tokenmaxxing 0.17.0 → 0.19.0

package/DESIGN.md

@@ -28,7 +28,7 @@ It is a process/PTY manager only - spawn, forward the terminal, wait, restore te
 ## 2. What tokenmaxxing installs
 
 - A `claude` **supervisor** on your PATH ahead of the real binary (`~/.config/tokenmaxxing/bin/claude`), or a shell function - you invoke it identically.
-- Three `~/.claude/settings.json` entries (merged, preserving anything you already have): a transparent `statusLine` shim, a `Stop` hook, a `SessionStart` hook.
+- Four `~/.claude/settings.json` entries (merged, preserving anything you already have): a transparent `statusLine` shim, a `subagentStatusLine` shim (per-subagent rows in the agents panel), a `Stop` hook, a `SessionStart` hook.
 - **`~/.config/tokenmaxxing/`** - the single home for config and state:
   - `config.json` - threshold, account order/policy.
   - `accounts.json` - non-secret index `{email, organizationUuid, accountUuid, lastUsage, resetsAt, needs_reauth}`.
@@ -83,6 +83,21 @@ The decision engages at `five_hour >= 50%` (policy.greedySessionFloor): from the
 
 ---
 
+## 5b. The Slack bridge (`xx serve`, 0.18.0)
+
+A local Socket Mode daemon (no public URL) that turns Slack threads into Claude Code sessions on the pooled accounts. Stack (user decision 2026-07-18): Vercel's Chat SDK (`chat` + `@chat-adapter/slack`) for the Slack side; the Claude Agent SDK driven through `src/sdk.ts`'s pooled surface for the claude side - `xx serve` is that surface's first in-repo consumer. EVE (Vercel's agent framework) was researched and explicitly dropped: it owns its own model loop via AI Gateway, so it would replace Claude Code rather than drive it.
+
+- **Config**: `slack.json` (0600 - it holds the xoxb-/xapp- tokens) with per-channel links `{channel, repo, worktree, permissionMode, model?}`. `serve setup` prints the app manifest (minimal scopes: app_mentions:read, channels:history, groups:history, chat:write, files:write, users:read + socket mode) and prompts for the tokens; `serve link <channel-id> <repo>` manages links (channel IDs only - names drift, ids don't).
+- **Thread = session**: a bot mention in a linked channel subscribes the thread, creates `slack-worktrees/<threadKey>` (branch `tm-slack-<threadKey>` cut from the repo's HEAD; `--no-worktree` links run in the repo itself), and records `{threadId, cwd, sessionId}` under `slack-threads/`. Resume is cwd-keyed in claude, so the cwd stays byte-stable for the thread's life; worktrees are never auto-deleted (they hold the thread's work).
+- **Turn = spawn**: each thread message runs ONE `query()` with `resume: sessionId` (never a persistent streaming query - the SDK subprocess reads credentials at spawn, so per-turn spawns are what let `ensureBestAccount()` land each turn on the freshest account, and the daemon can restart without losing threads). `stopHookCheck` rides along as the SDK Stop hook. Streamed `text_delta`s feed `thread.post(AsyncIterable)` (the adapter debounces edits); tool-only turns post the final result text.
+- **Safety posture**: per-link `permissionMode`, default `acceptEdits`; `--yolo` (alias `--dangerous`) opts a link into `bypassPermissions`, and relayThread pairs it with the SDK's mandatory `allowDangerouslySkipPermissions: true` opt-in. `AskUserQuestion` is disallowed (unanswerable over Slack; the model asks in prose instead). Turn failures post a trimmed message-only diagnostic (never a raw error body).
+- **Socket lifecycle**: `bot.initialize()` starts the persistent auto-reconnecting SocketModeClient; the daemon then just stays alive. The leased `startSocketModeListener` API must never be looped: it returns instantly without `waitUntil` and the loop starves the event loop (live incident 2026-07-18 - connected but silent).
+- **Id mapping**: Chat SDK ids are adapter-prefixed (`thread.channelId` = `slack:C0123`, `thread.id` = `slack:C0123:<threadTs>`) while links store bare Slack ids - lookups strip the prefix via `bareChannelId`. Subscriptions live in the daemon's memory state, so every mention re-subscribes its thread (a restarted daemon revives an old thread on the next mention); queue-skipped messages (`context.skipped`) fold into the next prompt, with the queue-entry TTL raised to 900s; unlinked-channel traffic logs `serve.unlinked_channel` and stays silent in Slack.
+- **Agent representation** (`src/lib/slackstream.ts`): turns stream natively (`chat.startStream`, which works in channel threads regardless of the assistant:write scope): thinking and tool calls as task cards ("Thinking"/tool name/"Turn", input summary + truncated output), reply text as native markdown with rendered code fences, and a segment break whenever a tool starts after streamed text, so one turn posts as separate ordered Slack messages around its tool runs.
+- **Live-verified end-to-end** (2026-07-18, #tokenmaxxing-dogfooding): mention opens worktree + session, replies stream, thread follow-ups resume with context, cards + fenced code render, segmentation and queue folding behave. Plus the hermetic suite: schemas/links, worktree idempotency, stream mapping, fail-fast paths.
+
+---
+
 ## 6. Honest papercuts
 - **Respawn hiccup (depleted pause only).** Plain swaps never restart the session. When the whole pool is depleted you see `claude` stop, a countdown, and a resume; anything typed in the split second before the SIGTERM is lost, and the supervisor resets terminal mode so nothing is left garbled.
 - **Adoption lag.** macOS reads the keychain through a raw 30s cache, so at most the first turn after a swap can still meter the old account. The bars' headroom absorbs it.
@@ -112,7 +127,7 @@ The decision engages at `five_hour >= 50%` (policy.greedySessionFloor): from the
 ---
 
 ## 8. Stack
-TypeScript on Bun, shipped as source: one multi-call entry (`src/main.ts`, `#!/usr/bin/env bun`) serves the CLI, the `claude` supervisor, the statusLine shim, and the hooks; `init` installs a 2-line shim that `exec`s bun on the installed package's entry (the Stop path runs every turn; bun's start-up stays low-millisecond). Published to npm as `tokenmaxxing` (source, platform-independent - a compiled binary was tried and shipped one architecture's Mach-O to every platform). The supervisor needs a real PTY layer (spawn claude on a pty, forward resize/signals, restore mode between runs).
+TypeScript on Bun, shipped as source: one multi-call entry (`src/main.ts`, `#!/usr/bin/env bun`) serves the CLI, the `claude` supervisor, the statusLine shim, and the hooks; `init` installs a 2-line shim that `exec`s bun on the installed package's entry (the Stop path runs every turn; bun's start-up stays low-millisecond). Published to npm as `tokenmaxxing` (source, platform-independent - a compiled binary was tried and shipped one architecture's Mach-O to every platform). Shipping is PR-based since 2026-07-18: work reaches main only through a pull request (branch, PR, CI green, review handled, merge), and a release is a PR-landed version bump followed by `gh release create` (details in AGENTS.md "Release and CI"). The supervisor needs a real PTY layer (spawn claude on a pty, forward resize/signals, restore mode between runs).
 
 ---
 

package/README.md

@@ -45,6 +45,7 @@ claude                  # use claude as always
 | `tokenmaxxing status --force` | additionally ping every account (one tiny haiku request each) so all 5h session timers start now, then sample fresh |
 | `tokenmaxxing watch [seconds]` | live status: re-render every N seconds (default 120, floor 30; never pings) |
 | `tokenmaxxing config` | effective config with sources; `get`/`set`/`unset` dotted keys, `tidy` prunes unknown keys |
+| `tokenmaxxing serve` | Slack bridge daemon (Socket Mode, no public URL): `setup` prints the app manifest and stores the two tokens, `link <channel-id> <repo>` ties a channel to a repo (`--yolo` for full-autonomy bypassPermissions sessions), then mentioning the bot in that channel opens a Claude Code session per thread (own git worktree by default) and thread messages relay in and out |
 | `tokenmaxxing doctor` | verify the supervisor + settings entries survived |
 | `tokenmaxxing rename [--codex] <sel> <label>` / `rm <sel>` | manage the pool (`--codex` targets the codex pool: one email can hold both a claude and a codex account) |
 | `tokenmaxxing uninstall` | remove supervisor + settings entries (accounts/credentials kept) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",
@@ -40,6 +40,10 @@
     "typescript": "^5.6.0"
   },
   "dependencies": {
+    "@anthropic-ai/claude-agent-sdk": "^0.3.214",
+    "@chat-adapter/slack": "^4.34.0",
+    "@chat-adapter/state-memory": "^4.34.0",
+    "chat": "^4.34.0",
     "es-toolkit": "^1.49.0",
     "ky": "^2.0.2",
     "zod": "^4.4.3"

package/src/cli/doctor.ts

@@ -33,6 +33,7 @@ export async function cmdDoctor(): Promise<number> {
 
   const s = checkSettings();
   check(s.statusLineOk, "statusLine shim installed in settings.json", "run `tokenmaxxing init`");
+  check(s.subagentStatusLineOk, "subagentStatusLine shim installed in settings.json", "run `tokenmaxxing init`");
   check(s.stopOk, "Stop hook installed in settings.json", "run `tokenmaxxing init`");
   check(s.sessionStartOk, "SessionStart hook installed in settings.json", "run `tokenmaxxing init`");
   check(checkTimerHealthy(), "periodic check timer active", timerActivationHint());

package/src/cli/render.ts

@@ -18,6 +18,33 @@ export function makeColors(enabled: boolean) {
 
 export const c = makeColors(!process.env.NO_COLOR && !!process.stdout.isTTY);
 
+/** Used% -> RGB on a continuous green->yellow->red ramp, anchored at the
+ *  semantic severity bands (pure green at 0, yellow at 75, red from 95) so the
+ *  band boundaries read exactly like the old 3-color scheme. Blue stays 0. */
+function rampRgb(usedPct: number): { r: number; g: number } {
+  const u = clamp(usedPct, 0, 100);
+  if (u >= 95) return { r: 255, g: 0 };
+  if (u >= 75) return { r: 255, g: Math.round(255 * (1 - (u - 75) / 20)) };
+  return { r: Math.round((255 * u) / 75), g: 255 };
+}
+
+/** Usage-severity painter for the statusLine (user decision 2026-07-18: colors
+ *  carry quota status instead of numbers). Truecolor when the terminal
+ *  advertises it, else the nearest 256-color cube step; disabled -> identity,
+ *  and callers must then fall back to numeric rendering (without color a
+ *  drained window must not look fresh). */
+export function makeUsagePaint(input: { enabled: boolean; truecolor: boolean }) {
+  return (usedPct: number) =>
+    (s: string): string => {
+      if (!input.enabled) return s;
+      const { r, g } = rampRgb(usedPct);
+      const code = input.truecolor
+        ? `38;2;${r};${g};0`
+        : `38;5;${16 + 36 * Math.round(r / 51) + 6 * Math.round(g / 51)}`;
+      return `\x1b[${code}m${s}\x1b[0m`;
+    };
+}
+
 /** Plan label for a claude account, e.g. "max 20x": subscription name plus the
  *  multiplier segment of the rate-limit tier id ("default_claude_max_20x").
  *  Structural, never exact-string: the multiplier is any <digits>x segment, so

package/src/cli/serve.ts

@@ -0,0 +1,312 @@
+// `tokenmaxxing serve` - the Slack bridge daemon. Socket Mode (no public URL):
+// a mention in a linked channel opens a claude session for that thread (in its
+// own git worktree by default), and every further thread message becomes one
+// claude turn whose streamed output posts back into the thread. Stack chosen by
+// the user 2026-07-18: Vercel Chat SDK (`chat` + `@chat-adapter/slack`) for
+// Slack, the Claude Agent SDK driven through src/sdk.ts for claude (EVE was
+// researched and dropped: it owns its own model loop instead of driving
+// Claude Code).
+//
+//   serve setup            print the app manifest + prompt for the two tokens
+//   serve link <ch> <repo> [--no-worktree] [--dangerous] [--model <m>]
+//   serve unlink <ch>      remove a link
+//   serve links            list links
+//   serve                  run the daemon
+
+import { existsSync, realpathSync } from "node:fs";
+import { Chat, type StreamChunk } from "chat";
+import { createSlackAdapter } from "@chat-adapter/slack";
+import { createMemoryState } from "@chat-adapter/state-memory";
+import {
+  bareChannelId,
+  isChannelId,
+  linkForChannel,
+  loadSlackConfig,
+  loadSlackThread,
+  removeLink,
+  saveSlackConfig,
+  saveSlackThread,
+  stripLeadingMention,
+  upsertLink,
+  SlackLinkSchema,
+  type SlackConfig,
+} from "../lib/slackstate.ts";
+import { ensureThreadCwd, relayThread } from "../lib/slackbridge.ts";
+import { log } from "../lib/log.ts";
+import { c, count } from "./render.ts";
+
+const SERVE_USAGE = "usage: tokenmaxxing serve [setup | link <channel-id> <repo> [--no-worktree] [--yolo | --dangerous] [--model <m>] | unlink <channel-id> | links]";
+
+/** The manifest the user pastes at api.slack.com/apps > From an app manifest.
+ *  Scopes/events verified against docs.slack.dev 2026-07-18: a channel-thread
+ *  relay plus Slack's Agent messaging experience (agent_view + assistant:write
+ *  power the DM assistant surface and typing status; channel-thread streaming
+ *  works without them, verified live). Changing scopes on an existing app
+ *  requires reinstalling it to the workspace. */
+const APP_MANIFEST = `display_information:
+  name: tokenmaxxing
+  description: bridges Slack threads to Claude Code sessions
+
+features:
+  agent_view: true
+  bot_user:
+    display_name: tokenmaxxing
+    always_online: true
+
+oauth_config:
+  scopes:
+    bot:
+      - app_mentions:read
+      - assistant:write
+      - channels:history
+      - groups:history
+      - chat:write
+      - files:write
+      - users:read
+
+settings:
+  event_subscriptions:
+    bot_events:
+      - app_context_changed
+      - app_home_opened
+      - app_mention
+      - message.channels
+      - message.groups
+      - message.im
+  socket_mode_enabled: true
+  org_deploy_enabled: false
+  token_rotation_enabled: false`;
+
+function printSetupInstructions(): void {
+  console.log(c.bold("Slack app setup (one time)"));
+  console.log(`1. Open ${c.cyan("https://api.slack.com/apps")} > Create New App > From an app manifest, pick your workspace, and paste:`);
+  console.log();
+  console.log(APP_MANIFEST);
+  console.log();
+  console.log("2. OAuth & Permissions > Install to Workspace, copy the Bot User OAuth Token (xoxb-...).");
+  console.log("3. Basic Information > App-Level Tokens > Generate (add the connections:write scope), copy the token (xapp-...).");
+  console.log(`4. Run ${c.cyan("tokenmaxxing serve setup")} and paste both tokens, then ${c.cyan("tokenmaxxing serve link <channel-id> <repo>")} and invite the bot to that channel.`);
+  console.log(`${c.dim("Existing app? Paste the manifest over App Manifest in its settings, then reinstall to the workspace (scope changes need it). Tokens stay valid unless you rotate them.")}`);
+}
+
+function cmdServeSetup(): number {
+  printSetupInstructions();
+  console.log();
+  const botToken = prompt("bot token (xoxb-...):")?.trim();
+  const appToken = prompt("app token (xapp-...):")?.trim();
+  if (!botToken || !appToken) {
+    console.error(c.red("both tokens are required - nothing saved"));
+    return 1;
+  }
+  const existing = loadSlackConfig();
+  let cfg: SlackConfig;
+  try {
+    cfg = { botToken, appToken, links: existing?.links ?? [] };
+    saveSlackConfig(cfg);
+  } catch {
+    console.error(c.red("tokens rejected: the bot token must start with xoxb- and the app token with xapp-"));
+    return 1;
+  }
+  console.log(`${c.green("✓")} saved to slack.json (0600) with ${count({ n: cfg.links.length, noun: "link" })}`);
+  return 0;
+}
+
+function cmdServeLink(argv: string[]): number {
+  const worktree = !argv.includes("--no-worktree");
+  // yolo mode = the SDK's bypassPermissions; --dangerous is the same switch.
+  const dangerous = argv.includes("--yolo") || argv.includes("--dangerous");
+  const modelIdx = argv.indexOf("--model");
+  const model = modelIdx >= 0 ? argv[modelIdx + 1] : undefined;
+  const rest = argv.filter((a, i) => !a.startsWith("--") && (modelIdx < 0 || i !== modelIdx + 1));
+  const [channel, repo] = rest;
+  if (!channel || !repo) {
+    console.error(SERVE_USAGE);
+    return 2;
+  }
+  if (!isChannelId(channel)) {
+    console.error(c.red(`"${channel}" is not a Slack channel id (C.../G...). In Slack: right-click the channel > View channel details - the id is at the bottom.`));
+    return 1;
+  }
+  if (!existsSync(repo)) {
+    console.error(c.red(`repo path does not exist: ${repo}`));
+    return 1;
+  }
+  const repoReal = realpathSync(repo);
+  if (!existsSync(`${repoReal}/.git`)) {
+    console.error(c.red(`${repoReal} is not a git repository (worktree mode needs one)`));
+    return 1;
+  }
+  const cfg = loadSlackConfig();
+  if (!cfg) {
+    console.error(c.red("no slack.json yet - run `tokenmaxxing serve setup` first"));
+    return 1;
+  }
+  const link = SlackLinkSchema.parse({
+    channel,
+    repo: repoReal,
+    worktree,
+    permissionMode: dangerous ? "bypassPermissions" : "acceptEdits",
+    ...(model ? { model } : {}),
+  });
+  saveSlackConfig(upsertLink(cfg, link));
+  const flags = [worktree ? "worktree" : "in-place", link.permissionMode, ...(model ? [model] : [])].join(", ");
+  console.log(`${c.green("✓")} linked ${c.bold(channel)} → ${repoReal} (${flags})`);
+  return 0;
+}
+
+function cmdServeUnlink(channel: string | undefined): number {
+  if (!channel) {
+    console.error(SERVE_USAGE);
+    return 2;
+  }
+  const cfg = loadSlackConfig();
+  const next = cfg ? removeLink(cfg, channel) : null;
+  if (!next) {
+    console.error(c.red(`no link for channel ${channel}`));
+    return 1;
+  }
+  saveSlackConfig(next);
+  console.log(`${c.green("✓")} unlinked ${channel}`);
+  return 0;
+}
+
+function cmdServeLinks(): number {
+  const cfg = loadSlackConfig();
+  if (!cfg || cfg.links.length === 0) {
+    console.log(c.dim("no channel links - run `tokenmaxxing serve link <channel-id> <repo>`"));
+    return 0;
+  }
+  for (const l of cfg.links) {
+    const flags = [l.worktree ? "worktree" : "in-place", l.permissionMode, ...(l.model ? [l.model] : [])].join(", ");
+    console.log(`${c.bold(l.channel)} → ${l.repo} ${c.dim(`(${flags})`)}`);
+  }
+  return 0;
+}
+
+async function runDaemon(): Promise<number> {
+  const cfg = loadSlackConfig();
+  if (!cfg) {
+    printSetupInstructions();
+    return 1;
+  }
+  if (cfg.links.length === 0) {
+    console.error(c.red("no channel links - run `tokenmaxxing serve link <channel-id> <repo>` first"));
+    return 1;
+  }
+
+  const slack = createSlackAdapter({
+    mode: "socket",
+    botToken: cfg.botToken,
+    appToken: cfg.appToken,
+    // Native append-streaming (chat.startStream) with task cards is the
+    // correct mode (user-confirmed live 2026-07-18): it works in channel
+    // threads even when auth.test reports no assistant:write, so never gate
+    // it on a scope probe. The adapter falls back to post-and-edit by itself
+    // when a workspace truly rejects streaming. agentView matches the
+    // manifest's Agent messaging experience for the DM surface.
+    agentView: true,
+    // the web-api default retry policy (tenRetriesInAboutThirtyMinutes) can
+    // stall a streamed turn ~30min on one rate-limited edit; this is
+    // @slack/web-api's fiveRetriesInFiveMinutes literal (dep not declared,
+    // so the values are inlined).
+    webClientOptions: { retryConfig: { retries: 5, factor: 3.86 }, timeout: 15_000 },
+  });
+  const bot = new Chat({
+    userName: "tokenmaxxing",
+    adapters: { slack },
+    state: createMemoryState(),
+    // per-thread lock with queueing: a message landing mid-turn waits its turn
+    // instead of racing a second claude spawn on the same cwd. The default
+    // 90s queue-entry TTL silently discards anything queued behind a turn
+    // longer than that (claude turns routinely are), hence the override.
+    concurrency: { strategy: "queue", queueEntryTtlMs: 900_000 },
+    // without this a cards-only segment in post-and-edit fallback would
+    // strand a bare "..." placeholder message.
+    fallbackStreamingPlaceholderText: null,
+    logger: "warn",
+  });
+
+  const handleTurn = async (input: {
+    thread: { id: string; channelId: string; post: (m: AsyncIterable<string | StreamChunk>) => Promise<unknown>; subscribe: () => Promise<void>; startTyping: () => Promise<void> };
+    texts: string[];
+    isMention: boolean;
+  }) => {
+    const { thread, texts, isMention } = input;
+    const link = linkForChannel(cfg, bareChannelId(thread.channelId));
+    if (!link) {
+      log("serve.unlinked_channel", { channel: thread.channelId });
+      return; // not a linked channel - stay silent in Slack
+    }
+    log("serve.message", { thread: thread.id, isMention, texts: texts.length });
+    // texts carries queue-skipped messages plus the triggering one: the queue
+    // strategy hands a turn only the LATEST message and the rest via
+    // context.skipped, so they are folded into one prompt here.
+    const prompt = texts
+      .map((t) => stripLeadingMention(t))
+      .filter((t) => t !== "")
+      .join("\n\n");
+    if (!prompt) return;
+    let record = loadSlackThread(thread.id);
+    if (!record) {
+      if (!isMention) return; // only a mention opens a session
+      const cwd = ensureThreadCwd({ link, threadId: thread.id });
+      record = { threadId: thread.id, repo: link.repo, cwd, sessionId: null, createdAt: new Date().toISOString() };
+      saveSlackThread(record);
+      log("serve.thread_opened", { thread: thread.id, cwd });
+    }
+    // subscriptions live in the memory state, so a daemon restart forgets
+    // them; every mention re-subscribes to keep follow-up replies flowing.
+    if (isMention) await thread.subscribe();
+    // "is working..." assistant status; a no-op until the Slack app has the
+    // agent feature + assistant:write (the adapter warns instead of throwing).
+    await thread.startTyping();
+    const outcome = await relayThread({
+      cwd: record.cwd,
+      sessionId: record.sessionId,
+      prompt,
+      link,
+      post: (m) => thread.post(m),
+    });
+    if (outcome.sessionId !== record.sessionId) {
+      saveSlackThread({ ...record, sessionId: outcome.sessionId });
+    }
+  };
+
+  const relayable = (m: { author: { isMe: boolean; isBot?: boolean | "unknown" } }) => !m.author.isMe && m.author.isBot !== true;
+
+  bot.onNewMention(async (thread, message, context) => {
+    const texts = [...(context?.skipped ?? []).filter(relayable), message].map((m) => m.text);
+    await handleTurn({ thread, texts, isMention: true });
+  });
+  bot.onSubscribedMessage(async (thread, message, context) => {
+    if (!relayable(message)) return; // never relay our own posts
+    const texts = [...(context?.skipped ?? []).filter(relayable), message].map((m) => m.text);
+    await handleTurn({ thread, texts, isMention: false });
+  });
+
+  // initialize() starts the PERSISTENT Socket Mode client (auto-reconnecting)
+  // wired straight into event routing; the daemon only has to stay alive.
+  // Never call startSocketModeListener here: that is the serverless leased
+  // variant (it demands options.waitUntil and returns instantly without it),
+  // and awaiting it in a loop starved the event loop so hard the WebSocket
+  // never delivered a single event (live incident 2026-07-18).
+  await bot.initialize();
+  console.log(`${c.green("●")} serving ${count({ n: cfg.links.length, noun: "linked channel" })} over Slack Socket Mode - mention the bot in a linked channel to open a session (Ctrl-C to stop)`);
+  log("serve.started", { links: cfg.links.length });
+  await new Promise<never>(() => {});
+  return 0;
+}
+
+export async function cmdServe(argv: string[]): Promise<number> {
+  const [sub, ...rest] = argv;
+  switch (sub) {
+    case undefined: return runDaemon();
+    case "setup": return cmdServeSetup();
+    case "link": return cmdServeLink(rest);
+    case "unlink": return cmdServeUnlink(rest[0]);
+    case "links": return cmdServeLinks();
+    default:
+      console.error(SERVE_USAGE);
+      return 2;
+  }
+}

package/src/cli/status.ts

@@ -12,12 +12,13 @@
 // fallback: its own `/usage` fail-silents exactly when a live session is
 // running it, and that session's tee is fresher than any cache.
 
+import { sortBy } from "es-toolkit";
 import { loadAccounts, loadConfig, loadUsage, loadModelUsage, saveAccounts } from "../lib/state.ts";
 import { readOAuthAccount } from "../lib/claudejson.ts";
 import { probeActiveUsage, probeParkedUsage, type SampleOutcome } from "../lib/sample.ts";
 import { withLock } from "../lib/lock.ts";
 import { codexPaths, paths } from "../lib/paths.ts";
-import { effectiveBars, isExhausted, nextWeeklyReset } from "../lib/picker.ts";
+import { earliestReset, effectiveBars, isExhausted, nextWeeklyReset } from "../lib/picker.ts";
 import { loadCodexAccounts, saveCodexAccounts } from "../lib/codexstate.ts";
 import { liveCodexAccountId, sampleCodexAccount, type CodexSampleOutcome } from "../lib/codexsample.ts";
 import { isCodexExhausted } from "../lib/codexpick.ts";
@@ -115,7 +116,11 @@ export async function cmdStatus(force = false, preRender?: () => void): Promise<
     console.log(`    ${name.padEnd(5)} ${bar(pct)}  ${c.dim(fmtReset(resetsAt, now))}`);
   };
 
-  for (const a of idx.accounts) {
+  // Display order (user decision 2026-07-18): earliest upcoming reset first
+  // (5h or extrapolated weekly, from the just-refreshed samples), needs-reauth
+  // last; the ● marker identifies the active account wherever it sorts.
+  const displayAccounts = sortBy(idx.accounts, [(a) => (a.needsReauth ? 1 : 0), (a) => earliestReset(a, now)]);
+  for (const a of displayAccounts) {
     const active = a.accountUuid === idx.activeAccountUuid;
     const outcome = outcomes.get(a.accountUuid);
     const failed = outcome ? !outcome.ok : false;
@@ -200,7 +205,17 @@ async function renderCodexSection(input: {
   console.log();
   const windowLabel = (window: CodexWindow) =>
     isSessionWindow({ window }) ? `${Math.round((window.windowSeconds ?? 0) / 3600)}h` : "week";
-  for (const account of index.accounts) {
+  // Same display order as the claude pool: earliest upcoming reset first
+  // across every cached window, needs-reauth last.
+  const displayAccounts = sortBy(index.accounts, [
+    (a) => (a.needsReauth ? 1 : 0),
+    (a) => {
+      const windows = [...(a.lastUsage?.aggregate ?? []), ...Object.values(a.lastUsage?.perLimit ?? {}).flat()];
+      const resets = windows.flatMap((w) => (w.resetsAt != null && w.resetsAt > now ? [w.resetsAt] : []));
+      return resets.length > 0 ? Math.min(...resets) : Number.POSITIVE_INFINITY;
+    },
+  ]);
+  for (const account of displayAccounts) {
     const active = account.accountId === liveId;
     const marker = active ? c.green("●") : c.dim("○");
     const badges: string[] = [];