tokenmaxxing 0.19.1 → 1.0.0

package/src/lib/state.ts

@@ -31,58 +31,109 @@ const DEFAULT_CONFIG: Config = {
   policy: { projectionMargin: 0, greedySessionFloor: 50, switchModels: ["fable"], usagePollTtlMs: 90_000, maxWaitMs: 3_600_000 },
 };
 
+/** Percent-of-window values: out-of-range bars make every account read as
+ *  exhausted, so the schema rejects them at the config gate. The cross-field
+ *  case (a projectionMargin at or above a threshold zeroes the effective bar)
+ *  is caught by ConfigSchema's refine on the merged result. */
+const PercentSchema = z.number().min(0).max(100);
+
 /** On-disk shape (all optional); validated via Zod, merged over defaults.
  *  Exported for `xx config`, which edits and housekeeps the sparse file. */
 export const ConfigFileSchema = z
   .object({
-    thresholds: z.object({ session: z.number(), weekly: z.number() }).partial(),
+    thresholds: z.object({ session: PercentSchema, weekly: PercentSchema }).partial(),
     claudeBin: z.string(),
     codexBin: z.string(),
     policy: z
       .object({
-        projectionMargin: z.number(),
-        greedySessionFloor: z.number(),
+        projectionMargin: PercentSchema,
+        greedySessionFloor: PercentSchema,
         switchModels: z.array(z.string()),
-        usagePollTtlMs: z.number(),
-        maxWaitMs: z.number(),
+        usagePollTtlMs: z.number().int().positive(),
+        maxWaitMs: z.number().int().positive(),
       })
       .partial(),
   })
   .partial();
 
-export function loadConfig(): Config {
+const MergeOutcomeSchema = z.union([
+  z.object({ ok: z.literal(true), config: ConfigSchema }),
+  z.object({ ok: z.literal(false), detail: z.string() }),
+]);
+export type MergeOutcome = z.infer<typeof MergeOutcomeSchema>;
+
+/** Merge a validated sparse file over the defaults, apply the env binary
+ *  overrides, and validate the merged WHOLE (the projectionMargin-vs-
+ *  thresholds refine). Shared by loadConfig and `xx config set`: set must
+ *  reject a value whose merged result would make every later loadConfig
+ *  throw, silently disabling status/switch/hooks/statusline until the file is
+ *  hand-repaired (closing-review catch). */
+export function mergeConfigFile(p: z.infer<typeof ConfigFileSchema>): MergeOutcome {
   const cfg: Config = { ...DEFAULT_CONFIG, thresholds: { ...DEFAULT_CONFIG.thresholds }, policy: { ...DEFAULT_CONFIG.policy } };
+  cfg.thresholds.session = p.thresholds?.session ?? cfg.thresholds.session;
+  cfg.thresholds.weekly = p.thresholds?.weekly ?? cfg.thresholds.weekly;
+  cfg.claudeBin = p.claudeBin ?? cfg.claudeBin;
+  cfg.codexBin = p.codexBin ?? cfg.codexBin;
+  cfg.policy.projectionMargin = p.policy?.projectionMargin ?? cfg.policy.projectionMargin;
+  cfg.policy.greedySessionFloor = p.policy?.greedySessionFloor ?? cfg.policy.greedySessionFloor;
+  cfg.policy.usagePollTtlMs = p.policy?.usagePollTtlMs ?? cfg.policy.usagePollTtlMs;
+  cfg.policy.maxWaitMs = p.policy?.maxWaitMs ?? cfg.policy.maxWaitMs;
+  if (p.policy?.switchModels) {
+    cfg.policy.switchModels = p.policy.switchModels.map((s) => s.toLowerCase());
+  }
+  // env overrides win for the real binaries (tests / relocation)
+  const envBin = realClaudeBinFromEnv();
+  if (envBin) cfg.claudeBin = envBin;
+  const envCodexBin = realCodexBinFromEnv();
+  if (envCodexBin) cfg.codexBin = envCodexBin;
+  const merged = ConfigSchema.safeParse(cfg);
+  if (!merged.success) {
+    // per-field values passed but the merged whole is unusable (the
+    // projectionMargin-vs-thresholds refine); name the reason, not a zod dump.
+    return { ok: false, detail: merged.error.issues.map((issue) => issue.message).join("; ") };
+  }
+  return { ok: true, config: merged.data };
+}
+
+export function loadConfig(): Config {
+  let fileData: z.infer<typeof ConfigFileSchema> = {};
   if (existsSync(paths.configJson)) {
-    let raw: unknown = {};
+    let raw: unknown;
     try {
       raw = JSON.parse(readFileSync(paths.configJson, "utf8"));
     } catch {
-      raw = {};
+      // Silent defaults here once meant a corrupt file could quietly unpin
+      // claudeBin; a damaged config is the user's to repair, loudly.
+      throw new Error(`${paths.configJson} is corrupt (unparsable JSON) - fix or remove it`);
     }
     const parsed = ConfigFileSchema.safeParse(raw);
-    const p = parsed.success ? parsed.data : {};
-    cfg.thresholds.session = p.thresholds?.session ?? cfg.thresholds.session;
-    cfg.thresholds.weekly = p.thresholds?.weekly ?? cfg.thresholds.weekly;
-    cfg.claudeBin = p.claudeBin ?? cfg.claudeBin;
-    cfg.codexBin = p.codexBin ?? cfg.codexBin;
-    cfg.policy.projectionMargin = p.policy?.projectionMargin ?? cfg.policy.projectionMargin;
-    cfg.policy.greedySessionFloor = p.policy?.greedySessionFloor ?? cfg.policy.greedySessionFloor;
-    cfg.policy.usagePollTtlMs = p.policy?.usagePollTtlMs ?? cfg.policy.usagePollTtlMs;
-    cfg.policy.maxWaitMs = p.policy?.maxWaitMs ?? cfg.policy.maxWaitMs;
-    if (p.policy?.switchModels) {
-      cfg.policy.switchModels = p.policy.switchModels.map((s) => s.toLowerCase());
+    if (!parsed.success) {
+      // Valid JSON with wrong-typed KNOWN keys must not silently drop pins
+      // like claudeBin; unknown keys are stripped by the schema and stay
+      // tolerated (that is `config tidy`'s territory, not an error).
+      const fields = parsed.error.issues.map((issue) => issue.path.join(".")).join(", ");
+      throw new Error(`${paths.configJson} has wrong-typed values (${fields}) - fix or remove them`);
     }
+    fileData = parsed.data;
   }
-  // env overrides win for the real binaries (tests / relocation)
-  const envBin = realClaudeBinFromEnv();
-  if (envBin) cfg.claudeBin = envBin;
-  const envCodexBin = realCodexBinFromEnv();
-  if (envCodexBin) cfg.codexBin = envCodexBin;
-  return ConfigSchema.parse(cfg);
+  const outcome = mergeConfigFile(fileData);
+  if (!outcome.ok) throw new Error(`${paths.configJson} is invalid: ${outcome.detail} - fix or remove the offending values`);
+  return outcome.config;
 }
 
-export function saveConfig(c: Config): void {
-  writeFileAtomic(paths.configJson, JSON.stringify(ConfigSchema.parse(c), null, 2) + "\n");
+/** Pin one binary path into the SPARSE config file, preserving every other
+ *  override verbatim. Never write the merged config here: baking defaults (or
+ *  an ambient TOKENMAXXING_*_BIN env override) into the file freezes future
+ *  default changes as stale explicit values and misreports every `xx config`
+ *  source as "file" (closing-review catch; the sparse-overrides contract is
+ *  config.ts's header). Throws on a corrupt file, like loadConfig. */
+export function pinBinOverride(input: { key: "claudeBin" | "codexBin"; bin: string }): void {
+  let raw: Record<string, unknown> = {};
+  if (existsSync(paths.configJson)) {
+    raw = z.record(z.string(), z.unknown()).parse(JSON.parse(readFileSync(paths.configJson, "utf8")));
+  }
+  raw[input.key] = input.bin;
+  writeFileAtomic(paths.configJson, JSON.stringify(raw, null, 2) + "\n");
 }
 
 // ---- accounts.json -------------------------------------------------------
@@ -90,13 +141,22 @@ export function saveConfig(c: Config): void {
 const emptyIndex = (): AccountsIndex => ({ version: 1, activeAccountUuid: null, accounts: [] });
 
 export function loadAccounts(): AccountsIndex {
+  // Absent = genuinely empty. Present-but-unreadable THROWS (mirrors the codex
+  // state loaders): a truncated index once read as an empty pool would send
+  // `init` down first-time onboarding and overwrite it, orphaning every parked
+  // credential. Damaged state is the user's to repair, loudly.
   if (!existsSync(paths.accountsJson)) return emptyIndex();
+  let json: unknown;
   try {
-    const parsed = AccountsIndexSchema.safeParse(JSON.parse(readFileSync(paths.accountsJson, "utf8")));
-    return parsed.success ? parsed.data : emptyIndex();
+    json = JSON.parse(readFileSync(paths.accountsJson, "utf8"));
   } catch {
-    return emptyIndex();
+    throw new Error(`${paths.accountsJson} is corrupt (unparsable JSON) - refusing to treat a damaged pool as empty; repair or remove the file`);
+  }
+  const parsed = AccountsIndexSchema.safeParse(json);
+  if (!parsed.success) {
+    throw new Error(`${paths.accountsJson} does not match the accounts schema - refusing to treat a damaged pool as empty; repair or remove the file`);
   }
+  return parsed.data;
 }
 
 export function saveAccounts(idx: AccountsIndex): void {
@@ -122,22 +182,57 @@ export function clearUsageSnapshots(): void {
   rmSync(paths.modelUsageJson, { force: true });
 }
 
-// ---- lastswap.json (epoch ms of the last swap; absent = never swapped) ----
+// ---- lastswap.json (epoch ms of the last swap; absent = never swapped;
+// present-but-corrupt THROWS - silently reading a damaged swap clock as
+// never-swapped would bypass the post-swap cooldown) ----
 
 export function loadLastSwapAt(): number | null {
   if (!existsSync(paths.lastSwapJson)) return null;
+  let json: unknown;
   try {
-    const parsed = LastSwapSchema.safeParse(JSON.parse(readFileSync(paths.lastSwapJson, "utf8")));
-    return parsed.success ? parsed.data.ts : null;
+    json = JSON.parse(readFileSync(paths.lastSwapJson, "utf8"));
   } catch {
-    return null;
+    throw new Error(`${paths.lastSwapJson} is corrupt (unparsable JSON) - refusing to treat a damaged swap clock as never-swapped; repair or remove the file`);
   }
+  return LastSwapSchema.parse(json).ts;
 }
 
 export function saveLastSwapAt(ts: number): void {
   writeFileAtomic(paths.lastSwapJson, JSON.stringify(LastSwapSchema.parse({ ts })));
 }
 
+// ---- depleted.json (the last depleted-wait decision; absent = none) ----
+// Written on every depleted-wait so hooks that hit an early exit (post-swap
+// cooldown, raced re-check, cleared snapshots) can REPLAY the wait to their
+// own supervisor: without the replay only the first session's Stop hook ever
+// saw a marker-writable decision and sibling sessions never paused (DESIGN.md
+// 3.5's fan-out). The record dies three ways: waitUntil passing, the live
+// seat (claude's oauthAccount) moving off the recorded account, and ANY
+// completed swap clearing it outright (performSwap - the depleted path
+// re-records its own wait right after its pre-park swap returns).
+
+const DepletedWaitSchema = z.object({ waitUntil: z.number(), accountUuid: z.string(), ts: z.number() });
+export type DepletedWait = z.infer<typeof DepletedWaitSchema>;
+
+export function loadDepletedWait(): DepletedWait | null {
+  if (!existsSync(paths.depletedJson)) return null;
+  let json: unknown;
+  try {
+    json = JSON.parse(readFileSync(paths.depletedJson, "utf8"));
+  } catch {
+    throw new Error(`${paths.depletedJson} is corrupt (unparsable JSON) - repair or remove the file`);
+  }
+  return DepletedWaitSchema.parse(json);
+}
+
+export function saveDepletedWait(rec: DepletedWait): void {
+  writeFileAtomic(paths.depletedJson, JSON.stringify(DepletedWaitSchema.parse(rec)));
+}
+
+export function clearDepletedWait(): void {
+  rmSync(paths.depletedJson, { force: true });
+}
+
 /** An alive feed re-proving unchanged figures still refreshes `ts` this often,
  *  so cache-age displays stay honest without a write+fsync per tick. */
 const USAGE_TS_REFRESH_MS = 10 * 60_000;
@@ -155,7 +250,8 @@ export function writeUsage(next: UsageState): boolean {
     } catch (e) {
       // The file vanished mid-race: a concurrent swap just invalidated these
       // figures. Suppressing stays correct; a write would resurrect them.
-      if ((e as { code?: string }).code !== "ENOENT") throw e;
+      const errno = z.object({ code: z.string() }).safeParse(e);
+      if (!errno.success || errno.data.code !== "ENOENT") throw e;
     }
     return false;
   }

package/src/lib/swap.ts

@@ -2,23 +2,27 @@
 // caller - the Stop hook or a CLI command). The keychain/json writes additionally
 // run under claude's own refresh lock so they can't interleave with a token refresh.
 //
-//   refresh B (network, no lock)
-//   resolve the live credential's TRUE owner (network, no lock)
+//   resolve the live credential's TRUE owner (network, no lock; an expiring
+//     live credential refreshes under claude's refresh lock first)
+//   refresh B's parked credential (network, no lock), persisting the rotation
+//     at once - UNLESS B IS the live owner (label drift): then the live blob is
+//     already the newest rotation and the parked copy must not be refreshed
 //   ── under claude refresh lock ──
-//     harvest live → its OWNER's backup (mandatory: refresh token rotates in place)
+//     verify the live item still holds the token the owner was resolved from
+//     (a concurrent /login or refresh in the unlocked gap aborts the swap)
+//     harvest live → its OWNER's backup (mandatory: refresh token rotates in
+//     place; when the owner IS the target this repairs its stale backup)
 //     install B into the live item
-//     persist B's rotated token into B's backup
 //     rewrite oauthAccount in ~/.claude.json
-//     mark B active (inside the lock: a crash before this write leaves a stale
-//     active label, which is exactly what once made a harvest destroy a backup)
+//     mark B active (kept adjacent to the identity write: the files cannot be
+//     crash-atomic together, but the next swap's true-owner resolution catches
+//     and logs any crash drift - swap.harvest_drift)
 
-import { clearUsageSnapshots, loadAccounts, saveAccounts, saveLastSwapAt } from "./state.ts";
+import { clearDepletedWait, clearUsageSnapshots, loadAccounts, saveAccounts, saveLastSwapAt } from "./state.ts";
 import { readItem, writeItem, liveTarget, parkedTarget, claudeAiOauthOnly, mergeIntoLive } from "./credstore.ts";
 import { refreshCredential, isAccessTokenExpiring, fetchTokenOrg, InvalidGrantError } from "./oauth.ts";
 import { swapOAuthAccount } from "./claudejson.ts";
-import { withLock } from "./lock.ts";
 import { withClaudeRefreshLock } from "./claudelock.ts";
-import { paths } from "./paths.ts";
 import { log } from "./log.ts";
 import { pickBest, type PickCtx } from "./picker.ts";
 import { CredentialBlobSchema, type Account, type OAuthCreds } from "./types.ts";
@@ -35,43 +39,47 @@ function parseBlob(raw: string) {
 export async function performSwap(target: Account): Promise<void> {
   const idx = loadAccounts();
 
-  // 1. refresh target's parked credential (network) BEFORE taking claude's lock.
-  const parkedRaw = await readItem(parkedTarget(target.keychainItem));
-  if (!parkedRaw) throw new Error(`no parked credential for ${target.email}`);
-  let fresh: OAuthCreds;
-  try {
-    fresh = await refreshCredential(parseBlob(parkedRaw).claudeAiOauth);
-  } catch (e) {
-    if (e instanceof InvalidGrantError) {
-      const t = idx.accounts.find((a) => a.accountUuid === target.accountUuid);
-      if (t) { t.needsReauth = true; saveAccounts(idx); }
-      log("swap.invalid_grant", { account: target.accountUuid.slice(0, 8) });
-    }
-    throw e;
-  }
-  // 2. resolve the live credential's TRUE owner - the harvest destination.
-  //    activeAccountUuid is a label, and labels drift from the blob they describe
-  //    (crash mid-swap, manual /login, historical re-init); harvesting by label is
-  //    how a backup once got destroyed. The token itself cannot lie. A rotation
-  //    between here and the harvest write keeps the same owner, so this can stay
-  //    outside the (fast, local) critical section.
+  // 1. resolve the live credential's TRUE owner - the harvest destination -
+  //    BEFORE any rotation. activeAccountUuid is a label, and labels drift from
+  //    the blob they describe (crash mid-swap, manual /login, historical
+  //    re-init); harvesting by label is how a backup once got destroyed, and
+  //    refreshing the target's parked copy while the target is secretly the
+  //    LIVE account would rotate a superseded grant and flag a healthy account
+  //    needs-reauth (review catch, iteration 3). The token itself cannot lie.
   const preLive = await readItem(liveTarget());
   let liveOwner: Account | null = null;
+  let liveCreds: OAuthCreds | null = null;
+  // What the live item's accessToken must still be when the critical section
+  // below re-reads it: the owner resolution here happens UNLOCKED, so a change
+  // in between means the resolved owner may describe a different credential.
+  let expectedLiveToken: string | null = null;
   if (preLive) {
-    let liveCreds = parseBlob(preLive).claudeAiOauth;
-    let identifiable = true;
+    liveCreds = parseBlob(preLive).claudeAiOauth;
+    expectedLiveToken = liveCreds.accessToken;
     if (isAccessTokenExpiring(liveCreds, 60_000)) {
       try {
-        liveCreds = await refreshCredential(liveCreds);
-        await writeItem(liveTarget(), mergeIntoLive(preLive, liveCreds));
+        await withClaudeRefreshLock(async (lock) => {
+          // re-read inside the lock: claude may have rotated it while we waited.
+          const raw2 = await readItem(liveTarget());
+          if (raw2 == null) throw new Error("live credential vanished while waiting for the refresh lock");
+          const current = parseBlob(raw2).claudeAiOauth;
+          const next = isAccessTokenExpiring(current, 60_000) ? await refreshCredential(current) : current;
+          liveCreds = next;
+          expectedLiveToken = next.accessToken;
+          if (next === current) return;
+          if (lock.compromised()) throw new Error("refresh lock compromised mid-refresh - discarding the live rewrite");
+          await writeItem(liveTarget(), mergeIntoLive(raw2, next));
+        });
       } catch (e) {
         if (!(e instanceof InvalidGrantError)) throw e;
         // dead credential family: nothing worth preserving, skip the harvest.
-        identifiable = false;
+        // expectedLiveToken keeps the on-disk token - the failed refresh wrote
+        // nothing, so the blob is unchanged until someone else changes it.
+        liveCreds = null;
         log("swap.harvest_skipped_dead_live", {});
       }
     }
-    if (identifiable) {
+    if (liveCreds != null) {
       const org = await fetchTokenOrg(liveCreds.accessToken);
       liveOwner = idx.accounts.find((a) => a.organizationUuid === org.organization_uuid) ?? null;
       if (!liveOwner) {
@@ -88,11 +96,53 @@ export async function performSwap(target: Account): Promise<void> {
     }
   }
 
+  // 2. the credential to install. When the target IS the live owner (label
+  //    drift made us "swap onto" the account already live), the live item holds
+  //    the newest rotation and NOTHING must be installed over it - refreshing
+  //    the parked copy would rotate a superseded grant, and installing any
+  //    pre-lock snapshot could clobber a rotation claude makes meanwhile; the
+  //    harvest below repairs the stale backup and the label commit repairs the
+  //    drift. Otherwise refresh the parked credential and persist the rotation
+  //    before ANY later step can fail (mirrors codexswap).
+  const selfSwap = liveOwner != null && liveOwner.accountUuid === target.accountUuid;
+  let fresh: OAuthCreds | null = null;
+  if (!selfSwap) {
+    const parkedRaw = await readItem(parkedTarget(target.keychainItem));
+    if (!parkedRaw) throw new Error(`no parked credential for ${target.email}`);
+    try {
+      fresh = await refreshCredential(parseBlob(parkedRaw).claudeAiOauth);
+    } catch (e) {
+      if (e instanceof InvalidGrantError) {
+        const t = idx.accounts.find((a) => a.accountUuid === target.accountUuid);
+        if (t) { t.needsReauth = true; saveAccounts(idx); }
+        log("swap.invalid_grant", { account: target.accountUuid.slice(0, 8) });
+      }
+      throw e;
+    }
+    await writeItem(parkedTarget(target.keychainItem), JSON.stringify({ claudeAiOauth: fresh }));
+  }
+
   // 3. the fast, local, atomic-vs-claude-refresh critical section.
-  await withClaudeRefreshLock(async () => {
+  await withClaudeRefreshLock(async (lock) => {
     const currentLive = await readItem(liveTarget());
+    if (lock.compromised()) throw new Error("refresh lock compromised - aborting the swap before any write");
+
+    // The owner above was resolved UNLOCKED (network calls must not sit inside
+    // claude's refresh lock), so a manual /login or a claude refresh can have
+    // replaced the live item since. Harvesting the replaced blob under the
+    // stale owner would corrupt that owner's only backup - the exact incident
+    // class the owner-first order exists to prevent (review catch, PR #31).
+    // Any change aborts before a single write; the next check re-resolves the
+    // true owner and retries.
+    const currentToken = currentLive == null ? null : parseBlob(currentLive).claudeAiOauth.accessToken;
+    if (currentToken !== expectedLiveToken) {
+      throw new Error("live credential changed while unlocked (concurrent /login or refresh) - aborting this swap; the next check re-resolves the owner and retries");
+    }
 
     // harvest the live claudeAiOauth into its OWNER's (small) backup item.
+    // When the owner IS the target (label drift), the live blob is the newest
+    // rotation - the parked refresh was skipped above - so this same write is
+    // exactly the repair of a stale or dead parked backup.
     if (liveOwner && currentLive) {
       await writeItem(parkedTarget(liveOwner.keychainItem), claudeAiOauthOnly(currentLive));
       log("swap.harvest", { account: liveOwner.accountUuid.slice(0, 8) });
@@ -100,12 +150,17 @@ export async function performSwap(target: Account): Promise<void> {
 
     // install B: merge B's fresh claudeAiOauth into the CURRENT live blob so all
     // sibling state (MCP OAuth tokens, etc.) is preserved across the swap.
-    await writeItem(liveTarget(), mergeIntoLive(currentLive, fresh));
-    // persist B's rotated token into its small backup item.
-    await writeItem(parkedTarget(target.keychainItem), JSON.stringify({ claudeAiOauth: fresh }));
+    // (B's rotation was already persisted to its backup right after the refresh.)
+    // A self-swap installs NOTHING: the live item already holds the newest
+    // rotation, re-read under this lock; only the label below needs repair.
+    if (fresh != null) {
+      await writeItem(liveTarget(), mergeIntoLive(currentLive, fresh));
+    }
     swapOAuthAccount(target.oauthAccount);
-    // record B as active INSIDE the critical section so a crash cannot leave the
-    // installed credential and the active label pointing at different accounts.
+    // record B as active immediately after the identity write. These separate
+    // files cannot be crash-atomic together, so a crash may leave intermediate
+    // state; the next swap resolves the live owner from the token itself and
+    // logs any drift (swap.harvest_drift).
     idx.activeAccountUuid = target.accountUuid;
     const t2 = idx.accounts.find((a) => a.accountUuid === target.accountUuid);
     if (t2) { t2.needsReauth = false; }
@@ -113,6 +168,12 @@ export async function performSwap(target: Account): Promise<void> {
     // the snapshots on disk still describe the pre-swap account; under the new
     // org label they'd trigger a bogus switch off the account just installed.
     clearUsageSnapshots();
+    // any completed swap supersedes a recorded depleted-wait: an unexpired
+    // stale record could otherwise replay through this swap's own cooldown
+    // and pause the fresh seat for a long-gone decision (review catch,
+    // PR #31). The depleted path re-records its own wait right after its
+    // pre-park swap returns.
+    clearDepletedWait();
     saveLastSwapAt(Date.now());
   });
   log("swap.done", { account: target.accountUuid.slice(0, 8), email: target.email });
@@ -123,12 +184,17 @@ export async function performSwap(target: Account): Promise<void> {
  * Assumes the caller holds the flock (does NOT lock - avoids same-process
  * flock self-deadlock). Returns the account landed on, or null if none usable.
  */
-export async function chooseAndSwap(ctx: Omit<PickCtx, "currentAccountUuid">): Promise<Account | null> {
+export async function chooseAndSwap(ctx: PickCtx): Promise<Account | null> {
+  // ctx.currentAccountUuid is the caller-resolved SEAT (decide.ts resolves it
+  // by the live org, label fallback): resolving here off activeAccountUuid
+  // re-imported the label drift the caller just resolved away, and under
+  // drift the LIVE account could be picked as its own swap target (bugbot
+  // review catch, PR #33).
   const tried = new Set<string>();
   while (true) {
     const idx = loadAccounts();
     const candidates = idx.accounts.filter((a) => !tried.has(a.accountUuid));
-    const best = pickBest(candidates, { ...ctx, currentAccountUuid: idx.activeAccountUuid });
+    const best = pickBest(candidates, ctx);
     if (!best) return null;
     tried.add(best.accountUuid);
     try {
@@ -141,7 +207,3 @@ export async function chooseAndSwap(ctx: Omit<PickCtx, "currentAccountUuid">): P
   }
 }
 
-/** Standalone lock-taking variant for CLI/manual use (NEVER call under a held flock). */
-export async function swapToBest(ctx: Omit<PickCtx, "currentAccountUuid">): Promise<Account | null> {
-  return withLock(paths.lockFile, () => chooseAndSwap(ctx));
-}