tokenmaxxing 0.19.1 → 1.0.0

package/src/lib/sample.ts

@@ -31,22 +31,32 @@ import { CredentialBlobSchema, type Account, type OAuthCreds, type RolesResponse
 /** Result of a live sample: the fresh usage, or why it could not be taken.
  *  `pingError` is set only when a requested ping (status --force) failed - the
  *  account's 5h timer may not have started even if the sample itself succeeded. */
-export const SampleOutcomeSchema = z.discriminatedUnion("ok", [
+const SampleOutcomeSchema = z.discriminatedUnion("ok", [
   z.object({ ok: z.literal(true), usage: FullUsageSchema, pingError: z.string().optional() }),
   z.object({ ok: z.literal(false), reason: z.string(), pingError: z.string().optional() }),
 ]);
 export type SampleOutcome = z.infer<typeof SampleOutcomeSchema>;
 
-/** Verify `creds` belongs to `account`; null on match, else the mismatch reason. */
-async function identityMismatch(creds: OAuthCreds, account: Account): Promise<string | null> {
+const IdentityCheckSchema = z.discriminatedUnion("status", [
+  z.object({ status: z.literal("match") }),
+  z.object({ status: z.literal("mismatch"), reason: z.string() }),
+  z.object({ status: z.literal("unavailable"), reason: z.string() }),
+]);
+type IdentityCheck = z.infer<typeof IdentityCheckSchema>;
+
+/** Verify `creds` belongs to `account`. Only a definitive org DISAGREEMENT is
+ *  a mismatch; an unreachable roles endpoint is "unavailable" and must never
+ *  bench the account - a transient outage is not a dead credential, and
+ *  flagging on it once removed every parked account from switching. */
+async function checkIdentity(creds: OAuthCreds, account: Account): Promise<IdentityCheck> {
   let org: RolesResponse;
   try {
     org = await fetchTokenOrg(creds.accessToken);
   } catch (e) {
-    return `credential identity check failed: ${String((e as Error).message ?? e)}`;
+    return { status: "unavailable", reason: `credential identity check failed: ${e instanceof Error ? e.message : String(e)}` };
   }
-  if (org.organization_uuid === account.organizationUuid) return null;
-  return `credential actually belongs to ${org.organization_name} (org ${org.organization_uuid.slice(0, 8)})`;
+  if (org.organization_uuid === account.organizationUuid) return { status: "match" };
+  return { status: "mismatch", reason: `credential actually belongs to ${org.organization_name} (org ${org.organization_uuid.slice(0, 8)})` };
 }
 
 /** Stamp the blob's plan fields onto the account (caller persists). Runs only
@@ -74,11 +84,36 @@ export async function probeParkedUsage(account: Account, opts: { ping?: boolean
   try {
     creds = CredentialBlobSchema.parse(JSON.parse(parkedRaw)).claudeAiOauth;
   } catch (e) {
-    return { ok: false, reason: `parked credential unreadable (${String((e as Error).message ?? e).slice(0, 80)}) - run \`tokenmaxxing auth\`` };
+    return { ok: false, reason: `parked credential unreadable (${(e instanceof Error ? e.message : String(e)).slice(0, 80)}) - run \`tokenmaxxing auth\`` };
+  }
+
+  // The parked copy must never be refreshed (or probed - the probe can rotate
+  // it too) while its account secretly owns the LIVE login: after a crash
+  // between performSwap's live install and the oauthAccount rewrite, status
+  // still routes the live account here, and a parked-side rotation would
+  // supersede the live item's single-use refresh token out from under the
+  // running session - or, if claude rotated first, falsely flag the healthy
+  // live account needsReauth (closing-review catch; mirrors the codex
+  // sampler's present-account invariant). Verified against the live blob's
+  // TRUE org, fail-closed like the rm guard: an unverifiable live owner
+  // refuses the sample rather than risking the live grant.
+  const liveRaw = await readItem(liveTarget());
+  if (liveRaw != null) {
+    let liveOrg: string;
+    try {
+      const liveCreds = CredentialBlobSchema.parse(JSON.parse(liveRaw)).claudeAiOauth;
+      liveOrg = (await fetchTokenOrg(liveCreds.accessToken)).organization_uuid;
+    } catch (e) {
+      return { ok: false, reason: `cannot verify the live credential's owner (${(e instanceof Error ? e.message : String(e)).slice(0, 80)}) - refusing to sample a possibly-live account` };
+    }
+    if (liveOrg === account.organizationUuid) {
+      return { ok: false, reason: "this account holds the LIVE login (active label drifted) - run `tokenmaxxing switch` to reconcile" };
+    }
   }
 
   // Hand claude a token with comfortable headroom so it won't run its own refresh
-  // (which claude does within 120s of expiry). Refresh + persist ourselves first.
+  // (which claude does within 300s of expiry - the same margin checked here).
+  // Refresh + persist ourselves first.
   if (isAccessTokenExpiring(creds, 300_000)) {
     try {
       creds = await refreshCredential(creds);
@@ -86,16 +121,19 @@ export async function probeParkedUsage(account: Account, opts: { ping?: boolean
     } catch (e) {
       if (e instanceof InvalidGrantError) {
         account.needsReauth = true;
-        return { ok: false, reason: "refresh token dead - re-auth with `tokenmaxxing add`" };
+        return { ok: false, reason: "refresh token dead - re-auth with `tokenmaxxing auth`" };
       }
-      return { ok: false, reason: `token refresh failed: ${String((e as Error).message ?? e)}` };
+      return { ok: false, reason: `token refresh failed: ${e instanceof Error ? e.message : String(e)}` };
     }
   }
 
-  const mismatch = await identityMismatch(creds, account);
-  if (mismatch) {
+  const identity = await checkIdentity(creds, account);
+  if (identity.status === "mismatch") {
     account.needsReauth = true;
-    return { ok: false, reason: `${mismatch} - this account's own credential is gone; re-auth with \`tokenmaxxing add\`` };
+    return { ok: false, reason: `${identity.reason} - this account's own credential is gone; re-auth with \`tokenmaxxing auth\`` };
+  }
+  if (identity.status === "unavailable") {
+    return { ok: false, reason: identity.reason };
   }
   refreshPlanFields(account, creds);
 
@@ -124,6 +162,35 @@ export async function probeParkedUsage(account: Account, opts: { ping?: boolean
   }
 }
 
+/** Refresh the LIVE access token when near expiry, under claude's own refresh
+ *  lock. Exported for `xx status`: every parked probe's fail-closed live-owner
+ *  check reads this token, so it must be fresh BEFORE those probes run - even
+ *  when the active account's own usage comes from the statusline tee and no
+ *  active probe happens (cubic review catch, PR #35: the tee short-circuit
+ *  skipped the refresh and every parked sample 401'd on the first post-idle
+ *  status). No live item, or an unparsable one, is a no-op here: the callers'
+ *  own guards surface those loudly. InvalidGrantError propagates. */
+export async function ensureLiveTokenFresh(): Promise<void> {
+  const liveRaw = await readItem(liveTarget());
+  if (!liveRaw) return;
+  let creds: OAuthCreds;
+  try {
+    creds = CredentialBlobSchema.parse(JSON.parse(liveRaw)).claudeAiOauth;
+  } catch {
+    return;
+  }
+  if (!isAccessTokenExpiring(creds, 300_000)) return;
+  await withClaudeRefreshLock(async (lock) => {
+    const raw2 = await readItem(liveTarget());
+    if (raw2 == null) throw new Error("live credential vanished while waiting for the refresh lock");
+    const current = CredentialBlobSchema.parse(JSON.parse(raw2)).claudeAiOauth;
+    const next = isAccessTokenExpiring(current, 300_000) ? await refreshCredential(current) : current;
+    if (next === current) return;
+    if (lock.compromised()) throw new Error("refresh lock compromised mid-refresh - discarding the live rewrite");
+    await writeItem(liveTarget(), mergeIntoLive(raw2, next));
+  });
+}
+
 /**
  * Live-sample the ACTIVE account off the live login, verifying the live
  * credential belongs to it. `/usage` with no CLAUDE_CONFIG_DIR meters the live
@@ -132,32 +199,25 @@ export async function probeParkedUsage(account: Account, opts: { ping?: boolean
  * the identity check - never spend quota on a drifted credential).
  */
 export async function probeActiveUsage(account: Account, opts: { ping?: boolean } = {}): Promise<SampleOutcome> {
+  // A running claude keeps the live token fresh; after long idle it may not have.
+  try {
+    await ensureLiveTokenFresh();
+  } catch (e) {
+    if (e instanceof InvalidGrantError) return { ok: false, reason: "live refresh token dead - run `claude` and `/login`" };
+    return { ok: false, reason: `token refresh failed: ${e instanceof Error ? e.message : String(e)}` };
+  }
   const liveRaw = await readItem(liveTarget());
   if (!liveRaw) return { ok: false, reason: "no live credential - run `claude` and `/login`" };
   let creds: OAuthCreds;
   try {
     creds = CredentialBlobSchema.parse(JSON.parse(liveRaw)).claudeAiOauth;
   } catch (e) {
-    return { ok: false, reason: `live credential blob unreadable (${String((e as Error).message ?? e).slice(0, 80)})` };
-  }
-
-  // A running claude keeps the live token fresh; after long idle it may not have.
-  if (isAccessTokenExpiring(creds, 300_000)) {
-    try {
-      await withClaudeRefreshLock(async () => {
-        const raw2 = (await readItem(liveTarget())) ?? liveRaw;
-        const current = CredentialBlobSchema.parse(JSON.parse(raw2)).claudeAiOauth;
-        creds = isAccessTokenExpiring(current, 300_000) ? await refreshCredential(current) : current;
-        if (creds !== current) await writeItem(liveTarget(), mergeIntoLive(raw2, creds));
-      });
-    } catch (e) {
-      if (e instanceof InvalidGrantError) return { ok: false, reason: "live refresh token dead - run `claude` and `/login`" };
-      return { ok: false, reason: `token refresh failed: ${String((e as Error).message ?? e)}` };
-    }
+    return { ok: false, reason: `live credential blob unreadable (${(e instanceof Error ? e.message : String(e)).slice(0, 80)})` };
   }
 
-  const mismatch = await identityMismatch(creds, account);
-  if (mismatch) return { ok: false, reason: `live ${mismatch} - active label drifted; run \`tokenmaxxing switch\`` };
+  const identity = await checkIdentity(creds, account);
+  if (identity.status === "mismatch") return { ok: false, reason: `live ${identity.reason} - active label drifted; run \`tokenmaxxing switch\`` };
+  if (identity.status === "unavailable") return { ok: false, reason: identity.reason };
   refreshPlanFields(account, creds);
 
   const pingError = opts.ping ? await pingSession() : null;

package/src/lib/sessions.ts

@@ -3,7 +3,7 @@
 // recovery in #20) re-applies them instead of dropping --dangerously-skip-
 // permissions / --model / etc.
 
-import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { paths } from "./paths.ts";
@@ -11,6 +11,12 @@ import { writeFileAtomic } from "./atomic.ts";
 
 const SessionSchema = z.object({ flags: z.array(z.string()), cwd: z.string() });
 
+// Matches claude's default transcript retention (cleanupPeriodDays 30): a
+// transcript claude has already deleted cannot be resumed, so its flags file
+// is dead weight. saveSessionFlags rewrites the file on every (re)launch, so
+// an actively resumed session keeps its mtime fresh and is never pruned.
+const SESSION_RETENTION_MS = 30 * 24 * 3600 * 1000;
+
 function sessionFile(sid: string): string {
   return join(paths.home, "sessions", `${sid}.json`);
 }
@@ -25,3 +31,19 @@ export function loadSessionFlags(sid: string): string[] | null {
   if (!existsSync(f)) return null;
   return SessionSchema.parse(JSON.parse(readFileSync(f, "utf8"))).flags;
 }
+
+/** Delete session files past the retention window (also reaps stale
+ *  writeFileAtomic temp siblings from a crashed writer). */
+export function pruneStaleSessions(now: number): void {
+  const dir = join(paths.home, "sessions");
+  if (!existsSync(dir)) return;
+  for (const f of readdirSync(dir)) {
+    const p = join(dir, f);
+    try {
+      if (now - statSync(p).mtimeMs > SESSION_RETENTION_MS) rmSync(p, { force: true });
+    } catch {
+      // A concurrent writeFileAtomic renames its tmp sibling away between
+      // readdir and stat; a vanished entry needs no pruning.
+    }
+  }
+}

package/src/lib/settings.ts

@@ -4,7 +4,7 @@
 // are ours outright - tokenmaxxing renders them natively, so any other
 // statusLine command is replaced.
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { paths } from "./paths.ts";
@@ -39,11 +39,15 @@ function readSettings(): Settings {
 }
 
 function writeSettings(s: Settings): void {
-  writeFileAtomic(paths.claudeSettings, JSON.stringify(s, null, 2) + "\n", 0o644);
+  // Preserve the user's mode: settings.json can carry an env block with
+  // credentials, and the atomic rename would otherwise widen a 0600 file to
+  // world-readable. A brand-new file starts at the conservative 0600.
+  const mode = existsSync(paths.claudeSettings) ? statSync(paths.claudeSettings).mode & 0o777 : 0o600;
+  writeFileAtomic(paths.claudeSettings, JSON.stringify(s, null, 2) + "\n", mode);
 }
 
 /** True if a hook/statusline command string is one tokenmaxxing installed. */
-export function isOurCommand(cmd: string | undefined): boolean {
+function isOurCommand(cmd: string | undefined): boolean {
   if (!cmd) return false;
   return (
     cmd.includes(SUBCMD.statusline) ||
@@ -55,36 +59,69 @@ export function isOurCommand(cmd: string | undefined): boolean {
   );
 }
 
+/** The exact command string installSettings writes for a subcommand; doctor
+ *  compares against it verbatim, so a green check proves the canonical entry. */
+function ourCommand(sub: string): string {
+  return `${JSON.stringify(installedBin())} ${sub}`;
+}
+
 function ourHookGroup(sub: string): HookGroup {
-  return { hooks: [{ type: "command", command: `${JSON.stringify(installedBin())} ${sub}` }] };
+  return { hooks: [{ type: "command", command: ourCommand(sub) }] };
 }
 
 function appendHook(s: Settings, event: string, sub: string): void {
   s.hooks ??= {};
   s.hooks[event] ??= [];
   const arr = s.hooks[event]!;
-  const present = arr.some((g) => g.hooks?.some((h) => h.command?.includes(sub)));
+  const present = arr.some((g) => g.hooks.some((h) => h.command === ourCommand(sub)));
   if (!present) arr.push(ourHookGroup(sub));
 }
 
+/** True only for a command tokenmaxxing itself wrote - the exact historical
+ *  shape `"<...>/tokenmaxxing" <sub>` at ANY install path (so stale
+ *  pre-relocation entries match too). A foreign command that merely mentions
+ *  the subcommand or the path as text is NOT ours and must survive removal. */
+/** Structural ownership: exactly `"<path>/tokenmaxxing" <sub>`. Exported for
+ *  the codex hooks.json installer, whose old includes()-based match deleted
+ *  foreign hooks sharing a group and misclassified commands merely mentioning
+ *  the subcommand (closing-review catch; the same class settings.ts's own
+ *  removeHook was fixed for in PR #31). */
+export function isOurHookCommand(cmd: string, sub: string): boolean {
+  if (!cmd.endsWith(` ${sub}`)) return false;
+  const quotedPath = cmd.slice(0, cmd.length - (sub.length + 1));
+  if (!quotedPath.startsWith('"') || !quotedPath.endsWith('"')) return false;
+  let path: unknown;
+  try {
+    path = JSON.parse(quotedPath);
+  } catch {
+    return false;
+  }
+  const parsed = z.string().safeParse(path);
+  return parsed.success && parsed.data.endsWith("/tokenmaxxing");
+}
+
 function removeHook(s: Settings, event: string, sub: string): void {
   const arr = s.hooks?.[event];
   if (!arr) return;
-  s.hooks![event] = arr.filter((g) => !g.hooks?.some((h) => h.command?.includes(sub)));
+  // Strip only VERIFIED tokenmaxxing-owned entries from WITHIN each group:
+  // foreign hooks sharing a group - or merely mentioning our strings - survive
+  // (review catches, PR #31), and a group is dropped only once it is empty.
+  for (const g of arr) g.hooks = g.hooks.filter((h) => !isOurHookCommand(h.command, sub));
+  s.hooks![event] = arr.filter((g) => g.hooks.length > 0);
   if (s.hooks![event]!.length === 0) delete s.hooks![event];
 }
 
-/** Install the entries: take both statusLine slots, append our hooks. */
+/** Install the entries: take both statusLine slots, append our hooks. Stale
+ *  same-subcommand hooks from an OLD install path are dropped first, so a
+ *  TOKENMAXXING_HOME relocation rewrites the entries instead of leaving dead
+ *  paths that read as installed (relocation residue is how the supervisor
+ *  recursion incident started). Foreign hooks are untouched. */
 export function installSettings(): void {
   const s = readSettings();
-  s.statusLine = {
-    type: "command",
-    command: `${JSON.stringify(installedBin())} ${SUBCMD.statusline}`,
-  };
-  s.subagentStatusLine = {
-    type: "command",
-    command: `${JSON.stringify(installedBin())} ${SUBCMD.subagentStatusline}`,
-  };
+  s.statusLine = { type: "command", command: ourCommand(SUBCMD.statusline) };
+  s.subagentStatusLine = { type: "command", command: ourCommand(SUBCMD.subagentStatusline) };
+  removeHook(s, "Stop", SUBCMD.stop);
+  removeHook(s, "SessionStart", SUBCMD.sessionStart);
   appendHook(s, "Stop", SUBCMD.stop);
   appendHook(s, "SessionStart", SUBCMD.sessionStart);
   writeSettings(s);
@@ -110,11 +147,15 @@ export type SettingsCheck = z.infer<typeof SettingsCheckSchema>;
 
 export function checkSettings(): SettingsCheck {
   const s = readSettings();
+  // Exact-command identity (review catch, PR #31): only the verbatim string
+  // installSettings writes counts as installed. A hook pointing at an OLD
+  // install path reads as broken, and a foreign command that merely mentions
+  // the path or subcommand as text never green-lights.
   const has = (event: string, sub: string) =>
-    !!s.hooks?.[event]?.some((g) => g.hooks?.some((h) => h.command?.includes(sub)));
+    !!s.hooks?.[event]?.some((g) => g.hooks.some((h) => h.command === ourCommand(sub)));
   return {
-    statusLineOk: isOurCommand(s.statusLine?.command),
-    subagentStatusLineOk: isOurCommand(s.subagentStatusLine?.command),
+    statusLineOk: s.statusLine?.command === ourCommand(SUBCMD.statusline),
+    subagentStatusLineOk: s.subagentStatusLine?.command === ourCommand(SUBCMD.subagentStatusline),
     stopOk: has("Stop", SUBCMD.stop),
     sessionStartOk: has("SessionStart", SUBCMD.sessionStart),
   };