tokenmaxxing 0.21.0 → 1.0.0

package/DESIGN.md

@@ -72,7 +72,7 @@ Each terminal ran the supervisor, so each has its own child `claude` and its own
 
 - **`tokenmaxxing init` imports the account you're already on - automatically, no prompts, no re-login.** It reads the live `Claude Code-credentials` keychain blob plus the `oauthAccount` object in `~/.claude.json` (email, `organizationUuid`, `accountUuid`, plan tier) and writes them as **account #1** into tokenmaxxing's store (`tokenmaxxing-cred-<accountUuid[:8]>` + an `accounts.json` index entry). Nothing about your current session changes - that account stays active; it's now just also a registered pool member. After this one command you already have a working (single-account) pool. `init` also installs the supervisor + the four settings entries.
   - If the current auth is API-key mode (`ANTHROPIC_API_KEY`/`apiKeyHelper`) rather than a subscription `/login`, there's no quota-poolable subscription credential to import - `init` says so and points you to `/login` first (per-token API billing isn't what tokenmaxxing pools).
-- **`tokenmaxxing add`** - registers *additional* accounts: logs one in via a throwaway `CLAUDE_CONFIG_DIR=~/.config/tokenmaxxing/onboard` (your primary login untouched), harvests it into the store, deletes the temp dir + its namespaced item. This is the **only** time `CLAUDE_CONFIG_DIR` is ever used.
+- **`tokenmaxxing add`** - registers *additional* accounts: logs one in via a throwaway `CLAUDE_CONFIG_DIR=~/.config/tokenmaxxing/onboard` (your primary login untouched), harvests it into the store, deletes the temp dir + its namespaced item. `CLAUDE_CONFIG_DIR` is SET by tokenmaxxing only for throwaway isolated stores like this one: the same harvest serves `auth`, and parked-account `/usage` sampling probes under `sample/<item>` the same way; an AMBIENT `CLAUDE_CONFIG_DIR` is refused by every CLI command and by the SDK's pooledSpawnEnv.
 - **`tokenmaxxing auth [sel | --all]`** - reauthenticates an *existing* pool member whose refresh token died (a needs-reauth account can never heal through a swap: the dead token is exactly what a swap would need). Same isolated-login harvest as `add`, but it states which email to sign in with and **requires the login to land on the target account** (harvested `accountUuid` must match, else nothing changes) - the credential write and the needs-reauth clear happen in one flock critical section so a concurrent swap's harvest cannot clobber the fresh backup. Bare `auth` lists the pool with emails and asks which; `--all` walks every flagged account one by one.
 - Both commands exercise `security` reads/writes interactively (where a macOS keychain ACL prompt is acceptable), so the first access never happens cold inside a headless hook.
 

package/README.md

@@ -39,6 +39,7 @@ claude                  # use claude as always
 | `tokenmaxxing add` | register an additional account (isolated login, harvested into the pool) |
 | `tokenmaxxing add --codex` | register an additional codex account (isolated login) |
 | `tokenmaxxing auth [sel \| --all]` | reauthenticate a pooled account in place: bare lists the pool (emails shown) and asks which; a selector targets one account and tells you the email to sign in with; `--all` walks every needs-reauth account one by one |
+| `tokenmaxxing switch [sel]` | switch the claude pool: bare picks the best account greedily (no-op when the current one wins), a selector targets one |
 | `tokenmaxxing switch --codex [sel]` | switch the codex pool (takes effect on the next codex start) |
 | `tokenmaxxing ls` | list pooled accounts |
 | `tokenmaxxing status` | accounts with 5h / weekly usage bars, active + exhausted-until-reset |
@@ -47,7 +48,7 @@ claude                  # use claude as always
 | `tokenmaxxing config` | effective config with sources; `get`/`set`/`unset` dotted keys, `tidy` prunes unknown keys |
 | `tokenmaxxing serve` | Slack bridge daemon (Socket Mode, no public URL): `setup` prints the app manifest and stores the two tokens, `link <channel-id> <repo>` ties a channel to a repo (`--yolo` for full-autonomy bypassPermissions sessions), then mentioning the bot in that channel opens a Claude Code session per thread in the repo checkout (the session cuts its own git worktree only when a task needs isolation) and thread messages relay in and out |
 | `tokenmaxxing doctor` | verify the supervisor + settings entries survived |
-| `tokenmaxxing rename [--codex] <sel> <label>` / `rm <sel>` | manage the pool (`--codex` targets the codex pool: one email can hold both a claude and a codex account) |
+| `tokenmaxxing rename [--codex] <sel> <label>` / `rm [--codex] <sel>` | manage the pool (`--codex` targets the codex pool: one email can hold both a claude and a codex account) |
 | `tokenmaxxing uninstall` | remove supervisor + settings entries (accounts/credentials kept) |
 
 ## How switching decides

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "0.21.0",
+  "version": "1.0.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",

package/src/cli/codexrm.ts

@@ -0,0 +1,49 @@
+// `tokenmaxxing rm --codex <selector>` - remove a pooled codex account (not
+// the live one). Until this existed the uninstall message pointed users at
+// `xx rm` for every parked credential while codex blobs were unremovable
+// (adversarial-review catch).
+
+import { withLock } from "../lib/lock.ts";
+import { codexPaths } from "../lib/paths.ts";
+import { loadCodexAccounts, saveCodexAccounts } from "../lib/codexstate.ts";
+import { deleteParkedCodexAuth } from "../lib/codexauth.ts";
+import { liveCodexAccountId } from "../lib/codexsample.ts";
+import { presentCodexAccountIds } from "../lib/codexpresence.ts";
+import { findCodexAccount } from "./rename.ts";
+import { c } from "./render.ts";
+
+export async function cmdCodexRm(selector?: string): Promise<number> {
+  if (!selector) {
+    console.error("usage: tokenmaxxing rm --codex <email|label|id>");
+    return 2;
+  }
+  // under the codex flock: a concurrent swap's index write must not be clobbered.
+  return withLock(codexPaths.lockFile, async () => {
+    const index = loadCodexAccounts();
+    const account = findCodexAccount(index.accounts, selector);
+    if (!account) {
+      console.error(c.red(`no codex account matches "${selector}"`));
+      return 1;
+    }
+    // The live identity is decoded from auth.json itself (id_token claims),
+    // offline ground truth - labels drift, the blob cannot lie. An unreadable
+    // live blob THROWS out of liveCodexAccountId (the codex loaders' contract),
+    // which fails this destructive command loudly rather than trusting a label.
+    if (liveCodexAccountId() === account.accountId) {
+      console.error(c.red(`${account.label} is the LIVE codex account - run \`tokenmaxxing switch --codex\` to move off it first.`));
+      return 1;
+    }
+    if (presentCodexAccountIds().has(account.accountId)) {
+      console.error(c.red(`${account.label} is running in a live codex session - close that session before removing it.`));
+      return 1;
+    }
+    // Parked codex blobs are plain 0600 files; hard delete on purpose (the
+    // credential-dir cleanup exception - trashing would move a credential
+    // into the Trash folder).
+    deleteParkedCodexAuth({ credFile: account.credFile });
+    index.accounts = index.accounts.filter((x) => x.accountId !== account.accountId);
+    saveCodexAccounts({ index });
+    console.log(`removed codex account ${c.bold(account.label)} from the pool (${index.accounts.length} left)`);
+    return 0;
+  });
+}

package/src/cli/codexswitch.ts

@@ -32,7 +32,11 @@ export async function cmdCodexSwitch(sel?: string): Promise<number> {
     }
     const currentId = liveCodexAccountId();
 
-    if (sel !== undefined) {
+    // truthiness on purpose, mirroring the claude switch: an EMPTY selector
+    // must mean "no selector" - `startsWith("")` matches every account, so
+    // `sel !== undefined` let `xx switch --codex ""` swap onto the first
+    // account (adversarial-review catch)
+    if (sel) {
       const target = index.accounts.find(
         (account) => account.label === sel || account.email === sel || account.accountId.startsWith(sel),
       );

package/src/cli/config.ts

@@ -160,6 +160,21 @@ function cmdUnset(key: string): number {
   const next = structuredClone(raw);
   unset(next, key);
   pruneEmptyParents(next);
+  // Same merged-whole gate as `set` (adversarial-review catch): removing one
+  // override shifts the merged value back to its default, and the
+  // projectionMargin-vs-thresholds refine can fail on the RESULT even though
+  // every remaining field is individually valid - writing that file would make
+  // every later loadConfig throw, bricking status/switch/hooks/statusline.
+  const validated = ConfigFileSchema.safeParse(next);
+  if (!validated.success) {
+    console.error(c.red(`rejected: ${validated.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}`));
+    return 1;
+  }
+  const mergedCheck = mergeConfigFile(validated.data);
+  if (!mergedCheck.ok) {
+    console.error(c.red(`rejected: ${mergedCheck.detail} (adjust the conflicting override before unsetting ${key})`));
+    return 1;
+  }
   writeRawFile({ raw: next });
   console.log(`${key} unset -> ${JSON.stringify(get(loadConfig(), key))} (default)`);
   return 0;

package/src/cli/rename.ts

@@ -39,6 +39,16 @@ async function renameCodexAccount(input: { selector: string; newLabel: string })
       console.error(c.red(`no codex account matches "${input.selector}"`));
       return 1;
     }
+    // labels resolve selectors first-match: a duplicate would make the other
+    // account unreachable by label and misdirect destructive commands like
+    // `rm` onto the wrong one (adversarial-review catch)
+    // case-insensitive, matching how findCodexAccount resolves selectors (PR
+    // #37 review catch: a casing-only duplicate slipped the === guard)
+    const taken = index.accounts.find((x) => x.accountId !== account.accountId && x.label.toLowerCase() === input.newLabel.toLowerCase());
+    if (taken) {
+      console.error(c.red(`label "${input.newLabel}" is already used by ${taken.accountId.slice(0, 8)} - labels must be unique within the pool`));
+      return 1;
+    }
     const old = account.label;
     account.label = input.newLabel;
     saveCodexAccounts({ index });
@@ -63,6 +73,16 @@ export async function cmdRename(argv: string[]): Promise<number> {
       console.error(c.red(`no claude account matches "${selector}" (codex accounts rename via --codex)`));
       return 1;
     }
+    // labels resolve selectors first-match: a duplicate would make the other
+    // account unreachable by label and misdirect destructive commands like
+    // `rm` onto the wrong one (adversarial-review catch)
+    // case-insensitive, matching how findAccount resolves selectors (PR #37
+    // review catch: a casing-only duplicate slipped the === guard)
+    const taken = idx.accounts.find((x) => x.accountUuid !== a.accountUuid && x.label.toLowerCase() === newLabel.toLowerCase());
+    if (taken) {
+      console.error(c.red(`label "${newLabel}" is already used by ${taken.email} - labels must be unique within the pool`));
+      return 1;
+    }
     const old = a.label;
     a.label = newLabel;
     saveAccounts(idx);

package/src/cli/serve.ts

@@ -363,9 +363,12 @@ export function buildServeRuntime(seam: {
       // exists to detect. Outside a drain, or on success, clear it.
       // An announced drop is TERMINAL: relayThread told the user to resend, so
       // retaining the marker would replay work the drop notice disclaimed
-      // (duplicate turns, quota, side effects). null outcome = relay threw =
+      // (duplicate turns, quota, side effects). A turn whose child reached a
+      // SUCCESSFUL result is also terminal even when failed (that failure is
+      // Slack delivery, not a killed child - resuming would re-run completed
+      // work; adversarial-review catch). null outcome = relay threw =
       // still presumed killed.
-      const presumedKilled = draining && (outcome === null || (outcome.failed && !outcome.announcedDrop));
+      const presumedKilled = draining && (outcome === null || (outcome.failed && !outcome.announcedDrop && !outcome.resultReceived));
       // An unannounced drop OUTSIDE a drain still clears the marker on
       // purpose (retention would re-execute the turn at the next restart; see
       // notifyDelivered's doc) - but the loss must be operator-visible.
@@ -730,8 +733,14 @@ async function runDaemon(): Promise<number> {
     // expiry is SILENT (chat 4.34.0 has no app callback for it), so the TTL
     // must outlast the longest legitimate hold: a depleted-pool park
     // (PARK_MAX_MS 14min) plus a long claude turn. Expired-and-folded beats
-    // silently-vanished, hence a full hour.
-    concurrency: { strategy: "queue", queueEntryTtlMs: 3_600_000 },
+    // silently-vanished, hence a full hour. maxQueueSize matters for the same
+    // reason: the SDK default is 10 with a LOG-LESS drop-oldest trim
+    // (@chat-adapter/state-memory enqueue splices the front, and the SDK's
+    // message-dropped log only fires for drop-newest), so a >10-message burst
+    // behind one long turn silently ate the oldest instructions
+    // (adversarial-review catch). 100 outlasts any legitimate burst; the TTL
+    // stays the real bound.
+    concurrency: { strategy: "queue", queueEntryTtlMs: 3_600_000, maxQueueSize: 100 },
     // without this a cards-only segment in post-and-edit fallback would
     // strand a bare "..." placeholder message.
     fallbackStreamingPlaceholderText: null,

package/src/entries/supervisor.ts

@@ -155,6 +155,44 @@ export function stripSessionFlags(argv: string[]): string[] {
   return out;
 }
 
+/** Remove positional tokens (the one-shot initial prompt) while keeping every
+ *  flag and its consumed value(s). A positional is a submit-once user turn:
+ *  persisting or replaying it on a respawn / later `--resume` re-injects the
+ *  original instruction into an already-progressed session (adversarial-review
+ *  HIGH catch) - only real flags like --model belong in sessions/ files and
+ *  respawn args.
+ *
+ *  TRADEOFF (WONTFIX, flagged PR #37): when claude adds a value-taking root
+ *  flag before the sets above are updated, that value reads as a positional
+ *  and is dropped, so the respawn launches without it and claude errors on the
+ *  missing argument - loud, and the user relaunches. The alternative default
+ *  (treat a bare token after an UNRECOGNIZED flag as that flag's value) turns
+ *  the same staleness silent: a newly added BOOLEAN flag sitting before the
+ *  prompt would make the prompt look like a value and replay a submit-once
+ *  turn, which is the exact harm this function exists to prevent. The
+ *  ambiguity is irreducible without claude's own option table, and a loud
+ *  broken launch beats a silent re-submit. */
+export function stripPositionals(argv: string[]): string[] {
+  const out: string[] = [];
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i]!;
+    // `--` ends option parsing: everything after it is positional (a prompt
+    // deliberately starting with "-"), never a flag to persist (PR #37
+    // review catch). The delimiter itself is dropped with them.
+    if (a === "--") break;
+    if (!a.startsWith("-")) continue;
+    out.push(a);
+    if (VALUE_TAKING_ROOT_FLAGS.has(a)) {
+      if (i + 1 < argv.length) out.push(argv[++i]!);
+    } else if (VARIADIC_ROOT_FLAGS.has(a)) {
+      while (i + 1 < argv.length && !argv[i + 1]!.startsWith("-")) out.push(argv[++i]!);
+    } else if (OPTIONAL_VALUE_ROOT_FLAGS.has(a)) {
+      if (i + 1 < argv.length && !argv[i + 1]!.startsWith("-")) out.push(argv[++i]!);
+    }
+  }
+  return out;
+}
+
 /** Newest transcript session id for the current cwd (for `-c`). claude's
  *  project-dir slug maps EVERY non-alphanumeric char to "-": the regex below
  *  mirrors claude's own, byte for byte (binary-verified 2.1.215, the external-
@@ -272,9 +310,17 @@ export async function runSupervisor(argv: string[]): Promise<number> {
   // this time (a bare `claude --resume <id>`, or the depleted-pool recovery).
   if (resuming && base.length === 0) {
     const persisted = loadSessionFlags(sid);
-    if (persisted) base = persisted;
+    // enforce the flags-only contract at the trust boundary, not just at
+    // write: a sessions/ file written before stripPositionals existed can
+    // still carry the original prompt, and restoring it verbatim would
+    // re-submit that prompt on a bare `claude --resume` (PR #37 review
+    // catch). Idempotent on well-formed files.
+    if (persisted) base = stripPositionals(persisted);
   }
-  saveSessionFlags(sid, base, process.cwd());
+  // The FIRST launch keeps a positional prompt (the user just typed it);
+  // everything persisted or respawned carries flags only.
+  const persistable = stripPositionals(base);
+  saveSessionFlags(sid, persistable, process.cwd());
   pruneStaleSessions(Date.now());
 
   let launchArgs = resuming ? ["--resume", sid, ...base] : ["--session-id", sid, ...base];
@@ -330,9 +376,11 @@ export async function runSupervisor(argv: string[]): Promise<number> {
       // /clear they differ, and resuming the pinned id would revive the
       // pre-/clear conversation (closing-review HIGH catch). Persist the
       // flags under that transcript id too, so a later bare
-      // `claude --resume <id>` restores them (PR #36 review catch).
-      saveSessionFlags(m.sessionId, base, process.cwd());
-      launchArgs = ["--resume", m.sessionId, ...base];
+      // `claude --resume <id>` restores them (PR #36 review catch). FLAGS
+      // only: replaying a positional prompt would re-submit it as a fresh
+      // turn on the progressed session (adversarial-review HIGH catch).
+      saveSessionFlags(m.sessionId, persistable, process.cwd());
+      launchArgs = ["--resume", m.sessionId, ...persistable];
       continue;
     }
     // No marker: claude exited on its own (quit, crash, resume refused). Log it -

package/src/lib/codexauth.ts

@@ -4,7 +4,7 @@
 // rust-v0.144.5 manager.rs), so every mutation here runs under tokenmaxxing's
 // own codex flock, held by the caller.
 
-import { readFileSync } from "node:fs";
+import { readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { writeFileAtomic } from "./atomic.ts";
@@ -65,6 +65,13 @@ export function writeParkedCodexAuth(input: { credFile: string; auth: CodexAuthJ
   writeFileAtomic(parkedPath(input), JSON.stringify(CodexAuthJsonSchema.parse(input.auth), null, 2), 0o600);
 }
 
+/** `rm --codex` uses this so the path shape (.json suffix) has one owner:
+ *  a hand-built path without the suffix silently missed the real file under
+ *  rmSync force (PR #37 review catch). */
+export function deleteParkedCodexAuth(input: { credFile: string }): void {
+  rmSync(parkedPath(input), { force: true });
+}
+
 /** Identity claims inside the id_token JWT payload (verified against a live
  *  0.144.4 token: the chatgpt fields sit under the api.openai.com/auth claim). */
 const IdClaimsSchema = z.looseObject({

package/src/lib/decide.ts

@@ -48,10 +48,22 @@ const SwapDecisionSchema = z.object({
 });
 export type SwapDecision = z.infer<typeof SwapDecisionSchema>;
 
+const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
+const FIVE_HOURS_MS = 5 * 60 * 60 * 1000;
+
 /** A window's usable-against percentage NOW: one whose cached reset has passed
- *  is empty again, never a switch reason. */
-function liveUsed(w: UsageWindow, now: number): number {
-  return w.resetsAt != null && w.resetsAt <= now ? 0 : w.usedPercentage;
+ *  is empty again, never a switch reason. A NULL-reset window (reset clock
+ *  failed to parse) self-bounds at sampledAt + the window's own duration,
+ *  mirroring the picker's blockedUntil and the codex liveUsed: without the
+ *  bound the trigger side kept reading a long-stale over-bar row as live while
+ *  the screening side had already released it - the two halves of one decision
+ *  disagreed, forcing hard-path swaps (or waitUntil=now respawn churn) off a
+ *  healthy account (adversarial-review catch). */
+function liveUsed(input: { window: UsageWindow; windowMs: number; sampledAt: number; now: number }): number {
+  const { window: w, windowMs, sampledAt, now } = input;
+  if (w.resetsAt != null) return w.resetsAt <= now ? 0 : w.usedPercentage;
+  if (now >= sampledAt + windowMs) return 0;
+  return w.usedPercentage;
 }
 
 /** The family's weekly cap among the `/usage` rows; when several rows match the
@@ -61,7 +73,7 @@ function capForFamily(mu: ModelUsageState, family: string, now: number): UsageWi
   const rows = Object.entries(mu.perModel)
     .filter(([k]) => familyTokens(k).includes(family))
     .map(([, w]) => w);
-  return maxBy(rows, (w) => liveUsed(w, now));
+  return maxBy(rows, (w) => liveUsed({ window: w, windowMs: WEEK_MS, sampledAt: mu.sampledAt ?? mu.ts, now }));
 }
 
 /** True if the active account is over its floor on ANY screening bar: the 5h
@@ -71,11 +83,14 @@ function capForFamily(mu: ModelUsageState, family: string, now: number): UsageWi
 function isOver(u: UsageState | null, mu: ModelUsageState | null, org: string | null, cfg: Config, now: number): boolean {
   if (!u || !org || u.org !== org) return false;
   const bars = effectiveBars(cfg);
-  if (liveUsed(u.fiveHour, now) >= bars.session || liveUsed(u.sevenDay, now) >= bars.weekly) return true;
+  if (
+    liveUsed({ window: u.fiveHour, windowMs: FIVE_HOURS_MS, sampledAt: u.ts, now }) >= bars.session ||
+    liveUsed({ window: u.sevenDay, windowMs: WEEK_MS, sampledAt: u.ts, now }) >= bars.weekly
+  ) return true;
   if (mu && mu.org === org) {
     for (const family of gatedFamilies(u.model, cfg.policy.switchModels)) {
       const cap = capForFamily(mu, family, now);
-      if (cap && liveUsed(cap, now) >= bars.weekly) return true;
+      if (cap && liveUsed({ window: cap, windowMs: WEEK_MS, sampledAt: mu.sampledAt ?? mu.ts, now }) >= bars.weekly) return true;
     }
   }
   return false;
@@ -91,7 +106,7 @@ function needsPerModel(u: UsageState | null, cfg: Config): boolean {
  *  a fresh session rides its account - no churn. */
 function isEngaged(u: UsageState | null, mu: ModelUsageState | null, org: string | null, cfg: Config, now: number): boolean {
   if (!u || !org || u.org !== org) return false;
-  return liveUsed(u.fiveHour, now) >= cfg.policy.greedySessionFloor || isOver(u, mu, org, cfg, now);
+  return liveUsed({ window: u.fiveHour, windowMs: FIVE_HOURS_MS, sampledAt: u.ts, now }) >= cfg.policy.greedySessionFloor || isOver(u, mu, org, cfg, now);
 }
 
 const SnapshotsSchema = z.object({

package/src/lib/slackbridge.ts

@@ -41,6 +41,11 @@ export const TurnOutcomeSchema = z.object({
    *  re-send it"): a drain must NOT presume a killed child and retain the
    *  resume marker, or startup replays work the user was told to resend. */
   announcedDrop: z.boolean(),
+  /** the LAST attempt's claude child ran to a SUCCESSFUL result: the work is
+   *  done even if Slack delivery later failed (textLost sets failed for the
+   *  operator's benefit). A drain must not read that delivery failure as a
+   *  killed child and re-run completed work (adversarial-review catch). */
+  resultReceived: z.boolean(),
 });
 export type TurnOutcome = z.infer<typeof TurnOutcomeSchema>;
 
@@ -384,7 +389,7 @@ export async function relayThread(input: {
    *  out a depleted-pool countdown. */
   drainSignal?: AbortSignal;
 }): Promise<TurnOutcome> {
-  const outcome: TurnOutcome = { sessionId: input.sessionId, failed: false, rateLimited: false, finish: false, announcedDrop: false };
+  const outcome: TurnOutcome = { sessionId: input.sessionId, failed: false, rateLimited: false, finish: false, announcedDrop: false, resultReceived: false };
   let segment: ReturnType<typeof pushableStream> | null = null;
   let segmentMeta: { text: boolean } | null = null;
   let lastPost: Promise<unknown> = Promise.resolve();
@@ -478,6 +483,7 @@ export async function relayThread(input: {
     postedText = false;
     outcome.failed = false;
     outcome.rateLimited = false;
+    outcome.resultReceived = false;
     // outcome.finish stays sticky across retries: the tool call already
     // happened in this session, and a limit right after it must not unfinish
     // the thread.
@@ -575,6 +581,7 @@ export async function relayThread(input: {
             if (outcome.rateLimited) await recordObservedLimit({ text, now: Date.now(), org: spawnOrg });
           } else {
             result = message.result;
+            outcome.resultReceived = true;
           }
         }
         for (const part of agentEventChunks({ state: mapState, message })) {

package/src/lib/types.ts

@@ -311,13 +311,25 @@ export const CodexUsageSchema = z.object({
 });
 export type CodexUsage = z.infer<typeof CodexUsageSchema>;
 
+/** A parked-credential file NAME, never a path. These are machine-written
+ *  (`tokenmaxxing-codex-<id8>`), so a separator here means the index is
+ *  corrupted - and `join(credsDir, credFile)` would normalize `../` right out
+ *  of codex-creds, letting `rm --codex` unlink another file (review catch).
+ *  Refusing at parse time matches the codex loaders' throw-on-unparsable
+ *  contract and covers the read/write paths with the delete. */
+const BareFileNameSchema = z
+  .string()
+  .refine((s) => s.length > 0 && s !== "." && s !== ".." && !s.includes("/") && !s.includes("\\"), {
+    message: "credFile must be a bare file name, not a path",
+  });
+
 /** A pooled codex account (codex-accounts.json - NON-secret). */
 export const CodexAccountSchema = z.object({
   accountId: z.string(),
   email: z.string().nullable(),
   label: z.string(),
   planType: z.string().nullable(),
-  credFile: z.string(),
+  credFile: BareFileNameSchema,
   addedAt: z.string(),
   needsReauth: z.boolean().optional(),
   lastUsage: z

package/src/main.ts

@@ -24,6 +24,7 @@ import { cmdStatus } from "./cli/status.ts";
 import { cmdWatch } from "./cli/watch.ts";
 import { cmdDoctor } from "./cli/doctor.ts";
 import { cmdRm } from "./cli/rm.ts";
+import { cmdCodexRm } from "./cli/codexrm.ts";
 import { cmdRename } from "./cli/rename.ts";
 import { cmdSwitch } from "./cli/switch.ts";
 import { cmdCheck } from "./cli/check.ts";
@@ -52,7 +53,7 @@ function printHelp(): void {
   ${c.cyan("tokenmaxxing serve")} [setup|link|unlink|links]  Slack bridge daemon: mention the bot in a linked channel to open a claude session per thread in the repo checkout
   ${c.cyan("tokenmaxxing doctor")}     verify the install is intact
   ${c.cyan("tokenmaxxing rename")} [--codex] <sel> <label>
-  ${c.cyan("tokenmaxxing rm")} <sel>
+  ${c.cyan("tokenmaxxing rm")} [--codex] <sel>
   ${c.cyan("tokenmaxxing uninstall")}  remove supervisor + settings entries
 
   ${c.dim("(aliased as")} ${c.cyan("xx")}${c.dim(")")} - then just run ${c.bold("claude")} as always; it switches accounts near quota automatically.`);
@@ -122,7 +123,13 @@ async function main(): Promise<number> {
     case "status": return cmdStatus(args.includes("--force"));
     case "watch": return cmdWatch(args[1]);
     case "doctor": return cmdDoctor();
-    case "rm": return cmdRm(args[1]);
+    // --codex accepted anywhere, like switch/rename: the two pools are
+    // separate namespaces and codex accounts were otherwise unremovable
+    // (adversarial-review catch).
+    case "rm": {
+      const rest = args.slice(1).filter((a) => a !== "--codex");
+      return args.includes("--codex") ? cmdCodexRm(rest[0]) : cmdRm(rest[0]);
+    }
     case "rename": return cmdRename(args.slice(1));
     case "uninstall": {
       const out = uninstallSupervisor();