tokenmaxxing 0.19.1 → 0.21.0

package/src/cli/status.ts

@@ -15,7 +15,7 @@
 import { sortBy } from "es-toolkit";
 import { loadAccounts, loadConfig, loadUsage, loadModelUsage, saveAccounts } from "../lib/state.ts";
 import { readOAuthAccount } from "../lib/claudejson.ts";
-import { probeActiveUsage, probeParkedUsage, type SampleOutcome } from "../lib/sample.ts";
+import { ensureLiveTokenFresh, probeActiveUsage, probeParkedUsage, type SampleOutcome } from "../lib/sample.ts";
 import { withLock } from "../lib/lock.ts";
 import { codexPaths, paths } from "../lib/paths.ts";
 import { earliestReset, effectiveBars, isExhausted, nextWeeklyReset } from "../lib/picker.ts";
@@ -25,7 +25,7 @@ import { isCodexExhausted } from "../lib/codexpick.ts";
 import { codexLimitLabel, isSessionWindow } from "../lib/codexusage.ts";
 import { bar, c, claudeTierLabel, count, fmtAgo, fmtReset } from "./render.ts";
 import type { FullUsage } from "../lib/usage.ts";
-import type { Config, CodexWindow, UsageWindow } from "../lib/types.ts";
+import type { Account, Config, CodexWindow, UsageWindow } from "../lib/types.ts";
 
 /** `preRender` runs after sampling, right before the first output line: `watch`
  *  keeps the previous frame on screen through the multi-second sample and
@@ -35,8 +35,28 @@ export async function cmdStatus(force = false, preRender?: () => void): Promise<
   const cfg = loadConfig();
   const now = Date.now();
 
+  // A window whose cached reset has passed is empty again; weekly windows recur
+  // on a fixed per-account anchor, so a stale weekly reset extrapolates forward.
+  // Fresh samples pass through unchanged (their resets are in the future).
+  const row = (name: string, w: UsageWindow, weekly: boolean) => {
+    const passed = w.resetsAt != null && w.resetsAt <= now;
+    const pct = passed ? 0 : w.usedPercentage;
+    const resetsAt = weekly ? nextWeeklyReset(w.resetsAt, now) : passed ? null : w.resetsAt;
+    console.log(`    ${name.padEnd(5)} ${bar(pct)}  ${c.dim(fmtReset(resetsAt, now))}`);
+  };
+
   if (idx.accounts.length === 0) {
-    console.log(c.dim("no accounts yet, run `tokenmaxxing init`"));
+    // A codex-only pool is a documented standalone flow: the empty-claude
+    // early return must still render it, and only a fully empty install gets
+    // the init hint (closing-review catch: bare `xx` claimed "no accounts"
+    // over a populated codex pool and pointed at the wrong init).
+    if (loadCodexAccounts().accounts.length > 0) {
+      console.log(c.dim("no claude accounts (run `tokenmaxxing init` to pool claude too)"));
+      console.log();
+      await renderCodexSection({ cfg, now, row });
+      return 0;
+    }
+    console.log(c.dim("no accounts yet, run `tokenmaxxing init` (or `tokenmaxxing init --codex`)"));
     return 0;
   }
 
@@ -51,9 +71,13 @@ export async function cmdStatus(force = false, preRender?: () => void): Promise<
     const modelUsage = loadModelUsage();
     const liveOAuth = readOAuthAccount();
     const activeOrg = liveOAuth?.organizationUuid ?? null;
-    await Promise.all(
-      idx.accounts.map(async (a) => {
-        const isActive = a.accountUuid === idx.activeAccountUuid && activeOrg === a.organizationUuid;
+    const probeOne = async (a: Account) => {
+        // Active = the org claude's own oauthAccount names, NOT the stored
+        // label conjunction: after a manual /login the label lags, and routing
+        // the genuinely-live account through the parked prober would refresh
+        // its stale parked grant and could flag a healthy account needs-reauth.
+        // probeActiveUsage's own roles check still fail-fasts on residual drift.
+        const isActive = activeOrg != null && activeOrg === a.organizationUuid;
         // The tee path never opens the credential blob, so the active account's
         // tier comes from the live oauthAccount instead - it names this very org
         // (uuid-matched above), so the tier is attributed to its own identity.
@@ -73,10 +97,14 @@ export async function cmdStatus(force = false, preRender?: () => void): Promise<
         let outcome: SampleOutcome;
         if (force) {
           // Force: ping + live probe for everyone. The tee predates the ping,
-          // so it serves only as the active account's fallback when its own
-          // `/usage` fail-silents (a running session's tee is still fresh).
+          // so it serves ONLY as the fallback for the fail-silent `/usage`
+          // case (the probe got past every guard and claude printed no limit
+          // lines). Any other failure - identity mismatch, dead refresh, a
+          // refused ping - must stay VISIBLE: the old unconditional fallback
+          // masked pre-ping failures as healthy tee data, silently skipping
+          // the ping with no warning (closing-review catch).
           outcome = isActive ? await probeActiveUsage(a, { ping: true }) : await probeParkedUsage(a, { ping: true });
-          if (!outcome.ok && fromStatusLine) {
+          if (!outcome.ok && fromStatusLine && outcome.reason.includes("no limit data")) {
             const failed = outcome;
             outcome = { ok: true, usage: fromStatusLine };
             if (failed.pingError != null) outcome.pingError = failed.pingError;
@@ -93,12 +121,37 @@ export async function cmdStatus(force = false, preRender?: () => void): Promise<
         outcomes.set(a.accountUuid, outcome);
         if (!outcome.ok) return;
         a.lastUsage = { fiveHour: outcome.usage.session, sevenDay: outcome.usage.weekAll };
-        if (Object.keys(outcome.usage.perModel).length > 0) a.lastPerModel = outcome.usage.perModel;
         // stamp when the figures were actually measured: the statusLine tee's
         // own write time for the push-fed active account, else the probe time.
         a.lastUsageAt = viaTee && live ? live.ts : Date.now();
-      }),
-    );
+        if (Object.keys(outcome.usage.perModel).length > 0) {
+          a.lastPerModel = outcome.usage.perModel;
+          // via the tee, the per-model rows come from model-usage.json whose
+          // own sample time may be DAYS older than the aggregate tee - dating
+          // them by the tee's timestamp inflated the null-reset self-bound
+          // (closing-review catch). A fresh probe's rows date by the probe.
+          a.lastPerModelAt = viaTee && modelUsage ? (modelUsage.sampledAt ?? modelUsage.ts) : a.lastUsageAt;
+        }
+    };
+    // The ACTIVE probe runs FIRST, alone: it refreshes an expired live access
+    // token under claude's refresh lock, and every parked probe's fail-closed
+    // live-owner check reads that same live token - run concurrently they
+    // raced the refresh and, after the machine idled past the token lifetime,
+    // every parked sample 401'd on the first `xx status` (closing-review
+    // catch). Parked probes then run concurrently as before.
+    const activeAccount = idx.accounts.find((a) => activeOrg != null && activeOrg === a.organizationUuid) ?? null;
+    if (activeAccount) await probeOne(activeAccount);
+    // even when the active account's usage came from the TEE (no active
+    // probe, no refresh side effect), the parked probes still need a fresh
+    // live token for their fail-closed live-owner checks (cubic review
+    // catch, PR #35). A dead live grant is deliberately not fatal here: each
+    // parked probe reports its own honest failure reason.
+    try {
+      await ensureLiveTokenFresh();
+    } catch {
+      // per-account guards surface the failure per probe
+    }
+    await Promise.all(idx.accounts.filter((a) => a !== activeAccount).map(probeOne));
     saveAccounts(idx);
   });
 
@@ -106,22 +159,15 @@ export async function cmdStatus(force = false, preRender?: () => void): Promise<
   console.log(c.dim(`thresholds 5h ${cfg.thresholds.session}% weekly ${cfg.thresholds.weekly}%  (${count({ n: idx.accounts.length, noun: "claude account" })})`));
   console.log();
 
-  // A window whose cached reset has passed is empty again; weekly windows recur
-  // on a fixed per-account anchor, so a stale weekly reset extrapolates forward.
-  // Fresh samples pass through unchanged (their resets are in the future).
-  const row = (name: string, w: UsageWindow, weekly: boolean) => {
-    const passed = w.resetsAt != null && w.resetsAt <= now;
-    const pct = passed ? 0 : w.usedPercentage;
-    const resetsAt = weekly ? nextWeeklyReset(w.resetsAt, now) : passed ? null : w.resetsAt;
-    console.log(`    ${name.padEnd(5)} ${bar(pct)}  ${c.dim(fmtReset(resetsAt, now))}`);
-  };
-
   // Display order (user decision 2026-07-18): earliest upcoming reset first
   // (5h or extrapolated weekly, from the just-refreshed samples), needs-reauth
   // last; the ● marker identifies the active account wherever it sorts.
   const displayAccounts = sortBy(idx.accounts, [(a) => (a.needsReauth ? 1 : 0), (a) => earliestReset(a, now)]);
+  // The marker matches the probe routing above: active = the org claude's own
+  // oauthAccount names (the swap label can lag after a manual /login).
+  const displayActiveOrg = readOAuthAccount()?.organizationUuid ?? null;
   for (const a of displayAccounts) {
-    const active = a.accountUuid === idx.activeAccountUuid;
+    const active = displayActiveOrg != null && a.organizationUuid === displayActiveOrg;
     const outcome = outcomes.get(a.accountUuid);
     const failed = outcome ? !outcome.ok : false;
     // On a failed sample, fall back to the last-known values (with a note below).

package/src/cli/switch.ts

@@ -18,8 +18,8 @@ import { withLock } from "../lib/lock.ts";
 import { paths } from "../lib/paths.ts";
 import { loadAccounts, loadConfig } from "../lib/state.ts";
 import { readOAuthAccount } from "../lib/claudejson.ts";
-import { performSwap, chooseAndSwap } from "../lib/swap.ts";
-import { currentWins, effectiveBars, pickEarliestReset, weeklyExpiry, type PickCtx } from "../lib/picker.ts";
+import { performSwap } from "../lib/swap.ts";
+import { currentWins, effectiveBars, pickBest, pickEarliestReset, weeklyExpiry, type PickCtx } from "../lib/picker.ts";
 import { InvalidGrantError } from "../lib/oauth.ts";
 import { findAccount } from "./rename.ts";
 import { c, fmtReset } from "./render.ts";
@@ -36,7 +36,13 @@ export async function cmdSwitch(selector?: string): Promise<number> {
 
   return withLock(paths.lockFile, async () => {
     const idx = loadAccounts();
-    const claimed = readOAuthAccount()?.accountUuid ?? null;
+    // ONE claude.json read for both identity fields: two reads could straddle
+    // a concurrent /login and describe two different live identities - the
+    // drift check and the seat must come from the same snapshot (cubic review
+    // catch, PR #33).
+    const liveClaim = readOAuthAccount();
+    const claimed = liveClaim?.accountUuid ?? null;
+    const claimedOrg = liveClaim?.organizationUuid ?? null;
     const drifted = claimed != null && claimed !== idx.activeAccountUuid;
 
     const swapTo = async (target: Account): Promise<number> => {
@@ -54,32 +60,60 @@ export async function cmdSwitch(selector?: string): Promise<number> {
       const target = findAccount(idx.accounts, selector);
       if (!target) { console.error(c.red(`no account matches "${selector}"`)); return 1; }
       if (target.accountUuid === idx.activeAccountUuid && !drifted) { console.log(`already on ${c.bold(target.label)}`); return 0; }
-      if (target.needsReauth) { console.error(c.red(`${target.label} needs re-auth - \`tokenmaxxing add\``)); return 1; }
+      if (target.needsReauth) { console.error(c.red(`${target.label} needs re-auth - run \`tokenmaxxing auth ${target.label}\``)); return 1; }
       return swapTo(target);
     }
 
     // auto: greedy over everyone, current included - a no-op when current wins.
     // No session context here, so every configured per-model family gates.
+    // Dead-token fallback mirrors decide.ts's greedy loop, NOT chooseAndSwap:
+    // its fallback lands on the next usable candidate unconditionally, which
+    // is right when over a bar but wrong here - a dead grant on the pace
+    // winner must re-check the seat, or a healthy current account gets a real
+    // swap onto a pace-WORSE account and the next periodic check bounces it
+    // straight back (closing-review catch). performSwap persists needs-reauth
+    // before throwing, so each reload shrinks the candidate set and the loop
+    // terminates.
     const everyone: PickCtx = { now, thresholds: effectiveBars(cfg), currentAccountUuid: null, switchFamilies: cfg.policy.switchModels };
-    const active = idx.accounts.find((a) => a.accountUuid === idx.activeAccountUuid) ?? null;
-    if (active != null && currentWins(active, idx.accounts, everyone)) {
-      if (drifted) return swapTo(active);
-      const expiry = weeklyExpiry(active, now);
-      const why = Number.isFinite(expiry) ? ` (weekly ${fmtReset(expiry, now)})` : "";
-      console.log(`already on the best account: ${c.bold(active.label)}${why}`);
-      return 0;
-    }
-    {
-      const landed = await chooseAndSwap({ now, thresholds: effectiveBars(cfg), switchFamilies: cfg.policy.switchModels });
-      if (landed) {
-        console.log(`${c.green("↻")} switched to ${c.bold(landed.label)}`);
+    while (true) {
+      const cur = loadAccounts();
+      // The seat is the LIVE login's pooled account when resolvable, the
+      // stored label only as fallback - the same identity rule AND the same
+      // identity KEY as decide.ts's seatOf: the organizationUuid, since quota
+      // is metered per org and the org is what the roles endpoint verifies
+      // (bugbot review catches, PR #33). Under drift this also makes ties
+      // favor the live account: the realign swap then keeps the same
+      // credential instead of hopping accounts on a tie.
+      const active =
+        (claimedOrg != null ? cur.accounts.find((a) => a.organizationUuid === claimedOrg) : null) ??
+        cur.accounts.find((a) => a.accountUuid === cur.activeAccountUuid) ??
+        null;
+      if (active != null && currentWins(active, cur.accounts, everyone)) {
+        if (drifted) return swapTo(active);
+        const expiry = weeklyExpiry(active, now);
+        const why = Number.isFinite(expiry) ? ` (weekly ${fmtReset(expiry, now)})` : "";
+        console.log(`already on the best account: ${c.bold(active.label)}${why}`);
         return 0;
       }
+      const best = pickBest(cur.accounts, { ...everyone, currentAccountUuid: active?.accountUuid ?? null });
+      if (!best) break; // no usable target: the depleted path below decides
+      try {
+        await performSwap(best);
+      } catch (e) {
+        if (e instanceof InvalidGrantError) {
+          console.error(c.red(`${best.label}'s refresh token is dead - run \`tokenmaxxing auth ${best.label}\``));
+          continue;
+        }
+        throw e;
+      }
+      console.log(`${c.green("↻")} switched to ${c.bold(best.label)}`);
+      return 0;
     }
 
     // No usable target swapped in: everything is depleted, or the remaining
-    // candidates' refresh tokens just died (chooseAndSwap marks needs-reauth,
-    // hence the reload). Stay on / switch to whichever recovers soonest.
+    // candidates' refresh tokens just died (performSwap persists needs-reauth
+    // before throwing, hence the reload). Stay on / switch to whichever
+    // recovers soonest.
     const fresh = loadAccounts();
     const earliest = pickEarliestReset(fresh.accounts, everyone);
     if (!earliest) {
@@ -88,7 +122,8 @@ export async function cmdSwitch(selector?: string): Promise<number> {
       const reauth = fresh.accounts.filter((a) => a.needsReauth).map((a) => a.label);
       if (reauth.length > 0) { console.error(c.yellow(`no switchable account - reauth needed (run \`tokenmaxxing auth --all\`): ${reauth.join(", ")}`)); return 1; }
       // never freeze a label drift behind a no-op (see header).
-      if (drifted && active) return swapTo(active);
+      const freshActive = fresh.accounts.find((a) => a.accountUuid === fresh.activeAccountUuid) ?? null;
+      if (drifted && freshActive) return swapTo(freshActive);
       console.log(c.yellow("all accounts at their limit with unknown reset times (unparsed reset clocks? see tokenmaxxing.log) - staying put"));
       return 0;
     }

package/src/entries/codexstophook.ts

@@ -11,17 +11,114 @@
 // a hook failure must never block the stop - errors are logged, not thrown.
 
 import { join } from "node:path";
-import { mkdirSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import { z } from "zod";
 import { codexPaths } from "../lib/paths.ts";
+import { withLock } from "../lib/lock.ts";
 import { writeFileAtomic } from "../lib/atomic.ts";
 import { evaluateAndMaybeSwapCodex } from "../lib/codexdecide.ts";
+import { isCodexExhausted } from "../lib/codexpick.ts";
+import { livingCodexPresences } from "../lib/codexpresence.ts";
+import { liveCodexAccountId } from "../lib/codexsample.ts";
+import { loadCodexAccounts } from "../lib/codexstate.ts";
+import { loadConfig } from "../lib/state.ts";
+import { effectiveBars } from "../lib/picker.ts";
 import { CODEX_SUPERVISOR_ID_ENV } from "./codexsupervisor.ts";
-import { CodexRespawnMarkerSchema, CodexStopStdinSchema } from "../lib/types.ts";
+import { CodexReconcileMarkerSchema, CodexRespawnMarkerSchema, CodexStopStdinSchema, type CodexAccount } from "../lib/types.ts";
 import { log } from "../lib/log.ts";
 
 const SupervisorIdSchema = z.string().min(1).optional().catch(undefined);
 
+/** Consume a cross-session reconcile signal addressed to THIS supervisor
+ *  (owner-approved option b, 2026-07-20): a deciding actor saw this session
+ *  running on an exhausted/dead account and asked it to respawn onto the live
+ *  seat. The Stop boundary is the only safe respawn point, and only THIS
+ *  hook's stdin carries the session id a resume needs, so promotion happens
+ *  here: the signal becomes a normal respawn marker the supervisor already
+ *  consumes. Returns true when the respawn marker was written (the session is
+ *  about to die - skip the normal decision). Everything past the cheap
+ *  no-marker fast path runs under the codex FLOCK (pullfrog review catch,
+ *  PR #34): the usability revalidation is only as good as its atomicity with
+ *  the marker write - unlocked, a concurrent `xx switch --codex` could move
+ *  the live seat onto a blocked account between the check and the write. The
+ *  flock serializes promotion against every tokenmaxxing actor (codex's own
+ *  actions are unserialized as ever); no nesting occurs because the hook
+ *  calls promote strictly before or after the evaluation's own lock. */
+async function promoteReconcile(input: { supervisorId: string; sessionId: string | null }): Promise<boolean> {
+  const markerPath = join(codexPaths.reconcileDir, input.supervisorId);
+  if (!existsSync(markerPath)) return false;
+  return withLock(codexPaths.lockFile, async () => promoteReconcileLocked(input));
+}
+
+function promoteReconcileLocked(input: { supervisorId: string; sessionId: string | null }): boolean {
+  const markerPath = join(codexPaths.reconcileDir, input.supervisorId);
+  if (!existsSync(markerPath)) return false; // re-checked under the lock: a raced consumer may have taken it
+  const parsed = CodexReconcileMarkerSchema.safeParse((() => {
+    try {
+      return JSON.parse(readFileSync(markerPath, "utf8"));
+    } catch {
+      return null;
+    }
+  })());
+  if (!parsed.success) {
+    // unlike a presence file, a broken signal guards nothing: drop it loudly.
+    rmSync(markerPath, { force: true });
+    log("codexstop.reconcile_unparsable", {});
+    return false;
+  }
+  // Staleness guard: the signal names the account this session was seen on;
+  // if the session has since respawned onto another account the signal is
+  // moot. Same when the live seat changed to (or still is) our own account -
+  // a respawn would land right back where we are.
+  const presence = livingCodexPresences().find((p) => p.supervisorId === input.supervisorId) ?? null;
+  if (presence == null || presence.accountId !== parsed.data.accountId) {
+    rmSync(markerPath, { force: true });
+    log("codexstop.reconcile_stale", {});
+    return false;
+  }
+  const liveId = liveCodexAccountId();
+  if (liveId == null || liveId === presence.accountId) {
+    rmSync(markerPath, { force: true });
+    log("codexstop.reconcile_moot", {});
+    return false;
+  }
+  // Revalidate the DESTINATION at consumption time (bugbot/pullfrog/vercel/
+  // cubic review catches, PR #34): a signal can sit across resets and usage
+  // changes, and identity checks alone would move a session onto a live seat
+  // that has since become exhausted, needs-reauth, or left the pool entirely.
+  // The SOURCE seat's state is deliberately not re-checked (owner ruling
+  // 2026-07-20: every pooled non-live sibling follows the seat, healthy or
+  // not - a non-live session wedges at token expiry regardless of quota).
+  // Dropped signals are cheap: the sweep re-signals next evaluation.
+  const now = Date.now();
+  const bars = effectiveBars(loadConfig());
+  const index = loadCodexAccounts();
+  const unusable = (account: CodexAccount): boolean =>
+    account.needsReauth === true || isCodexExhausted({ account, thresholds: bars, now });
+  const liveAccount = index.accounts.find((a) => a.accountId === liveId);
+  if (!liveAccount || unusable(liveAccount)) {
+    rmSync(markerPath, { force: true });
+    log("codexstop.reconcile_blocked_target", {});
+    return false;
+  }
+  // blank counts as missing: the supervisor treats a falsy sessionId as
+  // "resume --last", the exact fallback this guard exists to avoid.
+  if (input.sessionId == null || input.sessionId.trim() === "") {
+    // keep the signal for the next boundary, whose stdin will carry a real
+    // id - a resume without one could revive the wrong transcript.
+    log("codexstop.reconcile_no_session", {});
+    return false;
+  }
+  mkdirSync(codexPaths.respawnDir, { recursive: true });
+  writeFileAtomic(
+    join(codexPaths.respawnDir, input.supervisorId),
+    JSON.stringify(CodexRespawnMarkerSchema.parse({ account: liveAccount.label, sessionId: input.sessionId, ts: now })),
+  );
+  rmSync(markerPath, { force: true });
+  log("codexstop.reconcile_respawn", { supervisorId: input.supervisorId.slice(0, 8), account: liveId.slice(0, 8) });
+  return true;
+}
+
 async function readStdin(): Promise<string> {
   const chunks: Uint8Array[] = [];
   for await (const chunk of Bun.stdin.stream()) chunks.push(chunk);
@@ -41,9 +138,24 @@ export async function handleCodexStop(input: { rawStdin: string }): Promise<void
   const sessionId = parsed.success ? (parsed.data.session_id ?? null) : null;
 
   try {
-    const decision = await evaluateAndMaybeSwapCodex({});
+    // No supervisor = no decision AT ALL, checked before evaluate can swap:
+    // hooks.json is global, so this hook also fires in sessions launched
+    // around the PATH shim (IDE extension, absolute path), and a swap with
+    // nobody to respawn strands that session - codex cannot hot-adopt, and
+    // its guarded reload refuses a cross-account auth.json, so the session
+    // dies on its stale token with "Please sign in again" (closing-review
+    // catch). Restart IS the switch; without a restarter, do not switch.
     const supervisorId = SupervisorIdSchema.parse(process.env[CODEX_SUPERVISOR_ID_ENV]);
-    if (decision.swapped && decision.account && supervisorId) {
+    if (supervisorId === undefined) {
+      log("codexstop.unsupervised_skip", {});
+      return;
+    }
+    // A pending reconcile signal outranks the normal decision: this session
+    // is about to respawn onto the live seat, so evaluating it would waste a
+    // sample (and could even swap the seat out from under the respawn).
+    if (await promoteReconcile({ supervisorId, sessionId })) return;
+    const decision = await evaluateAndMaybeSwapCodex({});
+    if (decision.swapped && decision.account) {
       mkdirSync(codexPaths.respawnDir, { recursive: true });
       const payload = CodexRespawnMarkerSchema.parse({
         account: decision.account.label,
@@ -52,7 +164,14 @@ export async function handleCodexStop(input: { rawStdin: string }): Promise<void
       });
       writeFileAtomic(join(codexPaths.respawnDir, supervisorId), JSON.stringify(payload));
       log("codexstop.marker", { supervisorId: supervisorId.slice(0, 8) });
+      return;
     }
+    // The evaluation's sweep may have signaled THIS session (its own account
+    // is the wedged one while the live seat is healthy - the lone-stranded
+    // case the removed self-skip used to lose, bugbot/cubic review catch,
+    // PR #34): consume it at this very boundary instead of burning one more
+    // turn on the dead account.
+    await promoteReconcile({ supervisorId, sessionId });
   } catch (e) {
     log("codexstop.error", { err: e instanceof Error ? e.message : String(e) });
   }

package/src/entries/codexsupervisor.ts

@@ -8,9 +8,11 @@
 // sessions pair correctly); the supervisor then SIGTERMs its child and
 // relaunches `codex resume <session-id>` on the freshly-installed account.
 
-import { existsSync, mkdirSync, rmSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
+import { z } from "zod";
 import { codexPaths, paths } from "../lib/paths.ts";
+import { withLock } from "../lib/lock.ts";
 import { LOOP_DIAGNOSIS, MAX_WRAP_DEPTH, WRAP_DEPTH_ENV, WRAP_RATE_MAX, WRAP_RATE_WINDOW_MS, wrapDepth, wrapperEntryRateTripped } from "../lib/claudebin.ts";
 import { resolveRealCodex } from "../lib/codexbin.ts";
 import { clearCodexPresence, writeCodexPresence } from "../lib/codexpresence.ts";
@@ -30,6 +32,21 @@ const NONINTERACTIVE_SUBCMDS = new Set([
 
 const PASSTHROUGH_FLAGS = new Set(["--version", "-V", "--help", "-h"]);
 
+/** Read + validate a codex respawn marker. An unparseable one (version-skew
+ *  hook, corruption) is dropped loudly and reported as absent: the watcher
+ *  checks validity BEFORE the SIGTERM, so garbage never kills the session, and
+ *  the post-exit consume never throws after the child is already dead (PR #36
+ *  review catch, mirroring the claude supervisor). */
+function consumableCodexMarker(marker: string): z.infer<typeof CodexRespawnMarkerSchema> | null {
+  try {
+    return CodexRespawnMarkerSchema.parse(JSON.parse(readFileSync(marker, "utf8")));
+  } catch (e) {
+    rmSync(marker, { force: true });
+    log("codexsupervisor.marker_invalid", { err: e instanceof Error ? e.message : String(e) });
+    return null;
+  }
+}
+
 /** Root options that consume the NEXT token as their value (verified against
  *  `codex --help` 0.144.4): without skipping them, `codex -m gpt exec ...`
  *  would read "gpt" as the subcommand and wrongly supervise an exec run. */
@@ -76,7 +93,18 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
   const childEnv = { ...process.env, [WRAP_DEPTH_ENV]: String(depth + 1) };
 
   if (!shouldManageCodex({ argv })) {
-    const p = Bun.spawn([real, ...argv], { stdin: "inherit", stdout: "inherit", stderr: "inherit", env: childEnv });
+    // STRIP the supervisor pairing env from unmanaged spawns: a nested codex
+    // launched from inside a supervised session (e.g. its agent running
+    // `codex exec ...`) would otherwise inherit the OUTER session's id, and
+    // its global Stop hook could then write a respawn marker that SIGTERMs
+    // the outer session MID-TURN and resumes it onto the nested transcript
+    // (closing-review catch). A managed nested launch is already safe - it
+    // exports its own fresh id below; only a shim-bypassed absolute-path
+    // nested launch keeps the inherited env, the same accepted gap as
+    // claude's bg-daemon bypass.
+    const passthroughEnv: Record<string, string | undefined> = { ...childEnv };
+    delete passthroughEnv[CODEX_SUPERVISOR_ID_ENV];
+    const p = Bun.spawn([real, ...argv], { stdin: "inherit", stdout: "inherit", stderr: "inherit", env: passthroughEnv });
     await p.exited;
     return p.exitCode ?? (p.signalCode ? 1 : 0);
   }
@@ -103,20 +131,63 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
     // the picker must never target it and the sampler must never rotate its
     // parked token while the session lives. Rewritten every respawn (the swap
     // changed the live identity); cleared on exit; PID-validated by readers.
-    const spawnAccountId = liveCodexAccountId();
-    if (spawnAccountId) writeCodexPresence({ supervisorId, accountId: spawnAccountId });
-
-    const child = Bun.spawn([real, ...launchArgs], {
-      stdin: "inherit",
-      stdout: "inherit",
-      stderr: "inherit",
-      env: { ...childEnv, [CODEX_SUPERVISOR_ID_ENV]: supervisorId },
+    // Read + presence-write + spawn run under the codex FLOCK (closing-review
+    // catch): unlocked, a swap could land between the read and the child's
+    // auth.json read, seating the child on the NEW account while presence
+    // named the old one for the session's whole life - un-benching the
+    // running account for samplers and the picker. Under the flock no swap
+    // can interleave until after the spawn; the residual window (child
+    // startup vs a swap acquiring the lock immediately after) is sub-ms in
+    // practice against a swap's network-bound critical section.
+    const child = await withLock(codexPaths.lockFile, async () => {
+      const spawnAccountId = liveCodexAccountId();
+      const spawned = Bun.spawn([real, ...launchArgs], {
+        stdin: "inherit",
+        stdout: "inherit",
+        stderr: "inherit",
+        env: { ...childEnv, [CODEX_SUPERVISOR_ID_ENV]: supervisorId },
+      });
+      // Presence pins the CHILD's pid, written after the spawn (still inside
+      // the flock): the session IS the codex process, and pinning this
+      // supervisor's pid let a SIGKILLed supervisor prune the presence while
+      // its orphaned codex kept rotating the account's token (closing-review
+      // catch). Brief retries cover ps visibility lag on a just-spawned pid.
+      // FAIL CLOSED on final failure (PR #36 review catch): a session running
+      // without presence is exactly the unprotected state presence exists to
+      // prevent - its account would look swappable and samplable - so kill
+      // the just-spawned child (nothing is in flight yet) and surface the
+      // error instead of running unprotected.
+      if (spawnAccountId) {
+        for (let attempt = 0; attempt < 10; attempt++) {
+          try {
+            writeCodexPresence({ supervisorId, accountId: spawnAccountId, pid: spawned.pid });
+            break;
+          } catch (e) {
+            // a child that already exited needs no presence (its absence is
+            // correct) and must keep its own exit result - the normal exit
+            // path below handles it (PR #36 second-round catch)
+            if (spawned.exitCode !== null || spawned.signalCode !== null) break;
+            if (attempt === 9) {
+              log("codexsupervisor.presence_failed", { err: e instanceof Error ? e.message : String(e) });
+              spawned.kill();
+              // the child may have entered raw mode during the retries: await
+              // its death and restore the terminal before surfacing (PR #36
+              // second-round catch)
+              await spawned.exited;
+              restoreTermios(savedTermios);
+              throw new Error("could not write the codex presence file - refusing to run an unprotected session (its account would look like a swap target)");
+            }
+            await Bun.sleep(100);
+          }
+        }
+      }
+      return spawned;
     });
 
     let done = false;
     const markerWatch = (async () => {
       while (!done) {
-        if (await Bun.file(marker).exists()) return true;
+        if (existsSync(marker) && consumableCodexMarker(marker) != null) return true;
         await Bun.sleep(150);
       }
       return false;
@@ -135,8 +206,8 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
     await markerWatch.catch(() => false);
     restoreTermios(savedTermios);
 
-    if (existsSync(marker)) {
-      const payload = CodexRespawnMarkerSchema.parse(await Bun.file(marker).json());
+    const payload = existsSync(marker) ? consumableCodexMarker(marker) : null;
+    if (payload) {
       rmSync(marker, { force: true });
       respawns++;
       process.stdout.write(`\n\x1b[36m↻ tokenmaxxing: switched codex to ${payload.account} - resuming...\x1b[0m\n`);
@@ -144,6 +215,9 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
       continue;
     }
     clearCodexPresence({ supervisorId });
+    // a reconcile signal addressed to this now-gone session is moot; the
+    // deciding actor's sweep would gc it eventually, this is just prompt.
+    rmSync(join(codexPaths.reconcileDir, supervisorId), { force: true });
     log("codexsupervisor.exit", { supervisorId: supervisorId.slice(0, 8), respawns, code: child.exitCode, signal: child.signalCode });
     return child.exitCode ?? (child.signalCode ? 1 : 0);
   }

package/src/entries/sessionstart.ts

@@ -33,7 +33,7 @@ export async function runSessionStart(): Promise<number> {
       log("sessionstart.swapped", { source, account: decision.account.accountUuid.slice(0, 8) });
     }
   } catch (e) {
-    log("sessionstart.error", { err: String((e as Error).message ?? e) });
+    log("sessionstart.error", { err: e instanceof Error ? e.message : String(e) });
   }
   return 0;
 }