: string[] }): AuthPlan {
+  const all = input.argv.includes("--all");
+  const rest = input.argv.filter((a) => a !== "--all");
+  if ((all && rest.length > 0) || rest.length > 1) return { kind: "usage" };
+  if (input.accounts.length === 0) return { kind: "error", message: "no accounts in the pool - run `tokenmaxxing init` first" };
+  if (all) {
+    const flagged = input.accounts.filter((a) => a.needsReauth === true);
+    return { kind: "targets", uuids: flagged.map((a) => a.accountUuid) };
+  }
+  const selector = rest[0];
+  if (selector !== undefined) {
+    const found = findAccount(input.accounts, selector);
+    if (!found) return { kind: "error", message: `no claude account matches "${selector}"` };
+    return { kind: "targets", uuids: [found.accountUuid] };
+  }
+  return { kind: "pick" };
+}
+
+/** Needs-reauth accounts first (they are why the user is here), pool order within. */
+export function pickerOrder(accounts: Account[]): Account[] {
+  const [flagged, healthy] = partition(accounts, (a) => a.needsReauth === true);
+  return [...flagged, ...healthy];
+}
+
+function askWhichAccount(idx: AccountsIndex): Account | null {
+  const ordered = pickerOrder(idx.accounts);
+  console.log("which account do you want to reauthenticate?");
+  for (const [i, a] of ordered.entries()) {
+    const flags: string[] = [];
+    if (a.accountUuid === idx.activeAccountUuid) flags.push(c.green("active"));
+    if (a.needsReauth) flags.push(c.red("needs-reauth"));
+    const labelNote = a.label && a.label !== a.email ? ` (${a.label})` : "";
+    const tag = flags.length ? ` ${flags.join(" ")}` : "";
+    console.log(`  ${i + 1}. ${c.bold(a.email)}${labelNote}${tag}`);
+  }
+  const answer = prompt("account (number, email, or label):")?.trim();
+  if (!answer) {
+    console.error(c.red("nothing selected"));
+    return null;
+  }
+  const n = Number(answer);
+  const byNumber = Number.isInteger(n) && n >= 1 && n <= ordered.length ? ordered[n - 1] : undefined;
+  const chosen = byNumber ?? findAccount(ordered, answer);
+  if (!chosen) {
+    console.error(c.red(`no account matches "${answer}"`));
+    return null;
+  }
+  return chosen;
+}
+
+async function reauthOne(target: Account): Promise<boolean> {
+  console.log(c.cyan(`Reauthenticating ${c.bold(target.label)} - sign in as  ${c.bold(target.email)}.`));
+  console.log(c.dim(`In the session that opens, run  ${c.bold("/login")}  with that account. It closes itself once you're in.`));
+  console.log();
+
+  const harvested = await harvestIsolatedLogin();
+  if (!harvested) return false;
+  const { blobRaw, blob, oauthAccount, sampled } = harvested;
+
+  if (oauthAccount.accountUuid !== target.accountUuid) {
+    console.error(
+      c.red(
+        `that login is ${c.bold(oauthAccount.emailAddress)}, but ${target.label} is ${c.bold(target.email)} - nothing changed. To pool it as its own account, run \`tokenmaxxing add\`.`,
+      ),
+    );
+    return false;
+  }
+
+  // under the flock: a concurrent swap both harvests into parked items and
+  // writes the index, so the credential write and the needsReauth clear must
+  // land in one critical section (else a swap-away harvest of the live blob
+  // could overwrite this fresh backup right before it is marked healthy).
+  const isActive = await withLock(paths.lockFile, async () => {
+    await writeItem(parkedTarget(target.keychainItem), claudeAiOauthOnly(blobRaw));
+    const idx = loadAccounts();
+    const account = idx.accounts.find((a) => a.accountUuid === target.accountUuid);
+    if (account) {
+      account.email = oauthAccount.emailAddress;
+      account.organizationUuid = oauthAccount.organizationUuid;
+      account.oauthAccount = oauthAccount;
+      account.subscriptionType = blob.claudeAiOauth.subscriptionType;
+      account.rateLimitTier = blob.claudeAiOauth.rateLimitTier;
+      account.needsReauth = false;
+      if (sampled) {
+        account.lastUsage = { fiveHour: sampled.session, sevenDay: sampled.weekAll };
+        if (Object.keys(sampled.perModel).length > 0) account.lastPerModel = sampled.perModel;
+        account.lastUsageAt = Date.now();
+      }
+      saveAccounts(idx);
+    }
+    return idx.activeAccountUuid === target.accountUuid;
+  });
+
+  const usageNote = sampled ? ` (session ${sampled.session.usedPercentage}% / week ${sampled.weekAll.usedPercentage}%)` : "";
+  const tier = claudeTierLabel(blob.claudeAiOauth) ?? "?";
+  console.log(`${c.green("✓")} reauthed ${c.bold(oauthAccount.emailAddress)} (${tier})${usageNote}`);
+  if (isActive) {
+    console.log(c.dim("this account is the active one: the fresh credential is parked as its backup; the live session keeps its current token until the next swap."));
+  }
+  return true;
+}
+
+export async function cmdAuth(argv: string[]): Promise<number> {
+  const idx = loadAccounts();
+  const plan = planAuth({ accounts: idx.accounts, argv });
+  if (plan.kind === "usage") {
+    console.error(AUTH_USAGE);
+    return 2;
+  }
+  if (plan.kind === "error") {
+    console.error(c.red(plan.message));
+    return 1;
+  }
+
+  const targets: Account[] = [];
+  if (plan.kind === "pick") {
+    const picked = askWhichAccount(idx);
+    if (!picked) return 1;
+    targets.push(picked);
+  } else {
+    for (const uuid of plan.uuids) {
+      const account = idx.accounts.find((a) => a.accountUuid === uuid);
+      if (account) targets.push(account);
+    }
+    if (targets.length === 0) {
+      console.log(`${c.green("✓")} no account needs reauth`);
+      return 0;
+    }
+  }
+
+  let ok = 0;
+  for (const [i, target] of targets.entries()) {
+    console.log();
+    if (targets.length > 1) console.log(c.bold(`[${i + 1}/${targets.length}]`));
+    if (await reauthOne(target)) ok += 1;
+  }
+
+  if (targets.length > 1) {
+    console.log();
+    console.log(`reauthed ${count({ n: ok, noun: "account" })} of ${targets.length}`);
+  }
+  return ok === targets.length ? 0 : 1;
+}

package/src/cli/doctor.ts

@@ -60,17 +60,17 @@ export async function cmdDoctor(): Promise<number> {
 
   for (const a of idx.accounts) {
     const parked = await readItem(parkedTarget(a.keychainItem));
-    check(!!parked, `parked credential present for ${a.email}`, "re-run `tokenmaxxing init`/`add`");
+    check(!!parked, `parked credential present for ${a.email}`, `run \`tokenmaxxing auth ${a.label}\``);
     if (parked) {
       try {
         const org = await blobOrg(parked);
-        if (org) check(org.organization_uuid === a.organizationUuid, `parked credential identity matches ${a.email}`, `token belongs to ${org.organization_name} - re-auth with \`tokenmaxxing add\``);
+        if (org) check(org.organization_uuid === a.organizationUuid, `parked credential identity matches ${a.email}`, `token belongs to ${org.organization_name} - run \`tokenmaxxing auth ${a.label}\``);
         else console.log(c.dim(`  - ${a.email} identity unverifiable (access token expired)`));
       } catch (e) {
         check(false, `parked credential identity matches ${a.email}`, String((e as Error).message ?? e).slice(0, 100));
       }
     }
-    if (a.needsReauth) check(false, `${a.email} needs re-auth`, "run `tokenmaxxing add` to re-login");
+    if (a.needsReauth) check(false, `${a.email} needs re-auth`, `run \`tokenmaxxing auth ${a.label}\` to re-login`);
   }
 
   const cfg = loadConfig();

package/src/cli/onboard.ts

@@ -0,0 +1,112 @@
+// One isolated Claude login, harvested. Shared by `add` (register whatever
+// account the login lands on) and `auth` (require it to match an existing
+// account). Drives the login in a throwaway CLAUDE_CONFIG_DIR - the ONLY use
+// of CLAUDE_CONFIG_DIR in the tool - auto-exits the moment the login lands,
+// samples that account's usage, then returns the credential + identity. The
+// temp dir and isolated credential are always destroyed before returning.
+
+import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { z } from "zod";
+import { readItem, deleteItem, isolatedTarget } from "../lib/credstore.ts";
+import { resolveRealClaude } from "../lib/claudebin.ts";
+import { probeUsage, FullUsageSchema } from "../lib/usage.ts";
+import { saveTermios, restoreTermios } from "../lib/tty.ts";
+import { paths } from "../lib/paths.ts";
+import { CredentialBlobSchema, OAuthAccountSchema } from "../lib/types.ts";
+import { c } from "./render.ts";
+
+export const HarvestedLoginSchema = z.object({
+  /** the raw isolated credential blob (park it via claudeAiOauthOnly). */
+  blobRaw: z.string(),
+  blob: CredentialBlobSchema,
+  oauthAccount: OAuthAccountSchema,
+  sampled: FullUsageSchema.nullable(),
+});
+export type HarvestedLogin = z.infer<typeof HarvestedLoginSchema>;
+
+/** True once `/login` has written a usable identity into the onboard dir. */
+function identityReady(cjPath: string): boolean {
+  if (!existsSync(cjPath)) return false;
+  try {
+    const oauthAccount = JSON.parse(readFileSync(cjPath, "utf8")).oauthAccount;
+    return z.object({ accountUuid: z.string().min(1) }).safeParse(oauthAccount).success;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Run one isolated login session and harvest it. The caller prints its own
+ * instructions (which account to sign in as) BEFORE calling. Prints progress
+ * and failure diagnostics; returns null when no usable login landed.
+ */
+export async function harvestIsolatedLogin(): Promise<HarvestedLogin | null> {
+  const onboardDir = paths.onboardDir;
+  rmSync(onboardDir, { recursive: true, force: true });
+  mkdirSync(onboardDir, { recursive: true });
+  const iso = isolatedTarget(onboardDir);
+  const cjPath = join(onboardDir, ".claude.json");
+  const real = resolveRealClaude();
+
+  const savedTermios = saveTermios();
+  // Scrub the ambient credential/identity overrides claude honors BEFORE its
+  // keychain lookup (verified 2.1.205) - the onboard session must authenticate
+  // only via the /login the user performs inside it.
+  const env: Record<string, string> = { ...process.env, CLAUDE_CONFIG_DIR: onboardDir, TOKENMAXXING_PROBE: "1", TOKENMAXXING_SUPERVISED: "" };
+  delete env.ANTHROPIC_API_KEY;
+  delete env.ANTHROPIC_AUTH_TOKEN;
+  delete env.CLAUDE_CODE_OAUTH_TOKEN;
+  delete env.CLAUDE_SECURESTORAGE_CONFIG_DIR;
+  const p = Bun.spawn([real], {
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+    env,
+  });
+
+  // Auto-exit (#17): watch for a completed login - identity written AND the
+  // isolated credential present - then SIGTERM claude. No manual /exit.
+  let exited = false;
+  const onExit = p.exited.then(() => { exited = true; });
+  while (!exited) {
+    await Bun.sleep(400);
+    if (identityReady(cjPath) && (await readItem(iso))) {
+      p.kill();
+      break;
+    }
+  }
+  await p.exited;
+  await onExit;
+  restoreTermios(savedTermios);
+
+  const cleanup = async () => {
+    await deleteItem(iso);
+    rmSync(onboardDir, { recursive: true, force: true });
+  };
+
+  const blobRaw = await readItem(iso);
+  if (!blobRaw || !identityReady(cjPath)) {
+    console.error(c.red("no login detected in the isolated session - nothing changed."));
+    await cleanup();
+    return null;
+  }
+
+  let blob, oauthAccount;
+  try {
+    blob = CredentialBlobSchema.parse(JSON.parse(blobRaw));
+    oauthAccount = OAuthAccountSchema.parse(JSON.parse(readFileSync(cjPath, "utf8")).oauthAccount);
+  } catch {
+    console.error(c.red("could not parse the onboarded account's credential/identity."));
+    await cleanup();
+    return null;
+  }
+
+  // Sample usage now (#16) so the account isn't "not sampled yet" in status/ls.
+  console.log(c.dim("sampling usage..."));
+  const sampled = await probeUsage(onboardDir);
+  if (!sampled) console.log(c.yellow("could not sample usage now - it will fill in on first use."));
+
+  await cleanup();
+  return { blobRaw, blob, oauthAccount, sampled };
+}

package/src/cli/switch.ts

@@ -43,7 +43,7 @@ export async function cmdSwitch(selector?: string): Promise<number> {
       try {
         await performSwap(target);
       } catch (e) {
-        if (e instanceof InvalidGrantError) { console.error(c.red(`${target.label}'s refresh token is dead - re-add it`)); return 1; }
+        if (e instanceof InvalidGrantError) { console.error(c.red(`${target.label}'s refresh token is dead - run \`tokenmaxxing auth ${target.label}\``)); return 1; }
         throw e;
       }
       console.log(`${c.green("↻")} switched to ${c.bold(target.label)}`);
@@ -86,7 +86,7 @@ export async function cmdSwitch(selector?: string): Promise<number> {
       // Either every account needs re-auth, or every account is blocked with no
       // recoverable bound (unparsed reset clocks AND no sample time - see log).
       const reauth = fresh.accounts.filter((a) => a.needsReauth).map((a) => a.label);
-      if (reauth.length > 0) { console.error(c.yellow(`no switchable account - re-auth needed: ${reauth.join(", ")}`)); return 1; }
+      if (reauth.length > 0) { console.error(c.yellow(`no switchable account - reauth needed (run \`tokenmaxxing auth --all\`): ${reauth.join(", ")}`)); return 1; }
       // never freeze a label drift behind a no-op (see header).
       if (drifted && active) return swapTo(active);
       console.log(c.yellow("all accounts at their limit with unknown reset times (unparsed reset clocks? see tokenmaxxing.log) - staying put"));

package/src/lib/sample.ts

@@ -68,13 +68,13 @@ function refreshPlanFields(account: Account, creds: OAuthCreds): void {
 export async function probeParkedUsage(account: Account, opts: { ping?: boolean } = {}): Promise<SampleOutcome> {
   const backup = parkedTarget(account.keychainItem);
   const parkedRaw = await readItem(backup);
-  if (!parkedRaw) return { ok: false, reason: "no parked credential - re-add with `tokenmaxxing add`" };
+  if (!parkedRaw) return { ok: false, reason: "no parked credential - run `tokenmaxxing auth`" };
 
   let creds: OAuthCreds;
   try {
     creds = CredentialBlobSchema.parse(JSON.parse(parkedRaw)).claudeAiOauth;
   } catch (e) {
-    return { ok: false, reason: `parked credential unreadable (${String((e as Error).message ?? e).slice(0, 80)}) - re-add with \`tokenmaxxing add\`` };
+    return { ok: false, reason: `parked credential unreadable (${String((e as Error).message ?? e).slice(0, 80)}) - run \`tokenmaxxing auth\`` };
   }
 
   // Hand claude a token with comfortable headroom so it won't run its own refresh

package/src/main.ts

@@ -10,6 +10,7 @@ import { runStopHook } from "./entries/stophook.ts";
 import { runSessionStart } from "./entries/sessionstart.ts";
 import { cmdInit } from "./cli/init.ts";
 import { cmdAdd } from "./cli/add.ts";
+import { cmdAuth } from "./cli/auth.ts";
 import { cmdCodexAdd } from "./cli/codexadd.ts";
 import { cmdCodexInit } from "./cli/codexinit.ts";
 import { cmdCodexSwitch } from "./cli/codexswitch.ts";
@@ -37,6 +38,7 @@ function printHelp(): void {
   ${c.cyan("tokenmaxxing init --codex")}  same for codex: import login, install codex supervisor + Stop hook (trust it via /hooks)
   ${c.cyan("tokenmaxxing add")}        register an additional account (isolated login)
   ${c.cyan("tokenmaxxing add --codex")}   register an additional codex account (isolated login)
+  ${c.cyan("tokenmaxxing auth")} [sel | --all]  reauthenticate a pooled account in place (bare = pick from a list; --all = every needs-reauth account, one by one)
   ${c.cyan("tokenmaxxing switch --codex")} [sel]  switch the codex pool (takes effect on next codex start)
   ${c.cyan("tokenmaxxing ls")}         list pooled accounts
   ${c.cyan("tokenmaxxing status")}     accounts with 5h / weekly / per-model usage bars
@@ -80,6 +82,7 @@ async function main(): Promise<number> {
     case "config": return cmdConfig(args.slice(1));
     case "init": return args.includes("--codex") ? cmdCodexInit() : cmdInit();
     case "add": return args.includes("--codex") ? cmdCodexAdd() : cmdAdd();
+    case "auth": return cmdAuth(args.slice(1));
     case "ls": return cmdLs();
     case "status": return cmdStatus(args.includes("--force"));
     case "watch": return cmdWatch(args[1]);