tokenmaxxing 0.16.0 → 0.18.0

package/DESIGN.md

@@ -28,7 +28,7 @@ It is a process/PTY manager only - spawn, forward the terminal, wait, restore te
 ## 2. What tokenmaxxing installs
 
 - A `claude` **supervisor** on your PATH ahead of the real binary (`~/.config/tokenmaxxing/bin/claude`), or a shell function - you invoke it identically.
-- Three `~/.claude/settings.json` entries (merged, preserving anything you already have): a transparent `statusLine` shim, a `Stop` hook, a `SessionStart` hook.
+- Four `~/.claude/settings.json` entries (merged, preserving anything you already have): a transparent `statusLine` shim, a `subagentStatusLine` shim (per-subagent rows in the agents panel), a `Stop` hook, a `SessionStart` hook.
 - **`~/.config/tokenmaxxing/`** - the single home for config and state:
   - `config.json` - threshold, account order/policy.
   - `accounts.json` - non-secret index `{email, organizationUuid, accountUuid, lastUsage, resetsAt, needs_reauth}`.
@@ -71,6 +71,7 @@ Each terminal ran the supervisor, so each has its own child `claude` and its own
 - **`tokenmaxxing init` imports the account you're already on - automatically, no prompts, no re-login.** It reads the live `Claude Code-credentials` keychain blob plus the `oauthAccount` object in `~/.claude.json` (email, `organizationUuid`, `accountUuid`, plan tier) and writes them as **account #1** into tokenmaxxing's store (`tokenmaxxing-cred-<accountUuid[:8]>` + an `accounts.json` index entry). Nothing about your current session changes - that account stays active; it's now just also a registered pool member. After this one command you already have a working (single-account) pool. `init` also installs the supervisor + the three settings entries.
   - If the current auth is API-key mode (`ANTHROPIC_API_KEY`/`apiKeyHelper`) rather than a subscription `/login`, there's no quota-poolable subscription credential to import - `init` says so and points you to `/login` first (per-token API billing isn't what tokenmaxxing pools).
 - **`tokenmaxxing add`** - registers *additional* accounts: logs one in via a throwaway `CLAUDE_CONFIG_DIR=~/.config/tokenmaxxing/onboard` (your primary login untouched), harvests it into the store, deletes the temp dir + its namespaced item. This is the **only** time `CLAUDE_CONFIG_DIR` is ever used.
+- **`tokenmaxxing auth [sel | --all]`** - reauthenticates an *existing* pool member whose refresh token died (a needs-reauth account can never heal through a swap: the dead token is exactly what a swap would need). Same isolated-login harvest as `add`, but it states which email to sign in with and **requires the login to land on the target account** (harvested `accountUuid` must match, else nothing changes) - the credential write and the needs-reauth clear happen in one flock critical section so a concurrent swap's harvest cannot clobber the fresh backup. Bare `auth` lists the pool with emails and asks which; `--all` walks every flagged account one by one.
 - Both commands exercise `security` reads/writes interactively (where a macOS keychain ACL prompt is acceptable), so the first access never happens cold inside a headless hook.
 
 ---
@@ -82,6 +83,18 @@ The decision engages at `five_hour >= 50%` (policy.greedySessionFloor): from the
 
 ---
 
+## 5b. The Slack bridge (`xx serve`, 0.18.0)
+
+A local Socket Mode daemon (no public URL) that turns Slack threads into Claude Code sessions on the pooled accounts. Stack (user decision 2026-07-18): Vercel's Chat SDK (`chat` + `@chat-adapter/slack`) for the Slack side; the Claude Agent SDK driven through `src/sdk.ts`'s pooled surface for the claude side - `xx serve` is that surface's first in-repo consumer. EVE (Vercel's agent framework) was researched and explicitly dropped: it owns its own model loop via AI Gateway, so it would replace Claude Code rather than drive it.
+
+- **Config**: `slack.json` (0600 - it holds the xoxb-/xapp- tokens) with per-channel links `{channel, repo, worktree, permissionMode, model?}`. `serve setup` prints the app manifest (minimal scopes: app_mentions:read, channels:history, groups:history, chat:write, files:write, users:read + socket mode) and prompts for the tokens; `serve link <channel-id> <repo>` manages links (channel IDs only - names drift, ids don't).
+- **Thread = session**: a bot mention in a linked channel subscribes the thread, creates `slack-worktrees/<threadKey>` (branch `tm-slack-<threadKey>` cut from the repo's HEAD; `--no-worktree` links run in the repo itself), and records `{threadId, cwd, sessionId}` under `slack-threads/`. Resume is cwd-keyed in claude, so the cwd stays byte-stable for the thread's life; worktrees are never auto-deleted (they hold the thread's work).
+- **Turn = spawn**: each thread message runs ONE `query()` with `resume: sessionId` (never a persistent streaming query - the SDK subprocess reads credentials at spawn, so per-turn spawns are what let `ensureBestAccount()` land each turn on the freshest account, and the daemon can restart without losing threads). `stopHookCheck` rides along as the SDK Stop hook. Streamed `text_delta`s feed `thread.post(AsyncIterable)` (the adapter debounces edits); tool-only turns post the final result text.
+- **Safety posture**: per-link `permissionMode`, default `acceptEdits`; `--dangerous` opts a link into `bypassPermissions`. Turn failures post a trimmed message-only diagnostic (never a raw error body). The socket loop aborts visibly after 3 consecutive connection failures.
+- **Verified hermetically** (2026-07-18): schema/link management, worktree creation + idempotency, arg parsing, daemon fail-fast paths. **Not yet live-verified**: a real Socket Mode connection under Bun (needs real tokens; the underlying ws/undici primitives tested clean) and a real relayed turn (meters an account). Run one live smoke test before relying on it.
+
+---
+
 ## 6. Honest papercuts
 - **Respawn hiccup (depleted pause only).** Plain swaps never restart the session. When the whole pool is depleted you see `claude` stop, a countdown, and a resume; anything typed in the split second before the SIGTERM is lost, and the supervisor resets terminal mode so nothing is left garbled.
 - **Adoption lag.** macOS reads the keychain through a raw 30s cache, so at most the first turn after a swap can still meter the old account. The bars' headroom absorbs it.

package/README.md

@@ -38,12 +38,14 @@ claude                  # use claude as always
 | `tokenmaxxing init --codex` | same for codex: import login, install codex supervisor + Stop hook |
 | `tokenmaxxing add` | register an additional account (isolated login, harvested into the pool) |
 | `tokenmaxxing add --codex` | register an additional codex account (isolated login) |
+| `tokenmaxxing auth [sel \| --all]` | reauthenticate a pooled account in place: bare lists the pool (emails shown) and asks which; a selector targets one account and tells you the email to sign in with; `--all` walks every needs-reauth account one by one |
 | `tokenmaxxing switch --codex [sel]` | switch the codex pool (takes effect on the next codex start) |
 | `tokenmaxxing ls` | list pooled accounts |
 | `tokenmaxxing status` | accounts with 5h / weekly usage bars, active + exhausted-until-reset |
 | `tokenmaxxing status --force` | additionally ping every account (one tiny haiku request each) so all 5h session timers start now, then sample fresh |
 | `tokenmaxxing watch [seconds]` | live status: re-render every N seconds (default 120, floor 30; never pings) |
 | `tokenmaxxing config` | effective config with sources; `get`/`set`/`unset` dotted keys, `tidy` prunes unknown keys |
+| `tokenmaxxing serve` | Slack bridge daemon (Socket Mode, no public URL): `setup` prints the app manifest and stores the two tokens, `link <channel-id> <repo>` ties a channel to a repo, then mentioning the bot in that channel opens a Claude Code session per thread (own git worktree by default) and thread messages relay in and out |
 | `tokenmaxxing doctor` | verify the supervisor + settings entries survived |
 | `tokenmaxxing rename [--codex] <sel> <label>` / `rm <sel>` | manage the pool (`--codex` targets the codex pool: one email can hold both a claude and a codex account) |
 | `tokenmaxxing uninstall` | remove supervisor + settings entries (accounts/credentials kept) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",
@@ -40,6 +40,10 @@
     "typescript": "^5.6.0"
   },
   "dependencies": {
+    "@anthropic-ai/claude-agent-sdk": "^0.3.214",
+    "@chat-adapter/slack": "^4.34.0",
+    "@chat-adapter/state-memory": "^4.34.0",
+    "chat": "^4.34.0",
     "es-toolkit": "^1.49.0",
     "ky": "^2.0.2",
     "zod": "^4.4.3"

package/src/cli/add.ts

@@ -1,109 +1,32 @@
-// `tokenmaxxing add` - register an ADDITIONAL account. Logs one in inside a
-// throwaway CLAUDE_CONFIG_DIR (the ONLY use of CLAUDE_CONFIG_DIR), auto-exits the
-// moment the login lands, samples that account's usage, then harvests its
-// credential + identity into the pool and deletes the temp dir + isolated
-// credential. Your primary login is never touched.
+// `tokenmaxxing add` - register an ADDITIONAL account. Drives one isolated
+// login (see onboard.ts), then pools whatever account it landed on. Your
+// primary login is never touched.
 
-import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { z } from "zod";
-import { readItem, writeItem, deleteItem, parkedTarget, isolatedTarget, claudeAiOauthOnly } from "../lib/credstore.ts";
-import { resolveRealClaude } from "../lib/claudebin.ts";
-import { probeUsage } from "../lib/usage.ts";
-import { saveTermios, restoreTermios } from "../lib/tty.ts";
 import { withLock } from "../lib/lock.ts";
 import { loadAccounts, saveAccounts } from "../lib/state.ts";
 import { credItemFor, paths } from "../lib/paths.ts";
-import { CredentialBlobSchema, OAuthAccountSchema, type Account } from "../lib/types.ts";
+import { writeItem, parkedTarget, claudeAiOauthOnly } from "../lib/credstore.ts";
+import { harvestIsolatedLogin } from "./onboard.ts";
+import { type Account } from "../lib/types.ts";
 import { c, claudeTierLabel, count } from "./render.ts";
 
-/** True once `/login` has written a usable identity into the onboard dir. */
-function identityReady(cjPath: string): boolean {
-  if (!existsSync(cjPath)) return false;
-  try {
-    const oauthAccount = JSON.parse(readFileSync(cjPath, "utf8")).oauthAccount;
-    return z.object({ accountUuid: z.string().min(1) }).safeParse(oauthAccount).success;
-  } catch {
-    return false;
-  }
-}
-
 export async function cmdAdd(): Promise<number> {
-  const onboardDir = paths.onboardDir;
-  rmSync(onboardDir, { recursive: true, force: true });
-  mkdirSync(onboardDir, { recursive: true });
-  const iso = isolatedTarget(onboardDir);
-  const cjPath = join(onboardDir, ".claude.json");
-  const real = resolveRealClaude();
-
   console.log(c.cyan("Opening an isolated Claude login - your primary login is untouched."));
   console.log(c.dim(`In the session that opens, run  ${c.bold("/login")}  with the account to add. It closes itself once you're in.`));
   console.log();
 
-  const savedTermios = saveTermios();
-  // Scrub the ambient credential/identity overrides claude honors BEFORE its
-  // keychain lookup (verified 2.1.205) - the onboard session must authenticate
-  // only via the /login the user performs inside it.
-  const env: Record<string, string> = { ...process.env, CLAUDE_CONFIG_DIR: onboardDir, TOKENMAXXING_PROBE: "1", TOKENMAXXING_SUPERVISED: "" };
-  delete env.ANTHROPIC_API_KEY;
-  delete env.ANTHROPIC_AUTH_TOKEN;
-  delete env.CLAUDE_CODE_OAUTH_TOKEN;
-  delete env.CLAUDE_SECURESTORAGE_CONFIG_DIR;
-  const p = Bun.spawn([real], {
-    stdin: "inherit",
-    stdout: "inherit",
-    stderr: "inherit",
-    env,
-  });
-
-  // Auto-exit (#17): watch for a completed login - identity written AND the
-  // isolated credential present - then SIGTERM claude. No manual /exit.
-  let exited = false;
-  const onExit = p.exited.then(() => { exited = true; });
-  while (!exited) {
-    await Bun.sleep(400);
-    if (identityReady(cjPath) && (await readItem(iso))) {
-      p.kill();
-      break;
-    }
-  }
-  await p.exited;
-  await onExit;
-  restoreTermios(savedTermios);
-
-  const cleanup = async () => {
-    await deleteItem(iso);
-    rmSync(onboardDir, { recursive: true, force: true });
-  };
-
-  const blobRaw = await readItem(iso);
-  if (!blobRaw || !identityReady(cjPath)) {
-    console.error(c.red("no login detected in the isolated session - nothing added."));
-    await cleanup();
-    return 1;
-  }
-
-  let blob, oauthAccount;
-  try {
-    blob = CredentialBlobSchema.parse(JSON.parse(blobRaw));
-    oauthAccount = OAuthAccountSchema.parse(JSON.parse(readFileSync(cjPath, "utf8")).oauthAccount);
-  } catch {
-    console.error(c.red("could not parse the onboarded account's credential/identity."));
-    await cleanup();
-    return 1;
-  }
-
-  // Sample usage now (#16) so the account isn't "not sampled yet" in status/ls.
-  console.log(c.dim("sampling usage..."));
-  const sampled = await probeUsage(onboardDir);
-  if (!sampled) console.log(c.yellow("could not sample usage now - it will fill in on first use."));
+  const harvested = await harvestIsolatedLogin();
+  if (!harvested) return 1;
+  const { blobRaw, blob, oauthAccount, sampled } = harvested;
 
   const uuid = oauthAccount.accountUuid;
   const keychainItem = credItemFor(uuid);
-  await writeItem(parkedTarget(keychainItem), claudeAiOauthOnly(blobRaw)); // park a small backup
 
-  // under the flock: a concurrent swap's index write must not be clobbered.
+  // under the flock: a concurrent swap both harvests into parked items and
+  // writes the index, so the backup write and the index upsert must land in
+  // one critical section.
   const { account, poolSize } = await withLock(paths.lockFile, async () => {
+    await writeItem(parkedTarget(keychainItem), claudeAiOauthOnly(blobRaw)); // park a small backup
     const idx = loadAccounts();
     const existing = idx.accounts.find((a) => a.accountUuid === uuid);
     const fresh: Account = {
@@ -127,8 +50,6 @@ export async function cmdAdd(): Promise<number> {
     return { account: fresh, poolSize: idx.accounts.length };
   });
 
-  await cleanup();
-
   console.log();
   const usageNote = sampled ? ` (session ${sampled.session.usedPercentage}% / week ${sampled.weekAll.usedPercentage}%)` : "";
   console.log(`${c.green("✓")} added ${c.bold(account.email)} (${claudeTierLabel(account) ?? "?"})${usageNote} → pool now has ${count({ n: poolSize, noun: "account" })}`);

package/src/cli/auth.ts

@@ -0,0 +1,177 @@
+// `tokenmaxxing auth` - reauthenticate a pooled account in place. The dead
+// refresh token cannot heal itself (a needs-reauth account can never win a
+// swap), so this drives one isolated login per target and REQUIRES the login
+// to land on the target account: the harvested identity must match, otherwise
+// nothing changes. Bare `auth` lists the pool (emails shown) and asks which;
+// `auth <sel>` targets one account, stating the email to sign in with;
+// `auth --all` walks every needs-reauth account one by one.
+
+import { partition } from "es-toolkit";
+import { z } from "zod";
+import { withLock } from "../lib/lock.ts";
+import { loadAccounts, saveAccounts } from "../lib/state.ts";
+import { paths } from "../lib/paths.ts";
+import { writeItem, parkedTarget, claudeAiOauthOnly } from "../lib/credstore.ts";
+import { findAccount } from "./rename.ts";
+import { harvestIsolatedLogin } from "./onboard.ts";
+import { c, claudeTierLabel, count } from "./render.ts";
+import type { Account, AccountsIndex } from "../lib/types.ts";
+
+const AUTH_USAGE = "usage: tokenmaxxing auth [<email|label|id> | --all]";
+
+export const AuthPlanSchema = z.discriminatedUnion("kind", [
+  /** malformed argv: print AUTH_USAGE, exit 2. */
+  z.object({ kind: z.literal("usage") }),
+  /** unresolvable state (empty pool, unknown selector): exit 1. */
+  z.object({ kind: z.literal("error"), message: z.string() }),
+  /** bare `auth`: ask interactively. */
+  z.object({ kind: z.literal("pick") }),
+  z.object({ kind: z.literal("targets"), uuids: z.array(z.string()) }),
+]);
+export type AuthPlan = z.infer<typeof AuthPlanSchema>;
+
+/** Resolve argv into a reauth plan (pure - unit-tested). Argv shape is
+ *  validated before any pool state is consulted. */
+export function planAuth(input: { accounts: Account[]; argv: string[] }): AuthPlan {
+  const all = input.argv.includes("--all");
+  const rest = input.argv.filter((a) => a !== "--all");
+  if ((all && rest.length > 0) || rest.length > 1) return { kind: "usage" };
+  if (input.accounts.length === 0) return { kind: "error", message: "no accounts in the pool - run `tokenmaxxing init` first" };
+  if (all) {
+    const flagged = input.accounts.filter((a) => a.needsReauth === true);
+    return { kind: "targets", uuids: flagged.map((a) => a.accountUuid) };
+  }
+  const selector = rest[0];
+  if (selector !== undefined) {
+    const found = findAccount(input.accounts, selector);
+    if (!found) return { kind: "error", message: `no claude account matches "${selector}"` };
+    return { kind: "targets", uuids: [found.accountUuid] };
+  }
+  return { kind: "pick" };
+}
+
+/** Needs-reauth accounts first (they are why the user is here), pool order within. */
+export function pickerOrder(accounts: Account[]): Account[] {
+  const [flagged, healthy] = partition(accounts, (a) => a.needsReauth === true);
+  return [...flagged, ...healthy];
+}
+
+function askWhichAccount(idx: AccountsIndex): Account | null {
+  const ordered = pickerOrder(idx.accounts);
+  console.log("which account do you want to reauthenticate?");
+  for (const [i, a] of ordered.entries()) {
+    const flags: string[] = [];
+    if (a.accountUuid === idx.activeAccountUuid) flags.push(c.green("active"));
+    if (a.needsReauth) flags.push(c.red("needs-reauth"));
+    const labelNote = a.label && a.label !== a.email ? ` (${a.label})` : "";
+    const tag = flags.length ? ` ${flags.join(" ")}` : "";
+    console.log(`  ${i + 1}. ${c.bold(a.email)}${labelNote}${tag}`);
+  }
+  const answer = prompt("account (number, email, or label):")?.trim();
+  if (!answer) {
+    console.error(c.red("nothing selected"));
+    return null;
+  }
+  const n = Number(answer);
+  const byNumber = Number.isInteger(n) && n >= 1 && n <= ordered.length ? ordered[n - 1] : undefined;
+  const chosen = byNumber ?? findAccount(ordered, answer);
+  if (!chosen) {
+    console.error(c.red(`no account matches "${answer}"`));
+    return null;
+  }
+  return chosen;
+}
+
+async function reauthOne(target: Account): Promise<boolean> {
+  console.log(c.cyan(`Reauthenticating ${c.bold(target.label)} - sign in as  ${c.bold(target.email)}.`));
+  console.log(c.dim(`In the session that opens, run  ${c.bold("/login")}  with that account. It closes itself once you're in.`));
+  console.log();
+
+  const harvested = await harvestIsolatedLogin();
+  if (!harvested) return false;
+  const { blobRaw, blob, oauthAccount, sampled } = harvested;
+
+  if (oauthAccount.accountUuid !== target.accountUuid) {
+    console.error(
+      c.red(
+        `that login is ${c.bold(oauthAccount.emailAddress)}, but ${target.label} is ${c.bold(target.email)} - nothing changed. To pool it as its own account, run \`tokenmaxxing add\`.`,
+      ),
+    );
+    return false;
+  }
+
+  // under the flock: a concurrent swap both harvests into parked items and
+  // writes the index, so the credential write and the needsReauth clear must
+  // land in one critical section (else a swap-away harvest of the live blob
+  // could overwrite this fresh backup right before it is marked healthy).
+  const isActive = await withLock(paths.lockFile, async () => {
+    await writeItem(parkedTarget(target.keychainItem), claudeAiOauthOnly(blobRaw));
+    const idx = loadAccounts();
+    const account = idx.accounts.find((a) => a.accountUuid === target.accountUuid);
+    if (account) {
+      account.email = oauthAccount.emailAddress;
+      account.organizationUuid = oauthAccount.organizationUuid;
+      account.oauthAccount = oauthAccount;
+      account.subscriptionType = blob.claudeAiOauth.subscriptionType;
+      account.rateLimitTier = blob.claudeAiOauth.rateLimitTier;
+      account.needsReauth = false;
+      if (sampled) {
+        account.lastUsage = { fiveHour: sampled.session, sevenDay: sampled.weekAll };
+        if (Object.keys(sampled.perModel).length > 0) account.lastPerModel = sampled.perModel;
+        account.lastUsageAt = Date.now();
+      }
+      saveAccounts(idx);
+    }
+    return idx.activeAccountUuid === target.accountUuid;
+  });
+
+  const usageNote = sampled ? ` (session ${sampled.session.usedPercentage}% / week ${sampled.weekAll.usedPercentage}%)` : "";
+  const tier = claudeTierLabel(blob.claudeAiOauth) ?? "?";
+  console.log(`${c.green("✓")} reauthed ${c.bold(oauthAccount.emailAddress)} (${tier})${usageNote}`);
+  if (isActive) {
+    console.log(c.dim("this account is the active one: the fresh credential is parked as its backup; the live session keeps its current token until the next swap."));
+  }
+  return true;
+}
+
+export async function cmdAuth(argv: string[]): Promise<number> {
+  const idx = loadAccounts();
+  const plan = planAuth({ accounts: idx.accounts, argv });
+  if (plan.kind === "usage") {
+    console.error(AUTH_USAGE);
+    return 2;
+  }
+  if (plan.kind === "error") {
+    console.error(c.red(plan.message));
+    return 1;
+  }
+
+  const targets: Account[] = [];
+  if (plan.kind === "pick") {
+    const picked = askWhichAccount(idx);
+    if (!picked) return 1;
+    targets.push(picked);
+  } else {
+    for (const uuid of plan.uuids) {
+      const account = idx.accounts.find((a) => a.accountUuid === uuid);
+      if (account) targets.push(account);
+    }
+    if (targets.length === 0) {
+      console.log(`${c.green("✓")} no account needs reauth`);
+      return 0;
+    }
+  }
+
+  let ok = 0;
+  for (const [i, target] of targets.entries()) {
+    console.log();
+    if (targets.length > 1) console.log(c.bold(`[${i + 1}/${targets.length}]`));
+    if (await reauthOne(target)) ok += 1;
+  }
+
+  if (targets.length > 1) {
+    console.log();
+    console.log(`reauthed ${count({ n: ok, noun: "account" })} of ${targets.length}`);
+  }
+  return ok === targets.length ? 0 : 1;
+}

package/src/cli/doctor.ts

@@ -33,6 +33,7 @@ export async function cmdDoctor(): Promise<number> {
 
   const s = checkSettings();
   check(s.statusLineOk, "statusLine shim installed in settings.json", "run `tokenmaxxing init`");
+  check(s.subagentStatusLineOk, "subagentStatusLine shim installed in settings.json", "run `tokenmaxxing init`");
   check(s.stopOk, "Stop hook installed in settings.json", "run `tokenmaxxing init`");
   check(s.sessionStartOk, "SessionStart hook installed in settings.json", "run `tokenmaxxing init`");
   check(checkTimerHealthy(), "periodic check timer active", timerActivationHint());
@@ -60,17 +61,17 @@ export async function cmdDoctor(): Promise<number> {
 
   for (const a of idx.accounts) {
     const parked = await readItem(parkedTarget(a.keychainItem));
-    check(!!parked, `parked credential present for ${a.email}`, "re-run `tokenmaxxing init`/`add`");
+    check(!!parked, `parked credential present for ${a.email}`, `run \`tokenmaxxing auth ${a.label}\``);
     if (parked) {
       try {
         const org = await blobOrg(parked);
-        if (org) check(org.organization_uuid === a.organizationUuid, `parked credential identity matches ${a.email}`, `token belongs to ${org.organization_name} - re-auth with \`tokenmaxxing add\``);
+        if (org) check(org.organization_uuid === a.organizationUuid, `parked credential identity matches ${a.email}`, `token belongs to ${org.organization_name} - run \`tokenmaxxing auth ${a.label}\``);
         else console.log(c.dim(`  - ${a.email} identity unverifiable (access token expired)`));
       } catch (e) {
         check(false, `parked credential identity matches ${a.email}`, String((e as Error).message ?? e).slice(0, 100));
       }
     }
-    if (a.needsReauth) check(false, `${a.email} needs re-auth`, "run `tokenmaxxing add` to re-login");
+    if (a.needsReauth) check(false, `${a.email} needs re-auth`, `run \`tokenmaxxing auth ${a.label}\` to re-login`);
   }
 
   const cfg = loadConfig();

package/src/cli/onboard.ts

@@ -0,0 +1,112 @@
+// One isolated Claude login, harvested. Shared by `add` (register whatever
+// account the login lands on) and `auth` (require it to match an existing
+// account). Drives the login in a throwaway CLAUDE_CONFIG_DIR - the ONLY use
+// of CLAUDE_CONFIG_DIR in the tool - auto-exits the moment the login lands,
+// samples that account's usage, then returns the credential + identity. The
+// temp dir and isolated credential are always destroyed before returning.
+
+import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { z } from "zod";
+import { readItem, deleteItem, isolatedTarget } from "../lib/credstore.ts";
+import { resolveRealClaude } from "../lib/claudebin.ts";
+import { probeUsage, FullUsageSchema } from "../lib/usage.ts";
+import { saveTermios, restoreTermios } from "../lib/tty.ts";
+import { paths } from "../lib/paths.ts";
+import { CredentialBlobSchema, OAuthAccountSchema } from "../lib/types.ts";
+import { c } from "./render.ts";
+
+export const HarvestedLoginSchema = z.object({
+  /** the raw isolated credential blob (park it via claudeAiOauthOnly). */
+  blobRaw: z.string(),
+  blob: CredentialBlobSchema,
+  oauthAccount: OAuthAccountSchema,
+  sampled: FullUsageSchema.nullable(),
+});
+export type HarvestedLogin = z.infer<typeof HarvestedLoginSchema>;
+
+/** True once `/login` has written a usable identity into the onboard dir. */
+function identityReady(cjPath: string): boolean {
+  if (!existsSync(cjPath)) return false;
+  try {
+    const oauthAccount = JSON.parse(readFileSync(cjPath, "utf8")).oauthAccount;
+    return z.object({ accountUuid: z.string().min(1) }).safeParse(oauthAccount).success;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Run one isolated login session and harvest it. The caller prints its own
+ * instructions (which account to sign in as) BEFORE calling. Prints progress
+ * and failure diagnostics; returns null when no usable login landed.
+ */
+export async function harvestIsolatedLogin(): Promise<HarvestedLogin | null> {
+  const onboardDir = paths.onboardDir;
+  rmSync(onboardDir, { recursive: true, force: true });
+  mkdirSync(onboardDir, { recursive: true });
+  const iso = isolatedTarget(onboardDir);
+  const cjPath = join(onboardDir, ".claude.json");
+  const real = resolveRealClaude();
+
+  const savedTermios = saveTermios();
+  // Scrub the ambient credential/identity overrides claude honors BEFORE its
+  // keychain lookup (verified 2.1.205) - the onboard session must authenticate
+  // only via the /login the user performs inside it.
+  const env: Record<string, string> = { ...process.env, CLAUDE_CONFIG_DIR: onboardDir, TOKENMAXXING_PROBE: "1", TOKENMAXXING_SUPERVISED: "" };
+  delete env.ANTHROPIC_API_KEY;
+  delete env.ANTHROPIC_AUTH_TOKEN;
+  delete env.CLAUDE_CODE_OAUTH_TOKEN;
+  delete env.CLAUDE_SECURESTORAGE_CONFIG_DIR;
+  const p = Bun.spawn([real], {
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+    env,
+  });
+
+  // Auto-exit (#17): watch for a completed login - identity written AND the
+  // isolated credential present - then SIGTERM claude. No manual /exit.
+  let exited = false;
+  const onExit = p.exited.then(() => { exited = true; });
+  while (!exited) {
+    await Bun.sleep(400);
+    if (identityReady(cjPath) && (await readItem(iso))) {
+      p.kill();
+      break;
+    }
+  }
+  await p.exited;
+  await onExit;
+  restoreTermios(savedTermios);
+
+  const cleanup = async () => {
+    await deleteItem(iso);
+    rmSync(onboardDir, { recursive: true, force: true });
+  };
+
+  const blobRaw = await readItem(iso);
+  if (!blobRaw || !identityReady(cjPath)) {
+    console.error(c.red("no login detected in the isolated session - nothing changed."));
+    await cleanup();
+    return null;
+  }
+
+  let blob, oauthAccount;
+  try {
+    blob = CredentialBlobSchema.parse(JSON.parse(blobRaw));
+    oauthAccount = OAuthAccountSchema.parse(JSON.parse(readFileSync(cjPath, "utf8")).oauthAccount);
+  } catch {
+    console.error(c.red("could not parse the onboarded account's credential/identity."));
+    await cleanup();
+    return null;
+  }
+
+  // Sample usage now (#16) so the account isn't "not sampled yet" in status/ls.
+  console.log(c.dim("sampling usage..."));
+  const sampled = await probeUsage(onboardDir);
+  if (!sampled) console.log(c.yellow("could not sample usage now - it will fill in on first use."));
+
+  await cleanup();
+  return { blobRaw, blob, oauthAccount, sampled };
+}

package/src/cli/render.ts

@@ -18,6 +18,33 @@ export function makeColors(enabled: boolean) {
 
 export const c = makeColors(!process.env.NO_COLOR && !!process.stdout.isTTY);
 
+/** Used% -> RGB on a continuous green->yellow->red ramp, anchored at the
+ *  semantic severity bands (pure green at 0, yellow at 75, red from 95) so the
+ *  band boundaries read exactly like the old 3-color scheme. Blue stays 0. */
+function rampRgb(usedPct: number): { r: number; g: number } {
+  const u = clamp(usedPct, 0, 100);
+  if (u >= 95) return { r: 255, g: 0 };
+  if (u >= 75) return { r: 255, g: Math.round(255 * (1 - (u - 75) / 20)) };
+  return { r: Math.round((255 * u) / 75), g: 255 };
+}
+
+/** Usage-severity painter for the statusLine (user decision 2026-07-18: colors
+ *  carry quota status instead of numbers). Truecolor when the terminal
+ *  advertises it, else the nearest 256-color cube step; disabled -> identity,
+ *  and callers must then fall back to numeric rendering (without color a
+ *  drained window must not look fresh). */
+export function makeUsagePaint(input: { enabled: boolean; truecolor: boolean }) {
+  return (usedPct: number) =>
+    (s: string): string => {
+      if (!input.enabled) return s;
+      const { r, g } = rampRgb(usedPct);
+      const code = input.truecolor
+        ? `38;2;${r};${g};0`
+        : `38;5;${16 + 36 * Math.round(r / 51) + 6 * Math.round(g / 51)}`;
+      return `\x1b[${code}m${s}\x1b[0m`;
+    };
+}
+
 /** Plan label for a claude account, e.g. "max 20x": subscription name plus the
  *  multiplier segment of the rate-limit tier id ("default_claude_max_20x").
  *  Structural, never exact-string: the multiplier is any <digits>x segment, so