tokenmaxxing 1.131.0 → 1.133.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.131.0",
+  "version": "1.133.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts, start each session on its own account, and resume a session on a fresher account when quota fills.",
   "type": "module",
   "license": "MIT",

package/src/cli/key.ts

@@ -0,0 +1,147 @@
+import { z } from "zod";
+import { keySessions, loadApiKeys, removeApiKeySecret, saveApiKeys, writeApiKeySecret } from "../lib/apikeys.ts";
+import { withLock } from "../lib/lock.ts";
+import { claudePool } from "../lib/paths.ts";
+import { readStdin } from "../lib/proc.ts";
+import type { ApiKey } from "../lib/types.ts";
+import { c, emitError, plain } from "./render.ts";
+
+const USAGE = "usage: tokenmaxxing key add <label> [credit-usd] [workspace-id] (the key on stdin) | key credit <label> <usd> | key rm <label>";
+
+const UsdSchema = z.coerce.number().finite().min(0);
+
+const WorkspaceIdSchema = z
+  .string()
+  .min(1)
+  .refine((id) => id.trim() === id && !id.includes("\n") && !id.includes("\r"), "a workspace id is one line with no surrounding whitespace");
+
+export function usd(amount: number): string {
+  return `$${amount.toFixed(2)}`;
+}
+
+function findKey(keys: ApiKey[], label: string): ApiKey | undefined {
+  return keys.find((k) => k.label.toLowerCase() === label.toLowerCase());
+}
+
+function parseUsd(raw: string): number | null {
+  const parsed = UsdSchema.safeParse(raw);
+  if (parsed.success) return parsed.data;
+  emitError({ message: `"${raw}" is not a dollar amount (a number at or above 0)` });
+  return null;
+}
+
+async function add(args: string[]): Promise<number> {
+  const [label, creditRaw, workspaceRaw] = args;
+  if (!label) {
+    emitError({ message: USAGE, paint: plain });
+    return 2;
+  }
+  const credit = creditRaw == null ? undefined : parseUsd(creditRaw);
+  if (credit === null) return 2;
+  const workspace = workspaceRaw == null ? undefined : WorkspaceIdSchema.safeParse(workspaceRaw);
+  if (workspace != null && !workspace.success) {
+    emitError({ message: `"${workspaceRaw}" is not a workspace id: ${workspace.error.issues[0]?.message ?? "invalid"}` });
+    return 2;
+  }
+  const workspaceId = workspace?.data;
+  if (process.stdin.isTTY) {
+    emitError({ message: "refusing to read the API key from a terminal, which would echo it - pipe it in: read -rs KEY && printf '%s' \"$KEY\" | tokenmaxxing key add <label> ...; unset KEY" });
+    return 2;
+  }
+  const secret = (await readStdin()).trim();
+  if (secret === "") {
+    emitError({ message: "no API key on stdin - pipe the key in, for example from your password manager" });
+    return 2;
+  }
+  if (secret.includes("\n") || secret.includes("\r")) {
+    emitError({ message: "stdin holds more than one line - pass one API key per `key add`" });
+    return 2;
+  }
+  if (secret.startsWith("sk-ant-admin")) {
+    emitError({ message: "that is an Admin API key, which cannot run inference - create a regular API key in the Console" });
+    return 2;
+  }
+  return withLock(claudePool.lockFile, () => {
+    const idx = loadApiKeys();
+    const taken = findKey(idx.keys, label);
+    if (taken) {
+      emitError({ message: `label "${label}" is already used by another API key - labels must be unique` });
+      return 1;
+    }
+    let id = crypto.randomUUID().slice(0, 8);
+    while (idx.keys.some((k) => k.id === id)) id = crypto.randomUUID().slice(0, 8);
+    const now = Date.now();
+    writeApiKeySecret(id, secret);
+    idx.keys.push({
+      id,
+      label,
+      ...(workspaceId != null ? { workspaceId } : {}),
+      ...(credit != null ? { creditUsd: credit } : {}),
+      spentUsd: 0,
+      creditSetAt: now,
+      addedAt: now,
+    });
+    saveApiKeys(idx);
+    console.log(`added API key ${c.bold(label)} (${credit != null ? `credit ${usd(credit)}` : "credit unknown, ranks after keys with a balance"}${workspaceId != null ? `, workspace ${workspaceId}` : ""})`);
+    return 0;
+  });
+}
+
+async function credit(args: string[]): Promise<number> {
+  const [label, amountRaw] = args;
+  if (!label || amountRaw == null || args.length > 2) {
+    emitError({ message: USAGE, paint: plain });
+    return 2;
+  }
+  const amount = parseUsd(amountRaw);
+  if (amount === null) return 2;
+  return withLock(claudePool.lockFile, () => {
+    const idx = loadApiKeys();
+    const key = findKey(idx.keys, label);
+    if (!key) {
+      emitError({ message: `no API key is labeled "${label}"` });
+      return 1;
+    }
+    key.creditUsd = amount;
+    key.spentUsd = 0;
+    key.creditSetAt = Date.now();
+    key.refusedAt = undefined;
+    saveApiKeys(idx);
+    console.log(`set ${c.bold(key.label)} credit to ${usd(amount)}`);
+    return 0;
+  });
+}
+
+async function rm(args: string[]): Promise<number> {
+  const [label] = args;
+  if (!label || args.length > 1) {
+    emitError({ message: USAGE, paint: plain });
+    return 2;
+  }
+  return withLock(claudePool.lockFile, () => {
+    const idx = loadApiKeys();
+    const key = findKey(idx.keys, label);
+    if (!key) {
+      emitError({ message: `no API key is labeled "${label}"` });
+      return 1;
+    }
+    if (keySessions().has(key.id)) {
+      emitError({ message: `${key.label} is running in a live session - close that session before removing the key.` });
+      return 1;
+    }
+    removeApiKeySecret(key.id);
+    idx.keys = idx.keys.filter((k) => k.id !== key.id);
+    saveApiKeys(idx);
+    console.log(`removed API key ${c.bold(key.label)} (${idx.keys.length} left)`);
+    return 0;
+  });
+}
+
+export async function cmdKey(args: string[]): Promise<number> {
+  const [action, ...rest] = args;
+  if (action === "add") return add(rest);
+  if (action === "credit") return credit(rest);
+  if (action === "rm") return rm(rest);
+  emitError({ message: USAGE, paint: plain });
+  return 2;
+}

package/src/cli/status.ts

@@ -1,4 +1,5 @@
 import { chunk, sortBy } from "es-toolkit";
+import { creditLeft, keySessions, loadApiKeys } from "../lib/apikeys.ts";
 import { claude } from "../lib/claude.ts";
 import { codex } from "../lib/codex.ts";
 import { grok } from "../lib/grok.ts";
@@ -7,6 +8,7 @@ import { withLock } from "../lib/lock.ts";
 import { codexPool, grokPool } from "../lib/paths.ts";
 import { barFor, bufferedUsed, earliestReset, gatedWindows, landGrant, landWindows, isExhausted, isSessionWindow, limitWindows, liveUsed, nextWeeklyReset, sessionWindow, thresholdBars, weeklyWindow } from "../lib/picker.ts";
 import type { Provider, SampleReport } from "../lib/provider.ts";
+import { usd } from "./key.ts";
 import { bar, c, count, emitJson, fmtAgo } from "./render.ts";
 import type { Account, AccountThresholds, Bars, Config, Thresholds, Window } from "../lib/types.ts";
 
@@ -38,7 +40,48 @@ type PoolReport = {
   accounts: StatusAccount[];
 };
 
-export type StatusReport = { now: number; claude: PoolReport; codex: PoolReport; grok: PoolReport };
+type StatusApiKey = {
+  label: string;
+  id: string;
+  workspaceId: string | null;
+  creditUsd: number | null;
+  spentUsd: number;
+  creditLeftUsd: number | null;
+  refused: boolean;
+  refusedAt: number | null;
+  sessions: number;
+};
+
+export type StatusReport = { now: number; claude: PoolReport; codex: PoolReport; grok: PoolReport; apiKeys?: StatusApiKey[] };
+
+function apiKeyReport(): StatusApiKey[] {
+  const sessions = keySessions();
+  return loadApiKeys().keys.map((k) => ({
+    label: k.label,
+    id: k.id,
+    workspaceId: k.workspaceId ?? null,
+    creditUsd: k.creditUsd ?? null,
+    spentUsd: k.spentUsd,
+    creditLeftUsd: creditLeft(k),
+    refused: k.refusedAt != null,
+    refusedAt: k.refusedAt ?? null,
+    sessions: sessions.get(k.id) ?? 0,
+  }));
+}
+
+function renderApiKeys(keys: StatusApiKey[]): void {
+  console.log(c.dim(`api keys  (${count({ n: keys.length, noun: "key" })}, used only while every claude account is at its limit)`));
+  console.log();
+  for (const k of keys) {
+    const badges: string[] = [];
+    if (k.sessions > 0) badges.push(c.green(count({ n: k.sessions, noun: "session" })));
+    if (k.refused) badges.push(c.red("refused"));
+    else if (k.creditLeftUsd != null && k.creditLeftUsd <= 0) badges.push(c.yellow("spent"));
+    const credit = k.creditLeftUsd == null ? c.dim("credit unknown") : `credit left ${usd(k.creditLeftUsd)}`;
+    console.log(`${k.sessions > 0 ? c.green("●") : c.dim("○")} ${c.bold(k.label)} ${credit}${badges.length ? ` ${badges.join(" ")}` : ""}`);
+  }
+  console.log();
+}
 
 function currentWindow(a: Account, w: Window, bars: Bars | null, now: number): WindowReport {
   const passed = w.resetsAt != null && w.resetsAt <= now;
@@ -259,11 +302,12 @@ export async function cmdStatus(opts: { json?: boolean; cached?: boolean } = {})
   const cfg = loadConfig();
   const now = Date.now();
   const claudeReport = await collect(claude, cfg, now, cached);
+  const apiKeys = apiKeyReport();
   if (!json) {
     const codexPooled = loadAccounts(codexPool).accounts.length > 0;
     const grokPooled = loadAccounts(grokPool).accounts.length > 0;
     if (claudeReport.accounts.length === 0) {
-      if (!codexPooled && !grokPooled) {
+      if (!codexPooled && !grokPooled && apiKeys.length === 0) {
         console.log(c.dim("no accounts yet, run `tokenmaxxing init` (or `tokenmaxxing init --codex`, `--grok`)"));
         return 0;
       }
@@ -273,11 +317,12 @@ export async function cmdStatus(opts: { json?: boolean; cached?: boolean } = {})
       const header = `thresholds 5h ${claudeReport.thresholds.session}% weekly ${claudeReport.thresholds.weekly}%  bars 5h ${claudeReport.bars.session}% weekly ${claudeReport.bars.weekly}%  (${count({ n: claudeReport.accounts.length, noun: "claude account" })})`;
       renderPool(claude, claudeReport, header, Date.now(), cfg.policy.usagePollTtlMs);
     }
+    if (apiKeys.length > 0) renderApiKeys(apiKeys);
   }
   const codexReport = await collect(codex, cfg, now, cached);
   const grokReport = await collect(grok, cfg, now, cached);
   if (json) {
-    const report: StatusReport = { now, claude: claudeReport, codex: codexReport, grok: grokReport };
+    const report: StatusReport = { now, claude: claudeReport, codex: codexReport, grok: grokReport, ...(apiKeys.length > 0 ? { apiKeys } : {}) };
     emitJson({ ok: true, ...report });
     return 0;
   }

package/src/entries/codexsupervisor.ts

@@ -10,7 +10,7 @@ import { codexStoreUsable, ensureCodexStoreHome } from "../lib/codexauth.ts";
 import { CODEX_CRED_ENV, CODEX_SUPERVISOR_ID_ENV, borrowCodexSeat, codexPickCtx, pickCodexSeat } from "../lib/codex.ts";
 import { clearPresence, livingPresences } from "../lib/presence.ts";
 import { isExhausted } from "../lib/picker.ts";
-import { exitStatus, loopGuardTripped, raceMarkerOrExit, recordPresenceOrStop, runPassthrough } from "../lib/supervise.ts";
+import { childStdout, exitStatus, loopGuardTripped, raceMarkerOrExit, recordPresenceOrStop, relayStdout, runPassthrough } from "../lib/supervise.ts";
 import { saveTermios } from "../lib/tty.ts";
 import { loadAccounts, readJsonFile } from "../lib/state.ts";
 import { CodexRespawnMarkerSchema, type Account } from "../lib/types.ts";
@@ -137,14 +137,14 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
     if (existsSync(marker)) rmSync(marker, { force: true });
 
     const launchedAt = Date.now();
-    const { child, seat } = await withLock(codexPool.lockFile, async () => {
+    const { child, seat, drain } = await withLock(codexPool.lockFile, async () => {
       clearPresence({ dir: codexPaths.presenceDir, id: supervisorId });
       const picked = validWanted({ wanted, now: launchedAt, supervisorId }) ?? pickCodexSeat(launchedAt);
       log("codexsupervisor.launch", { supervisorId: supervisorId.slice(0, 8), respawns, seat: picked?.id.slice(0, 8) ?? null, args: launchArgs.join(" ") });
       const store = picked ? ensureCodexStoreHome(picked.id) : undefined;
       const spawned = Bun.spawn([real, ...launchArgs], {
         stdin: "inherit",
-        stdout: "inherit",
+        stdout: childStdout(),
         stderr: "inherit",
         env: {
           ...(store ? omit(childEnv, CODEX_CRED_ENV) : childEnv),
@@ -152,6 +152,7 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
           ...(store ? { CODEX_HOME: store } : {}),
         },
       });
+      const drain = spawned.stdout instanceof ReadableStream ? relayStdout(spawned.stdout) : null;
       if (picked) {
         await recordPresenceOrStop({
           child: spawned,
@@ -163,10 +164,10 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
           savedTermios,
         });
       }
-      return { child: spawned, seat: picked };
+      return { child: spawned, seat: picked, drain };
     });
     if (respawns > 0) {
-      process.stdout.write(`\n\x1b[36m↻ tokenmaxxing: switched codex to ${seat?.label ?? "the ambient codex login"} - resuming...\x1b[0m\n`);
+      process.stderr.write(`\n\x1b[36m↻ tokenmaxxing: switched codex to ${seat?.label ?? "the ambient codex login"} - resuming...\x1b[0m\n`);
     }
 
     await raceMarkerOrExit({
@@ -178,6 +179,7 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
       },
       savedTermios,
     });
+    await drain?.();
 
     const payload = existsSync(marker) ? readCodexMarker(marker) : null;
     if (payload) {

package/src/entries/statusline.ts

@@ -1,5 +1,8 @@
+import { existsSync } from "node:fs";
 import { sortBy } from "es-toolkit";
+import { writeSessionCost } from "../lib/apikeys.ts";
 import { claudePool, seatFromEnv } from "../lib/paths.ts";
+import { supervisedSession } from "../lib/sessions.ts";
 import { errorMessage } from "../lib/log.ts";
 import { loadAccounts, loadConfig, writeUsage } from "../lib/state.ts";
 import { familyTokens, matchedFamily, parseStatusLineStdin, parseStatusLineModel } from "../lib/usage.ts";
@@ -8,6 +11,7 @@ import { readStdin } from "../lib/proc.ts";
 import { worktreeName } from "../lib/worktree.ts";
 import { fmtResetShort, makeColors, makeUsagePaint, statuslineColor } from "../cli/render.ts";
 import {
+  CostLineSchema,
   JsonTextSchema,
   StatusLineStdinSchema,
   type Account,
@@ -127,6 +131,12 @@ export async function runStatusline(): Promise<number> {
     }
   } catch {
   }
+  try {
+    const session = existsSync(claudePool.apiKeysJson) ? supervisedSession() : null;
+    const cost = session == null ? null : (CostLineSchema.safeParse(obj).data ?? null);
+    if (session != null && cost != null && cost.sessionId === session.live) writeSessionCost(session.sid, cost);
+  } catch {
+  }
 
   let line: string;
   try {

package/src/entries/stopfailurehook.ts

@@ -2,9 +2,10 @@ import { existsSync, readdirSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 import { z } from "zod";
 import { claude } from "../lib/claude.ts";
-import { evaluateAndMaybeSwap } from "../lib/decide.ts";
+import { liveApiKeyId, refuseApiKey } from "../lib/apikeys.ts";
+import { evaluateAndMaybeSwap, moveTarget } from "../lib/decide.ts";
 import { readStdin } from "../lib/proc.ts";
-import { adoptLiveSession, refusedAccounts, supervisedSession, writeRespawnMarker } from "../lib/sessions.ts";
+import { adoptLiveSession, keyMovesSupported, refusedAccounts, supervisedSession, writeRespawnMarker } from "../lib/sessions.ts";
 import { loadConfig } from "../lib/state.ts";
 import { classifyEnforcedLimit, ENFORCED_ERRORS, findEnforcedRow, parseErrorBody, readTranscriptTail, type TranscriptRow } from "../lib/usage.ts";
 import { paths } from "../lib/paths.ts";
@@ -60,6 +61,22 @@ export async function runStopFailureHook(): Promise<number> {
       return 0;
     }
     const canRespawn = session != null && mainLoop;
+    const keyId = account == null ? liveApiKeyId() : null;
+    if (keyId != null) {
+      if (error !== "billing_error") return 0;
+      const known = await refuseApiKey(keyId, now);
+      log("stopfailure.key_refused", { key: keyId, known, subagent: !mainLoop });
+      const decision = await evaluateAndMaybeSwap(claude, now, canRespawn, null, { waiterId: canRespawn ? session?.sid : undefined, refused: refusedAccounts(), apiKeys: true, apiKeyId: keyId });
+      const target = moveTarget(decision);
+      if (session && canRespawn && target) {
+        writeRespawnMarker({ session, ...target, waitUntil: target.waitUntil ?? now, compact: false, origin: "stopfailure" });
+        log("stopfailure.marker", { session: session.sid.slice(0, 8), live: session.live.slice(0, 8), account: target.accountId.slice(0, 8), key: target.apiKeyId, waitUntil: target.waitUntil ?? now });
+      } else {
+        log("stopfailure.decision", { reason: decision.reason, swapped: decision.swapped, account: decision.account?.id.slice(0, 8), waitUntil: decision.waitUntil });
+      }
+      return 0;
+    }
+    if (error === "billing_error") return 0;
     const cfg = loadConfig();
     const row = stdin.transcript_path
       ? await awaitEnforcedRow({ transcriptPath: stdin.transcript_path, agentId: stdin.agent_id, error, lastAssistantMessage: stdin.last_assistant_message })
@@ -92,10 +109,11 @@ export async function runStopFailureHook(): Promise<number> {
     }
 
     const refused = enforced?.kind === "credits" ? [...new Set([...refusedAccounts(), enforced.account])] : undefined;
-    const decision = await evaluateAndMaybeSwap(claude, now, canRespawn, enforced, { waiterId: canRespawn ? session?.sid : undefined, exclude: refused });
-    if (session && canRespawn && decision.account && (decision.swapped || decision.waitUntil !== undefined)) {
-      writeRespawnMarker({ session, accountId: decision.account.id, waitUntil: decision.waitUntil ?? now, compact: false, origin: "stopfailure", refused });
-      log("stopfailure.marker", { session: session.sid.slice(0, 8), live: session.live.slice(0, 8), account: decision.account.id.slice(0, 8), waitUntil: decision.waitUntil ?? now });
+    const decision = await evaluateAndMaybeSwap(claude, now, canRespawn, enforced, { waiterId: canRespawn ? session?.sid : undefined, exclude: refused, apiKeys: canRespawn && keyMovesSupported() });
+    const target = moveTarget(decision);
+    if (session && canRespawn && target) {
+      writeRespawnMarker({ session, ...target, waitUntil: target.waitUntil ?? now, compact: false, origin: "stopfailure", refused });
+      log("stopfailure.marker", { session: session.sid.slice(0, 8), live: session.live.slice(0, 8), account: target.accountId.slice(0, 8), key: target.apiKeyId, waitUntil: target.waitUntil ?? now });
     } else {
       log("stopfailure.decision", { reason: decision.reason, swapped: decision.swapped, account: decision.account?.id.slice(0, 8), waitUntil: decision.waitUntil });
     }

package/src/entries/stophook.ts

@@ -1,8 +1,8 @@
 import { z } from "zod";
 import { claude } from "../lib/claude.ts";
-import { evaluateAndMaybeSwap } from "../lib/decide.ts";
+import { evaluateAndMaybeSwap, moveTarget } from "../lib/decide.ts";
 import { readStdin } from "../lib/proc.ts";
-import { adoptLiveSession, refusedAccounts, supervisedSession, writeRespawnMarker } from "../lib/sessions.ts";
+import { adoptLiveSession, keyMovesSupported, refusedAccounts, supervisedSession, writeRespawnMarker } from "../lib/sessions.ts";
 import { JsonTextSchema } from "../lib/types.ts";
 import { errorMessage, log } from "../lib/log.ts";
 
@@ -24,10 +24,11 @@ export async function runBoundaryHook(event: "stop" | "sessionstart"): Promise<n
       log(`${event}.nested_session`, { stdin: stdin.session_id?.slice(0, 8), supervised: supervised.live.slice(0, 8), source: stdin.source });
       return 0;
     }
-    const decision = await evaluateAndMaybeSwap(claude, Date.now(), session != null, null, { waiterId: session?.sid, refused: refusedAccounts() });
-    if (session && decision.account && (decision.swapped || decision.waitUntil !== undefined)) {
-      writeRespawnMarker({ session, accountId: decision.account.id, waitUntil: decision.waitUntil ?? Date.now(), compact: true, origin: event });
-      log(`${event}.${decision.waitUntil !== undefined ? "wait" : "move"}`, { source: stdin.source, account: decision.account.id.slice(0, 8), waitUntil: decision.waitUntil, session: session.sid.slice(0, 8), live: session.live.slice(0, 8) });
+    const decision = await evaluateAndMaybeSwap(claude, Date.now(), session != null, null, { waiterId: session?.sid, refused: refusedAccounts(), apiKeys: session != null && keyMovesSupported() });
+    const target = moveTarget(decision);
+    if (session && target) {
+      writeRespawnMarker({ session, ...target, waitUntil: target.waitUntil ?? Date.now(), compact: true, origin: event });
+      log(`${event}.${target.waitUntil !== undefined ? "wait" : "move"}`, { source: stdin.source, account: target.accountId.slice(0, 8), key: target.apiKeyId, waitUntil: target.waitUntil, session: session.sid.slice(0, 8), live: session.live.slice(0, 8) });
     }
   } catch (e) {
     log(`${event}.error`, { err: errorMessage(e) });