tokenmaxxing 0.3.1 → 0.5.0

package/DESIGN.md

@@ -4,7 +4,7 @@ Automatic Claude Code account switching. You run `claude` exactly as always; whe
 
 > Scope: **Claude Code only, macOS first.** Codex and other CLIs deferred (see `.memory/cc-codex-auth-mechanics.md`).
 >
-> Status: **implemented** (v0.1.0, 2026-07-09). TypeScript on Bun → single binary; Zod validates every external-boundary payload, JSON config, es-toolkit for utilities, `flock(2)` via `bun:ffi`. All load-bearing external facts were adversarially verified against the `2.1.204` binary + docs (OAuth token endpoint is `platform.claude.com/v1/oauth/token`, client_id `9d1c250a-…`, JSON body). What the acceptance gate actually shows is in §9.
+> Status: **implemented** (v0.1.0, 2026-07-09). TypeScript on Bun → single binary; Zod validates every external-boundary payload, JSON config, es-toolkit for utilities, `flock(2)` via `bun:ffi`. All load-bearing external facts were adversarially verified against the `2.1.204` binary + docs (OAuth token endpoint is `platform.claude.com/v1/oauth/token`, client_id `9d1c250a-...`, JSON body). What the acceptance gate actually shows is in §9.
 
 ---
 
@@ -57,7 +57,7 @@ The supervisor's `claude` call returns; it sees `respawn/<sid>`, deletes it, res
 ### 3.4 Swap sequence (under the lock)
 1. **Harvest the live credential into its TRUE owner's backup** - read the current `Claude Code-credentials` blob and resolve which account it actually belongs to via the roles endpoint (`GET /api/oauth/claude_cli/roles`), NOT the `accounts.json` active label. The label drifts from the live blob (a kill mid-swap, a manual `/login`), and harvesting by label once overwrote another account's backup and destroyed its only credential. Mandatory anyway: Claude rotates the refresh token in place, so older backups are dead. Refuse the swap if the live credential belongs to no pooled account.
 2. **Refresh B** - OAuth refresh-grant with B's parked refresh token → fresh access token; persist the rotated refresh token. On `invalid_grant`, mark B `needs_reauth`, notify, try the next account.
-3. **Install B** - `security add-generic-password -U … 'Claude Code-credentials' …` with B's fresh (non-expired) `claudeAiOauth` JSON.
+3. **Install B** - `security add-generic-password -U ... 'Claude Code-credentials' ...` with B's fresh (non-expired) `claudeAiOauth` JSON.
 4. **Swap identity + mark B active** - atomically rewrite only the `oauthAccount` object in `~/.claude.json` (temp+rename) to B's, and write `activeAccountUuid = B` in the SAME critical section, so a crash can't leave the installed credential and the active label pointing at different accounts.
 5. Do steps 1, 3, 4 inside Claude's own `~/.claude.lock` so the writes can't collide with a token refresh.
 
@@ -114,7 +114,7 @@ TypeScript on Bun, shipped as source: one multi-call entry (`src/main.ts`, `#!/u
 
 Unit suite: **32 pass**. Hermetic swap+concurrency+model-aware E2E: **all pass**. CLI init/doctor/uninstall: **pass** (re-verified init/doctor 2026-07-09 through the npm-installed bun shim on linux-arm64 after the switch to source packaging; full suite 47 pass / 0 fail there).
 
-1. **Transcript continuity across a process boundary - ✅ proven on real claude/real account.** `claude --session-id X -p …` committed a clean 12-line transcript; `claude --resume X -p …` recalled the earlier turn's codeword. The supervisor's kill→restore-termios→respawn→`--resume` loop is proven with a mock claude. The one step not run live is the abrupt SIGTERM of an *idle interactive* real claude (structurally safe - the transcript is fully committed+fsynced before idle and nothing writes while idle).
+1. **Transcript continuity across a process boundary - ✅ proven on real claude/real account.** `claude --session-id X -p ...` committed a clean 12-line transcript; `claude --resume X -p ...` recalled the earlier turn's codeword. The supervisor's kill→restore-termios→respawn→`--resume` loop is proven with a mock claude. The one step not run live is the abrupt SIGTERM of an *idle interactive* real claude (structurally safe - the transcript is fully committed+fsynced before idle and nothing writes while idle).
 2. **Terminal restoration - ✅ mechanism proven.** The supervisor saves `stty -g` and restores it between kill and respawn; the path executes in the mock-supervisor run. Visual raw-mode/​resize confirmation wants a live interactive terminal.
 3. **SessionStart swap - ✅ swap logic proven; ⚠️ "adopted by first turn" needs a 2nd real account.** The hook's decision+swap path is covered by the E2E; the claude-internal timing (SessionStart before first `getToken`) needs a second subscription to observe end-to-end.
 4. **Keychain writes from a headless hook - ✅ proven.** The swap E2E's 4 concurrent subprocesses each wrote the live item via `security -i` (secret on stdin, never argv) with no prompt/hang; `init` parked backups headlessly too. (Residual: the live `Claude Code-credentials` ACL for the *fresh resumed claude* is mitigated by onboarding touching `security` interactively.)

package/README.md

@@ -6,9 +6,9 @@
 
 ```
 $ claude
-  …you work normally…
-  ↻ tokenmaxxing: switched to work@acme.com - resuming…
-  …same conversation, fresh quota…
+  ...you work normally...
+  ↻ tokenmaxxing: switched to work@acme.com - resuming...
+  ...same conversation, fresh quota...
 ```
 
 ## Why
@@ -24,7 +24,7 @@ bun add -g tokenmaxxing
 tokenmaxxing init
 ```
 
-`init` imports the account you're already on, installs the `claude` supervisor + three `settings.json` entries (a statusLine shim, a Stop hook, a SessionStart hook), and adds the supervisor's bin dir to PATH in your shell rc (idempotent; it must sit ahead of the real `claude` to intercept it). Restart your shell, then add more accounts and go:
+`init` imports the account you're already on, installs the `claude` supervisor + three `settings.json` entries (the tokenmaxxing statusLine, a Stop hook, a SessionStart hook), and adds the supervisor's bin dir to PATH in your shell rc (idempotent; it must sit ahead of the real `claude` to intercept it). Restart your shell, then add more accounts and go:
 
 ```sh
 tokenmaxxing add        # logs one in, in isolation, and pools it
@@ -47,7 +47,7 @@ claude                  # use claude as always
 
 Switching triggers at **95%** (configurable) on any of:
 
-- **Session** (5-hour) or **week (all models)** - the aggregate windows, fed free/push-based by a statusLine shim.
+- **Session** (5-hour) or **week (all models)** - the aggregate windows, fed free/push-based by the statusLine.
 - **Per-model weekly cap** - the capable models (Fable, Opus) have their own tighter weekly limit that binds *before* the aggregate. tokenmaxxing reads it from `claude -p '/usage'` (free, 0 tokens, TTL-cached) whenever the active model is one of `policy.switchModels`, so a Fable session switches on the Fable cap while a Sonnet session rides the aggregate.
 
 The 5% headroom is deliberate: it's the budget to reach a clean turn boundary and respawn before the wall.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",

package/src/cli/add.ts

@@ -11,6 +11,7 @@ import { readItem, writeItem, deleteItem, parkedTarget, isolatedTarget, claudeAi
 import { resolveRealClaude } from "../lib/claudebin.ts";
 import { probeUsage } from "../lib/usage.ts";
 import { saveTermios, restoreTermios } from "../lib/tty.ts";
+import { withLock } from "../lib/lock.ts";
 import { loadAccounts, saveAccounts } from "../lib/state.ts";
 import { credItemFor, paths } from "../lib/paths.ts";
 import { CredentialBlobSchema, OAuthAccountSchema, type Account } from "../lib/types.ts";
@@ -93,7 +94,7 @@ export async function cmdAdd(): Promise<number> {
   }
 
   // Sample usage now (#16) so the account isn't "not sampled yet" in status/ls.
-  console.log(c.dim("sampling usage…"));
+  console.log(c.dim("sampling usage..."));
   const sampled = await probeUsage(onboardDir);
   if (!sampled) console.log(c.yellow("could not sample usage now - it will fill in on first use."));
 
@@ -101,29 +102,33 @@ export async function cmdAdd(): Promise<number> {
   const keychainItem = credItemFor(uuid);
   await writeItem(parkedTarget(keychainItem), claudeAiOauthOnly(blobRaw)); // park a small backup
 
-  const idx = loadAccounts();
-  const existing = idx.accounts.find((a) => a.accountUuid === uuid);
-  const account: Account = {
-    accountUuid: uuid,
-    email: oauthAccount.emailAddress,
-    organizationUuid: oauthAccount.organizationUuid,
-    label: existing?.label ?? oauthAccount.emailAddress,
-    keychainItem,
-    oauthAccount,
-    addedAt: existing?.addedAt ?? new Date().toISOString(),
-    subscriptionType: blob.claudeAiOauth.subscriptionType,
-    needsReauth: false,
-    lastUsage: sampled ? { fiveHour: sampled.session, sevenDay: sampled.weekAll } : existing?.lastUsage,
-    lastPerModel: sampled && Object.keys(sampled.perModel).length > 0 ? sampled.perModel : existing?.lastPerModel,
-  };
-  if (existing) Object.assign(existing, account);
-  else idx.accounts.push(account);
-  saveAccounts(idx);
+  // under the flock: a concurrent swap's index write must not be clobbered.
+  const { account, poolSize } = await withLock(paths.lockFile, async () => {
+    const idx = loadAccounts();
+    const existing = idx.accounts.find((a) => a.accountUuid === uuid);
+    const fresh: Account = {
+      accountUuid: uuid,
+      email: oauthAccount.emailAddress,
+      organizationUuid: oauthAccount.organizationUuid,
+      label: existing?.label ?? oauthAccount.emailAddress,
+      keychainItem,
+      oauthAccount,
+      addedAt: existing?.addedAt ?? new Date().toISOString(),
+      subscriptionType: blob.claudeAiOauth.subscriptionType,
+      needsReauth: false,
+      lastUsage: sampled ? { fiveHour: sampled.session, sevenDay: sampled.weekAll } : existing?.lastUsage,
+      lastPerModel: sampled && Object.keys(sampled.perModel).length > 0 ? sampled.perModel : existing?.lastPerModel,
+    };
+    if (existing) Object.assign(existing, fresh);
+    else idx.accounts.push(fresh);
+    saveAccounts(idx);
+    return { account: fresh, poolSize: idx.accounts.length };
+  });
 
   await cleanup();
 
   console.log();
   const usageNote = sampled ? ` · session ${sampled.session.usedPercentage}% / week ${sampled.weekAll.usedPercentage}%` : "";
-  console.log(`${c.green("✓")} added ${c.bold(account.email)} (${account.subscriptionType ?? "?"})${usageNote} → pool now has ${idx.accounts.length} account(s)`);
+  console.log(`${c.green("✓")} added ${c.bold(account.email)} (${account.subscriptionType ?? "?"})${usageNote} → pool now has ${poolSize} account(s)`);
   return 0;
 }

package/src/cli/check.ts

@@ -0,0 +1,29 @@
+// `tokenmaxxing check` - one auto-switch evaluation, the same decision the
+// Stop/SessionStart hooks make (flocked, idempotent). Installed as a periodic
+// launchd/systemd job so a limit crossed mid-turn, or with no session running,
+// still switches within minutes; the hooks only ever see turn boundaries.
+// Running claude sessions adopt the swapped credential in place (<=30s).
+
+import { evaluateAndMaybeSwap } from "../lib/decide.ts";
+import { log } from "../lib/log.ts";
+import { c, fmtReset } from "./render.ts";
+
+export async function cmdCheck(): Promise<number> {
+  let d;
+  try {
+    d = await evaluateAndMaybeSwap();
+  } catch (e) {
+    // unattended under the timer: the log is the only place anyone will look.
+    log("check.error", { err: String((e as Error).message ?? e) });
+    console.error(c.red(`check failed: ${String((e as Error).message ?? e)}`));
+    return 1;
+  }
+  if (d.swapped && d.account) {
+    console.log(`${c.green("↻")} switched to ${c.bold(d.account.label)}`);
+  } else if (d.waitUntil !== undefined && d.account) {
+    console.log(c.yellow(`all accounts at limit - staying on ${c.bold(d.account.label)} (${fmtReset(d.waitUntil)})`));
+  } else {
+    console.log(c.dim(`no switch (${d.reason})`));
+  }
+  return 0;
+}

package/src/cli/doctor.ts

@@ -3,7 +3,7 @@
 
 import { existsSync } from "node:fs";
 import { checkSettings, installedBin } from "../lib/settings.ts";
-import { isBinDirAhead } from "../lib/install.ts";
+import { checkTimerHealthy, isBinDirAhead, timerActivationHint } from "../lib/install.ts";
 import { paths } from "../lib/paths.ts";
 import { loadAccounts, loadConfig } from "../lib/state.ts";
 import { readItem, liveTarget, parkedTarget } from "../lib/credstore.ts";
@@ -34,6 +34,7 @@ export async function cmdDoctor(): Promise<number> {
   check(s.statusLineOk, "statusLine shim installed in settings.json", "run `tokenmaxxing init`");
   check(s.stopOk, "Stop hook installed in settings.json", "run `tokenmaxxing init`");
   check(s.sessionStartOk, "SessionStart hook installed in settings.json", "run `tokenmaxxing init`");
+  check(checkTimerHealthy(), "periodic check timer active", timerActivationHint());
 
   const idx = loadAccounts();
   check(idx.accounts.length > 0, "at least one account in the pool", "run `tokenmaxxing init`");

package/src/cli/init.ts

@@ -6,7 +6,7 @@ import { isApiKeyMode, readOAuthAccount } from "../lib/claudejson.ts";
 import { readItem, writeItem, liveTarget, parkedTarget, mergeIntoLive } from "../lib/credstore.ts";
 import { refreshCredential, isAccessTokenExpiring, fetchTokenOrg } from "../lib/oauth.ts";
 import { loadAccounts, saveAccounts, loadConfig, saveConfig } from "../lib/state.ts";
-import { installSupervisor, shellRcPath, ensurePathInRc } from "../lib/install.ts";
+import { installSupervisor, shellRcPath, ensurePathInRc, timerActivationHint, type InstallOutcome } from "../lib/install.ts";
 import { resolveRealClaude } from "../lib/claudebin.ts";
 import { credItemFor, paths } from "../lib/paths.ts";
 import { CredentialBlobSchema, type Account } from "../lib/types.ts";
@@ -25,6 +25,11 @@ function ensurePathAhead(): void {
   else console.log(c.yellow(`⚠ PATH line already in ${rc} - restart your shell to pick it up`));
 }
 
+function reportTimer(out: InstallOutcome): void {
+  if (out.timerLoaded) console.log(`${c.green("✓")} periodic check timer active (every 3m)`);
+  else console.log(c.yellow(`⚠ check timer written but not activated - run: ${timerActivationHint()}`));
+}
+
 export async function cmdInit(): Promise<number> {
   mkdirSync(paths.home, { recursive: true });
 
@@ -41,6 +46,7 @@ export async function cmdInit(): Promise<number> {
     saveConfig(cfg);
     const active = existingIdx.accounts.find((a) => a.accountUuid === existingIdx.activeAccountUuid);
     console.log(`${c.green("✓")} re-installed supervisor + hooks (pool already has ${existingIdx.accounts.length} account${existingIdx.accounts.length === 1 ? "" : "s"} - not re-importing)`);
+    reportTimer(out);
     if (!out.pathAhead) ensurePathAhead();
     console.log(`  active: ${c.bold(active?.label ?? "unknown")} · run ${c.cyan("tokenmaxxing add")} for more, ${c.cyan("tokenmaxxing status")} to check`);
     return 0;
@@ -113,7 +119,7 @@ export async function cmdInit(): Promise<number> {
 
   console.log(`${c.green("✓")} imported current account → ${c.bold(account.email)} (${account.subscriptionType ?? "?"})`);
   console.log(`${c.green("✓")} installed ${c.bold("claude")} supervisor + statusLine/Stop/SessionStart hooks`);
-  if (out.priorStatusLine) console.log(`${c.green("✓")} wrapped your existing statusLine (preserved)`);
+  reportTimer(out);
   if (!out.pathAhead) {
     console.log();
     ensurePathAhead();

package/src/cli/rename.ts

@@ -1,5 +1,7 @@
 // `tokenmaxxing rename <selector> <new-label>` - relabel a pooled account.
 
+import { withLock } from "../lib/lock.ts";
+import { paths } from "../lib/paths.ts";
 import { loadAccounts, saveAccounts } from "../lib/state.ts";
 import { c } from "./render.ts";
 import type { Account } from "../lib/types.ts";
@@ -14,20 +16,23 @@ export function findAccount(accounts: Account[], selector: string): Account | un
   );
 }
 
-export function cmdRename(selector?: string, newLabel?: string): number {
+export async function cmdRename(selector?: string, newLabel?: string): Promise<number> {
   if (!selector || !newLabel) {
     console.error("usage: tokenmaxxing rename <email|label|uuid> <new-label>");
     return 2;
   }
-  const idx = loadAccounts();
-  const a = findAccount(idx.accounts, selector);
-  if (!a) {
-    console.error(c.red(`no account matches "${selector}"`));
-    return 1;
-  }
-  const old = a.label;
-  a.label = newLabel;
-  saveAccounts(idx);
-  console.log(`renamed ${c.dim(old)} → ${c.bold(newLabel)}`);
-  return 0;
+  // under the flock: a concurrent swap's index write must not be clobbered.
+  return withLock(paths.lockFile, async () => {
+    const idx = loadAccounts();
+    const a = findAccount(idx.accounts, selector);
+    if (!a) {
+      console.error(c.red(`no account matches "${selector}"`));
+      return 1;
+    }
+    const old = a.label;
+    a.label = newLabel;
+    saveAccounts(idx);
+    console.log(`renamed ${c.dim(old)} → ${c.bold(newLabel)}`);
+    return 0;
+  });
 }

package/src/cli/render.ts

@@ -2,16 +2,21 @@
 
 import { clamp } from "es-toolkit";
 
-const useColor = !process.env.NO_COLOR && process.stdout.isTTY;
+/** ANSI painters, no-ops when disabled. The statusLine renders through a pipe
+ *  (never a TTY), so it needs its own enable gate; the CLI gates on stdout. */
+export function makeColors(enabled: boolean) {
+  const paint = (code: string) => (s: string) => (enabled ? `\x1b[${code}m${s}\x1b[0m` : s);
+  return {
+    dim: paint("2"),
+    bold: paint("1"),
+    green: paint("32"),
+    yellow: paint("33"),
+    red: paint("31"),
+    cyan: paint("36"),
+  };
+}
 
-export const c = {
-  dim: (s: string) => (useColor ? `\x1b[2m${s}\x1b[0m` : s),
-  bold: (s: string) => (useColor ? `\x1b[1m${s}\x1b[0m` : s),
-  green: (s: string) => (useColor ? `\x1b[32m${s}\x1b[0m` : s),
-  yellow: (s: string) => (useColor ? `\x1b[33m${s}\x1b[0m` : s),
-  red: (s: string) => (useColor ? `\x1b[31m${s}\x1b[0m` : s),
-  cyan: (s: string) => (useColor ? `\x1b[36m${s}\x1b[0m` : s),
-};
+export const c = makeColors(!process.env.NO_COLOR && !!process.stdout.isTTY);
 
 /** A fixed-width usage bar, colored by fill. */
 export function bar(pct: number, width = 16): string {
@@ -34,3 +39,20 @@ export function fmtReset(epochMs: number | null | undefined, now = Date.now()):
   if (h > 0) return `resets in ${h}h${m}m`;
   return `resets in ${m}m`;
 }
+
+/** Compact time-until-reset for the statusLine: the largest unit only ("6d",
+ *  "2h", "45m"), floored to "1m" so a live window never reads as zero, and ""
+ *  once the reset has passed (the window is simply empty again). Non-empty
+ *  output always ends in a unit letter, so the digit-leading used-percent glued
+ *  after it stays parseable. */
+export function fmtResetShort(epochMs: number | null | undefined, now = Date.now()): string {
+  if (epochMs == null) return "";
+  const dsec = Math.round((epochMs - now) / 1000);
+  if (dsec <= 0) return "";
+  const d = Math.floor(dsec / 86400);
+  const h = Math.floor((dsec % 86400) / 3600);
+  const m = Math.floor((dsec % 3600) / 60);
+  if (d > 0) return `${d}d`;
+  if (h > 0) return `${h}h`;
+  return `${Math.max(m, 1)}m`;
+}

package/src/cli/rm.ts

@@ -1,6 +1,8 @@
 // `tokenmaxxing rm <selector>` - remove a pooled account (not the active one).
 
 import { deleteItem, parkedTarget } from "../lib/credstore.ts";
+import { withLock } from "../lib/lock.ts";
+import { paths } from "../lib/paths.ts";
 import { loadAccounts, saveAccounts } from "../lib/state.ts";
 import { findAccount } from "./rename.ts";
 import { c } from "./render.ts";
@@ -10,19 +12,22 @@ export async function cmdRm(selector?: string): Promise<number> {
     console.error("usage: tokenmaxxing rm <email|label|uuid>");
     return 2;
   }
-  const idx = loadAccounts();
-  const a = findAccount(idx.accounts, selector);
-  if (!a) {
-    console.error(c.red(`no account matches "${selector}"`));
-    return 1;
-  }
-  if (a.accountUuid === idx.activeAccountUuid) {
-    console.error(c.red(`${a.email} is the ACTIVE account - switch away before removing it.`));
-    return 1;
-  }
-  await deleteItem(parkedTarget(a.keychainItem));
-  idx.accounts = idx.accounts.filter((x) => x.accountUuid !== a.accountUuid);
-  saveAccounts(idx);
-  console.log(`removed ${c.bold(a.label)} from the pool (${idx.accounts.length} left)`);
-  return 0;
+  // under the flock: a concurrent swap's index write must not be clobbered.
+  return withLock(paths.lockFile, async () => {
+    const idx = loadAccounts();
+    const a = findAccount(idx.accounts, selector);
+    if (!a) {
+      console.error(c.red(`no account matches "${selector}"`));
+      return 1;
+    }
+    if (a.accountUuid === idx.activeAccountUuid) {
+      console.error(c.red(`${a.email} is the ACTIVE account - switch away before removing it.`));
+      return 1;
+    }
+    await deleteItem(parkedTarget(a.keychainItem));
+    idx.accounts = idx.accounts.filter((x) => x.accountUuid !== a.accountUuid);
+    saveAccounts(idx);
+    console.log(`removed ${c.bold(a.label)} from the pool (${idx.accounts.length} left)`);
+    return 0;
+  });
 }

package/src/cli/status.ts

@@ -16,10 +16,8 @@ import type { FullUsage } from "../lib/usage.ts";
 import type { UsageWindow } from "../lib/types.ts";
 
 export async function cmdStatus(): Promise<number> {
-  const idx = loadAccounts();
+  let idx = loadAccounts();
   const cfg = loadConfig();
-  const live = loadUsage();
-  const modelUsage = loadModelUsage();
   const now = Date.now();
 
   if (idx.accounts.length === 0) {
@@ -27,13 +25,17 @@ export async function cmdStatus(): Promise<number> {
     return 0;
   }
 
-  const activeOrg = readOAuthAccount()?.organizationUuid ?? null;
-
-  // Sample under the flock so parked refreshes can't collide with an in-flight swap.
-  console.error(c.dim("sampling live usage…"));
+  // Load, sample, and save entirely under the flock: parked refreshes must not
+  // collide with an in-flight swap, and a save of an index loaded before a
+  // concurrent swap would clobber the swap's activeAccountUuid.
+  console.error(c.dim("sampling live usage..."));
   const outcomes = new Map<string, SampleOutcome>();
-  await withLock(paths.lockFile, () =>
-    Promise.all(
+  await withLock(paths.lockFile, async () => {
+    idx = loadAccounts();
+    const live = loadUsage();
+    const modelUsage = loadModelUsage();
+    const activeOrg = readOAuthAccount()?.organizationUuid ?? null;
+    await Promise.all(
       idx.accounts.map(async (a) => {
         const isActive = a.accountUuid === idx.activeAccountUuid && activeOrg === a.organizationUuid;
         // Active account: prefer the free statusLine push (usage.json) so we never
@@ -57,9 +59,9 @@ export async function cmdStatus(): Promise<number> {
         a.lastUsage = { fiveHour: outcome.usage.session, sevenDay: outcome.usage.weekAll };
         if (Object.keys(outcome.usage.perModel).length > 0) a.lastPerModel = outcome.usage.perModel;
       }),
-    ),
-  );
-  saveAccounts(idx);
+    );
+    saveAccounts(idx);
+  });
 
   console.log(c.dim(`threshold ${cfg.threshold}%  ·  ${idx.accounts.length} account(s)`));
   console.log();

package/src/entries/statusline.ts

@@ -1,13 +1,53 @@
-// statusLine shim. Reads Claude's statusLine stdin, tees the rate-limit data to
-// usage.json (write-on-change, O(ms)), then transparently delegates to the user's
-// prior statusLine command (same stdin) and passes its stdout through unchanged.
-// Must NEVER break the user's status line: every step is best-effort.
+// Native statusLine. Reads Claude's statusLine stdin, tees the rate-limit data
+// to usage.json (write-on-change, O(ms)), then renders ONE line:
+//   worktree name (linked worktrees only), model (effort), ctx used,
+//   +added/-removed, then quota as USED percent (bold, severity-colored)
+//   glued after its time-to-reset: "◆ F26 2h5 1d38  ◇ F67 2d40  ◇ 2 full"
+//   ("2h5" = resets in 2h, 5 used) - the active account's windows after a
+//   green ◆ (per-model by initial first, "F?" when the cap applies but is
+//   unmeasured, then session/5h, then week), then each parked account's week
+//   after a cyan ◇, in swap-preference order so the first usable ◇ is where
+//   the next swap lands. Adjacent untouched (or unsampled) parked accounts
+//   collapse into one counted token. Blocks are joined by TWO spaces, tokens
+//   within a block by one. Per-model resets are omitted (they match the
+//   weekly reset).
+// Must NEVER break the status line: render what parses, skip what doesn't.
 
+import { sortBy } from "es-toolkit";
+import { z } from "zod";
 import { readOAuthAccount } from "../lib/claudejson.ts";
-import { readPriorStatusLine } from "../lib/settings.ts";
-import { writeUsage } from "../lib/state.ts";
-import { parseStatusLineStdin, parseStatusLineModel } from "../lib/usage.ts";
-import type { UsageState } from "../lib/types.ts";
+import { loadAccounts, loadConfig, loadLastSwapAt, loadModelUsage, writeUsage } from "../lib/state.ts";
+import { familyTokens, matchedFamily, parseStatusLineStdin, parseStatusLineModel } from "../lib/usage.ts";
+import { isExhausted, swapPreference, weeklyExpiry } from "../lib/picker.ts";
+import { worktreeName } from "../lib/worktree.ts";
+import { fmtResetShort, makeColors } from "../cli/render.ts";
+import {
+  AccountsIndexSchema,
+  StatusLineStdinSchema,
+  UsageWindowSchema,
+  type Account,
+  type UsageState,
+  type UsageWindow,
+} from "../lib/types.ts";
+
+/** A session that hasn't adopted a fresh swap yet (<=30s keychain cache) pushes
+ *  the OLD account's windows while ~/.claude.json already names the NEW org.
+ *  Suppress the tee for this long after a swap so that mislabel never lands. */
+const ADOPTION_GRACE_MS = 45_000;
+
+const RenderCtxSchema = z.object({
+  accounts: AccountsIndexSchema,
+  /** active account's per-model weekly windows ({} unless fresh for the live org). */
+  perModel: z.record(z.string(), UsageWindowSchema),
+  /** families (lowercased) whose per-model weekly cap gates a switch. */
+  switchModels: z.array(z.string()),
+  threshold: z.number(),
+  /** linked-worktree basename, null in a main checkout. */
+  worktree: z.string().nullable(),
+  now: z.number(),
+  color: z.boolean(),
+});
+export type RenderCtx = z.infer<typeof RenderCtxSchema>;
 
 async function readStdin(): Promise<string> {
   const chunks: Uint8Array[] = [];
@@ -15,38 +55,132 @@ async function readStdin(): Promise<string> {
   return Buffer.concat(chunks).toString("utf8");
 }
 
+/** Pure renderer: statusLine stdin + tokenmaxxing state → the emitted line. */
+export function renderStatusline(stdinObj: unknown, ctx: RenderCtx): string {
+  const col = makeColors(ctx.color);
+  const severity = (u: number) => (u >= 95 ? col.red : u >= 75 ? col.yellow : col.green);
+  const gauge = (u: number) => col.bold(severity(u)(`${Math.round(u)}`));
+  // Used quota in a window; one whose reset has passed is empty again.
+  const used = (w: UsageWindow) => (w.resetsAt != null && w.resetsAt <= ctx.now ? 0 : w.usedPercentage);
+  const reset = (epochMs: number | null) => fmtResetShort(epochMs, ctx.now);
+
+  const parsed = StatusLineStdinSchema.safeParse(stdinObj);
+  const d = parsed.success ? parsed.data : null;
+
+  // ---- info block: worktree, model, ctx, diff
+  const info: string[] = [];
+  if (ctx.worktree != null) info.push(ctx.worktree);
+  const modelName = d?.model?.display_name ?? d?.model?.id;
+  if (modelName) {
+    const effort = d?.effort?.level;
+    info.push(col.bold(modelName) + (effort ? ` (${effort})` : ""));
+  }
+  const ctxUsed = d?.context_window?.used_percentage;
+  if (ctxUsed != null) info.push(`ctx ${gauge(ctxUsed)}`);
+  const added = d?.cost?.total_lines_added ?? 0;
+  const removed = d?.cost?.total_lines_removed ?? 0;
+  // -removed stays unpainted: red means quota alarm and nothing else.
+  if (added > 0 || removed > 0) info.push(`${col.green(`+${added}`)}/-${removed}`);
+
+  // ---- active account block
+  const seg = (label: string, w: UsageWindow, resetAt: number | null) =>
+    `${label}${reset(resetAt)}${gauge(used(w))}`;
+  const wins = parseStatusLineStdin(stdinObj);
+  const windows: string[] = [];
+  // A capacity-constrained model whose cap is unmeasured must not look safe.
+  const family = matchedFamily(parseStatusLineModel(stdinObj), ctx.switchModels);
+  if (family && !Object.keys(ctx.perModel).some((k) => familyTokens(k).includes(family))) {
+    windows.push(`${family[0]!.toUpperCase()}?`);
+  }
+  for (const [name, w] of Object.entries(ctx.perModel)) windows.push(seg(name.slice(0, 1), w, null));
+  if (wins) {
+    windows.push(seg("", wins.fiveHour, wins.fiveHour.resetsAt));
+    windows.push(seg("", wins.sevenDay, wins.sevenDay.resetsAt));
+  }
+  const active =
+    windows.length > 0
+      ? `${col.green("◆")} ${windows.join(" ")}`
+      : ctx.accounts.activeAccountUuid != null
+        ? `${col.green("◆")} ?`
+        : "";
+
+  // ---- parked accounts, in swap order: the first usable ◇ is the next target
+  const pickCtx = { now: ctx.now, threshold: ctx.threshold, currentAccountUuid: ctx.accounts.activeAccountUuid };
+  const parked = sortBy(
+    ctx.accounts.accounts.filter((a) => a.accountUuid !== ctx.accounts.activeAccountUuid),
+    [(a) => (a.needsReauth || isExhausted(a, pickCtx) ? 1 : 0), ...swapPreference(ctx.now)],
+  );
+  const poolSeg = (a: Account): { kind: "full" | "unknown" | "other"; text: string } => {
+    const marker = a.needsReauth ? col.red("✗") : col.cyan("◇");
+    const mergeable = !a.needsReauth;
+
+    const week = a.lastUsage?.sevenDay;
+    if (week == null) return { kind: mergeable ? "unknown" : "other", text: `${marker} ?` };
+    const weekUsed = used(week);
+    if (Math.round(weekUsed) <= 0) return { kind: mergeable ? "full" : "other", text: `${marker} ${col.green("full")}` };
+
+    const parts: string[] = [];
+    // A per-model weekly cap with more used than the aggregate is the binding constraint - surface it.
+    for (const [name, w] of Object.entries(a.lastPerModel ?? {})) {
+      if (used(w) > weekUsed) parts.push(seg(name.slice(0, 1), w, null));
+    }
+    const expiry = weeklyExpiry(a, ctx.now);
+    parts.push(seg("", week, Number.isFinite(expiry) ? expiry : null));
+    return { kind: "other", text: `${marker} ${parts.join(" ")}` };
+  };
+
+  // Adjacent identical bare tokens collapse into one counted token ("◇ 3 full").
+  const pool: string[] = [];
+  const segs = parked.map(poolSeg);
+  for (let i = 0; i < segs.length; ) {
+    const s = segs[i]!;
+    let j = i + 1;
+    while (s.kind !== "other" && j < segs.length && segs[j]!.kind === s.kind) j++;
+    if (j - i >= 2) pool.push(`${col.cyan("◇")} ${j - i} ${s.kind === "full" ? col.green("full") : "?"}`);
+    else pool.push(s.text);
+    i = j;
+  }
+
+  return [info.join(" "), active, ...pool].filter((l) => l !== "").join("  ");
+}
+
 export async function runStatusline(): Promise<number> {
   const raw = await readStdin();
+  let obj: unknown = null;
+  try {
+    obj = JSON.parse(raw);
+  } catch {
+    // malformed stdin - render from state alone
+  }
+  const now = Date.now();
 
-  // 1) tee usage - best effort, never throws out.
+  // tee usage for the Stop hook / status - best effort, never blocks rendering.
+  let org: string | null = null;
   try {
-    const obj = JSON.parse(raw);
-    const windows = parseStatusLineStdin(obj);
-    if (windows) {
-      const org = readOAuthAccount()?.organizationUuid ?? null;
-      const state: UsageState = { ...windows, org, ts: Date.now(), model: parseStatusLineModel(obj) };
+    org = readOAuthAccount()?.organizationUuid ?? null;
+    const windows = obj == null ? null : parseStatusLineStdin(obj);
+    const lastSwapAt = loadLastSwapAt();
+    if (windows && (lastSwapAt == null || now - lastSwapAt >= ADOPTION_GRACE_MS)) {
+      const state: UsageState = { ...windows, org, ts: now, model: parseStatusLineModel(obj) };
       writeUsage(state);
     }
   } catch {
-    // malformed stdin - skip usage, still delegate below
+    // skip the tee, still render below
   }
 
-  // 2) delegate to the prior statusLine, feeding it the same stdin.
-  const prior = readPriorStatusLine();
-  if (prior) {
-    try {
-      const p = Bun.spawn(["/bin/sh", "-c", prior], {
-        stdin: new TextEncoder().encode(raw),
-        stdout: "pipe",
-        stderr: "inherit",
-      });
-      const out = await new Response(p.stdout).text();
-      await p.exited;
-      if (out) process.stdout.write(out);
-      return p.exitCode ?? 0;
-    } catch {
-      // fall through to no-op
-    }
-  }
+  const cfg = loadConfig();
+  const modelUsage = loadModelUsage();
+  const stdin = StatusLineStdinSchema.safeParse(obj);
+  const dir = stdin.success ? (stdin.data.workspace?.current_dir ?? stdin.data.workspace?.project_dir ?? null) : null;
+  const ctx: RenderCtx = {
+    accounts: loadAccounts(),
+    perModel: modelUsage && modelUsage.org === org ? modelUsage.perModel : {},
+    switchModels: cfg.policy.switchModels,
+    threshold: cfg.threshold,
+    worktree: dir == null ? null : worktreeName(dir),
+    now,
+    color: !process.env.NO_COLOR,
+  };
+  process.stdout.write(renderStatusline(obj, ctx) + "\n");
   return 0;
 }