tokenmaxxing 0.19.1 → 1.0.0

package/src/entries/statusline.ts

@@ -24,9 +24,11 @@ import { loadAccounts, loadConfig, loadLastSwapAt, loadModelUsage, writeUsage }
 import { familyTokens, matchedFamily, parseStatusLineStdin, parseStatusLineModel } from "../lib/usage.ts";
 import { earliestReset, weeklyExpiry } from "../lib/picker.ts";
 import { worktreeName } from "../lib/worktree.ts";
-import { fmtResetShort, makeColors, makeUsagePaint } from "../cli/render.ts";
+import { makeColors, makeUsagePaint } from "../cli/render.ts";
+import { fmtResetShort } from "../lib/usage.ts";
 import {
   AccountsIndexSchema,
+  RateLimitsStdinSchema,
   StatusLineStdinSchema,
   UsageWindowSchema,
   type Account,
@@ -47,6 +49,11 @@ const RenderCtxSchema = z.object({
   switchModels: z.array(z.string()),
   /** linked-worktree basename, null in a main checkout. */
   worktree: z.string().nullable(),
+  /** the LIVE login's org from claude.json, the seat's identity - the
+   *  activeAccountUuid label drifts after a manual /login (the same rule as
+   *  decide.ts's seatOf; closing-review catch: the label-keyed split rendered
+   *  the live account twice and hid the stale-labeled one). */
+  liveOrg: z.string().nullable(),
   now: z.number(),
   color: z.boolean(),
   /** terminal advertises 24-bit color (COLORTERM); false steps the ramp to the 256-color cube. */
@@ -115,16 +122,20 @@ export function renderStatusline(stdinObj: unknown, ctx: RenderCtx): string {
     windows.push(seg("", wins.fiveHour, wins.fiveHour.resetsAt));
     windows.push(seg("", wins.sevenDay, wins.sevenDay.resetsAt));
   }
+  // The seat: live-org first, stored label fallback (unknown live identity).
+  const seatUuid =
+    (ctx.liveOrg != null ? ctx.accounts.accounts.find((a) => a.organizationUuid === ctx.liveOrg)?.accountUuid : undefined) ??
+    ctx.accounts.activeAccountUuid;
   const active =
     windows.length > 0
       ? `${col.green("◆")} ${windows.join(" ")}`
-      : ctx.accounts.activeAccountUuid != null
+      : seatUuid != null
         ? `${col.green("◆")} ?`
         : "";
 
   // ---- parked accounts, earliest upcoming reset first (needs-reauth last)
   const parked = sortBy(
-    ctx.accounts.accounts.filter((a) => a.accountUuid !== ctx.accounts.activeAccountUuid),
+    ctx.accounts.accounts.filter((a) => a.accountUuid !== seatUuid),
     [(a) => (a.needsReauth ? 1 : 0), (a) => earliestReset(a, ctx.now)],
   );
   // Every parked account renders its own marker (user rule 2026-07-18: the
@@ -159,34 +170,59 @@ export async function runStatusline(): Promise<number> {
   }
   const now = Date.now();
 
+  // The stdin payload's own org label: those rate_limits and that
+  // organizationUuid ride the SAME API response, so the label can never lie
+  // about whose windows these are. claude.json's org is only the fallback -
+  // it flips at the swap while a session that has made no post-swap request
+  // keeps rendering the OLD account's windows indefinitely, and the 45s
+  // ADOPTION_GRACE_MS bounds nothing for such a session (closing-review
+  // catch: a stale-window tee labeled with the new org could hard-swap a
+  // healthy account and stamp foreign usage into it). The render below uses
+  // the same preference so the active ◆ seat matches the windows painted
+  // beside it (PR #36 review catch). Trusted ONLY when the payload's windows
+  // parsed too: an org label without windows would re-label state the payload
+  // did not carry (second-round catch).
+  let stdinOrg: string | null = null;
+
   // tee usage for the Stop hook / status - best effort, never blocks rendering.
   let org: string | null = null;
   try {
     org = readOAuthAccount()?.organizationUuid ?? null;
     const windows = obj == null ? null : parseStatusLineStdin(obj);
     const lastSwapAt = loadLastSwapAt();
-    if (windows && (lastSwapAt == null || now - lastSwapAt >= ADOPTION_GRACE_MS)) {
-      const state: UsageState = { ...windows, org, ts: now, model: parseStatusLineModel(obj) };
+    stdinOrg = windows != null ? (RateLimitsStdinSchema.safeParse(obj).data?.organizationUuid ?? null) : null;
+    const teeOrg = stdinOrg ?? org;
+    if (windows && (stdinOrg != null || lastSwapAt == null || now - lastSwapAt >= ADOPTION_GRACE_MS)) {
+      const state: UsageState = { ...windows, org: teeOrg, ts: now, model: parseStatusLineModel(obj) };
       writeUsage(state);
     }
   } catch {
     // skip the tee, still render below
   }
 
-  const cfg = loadConfig();
-  const modelUsage = loadModelUsage();
-  const stdin = StatusLineStdinSchema.safeParse(obj);
-  const dir = stdin.success ? (stdin.data.workspace?.current_dir ?? stdin.data.workspace?.project_dir ?? null) : null;
-  const colorterm = z.string().optional().parse(process.env.COLORTERM);
-  const ctx: RenderCtx = {
-    accounts: loadAccounts(),
-    perModel: modelUsage && modelUsage.org === org ? modelUsage.perModel : {},
-    switchModels: cfg.policy.switchModels,
-    worktree: dir == null ? null : worktreeName(dir),
-    now,
-    color: !process.env.NO_COLOR,
-    truecolor: colorterm != null && (colorterm.includes("truecolor") || colorterm.includes("24bit")),
-  };
-  process.stdout.write(renderStatusline(obj, ctx) + "\n");
+  let line: string;
+  try {
+    const cfg = loadConfig();
+    const modelUsage = loadModelUsage();
+    const stdin = StatusLineStdinSchema.safeParse(obj);
+    const dir = stdin.success ? (stdin.data.workspace?.current_dir ?? stdin.data.workspace?.project_dir ?? null) : null;
+    const colorterm = z.string().optional().parse(process.env.COLORTERM);
+    const ctx: RenderCtx = {
+      accounts: loadAccounts(),
+      perModel: modelUsage && modelUsage.org === (stdinOrg ?? org) ? modelUsage.perModel : {},
+      switchModels: cfg.policy.switchModels,
+      worktree: dir == null ? null : worktreeName(dir),
+      liveOrg: stdinOrg ?? org,
+      now,
+      color: !process.env.NO_COLOR,
+      truecolor: colorterm != null && (colorterm.includes("truecolor") || colorterm.includes("24bit")),
+    };
+    line = renderStatusline(obj, ctx);
+  } catch (e) {
+    // Corrupt local state (the loaders throw on it) must stay VISIBLE: render
+    // the failure as the statusline itself, never abort into a blank line.
+    line = `tokenmaxxing: ${e instanceof Error ? e.message : String(e)}`;
+  }
+  process.stdout.write(line + "\n");
   return 0;
 }

package/src/entries/stophook.ts

@@ -14,7 +14,11 @@ import { evaluateAndMaybeSwap } from "../lib/decide.ts";
 import { RespawnMarkerSchema } from "../lib/types.ts";
 import { log } from "../lib/log.ts";
 
-const StopStdin = z.looseObject({ session_id: z.string().optional() });
+// session_id must be a real transcript UUID: a malformed value would ride the
+// respawn marker into `--resume <garbage>`, which claude treats as a picker
+// search term (PR #36 review catch); non-UUID input drops to undefined and the
+// marker falls back to the pinned sid.
+const StopStdin = z.looseObject({ session_id: z.uuid().optional().catch(undefined) });
 
 async function readStdin(): Promise<string> {
   const chunks: Uint8Array[] = [];
@@ -28,27 +32,37 @@ export async function runStopHook(): Promise<number> {
 
   const raw = await readStdin();
   const parsed = StopStdin.safeParse((() => { try { return JSON.parse(raw); } catch { return {}; } })());
-  const sessionId =
-    (parsed.success ? parsed.data.session_id : undefined) ?? process.env.TOKENMAXXING_SESSION_ID;
+  // TWO session ids with different jobs (closing-review HIGH catch): the
+  // PINNED id (env, set once by the supervisor) names the marker file the
+  // supervisor actually watches and survives /clear; the STDIN id names the
+  // CURRENT transcript to resume and drifts to a new value after /clear.
+  // Keying the file by the stdin id orphaned every post-/clear marker.
+  const stdinSid = parsed.success ? parsed.data.session_id : undefined;
+  const pinnedSid = process.env.TOKENMAXXING_SESSION_ID;
 
   try {
     // Anticipatory depleted swaps are only sane when the respawn marker below
     // will actually pause the session until the reset.
-    const canPause = process.env.TOKENMAXXING_SUPERVISED === "1" && sessionId != null;
+    const canPause = process.env.TOKENMAXXING_SUPERVISED === "1" && pinnedSid != null;
     const decision = await evaluateAndMaybeSwap(Date.now(), canPause);
     if (decision.account && (decision.swapped || decision.waitUntil !== undefined)) {
       log(decision.swapped ? "stop.swapped" : "stop.wait", { account: decision.account.accountUuid.slice(0, 8), waitUntil: decision.waitUntil });
       // Respawn only for a depleted-pool wait: pausing until the reset requires
       // killing the child. A plain swap leaves the session running to adopt.
-      if (decision.waitUntil !== undefined && process.env.TOKENMAXXING_SUPERVISED === "1" && sessionId) {
-        const marker = join(paths.respawnDir, sessionId);
-        const payload = RespawnMarkerSchema.parse({ account: decision.account.label, ts: Date.now(), waitUntil: decision.waitUntil });
+      if (decision.waitUntil !== undefined && canPause && pinnedSid) {
+        const marker = join(paths.respawnDir, pinnedSid);
+        const payload = RespawnMarkerSchema.parse({
+          account: decision.account.label,
+          ts: Date.now(),
+          waitUntil: decision.waitUntil,
+          sessionId: stdinSid ?? pinnedSid,
+        });
         writeFileAtomic(marker, JSON.stringify(payload));
-        log("stop.marker", { session: sessionId.slice(0, 8) });
+        log("stop.marker", { session: (stdinSid ?? pinnedSid).slice(0, 8) });
       }
     }
   } catch (e) {
-    log("stop.error", { err: String((e as Error).message ?? e) });
+    log("stop.error", { err: e instanceof Error ? e.message : String(e) });
   }
   return 0; // never block the stop
 }

package/src/entries/supervisor.ts

@@ -7,14 +7,14 @@
 // relaunches `claude --resume <id>`. Process/terminal manager only - it never
 // reads or proxies tokens.
 
-import { existsSync, mkdirSync, rmSync, readdirSync, statSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, rmSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { maxBy } from "es-toolkit";
 import { z } from "zod";
 import { paths } from "../lib/paths.ts";
 import { LOOP_DIAGNOSIS, MAX_WRAP_DEPTH, WRAP_DEPTH_ENV, WRAP_RATE_MAX, WRAP_RATE_WINDOW_MS, resolveRealClaude, wrapDepth, wrapperEntryRateTripped } from "../lib/claudebin.ts";
 import { saveTermios, restoreTermios } from "../lib/tty.ts";
-import { loadSessionFlags, saveSessionFlags } from "../lib/sessions.ts";
+import { loadSessionFlags, pruneStaleSessions, saveSessionFlags } from "../lib/sessions.ts";
 import { RespawnMarkerSchema } from "../lib/types.ts";
 import { log } from "../lib/log.ts";
 
@@ -23,6 +23,31 @@ const NONINTERACTIVE_SUBCMDS = new Set([
   "setup-token", "plugin", "agents", "completion", "help",
 ]);
 
+// Root flags whose VALUE tokens must never be read as the subcommand (e.g.
+// `--settings config` is an interactive session, not `claude config`): the
+// same hardening class shouldManageCodex got. Split by arity, mirroring
+// claude's own commander declarations (--help-verified 2.1.215; claude changes
+// monthly - a newly added value-taking flag regresses only that flag's
+// collision case). `--session-id` / `-r` / `--resume` consume their values in
+// dedicated branches below.
+const VALUE_TAKING_ROOT_FLAGS = new Set([
+  "--agent", "--agents", "--append-system-prompt", "--append-system-prompt-file",
+  "--debug-file", "--effort", "--fallback-model", "--input-format",
+  "--json-schema", "--max-budget-usd", "--model", "-n", "--name",
+  "--output-format", "--permission-mode", "--plugin-dir", "--plugin-url",
+  "--remote-control-session-name-prefix", "--setting-sources", "--settings",
+  "--system-prompt",
+]);
+// Variadic (`<x...>`): commander consumes EVERY following non-dash token.
+const VARIADIC_ROOT_FLAGS = new Set([
+  "--add-dir", "--allowedTools", "--allowed-tools", "--betas",
+  "--disallowedTools", "--disallowed-tools", "--file", "--mcp-config", "--tools",
+]);
+// Optional value (`[x]`): commander consumes the next token unless it is a flag.
+const OPTIONAL_VALUE_ROOT_FLAGS = new Set([
+  "-d", "--debug", "--from-pr", "--prompt-suggestions", "--remote-control", "-w", "--worktree",
+]);
+
 const isUuid = (s: string) => z.uuid().safeParse(s).success;
 
 const AnalysisSchema = z.object({
@@ -38,47 +63,144 @@ export function analyzeArgs(argv: string[]): Analysis {
   let resumeId: string | null = null;
   let continueLatest = false;
   let printMode = false;
+  let invalidSessionArg = false;
+  let pickerResume = false;
+  let forkSession = false;
   let firstPositional: string | null = null;
 
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i]!;
     if (a === "-p" || a === "--print") printMode = true;
     else if (a === "--version" || a === "-v" || a === "--help" || a === "-h") printMode = true;
-    else if (a === "--session-id") sessionId = argv[++i] ?? null;
+    else if (a === "--session-id") {
+      // A non-UUID here must never become supervisor state: the sid names the
+      // respawn-marker and session-flag paths (an unvalidated value could
+      // traverse out of them), and real claude rejects a malformed id anyway -
+      // pass it through unmanaged and let claude do the rejecting.
+      const next = argv[++i] ?? null;
+      if (next && isUuid(next)) sessionId = next;
+      else invalidSessionArg = true;
+    }
     else if (a === "-c" || a === "--continue") continueLatest = true;
     else if (a === "-r" || a === "--resume") {
+      // A UUID resume is managed (the sid is known, marker paths can be
+      // pinned). Bare `-r`, or `-r <term>` (binary-verified 2.1.214: a non-id
+      // value is an interactive-picker SEARCH TERM), choose the sid INSIDE
+      // claude - the supervisor cannot pin marker paths for an unknown sid, so
+      // those pass through unmanaged and claude behaves exactly as without the
+      // wrapper (same accepted state as claude's bg-daemon sessions: swaps
+      // still adopt in place, hooks still fire; only the depleted-pool
+      // countdown is absent).
       const next = argv[i + 1];
       if (next && !next.startsWith("-") && isUuid(next)) { resumeId = next; i++; }
-    } else if (!a.startsWith("-") && firstPositional === null) {
+      else pickerResume = true;
+    }
+    else if (a === "--fork-session") forkSession = true;
+    // commander's `--flag=value` forms (closing-review catch: unrecognized,
+    // they were skipped as unknown dash-args, so the supervisor pinned a
+    // fresh random sid while claude ran the flag-selected session - markers
+    // and session flags landed under an id nothing was running).
+    else if (a.startsWith("--session-id=")) {
+      const value = a.slice("--session-id=".length);
+      if (isUuid(value)) sessionId = value;
+      else invalidSessionArg = true;
+    }
+    else if (a.startsWith("--resume=")) {
+      const value = a.slice("--resume=".length);
+      if (isUuid(value)) resumeId = value;
+      else pickerResume = true;
+    }
+    else if (VALUE_TAKING_ROOT_FLAGS.has(a)) i++;
+    else if (VARIADIC_ROOT_FLAGS.has(a)) {
+      while (i + 1 < argv.length && !argv[i + 1]!.startsWith("-")) i++;
+    }
+    else if (OPTIONAL_VALUE_ROOT_FLAGS.has(a)) {
+      if (argv[i + 1] !== undefined && !argv[i + 1]!.startsWith("-")) i++;
+    }
+    else if (!a.startsWith("-") && firstPositional === null) {
       firstPositional = a;
     }
   }
 
   const isSubcmd = firstPositional !== null && NONINTERACTIVE_SUBCMDS.has(firstPositional);
-  const manage = !printMode && !isSubcmd && !process.env.TOKENMAXXING_PROBE;
+  // A forked resume gets a NEW session id chosen inside claude, so the
+  // supervisor cannot pin marker paths - pass through unmanaged like
+  // picker-mode resume (closing-review catch: managing it paired the marker
+  // to the stale pre-fork sid, and a respawn would fork yet another session).
+  const forkResume = forkSession && (resumeId !== null || continueLatest);
+  const manage = !printMode && !isSubcmd && !invalidSessionArg && !pickerResume && !forkResume && !process.env.TOKENMAXXING_PROBE;
   return { manage, sessionId, resumeId, continueLatest };
 }
 
-/** Remove session-selecting flags so we can inject our own on respawn. */
+/** Remove session-selecting flags so we can inject our own on respawn. Managed
+ *  argv can only carry a UUID-valued resume (picker-mode passes through
+ *  unmanaged), so the value is always consumed with its flag. */
 export function stripSessionFlags(argv: string[]): string[] {
   const out: string[] = [];
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i]!;
     if (a === "--session-id") { i++; continue; }
     if (a === "-c" || a === "--continue") continue;
-    if (a === "-r" || a === "--resume") {
-      const next = argv[i + 1];
-      if (next && !next.startsWith("-") && isUuid(next)) i++;
-      continue;
-    }
+    if (a === "-r" || a === "--resume") { i++; continue; }
+    // the commander `=` forms carry their value in the same token
+    if (a.startsWith("--session-id=") || a.startsWith("--resume=")) continue;
+    // --fork-session must not survive into respawn args: bare `--fork-session`
+    // is inert and stays managed, but a depleted-pool respawn injects
+    // `--resume <sid>` - with the flag still present claude would FORK to a
+    // NEW session id, permanently unpairing the supervisor's marker path from
+    // the running session (closing-review catch).
+    if (a === "--fork-session") continue;
     out.push(a);
   }
   return out;
 }
 
-/** Newest transcript session id for the current cwd (for `-c`/`-r`-without-id). */
+/** Remove positional tokens (the one-shot initial prompt) while keeping every
+ *  flag and its consumed value(s). A positional is a submit-once user turn:
+ *  persisting or replaying it on a respawn / later `--resume` re-injects the
+ *  original instruction into an already-progressed session (adversarial-review
+ *  HIGH catch) - only real flags like --model belong in sessions/ files and
+ *  respawn args.
+ *
+ *  TRADEOFF (WONTFIX, flagged PR #37): when claude adds a value-taking root
+ *  flag before the sets above are updated, that value reads as a positional
+ *  and is dropped, so the respawn launches without it and claude errors on the
+ *  missing argument - loud, and the user relaunches. The alternative default
+ *  (treat a bare token after an UNRECOGNIZED flag as that flag's value) turns
+ *  the same staleness silent: a newly added BOOLEAN flag sitting before the
+ *  prompt would make the prompt look like a value and replay a submit-once
+ *  turn, which is the exact harm this function exists to prevent. The
+ *  ambiguity is irreducible without claude's own option table, and a loud
+ *  broken launch beats a silent re-submit. */
+export function stripPositionals(argv: string[]): string[] {
+  const out: string[] = [];
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i]!;
+    // `--` ends option parsing: everything after it is positional (a prompt
+    // deliberately starting with "-"), never a flag to persist (PR #37
+    // review catch). The delimiter itself is dropped with them.
+    if (a === "--") break;
+    if (!a.startsWith("-")) continue;
+    out.push(a);
+    if (VALUE_TAKING_ROOT_FLAGS.has(a)) {
+      if (i + 1 < argv.length) out.push(argv[++i]!);
+    } else if (VARIADIC_ROOT_FLAGS.has(a)) {
+      while (i + 1 < argv.length && !argv[i + 1]!.startsWith("-")) out.push(argv[++i]!);
+    } else if (OPTIONAL_VALUE_ROOT_FLAGS.has(a)) {
+      if (i + 1 < argv.length && !argv[i + 1]!.startsWith("-")) out.push(argv[++i]!);
+    }
+  }
+  return out;
+}
+
+/** Newest transcript session id for the current cwd (for `-c`). claude's
+ *  project-dir slug maps EVERY non-alphanumeric char to "-": the regex below
+ *  mirrors claude's own, byte for byte (binary-verified 2.1.215, the external-
+ *  contract regex exception). The old [/.]-only mapping missed underscores
+ *  etc., so `-c` in such a cwd silently opened a brand-new session instead of
+ *  continuing (closing-review catch). */
 function latestSessionForCwd(): string | null {
-  const slug = process.cwd().replace(/[/.]/g, "-");
+  const slug = process.cwd().replace(/[^a-zA-Z0-9]/g, "-");
   const projDir = join(paths.claudeDir, "projects", slug);
   if (!existsSync(projDir)) return null;
   try {
@@ -92,6 +214,21 @@ function latestSessionForCwd(): string | null {
   }
 }
 
+/** Read + validate a respawn marker. An unparseable one (a version-skew hook,
+ *  corruption) is dropped loudly and reported as absent: the watcher checks
+ *  validity BEFORE the SIGTERM, so garbage can never kill the session, and the
+ *  post-exit consume can never throw after the child is already dead (PR #36
+ *  review catch). */
+function consumableMarker(marker: string): z.infer<typeof RespawnMarkerSchema> | null {
+  try {
+    return RespawnMarkerSchema.parse(JSON.parse(readFileSync(marker, "utf8")));
+  } catch (e) {
+    rmSync(marker, { force: true });
+    log("supervisor.marker_invalid", { err: e instanceof Error ? e.message : String(e) });
+    return null;
+  }
+}
+
 /** Interruptible countdown until `until`, shown in the terminal (claude is dead,
  *  so the statusLine can't render it). Ctrl-C resumes immediately. */
 async function countdownWait(acct: string, until: number): Promise<void> {
@@ -138,7 +275,17 @@ export async function runSupervisor(argv: string[]): Promise<number> {
 
   // Pass-through: no session management, no respawn - exact stock behavior.
   if (!info.manage) {
-    const p = Bun.spawn([real, ...argv], { stdin: "inherit", stdout: "inherit", stderr: "inherit", env: childEnv });
+    // STRIP the supervision pairing env (mirrors the codex shim's passthrough
+    // arm, closing-review catch): a nested unmanaged claude inside a
+    // supervised session (e.g. the agent running `claude -p ...`) would
+    // otherwise inherit TOKENMAXXING_SUPERVISED/TOKENMAXXING_SESSION_ID, and
+    // its Stop hooks - which DO fire in print mode - would compute
+    // canPause=true and could anticipatorily pre-park the pool against a
+    // marker path the OUTER supervisor owns.
+    const passthroughEnv: Record<string, string | undefined> = { ...childEnv };
+    delete passthroughEnv.TOKENMAXXING_SUPERVISED;
+    delete passthroughEnv.TOKENMAXXING_SESSION_ID;
+    const p = Bun.spawn([real, ...argv], { stdin: "inherit", stdout: "inherit", stderr: "inherit", env: passthroughEnv });
     await p.exited;
     return p.exitCode ?? (p.signalCode ? 1 : 0);
   }
@@ -163,9 +310,18 @@ export async function runSupervisor(argv: string[]): Promise<number> {
   // this time (a bare `claude --resume <id>`, or the depleted-pool recovery).
   if (resuming && base.length === 0) {
     const persisted = loadSessionFlags(sid);
-    if (persisted) base = persisted;
+    // enforce the flags-only contract at the trust boundary, not just at
+    // write: a sessions/ file written before stripPositionals existed can
+    // still carry the original prompt, and restoring it verbatim would
+    // re-submit that prompt on a bare `claude --resume` (PR #37 review
+    // catch). Idempotent on well-formed files.
+    if (persisted) base = stripPositionals(persisted);
   }
-  saveSessionFlags(sid, base, process.cwd());
+  // The FIRST launch keeps a positional prompt (the user just typed it);
+  // everything persisted or respawned carries flags only.
+  const persistable = stripPositionals(base);
+  saveSessionFlags(sid, persistable, process.cwd());
+  pruneStaleSessions(Date.now());
 
   let launchArgs = resuming ? ["--resume", sid, ...base] : ["--session-id", sid, ...base];
 
@@ -194,7 +350,7 @@ export async function runSupervisor(argv: string[]): Promise<number> {
     let done = false;
     const markerWatch = (async () => {
       while (!done) {
-        if (await Bun.file(marker).exists()) return true;
+        if (existsSync(marker) && consumableMarker(marker) != null) return true;
         await Bun.sleep(150);
       }
       return false;
@@ -210,13 +366,21 @@ export async function runSupervisor(argv: string[]): Promise<number> {
     await markerWatch.catch(() => {});
     restoreTermios(savedTermios);
 
-    if (existsSync(marker)) {
-      const m = RespawnMarkerSchema.parse(await Bun.file(marker).json());
+    const m = existsSync(marker) ? consumableMarker(marker) : null;
+    if (m) {
       rmSync(marker, { force: true });
       respawns++;
       if (m.waitUntil > Date.now()) await countdownWait(m.account, m.waitUntil);
       else process.stdout.write(`\n\x1b[36m↻ tokenmaxxing: switched to ${m.account} - resuming...\x1b[0m\n`);
-      launchArgs = ["--resume", sid, ...base];
+      // resume the marker's CURRENT transcript, not the pinned id: after
+      // /clear they differ, and resuming the pinned id would revive the
+      // pre-/clear conversation (closing-review HIGH catch). Persist the
+      // flags under that transcript id too, so a later bare
+      // `claude --resume <id>` restores them (PR #36 review catch). FLAGS
+      // only: replaying a positional prompt would re-submit it as a fresh
+      // turn on the progressed session (adversarial-review HIGH catch).
+      saveSessionFlags(m.sessionId, persistable, process.cwd());
+      launchArgs = ["--resume", m.sessionId, ...persistable];
       continue;
     }
     // No marker: claude exited on its own (quit, crash, resume refused). Log it -

package/src/lib/atomic.ts

@@ -1,6 +1,6 @@
 // Atomic file writes (temp + rename on the same filesystem) and small fs utils.
 
-import { closeSync, mkdirSync, openSync, renameSync, writeSync, fsyncSync } from "node:fs";
+import { closeSync, mkdirSync, openSync, renameSync, rmSync, writeSync, fsyncSync } from "node:fs";
 import { dirname } from "node:path";
 
 /**
@@ -15,10 +15,32 @@ export function writeFileAtomic(file: string, data: string | Uint8Array, mode =
   const bytes = data instanceof Uint8Array ? data : new TextEncoder().encode(data);
   const fd = openSync(tmp, "wx", mode);
   try {
-    writeSync(fd, bytes);
-    fsyncSync(fd);
-  } finally {
-    closeSync(fd);
+    try {
+      // write(2) may write FEWER bytes than asked without throwing (ENOSPC mid-
+      // write, signal interruption): loop until done and fail loudly on a stuck
+      // fd, or a truncated temp file gets fsynced and renamed over the target
+      // as a successful-looking corrupt file (closing-review catch - for a
+      // parked credential that silently loses a just-rotated refresh token).
+      let offset = 0;
+      while (offset < bytes.length) {
+        const written = writeSync(fd, bytes, offset);
+        if (written <= 0) throw new Error(`short write on ${tmp}: ${offset}/${bytes.length} bytes (disk full?)`);
+        offset += written;
+      }
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    renameSync(tmp, file);
+  } catch (e) {
+    // a failed write must not strand the partial temp file - it can hold a
+    // truncated credential (PR #36 review catch) - and a failed CLEANUP must
+    // not mask the write error the caller needs (second-round catch)
+    try {
+      rmSync(tmp, { force: true });
+    } catch {
+      // the original write error below is the one that matters
+    }
+    throw e;
   }
-  renameSync(tmp, file);
 }

package/src/lib/claudebin.ts

@@ -72,7 +72,7 @@ export function pointsBackAtUs(bin: string): boolean {
  *  All of them, not just the first: a user-made wrapper script named claude can
  *  sit ahead of the real binary, and verified resolution must be able to walk
  *  past it. */
-export function scanPathForClaudeCandidates(): string[] {
+function scanPathForClaudeCandidates(): string[] {
   const seen = new Set<string>();
   const out: string[] = [];
   for (const d of (process.env.PATH ?? "").split(":")) {
@@ -133,7 +133,7 @@ export function verifyRealClaude(bin: string): string | null {
     // loop-abort diagnostic points the user at.
     p = Bun.spawnSync([bin, "--version"], { env, stdout: "pipe", stderr: "pipe", timeout: 15_000, killSignal: "SIGKILL" });
   } catch (e) {
-    return String((e as Error).message ?? e);
+    return e instanceof Error ? e.message : String(e);
   }
   const outText = (p.stdout?.toString() ?? "").trim();
   const err = (p.stderr?.toString() ?? "").trim();

package/src/lib/claudejson.ts

@@ -7,9 +7,11 @@ import { paths } from "./paths.ts";
 import { writeFileAtomic } from "./atomic.ts";
 import { OAuthAccountSchema, type OAuthAccount } from "./types.ts";
 
-export function readClaudeJson(): Record<string, unknown> {
+const ClaudeJsonSchema = z.record(z.string(), z.unknown());
+
+function readClaudeJson(): Record<string, unknown> {
   if (!existsSync(paths.claudeJson)) return {};
-  return JSON.parse(readFileSync(paths.claudeJson, "utf8")) as Record<string, unknown>;
+  return ClaudeJsonSchema.parse(JSON.parse(readFileSync(paths.claudeJson, "utf8")));
 }
 
 export function readOAuthAccount(): OAuthAccount | null {
@@ -32,9 +34,7 @@ export function isApiKeyMode(): boolean {
  * to unrelated keys with a stale in-memory copy.
  */
 export function swapOAuthAccount(next: OAuthAccount): void {
-  const j = existsSync(paths.claudeJson)
-    ? (JSON.parse(readFileSync(paths.claudeJson, "utf8")) as Record<string, unknown>)
-    : {};
+  const j = readClaudeJson();
   j["oauthAccount"] = next;
   writeFileAtomic(paths.claudeJson, JSON.stringify(j, null, 2) + "\n", 0o600);
 }