tokenmaxxing 0.4.0 → 0.6.0

package/DESIGN.md

@@ -4,7 +4,7 @@ Automatic Claude Code account switching. You run `claude` exactly as always; whe
 
 > Scope: **Claude Code only, macOS first.** Codex and other CLIs deferred (see `.memory/cc-codex-auth-mechanics.md`).
 >
-> Status: **implemented** (v0.1.0, 2026-07-09). TypeScript on Bun → single binary; Zod validates every external-boundary payload, JSON config, es-toolkit for utilities, `flock(2)` via `bun:ffi`. All load-bearing external facts were adversarially verified against the `2.1.204` binary + docs (OAuth token endpoint is `platform.claude.com/v1/oauth/token`, client_id `9d1c250a-…`, JSON body). What the acceptance gate actually shows is in §9.
+> Status: **implemented** (v0.1.0, 2026-07-09). TypeScript on Bun → single binary; Zod validates every external-boundary payload, JSON config, es-toolkit for utilities, `flock(2)` via `bun:ffi`. All load-bearing external facts were adversarially verified against the `2.1.204` binary + docs (OAuth token endpoint is `platform.claude.com/v1/oauth/token`, client_id `9d1c250a-...`, JSON body). What the acceptance gate actually shows is in §9.
 
 ---
 
@@ -57,7 +57,7 @@ The supervisor's `claude` call returns; it sees `respawn/<sid>`, deletes it, res
 ### 3.4 Swap sequence (under the lock)
 1. **Harvest the live credential into its TRUE owner's backup** - read the current `Claude Code-credentials` blob and resolve which account it actually belongs to via the roles endpoint (`GET /api/oauth/claude_cli/roles`), NOT the `accounts.json` active label. The label drifts from the live blob (a kill mid-swap, a manual `/login`), and harvesting by label once overwrote another account's backup and destroyed its only credential. Mandatory anyway: Claude rotates the refresh token in place, so older backups are dead. Refuse the swap if the live credential belongs to no pooled account.
 2. **Refresh B** - OAuth refresh-grant with B's parked refresh token → fresh access token; persist the rotated refresh token. On `invalid_grant`, mark B `needs_reauth`, notify, try the next account.
-3. **Install B** - `security add-generic-password -U … 'Claude Code-credentials' …` with B's fresh (non-expired) `claudeAiOauth` JSON.
+3. **Install B** - `security add-generic-password -U ... 'Claude Code-credentials' ...` with B's fresh (non-expired) `claudeAiOauth` JSON.
 4. **Swap identity + mark B active** - atomically rewrite only the `oauthAccount` object in `~/.claude.json` (temp+rename) to B's, and write `activeAccountUuid = B` in the SAME critical section, so a crash can't leave the installed credential and the active label pointing at different accounts.
 5. Do steps 1, 3, 4 inside Claude's own `~/.claude.lock` so the writes can't collide with a token refresh.
 
@@ -78,7 +78,7 @@ Each terminal ran the supervisor, so each has its own child `claude`, its own `-
 ## 5. Rotation policy
 Trigger at `five_hour >= 95%` OR `seven_day >= 95%`, per org. "Exhausted" is a **timestamped state** (`resets_at`), not a flag - an account is a candidate again after it resets. Optional projected threshold (`95 − EMA(per-turn Δ%)`) so a single large turn can't blow past 100% before the next Stop hook.
 
-**Model-aware trigger.** Claude subscriptions also enforce a **per-model weekly cap** - the capable models (Fable, Opus) have a tighter weekly limit that binds *before* the aggregate (e.g. 80% week-Fable at only 50% week-all-models). This cap isn't in statusLine stdin, so when the active model is in `policy.switchModels` we read it from `claude -p '/usage'` (free, 0 tokens, TTL-cached) and add `week(<activeModel>) >= threshold` to the trigger. A Fable session switches on the Fable cap; a Sonnet session rides the aggregate.
+**Model-aware trigger.** Claude subscriptions also enforce **per-model weekly caps** - currently only for Sonnet and Fable (there is no Opus-only quota), and Fable's tighter limit binds *before* the aggregate (e.g. 80% week-Fable at only 50% week-all-models). This cap isn't in statusLine stdin, so when the active model is in `policy.switchModels` we read it from `claude -p '/usage'` (free, 0 tokens, TTL-cached) and add `week(<activeModel>) >= threshold` to the trigger. A Fable session switches on the Fable cap; a Sonnet session rides the aggregate.
 
 ---
 
@@ -114,7 +114,7 @@ TypeScript on Bun, shipped as source: one multi-call entry (`src/main.ts`, `#!/u
 
 Unit suite: **32 pass**. Hermetic swap+concurrency+model-aware E2E: **all pass**. CLI init/doctor/uninstall: **pass** (re-verified init/doctor 2026-07-09 through the npm-installed bun shim on linux-arm64 after the switch to source packaging; full suite 47 pass / 0 fail there).
 
-1. **Transcript continuity across a process boundary - ✅ proven on real claude/real account.** `claude --session-id X -p …` committed a clean 12-line transcript; `claude --resume X -p …` recalled the earlier turn's codeword. The supervisor's kill→restore-termios→respawn→`--resume` loop is proven with a mock claude. The one step not run live is the abrupt SIGTERM of an *idle interactive* real claude (structurally safe - the transcript is fully committed+fsynced before idle and nothing writes while idle).
+1. **Transcript continuity across a process boundary - ✅ proven on real claude/real account.** `claude --session-id X -p ...` committed a clean 12-line transcript; `claude --resume X -p ...` recalled the earlier turn's codeword. The supervisor's kill→restore-termios→respawn→`--resume` loop is proven with a mock claude. The one step not run live is the abrupt SIGTERM of an *idle interactive* real claude (structurally safe - the transcript is fully committed+fsynced before idle and nothing writes while idle).
 2. **Terminal restoration - ✅ mechanism proven.** The supervisor saves `stty -g` and restores it between kill and respawn; the path executes in the mock-supervisor run. Visual raw-mode/​resize confirmation wants a live interactive terminal.
 3. **SessionStart swap - ✅ swap logic proven; ⚠️ "adopted by first turn" needs a 2nd real account.** The hook's decision+swap path is covered by the E2E; the claude-internal timing (SessionStart before first `getToken`) needs a second subscription to observe end-to-end.
 4. **Keychain writes from a headless hook - ✅ proven.** The swap E2E's 4 concurrent subprocesses each wrote the live item via `security -i` (secret on stdin, never argv) with no prompt/hang; `init` parked backups headlessly too. (Residual: the live `Claude Code-credentials` ACL for the *fresh resumed claude* is mitigated by onboarding touching `security` interactively.)

package/README.md

@@ -6,9 +6,9 @@
 
 ```
 $ claude
-  …you work normally…
-  ↻ tokenmaxxing: switched to work@acme.com - resuming…
-  …same conversation, fresh quota…
+  ...you work normally...
+  ↻ tokenmaxxing: switched to work@acme.com - resuming...
+  ...same conversation, fresh quota...
 ```
 
 ## Why
@@ -24,7 +24,7 @@ bun add -g tokenmaxxing
 tokenmaxxing init
 ```
 
-`init` imports the account you're already on, installs the `claude` supervisor + three `settings.json` entries (a statusLine shim, a Stop hook, a SessionStart hook), and adds the supervisor's bin dir to PATH in your shell rc (idempotent; it must sit ahead of the real `claude` to intercept it). Restart your shell, then add more accounts and go:
+`init` imports the account you're already on, installs the `claude` supervisor + three `settings.json` entries (the tokenmaxxing statusLine, a Stop hook, a SessionStart hook), and adds the supervisor's bin dir to PATH in your shell rc (idempotent; it must sit ahead of the real `claude` to intercept it). Restart your shell, then add more accounts and go:
 
 ```sh
 tokenmaxxing add        # logs one in, in isolation, and pools it
@@ -47,11 +47,13 @@ claude                  # use claude as always
 
 Switching triggers at **95%** (configurable) on any of:
 
-- **Session** (5-hour) or **week (all models)** - the aggregate windows, fed free/push-based by a statusLine shim.
-- **Per-model weekly cap** - the capable models (Fable, Opus) have their own tighter weekly limit that binds *before* the aggregate. tokenmaxxing reads it from `claude -p '/usage'` (free, 0 tokens, TTL-cached) whenever the active model is one of `policy.switchModels`, so a Fable session switches on the Fable cap while a Sonnet session rides the aggregate.
+- **Session** (5-hour) or **week (all models)** - the aggregate windows, fed free/push-based by the statusLine.
+- **Per-model weekly cap** - the most capable model (Fable) has its own tighter weekly limit that binds *before* the aggregate (per-model caps currently exist only for Sonnet and Fable, and Sonnet's is generous). tokenmaxxing reads it from `claude -p '/usage'` (free, 0 tokens, TTL-cached) whenever the active model is one of `policy.switchModels`, so a Fable session switches on the Fable cap while a Sonnet session rides the aggregate.
 
 The 5% headroom is deliberate: it's the budget to reach a clean turn boundary and respawn before the wall.
 
+The **target** is chosen greedily off each account's cached windows: the usable account (session and week under threshold, or past their reset) whose weekly window **expires soonest** - unused weekly allowance is forfeited at the fixed per-account reset. Cached resets are absolute UTC epochs, so a stale snapshot still resolves correctly: a weekly reset that has passed extrapolates forward in 7-day steps, and a session window past its reset counts as empty. `tokenmaxxing switch` ranks the current account too and does nothing when it already wins, so it is idempotent - running it periodically converges on the right account.
+
 ## Configuration
 
 `~/.config/tokenmaxxing/config.json` (every field optional):
@@ -61,7 +63,7 @@ The 5% headroom is deliberate: it's the budget to reach a clean turn boundary an
   "threshold": 95,
   "policy": {
     "projectionMargin": 0,
-    "switchModels": ["fable", "opus"],
+    "switchModels": ["fable"],
     "usagePollTtlMs": 90000
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",

package/src/cli/add.ts

@@ -94,7 +94,7 @@ export async function cmdAdd(): Promise<number> {
   }
 
   // Sample usage now (#16) so the account isn't "not sampled yet" in status/ls.
-  console.log(c.dim("sampling usage…"));
+  console.log(c.dim("sampling usage..."));
   const sampled = await probeUsage(onboardDir);
   if (!sampled) console.log(c.yellow("could not sample usage now - it will fill in on first use."));
 
@@ -118,6 +118,7 @@ export async function cmdAdd(): Promise<number> {
       needsReauth: false,
       lastUsage: sampled ? { fiveHour: sampled.session, sevenDay: sampled.weekAll } : existing?.lastUsage,
       lastPerModel: sampled && Object.keys(sampled.perModel).length > 0 ? sampled.perModel : existing?.lastPerModel,
+      lastUsageAt: sampled ? Date.now() : existing?.lastUsageAt,
     };
     if (existing) Object.assign(existing, fresh);
     else idx.accounts.push(fresh);

package/src/cli/init.ts

@@ -120,7 +120,6 @@ export async function cmdInit(): Promise<number> {
   console.log(`${c.green("✓")} imported current account → ${c.bold(account.email)} (${account.subscriptionType ?? "?"})`);
   console.log(`${c.green("✓")} installed ${c.bold("claude")} supervisor + statusLine/Stop/SessionStart hooks`);
   reportTimer(out);
-  if (out.priorStatusLine) console.log(`${c.green("✓")} wrapped your existing statusLine (preserved)`);
   if (!out.pathAhead) {
     console.log();
     ensurePathAhead();

package/src/cli/render.ts

@@ -2,16 +2,21 @@
 
 import { clamp } from "es-toolkit";
 
-const useColor = !process.env.NO_COLOR && process.stdout.isTTY;
+/** ANSI painters, no-ops when disabled. The statusLine renders through a pipe
+ *  (never a TTY), so it needs its own enable gate; the CLI gates on stdout. */
+export function makeColors(enabled: boolean) {
+  const paint = (code: string) => (s: string) => (enabled ? `\x1b[${code}m${s}\x1b[0m` : s);
+  return {
+    dim: paint("2"),
+    bold: paint("1"),
+    green: paint("32"),
+    yellow: paint("33"),
+    red: paint("31"),
+    cyan: paint("36"),
+  };
+}
 
-export const c = {
-  dim: (s: string) => (useColor ? `\x1b[2m${s}\x1b[0m` : s),
-  bold: (s: string) => (useColor ? `\x1b[1m${s}\x1b[0m` : s),
-  green: (s: string) => (useColor ? `\x1b[32m${s}\x1b[0m` : s),
-  yellow: (s: string) => (useColor ? `\x1b[33m${s}\x1b[0m` : s),
-  red: (s: string) => (useColor ? `\x1b[31m${s}\x1b[0m` : s),
-  cyan: (s: string) => (useColor ? `\x1b[36m${s}\x1b[0m` : s),
-};
+export const c = makeColors(!process.env.NO_COLOR && !!process.stdout.isTTY);
 
 /** A fixed-width usage bar, colored by fill. */
 export function bar(pct: number, width = 16): string {
@@ -34,3 +39,33 @@ export function fmtReset(epochMs: number | null | undefined, now = Date.now()):
   if (h > 0) return `resets in ${h}h${m}m`;
   return `resets in ${m}m`;
 }
+
+/** Age of a cached sample, largest unit only: "just now", "3m ago", "2h ago",
+ *  "5d ago". */
+export function fmtAgo(epochMs: number, now = Date.now()): string {
+  const dsec = Math.max(0, Math.round((now - epochMs) / 1000));
+  if (dsec < 60) return "just now";
+  const d = Math.floor(dsec / 86400);
+  const h = Math.floor((dsec % 86400) / 3600);
+  const m = Math.floor((dsec % 3600) / 60);
+  if (d > 0) return `${d}d ago`;
+  if (h > 0) return `${h}h ago`;
+  return `${m}m ago`;
+}
+
+/** Compact time-until-reset for the statusLine: the largest unit only ("6d",
+ *  "2h", "45m"), floored to "1m" so a live window never reads as zero, and ""
+ *  once the reset has passed (the window is simply empty again). Non-empty
+ *  output always ends in a unit letter, so the digit-leading used-percent glued
+ *  after it stays parseable. */
+export function fmtResetShort(epochMs: number | null | undefined, now = Date.now()): string {
+  if (epochMs == null) return "";
+  const dsec = Math.round((epochMs - now) / 1000);
+  if (dsec <= 0) return "";
+  const d = Math.floor(dsec / 86400);
+  const h = Math.floor((dsec % 86400) / 3600);
+  const m = Math.floor((dsec % 3600) / 60);
+  if (d > 0) return `${d}d`;
+  if (h > 0) return `${h}h`;
+  return `${Math.max(m, 1)}m`;
+}

package/src/cli/status.ts

@@ -10,8 +10,8 @@ import { readOAuthAccount } from "../lib/claudejson.ts";
 import { probeActiveUsage, probeParkedUsage, type SampleOutcome } from "../lib/sample.ts";
 import { withLock } from "../lib/lock.ts";
 import { paths } from "../lib/paths.ts";
-import { isExhausted } from "../lib/picker.ts";
-import { bar, c, fmtReset } from "./render.ts";
+import { isExhausted, nextWeeklyReset } from "../lib/picker.ts";
+import { bar, c, fmtAgo, fmtReset } from "./render.ts";
 import type { FullUsage } from "../lib/usage.ts";
 import type { UsageWindow } from "../lib/types.ts";
 
@@ -28,7 +28,7 @@ export async function cmdStatus(): Promise<number> {
   // Load, sample, and save entirely under the flock: parked refreshes must not
   // collide with an in-flight swap, and a save of an index loaded before a
   // concurrent swap would clobber the swap's activeAccountUuid.
-  console.error(c.dim("sampling live usage…"));
+  console.error(c.dim("sampling live usage..."));
   const outcomes = new Map<string, SampleOutcome>();
   await withLock(paths.lockFile, async () => {
     idx = loadAccounts();
@@ -58,6 +58,9 @@ export async function cmdStatus(): Promise<number> {
         if (!outcome.ok) return;
         a.lastUsage = { fiveHour: outcome.usage.session, sevenDay: outcome.usage.weekAll };
         if (Object.keys(outcome.usage.perModel).length > 0) a.lastPerModel = outcome.usage.perModel;
+        // stamp when the figures were actually measured: the statusLine tee's
+        // own write time for the push-fed active account, else the probe time.
+        a.lastUsageAt = fromStatusLine && live ? live.ts : Date.now();
       }),
     );
     saveAccounts(idx);
@@ -66,8 +69,15 @@ export async function cmdStatus(): Promise<number> {
   console.log(c.dim(`threshold ${cfg.threshold}%  ·  ${idx.accounts.length} account(s)`));
   console.log();
 
-  const row = (name: string, w: UsageWindow) =>
-    console.log(`    ${name.padEnd(5)} ${bar(w.usedPercentage)}  ${c.dim(fmtReset(w.resetsAt, now))}`);
+  // A window whose cached reset has passed is empty again; weekly windows recur
+  // on a fixed per-account anchor, so a stale weekly reset extrapolates forward.
+  // Fresh samples pass through unchanged (their resets are in the future).
+  const row = (name: string, w: UsageWindow, weekly: boolean) => {
+    const passed = w.resetsAt != null && w.resetsAt <= now;
+    const pct = passed ? 0 : w.usedPercentage;
+    const resetsAt = weekly ? nextWeeklyReset(w.resetsAt, now) : passed ? null : w.resetsAt;
+    console.log(`    ${name.padEnd(5)} ${bar(pct)}  ${c.dim(fmtReset(resetsAt, now))}`);
+  };
 
   for (const a of idx.accounts) {
     const active = a.accountUuid === idx.activeAccountUuid;
@@ -87,13 +97,13 @@ export async function cmdStatus(): Promise<number> {
 
     console.log(`${marker} ${c.bold(a.label || a.email)} ${badges.join(" ")}`);
     if (aggregate) {
-      row("5h", aggregate.fiveHour);
-      row("week", aggregate.sevenDay);
+      row("5h", aggregate.fiveHour, false);
+      row("week", aggregate.sevenDay, true);
     }
-    if (perModel) for (const [name, w] of Object.entries(perModel)) row(name, w);
+    if (perModel) for (const [name, w] of Object.entries(perModel)) row(name, w, true);
     if (failed && outcome && !outcome.ok) {
-      const note = aggregate || perModel ? "cached · live sample failed" : "live sample failed";
-      console.log(`    ${c.yellow(note)}: ${c.dim(outcome.reason)}`);
+      const cached = aggregate || perModel ? `cached${a.lastUsageAt != null ? ` ${fmtAgo(a.lastUsageAt, now)}` : ""} · ` : "";
+      console.log(`    ${c.yellow(`${cached}live sample failed`)}: ${c.dim(outcome.reason)}`);
     }
     console.log();
   }

package/src/cli/switch.ts

@@ -1,16 +1,28 @@
-// `tokenmaxxing switch [selector]` (also the bare `tokenmaxxing` / `xx`).
-// No selector → auto-pick the best available account. With a selector → switch to
-// that one. Manual/recovery tool: no threshold gate, runs under the flock. When
-// everything is depleted it still switches to the soonest-resetting account.
+// `tokenmaxxing switch [selector]`.
+// No selector → greedy: rank EVERY account (current included) by soonest weekly
+// expiry among those with session/week under threshold, off the cached windows.
+// When the current account already wins (or ties - swapping between equals buys
+// nothing), do nothing: the command is idempotent, so running it periodically
+// converges on the right account. With a selector → switch to that one. Runs
+// under the flock. When everything is depleted it stays on / switches to
+// whichever account recovers soonest.
+//
+// The active LABEL can drift from the live login (manual /login is the
+// surviving drift source). A no-op would freeze that drift forever, so when
+// ~/.claude.json names a different account than accounts.json we swap for real
+// instead of trusting the label - performSwap resolves the live credential's
+// true owner, harvesting the drifted login correctly.
 
 import { withLock } from "../lib/lock.ts";
 import { paths } from "../lib/paths.ts";
 import { loadAccounts, loadConfig } from "../lib/state.ts";
+import { readOAuthAccount } from "../lib/claudejson.ts";
 import { performSwap, chooseAndSwap } from "../lib/swap.ts";
-import { pickEarliestReset } from "../lib/picker.ts";
+import { isExhausted, pickBest, pickEarliestReset, swapPreference, weeklyExpiry, type PickCtx } from "../lib/picker.ts";
 import { InvalidGrantError } from "../lib/oauth.ts";
 import { findAccount } from "./rename.ts";
 import { c, fmtReset } from "./render.ts";
+import type { Account } from "../lib/types.ts";
 
 export async function cmdSwitch(selector?: string): Promise<number> {
   const idx0 = loadAccounts();
@@ -23,12 +35,10 @@ export async function cmdSwitch(selector?: string): Promise<number> {
 
   return withLock(paths.lockFile, async () => {
     const idx = loadAccounts();
+    const claimed = readOAuthAccount()?.accountUuid ?? null;
+    const drifted = claimed != null && claimed !== idx.activeAccountUuid;
 
-    if (selector) {
-      const target = findAccount(idx.accounts, selector);
-      if (!target) { console.error(c.red(`no account matches "${selector}"`)); return 1; }
-      if (target.accountUuid === idx.activeAccountUuid) { console.log(`already on ${c.bold(target.label)}`); return 0; }
-      if (target.needsReauth) { console.error(c.red(`${target.label} needs re-auth - \`tokenmaxxing add\``)); return 1; }
+    const swapTo = async (target: Account): Promise<number> => {
       try {
         await performSwap(target);
       } catch (e) {
@@ -37,25 +47,59 @@ export async function cmdSwitch(selector?: string): Promise<number> {
       }
       console.log(`${c.green("↻")} switched to ${c.bold(target.label)}`);
       return 0;
+    };
+
+    if (selector) {
+      const target = findAccount(idx.accounts, selector);
+      if (!target) { console.error(c.red(`no account matches "${selector}"`)); return 1; }
+      if (target.accountUuid === idx.activeAccountUuid && !drifted) { console.log(`already on ${c.bold(target.label)}`); return 0; }
+      if (target.needsReauth) { console.error(c.red(`${target.label} needs re-auth - \`tokenmaxxing add\``)); return 1; }
+      return swapTo(target);
     }
 
-    // auto: best account under threshold
-    const landed = await chooseAndSwap({ now, threshold: cfg.threshold });
-    if (landed) {
-      console.log(`${c.green("↻")} switched to ${c.bold(landed.label)}`);
+    // auto: greedy over everyone, current included - a no-op when current wins.
+    const everyone: PickCtx = { now, threshold: cfg.threshold, currentAccountUuid: null };
+    const active = idx.accounts.find((a) => a.accountUuid === idx.activeAccountUuid) ?? null;
+    const best = pickBest(idx.accounts, everyone);
+    const currentWins =
+      best != null && active != null && !active.needsReauth && !isExhausted(active, everyone) &&
+      (best.accountUuid === active.accountUuid || swapPreference(now).every((k) => k(active) === k(best)));
+    if (currentWins) {
+      if (drifted) return swapTo(active);
+      const expiry = weeklyExpiry(active, now);
+      const why = Number.isFinite(expiry) ? ` (weekly ${fmtReset(expiry, now)})` : "";
+      console.log(`already on the best account: ${c.bold(active.label)}${why}`);
       return 0;
     }
+    if (best) {
+      const landed = await chooseAndSwap({ now, threshold: cfg.threshold });
+      if (landed) {
+        console.log(`${c.green("↻")} switched to ${c.bold(landed.label)}`);
+        return 0;
+      }
+    }
 
-    // everything is depleted → switch to whichever recovers soonest
-    const earliest = pickEarliestReset(idx.accounts, { now, threshold: cfg.threshold, currentAccountUuid: idx.activeAccountUuid });
+    // No usable target swapped in: everything is depleted, or the remaining
+    // candidates' refresh tokens just died (chooseAndSwap marks needs-reauth,
+    // hence the reload). Stay on / switch to whichever recovers soonest.
+    const fresh = loadAccounts();
+    const earliest = pickEarliestReset(fresh.accounts, everyone);
     if (!earliest) { console.error(c.yellow("no switchable account (all need re-auth?)")); return 1; }
-    try {
-      await performSwap(earliest.account);
-    } catch (e) {
-      if (e instanceof InvalidGrantError) { console.error(c.red(`${earliest.account.label}'s refresh token is dead`)); return 1; }
-      throw e;
+    const reauth = fresh.accounts.filter((a) => a.needsReauth).map((a) => a.label);
+    const reauthNote = reauth.length ? ` - re-auth needed: ${reauth.join(", ")}` : "";
+    if (earliest.account.accountUuid === fresh.activeAccountUuid && !drifted) {
+      // availableAt in the past means the current account is fine and the
+      // others are simply unusable - do not claim a limit that is not there.
+      const msg = earliest.availableAt <= now
+        ? `staying on ${c.bold(earliest.account.label)} - no usable switch target${reauthNote}`
+        : `all accounts at limit - staying on ${c.bold(earliest.account.label)} (${fmtReset(earliest.availableAt, now)})${reauthNote}`;
+      console.log(c.yellow(msg));
+      return 0;
+    }
+    const code = await swapTo(earliest.account);
+    if (code === 0 && earliest.availableAt > now) {
+      console.log(c.yellow(`all accounts at limit - ${c.bold(earliest.account.label)} recovers soonest (${fmtReset(earliest.availableAt, now)})${reauthNote}`));
     }
-    console.log(`${c.yellow("↻")} all accounts at limit - switched to ${c.bold(earliest.account.label)} (${fmtReset(earliest.availableAt, now)})`);
-    return 0;
+    return code;
   });
 }

package/src/entries/statusline.ts

@@ -1,58 +1,186 @@
-// statusLine shim. Reads Claude's statusLine stdin, tees the rate-limit data to
-// usage.json (write-on-change, O(ms)), then transparently delegates to the user's
-// prior statusLine command (same stdin) and passes its stdout through unchanged.
-// Must NEVER break the user's status line: every step is best-effort.
+// Native statusLine. Reads Claude's statusLine stdin, tees the rate-limit data
+// to usage.json (write-on-change, O(ms)), then renders ONE line:
+//   worktree name (linked worktrees only), model (effort), ctx used,
+//   +added/-removed, then quota as USED percent (bold, severity-colored)
+//   glued after its time-to-reset: "◆ F26 2h5 1d38  ◇ F67 2d40  ◇ 2 full"
+//   ("2h5" = resets in 2h, 5 used) - the active account's windows after a
+//   green ◆ (per-model by initial first, "F?" when the cap applies but is
+//   unmeasured, then session/5h, then week), then each parked account's week
+//   after a cyan ◇, in swap-preference order so the first usable ◇ is where
+//   the next swap lands. Adjacent untouched (or unsampled) parked accounts
+//   collapse into one counted token. Blocks are joined by TWO spaces, tokens
+//   within a block by one. Per-model resets are omitted (they match the
+//   weekly reset).
+// Must NEVER break the status line: render what parses, skip what doesn't.
 
+import { sortBy } from "es-toolkit";
+import { z } from "zod";
 import { readOAuthAccount } from "../lib/claudejson.ts";
-import { readPriorStatusLine } from "../lib/settings.ts";
-import { loadLastSwapAt, writeUsage } from "../lib/state.ts";
-import { parseStatusLineStdin, parseStatusLineModel } from "../lib/usage.ts";
-import type { UsageState } from "../lib/types.ts";
+import { loadAccounts, loadConfig, loadLastSwapAt, loadModelUsage, writeUsage } from "../lib/state.ts";
+import { familyTokens, matchedFamily, parseStatusLineStdin, parseStatusLineModel } from "../lib/usage.ts";
+import { isExhausted, swapPreference, weeklyExpiry } from "../lib/picker.ts";
+import { worktreeName } from "../lib/worktree.ts";
+import { fmtResetShort, makeColors } from "../cli/render.ts";
+import {
+  AccountsIndexSchema,
+  StatusLineStdinSchema,
+  UsageWindowSchema,
+  type Account,
+  type UsageState,
+  type UsageWindow,
+} from "../lib/types.ts";
 
 /** A session that hasn't adopted a fresh swap yet (<=30s keychain cache) pushes
  *  the OLD account's windows while ~/.claude.json already names the NEW org.
  *  Suppress the tee for this long after a swap so that mislabel never lands. */
 const ADOPTION_GRACE_MS = 45_000;
 
+const RenderCtxSchema = z.object({
+  accounts: AccountsIndexSchema,
+  /** active account's per-model weekly windows ({} unless fresh for the live org). */
+  perModel: z.record(z.string(), UsageWindowSchema),
+  /** families (lowercased) whose per-model weekly cap gates a switch. */
+  switchModels: z.array(z.string()),
+  threshold: z.number(),
+  /** linked-worktree basename, null in a main checkout. */
+  worktree: z.string().nullable(),
+  now: z.number(),
+  color: z.boolean(),
+});
+export type RenderCtx = z.infer<typeof RenderCtxSchema>;
+
 async function readStdin(): Promise<string> {
   const chunks: Uint8Array[] = [];
   for await (const c of Bun.stdin.stream()) chunks.push(c);
   return Buffer.concat(chunks).toString("utf8");
 }
 
+/** Pure renderer: statusLine stdin + tokenmaxxing state → the emitted line. */
+export function renderStatusline(stdinObj: unknown, ctx: RenderCtx): string {
+  const col = makeColors(ctx.color);
+  const severity = (u: number) => (u >= 95 ? col.red : u >= 75 ? col.yellow : col.green);
+  const gauge = (u: number) => col.bold(severity(u)(`${Math.round(u)}`));
+  // Used quota in a window; one whose reset has passed is empty again.
+  const used = (w: UsageWindow) => (w.resetsAt != null && w.resetsAt <= ctx.now ? 0 : w.usedPercentage);
+  const reset = (epochMs: number | null) => fmtResetShort(epochMs, ctx.now);
+
+  const parsed = StatusLineStdinSchema.safeParse(stdinObj);
+  const d = parsed.success ? parsed.data : null;
+
+  // ---- info block: worktree, model, ctx, diff
+  const info: string[] = [];
+  if (ctx.worktree != null) info.push(ctx.worktree);
+  const modelName = d?.model?.display_name ?? d?.model?.id;
+  if (modelName) {
+    const effort = d?.effort?.level;
+    info.push(col.bold(modelName) + (effort ? ` (${effort})` : ""));
+  }
+  const ctxUsed = d?.context_window?.used_percentage;
+  if (ctxUsed != null) info.push(`ctx ${gauge(ctxUsed)}`);
+  const added = d?.cost?.total_lines_added ?? 0;
+  const removed = d?.cost?.total_lines_removed ?? 0;
+  // -removed stays unpainted: red means quota alarm and nothing else.
+  if (added > 0 || removed > 0) info.push(`${col.green(`+${added}`)}/-${removed}`);
+
+  // ---- active account block
+  const seg = (label: string, w: UsageWindow, resetAt: number | null) =>
+    `${label}${reset(resetAt)}${gauge(used(w))}`;
+  const wins = parseStatusLineStdin(stdinObj);
+  const windows: string[] = [];
+  // A capacity-constrained model whose cap is unmeasured must not look safe.
+  const family = matchedFamily(parseStatusLineModel(stdinObj), ctx.switchModels);
+  if (family && !Object.keys(ctx.perModel).some((k) => familyTokens(k).includes(family))) {
+    windows.push(`${family[0]!.toUpperCase()}?`);
+  }
+  for (const [name, w] of Object.entries(ctx.perModel)) windows.push(seg(name.slice(0, 1), w, null));
+  if (wins) {
+    windows.push(seg("", wins.fiveHour, wins.fiveHour.resetsAt));
+    windows.push(seg("", wins.sevenDay, wins.sevenDay.resetsAt));
+  }
+  const active =
+    windows.length > 0
+      ? `${col.green("◆")} ${windows.join(" ")}`
+      : ctx.accounts.activeAccountUuid != null
+        ? `${col.green("◆")} ?`
+        : "";
+
+  // ---- parked accounts, in swap order: the first usable ◇ is the next target
+  const pickCtx = { now: ctx.now, threshold: ctx.threshold, currentAccountUuid: ctx.accounts.activeAccountUuid };
+  const parked = sortBy(
+    ctx.accounts.accounts.filter((a) => a.accountUuid !== ctx.accounts.activeAccountUuid),
+    [(a) => (a.needsReauth || isExhausted(a, pickCtx) ? 1 : 0), ...swapPreference(ctx.now)],
+  );
+  const poolSeg = (a: Account): { kind: "full" | "unknown" | "other"; text: string } => {
+    const marker = a.needsReauth ? col.red("✗") : col.cyan("◇");
+    const mergeable = !a.needsReauth;
+
+    const week = a.lastUsage?.sevenDay;
+    if (week == null) return { kind: mergeable ? "unknown" : "other", text: `${marker} ?` };
+    const weekUsed = used(week);
+    if (Math.round(weekUsed) <= 0) return { kind: mergeable ? "full" : "other", text: `${marker} ${col.green("full")}` };
+
+    const parts: string[] = [];
+    // A per-model weekly cap with more used than the aggregate is the binding constraint - surface it.
+    for (const [name, w] of Object.entries(a.lastPerModel ?? {})) {
+      if (used(w) > weekUsed) parts.push(seg(name.slice(0, 1), w, null));
+    }
+    const expiry = weeklyExpiry(a, ctx.now);
+    parts.push(seg("", week, Number.isFinite(expiry) ? expiry : null));
+    return { kind: "other", text: `${marker} ${parts.join(" ")}` };
+  };
+
+  // Adjacent identical bare tokens collapse into one counted token ("◇ 3 full").
+  const pool: string[] = [];
+  const segs = parked.map(poolSeg);
+  for (let i = 0; i < segs.length; ) {
+    const s = segs[i]!;
+    let j = i + 1;
+    while (s.kind !== "other" && j < segs.length && segs[j]!.kind === s.kind) j++;
+    if (j - i >= 2) pool.push(`${col.cyan("◇")} ${j - i} ${s.kind === "full" ? col.green("full") : "?"}`);
+    else pool.push(s.text);
+    i = j;
+  }
+
+  return [info.join(" "), active, ...pool].filter((l) => l !== "").join("  ");
+}
+
 export async function runStatusline(): Promise<number> {
   const raw = await readStdin();
+  let obj: unknown = null;
+  try {
+    obj = JSON.parse(raw);
+  } catch {
+    // malformed stdin - render from state alone
+  }
+  const now = Date.now();
 
-  // 1) tee usage - best effort, never throws out.
+  // tee usage for the Stop hook / status - best effort, never blocks rendering.
+  let org: string | null = null;
   try {
-    const obj = JSON.parse(raw);
-    const windows = parseStatusLineStdin(obj);
+    org = readOAuthAccount()?.organizationUuid ?? null;
+    const windows = obj == null ? null : parseStatusLineStdin(obj);
     const lastSwapAt = loadLastSwapAt();
-    if (windows && (lastSwapAt == null || Date.now() - lastSwapAt >= ADOPTION_GRACE_MS)) {
-      const org = readOAuthAccount()?.organizationUuid ?? null;
-      const state: UsageState = { ...windows, org, ts: Date.now(), model: parseStatusLineModel(obj) };
+    if (windows && (lastSwapAt == null || now - lastSwapAt >= ADOPTION_GRACE_MS)) {
+      const state: UsageState = { ...windows, org, ts: now, model: parseStatusLineModel(obj) };
       writeUsage(state);
     }
   } catch {
-    // malformed stdin - skip usage, still delegate below
+    // skip the tee, still render below
   }
 
-  // 2) delegate to the prior statusLine, feeding it the same stdin.
-  const prior = readPriorStatusLine();
-  if (prior) {
-    try {
-      const p = Bun.spawn(["/bin/sh", "-c", prior], {
-        stdin: new TextEncoder().encode(raw),
-        stdout: "pipe",
-        stderr: "inherit",
-      });
-      const out = await new Response(p.stdout).text();
-      await p.exited;
-      if (out) process.stdout.write(out);
-      return p.exitCode ?? 0;
-    } catch {
-      // fall through to no-op
-    }
-  }
+  const cfg = loadConfig();
+  const modelUsage = loadModelUsage();
+  const stdin = StatusLineStdinSchema.safeParse(obj);
+  const dir = stdin.success ? (stdin.data.workspace?.current_dir ?? stdin.data.workspace?.project_dir ?? null) : null;
+  const ctx: RenderCtx = {
+    accounts: loadAccounts(),
+    perModel: modelUsage && modelUsage.org === org ? modelUsage.perModel : {},
+    switchModels: cfg.policy.switchModels,
+    threshold: cfg.threshold,
+    worktree: dir == null ? null : worktreeName(dir),
+    now,
+    color: !process.env.NO_COLOR,
+  };
+  process.stdout.write(renderStatusline(obj, ctx) + "\n");
   return 0;
 }

package/src/entries/supervisor.ts

@@ -106,7 +106,7 @@ async function countdownWait(acct: string, until: number): Promise<void> {
     await Bun.sleep(1000);
   }
   process.removeListener("SIGINT", onInt);
-  process.stdout.write(`\n\x1b[36m↻ resuming on ${acct}…\x1b[0m\n`);
+  process.stdout.write(`\n\x1b[36m↻ resuming on ${acct}...\x1b[0m\n`);
 }
 
 /** Entry point: `claude ...args`. */
@@ -193,7 +193,7 @@ export async function runSupervisor(argv: string[]): Promise<number> {
       rmSync(marker, { force: true });
       respawns++;
       if (m.waitUntil && m.waitUntil > Date.now()) await countdownWait(m.account, m.waitUntil);
-      else process.stdout.write(`\n\x1b[36m↻ tokenmaxxing: switched to ${m.account} - resuming…\x1b[0m\n`);
+      else process.stdout.write(`\n\x1b[36m↻ tokenmaxxing: switched to ${m.account} - resuming...\x1b[0m\n`);
       launchArgs = ["--resume", sid, ...base];
       continue;
     }

package/src/lib/claudebin.ts

@@ -7,9 +7,14 @@ import { loadConfig } from "./state.ts";
 
 export function resolveRealClaude(): string {
   const cfg = loadConfig();
-  if (cfg.claudeBin && existsSync(cfg.claudeBin)) return cfg.claudeBin;
-  if (process.env.TOKENMAXXING_CLAUDE_BIN && existsSync(process.env.TOKENMAXXING_CLAUDE_BIN))
-    return process.env.TOKENMAXXING_CLAUDE_BIN;
+  if (cfg.claudeBin) {
+    if (existsSync(cfg.claudeBin)) return cfg.claudeBin;
+    // A configured-but-vanished binary must not silently degrade to the PATH
+    // scan: under a relocated TOKENMAXXING_HOME the scan's binDir guard misses
+    // the installed wrapper, which then recurses through the supervisor
+    // (observed 2026-07-12 as a forever-hung `/usage` probe).
+    throw new Error(`configured claudeBin does not exist: ${cfg.claudeBin} - fix config.json`);
+  }
   for (const d of (process.env.PATH ?? "").split(":")) {
     if (!d || d === paths.binDir) continue;
     const cand = join(d, "claude");

package/src/lib/decide.ts

@@ -20,9 +20,9 @@ import { readOAuthAccount } from "./claudejson.ts";
 import { chooseAndSwap, performSwap } from "./swap.ts";
 import { pickEarliestReset, usableAt } from "./picker.ts";
 import { InvalidGrantError } from "./oauth.ts";
-import { probeUsage } from "./usage.ts";
+import { familyTokens, matchedFamily, probeUsage } from "./usage.ts";
 import { log } from "./log.ts";
-import { AccountSchema, type Account, type Config, type ModelInfo, type ModelUsageState, type UsageState, type UsageWindow } from "./types.ts";
+import { AccountSchema, type Account, type Config, type ModelUsageState, type UsageState, type UsageWindow } from "./types.ts";
 
 const SwapDecisionSchema = z.object({
   swapped: z.boolean(),
@@ -58,24 +58,6 @@ async function ensurePerModel(cfg: Config, org: string | null): Promise<ModelUsa
   return state;
 }
 
-/** Lowercased word tokens of a model id or display string: "claude-opus-4-8" /
- *  "Opus 4.8" -> ["claude","opus","4","8"] / ["opus","4","8"]. Model naming
- *  drifts per release ("Fable" became "Fable 5" in 2.1.206, and id grammar has
- *  historically flipped between family-first and version-first), so gates match
- *  a family token anywhere instead of an exact string - an exact-string gate
- *  silently disabled the per-model check in the 2026-07-09/10 incidents. */
-export function familyTokens(s: string): string[] {
-  return s.trim().toLowerCase().split(/[\s.-]+/).filter((t) => t.length > 0);
-}
-
-/** The switchModels family the active model belongs to, from its id OR display
- *  tokens; null when the model is not capacity-constrained. */
-export function matchedFamily(model: ModelInfo | null, families: string[]): string | null {
-  if (!model) return null;
-  const tokens = new Set([...familyTokens(model.id), ...familyTokens(model.display)]);
-  return families.find((f) => tokens.has(f)) ?? null;
-}
-
 /** The family's weekly cap among the `/usage` rows; when several rows match the
  *  family, the most-used one wins (switching early beats metering a depleted cap). */
 function capForFamily(mu: ModelUsageState, family: string): UsageWindow | undefined {
@@ -134,6 +116,7 @@ export async function evaluateAndMaybeSwap(now = Date.now()): Promise<SwapDecisi
       const active = idx.accounts.find((a) => a.accountUuid === idx.activeAccountUuid);
       if (active) {
         active.lastUsage = { fiveHour: u2.fiveHour, sevenDay: u2.sevenDay };
+        active.lastUsageAt = u2.ts;
         // Snapshot per-model caps too, so they still show after we switch away.
         if (mu2 && mu2.org === org2) active.lastPerModel = mu2.perModel;
         saveAccounts(idx);

package/src/lib/install.ts

@@ -1,5 +1,5 @@
 // Install/uninstall the on-PATH `claude` supervisor wrapper + settings entries.
-// The wrapper is a 2-line `exec … __supervise "$@"` shim so dispatch never
+// The wrapper is a 2-line `exec ... __supervise "$@"` shim so dispatch never
 // depends on argv0 semantics.
 
 import { appendFileSync, existsSync, mkdirSync, readFileSync, realpathSync, rmSync } from "node:fs";
@@ -14,7 +14,6 @@ import { resolveRealClaude } from "./claudebin.ts";
 const InstallOutcomeSchema = z.object({
   claudeWrapper: z.string(),
   installedBin: z.string(),
-  priorStatusLine: z.string().nullable(),
   pathAhead: z.boolean(),
   timerLoaded: z.boolean(),
 });
@@ -48,11 +47,10 @@ export function installSupervisor(): InstallOutcome {
   // the `xx` short alias → tokenmaxxing
   writeFileAtomic(join(paths.binDir, "xx"), `#!/bin/sh\nexec ${JSON.stringify(target)} "$@"\n`, 0o755);
 
-  const { priorStatusLine } = installSettings();
+  installSettings();
   return {
     claudeWrapper: paths.supervisorLink,
     installedBin: target,
-    priorStatusLine,
     pathAhead: isBinDirAhead(),
     timerLoaded: installCheckTimer(),
   };

package/src/lib/keychain.ts

@@ -1,7 +1,7 @@
 // macOS login-keychain generic-password I/O, ps-safe. The darwin backend of
 // credstore.ts - construct targets there, not here.
 //   READ  : `security find-generic-password -w`  → secret only ever in stdout.
-//   WRITE : pipe an `add-generic-password -U … -w <secret>` line into `security -i`
+//   WRITE : pipe an `add-generic-password -U ... -w <secret>` line into `security -i`
 //           over STDIN - the secret never appears in any process's argv (verified).
 // The service/account are non-secret and may sit in argv.
 

package/src/lib/log.ts

@@ -11,7 +11,7 @@ export function redact(s: string): string {
   return s
     // JWT-ish / long opaque tokens
     .replace(/\b(sk-ant-[A-Za-z0-9._-]{6,})/g, "sk-ant-***")
-    .replace(/\b([A-Za-z0-9_-]{40,})\b/g, (m) => `${m.slice(0, 4)}…(${m.length})`);
+    .replace(/\b([A-Za-z0-9_-]{40,})\b/g, (m) => `${m.slice(0, 4)}...(${m.length})`);
 }
 
 export function log(event: string, fields: Record<string, unknown> = {}): void {

package/src/lib/picker.ts

@@ -1,10 +1,11 @@
-// Choose the best account to switch TO when the active one crosses threshold.
-// Policy: exclude the current account and any that need reauth or are still
-// rate-limited (usage >= threshold and not yet past resets_at). Among the rest,
-// prefer the account whose weekly window expires soonest: weekly limits reset
-// at a fixed per-account time and unused allowance is forfeited at reset, so
-// quota nearest its reset is use-it-or-lose-it and should be drained first.
-// Tiebreak on lowest 7-day usage, then soonest 5h reset.
+// Choose the account to switch TO. Greedy policy: among usable accounts (no
+// reauth, no window >= threshold that hasn't reset yet), take the one whose
+// weekly window expires soonest - weekly limits reset at a fixed per-account
+// time and unused allowance is forfeited at reset, so quota nearest its reset
+// is use-it-or-lose-it and should be drained first. Runs entirely off each
+// account's cached windows (absolute UTC epochs, so a stale snapshot still
+// resolves to the correct upcoming reset), which makes the pick deterministic
+// and idempotent: re-running lands on the same account.
 
 import { minBy, sortBy } from "es-toolkit";
 import { z } from "zod";
@@ -13,6 +14,7 @@ import { AccountSchema, type Account } from "./types.ts";
 const PickCtxSchema = z.object({
   now: z.number(),
   threshold: z.number(),
+  /** account to exclude (hooks switch AWAY from it); null ranks everyone. */
   currentAccountUuid: z.string().nullable(),
 });
 export type PickCtx = z.infer<typeof PickCtxSchema>;
@@ -28,31 +30,33 @@ export function isExhausted(a: Account, ctx: PickCtx): boolean {
 
 const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
 
-/** Epoch ms when the account's weekly quota is next forfeited. The weekly reset
- *  is a fixed per-account anchor, so a stale (past) resetsAt extrapolates
- *  forward in 7-day steps; an account with no sampled reset sorts last. */
+/** Next occurrence of a weekly reset. The weekly reset is a fixed per-account
+ *  anchor, so a cached (past) resetsAt extrapolates forward in 7-day steps -
+ *  an old snapshot still yields the correct upcoming reset. */
+export function nextWeeklyReset(resetsAt: number | null, now: number): number | null {
+  if (resetsAt == null || resetsAt > now) return resetsAt;
+  return resetsAt + (Math.floor((now - resetsAt) / WEEK_MS) + 1) * WEEK_MS;
+}
+
+/** Epoch ms when the account's weekly quota is next forfeited; an account with
+ *  no sampled reset sorts last. */
 export function weeklyExpiry(a: Account, now: number): number {
-  const r = a.lastUsage?.sevenDay.resetsAt;
-  if (r == null) return Number.POSITIVE_INFINITY;
-  if (r > now) return r;
-  return r + (Math.floor((now - r) / WEEK_MS) + 1) * WEEK_MS;
+  return nextWeeklyReset(a.lastUsage?.sevenDay.resetsAt ?? null, now) ?? Number.POSITIVE_INFINITY;
 }
 
+/** The switch preference: soonest weekly expiry first, tiebreak lowest 7-day
+ *  usage. Shared with the statusLine pool ordering so the display order IS the
+ *  swap order. */
+export const swapPreference = (now: number) => [
+  (a: Account) => weeklyExpiry(a, now),
+  (a: Account) => a.lastUsage?.sevenDay.usedPercentage ?? 0,
+];
+
 export function pickBest(accounts: Account[], ctx: PickCtx): Account | null {
-  const candidates = accounts.filter(
-    (a) =>
-      a.accountUuid !== ctx.currentAccountUuid &&
-      !a.needsReauth &&
-      !isExhausted(a, ctx),
+  const usable = accounts.filter(
+    (a) => a.accountUuid !== ctx.currentAccountUuid && !a.needsReauth && !isExhausted(a, ctx),
   );
-  if (candidates.length === 0) return null;
-
-  // soonest weekly expiry first; tiebreak lowest 7-day usage, then soonest 5h reset.
-  return sortBy(candidates, [
-    (a) => weeklyExpiry(a, ctx.now),
-    (a) => a.lastUsage?.sevenDay.usedPercentage ?? 0,
-    (a) => a.lastUsage?.fiveHour.resetsAt ?? Number.POSITIVE_INFINITY,
-  ])[0]!;
+  return sortBy(usable, swapPreference(ctx.now))[0] ?? null;
 }
 
 /** When an account becomes usable again: the latest reset among its over-threshold

package/src/lib/settings.ts

@@ -1,6 +1,7 @@
 // Idempotent merge of tokenmaxxing's three entries into the user-owned
-// ~/.claude/settings.json: a statusLine shim, a Stop hook, a SessionStart hook.
-// We APPEND to existing hook arrays and WRAP the existing statusLine - never clobber.
+// ~/.claude/settings.json: our statusLine, a Stop hook, a SessionStart hook.
+// Hooks APPEND to existing arrays; the statusLine slot is ours outright -
+// tokenmaxxing renders it natively, so any other statusLine command is replaced.
 
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -23,8 +24,6 @@ const SettingsSchema = z.looseObject({
 type Settings = z.infer<typeof SettingsSchema>;
 type HookGroup = z.infer<typeof HookGroupSchema>;
 
-const PRIOR_STATUSLINE_FILE = join(paths.home, "prior-statusline.json");
-
 const SUBCMD = {
   statusline: "__statusline",
   stop: "__stop-hook",
@@ -71,57 +70,27 @@ function removeHook(s: Settings, event: string, sub: string): void {
   if (s.hooks![event]!.length === 0) delete s.hooks![event];
 }
 
-const InstallResultSchema = z.object({ priorStatusLine: z.string().nullable() });
-export type InstallResult = z.infer<typeof InstallResultSchema>;
-
-/**
- * Install the three entries. Returns the prior statusLine command that was
- * wrapped (stored to disk so the shim can chain to it and uninstall can restore).
- */
-export function installSettings(): InstallResult {
+/** Install the three entries: take the statusLine slot, append our hooks. */
+export function installSettings(): void {
   const s = readSettings();
-
-  // ---- statusLine: capture prior (unless it's already ours), then wrap.
-  let prior: string | null;
-  if (s.statusLine && !isOurCommand(s.statusLine.command)) {
-    prior = s.statusLine.command;
-    writeFileAtomic(PRIOR_STATUSLINE_FILE, JSON.stringify({ command: prior }) + "\n", 0o644);
-  } else {
-    prior = readPriorStatusLine();
-  }
   s.statusLine = {
     type: "command",
     command: `${JSON.stringify(installedBin())} ${SUBCMD.statusline}`,
   };
-
-  // ---- hooks: append ours if absent.
   appendHook(s, "Stop", SUBCMD.stop);
   appendHook(s, "SessionStart", SUBCMD.sessionStart);
-
   writeSettings(s);
-  return { priorStatusLine: prior };
 }
 
-/** Remove our three entries and restore the prior statusLine if we have it. */
+/** Remove our three entries. The statusLine slot is deleted only if it is ours. */
 export function uninstallSettings(): void {
   const s = readSettings();
   removeHook(s, "Stop", SUBCMD.stop);
   removeHook(s, "SessionStart", SUBCMD.sessionStart);
-  if (s.statusLine && isOurCommand(s.statusLine.command)) {
-    const prior = readPriorStatusLine();
-    if (prior) s.statusLine = { type: "command", command: prior };
-    else delete s.statusLine;
-  }
+  if (s.statusLine && isOurCommand(s.statusLine.command)) delete s.statusLine;
   writeSettings(s);
 }
 
-const PriorStatusLineSchema = z.object({ command: z.string() });
-
-export function readPriorStatusLine(): string | null {
-  if (!existsSync(PRIOR_STATUSLINE_FILE)) return null;
-  return PriorStatusLineSchema.parse(JSON.parse(readFileSync(PRIOR_STATUSLINE_FILE, "utf8"))).command;
-}
-
 const SettingsCheckSchema = z.object({
   statusLineOk: z.boolean(),
   stopOk: z.boolean(),

package/src/lib/state.ts

@@ -22,7 +22,9 @@ import {
 const DEFAULT_CONFIG: Config = {
   threshold: 95,
   claudeBin: "",
-  policy: { projectionMargin: 0, switchModels: ["fable", "opus"], usagePollTtlMs: 90_000, maxWaitMs: 3_600_000 },
+  // per-model weekly caps exist only for Sonnet and Fable (no Opus-only quota,
+  // per the user 2026-07-12), and only Fable's is worth switching on.
+  policy: { projectionMargin: 0, switchModels: ["fable"], usagePollTtlMs: 90_000, maxWaitMs: 3_600_000 },
 };
 
 /** On-disk shape (all optional); validated via Zod, merged over defaults. */
@@ -124,10 +126,15 @@ export function saveLastSwapAt(ts: number): void {
   writeFileAtomic(paths.lastSwapJson, JSON.stringify(LastSwapSchema.parse({ ts })));
 }
 
-/** Write-on-change: skip the write (and its fsync) when only `ts` would differ. */
+/** An alive feed re-proving unchanged figures still refreshes `ts` this often,
+ *  so cache-age displays stay honest without a write+fsync per tick. */
+const USAGE_TS_REFRESH_MS = 10 * 60_000;
+
+/** Write-on-change: skip the write (and its fsync) when only `ts` would differ,
+ *  unless the stored `ts` has aged past the refresh window. */
 export function writeUsage(next: UsageState): boolean {
   const prev = loadUsage();
-  if (prev && isEqual({ ...prev, ts: 0 }, { ...next, ts: 0 })) return false;
+  if (prev && isEqual({ ...prev, ts: 0 }, { ...next, ts: 0 }) && next.ts - prev.ts < USAGE_TS_REFRESH_MS) return false;
   writeFileAtomic(paths.usageJson, JSON.stringify(next));
   return true;
 }

package/src/lib/types.ts

@@ -84,6 +84,10 @@ export const AccountSchema = z.object({
   addedAt: z.string(),
   lastUsage: UsageWindowsSchema.optional(),
   lastPerModel: z.record(z.string(), UsageWindowSchema).optional(),
+  /** epoch ms of the sample behind lastUsage/lastPerModel. Their resetsAt
+   *  values are absolute epochs (UTC-anchored), so even an old snapshot still
+   *  resolves to correct resets - display it as a dated cache, never discard. */
+  lastUsageAt: z.number().optional(),
   needsReauth: z.boolean().optional(),
   subscriptionType: z.string().optional(),
 });
@@ -137,6 +141,32 @@ export const RateLimitsStdinSchema = z.looseObject({
   organizationUuid: z.string().optional(),
 });
 
+/** The statusLine stdin fields the native renderer consumes, on top of the
+ *  rate-limit tee's needs. Loose + optional throughout: fields are null before
+ *  the first API response and claude adds new ones freely. Each sub-object also
+ *  `.catch(undefined)`es so a field that drifts to a wrong shape degrades to
+ *  absent instead of failing the whole parse and erasing the info block. */
+export const StatusLineStdinSchema = RateLimitsStdinSchema.extend({
+  workspace: z
+    .looseObject({
+      current_dir: z.string().nullable().optional(),
+      project_dir: z.string().nullable().optional(),
+    })
+    .nullable()
+    .optional()
+    .catch(undefined),
+  context_window: z.looseObject({ used_percentage: z.number().nullable().optional() }).nullable().optional().catch(undefined),
+  cost: z
+    .looseObject({
+      total_lines_added: z.number().nullable().optional(),
+      total_lines_removed: z.number().nullable().optional(),
+    })
+    .nullable()
+    .optional()
+    .catch(undefined),
+  effort: z.looseObject({ level: z.string().optional() }).nullable().optional().catch(undefined),
+});
+
 /** Success body of the OAuth refresh grant. */
 export const RefreshResponseSchema = z.looseObject({
   access_token: z.string(),

package/src/lib/usage.ts

@@ -49,6 +49,24 @@ export function parseStatusLineModel(obj: unknown): ModelInfo | null {
   return { id: m?.id ?? m?.display_name ?? "", display: m?.display_name ?? m?.id ?? "" };
 }
 
+/** Lowercased word tokens of a model id or display string: "claude-opus-4-8" /
+ *  "Opus 4.8" -> ["claude","opus","4","8"] / ["opus","4","8"]. Model naming
+ *  drifts per release ("Fable" became "Fable 5" in 2.1.206, and id grammar has
+ *  historically flipped between family-first and version-first), so gates match
+ *  a family token anywhere instead of an exact string - an exact-string gate
+ *  silently disabled the per-model check in the 2026-07-09/10 incidents. */
+export function familyTokens(s: string): string[] {
+  return s.trim().toLowerCase().split(/[\s.-]+/).filter((t) => t.length > 0);
+}
+
+/** The switchModels family the active model belongs to, from its id OR display
+ *  tokens; null when the model is not capacity-constrained. */
+export function matchedFamily(model: ModelInfo | null, families: string[]): string | null {
+  if (!model) return null;
+  const tokens = new Set([...familyTokens(model.id), ...familyTokens(model.display)]);
+  return families.find((f) => tokens.has(f)) ?? null;
+}
+
 export const FullUsageSchema = z.object({
   session: UsageWindowSchema,
   weekAll: UsageWindowSchema,
@@ -122,8 +140,8 @@ export function parseResetClock(clock: string, now = Date.now()): number | null
 /**
  * Parse `claude -p '/usage'` .result text into all three limit kinds:
  *   Current session: N% used · resets <clock>      → session (5h)
- *   Current week (all models): N% used · resets …   → weekAll (7d aggregate)
- *   Current week (<Model>): N% used · resets …      → perModel[<Model>]
+ *   Current week (all models): N% used · resets ...   → weekAll (7d aggregate)
+ *   Current week (<Model>): N% used · resets ...      → perModel[<Model>]
  */
 export function parseUsageTextFull(text: string, now = Date.now()): FullUsage | null {
   if (!text) return null;
@@ -177,6 +195,11 @@ const CRED_ENV_OVERRIDES = [
 /** One `claude -p '/usage'` invocation → parsed usage, or null if it produced no
  *  limit lines (claude prints only a local-stats footer when its own usage fetch
  *  errors/throttles) or failed to run. */
+/** A probe child that wedges (auth prompt, dead endpoint) must never block the
+ *  Stop/SessionStart hooks or the status flock forever; a healthy `/usage`
+ *  answers in seconds. */
+const PROBE_KILL_MS = 60_000;
+
 async function probeUsageOnce(env: Record<string, string>, now: number): Promise<FullUsage | null> {
   let out: string;
   try {
@@ -185,12 +208,17 @@ async function probeUsageOnce(env: Record<string, string>, now: number): Promise
       stdout: "pipe",
       stderr: "pipe",
     });
-    out = await new Response(p.stdout).text();
-    const errText = await new Response(p.stderr).text();
-    await p.exited;
-    if (p.exitCode !== 0) {
-      log("usage.probe_failed", { exit: p.exitCode ?? "signal", stderr: errText.trim().slice(0, 200) });
-      return null;
+    const killer = setTimeout(() => p.kill(), PROBE_KILL_MS);
+    try {
+      out = await new Response(p.stdout).text();
+      const errText = await new Response(p.stderr).text();
+      await p.exited;
+      if (p.exitCode !== 0) {
+        log("usage.probe_failed", { exit: p.exitCode ?? "signal", stderr: errText.trim().slice(0, 200) });
+        return null;
+      }
+    } finally {
+      clearTimeout(killer);
     }
   } catch (e) {
     log("usage.probe_failed", { err: String((e as Error).message ?? e) });

package/src/lib/worktree.ts

@@ -0,0 +1,22 @@
+// Linked-worktree detection for the statusLine. A linked worktree's root holds
+// a .git FILE (a gitdir pointer) where the main checkout has a .git directory.
+// Read the filesystem directly - never a git subprocess.
+
+import { statSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+
+/** The worktree root's basename when `dir` is inside a LINKED git worktree;
+ *  null in a main checkout or outside any repository. Any fs error while
+ *  walking (EACCES, ENOTDIR, stale mounts) is also null: the status line must
+ *  never break over an unreadable path. */
+export function worktreeName(dir: string): string | null {
+  try {
+    for (let cur = dir; ; cur = dirname(cur)) {
+      const st = statSync(join(cur, ".git"), { throwIfNoEntry: false });
+      if (st) return st.isFile() ? basename(cur) : null;
+      if (dirname(cur) === cur) return null;
+    }
+  } catch {
+    return null;
+  }
+}

package/src/main.ts

@@ -24,7 +24,7 @@ function printHelp(): void {
   console.log(`${c.bold("tokenmaxxing")} - automatic Claude Code account switching
 
   ${c.cyan("tokenmaxxing")}            show the pool with usage bars (alias of ${c.cyan("status")})
-  ${c.cyan("tokenmaxxing switch")} [sel]  switch now to the best (or a specific) account
+  ${c.cyan("tokenmaxxing switch")} [sel]  switch to the best (or a specific) account; no-op when already on it
   ${c.cyan("tokenmaxxing check")}      evaluate once, switch if over threshold (run by the periodic timer)
   ${c.cyan("tokenmaxxing init")}       import the current account + install supervisor & hooks
   ${c.cyan("tokenmaxxing add")}        register an additional account (isolated login)