tokenmaxxing 1.0.0 → 1.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",

package/src/cli/codexadd.ts

@@ -1,8 +1,11 @@
 // `tokenmaxxing add --codex` - register an ADDITIONAL codex account. Runs
-// `codex login` inside a throwaway CODEX_HOME pinned to file-mode credential
-// storage (auto mode would keyring-namespace the login on macOS and leave
-// nothing harvestable), then parks the resulting auth.json under the token's
-// OWN identity and indexes it. The primary login is never touched.
+// `codex login --device-auth` inside a throwaway CODEX_HOME pinned to
+// file-mode credential storage (auto mode would keyring-namespace the login on
+// macOS and leave nothing harvestable), then parks the resulting auth.json
+// under the token's OWN identity and indexes it. The primary login is never
+// touched. Device auth is the default (user decision 2026-07-20): the browser
+// flow binds localhost on the machine running the command, so it dead-ends
+// over ssh; the device code works from any browser.
 
 import { mkdirSync, rmSync } from "node:fs";
 import { join } from "node:path";
@@ -31,11 +34,11 @@ export async function cmdCodexAdd(): Promise<number> {
   writeFileAtomic(join(onboardDir, "config.toml"), 'cli_auth_credentials_store = "file"\n');
 
   console.log(c.cyan("Opening an isolated codex login - your primary login is untouched."));
-  console.log(c.dim("Complete the browser sign-in with the account to add; the command exits once you're in."));
+  console.log(c.dim("Open the URL codex prints, enter the code, and sign in with the account to add; the command exits once you're in."));
   console.log();
 
   const savedTermios = saveTermios();
-  const p = Bun.spawn([real, "login"], {
+  const p = Bun.spawn([real, "login", "--device-auth"], {
     stdin: "inherit",
     stdout: "inherit",
     stderr: "inherit",

package/src/cli/serve.ts

@@ -54,14 +54,18 @@ const SERVE_USAGE = "usage: tokenmaxxing serve [setup | link <channel-id> <repo>
  *  Scopes/events verified against docs.slack.dev 2026-07-18: a channel-thread
  *  relay plus Slack's Agent messaging experience (agent_view + assistant:write
  *  power the DM assistant surface and typing status; channel-thread streaming
- *  works without them, verified live). Changing scopes on an existing app
- *  requires reinstalling it to the workspace. */
+ *  works without them, verified live). agent_view is an OBJECT whose required
+ *  field is agent_description (max 300 chars; docs.slack.dev app-manifest
+ *  reference, re-verified 2026-07-20) - a bare `agent_view: true` is rejected
+ *  with "Must provide an object". Changing scopes on an existing app requires
+ *  reinstalling it to the workspace. */
 const APP_MANIFEST = `display_information:
   name: tokenmaxxing
   description: bridges Slack threads to Claude Code sessions
 
 features:
-  agent_view: true
+  agent_view:
+    agent_description: bridges Slack threads to Claude Code sessions
   bot_user:
     display_name: tokenmaxxing
     always_online: true