tokenmaxxing 1.16.0 → 1.18.0

package/DESIGN.md

@@ -49,7 +49,7 @@ The switching path runs no long-lived daemon. The statusline pushes usage. Hooks
 The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limits.{five_hour,seven_day}.{used_percentage,resets_at}`, after every turn, 300ms debounce, zero cost). tokenmaxxing's statusLine tees that to `usage.json` (write-on-change, O(ms)) and renders its own native line (it replaced the earlier pass-through delegation on 2026-07-11: install takes the statusLine slot outright, so a pre-existing custom statusline command is overwritten). Cold-start fallback if `usage.json` is absent: `TOKENMAXXING_PROBE=1 claude -p '/usage'`, with `[ -n "$TOKENMAXXING_PROBE" ] && exit 0` as the hook's first line to stop the nested process recursing (hooks fire in `-p` too). The probe scrubs every ambient credential override claude reads before the keychain (`CLAUDE_CODE_OAUTH_TOKEN`, `CLAUDE_SECURESTORAGE_CONFIG_DIR`, etc.) so it can only meter the credential in the keychain item, and retries the transient empty-footer case (claude prints local stats with no percentages when its own usage fetch throttles).
 
 ### 3.2 Detect + swap + signal (Stop hook, per turn)
-1. Read `usage.json`; `exit 0` fast below the engagement floor (`policy.greedySessionFloor`, default 80% of the 5h window) unless a screening bar is already crossed. Engaged-but-under-every-bar runs the GREEDY convergence: stay when the current account wins or ties, else swap onto the strictly better account. A crossed bar forces the hard path (metered per `organizationUuid`).
+1. Read `usage.json`; `exit 0` fast below the engagement floor (`policy.greedySessionFloor`, default 80% of the 5h window) unless a screening bar is already crossed. Engaged-but-under-every-bar runs the GREEDY convergence: stay when the current account wins or ties, else swap onto the strictly better account. A crossed bar forces the hard path (metered per live `accountUuid`; team seats share one organization, so the organization never identifies a seat).
 2. Else take a `flock` on `~/.config/tokenmaxxing/lock`, re-check under it (parallel sessions race - first winner already swapped), pick the best parked account (not rate-limited, furthest behind its own weekly pace first: highest remaining% / time-to-weekly-reset, since unused allowance is forfeited at the fixed per-account reset; tiebreak soonest expiry then lowest 7-day usage), and **swap the credential** (§3.4).
 3. Done - the running session adopts the new credential on its own within a request or two. Only when the pool is depleted (the decision returned a `waitUntil`: pre-parked on the soonest-recovering account, or staying on the current one when it recovers first) does the hook write `respawn/<session_id>` (atomic temp+rename).
 
@@ -57,8 +57,8 @@ The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limi
 The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed turn boundary, deletes the marker, resets the terminal, shows an interruptible countdown to the reset, and relaunches `claude --resume <sid>` when it passes. The resumed process reads the keychain cold → runs on the recovered account, same conversation. The `SessionStart` hook (source `resume`) re-checks the account before the first turn as a backstop.
 
 ### 3.4 Swap sequence (under the lock)
-1. **Harvest the live credential into its TRUE owner's backup** - read the current `Claude Code-credentials` blob and resolve which account it actually belongs to via the roles endpoint (`GET /api/oauth/claude_cli/roles`), NOT the `accounts.json` active label. The label drifts from the live blob (a kill mid-swap, a manual `/login`), and harvesting by label once overwrote another account's backup and destroyed its only credential. Mandatory anyway: Claude rotates the refresh token in place, so older backups are dead. Refuse the swap if the live credential belongs to no pooled account.
-2. **Refresh B** - OAuth refresh-grant with B's parked refresh token → fresh access token; persist the rotated refresh token. On `invalid_grant`, mark B `needs_reauth`, notify, try the next account.
+1. **Harvest the live credential into its TRUE owner's backup** - read the current `Claude Code-credentials` blob and resolve which account it actually belongs to via the profile endpoint (`GET /api/oauth/profile`, matched on `account.uuid`), NOT the `accounts.json` active label and NOT the organization (team seats share one). The label drifts from the live blob (a kill mid-swap, a manual `/login`), and harvesting by label once overwrote another account's backup and destroyed its only credential. Mandatory anyway: Claude rotates the refresh token in place, so older backups are dead. Refuse the swap if the live credential belongs to no pooled account.
+2. **Refresh B** - a blob Claude Code dead-cleared (empty tokens) is dead without a request. Resolve the owner of B's parked token through the profile endpoint first; a token that belongs to another account is never refreshed, because a refresh rotation revokes that account's live sessions, and B is marked `needs_reauth` instead. Then OAuth refresh-grant with B's parked refresh token → fresh access token; persist the rotated refresh token. On `invalid_grant`, mark B `needs_reauth`, notify, try the next account. On any other 4xx, skip B for this evaluation without marking it and try the next account.
 3. **Install B** - `security add-generic-password -U ... 'Claude Code-credentials' ...` with B's fresh (non-expired) `claudeAiOauth` JSON.
 4. **Swap identity + mark B active** - atomically rewrite only the `oauthAccount` object in `~/.claude.json` (temp+rename) to B's, and write `activeAccountUuid = B` in the SAME critical section, so a crash can't leave the installed credential and the active label pointing at different accounts.
 5. Do steps 1, 3, 4 inside Claude's own refresh locks - the primary `<credDir>/.oauth_refresh.lock` plus the legacy sibling `<realpath(credDir)>.lock` (`~/.claude.lock` by default), both mkdir-based proper-lockfile locks, binary-verified against 2.1.214 - so the writes can't collide with a token refresh. Contention fails the swap fast (claude itself gives up with `lock_timeout` rather than refreshing unlocked); the next check retries.

package/agent-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "tokenmaxxing",
-  "version": "1.16.0",
+  "version": "1.18.0",
   "description": "Pool Claude Code and Codex logins, switch on pace pressure, and expose safe ops tools to agent clients.",
   "author": {
     "name": "anaclumos",

package/agent-plugin/skills/credentials-hygiene/SKILL.md

@@ -1,15 +1,16 @@
 ---
 name: credentials-hygiene
-description: Credential and identity rules for tokenmaxxing (fetchTokenOrg identity, flock, no blob compare, never print secrets). Use before any auth, swap, or credential-touching change.
+description: Credential and identity rules for tokenmaxxing (fetchTokenIdentity account-uuid identity, flock, no blob compare, never print secrets). Use before any auth, swap, or credential-touching change.
 ---
 
 # Credentials hygiene
 
 ## Identity
 
-- Identity is whatever `fetchTokenOrg` reports, never a stored label and never a blob byte compare. Two rotations of one account differ byte-for-byte.
+- Identity is the `accountUuid` that `fetchTokenIdentity` reports for a token (`GET /api/oauth/profile`), never the organization, never a stored label, and never a blob byte compare. Every seat of a Team plan shares one `organizationUuid`, so an org-keyed lookup collapses the seats onto one account. Two rotations of one account differ byte-for-byte.
 - Park a credential under its token's real owner. Commit the active label in the same critical section as credential writes.
 - Every live-store write goes through `withClaudeRefreshLock` (Claude). Near-expiry sessions can rotate into the live store at any moment.
+- A refresh rotation revokes the previous access token at once, so refreshing any copy of a credential that is live elsewhere kills those sessions' token.
 
 ## Isolation
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.16.0",
+  "version": "1.18.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",

package/src/cli/check.ts

@@ -23,7 +23,7 @@ export async function cmdCheck(args: string[] = [], json = false): Promise<numbe
     emitError({ json, message: `check failed: ${detail}` });
     return 1;
   }
-  const delayMs = checkDelayMs({ cfg, org: readOAuthAccount()?.organizationUuid ?? null, now, decision: d });
+  const delayMs = checkDelayMs({ cfg, account: readOAuthAccount()?.accountUuid ?? null, now, decision: d });
   saveNextCheckDueAt({ dueAt: now + delayMs, ts: now });
   if (json) {
     emitJson({

package/src/cli/doctor.ts

@@ -5,14 +5,14 @@ import { checkTimerHealthy, findClaudeShadowers, isBinDirAhead, shellRcPath, tim
 import { paths } from "../lib/paths.ts";
 import { loadAccounts, loadConfig } from "../lib/state.ts";
 import { readItem, liveTarget, parkedTarget } from "../lib/credstore.ts";
-import { isAccessTokenExpiring, fetchTokenOrg } from "../lib/oauth.ts";
-import { CredentialBlobSchema, type RolesResponse } from "../lib/types.ts";
+import { isAccessTokenExpiring, fetchTokenIdentity, describeIdentity } from "../lib/oauth.ts";
+import { CredentialBlobSchema, type TokenIdentity } from "../lib/types.ts";
 import { c, emitJson } from "./render.ts";
 
-async function blobOrg(raw: string): Promise<RolesResponse | null> {
+async function blobIdentity(raw: string): Promise<TokenIdentity | null> {
   const creds = CredentialBlobSchema.parse(JSON.parse(raw)).claudeAiOauth;
   if (isAccessTokenExpiring(creds)) return null;
-  return fetchTokenOrg(creds.accessToken);
+  return fetchTokenIdentity(creds.accessToken);
 }
 
 export async function cmdDoctor(json = false): Promise<number> {
@@ -54,8 +54,8 @@ export async function cmdDoctor(json = false): Promise<number> {
   const active = idx.accounts.find((a) => a.accountUuid === idx.activeAccountUuid);
   if (live && active) {
     try {
-      const org = await blobOrg(live);
-      if (org) check(org.organization_uuid === active.organizationUuid, `live credential identity matches active (${active.email})`, `token belongs to ${org.organization_name} - run \`tokenmaxxing switch\``);
+      const identity = await blobIdentity(live);
+      if (identity) check(identity.accountUuid === active.accountUuid, `live credential identity matches active (${active.email})`, `token belongs to ${describeIdentity(identity)} - run \`tokenmaxxing switch\``);
       else note("live credential identity unverifiable (access token expired)");
     } catch (e) {
       check(false, `live credential identity matches active (${active.email})`, (e instanceof Error ? e.message : String(e)).slice(0, 100));
@@ -67,8 +67,8 @@ export async function cmdDoctor(json = false): Promise<number> {
     check(!!parked, `parked credential present for ${a.email}`, `run \`tokenmaxxing auth ${a.label}\``);
     if (parked) {
       try {
-        const org = await blobOrg(parked);
-        if (org) check(org.organization_uuid === a.organizationUuid, `parked credential identity matches ${a.email}`, `token belongs to ${org.organization_name} - run \`tokenmaxxing auth ${a.label}\``);
+        const identity = await blobIdentity(parked);
+        if (identity) check(identity.accountUuid === a.accountUuid, `parked credential identity matches ${a.email}`, `token belongs to ${describeIdentity(identity)} - run \`tokenmaxxing auth ${a.label}\``);
         else note(`${a.email} identity unverifiable (access token expired)`);
       } catch (e) {
         check(false, `parked credential identity matches ${a.email}`, (e instanceof Error ? e.message : String(e)).slice(0, 100));

package/src/cli/init.ts

@@ -1,7 +1,7 @@
 import { mkdirSync } from "node:fs";
 import { isApiKeyMode, readOAuthAccount } from "../lib/claudejson.ts";
 import { readItem, writeItem, liveTarget, parkedTarget, mergeIntoLive } from "../lib/credstore.ts";
-import { refreshCredential, isAccessTokenExpiring, fetchTokenOrg } from "../lib/oauth.ts";
+import { refreshCredential, isAccessTokenExpiring, isDeadCredential, fetchTokenIdentity, describeIdentity } from "../lib/oauth.ts";
 import { withClaudeRefreshLock } from "../lib/claudelock.ts";
 import { loadAccounts, saveAccounts, loadConfig, pinBinOverride } from "../lib/state.ts";
 import { withLock } from "../lib/lock.ts";
@@ -83,6 +83,11 @@ export async function cmdInit(): Promise<number> {
   }
 
   let creds = blob.claudeAiOauth;
+  if (isDeadCredential(creds)) {
+    console.error(c.red("the live credential was cleared after a failed refresh."));
+    console.error(`Run ${c.cyan("claude")} → ${c.cyan("/login")} first, then re-run ${c.cyan("tokenmaxxing init")}.`);
+    return 1;
+  }
   if (isAccessTokenExpiring(creds)) {
     await withClaudeRefreshLock(async (lock) => {
       const raw2 = await readItem(liveTarget());
@@ -94,9 +99,9 @@ export async function cmdInit(): Promise<number> {
       await writeItem(liveTarget(), mergeIntoLive(raw2, creds));
     });
   }
-  const org = await fetchTokenOrg(creds.accessToken);
-  if (org.organization_uuid !== oauthAccount.organizationUuid) {
-    console.error(c.red(`the live credential belongs to ${org.organization_name}, but ~/.claude.json identifies ${oauthAccount.emailAddress} - identity drift.`));
+  const identity = await fetchTokenIdentity(creds.accessToken);
+  if (identity.accountUuid !== oauthAccount.accountUuid) {
+    console.error(c.red(`the live credential belongs to ${describeIdentity(identity)}, but ~/.claude.json identifies ${oauthAccount.emailAddress} - identity drift.`));
     console.error(`Run ${c.cyan("claude")} → ${c.cyan("/login")} to realign them, then re-run ${c.cyan("tokenmaxxing init")}.`);
     return 1;
   }

package/src/cli/rm.ts

@@ -1,7 +1,7 @@
 import { rmSync } from "node:fs";
 import { join } from "node:path";
 import { deleteItem, isolatedTarget, liveTarget, parkedTarget, readItem } from "../lib/credstore.ts";
-import { fetchTokenOrg } from "../lib/oauth.ts";
+import { fetchTokenIdentity } from "../lib/oauth.ts";
 import { withLock } from "../lib/lock.ts";
 import { credItemFor, paths } from "../lib/paths.ts";
 import { loadAccounts, saveAccounts } from "../lib/state.ts";
@@ -27,18 +27,18 @@ export async function cmdRm(selector?: string, json = false): Promise<number> {
     }
     const live = await readItem(liveTarget());
     if (live != null) {
-      let liveOrg: string;
+      let liveAccount: string;
       try {
         const liveCreds = CredentialBlobSchema.parse(JSON.parse(live)).claudeAiOauth;
-        liveOrg = (await fetchTokenOrg(liveCreds.accessToken)).organization_uuid;
+        liveAccount = (await fetchTokenIdentity(liveCreds.accessToken)).accountUuid;
       } catch (e) {
         emitError({
           json,
-          message: `cannot verify which account the LIVE credential belongs to (${e instanceof Error ? e.message : String(e)}) - refusing to remove while the live owner is unknown; repair the live credential or retry once the roles endpoint is reachable.`,
+          message: `cannot verify which account the LIVE credential belongs to (${e instanceof Error ? e.message : String(e)}) - refusing to remove while the live owner is unknown; repair the live credential or retry once the profile endpoint is reachable.`,
         });
         return 1;
       }
-      if (liveOrg === a.organizationUuid) {
+      if (liveAccount === a.accountUuid) {
         emitError({ json, message: `${a.email}'s credential is currently LIVE (the active label is stale - a manual /login drifted it); run \`tokenmaxxing switch\` to move off it first.` });
         return 1;
       }

package/src/cli/status.ts

@@ -116,17 +116,17 @@ async function collectClaude(input: { cfg: Config; ping: boolean; pingCount: num
       const teeAt = tee?.at ?? null;
       const modelUsage = loadModelUsage();
       const liveOAuth = readOAuthAccount();
-      const activeOrg = liveOAuth?.organizationUuid ?? null;
+      const liveAccount = liveOAuth?.accountUuid ?? null;
       const probeOne = async (a: Account) => {
-        const isActive = activeOrg != null && activeOrg === a.organizationUuid;
+        const isActive = liveAccount != null && liveAccount === a.accountUuid;
         if (isActive && liveOAuth?.organizationRateLimitTier != null) a.rateLimitTier = liveOAuth.organizationRateLimitTier;
         const teeCurrent = teeAt != null && (a.lastUsageAt == null || teeAt >= a.lastUsageAt);
         const fromStatusLine: FullUsage | null =
-          isActive && live && teeCurrent && live.org === a.organizationUuid
+          isActive && live && teeCurrent && live.account === a.accountUuid
             ? {
                 session: live.fiveHour,
                 weekAll: live.sevenDay,
-                perModel: modelUsage && modelUsage.org === a.organizationUuid ? modelUsage.perModel : {},
+                perModel: modelUsage && modelUsage.account === a.accountUuid ? modelUsage.perModel : {},
               }
             : null;
         let viaTee = false;
@@ -159,7 +159,7 @@ async function collectClaude(input: { cfg: Config; ping: boolean; pingCount: num
           a.lastPerModelAt = viaTee && modelUsage ? (modelUsage.sampledAt ?? modelUsage.ts) : a.lastUsageAt;
         }
       };
-      const activeAccount = idx.accounts.find((a) => activeOrg != null && activeOrg === a.organizationUuid) ?? null;
+      const activeAccount = idx.accounts.find((a) => liveAccount != null && liveAccount === a.accountUuid) ?? null;
       if (activeAccount) await probeOne(activeAccount);
       try {
         await ensureLiveTokenFresh();
@@ -172,7 +172,7 @@ async function collectClaude(input: { cfg: Config; ping: boolean; pingCount: num
 
   const families = gatedFamilies(loadUsage()?.model ?? null, cfg.policy.switchModels);
   const bars = effectiveBars(cfg, { accounts: idx.accounts, now, switchFamilies: families });
-  const activeOrg = readOAuthAccount()?.organizationUuid ?? null;
+  const liveAccount = readOAuthAccount()?.accountUuid ?? null;
   const ordered = sortBy(idx.accounts, [(a) => (a.needsReauth ? 1 : 0), (a) => earliestReset(a, now)]);
   const accounts = ordered.map((a): ClaudeStatusAccount => {
     const sampled = samples.get(a.accountUuid) ?? { outcome: { ok: false, reason: "not sampled" }, viaTee: false };
@@ -185,7 +185,7 @@ async function collectClaude(input: { cfg: Config; ping: boolean; pingCount: num
       accountUuid: a.accountUuid,
       organizationUuid: a.organizationUuid,
       tier: claudeTierLabel(a),
-      active: activeOrg != null && a.organizationUuid === activeOrg,
+      active: liveAccount != null && a.accountUuid === liveAccount,
       needsReauth: a.needsReauth === true,
       exhausted: isExhausted(a, { now, thresholds: bars, currentAccountUuid: idx.activeAccountUuid, switchFamilies: families }),
       usage: aggregate ? { fiveHour: currentWindow(aggregate.fiveHour, false, now), week: currentWindow(aggregate.sevenDay, true, now) } : null,

package/src/cli/switch.ts

@@ -32,7 +32,6 @@ export async function cmdSwitch(selector?: string, json = false): Promise<number
     const idx = loadAccounts();
     const liveClaim = readOAuthAccount();
     const claimed = liveClaim?.accountUuid ?? null;
-    const claimedOrg = liveClaim?.organizationUuid ?? null;
     const drifted = claimed != null && claimed !== idx.activeAccountUuid;
 
     const swapTo = async (target: Account, reason: string, extra: Record<string, unknown> = {}): Promise<number> => {
@@ -71,7 +70,7 @@ export async function cmdSwitch(selector?: string, json = false): Promise<number
       const cur = loadAccounts();
       const everyone = everyoneIn(cur.accounts);
       const active =
-        (claimedOrg != null ? cur.accounts.find((a) => a.organizationUuid === claimedOrg) : null) ??
+        (claimed != null ? cur.accounts.find((a) => a.accountUuid === claimed) : null) ??
         cur.accounts.find((a) => a.accountUuid === cur.activeAccountUuid) ??
         null;
       if (active != null && currentWins(active, cur.accounts, everyone)) {

package/src/entries/statusline.ts

@@ -9,7 +9,6 @@ import { makeColors, makeUsagePaint } from "../cli/render.ts";
 import { fmtResetShort } from "../lib/usage.ts";
 import {
   AccountsIndexSchema,
-  RateLimitsStdinSchema,
   StatusLineStdinSchema,
   UsageWindowSchema,
   type Account,
@@ -24,7 +23,7 @@ const RenderCtxSchema = z.object({
   perModel: z.record(z.string(), UsageWindowSchema),
   switchModels: z.array(z.string()),
   worktree: z.string().nullable(),
-  liveOrg: z.string().nullable(),
+  liveAccount: z.string().nullable(),
   now: z.number(),
   color: z.boolean(),
   truecolor: z.boolean(),
@@ -79,7 +78,7 @@ export function renderStatusline(stdinObj: unknown, ctx: RenderCtx): string {
     windows.push(seg("", wins.sevenDay, wins.sevenDay.resetsAt));
   }
   const seatUuid =
-    (ctx.liveOrg != null ? ctx.accounts.accounts.find((a) => a.organizationUuid === ctx.liveOrg)?.accountUuid : undefined) ??
+    (ctx.liveAccount != null && ctx.accounts.accounts.some((a) => a.accountUuid === ctx.liveAccount) ? ctx.liveAccount : null) ??
     ctx.accounts.activeAccountUuid;
   const active =
     windows.length > 0
@@ -120,17 +119,13 @@ export async function runStatusline(): Promise<number> {
   }
   const now = Date.now();
 
-  let stdinOrg: string | null = null;
-
-  let org: string | null = null;
+  let account: string | null = null;
   try {
-    org = readOAuthAccount()?.organizationUuid ?? null;
+    account = readOAuthAccount()?.accountUuid ?? null;
     const windows = obj == null ? null : parseStatusLineStdin(obj);
     const lastSwapAt = loadLastSwapAt();
-    stdinOrg = windows != null ? (RateLimitsStdinSchema.safeParse(obj).data?.organizationUuid ?? null) : null;
-    const teeOrg = stdinOrg ?? org;
-    if (windows && (stdinOrg != null || lastSwapAt == null || now - lastSwapAt >= ADOPTION_GRACE_MS)) {
-      const state: UsageState = { ...windows, org: teeOrg, ts: now, model: parseStatusLineModel(obj) };
+    if (windows && (lastSwapAt == null || now - lastSwapAt >= ADOPTION_GRACE_MS)) {
+      const state: UsageState = { ...windows, account, ts: now, model: parseStatusLineModel(obj) };
       writeUsage(state);
     }
   } catch {
@@ -145,10 +140,10 @@ export async function runStatusline(): Promise<number> {
     const colorterm = z.string().optional().parse(process.env.COLORTERM);
     const ctx: RenderCtx = {
       accounts: loadAccounts(),
-      perModel: modelUsage && modelUsage.org === (stdinOrg ?? org) ? modelUsage.perModel : {},
+      perModel: modelUsage && modelUsage.account === account ? modelUsage.perModel : {},
       switchModels: cfg.policy.switchModels,
       worktree: dir == null ? null : worktreeName(dir),
-      liveOrg: stdinOrg ?? org,
+      liveAccount: account,
       now,
       color: !process.env.NO_COLOR,
       truecolor: colorterm != null && (colorterm.includes("truecolor") || colorterm.includes("24bit")),

package/src/entries/stopfailurehook.ts

@@ -30,7 +30,7 @@ async function readStdin(): Promise<string> {
 export async function runStopFailureHook(): Promise<number> {
   if (process.env.TOKENMAXXING_PROBE) return 0;
 
-  const org = readOAuthAccount()?.organizationUuid ?? null;
+  const account = readOAuthAccount()?.accountUuid ?? null;
   const now = Date.now();
   const raw = await readStdin();
   const parsed = StopFailureStdin.safeParse((() => { try { return JSON.parse(raw); } catch { return {}; } })());
@@ -51,12 +51,12 @@ export async function runStopFailureHook(): Promise<number> {
     const limit = found ? classifyEnforcedLimit(found.row, cfg.policy.switchModels) : null;
 
     let enforced: EnforcedLimit | null = null;
-    if (limit && found && org) {
+    if (limit && found && account) {
       if (postSwapProof({ swapAt: loadLastSwapAt(), launchedAt, errorAt: found.errorAt, now })) {
-        const stamp = await recordEnforcedLimit({ limit, org, now });
+        const stamp = await recordEnforcedLimit({ limit, account, now });
         log("stopfailure.enforced", { kind: limit.kind, family: limit.kind === "model" ? limit.family : undefined, outcome: stamp.outcome, resetsAt: stamp.resetsAt, subagent: !mainLoop });
-        if (stamp.outcome !== "org-moved") {
-          enforced = { org, family: limit.kind === "model" ? limit.family : null, resetsAt: stamp.resetsAt, windowMs: enforcedWindowMs(limit) };
+        if (stamp.outcome !== "account-moved") {
+          enforced = { account, family: limit.kind === "model" ? limit.family : null, resetsAt: stamp.resetsAt, windowMs: enforcedWindowMs(limit) };
         }
       } else {
         log("stopfailure.unproven", { kind: limit.kind });

package/src/lib/decide.ts

@@ -4,9 +4,8 @@ import { withLock } from "./lock.ts";
 import { paths } from "./paths.ts";
 import { MAX_CHECK_DELAY_TICKS, POST_SWAP_COOLDOWN_MS, maxCheckDelayMs, loadAccounts, loadConfig, loadDepletedWait, loadLastSwapAt, loadUsage, loadUsageSnapshot, loadModelUsage, saveAccounts, saveDepletedWait, saveModelUsage, writeUsage } from "./state.ts";
 import { readOAuthAccount } from "./claudejson.ts";
-import { chooseAndSwap, performSwap } from "./swap.ts";
+import { chooseAndSwap, isSkippableSwapError, performSwap } from "./swap.ts";
 import { currentWins, effectiveBars, hardBars, isExhausted, nextWeeklyReset, pickBest, pickEarliestReset, sessionLadder, usableAt } from "./picker.ts";
-import { InvalidGrantError } from "./oauth.ts";
 import { familyTokens, gatedFamilies, probeUsage, type EnforcedClass } from "./usage.ts";
 import { log } from "./log.ts";
 import { AccountSchema, ModelUsageStateSchema, UsageStateSchema, type Account, type Config, type EnforcedLimit, type ModelUsageState, type Thresholds, type UsageState, type UsageWindow } from "./types.ts";
@@ -36,22 +35,22 @@ function capForFamily(mu: ModelUsageState, family: string, now: number): UsageWi
   return maxBy(rows, (w) => liveUsed({ window: w, windowMs: WEEK_MS, sampledAt: mu.sampledAt ?? mu.ts, now }));
 }
 
-function overlayLive(accounts: Account[], u: UsageState | null, mu: ModelUsageState | null, org: string | null): Account[] {
+function overlayLive(accounts: Account[], u: UsageState | null, mu: ModelUsageState | null, account: string | null): Account[] {
   return accounts.map((a) => {
-    if (org == null || a.organizationUuid !== org) return a;
-    const live = u && u.org === org ? { lastUsage: { fiveHour: u.fiveHour, sevenDay: u.sevenDay }, lastUsageAt: u.ts } : {};
-    const perModel = mu && mu.org === org && Object.keys(mu.perModel).length > 0 ? { lastPerModel: mu.perModel, lastPerModelAt: mu.sampledAt ?? mu.ts } : {};
+    if (account == null || a.accountUuid !== account) return a;
+    const live = u && u.account === account ? { lastUsage: { fiveHour: u.fiveHour, sevenDay: u.sevenDay }, lastUsageAt: u.ts } : {};
+    const perModel = mu && mu.account === account && Object.keys(mu.perModel).length > 0 ? { lastPerModel: mu.perModel, lastPerModelAt: mu.sampledAt ?? mu.ts } : {};
     return { ...a, ...live, ...perModel };
   });
 }
 
-function isOver(u: UsageState | null, mu: ModelUsageState | null, org: string | null, bars: Thresholds, cfg: Config, now: number): boolean {
-  if (!u || !org || u.org !== org) return false;
+function isOver(u: UsageState | null, mu: ModelUsageState | null, account: string | null, bars: Thresholds, cfg: Config, now: number): boolean {
+  if (!u || !account || u.account !== account) return false;
   if (
     liveUsed({ window: u.fiveHour, windowMs: FIVE_HOURS_MS, sampledAt: u.ts, now }) >= bars.session ||
     liveUsed({ window: u.sevenDay, windowMs: WEEK_MS, sampledAt: u.ts, now }) >= bars.weekly
   ) return true;
-  if (mu && mu.org === org) {
+  if (mu && mu.account === account) {
     for (const family of gatedFamilies(u.model, cfg.policy.switchModels)) {
       const cap = capForFamily(mu, family, now);
       if (cap && liveUsed({ window: cap, windowMs: WEEK_MS, sampledAt: mu.sampledAt ?? mu.ts, now }) >= bars.weekly) return true;
@@ -64,9 +63,9 @@ function needsPerModel(u: UsageState | null, cfg: Config): boolean {
   return u != null && gatedFamilies(u.model, cfg.policy.switchModels).length > 0;
 }
 
-function isEngaged(u: UsageState | null, mu: ModelUsageState | null, org: string | null, bars: Thresholds, cfg: Config, now: number): boolean {
-  if (!u || !org || u.org !== org) return false;
-  return liveUsed({ window: u.fiveHour, windowMs: FIVE_HOURS_MS, sampledAt: u.ts, now }) >= cfg.policy.greedySessionFloor || isOver(u, mu, org, bars, cfg, now);
+function isEngaged(u: UsageState | null, mu: ModelUsageState | null, account: string | null, bars: Thresholds, cfg: Config, now: number): boolean {
+  if (!u || !account || u.account !== account) return false;
+  return liveUsed({ window: u.fiveHour, windowMs: FIVE_HOURS_MS, sampledAt: u.ts, now }) >= cfg.policy.greedySessionFloor || isOver(u, mu, account, bars, cfg, now);
 }
 
 const SnapshotsSchema = z.object({
@@ -76,41 +75,41 @@ const SnapshotsSchema = z.object({
 });
 type Snapshots = z.infer<typeof SnapshotsSchema>;
 
-function usageFresh(u: UsageState | null, uAt: number | null, org: string | null, ttl: number, now: number): boolean {
-  return u != null && u.org === org && uAt != null && now - uAt <= ttl;
+function usageFresh(u: UsageState | null, uAt: number | null, account: string | null, ttl: number, now: number): boolean {
+  return u != null && u.account === account && uAt != null && now - uAt <= ttl;
 }
 
 function freshest(u: UsageState | null, uAt: number | null, account: Account | undefined): UsageState | null {
   if (!u || uAt == null) return u;
   const stored = account?.lastUsage;
-  if (stored && account.lastUsageAt != null && u.org === account.organizationUuid && uAt < account.lastUsageAt) {
+  if (stored && account.lastUsageAt != null && u.account === account.accountUuid && uAt < account.lastUsageAt) {
     return { ...u, fiveHour: stored.fiveHour, sevenDay: stored.sevenDay, ts: account.lastUsageAt };
   }
   return { ...u, ts: uAt };
 }
 
-async function loadFreshSnapshots(cfg: Config, org: string | null, now: number): Promise<Snapshots> {
+async function loadFreshSnapshots(cfg: Config, account: string | null, now: number): Promise<Snapshots> {
   const snap = loadUsageSnapshot();
   let u = snap?.state ?? null;
   let uAt = snap?.at ?? null;
   let mu = loadModelUsage();
   const ttl = cfg.policy.usagePollTtlMs;
-  const probeAttempted = mu != null && mu.org === org && now - mu.ts <= ttl;
-  if (org && !probeAttempted && (!usageFresh(u, uAt, org, ttl, now) || needsPerModel(u, cfg))) {
+  const probeAttempted = mu != null && mu.account === account && now - mu.ts <= ttl;
+  if (account && !probeAttempted && (!usageFresh(u, uAt, account, ttl, now) || needsPerModel(u, cfg))) {
     const full = await probeUsage();
     const ts = Date.now();
-    if (readOAuthAccount()?.organizationUuid === org) {
+    if (readOAuthAccount()?.accountUuid === account) {
       if (full) {
         const teed = loadUsageSnapshot();
-        if (teed && usageFresh(teed.state, teed.at, org, ttl, ts)) {
+        if (teed && usageFresh(teed.state, teed.at, account, ttl, ts)) {
           u = teed.state;
           uAt = teed.at;
         } else {
-          u = { fiveHour: full.session, sevenDay: full.weekAll, org, ts, model: null };
+          u = { fiveHour: full.session, sevenDay: full.weekAll, account, ts, model: null };
           writeUsage(u);
           uAt = ts;
         }
-        mu = { perModel: full.perModel, org, ts, sampledAt: ts };
+        mu = { perModel: full.perModel, account, ts, sampledAt: ts };
         saveModelUsage(mu);
         const expected = gatedFamilies(u?.model ?? null, cfg.policy.switchModels);
         const rows = Object.keys(full.perModel);
@@ -118,7 +117,7 @@ async function loadFreshSnapshots(cfg: Config, org: string | null, now: number):
           log("usage.no_permodel_row", { families: expected.join(","), rows: rows.join(",") });
         }
       } else {
-        mu = { perModel: mu?.org === org ? (mu?.perModel ?? {}) : {}, org, ts, sampledAt: mu?.org === org ? (mu?.sampledAt ?? mu?.ts) : undefined };
+        mu = { perModel: mu?.account === account ? (mu?.perModel ?? {}) : {}, account, ts, sampledAt: mu?.account === account ? (mu?.sampledAt ?? mu?.ts) : undefined };
         saveModelUsage(mu);
       }
     }
@@ -127,8 +126,8 @@ async function loadFreshSnapshots(cfg: Config, org: string | null, now: number):
 }
 
 export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = false, enforced: EnforcedLimit | null = null): Promise<SwapDecision> {
-  const activeOrg = readOAuthAccount()?.organizationUuid ?? null;
-  const enforced0 = enforced && enforced.org === activeOrg ? enforced : null;
+  const activeAccount = readOAuthAccount()?.accountUuid ?? null;
+  const enforced0 = enforced && enforced.account === activeAccount ? enforced : null;
 
   const lastSwapAt = loadLastSwapAt();
   if (!enforced0 && lastSwapAt != null && now - lastSwapAt < POST_SWAP_COOLDOWN_MS) {
@@ -137,17 +136,17 @@ export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = fals
 
   const cfg = loadConfig();
 
-  const { u: teeUsage, mu, uAt } = await loadFreshSnapshots(cfg, activeOrg, now);
+  const { u: teeUsage, mu, uAt } = await loadFreshSnapshots(cfg, activeAccount, now);
   const pool = loadAccounts();
-  const usage = freshest(teeUsage, uAt, pool.accounts.find((a) => a.organizationUuid === activeOrg));
+  const usage = freshest(teeUsage, uAt, pool.accounts.find((a) => a.accountUuid === activeAccount));
   const bars0 = effectiveBars(cfg, {
-    accounts: overlayLive(pool.accounts, usage, mu, activeOrg),
+    accounts: overlayLive(pool.accounts, usage, mu, activeAccount),
     now,
     switchFamilies: gatedFamilies(usage?.model ?? null, cfg.policy.switchModels),
   });
 
-  if (!enforced0 && !isEngaged(usage, mu, activeOrg, bars0, cfg, now)) {
-    const measured = usage != null && activeOrg != null && usage.org === activeOrg;
+  if (!enforced0 && !isEngaged(usage, mu, activeAccount, bars0, cfg, now)) {
+    const measured = usage != null && activeAccount != null && usage.account === activeAccount;
     if (!measured) {
       const replay = depletedReplay(now);
       if (replay) return replay;
@@ -157,25 +156,25 @@ export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = fals
 
   return withLock(paths.lockFile, async () => {
     const idx = loadAccounts();
-    const org2 = readOAuthAccount()?.organizationUuid ?? null;
-    const enforced2 = enforced0 && enforced0.org === org2 ? enforced0 : null;
+    const account2 = readOAuthAccount()?.accountUuid ?? null;
+    const enforced2 = enforced0 && enforced0.account === account2 ? enforced0 : null;
     const tee = loadUsageSnapshot();
-    const active = org2 ? idx.accounts.find((a) => a.organizationUuid === org2) : undefined;
+    const active = account2 ? idx.accounts.find((a) => a.accountUuid === account2) : undefined;
     const u2 = tee ? freshest(tee.state, tee.at, active) : usage;
     const mu2 = needsPerModel(u2, cfg) || enforced2?.family ? loadModelUsage() ?? mu : null;
 
-    if (org2 != null && !active) {
+    if (account2 != null && !active) {
       return { swapped: false, account: null, reason: "live-credential-not-in-pool" };
     }
 
     if (active) {
       let sampled = false;
-      if (tee && tee.state.org === org2 && (active.lastUsageAt == null || tee.at >= active.lastUsageAt)) {
+      if (tee && tee.state.account === account2 && (active.lastUsageAt == null || tee.at >= active.lastUsageAt)) {
         active.lastUsage = { fiveHour: tee.state.fiveHour, sevenDay: tee.state.sevenDay };
         active.lastUsageAt = tee.at;
         sampled = true;
       }
-      if (mu2 && mu2.org === org2 && Object.keys(mu2.perModel).length > 0) {
+      if (mu2 && mu2.account === account2 && Object.keys(mu2.perModel).length > 0) {
         active.lastPerModel = mu2.perModel;
         active.lastPerModelAt = mu2.sampledAt ?? mu2.ts;
         sampled = true;
@@ -188,49 +187,59 @@ export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = fals
     const barsOf = (accounts: Account[]): Thresholds => effectiveBars(cfg, { accounts, now, switchFamilies });
     const bars = barsOf(idx.accounts);
 
-    if (!enforced2 && !isEngaged(u2, mu2, org2, bars, cfg, now)) {
+    if (!enforced2 && !isEngaged(u2, mu2, account2, bars, cfg, now)) {
       return depletedReplay(now) ?? { swapped: false, account: null, reason: "raced-already-swapped" };
     }
 
     const seatOf = (idx2: { activeAccountUuid: string | null; accounts: Account[] }): Account | null =>
-      idx2.accounts.find((a) => a.organizationUuid === org2) ??
+      idx2.accounts.find((a) => a.accountUuid === account2) ??
       idx2.accounts.find((a) => a.accountUuid === idx2.activeAccountUuid) ??
       null;
 
+    const rejected = new Set<string>();
+    const usable = (accounts: Account[]): Account[] => accounts.filter((a) => !rejected.has(a.accountUuid));
+    const skipOrThrow = (e: unknown, candidate: Account): void => {
+      if (!isSkippableSwapError(e)) throw e;
+      rejected.add(candidate.accountUuid);
+      log("decide.candidate_rejected", { account: candidate.accountUuid.slice(0, 8), error: e instanceof Error ? e.message : String(e) });
+    };
+
     const greedy = async (holdMargin: number): Promise<SwapDecision> => {
       while (true) {
         const cur = loadAccounts();
         const active = seatOf(cur);
-        const ctxAll = { now, thresholds: barsOf(cur.accounts), currentAccountUuid: null, switchFamilies, holdMargin };
-        if (currentWins(active, cur.accounts, ctxAll)) {
+        const pool = usable(cur.accounts);
+        const ctxAll = { now, thresholds: barsOf(pool), currentAccountUuid: null, switchFamilies, holdMargin };
+        if (currentWins(active, pool, ctxAll)) {
           return { swapped: false, account: null, reason: "current-best" };
         }
-        const best = pickBest(cur.accounts, { ...ctxAll, currentAccountUuid: active?.accountUuid ?? null });
+        const best = pickBest(pool, { ...ctxAll, currentAccountUuid: active?.accountUuid ?? null });
         if (!best) return { swapped: false, account: null, reason: "no-usable-target" };
         try {
           await performSwap(best);
         } catch (e) {
-          if (e instanceof InvalidGrantError) continue;
-          throw e;
+          skipOrThrow(e, best);
+          continue;
         }
         log("decide.greedy_swap", { account: best.accountUuid.slice(0, 8) });
         return { swapped: true, account: best, reason: "swapped" };
       }
     };
-    if (!enforced2 && !isOver(u2, mu2, org2, bars, cfg, now)) return greedy(cfg.policy.greedySwapMargin);
+    if (!enforced2 && !isOver(u2, mu2, account2, bars, cfg, now)) return greedy(cfg.policy.greedySwapMargin);
 
     while (true) {
       const cur = loadAccounts();
       const seat = seatOf(cur);
-      const thresholds = barsOf(cur.accounts);
+      const pool = usable(cur.accounts);
+      const thresholds = barsOf(pool);
       if (!enforced2 && seat && !seat.needsReauth && !isExhausted(seat, { now, thresholds, currentAccountUuid: null, switchFamilies })) return greedy(0);
-      const best = pickBest(cur.accounts, { now, thresholds, currentAccountUuid: seat?.accountUuid ?? null, switchFamilies });
+      const best = pickBest(pool, { now, thresholds, currentAccountUuid: seat?.accountUuid ?? null, switchFamilies });
       if (!best) break;
       try {
         await performSwap(best);
       } catch (e) {
-        if (e instanceof InvalidGrantError) continue;
-        throw e;
+        skipOrThrow(e, best);
+        continue;
       }
       return { swapped: true, account: best, reason: "swapped" };
     }
@@ -241,7 +250,7 @@ export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = fals
       log("decide.last_drop_hold", { account: seat.accountUuid.slice(0, 8) });
       return { swapped: false, account: null, reason: "last-drop-hold" };
     }
-    const squeezed = await chooseAndSwap({ ...hardCtx, currentAccountUuid: seat?.accountUuid ?? null });
+    const squeezed = await chooseAndSwap({ ...hardCtx, currentAccountUuid: seat?.accountUuid ?? null }, rejected);
     if (squeezed) {
       log("decide.last_drop_swap", { account: squeezed.accountUuid.slice(0, 8) });
       return { swapped: true, account: squeezed, reason: "last-drop-swap" };
@@ -251,9 +260,9 @@ export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = fals
       const fresh = loadAccounts();
       const current = seatOf(fresh);
       const ctx = { now, thresholds: hardBars(cfg), currentAccountUuid: current?.accountUuid ?? null, switchFamilies };
-      const enforcedUntil = enforced2 && current && current.organizationUuid === enforced2.org ? (enforced2.resetsAt ?? now + enforced2.windowMs) : 0;
+      const enforcedUntil = enforced2 && current && current.accountUuid === enforced2.account ? (enforced2.resetsAt ?? now + enforced2.windowMs) : 0;
       const currentAt = current ? Math.max(usableAt(current, ctx), enforcedUntil) : Number.POSITIVE_INFINITY;
-      const other = pickEarliestReset(fresh.accounts, ctx);
+      const other = pickEarliestReset(usable(fresh.accounts), ctx);
 
       let target: Account | null = null;
       let waitUntil = Number.POSITIVE_INFINITY;
@@ -275,8 +284,8 @@ export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = fals
         try {
           await performSwap(target);
         } catch (e) {
-          if (e instanceof InvalidGrantError) continue;
-          throw e;
+          skipOrThrow(e, target);
+          continue;
         }
       }
       saveDepletedWait({ waitUntil, accountUuid: target.accountUuid, ts: now });
@@ -291,7 +300,7 @@ function depletedReplay(now: number): SwapDecision | null {
   if (!rec || rec.waitUntil <= now) return null;
   const account = loadAccounts().accounts.find((a) => a.accountUuid === rec.accountUuid) ?? null;
   if (!account) return null;
-  if (account.organizationUuid !== (readOAuthAccount()?.organizationUuid ?? null)) return null;
+  if (account.accountUuid !== (readOAuthAccount()?.accountUuid ?? null)) return null;
   return { swapped: false, account, reason: "depleted-wait", waitUntil: rec.waitUntil };
 }
 
@@ -306,19 +315,19 @@ export function postSwapProof(input: { swapAt: number | null; launchedAt: number
   return (errorAt ?? now) - swapAt >= POST_SWAP_COOLDOWN_MS;
 }
 
-const StampSchema = z.object({ outcome: z.enum(["stamped", "org-moved", "no-carrier"]), resetsAt: z.number().nullable() });
+const StampSchema = z.object({ outcome: z.enum(["stamped", "account-moved", "no-carrier"]), resetsAt: z.number().nullable() });
 export type Stamp = z.infer<typeof StampSchema>;
 
-export async function recordEnforcedLimit(input: { limit: EnforcedClass; org: string; now: number }): Promise<Stamp> {
-  const { limit, org, now } = input;
+export async function recordEnforcedLimit(input: { limit: EnforcedClass; account: string; now: number }): Promise<Stamp> {
+  const { limit, account: accountUuid, now } = input;
   return withLock(paths.lockFile, () => {
-    if ((readOAuthAccount()?.organizationUuid ?? null) !== org) return { outcome: "org-moved", resetsAt: limit.resetsAt };
+    if ((readOAuthAccount()?.accountUuid ?? null) !== accountUuid) return { outcome: "account-moved", resetsAt: limit.resetsAt };
     const prior = loadUsage();
-    const priorSame = prior && prior.org === org ? prior : null;
+    const priorSame = prior && prior.account === accountUuid ? prior : null;
     const idx = loadAccounts();
-    const account = idx.accounts.find((a) => a.organizationUuid === org);
+    const account = idx.accounts.find((a) => a.accountUuid === accountUuid);
     const mu = loadModelUsage();
-    const muSame = mu && mu.org === org ? mu : null;
+    const muSame = mu && mu.account === accountUuid ? mu : null;
     const carriedRows = muSame?.perModel ?? {};
     const sampledAt = muSame?.sampledAt ?? muSame?.ts;
     if (limit.kind === "model") {
@@ -328,14 +337,14 @@ export async function recordEnforcedLimit(input: { limit: EnforcedClass; org: st
       const resetsAt = limit.resetsAt ?? nextWeeklyReset(knownReset ?? weeklyReset, now);
       saveModelUsage({
         perModel: { ...carriedRows, [limit.family]: { usedPercentage: 100, resetsAt } },
-        org,
+        account: accountUuid,
         ts: now,
         sampledAt: resetsAt == null ? now : sampledAt ?? now,
       });
       log("usage.enforced_limit", { kind: limit.kind, family: limit.family, resetsAt });
       return { outcome: "stamped", resetsAt };
     }
-    saveModelUsage({ perModel: carriedRows, org, ts: now, sampledAt });
+    saveModelUsage({ perModel: carriedRows, account: accountUuid, ts: now, sampledAt });
     if (account && limit.resetsAt != null) {
       account.enforcedUntil = limit.resetsAt;
       saveAccounts(idx);
@@ -346,7 +355,7 @@ export async function recordEnforcedLimit(input: { limit: EnforcedClass; org: st
     writeUsage({
       fiveHour: limit.kind === "session" ? window : carrier.fiveHour,
       sevenDay: limit.kind === "weekly" ? window : carrier.sevenDay,
-      org,
+      account: accountUuid,
       ts: now,
       model: carrier.model,
     });
@@ -357,21 +366,21 @@ export async function recordEnforcedLimit(input: { limit: EnforcedClass; org: st
 
 const STAGE_CEILING_TICKS = [MAX_CHECK_DELAY_TICKS, 3, 2];
 
-export function checkDelayMs(input: { cfg: Config; org: string | null; now: number; decision: SwapDecision }): number {
-  const { cfg, org, now, decision } = input;
+export function checkDelayMs(input: { cfg: Config; account: string | null; now: number; decision: SwapDecision }): number {
+  const { cfg, account, now, decision } = input;
   const tick = cfg.policy.checkIntervalMs;
   const max = maxCheckDelayMs(cfg);
   if (decision.waitUntil !== undefined) return Math.min(max, Math.max(tick, decision.waitUntil - now));
   const swapAt = loadLastSwapAt();
   if (swapAt != null && now - swapAt < POST_SWAP_COOLDOWN_MS) return swapAt + POST_SWAP_COOLDOWN_MS - now;
   const snap = loadUsageSnapshot();
-  if (!org || !snap || !usageFresh(snap.state, snap.at, org, cfg.policy.usagePollTtlMs, now)) return 3 * tick;
+  if (!account || !snap || !usageFresh(snap.state, snap.at, account, cfg.policy.usagePollTtlMs, now)) return 3 * tick;
   const accounts = loadAccounts().accounts;
-  const u = freshest(snap.state, snap.at, accounts.find((a) => a.organizationUuid === org)) ?? { ...snap.state, ts: snap.at };
+  const u = freshest(snap.state, snap.at, accounts.find((a) => a.accountUuid === account)) ?? { ...snap.state, ts: snap.at };
   const mu = loadModelUsage();
-  const muSame = mu && mu.org === org ? mu : null;
+  const muSame = mu && mu.account === account ? mu : null;
   const families = gatedFamilies(u.model, cfg.policy.switchModels);
-  const bars = effectiveBars(cfg, { accounts: overlayLive(accounts, u, muSame, org), now, switchFamilies: families });
+  const bars = effectiveBars(cfg, { accounts: overlayLive(accounts, u, muSame, account), now, switchFamilies: families });
   const heads = [
     bars.session - liveUsed({ window: u.fiveHour, windowMs: FIVE_HOURS_MS, sampledAt: u.ts, now }),
     bars.weekly - liveUsed({ window: u.sevenDay, windowMs: WEEK_MS, sampledAt: u.ts, now }),

package/src/lib/http.ts

@@ -1,25 +1,52 @@
 import ky from "ky";
 import { z } from "zod";
 
-const ErrorBodySchema = z.looseObject({
-  error: z.string().optional(),
+const OAuthErrorBodySchema = z.looseObject({
+  error: z.string(),
   error_description: z.string().optional(),
+});
+
+const NestedErrorBodySchema = z.looseObject({
+  error: z.looseObject({ type: z.string().optional(), message: z.string().optional() }),
+  request_id: z.string().nullish(),
+});
+
+const PlainErrorBodySchema = z.looseObject({
   detail: z.string().optional(),
   message: z.string().optional(),
 });
 
+const ErrorDetailSchema = z.object({ code: z.string().nullable(), fields: z.array(z.string()) });
+type ErrorDetail = z.infer<typeof ErrorDetailSchema>;
+
+function parseErrorBody(text: string): ErrorDetail | null {
+  let json: unknown;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  const oauth = OAuthErrorBodySchema.safeParse(json);
+  if (oauth.success) return { code: oauth.data.error, fields: [oauth.data.error, oauth.data.error_description ?? ""] };
+  const nested = NestedErrorBodySchema.safeParse(json);
+  if (nested.success) {
+    const requestId = nested.data.request_id ? ` (${nested.data.request_id})` : "";
+    return { code: nested.data.error.type ?? null, fields: [nested.data.error.type ?? "", (nested.data.error.message ?? "") + requestId] };
+  }
+  const plain = PlainErrorBodySchema.safeParse(json);
+  if (plain.success) return { code: null, fields: [plain.data.detail ?? "", plain.data.message ?? ""] };
+  return null;
+}
+
+export function oauthErrorCode(input: { text: string }): string | null {
+  return parseErrorBody(input.text)?.code ?? null;
+}
+
 export function safeErrorDetail(input: { text: string }): string {
-  const parsed = ErrorBodySchema.safeParse((() => {
-    try {
-      return JSON.parse(input.text);
-    } catch {
-      return null;
-    }
-  })());
-  if (!parsed.success) return "(unparsable error body withheld)";
-  const fields = [parsed.data.error, parsed.data.error_description, parsed.data.detail, parsed.data.message];
-  const detail = fields.filter((field): field is string => field != null && field.length > 0).join(": ");
-  return detail.length > 0 ? detail.slice(0, 200) : "(no error detail)";
+  const body = parseErrorBody(input.text);
+  if (!body) return `(unrecognized error body, ${input.text.length} bytes, content withheld)`;
+  const detail = body.fields.filter((field) => field.length > 0).join(": ");
+  return detail.length > 0 ? detail.slice(0, 240) : "(no error detail)";
 }
 
 export const http = ky.create({

package/src/lib/log.ts

@@ -21,6 +21,7 @@ export function log(event: string, fields: Record<string, unknown> = {}): void {
   let line = "";
   try {
     line = Object.entries(fields)
+      .filter(([, v]) => v !== undefined)
       .map(([k, v]) => {
         const str = z.string().safeParse(v);
         return `${k}=${redact(str.success ? str.data : JSON.stringify(v))}`;

package/src/lib/oauth.ts

@@ -1,11 +1,11 @@
 import { z } from "zod";
-import { http, safeErrorDetail } from "./http.ts";
-import { RefreshResponseSchema, RolesResponseSchema, type OAuthCreds, type RolesResponse } from "./types.ts";
+import { http, oauthErrorCode, safeErrorDetail } from "./http.ts";
+import { ProfileResponseSchema, RefreshResponseSchema, TokenIdentitySchema, type OAuthCreds, type TokenIdentity } from "./types.ts";
 
 const EnvOverrideSchema = z.string().min(1).optional().catch(undefined);
 const TOKEN_URL = EnvOverrideSchema.parse(process.env.TOKENMAXXING_OAUTH_TOKEN_URL) ?? "https://platform.claude.com/v1/oauth/token";
 const CLIENT_ID = EnvOverrideSchema.parse(process.env.TOKENMAXXING_OAUTH_CLIENT_ID) ?? "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
-const ROLES_URL = EnvOverrideSchema.parse(process.env.TOKENMAXXING_OAUTH_ROLES_URL) ?? "https://api.anthropic.com/api/oauth/claude_cli/roles";
+const PROFILE_URL = EnvOverrideSchema.parse(process.env.TOKENMAXXING_OAUTH_PROFILE_URL) ?? "https://api.anthropic.com/api/oauth/profile";
 
 const DEFAULT_SCOPES = [
   "user:profile",
@@ -22,6 +22,17 @@ export class InvalidGrantError extends Error {
   }
 }
 
+export class RefreshRejectedError extends Error {
+  constructor(public readonly status: number, public readonly detail: string) {
+    super(`token refresh rejected (HTTP ${status}): ${detail}`);
+    this.name = "RefreshRejectedError";
+  }
+}
+
+export function isDeadCredential(creds: OAuthCreds): boolean {
+  return creds.refreshToken === "" || creds.accessToken === "";
+}
+
 export async function refreshCredential(creds: OAuthCreds, now = Date.now()): Promise<OAuthCreds> {
   const scope = (creds.scopes?.length ? creds.scopes : DEFAULT_SCOPES).join(" ");
   const body = {
@@ -43,10 +54,10 @@ export async function refreshCredential(creds: OAuthCreds, now = Date.now()): Pr
 
   const text = await res.text();
   if (!res.ok) {
-    if (res.status === 400 && /invalid_grant/.test(text)) {
-      throw new InvalidGrantError(safeErrorDetail({ text }));
-    }
-    throw new Error(`token refresh failed (HTTP ${res.status}): ${safeErrorDetail({ text })}`);
+    const detail = safeErrorDetail({ text });
+    if (res.status === 400 && oauthErrorCode({ text }) === "invalid_grant") throw new InvalidGrantError(detail);
+    if (res.status >= 400 && res.status < 500) throw new RefreshRejectedError(res.status, detail);
+    throw new Error(`token refresh failed (HTTP ${res.status}): ${detail}`);
   }
 
   const parsed = RefreshResponseSchema.safeParse((() => {
@@ -75,20 +86,29 @@ export function isAccessTokenExpiring(creds: OAuthCreds, skewMs = 120_000, now =
   return !creds.expiresAt || creds.expiresAt - now <= skewMs;
 }
 
-export async function fetchTokenOrg(accessToken: string): Promise<RolesResponse> {
+export async function fetchTokenIdentity(accessToken: string): Promise<TokenIdentity> {
   let res: Response;
   try {
-    res = await http.get(ROLES_URL, {
-      headers: { Authorization: `Bearer ${accessToken}`, "anthropic-beta": "oauth-2025-04-20" },
+    res = await http.get(PROFILE_URL, {
+      headers: { Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
     });
   } catch (e) {
-    throw new Error(`roles endpoint unreachable: ${e instanceof Error ? e.message : String(e)}`);
+    throw new Error(`profile endpoint unreachable: ${e instanceof Error ? e.message : String(e)}`);
   }
   const text = await res.text();
-  if (!res.ok) throw new Error(`roles check failed (HTTP ${res.status}): ${safeErrorDetail({ text })}`);
-  const parsed = RolesResponseSchema.safeParse((() => {
+  if (!res.ok) throw new Error(`identity check failed (HTTP ${res.status}): ${safeErrorDetail({ text })}`);
+  const parsed = ProfileResponseSchema.safeParse((() => {
     try { return JSON.parse(text); } catch { return null; }
   })());
-  if (!parsed.success) throw new Error(`roles endpoint returned an unrecognized body (${text.length} bytes, withheld)`);
-  return parsed.data;
+  if (!parsed.success) throw new Error(`profile endpoint returned an unrecognized body (${text.length} bytes, withheld)`);
+  return TokenIdentitySchema.parse({
+    accountUuid: parsed.data.account.uuid,
+    email: parsed.data.account.email ?? null,
+    organizationUuid: parsed.data.organization.uuid,
+    organizationName: parsed.data.organization.name ?? null,
+  });
+}
+
+export function describeIdentity(id: TokenIdentity): string {
+  return `${id.email ?? id.organizationName ?? "unknown"} (account ${id.accountUuid.slice(0, 8)})`;
 }

package/src/lib/sample.ts

@@ -4,9 +4,9 @@ import { z } from "zod";
 import { readItem, writeItem, deleteItem, liveTarget, parkedTarget, isolatedTarget, claudeAiOauthOnly, mergeIntoLive } from "./credstore.ts";
 import { credItemFor, paths } from "./paths.ts";
 import { withClaudeRefreshLock } from "./claudelock.ts";
-import { refreshCredential, isAccessTokenExpiring, fetchTokenOrg, InvalidGrantError } from "./oauth.ts";
+import { refreshCredential, isAccessTokenExpiring, isDeadCredential, fetchTokenIdentity, describeIdentity, InvalidGrantError } from "./oauth.ts";
 import { FullUsageSchema, pingSession, probeUsage } from "./usage.ts";
-import { CredentialBlobSchema, type Account, type OAuthCreds, type RolesResponse } from "./types.ts";
+import { CredentialBlobSchema, type Account, type OAuthCreds, type TokenIdentity } from "./types.ts";
 
 const SampleOutcomeSchema = z.discriminatedUnion("ok", [
   z.object({ ok: z.literal(true), usage: FullUsageSchema, pingError: z.string().optional(), pingRejected: z.boolean().optional() }),
@@ -22,14 +22,14 @@ const IdentityCheckSchema = z.discriminatedUnion("status", [
 type IdentityCheck = z.infer<typeof IdentityCheckSchema>;
 
 async function checkIdentity(creds: OAuthCreds, account: Account): Promise<IdentityCheck> {
-  let org: RolesResponse;
+  let identity: TokenIdentity;
   try {
-    org = await fetchTokenOrg(creds.accessToken);
+    identity = await fetchTokenIdentity(creds.accessToken);
   } catch (e) {
     return { status: "unavailable", reason: `credential identity check failed: ${e instanceof Error ? e.message : String(e)}` };
   }
-  if (org.organization_uuid === account.organizationUuid) return { status: "match" };
-  return { status: "mismatch", reason: `credential actually belongs to ${org.organization_name} (org ${org.organization_uuid.slice(0, 8)})` };
+  if (identity.accountUuid === account.accountUuid) return { status: "match" };
+  return { status: "mismatch", reason: `credential actually belongs to ${describeIdentity(identity)}` };
 }
 
 function refreshPlanFields(account: Account, creds: OAuthCreds): void {
@@ -48,22 +48,38 @@ export async function probeParkedUsage(account: Account, opts: { ping?: boolean
   } catch (e) {
     return { ok: false, reason: `parked credential unreadable (${(e instanceof Error ? e.message : String(e)).slice(0, 80)}) - run \`tokenmaxxing auth\`` };
   }
+  if (isDeadCredential(creds)) {
+    account.needsReauth = true;
+    return { ok: false, reason: "parked credential was cleared after a failed refresh - re-auth with `tokenmaxxing auth`" };
+  }
 
   const liveRaw = await readItem(liveTarget());
   if (liveRaw != null) {
-    let liveOrg: string;
+    let liveCreds: OAuthCreds;
     try {
-      const liveCreds = CredentialBlobSchema.parse(JSON.parse(liveRaw)).claudeAiOauth;
-      liveOrg = (await fetchTokenOrg(liveCreds.accessToken)).organization_uuid;
+      liveCreds = CredentialBlobSchema.parse(JSON.parse(liveRaw)).claudeAiOauth;
     } catch (e) {
-      return { ok: false, reason: `cannot verify the live credential's owner (${(e instanceof Error ? e.message : String(e)).slice(0, 80)}) - refusing to sample a possibly-live account` };
+      return { ok: false, reason: `cannot read the live credential (${(e instanceof Error ? e.message : String(e)).slice(0, 80)}) - refusing to sample a possibly-live account` };
     }
-    if (liveOrg === account.organizationUuid) {
-      return { ok: false, reason: "this account holds the LIVE login (active label drifted) - run `tokenmaxxing switch` to reconcile" };
+    if (!isDeadCredential(liveCreds)) {
+      let liveAccount: string;
+      try {
+        liveAccount = (await fetchTokenIdentity(liveCreds.accessToken)).accountUuid;
+      } catch (e) {
+        return { ok: false, reason: `cannot verify the live credential's owner (${(e instanceof Error ? e.message : String(e)).slice(0, 80)}) - refusing to sample a possibly-live account` };
+      }
+      if (liveAccount === account.accountUuid) {
+        return { ok: false, reason: "this account holds the LIVE login (active label drifted) - run `tokenmaxxing switch` to reconcile" };
+      }
     }
   }
 
   if (isAccessTokenExpiring(creds, 300_000)) {
+    const owner = await checkIdentity(creds, account);
+    if (owner.status === "mismatch") {
+      account.needsReauth = true;
+      return { ok: false, reason: `${owner.reason} - refusing to spend another account's grant; re-auth with \`tokenmaxxing auth\`` };
+    }
     try {
       creds = await refreshCredential(creds);
       await writeItem(backup, JSON.stringify({ claudeAiOauth: creds }));
@@ -122,11 +138,13 @@ export async function ensureLiveTokenFresh(): Promise<void> {
   } catch {
     return;
   }
+  if (isDeadCredential(creds)) throw new InvalidGrantError("live credential was cleared after a failed refresh");
   if (!isAccessTokenExpiring(creds, 300_000)) return;
   await withClaudeRefreshLock(async (lock) => {
     const raw2 = await readItem(liveTarget());
     if (raw2 == null) throw new Error("live credential vanished while waiting for the refresh lock");
     const current = CredentialBlobSchema.parse(JSON.parse(raw2)).claudeAiOauth;
+    if (isDeadCredential(current)) throw new InvalidGrantError("live credential was cleared after a failed refresh");
     const next = isAccessTokenExpiring(current, 300_000) ? await refreshCredential(current) : current;
     if (next === current) return;
     if (lock.compromised()) throw new Error("refresh lock compromised mid-refresh - discarding the live rewrite");

package/src/lib/swap.ts

@@ -1,6 +1,6 @@
 import { clearDepletedWait, clearNextCheck, clearUsageSnapshots, loadAccounts, saveAccounts, saveLastSwapAt } from "./state.ts";
 import { readItem, writeItem, liveTarget, parkedTarget, claudeAiOauthOnly, mergeIntoLive } from "./credstore.ts";
-import { refreshCredential, isAccessTokenExpiring, fetchTokenOrg, InvalidGrantError } from "./oauth.ts";
+import { refreshCredential, isAccessTokenExpiring, isDeadCredential, fetchTokenIdentity, describeIdentity, InvalidGrantError, RefreshRejectedError } from "./oauth.ts";
 import { swapOAuthAccount } from "./claudejson.ts";
 import { withClaudeRefreshLock } from "./claudelock.ts";
 import { log } from "./log.ts";
@@ -21,7 +21,10 @@ export async function performSwap(target: Account): Promise<void> {
   if (preLive) {
     liveCreds = parseBlob(preLive).claudeAiOauth;
     expectedLiveToken = liveCreds.accessToken;
-    if (isAccessTokenExpiring(liveCreds, 60_000)) {
+    if (isDeadCredential(liveCreds)) {
+      liveCreds = null;
+      log("swap.live_dead", {});
+    } else if (isAccessTokenExpiring(liveCreds, 60_000)) {
       try {
         await withClaudeRefreshLock(async (lock) => {
           const raw2 = await readItem(liveTarget());
@@ -41,11 +44,11 @@ export async function performSwap(target: Account): Promise<void> {
       }
     }
     if (liveCreds != null) {
-      const org = await fetchTokenOrg(liveCreds.accessToken);
-      liveOwner = idx.accounts.find((a) => a.organizationUuid === org.organization_uuid) ?? null;
+      const identity = await fetchTokenIdentity(liveCreds.accessToken);
+      liveOwner = idx.accounts.find((a) => a.accountUuid === identity.accountUuid) ?? null;
       if (!liveOwner) {
         throw new Error(
-          `live credential belongs to ${org.organization_name} (org ${org.organization_uuid.slice(0, 8)}), which is not in the pool - refusing to swap over it; import it first with \`tokenmaxxing add\``,
+          `live credential belongs to ${describeIdentity(identity)}, which is not in the pool - refusing to swap over it; import it first with \`tokenmaxxing add\``,
         );
       }
       if (liveOwner.accountUuid !== idx.activeAccountUuid) {
@@ -62,14 +65,23 @@ export async function performSwap(target: Account): Promise<void> {
   if (!selfSwap) {
     const parkedRaw = await readItem(parkedTarget(target.keychainItem));
     if (!parkedRaw) throw new Error(`no parked credential for ${target.email}`);
+    const parked = parseBlob(parkedRaw).claudeAiOauth;
+    const markDead = (detail: string): InvalidGrantError => {
+      const t = idx.accounts.find((a) => a.accountUuid === target.accountUuid);
+      if (t) { t.needsReauth = true; saveAccounts(idx); }
+      log("swap.invalid_grant", { account: target.accountUuid.slice(0, 8), detail });
+      return new InvalidGrantError(detail);
+    };
+    if (isDeadCredential(parked)) throw markDead("parked credential was cleared after a failed refresh - re-auth with `tokenmaxxing auth`");
+    const parkedOwner = await fetchTokenIdentity(parked.accessToken).catch(() => null);
+    if (parkedOwner != null && parkedOwner.accountUuid !== target.accountUuid) {
+      throw markDead(`parked credential belongs to ${describeIdentity(parkedOwner)} - refusing to spend another account's grant; re-auth with \`tokenmaxxing auth ${target.label}\``);
+    }
     try {
-      fresh = await refreshCredential(parseBlob(parkedRaw).claudeAiOauth);
+      fresh = await refreshCredential(parked);
     } catch (e) {
-      if (e instanceof InvalidGrantError) {
-        const t = idx.accounts.find((a) => a.accountUuid === target.accountUuid);
-        if (t) { t.needsReauth = true; saveAccounts(idx); }
-        log("swap.invalid_grant", { account: target.accountUuid.slice(0, 8) });
-      }
+      if (e instanceof InvalidGrantError) throw markDead(e.detail);
+      if (e instanceof RefreshRejectedError) log("swap.refresh_rejected", { account: target.accountUuid.slice(0, 8), status: e.status, detail: e.detail });
       throw e;
     }
     await writeItem(parkedTarget(target.keychainItem), JSON.stringify({ claudeAiOauth: fresh }));
@@ -105,8 +117,12 @@ export async function performSwap(target: Account): Promise<void> {
   log("swap.done", { account: target.accountUuid.slice(0, 8), email: target.email });
 }
 
-export async function chooseAndSwap(ctx: PickCtx): Promise<Account | null> {
-  const tried = new Set<string>();
+export function isSkippableSwapError(e: unknown): boolean {
+  return e instanceof InvalidGrantError || e instanceof RefreshRejectedError;
+}
+
+export async function chooseAndSwap(ctx: PickCtx, exclude: ReadonlySet<string> = new Set()): Promise<Account | null> {
+  const tried = new Set<string>(exclude);
   while (true) {
     const idx = loadAccounts();
     const candidates = idx.accounts.filter((a) => !tried.has(a.accountUuid));
@@ -117,7 +133,7 @@ export async function chooseAndSwap(ctx: PickCtx): Promise<Account | null> {
       await performSwap(best);
       return best;
     } catch (e) {
-      if (e instanceof InvalidGrantError) continue;
+      if (isSkippableSwapError(e)) continue;
       throw e;
     }
   }

package/src/lib/types.ts

@@ -42,7 +42,7 @@ const ModelInfoSchema = z.object({ id: z.string(), display: z.string() });
 export type ModelInfo = z.infer<typeof ModelInfoSchema>;
 
 export const UsageStateSchema = UsageWindowsSchema.extend({
-  org: z.string().nullable(),
+  account: z.string().nullable(),
   ts: z.number(),
   model: ModelInfoSchema.nullable().default(null),
 });
@@ -50,7 +50,7 @@ export type UsageState = z.infer<typeof UsageStateSchema>;
 
 export const ModelUsageStateSchema = z.object({
   perModel: z.record(z.string(), UsageWindowSchema).default({}),
-  org: z.string().nullable(),
+  account: z.string().nullable(),
   ts: z.number(),
   sampledAt: z.number().optional(),
 });
@@ -87,7 +87,7 @@ export type AccountsIndex = z.infer<typeof AccountsIndexSchema>;
 export const NextCheckSchema = z.object({ dueAt: z.number(), ts: z.number() });
 
 export const EnforcedLimitSchema = z.object({
-  org: z.string(),
+  account: z.string(),
   family: z.string().nullable(),
   resetsAt: z.number().nullable(),
   windowMs: z.number(),
@@ -153,7 +153,6 @@ export const RateLimitsStdinSchema = z.looseObject({
     })
     .optional(),
   model: z.looseObject({ id: z.string().optional(), display_name: z.string().optional() }).optional(),
-  organizationUuid: z.string().optional(),
 });
 
 export const StatusLineStdinSchema = RateLimitsStdinSchema.extend({
@@ -204,11 +203,18 @@ export const RefreshResponseSchema = z.looseObject({
   token_type: z.string().optional(),
 });
 
-export const RolesResponseSchema = z.looseObject({
-  organization_uuid: z.string(),
-  organization_name: z.string(),
+export const ProfileResponseSchema = z.looseObject({
+  account: z.looseObject({ uuid: z.string(), email: z.string().nullish() }),
+  organization: z.looseObject({ uuid: z.string(), name: z.string().nullish() }),
+});
+
+export const TokenIdentitySchema = z.object({
+  accountUuid: z.string(),
+  email: z.string().nullable(),
+  organizationUuid: z.string(),
+  organizationName: z.string().nullable(),
 });
-export type RolesResponse = z.infer<typeof RolesResponseSchema>;
+export type TokenIdentity = z.infer<typeof TokenIdentitySchema>;
 
 const CodexTokensSchema = z.looseObject({
   id_token: z.string(),