tokenmaxxing 1.128.0 → 1.130.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.128.0",
+  "version": "1.130.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts, start each session on its own account, and resume a session on a fresher account when quota fills.",
   "type": "module",
   "license": "MIT",

package/src/entries/codexsupervisor.ts

@@ -7,7 +7,7 @@ import { codexPaths, codexPool } from "../lib/paths.ts";
 import { withLock } from "../lib/lock.ts";
 import { CODEX_BIN, UNMANAGED_ENV, WRAP_DEPTH_ENV, resolveRealBin, wrapDepth } from "../lib/claudebin.ts";
 import { codexStoreUsable, ensureCodexStoreHome } from "../lib/codexauth.ts";
-import { CODEX_SUPERVISOR_ID_ENV, borrowCodexSeat, codexPickCtx, pickCodexSeat } from "../lib/codex.ts";
+import { CODEX_CRED_ENV, CODEX_SUPERVISOR_ID_ENV, borrowCodexSeat, codexPickCtx, pickCodexSeat } from "../lib/codex.ts";
 import { clearPresence, livingPresences } from "../lib/presence.ts";
 import { isExhausted } from "../lib/picker.ts";
 import { exitStatus, loopGuardTripped, raceMarkerOrExit, recordPresenceOrStop, runPassthrough } from "../lib/supervise.ts";
@@ -100,12 +100,11 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
     });
     const granted = borrowsCodexSeat({ argv }) ? await borrowCodexSeat(process.pid) : undefined;
     const seat = granted && !("denied" in granted) ? granted : null;
-    if (seat) passthroughEnv.CODEX_HOME = seat.store;
-    else if (granted !== undefined) log("codexsupervisor.borrow_none", { reason: granted && "denied" in granted ? granted.denied : "no usable account" });
+    if (!seat && granted !== undefined) log("codexsupervisor.borrow_none", { reason: granted && "denied" in granted ? granted.denied : "no usable account" });
     return runPassthrough({
       real,
       argv,
-      env: passthroughEnv,
+      env: seat ? { ...omit(passthroughEnv, CODEX_CRED_ENV), CODEX_HOME: seat.store } : passthroughEnv,
       onSpawn: (p) => {
         child = p;
         return seat
@@ -148,7 +147,7 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
         stdout: "inherit",
         stderr: "inherit",
         env: {
-          ...childEnv,
+          ...(store ? omit(childEnv, CODEX_CRED_ENV) : childEnv),
           [CODEX_SUPERVISOR_ID_ENV]: supervisorId,
           ...(store ? { CODEX_HOME: store } : {}),
         },

package/src/lib/codex.ts

@@ -21,6 +21,7 @@ import type { Account, CodexAuthJson, CodexUsage, Config } from "./types.ts";
 import { c } from "../cli/render.ts";
 
 export const CODEX_SUPERVISOR_ID_ENV = "TOKENMAXXING_CODEX_SUPERVISOR_ID";
+export const CODEX_CRED_ENV = ["CODEX_ACCESS_TOKEN", "CODEX_API_KEY"] as const;
 
 function liveId(): string | null {
   return codexSeatFromEnv(loadAccounts(codexPool).accounts.map((a) => a.id));

package/src/lib/install.ts

@@ -5,6 +5,7 @@ import { escape } from "es-toolkit";
 import { z } from "zod";
 import { codexPaths, codexStoreDirFor, HOME, optionalEnv, paths } from "./paths.ts";
 import { writeFileAtomic } from "./atomic.ts";
+import { shellQuote } from "./proc.ts";
 import { installedBin, installSettings, isOurHookCommand, uninstallSettings } from "./settings.ts";
 import { CLAUDE_BIN, resolveRealBin } from "./claudebin.ts";
 import { loadConfig, readJsonFile, type BinKey } from "./state.ts";
@@ -84,7 +85,7 @@ export PATH
 if command -v tokenmaxxing >/dev/null 2>&1; then
   exec tokenmaxxing "$@"
 fi
-exec ${JSON.stringify(bun)} --no-env-file run ${JSON.stringify(entry)} "$@"
+exec ${shellQuote(bun)} --no-env-file run ${shellQuote(entry)} "$@"
 `;
 }
 
@@ -94,15 +95,15 @@ function installEntryPoints(): string {
   if (isNixPackaged()) {
     writeFileAtomic(target, nixSupervisorShim(process.execPath, entry), 0o755);
   } else {
-    writeFileAtomic(target, `#!/bin/sh\nexec ${JSON.stringify(process.execPath)} --no-env-file run ${JSON.stringify(entry)} "$@"\n`, 0o755);
+    writeFileAtomic(target, `#!/bin/sh\nexec ${shellQuote(process.execPath)} --no-env-file run ${shellQuote(entry)} "$@"\n`, 0o755);
   }
-  writeFileAtomic(join(paths.binDir, "xx"), `#!/bin/sh\nexec ${JSON.stringify(target)} "$@"\n`, 0o755);
+  writeFileAtomic(join(paths.binDir, "xx"), `#!/bin/sh\nexec ${shellQuote(target)} "$@"\n`, 0o755);
   return target;
 }
 
 export function installSupervisor(): InstallOutcome {
   const target = installEntryPoints();
-  writeFileAtomic(paths.supervisorLink, `#!/bin/sh\nexec ${JSON.stringify(target)} __supervise "$@"\n`, 0o755);
+  writeFileAtomic(paths.supervisorLink, `#!/bin/sh\nexec ${shellQuote(target)} __supervise "$@"\n`, 0o755);
 
   installSettings();
   const checkIntervalS = Math.ceil(loadConfig().policy.checkIntervalMs / 1000);
@@ -127,7 +128,7 @@ const CodexHooksFileSchema = z.looseObject({
 const CODEX_STOP_HOOK_SUBCOMMAND = "__codex-stop-hook";
 
 function codexStopHookCommand(): string {
-  return `${JSON.stringify(installedBin())} ${CODEX_STOP_HOOK_SUBCOMMAND}`;
+  return `${shellQuote(installedBin())} ${CODEX_STOP_HOOK_SUBCOMMAND}`;
 }
 
 function withoutOurCodexStopHooks(groups: { hooks: { type?: string; command?: string }[] }[]): typeof groups {
@@ -200,7 +201,7 @@ export function codexSupervisorLink(): string {
 }
 
 export function installCodexSupervisor(): void {
-  writeFileAtomic(codexSupervisorLink(), `#!/bin/sh\nexec ${JSON.stringify(installEntryPoints())} __supervise-codex "$@"\n`, 0o755);
+  writeFileAtomic(codexSupervisorLink(), `#!/bin/sh\nexec ${shellQuote(installEntryPoints())} __supervise-codex "$@"\n`, 0o755);
   installCodexStopHook();
 }
 
@@ -214,7 +215,7 @@ export function piSupervisorLink(): string {
 }
 
 export function installPiSupervisor(): void {
-  writeFileAtomic(piSupervisorLink(), `#!/bin/sh\nexec ${JSON.stringify(installEntryPoints())} __supervise-pi "$@"\n`, 0o755);
+  writeFileAtomic(piSupervisorLink(), `#!/bin/sh\nexec ${shellQuote(installEntryPoints())} __supervise-pi "$@"\n`, 0o755);
 }
 
 export type UnitJob = {

package/src/lib/proc.ts

@@ -1,6 +1,10 @@
 import { basename } from "node:path";
 import { ErrnoSchema } from "./types.ts";
 
+export function shellQuote(s: string): string {
+  return `'${s.replaceAll("'", "'\\''")}'`;
+}
+
 const SHELLS = new Set(["sh", "bash", "dash", "zsh", "ksh", "fish"]);
 const MAX_SHELL_HOPS = 4;
 

package/src/lib/settings.ts

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { paths } from "./paths.ts";
 import { writeFileAtomic } from "./atomic.ts";
 import { readJsonFile } from "./state.ts";
+import { shellQuote } from "./proc.ts";
 import { JsonTextSchema } from "./types.ts";
 import { ENFORCED_ERRORS } from "./usage.ts";
 
@@ -55,7 +56,7 @@ function isOurCommand(cmd: string | undefined): boolean {
 }
 
 function ourCommand(sub: string): string {
-  return `${JSON.stringify(installedBin())} ${sub}`;
+  return `${shellQuote(installedBin())} ${sub}`;
 }
 
 function ourHookGroup(sub: string, matcher?: string): HookGroup {
@@ -73,9 +74,13 @@ function appendHook(s: Settings, event: string, sub: string, matcher?: string):
 export function isOurHookCommand(cmd: string, sub: string): boolean {
   if (!cmd.endsWith(` ${sub}`)) return false;
   const quotedPath = cmd.slice(0, cmd.length - (sub.length + 1));
-  if (!quotedPath.startsWith('"') || !quotedPath.endsWith('"')) return false;
-  const parsed = z.string().safeParse(JsonTextSchema.safeParse(quotedPath).data);
-  return parsed.success && parsed.data.endsWith("/tokenmaxxing");
+  const unquoted = quotedPath.slice(1, -1).replaceAll("'\\''", "'");
+  const path = quotedPath.startsWith("'")
+    ? shellQuote(unquoted) === quotedPath
+      ? unquoted
+      : undefined
+    : z.string().safeParse(JsonTextSchema.safeParse(quotedPath).data).data;
+  return path?.endsWith("/tokenmaxxing") === true;
 }
 
 function removeHook(s: Settings, event: string, sub: string): void {