tokenmaxxing 1.163.0 → 1.164.0

package/DESIGN.md

@@ -1,6 +1,6 @@
 # tokenmaxxing - design
 
-Automatic Claude Code account switching. You run `claude` exactly as always; every session starts on the pooled account with the most session-window headroom per running session, and when the account a session runs on crosses its bar (**90%** of the 5h session window or **98%** of a weekly window by default), tokenmaxxing resumes that session on a fresher account at a safe turn boundary. Works across many concurrent sessions at once, each on its own account; a fully depleted pool queues sessions first come first served onto reset targets (at most eight waiters per account; overflow waits for the next reset with room up to twice `policy.maxWaitMs` out, joining the least-crowded reset only when the horizon is full), pauses each one with a countdown, and auto-resumes at its assigned reset (further out than twice `policy.maxWaitMs`, the session stays put rather than parking for hours).
+Automatic Claude Code account switching. You run `claude` exactly as always; every session starts on the pooled account with the most session-window headroom per running session, and when the account a session runs on crosses its bar (**90%** of the 5h session window or **98%** of a weekly window by default), tokenmaxxing resumes that session on a fresher account at a safe turn boundary. Works across many concurrent sessions at once, each on its own account; a fully depleted pool assigns sessions first come first served to reset targets (at most eight sessions per account; overflow takes the next reset with room up to twice `policy.maxWaitMs` out, joining the least-crowded reset only when the horizon is full), stops each session with its assigned reset named, and holds no process open until that reset, so a harness closes the run and the session resumes when it is started again after the reset (further out than twice `policy.maxWaitMs`, a running session stays put).
 
 > Scope: **Claude Code first (macOS + Linux, the latter since 2026-07-09).** Codex support landed in 0.13.0 (2026-07-16) with its own parallel state and supervisor; since 1.35.0 both run on one engine. Codex's verified internals live in `.claude/rules/codex.md`.
 >
@@ -30,7 +30,7 @@ It is a process manager only - spawn with inherited stdio (stdin through a relay
 - A `claude` **supervisor** on your PATH ahead of the real binary (`~/.config/tokenmaxxing/bin/claude`) - you invoke it identically; a `claude` shell function or alias would shadow it, and `doctor` warns about one.
 - Five `~/.claude/settings.json` entries (merged - other settings keys are preserved, but the `statusLine` slot is taken over): the tokenmaxxing `statusLine` renderer (native since 2026-07-11; it also tees usage), a `subagentStatusLine` (per-subagent rows in the agents panel), a `Stop` hook, a `StopFailure` hook, a `SessionStart` hook.
 - **`~/.config/tokenmaxxing/`** - the single home for config and state:
-  - `config.json` - SPARSE overrides only (thresholds.session/weekly/accounts, claudeBin/codexBin/grokBin/piBin pins, policy.*); defaults apply at read time, `xx config` prints the path and the effective values, and edits happen in an editor.
+  - `config.json` - SPARSE overrides only (thresholds.session/weekly/accounts, claudeBin/codexBin/grokBin/museBin/piBin pins, policy.*); defaults apply at read time, `xx config` prints the path and the effective values, and edits happen in an editor.
   - `accounts.json` - non-secret index `{id, label, email, tier, addedAt, windows, lastUsageAt, lastProbeAt, probeFails, storeFails, usageRetryAt, enforcedUntil, needsReauth, oauthAccount}` (each cached window carries its name, duration, reset, and sample time; the same shape serves the Codex pool as `codex-accounts.json`). Neither index names an active account: the schema is `{version, accounts}`, and an older file that still carries `activeId` loads and drops the key on the next save.
   - `stores/<uuid8>/` - one Claude Code credential store per pooled account (see below).
   - `codex-stores/<uuid8>/` - one Codex credential store per pooled account: its `auth.json`, with everything else symlinked to the shared `~/.codex` so sessions, history, and config stay shared and `codex resume` works across stores.
@@ -40,7 +40,7 @@ It is a process manager only - spawn with inherited stdio (stdin through a relay
   - `wait-queue.json` - the claims of supervised sessions that are moving or waiting (`{sessionId, accountId, at, waitUntil}`), naming the account each relaunches on: placement counts a claimed session there, and at most eight sessions wait on one account; a session that arrives when every reset within `policy.maxWaitMs` is full waits for the next reset with room up to twice `policy.maxWaitMs` out, joining the least-crowded reset when the horizon is full.
   - `bin/claude` and `bin/codex` - the supervisors, beside the `tokenmaxxing` and `xx` entry points; `bin/pi` after `init --pi`.
   - `pi-stores/claude/<uuid8>/` and `pi-stores/codex/<uuid8>/` - one pi store per pooled account that has a pi login: the account's own pi grant in `auth.json`, everything else symlinked to the shared `~/.pi/agent` ([pi support](docs/content/docs/pi.mdx)).
-  - `sessions/<sid>.json`, `onboard/`, `hub-key`, `update.json`, `spawnrate.json`, `tokenmaxxing.log`, the codex `codex-onboard/`, `codex-respawn/`, and `codex-live/`, and the `grok-*` state of the status-only grok pool: the full table is in [State directory layout](docs/content/docs/state-directory.mdx).
+  - `sessions/<sid>.json`, `onboard/`, `hub-key`, `update.json`, `spawnrate.json`, `tokenmaxxing.log`, the codex `codex-onboard/`, `codex-respawn/`, and `codex-live/`, and the `grok-*` and `muse-*` state of the status-only grok and Muse Code pools: the full table is in [State directory layout](docs/content/docs/state-directory.mdx).
 - Per-account **credential stores** follow the platform's Claude Code store: macOS = a login-keychain item keyed by the store path (never plaintext on disk); Linux = a 0600 `.credentials.json` inside the 0700 store directory (the same plaintext model claude itself uses - its Linux build has no keyring path at all, binary-verified 2.1.205). One `credstore` facade dispatches on a `{kind: keychain|file}` target; call sites never branch on platform. tokenmaxxing writes a store once, at onboarding; Claude Code's own refresh is the only writer afterwards.
 
 - A periodic check job (`com.tokenmaxxing.check` launchd agent on macOS, `tokenmaxxing-check.timer` systemd user timer on Linux) running `tokenmaxxing check` once per tick (`policy.checkIntervalMs`, 60s by default): it runs the decision with no seat (nothing moves), folds fresh tees into the index, samples up to three accounts whose last sample attempt is oldest (the direct no-spend usage GET), deletes leftover atomic-write temp files under the state root, and on a Bun global install checks npm for a newer version once a day, so the cached figures every placement reads stay fresh.
@@ -61,8 +61,8 @@ The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limi
 3. Take the pool lock, re-check, fold every account's tee into the index, select a candidate under the switching policy from the cached figures, and verify that the target's store holds a usable credential (a store Claude Code dead-cleared flags the account for re-auth and the next candidate is tried).
 4. Write `respawn/<session-id>` (atomic temp+rename) naming the target, with `waitUntil` now for a plain move or the assigned reset when the pool is depleted. No credential is written.
 
-### 3.3 Move and depleted-pool pause (supervisor)
-The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed turn boundary, deletes the marker, resets the terminal, compacts the conversation when the marker asks for it, the old seat's record carries no live `enforcedUntil`, and `waitUntil` is not in the future (`compact: true` from the Stop and SessionStart hooks and from the supervisor's own seat watch, `false` from StopFailure: it runs `claude -p --resume <live-id> /compact` under the old seat's store, bounded at five minutes; the compaction counts only when a `compact_boundary` row lands in the transcript, because a refused compaction still exits 0, and a failure only prints why), and (when `waitUntil` is in the future, which means no pooled account has quota) skips the compaction and hands the session to the launch gate, which every launch goes through: with no account that has quota and no API key, it starts no child, claims the reset in `wait-queue.json`, shows an interruptible countdown to it, and places the session again; then it relaunches `claude --resume <live-id>` (`--session-id <live-id>` when that id has no transcript yet, because `--resume` exits with `No conversation found` for it) with `CLAUDE_SECURESTORAGE_CONFIG_DIR` set to the target's store and rewrites the session's presence. The marker file is keyed by the launch id `<sid>`; the live id inside it is the session id the supervised process runs now, which `/clear` and an in-session `/resume` change. A hook adopts a differing stdin id as the live id (`current` in `sessions/<sid>.json`) only when its own process descends, through shell processes alone, from the presence record's pid; any other differing id is a nested session and writes nothing. The resumed process reads that store cold → runs on the target account, same conversation. The `--session-id` path is the exception: the conversation has no prior turn (a `/clear` with no turn since, or a move before the first turn), so it starts with no compaction and no first prompt, and in a stream-json session the relay replays the harness lines the killed child received: `user` lines and the `initialize` and session-state control requests in `REPLAYED_REQUESTS`; every other control request gets an error `control_response` on stdout, because a repeat could run its effect twice, and the `control_response` answers to the killed child's own requests are dropped. A first launch with `--resume <id>` takes the same path when the supervisor holds `sessions/<id>.json` for that id and no project directory holds its transcript. On the `--resume` path the relaunch submits a first prompt that names the move (and the compaction, when it landed). After a Stop move the previous turn had finished, so the prompt asks Claude to end the turn without restating it, and to relaunch any background Bash task, Monitor, or Workflow run that turn waited on, because the move ended it. After any other move the prompt asks Claude to continue the task, says the restart ended every background Bash task, Monitor, and Workflow run the session started, and asks Claude to relaunch what the task still needs; a SessionStart move is in that group because a prompt sent inside the marker poll window can already have started on the old seat. The conversation goes on without a keystroke: in a terminal session it is the positional prompt after the session id; in a stream-json session (`--input-format stream-json`, where the binary ignores a positional prompt) the supervisor owns stdin, relays the harness's lines to the child through a pipe, sends the new process the latest `initialize` and session-state control requests the harness sent, because the Agent SDK sends `initialize` once per query and it carries the appended system prompt, the hooks, and the SDK MCP servers, and then writes the prompt as the first `user` line. In a terminal session the supervisor's own notices go to stderr. In a stream-json session (`--output-format stream-json`, read from the effective flags like the relay) there is no terminal and no statusline, so the supervisor writes each notice (the compaction and its failure, the move, the depleted-pool wait with its resume time, the resume) to stdout as a `system` line of subtype `informational` and level `warning`, the shape Claude Code emits for its own print-mode notices, which the harness renders in the conversation while the stream stays parseable; the per-second countdown ticks stay terminal-only, and the supervisor writes only while no child is running. Before the first notice of a move it writes a `task_notification` line with `status: "stopped"` and `reason: "worker_restart"` for each task the old child started on stdout (`task_started`) and did not end there (a `task_notification`, or a `task_updated` to `completed`, `failed`, or `killed`), the line Claude Code writes when a restarted process finds a task orphaned, because the move ended those tasks and a harness that tracks them from the stream, as T3 Code does, otherwise shows them running until the session exits. The `SessionStart` hook (every source) re-runs the decision before the first turn and writes the same marker if the seat is already over its bar or the pool is depleted. The supervisor also watches its own seat every ten seconds while the child runs (account record plus tee, the same bars) and writes the marker itself when the seat is at or over a bar, so a move never depends on a hook firing: a harness session between turns whose background workflow burns the window, or a subagent refusal that stamped the wall, is moved within seconds. SIGTERM to the supervisor is forwarded to the child and the supervisor exits after it, so a harness that stops the wrapper (the Agent SDK does) never leaves an orphaned claude on the old seat. A marker whose `launchedAt` does not match the running child is discarded, and after a Ctrl-C on the countdown a later marker whose `waitUntil` falls inside the skipped wait is ignored. A marker that fails to parse is never deleted and never treated as absent: the supervisor stops the child, restores the terminal, and exits naming the marker path. In a stream-json session that fatal, the wrap-depth abort, the wrapper-chain abort, and a failed presence write also go to stdout as the same `informational`/`warning` line.
+### 3.3 Move and depleted-pool stop (supervisor)
+The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed turn boundary, deletes the marker, resets the terminal, compacts the conversation when the marker asks for it, the old seat's record carries no live `enforcedUntil`, and `waitUntil` is not in the future (`compact: true` from the Stop and SessionStart hooks and from the supervisor's own seat watch, `false` from StopFailure: it runs `claude -p --resume <live-id> /compact` under the old seat's store, bounded at five minutes; the compaction counts only when a `compact_boundary` row lands in the transcript, because a refused compaction still exits 0, and a failure only prints why), and (when `waitUntil` is in the future, which means no pooled account has quota) skips the compaction and hands the session to the launch gate, which every launch goes through: with no account that has quota and no API key, it starts no child, writes one notice naming the assigned reset, releases the session's claim, and exits, and a later resume places the session again; with an account that has quota it relaunches `claude --resume <live-id>` (`--session-id <live-id>` when that id has no transcript yet, because `--resume` exits with `No conversation found` for it) with `CLAUDE_SECURESTORAGE_CONFIG_DIR` set to the target's store and rewrites the session's presence. The marker file is keyed by the launch id `<sid>`; the live id inside it is the session id the supervised process runs now, which `/clear` and an in-session `/resume` change. A hook adopts a differing stdin id as the live id (`current` in `sessions/<sid>.json`) only when its own process descends, through shell processes alone, from the presence record's pid; any other differing id is a nested session and writes nothing. The resumed process reads that store cold → runs on the target account, same conversation. The `--session-id` path is the exception: the conversation has no prior turn (a `/clear` with no turn since, or a move before the first turn), so it starts with no compaction and no first prompt, and in a stream-json session the relay replays the harness lines the killed child received: `user` lines and the `initialize` and session-state control requests in `REPLAYED_REQUESTS`; every other control request gets an error `control_response` on stdout, because a repeat could run its effect twice, and the `control_response` answers to the killed child's own requests are dropped. A first launch with `--resume <id>` takes the same path when the supervisor holds `sessions/<id>.json` for that id and no project directory holds its transcript. On the `--resume` path the relaunch submits a first prompt that names the move (and the compaction, when it landed). After a Stop move the previous turn had finished, so the prompt asks Claude to end the turn without restating it, and to relaunch any background Bash task, Monitor, or Workflow run that turn waited on, because the move ended it. After any other move the prompt asks Claude to continue the task, says the restart ended every background Bash task, Monitor, and Workflow run the session started, and asks Claude to relaunch what the task still needs; a SessionStart move is in that group because a prompt sent inside the marker poll window can already have started on the old seat. The conversation goes on without a keystroke: in a terminal session it is the positional prompt after the session id; in a stream-json session (`--input-format stream-json`, where the binary ignores a positional prompt) the supervisor owns stdin, relays the harness's lines to the child through a pipe, sends the new process the latest `initialize` and session-state control requests the harness sent, because the Agent SDK sends `initialize` once per query and it carries the appended system prompt, the hooks, and the SDK MCP servers, and then writes the prompt as the first `user` line. In a terminal session the supervisor's own notices go to stderr. In a stream-json session (`--output-format stream-json`, read from the effective flags like the relay) there is no terminal and no statusline, so the supervisor writes each notice (the compaction and its failure, the move, the depleted-pool stop with its reset time, the resume) to stdout as a `system` line of subtype `informational` and level `warning`, the shape Claude Code emits for its own print-mode notices, which the harness renders in the conversation while the stream stays parseable; the supervisor writes only while no child is running, except a fatal that ends the session. Before the first notice of a move it writes a `task_notification` line with `status: "stopped"` and `reason: "worker_restart"` for each task the old child started on stdout (`task_started`) and did not end there (a `task_notification`, or a `task_updated` to `completed`, `failed`, or `killed`), the line Claude Code writes when a restarted process finds a task orphaned, because the move ended those tasks and a harness that tracks them from the stream, as T3 Code does, otherwise shows them running until the session exits. The `SessionStart` hook (every source) re-runs the decision before the first turn and writes the same marker if the seat is already over its bar or the pool is depleted. The supervisor also watches its own seat every ten seconds while the child runs (account record plus tee, the same bars) and writes the marker itself when the seat is at or over a bar, so a move never depends on a hook firing: a harness session between turns whose background workflow burns the window, or a subagent refusal that stamped the wall, is moved within seconds. SIGTERM to the supervisor is forwarded to the child and the supervisor exits after it, so a harness that stops the wrapper (the Agent SDK does) never leaves an orphaned claude on the old seat. A marker whose `launchedAt` does not match the running child is discarded. A marker that fails to parse is never deleted and never treated as absent: the supervisor stops the child, restores the terminal, and exits naming the marker path. In a stream-json session that fatal, the wrap-depth abort, the wrapper-chain abort, and a failed presence write also go to stdout as the same `informational`/`warning` line.
 
 ### 3.4 Placement (supervisor, under the pool lock)
 1. Fold every account's tee into the index.
@@ -84,11 +84,11 @@ Each terminal ran the supervisor, so each has its own child `claude`, its own `-
 ---
 
 ## 5. Placement and rotation policy
-The [switching policy](docs/content/docs/switching.mdx) is one rule: under both bars, hold; at or over a bar, move to the usable account that ranks first; nothing usable, queue first come first served onto a reset target (at most eight waiters per account; overflow waits for the next reset with room) and wait for that reset. The same ranking places a session at launch; a launch onto a depleted pool takes the same target selection, counting running sessions as well as queued waiters, and waits for that reset before it starts a `claude` process.
+The [switching policy](docs/content/docs/switching.mdx) is one rule: under both bars, hold; at or over a bar, move to the usable account that ranks first; nothing usable, assign first come first served to a reset target (at most eight sessions per account; overflow takes the next reset with room), stop the session, and name that reset. The same ranking places a session at launch; a launch onto a depleted pool takes the same target selection, counting running sessions as well as assigned ones, and stops before it starts a `claude` process.
 
 - Ranking (decided by consult for #79): greatest remaining headroom to the session bar divided by the number of sessions after placement, `(bar - used) / (sessions + 1)`, then highest pace pressure (remaining percent of the binding gated per-model cap, or of the weekly aggregate for an account with no gated row, over time to its reset), then soonest weekly reset, then lowest weekly usage; unknown usage ranks last. Organization membership is not an input. Codex drops the headroom key, keeps the pace ordering and the weekly tie-breaks, and excludes accounts running in another codex session, because codex has no cross-process refresh lock and two sessions must never share a login.
 - Selection reads the cached figures only, after folding every account's tee. Each periodic check tick samples up to three accounts whose last sample attempt is oldest, skipping any attempted within the account's sample interval, over the direct no-spend usage read with the account's stored token. The interval is 15 minutes times the unused fraction of the bar closest to being reached, never under `policy.usagePollTtlMs`, and 15 minutes for an account at or over an aggregate bar or with no session or borrower on this host. Every sampler claims a read under the pool lock before it sends it, so concurrent hooks and `status` runs send an account one read. The windows are the session and weekly aggregates plus the `policy.switchModels` caps that are still under their bar, and an account with no stored aggregate gets `policy.usagePollTtlMs`. Every account is attempted about once per three ticks per pooled account, or once per its sample interval plus a tick when that is longer, and its cached figure is as fresh as its last successful attempt or its sessions' latest push. The pool lock covers only the reservation and the result write, never the usage GET. The usage endpoint rate limits each account on its own and names the time to come back in the `retry-after` of its HTTP 429; that time is stored as `usageRetryAt`, and no sampler (the tick, `status`, the seat's in-decision sample) reads the account before it. No sampler sends a read with an expired stored access token, because the endpoint answers it with 401 and, after a few, with the same 429. A sample that finds the token expired first runs `claude -p /usage --no-session-persistence --safe-mode` with the account's store set and a throwaway `CLAUDE_CONFIG_DIR`, so Claude Code refreshes the token under its own lock, and then reads with the new token; the child's output is not read. A refresh that leaves the token expired fails the sample with no read, and one that clears the store flags the account `needsReauth`.
-- The depleted pause happens at the bar, not at 100; Codex has no pause and rides its account until the server refuses it, because a running sibling cannot adopt another account without restarting.
+- The depleted stop happens at the bar, not at 100; Codex has no stop and rides its account until the server refuses it, because a running sibling cannot adopt another account without restarting.
 - Neither pool has a post-swap cooldown or a manual `switch`: a move is a respawn of one session under a fixed store, so nothing another session reads is invalidated by it, and placement at launch replaces the manual pick.
 
 The [profile](docs/content/docs/switching-profile.mdx) records observed cache rewrites across swaps and does not infer subscription quota savings.

package/README.md

@@ -2,14 +2,14 @@
 
 **Automatic Claude Code account switching.** Run `claude` exactly as you always do; each session starts on the pooled account with the most headroom per running session, and when that account nears its usage limit, tokenmaxxing resumes the session on a fresher account at a safe turn boundary - same conversation, compacted on the account it leaves and restarted under another account's credential store with a first prompt that asks Claude to continue. Works across many concurrent sessions, which spread over the pool instead of draining one account together. When the whole pool is at its limit, a session queues first come first served for a reset (at most eight sessions wait on one account; overflow waits for the next reset with room) and pauses with a countdown until its assigned reset, when that reset falls within twice `policy.maxWaitMs` (default 1h - a longer wait stays put rather than parking your terminal for hours).
 
-> **Scope:** Claude Code on macOS and Linux, plus OpenAI's Codex CLI as a second switching pool; grok as a status-only pool. It pools **subscription** accounts (Pro/Max), not API keys.
+> **Scope:** Claude Code on macOS and Linux, plus OpenAI's Codex CLI as a second switching pool; grok and Muse Code as status-only pools. It pools **subscription** accounts (Pro/Max), not API keys.
 
 ```
 $ claude
   ...you work normally; the statusline's ◆ marks this session's account...
   ↻ tokenmaxxing: compacting the conversation on me@example.com before the move...
   ↻ tokenmaxxing: moving to work@acme.com - resuming...
-  ⏳ tokenmaxxing: all accounts at their limit. Resuming on work@acme.com when it resets (Ctrl-C to resume now).
+  ⏳ tokenmaxxing: all accounts at their limit, so this session stopped. The next reset is at 18:42 KST on work@acme.com. Run `claude --resume <id>` after that to continue.
 ```
 
 ## Why
@@ -67,14 +67,15 @@ claude                  # use claude as always; each session gets its own accoun
 | `tokenmaxxing init --codex` | same for codex: log in the first account (isolated), install codex supervisor + Stop hook |
 | `tokenmaxxing init --pi` | verify and pin the real `pi` and install the `pi` supervisor, which runs pi sessions on pooled Claude and ChatGPT accounts that have a pi login |
 | `tokenmaxxing init --grok` | pool the first grok login, status-only: no supervisor, no switching |
-| `tokenmaxxing add [--codex \| --grok]` | register an additional account in that pool (isolated login, harvested once into its own store) |
-| `tokenmaxxing auth [--codex \| --grok] [sel \| --all]` | reauthenticate a pooled account in place: bare lists the pool (emails shown) and asks which; a selector targets one account and tells you the email to sign in with; `--all` walks every account that is flagged or has no usable credential in its store, one by one |
+| `tokenmaxxing init --muse` | pool the first Muse Code login, status-only: no supervisor, no switching, no usage read |
+| `tokenmaxxing add [--codex \| --grok \| --muse]` | register an additional account in that pool (isolated login, harvested once into its own store) |
+| `tokenmaxxing auth [--codex \| --grok \| --muse] [sel \| --all]` | reauthenticate a pooled account in place: bare lists the pool (emails shown) and asks which; a selector targets one account and tells you the email to sign in with; `--all` walks every account that is flagged or has no usable credential in its store, one by one |
 | `tokenmaxxing auth --pi [--codex] [sel \| --all]` | log a pooled Claude account (or a codex account with `--codex`) into pi, isolated, and keep that login as the account's pi credential after an identity check; `--all` walks every account without a pi login |
 | `tokenmaxxing status [--cached]` | every pool: accounts with 5h / weekly / per-model usage bars, live session counts, exhausted-until-reset; `--cached` renders the stored figures without sampling |
 | `tokenmaxxing config` | the config path and the effective values; edit the file in an editor, a bad value fails the next load with the field name |
 | `tokenmaxxing check` | fold fresh tees, sample up to three stale accounts, and self-update a Bun global install once a day; the periodic timer runs this every tick |
 | `tokenmaxxing doctor` | verify the install: PATH order, `claudeBin`, the five settings entries, the timer, the hub service, the credential identity of every Codex store and of every Claude store whose access token is still fresh (an expiring Claude token is reported as unverifiable, not as a failure), codex hook trust, and shell aliases that shadow `claude` |
-| `tokenmaxxing rename [--codex \| --grok] <sel> <label>` / `rm [...] <sel>` | manage a pool (one email can hold both a claude and a codex account); `rm` is refused for an account with a running supervised session |
+| `tokenmaxxing rename [--codex \| --grok \| --muse] <sel> <label>` / `rm [...] <sel>` | manage a pool (one email can hold both a claude and a codex account); `rm` is refused for an account with a running supervised session |
 | `tokenmaxxing serve` | serve the CLIProxyAPI-compatible usage API on `http://localhost:8317` (`hub.port`) so a dashboard such as T3 Code's "Add a CLIProxyAPI hub" shows the quota of every pooled Claude and Codex account; the management key is the contents of `hub-key` in the state directory, minted on the first run, and `init` runs it as a background service beside the check timer. Details in [Usage hub](docs/content/docs/hub.mdx) |
 | `tokenmaxxing uninstall [--yes]` | print the targets, then remove the shims, settings entries, codex Stop hook, check timer, hub service, and rc PATH line (accounts/stores kept); refused without `--yes` when `HOME` is the login home |
 | `--json` | machine-readable output: one JSON document on stdout for `status`, `config`, and `check` (`ok` mirrors the exit code, failures add `error`) |
@@ -146,12 +147,13 @@ pi keeps its own credential and refreshes it itself, so each pooled account gets
 ## Honest limitations
 
 - **A move restarts the process.** The session resumes the same transcript under the new account and continues on its own from a first prompt the supervisor submits, but the process restarts, which ends every background Bash task, Monitor, and Workflow run the session started (the first prompt asks Claude to relaunch what the task still needs); a bar-triggered move compacts the conversation on the old account first, so the first turn on the new account uploads the summary (the full context when the compaction does not land), while a move after a refusal re-uploads the full context once (prompt cache is org-scoped).
-- **Depleted-pause hiccup.** When the whole pool is at its limit, `claude` stops for the countdown; anything typed in that split second is lost.
+- **Depleted-stop hiccup.** When the whole pool is at its limit, `claude` stops and names the next reset; anything typed in that split second is lost, and the session continues only when you resume it after that reset.
 - **Unsupervised sessions are not moved.** A claude started outside the supervisor runs on Claude Code's own login, which tokenmaxxing never writes; when a hard limit lands there, the StopFailure hook prints the shim command that resumes the session under the supervisor.
 - **One shared identity file.** `~/.claude.json` holds one `oauthAccount` that Claude Code rewrites after whichever session refreshed last, so `/status` can show another session's email; the statusline's `◆` marks the account a session actually uses.
 - **Keychain (macOS).** The first keychain access for a new store happens inside the interactive `init`, `add`, or `auth` run, where a prompt can be answered, not inside a headless hook.
 - **Plaintext credentials (Linux).** Claude Code itself stores Linux credentials as a 0600 plaintext file; a store follows the same model.
 - **The status-only grok pool does not switch.** grok `status` shows the weekly subscription credit window, and no grok session moves.
+- **The status-only Muse Code pool does not switch and shows no usage.** Muse Code exposes no read-only quota endpoint, so every Muse Code account stays unmeasured.
 
 ## How it's built
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.163.0",
+  "version": "1.164.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts, start each session on its own account, and resume a session on a fresher account when quota fills.",
   "type": "module",
   "license": "MIT",

package/src/cli/auth.ts

@@ -13,7 +13,7 @@ import { c, count } from "./render.ts";
 import type { Account, AccountsIndex } from "../lib/types.ts";
 
 const AUTH_USAGE =
-  "usage: tokenmaxxing auth [--codex | --grok] [<email|label|id> | --all]\n       tokenmaxxing auth [--codex | --grok] --emails <email>...\n       tokenmaxxing auth --pi [--codex] [<email|label|id> | --all]";
+  "usage: tokenmaxxing auth [--codex | --grok | --muse] [<email|label|id> | --all]\n       tokenmaxxing auth [--codex | --grok | --muse] --emails <email>...\n       tokenmaxxing auth --pi [--codex] [<email|label|id> | --all]";
 const EMAILS_FLAG = "--emails";
 
 export type AuthPlan = { kind: "usage" } | { kind: "error"; message: string } | { kind: "pick" } | { kind: "targets"; ids: string[] };

package/src/cli/rename.ts

@@ -16,7 +16,7 @@ export function findAccount(accounts: Account[], selector: string): Account | un
 export async function cmdRename(p: Provider, argv: string[]): Promise<number> {
   const [selector, newLabel] = argv;
   if (!selector || !newLabel) {
-    emitError({ message: "usage: tokenmaxxing rename [--codex | --grok] <email|label|id> <new-label>", paint: plain });
+    emitError({ message: "usage: tokenmaxxing rename [--codex | --grok | --muse] <email|label|id> <new-label>", paint: plain });
     return 2;
   }
   return withLock(p.pool.lockFile, async () => {

package/src/cli/status.ts

@@ -3,9 +3,10 @@ import { creditLeft, keySessions, loadApiKeys } from "../lib/apikeys.ts";
 import { claude } from "../lib/claude.ts";
 import { codex } from "../lib/codex.ts";
 import { grok } from "../lib/grok.ts";
+import { muse } from "../lib/muse.ts";
 import { loadAccounts, loadConfig, saveAccounts } from "../lib/state.ts";
 import { withLock } from "../lib/lock.ts";
-import { codexPool, grokPool } from "../lib/paths.ts";
+import { codexPool, grokPool, musePool } from "../lib/paths.ts";
 import { barFor, bufferedUsed, earliestReset, gatedWindows, landGrant, landWindows, isExhausted, isSessionWindow, limitWindows, liveUsed, nextWeeklyReset, sessionWindow, thresholdBars, weeklyWindow } from "../lib/picker.ts";
 import type { Provider, SampleReport } from "../lib/provider.ts";
 import { usd } from "./key.ts";
@@ -52,7 +53,7 @@ type StatusApiKey = {
   sessions: number;
 };
 
-export type StatusReport = { now: number; claude: PoolReport; codex: PoolReport; grok: PoolReport; apiKeys?: StatusApiKey[] };
+export type StatusReport = { now: number; claude: PoolReport; codex: PoolReport; grok: PoolReport; muse: PoolReport; apiKeys?: StatusApiKey[] };
 
 function apiKeyReport(): StatusApiKey[] {
   const sessions = keySessions();
@@ -306,9 +307,10 @@ export async function cmdStatus(opts: { json?: boolean; cached?: boolean } = {})
   if (!json) {
     const codexPooled = loadAccounts(codexPool).accounts.length > 0;
     const grokPooled = loadAccounts(grokPool).accounts.length > 0;
+    const musePooled = loadAccounts(musePool).accounts.length > 0;
     if (claudeReport.accounts.length === 0) {
-      if (!codexPooled && !grokPooled && apiKeys.length === 0) {
-        console.log(c.dim("no accounts yet, run `tokenmaxxing init` (or `tokenmaxxing init --codex`, `--grok`)"));
+      if (!codexPooled && !grokPooled && !musePooled && apiKeys.length === 0) {
+        console.log(c.dim("no accounts yet, run `tokenmaxxing init` (or `tokenmaxxing init --codex`, `--grok`, `--muse`)"));
         return 0;
       }
       console.log(c.dim("no claude accounts (run `tokenmaxxing init` to pool claude too)"));
@@ -321,8 +323,9 @@ export async function cmdStatus(opts: { json?: boolean; cached?: boolean } = {})
   }
   const codexReport = await collect(codex, cfg, now, cached);
   const grokReport = await collect(grok, cfg, now, cached);
+  const museReport = await collect(muse, cfg, now, cached);
   if (json) {
-    const report: StatusReport = { now, claude: claudeReport, codex: codexReport, grok: grokReport, ...(apiKeys.length > 0 ? { apiKeys } : {}) };
+    const report: StatusReport = { now, claude: claudeReport, codex: codexReport, grok: grokReport, muse: museReport, ...(apiKeys.length > 0 ? { apiKeys } : {}) };
     emitJson({ ok: true, ...report });
     return 0;
   }
@@ -332,5 +335,8 @@ export async function cmdStatus(opts: { json?: boolean; cached?: boolean } = {})
   if (grokReport.accounts.length > 0) {
     renderPool(grok, grokReport, `grok  (${count({ n: grokReport.accounts.length, noun: "account" })}, status-only)`, Date.now(), cfg.policy.usagePollTtlMs);
   }
+  if (museReport.accounts.length > 0) {
+    renderPool(muse, museReport, `muse  (${count({ n: museReport.accounts.length, noun: "account" })}, status-only)`, Date.now(), cfg.policy.usagePollTtlMs);
+  }
   return 0;
 }

package/src/entries/pisupervisor.ts

@@ -14,7 +14,7 @@ import { ensurePiStoreHome, piStoreUsable } from "../lib/piauth.ts";
 import { thresholdBars, usableAt } from "../lib/picker.ts";
 import { PI_PRESENCE_PREFIX, clearPresence, livingPresences } from "../lib/presence.ts";
 import { teeObservation } from "../lib/sample.ts";
-import { countdownWait, exitStatus, loopGuardTripped, raceMarkerOrExit, recordPresenceOrStop, runPassthrough, SEAT_POLL_MS, SEAT_RETRY_MS } from "../lib/supervise.ts";
+import { clockFmt, exitStatus, loopGuardTripped, raceMarkerOrExit, recordPresenceOrStop, runPassthrough, SEAT_POLL_MS, SEAT_RETRY_MS } from "../lib/supervise.ts";
 import { saveTermios } from "../lib/tty.ts";
 import { loadAccounts, loadConfig, releaseWaitClaim } from "../lib/state.ts";
 import { gatedFamilies, modelFromFlag } from "../lib/usage.ts";
@@ -364,7 +364,6 @@ export async function runPiSupervisor(argv: string[]): Promise<number> {
 
   let respawns = 0;
   let wanted: string | null = null;
-  let overriddenUntil = 0;
   try {
     while (true) {
       const launchedAt = Date.now();
@@ -400,7 +399,7 @@ export async function runPiSupervisor(argv: string[]): Promise<number> {
             log("pisupervisor.claim_release_failed", { err: errorMessage(e) });
           }
         }
-        return { proc: spawned, seat: picked, overriddenUntil: Math.max(overriddenUntil, target?.depletedUntil ?? 0) };
+        return { proc: spawned, seat: picked, overriddenUntil: target?.depletedUntil ?? 0 };
       });
       if (launched == null) {
         await releaseClaim();
@@ -434,8 +433,13 @@ export async function runPiSupervisor(argv: string[]): Promise<number> {
         respawns++;
         const waitUntil = pending.move?.waitUntil ?? 0;
         if (waitUntil > Date.now()) {
-          if (await countdownWait(target.label, waitUntil, { stream: false, say })) overriddenUntil = waitUntil;
-        } else say(`\n\x1b[36m↻ tokenmaxxing: moving pi to ${target.label} - resuming...\x1b[0m\n`);
+          log("pisupervisor.depleted_exit", { id, pool, account: target.id.slice(0, 8), waitUntil });
+          say(`\n\x1b[36m⏳ tokenmaxxing: all accounts at their limit, so this session stopped. The next reset is at ${clockFmt.format(waitUntil)} on ${target.label}. Start pi again after that to continue.\x1b[0m\n`);
+          clearPresence({ dir: presenceDir, id });
+          await releaseClaim();
+          return 1;
+        }
+        say(`\n\x1b[36m↻ tokenmaxxing: moving pi to ${target.label} - resuming...\x1b[0m\n`);
         wanted = target.id;
         launchArgs = sessionExists(dir, sid) ? ["--session-id", sid, ...args.flags, "--", RESUME_PROMPT] : firstArgs;
         continue;

package/src/entries/supervisor.ts

@@ -14,10 +14,10 @@ import { limitWindows, liveUsed, sessionWindow, thresholdBars, usableAt, weeklyW
 import { clearPresence } from "../lib/presence.ts";
 import { readLines } from "../lib/proc.ts";
 import { teeObservation } from "../lib/sample.ts";
-import { childStdout, countdownWait, exitStatus, loopGuardTripped, raceMarkerOrExit, recordPresenceOrStop, relayStdout, runPassthrough, SEAT_POLL_MS, SEAT_RETRY_MS, type Say } from "../lib/supervise.ts";
+import { childStdout, clockFmt, exitStatus, loopGuardTripped, raceMarkerOrExit, recordPresenceOrStop, relayStdout, runPassthrough, SEAT_POLL_MS, SEAT_RETRY_MS, type Say } from "../lib/supervise.ts";
 import { saveTermios } from "../lib/tty.ts";
 import { liveSessionId, loadSessionFlags, pruneStaleSessions, saveSessionFlags, writeRespawnMarker } from "../lib/sessions.ts";
-import { loadAccounts, loadConfig, readJsonFile, releaseWaitClaim, replaceWaitClaim, writeUsage } from "../lib/state.ts";
+import { loadAccounts, loadConfig, readJsonFile, releaseWaitClaim, writeUsage } from "../lib/state.ts";
 import { gatedFamilies, modelFromFlag, parseStreamLine, scrubCredEnv } from "../lib/usage.ts";
 import { CostLineSchema, CostStateRowSchema, JsonTextSchema, RespawnMarkerSchema, type Account, type ApiKey, type Config, type ModelInfo, type SessionCost, type UsageWindows, type Window } from "../lib/types.ts";
 import { errorMessage, log } from "../lib/log.ts";
@@ -247,7 +247,6 @@ function latestSessionForCwd(): string | null {
 
 type MarkerGate = {
   launchedAt: number;
-  overriddenUntil: number;
 };
 
 function releaseClaimLocked(sid: string): void {
@@ -280,9 +279,6 @@ async function consumableMarker(marker: string, gate: MarkerGate): Promise<z.inf
   if (m.launchedAt !== undefined && m.launchedAt !== gate.launchedAt) {
     return discardMarker(marker, "supervisor.marker_stale", { markerLaunch: m.launchedAt, childLaunch: gate.launchedAt });
   }
-  if (m.waitUntil > Date.now() && m.waitUntil <= gate.overriddenUntil) {
-    return discardMarker(marker, "supervisor.marker_overridden", { waitUntil: m.waitUntil });
-  }
   return m;
 }
 
@@ -301,7 +297,7 @@ async function moveExhaustedSeat(seat: Account, sid: string, gate: MarkerGate, m
     const cfg = loadConfig();
     const families = gatedFamilies(model, cfg.policy.switchModels);
     const until = seatBlockedUntil(seat.id, now, families, cfg);
-    if (until == null || until <= gate.overriddenUntil) return false;
+    if (until == null) return false;
     const decision = await evaluateAndMaybeSwap(claude, now, true, null, { seatId: seat.id, sessionFamilies: families, waiterId: sid, refused, apiKeys: true });
     log("supervisor.seat_exhausted", { seat: seat.id.slice(0, 8), until, reason: decision.reason, account: decision.account?.id.slice(0, 8), key: decision.apiKey?.id, waitUntil: decision.waitUntil });
     const target = moveTarget(decision);
@@ -324,7 +320,7 @@ async function moveKeySession(key: ApiKey, sid: string, gate: MarkerGate, model:
     const decision = await evaluateAndMaybeSwap(claude, now, true, null, { seatId: null, sessionFamilies: families, waiterId: sid, refused, apiKeys: true, apiKeyId: key.id });
     log("supervisor.key_watch", { key: key.id, reason: decision.reason, account: decision.account?.id.slice(0, 8), next: decision.apiKey?.id, waitUntil: decision.waitUntil });
     const target = moveTarget(decision);
-    if (target && (target.waitUntil === undefined || target.waitUntil > gate.overriddenUntil)) {
+    if (target) {
       writeRespawnMarker({ session: { sid, launchedAt: gate.launchedAt, live: liveSessionId(sid) }, ...target, waitUntil: target.waitUntil ?? now, compact: true, origin: "seatwatch" });
     }
   } catch (e) {
@@ -362,6 +358,14 @@ function systemLine(sid: string, text: string): string {
   return `${JSON.stringify({ type: "system", subtype: "informational", content: text, level: "warning", uuid: crypto.randomUUID(), session_id: sid })}\n`;
 }
 
+function depletedLines(sid: string, until: number, text: string): string {
+  const line = (fields: Record<string, unknown>): string => `${JSON.stringify({ ...fields, uuid: crypto.randomUUID(), session_id: sid })}\n`;
+  return (
+    line({ type: "rate_limit_event", rate_limit_info: { status: "rejected", resetsAt: Math.ceil(until / 1000) } }) +
+    line({ type: "result", subtype: "error_during_execution", is_error: true, errors: [text], terminal_reason: "blocking_limit", num_turns: 0 })
+  );
+}
+
 function resumePrompt(input: { compacted: boolean; origin: z.infer<typeof RespawnMarkerSchema>["origin"]; onKey: boolean }): string {
   const where = input.onKey ? "on an API key, because every pooled account is at its limit or the previous key ran out" : "on an account with quota headroom";
   const moved = input.compacted
@@ -418,8 +422,12 @@ const RelayLineSchema = z.discriminatedUnion("type", [
   z.looseObject({ type: z.literal("control_request"), request_id: z.string(), request: z.looseObject({ subtype: z.string() }) }),
 ]);
 
-function controlErrorLine(requestId: string): string {
-  return `${JSON.stringify({ type: "control_response", response: { subtype: "error", request_id: requestId, error: "tokenmaxxing restarted Claude Code for an account move, and this request may or may not have run." } })}\n`;
+const UserLineSchema = z.looseObject({ type: z.literal("user") });
+
+const MOVED_REQUEST_ERROR = "tokenmaxxing restarted Claude Code for an account move, and this request may or may not have run.";
+
+function controlErrorLine(requestId: string, error: string): string {
+  return `${JSON.stringify({ type: "control_response", response: { subtype: "error", request_id: requestId, error } })}\n`;
 }
 
 class StdinRelay {
@@ -430,12 +438,18 @@ class StdinRelay {
   private dropped: string[] = [];
   private pendingTranscript: string | null = null;
   private ended = false;
+  private refusal: string | null = null;
+  private sawUser!: () => void;
+  readonly firstUser = new Promise<void>((resolve) => {
+    this.sawUser = resolve;
+  });
 
   constructor() {
     this.pump()
       .catch((e: unknown) => log("supervisor.relay_read_failed", { err: errorMessage(e) }))
       .finally(() => {
         this.ended = true;
+        this.sawUser();
         this.close();
       });
   }
@@ -455,6 +469,13 @@ class StdinRelay {
     this.sink = null;
   }
 
+  refuse(error: string): void {
+    this.refusal = error;
+    const lines = [...this.state.values(), ...this.queue];
+    this.queue = [];
+    for (const line of lines) this.forward(line);
+  }
+
   replay(): string[] {
     const dropped = this.dropped;
     this.queue = [...this.replayable, ...this.queue];
@@ -480,8 +501,14 @@ class StdinRelay {
   }
 
   private forward(line: string): void {
-    const parsed = RelayLineSchema.safeParse(JsonTextSchema.safeParse(line).data);
+    const value = JsonTextSchema.safeParse(line).data;
+    if (UserLineSchema.safeParse(value).success) this.sawUser();
+    const parsed = RelayLineSchema.safeParse(value);
     const request = parsed.success && parsed.data.type === "control_request" ? parsed.data : null;
+    if (this.refusal !== null) {
+      if (request !== null) process.stdout.write(controlErrorLine(request.request_id, this.refusal));
+      return;
+    }
     const setup = request !== null && REPLAYED_REQUESTS.has(request.request.subtype);
     if (setup) this.state.set(request.request.subtype, line);
     if (this.sink !== null) {
@@ -690,7 +717,6 @@ export async function runSupervisor(argv: string[]): Promise<number> {
   };
   let firstLine: string | null = null;
   let respawns = 0;
-  let overriddenUntil = 0;
   let wanted: { accountId: string | null; apiKeyId: string | null } | null = null;
   let refused: string[] = [];
   let drainStdout: ((abandoned: () => boolean) => Promise<void>) | null = null;
@@ -698,13 +724,12 @@ export async function runSupervisor(argv: string[]): Promise<number> {
   while (true) {
     rmSync(marker, { force: true });
 
-    const gate: MarkerGate = { launchedAt: Date.now(), overriddenUntil };
+    const gate: MarkerGate = { launchedAt: Date.now() };
     const launched = await withLock(claudePool.lockFile, async () => {
       if (terminating) return null;
       releaseClaimLocked(sid);
       const target = resolveLaunch(wanted, gate.launchedAt, model, refused);
-      if (target?.account && target.depletedUntil !== undefined && target.depletedUntil > gate.overriddenUntil) {
-        replaceWaitClaim({ sessionId: sid, accountId: target.account.id, at: gate.launchedAt, waitUntil: target.depletedUntil });
+      if (target?.account && target.depletedUntil !== undefined && target.depletedUntil > gate.launchedAt) {
         return { waitOn: target.account, waitUntil: target.depletedUntil };
       }
       const picked = target?.account ?? null;
@@ -751,9 +776,16 @@ export async function runSupervisor(argv: string[]): Promise<number> {
       return 143;
     }
     if (launched.waitOn !== undefined) {
-      log("supervisor.depleted_wait", { sid: sid.slice(0, 8), account: launched.waitOn.id.slice(0, 8), waitUntil: launched.waitUntil });
-      if (await countdownWait(launched.waitOn.label, launched.waitUntil, { stream, say, holdSid: noticeSid })) overriddenUntil = launched.waitUntil;
-      continue;
+      const text = `tokenmaxxing: session stopped because every pooled account is at its limit. The next reset is at ${clockFmt.format(launched.waitUntil)} on ${launched.waitOn.label}. Resume the session after that.`;
+      if (respawns === 0 && relay !== null) {
+        relay.refuse(text);
+        await relay.firstUser;
+      }
+      log("supervisor.depleted_exit", { sid: sid.slice(0, 8), account: launched.waitOn.id.slice(0, 8), waitUntil: launched.waitUntil });
+      say(`\n\x1b[36m⏳ tokenmaxxing: all accounts at their limit, so this session stopped. The next reset is at ${clockFmt.format(launched.waitUntil)} on ${launched.waitOn.label}. Run \`claude --resume ${noticeSid}\` after that to continue.\x1b[0m\n`, text);
+      if (stream) process.stdout.write(depletedLines(noticeSid, launched.waitUntil, text));
+      await releaseClaim();
+      return 1;
     }
 
     const { child: proc, seat, key, open } = launched;
@@ -794,7 +826,7 @@ export async function runSupervisor(argv: string[]): Promise<number> {
       const transcript = findTranscript(m.sessionId);
       const resumable = transcript !== null;
       if (!resumable && relay !== null) {
-        for (const id of relay.replay()) process.stdout.write(controlErrorLine(id));
+        for (const id of relay.replay()) process.stdout.write(controlErrorLine(id, MOVED_REQUEST_ERROR));
       }
       let compacted = false;
       const compactKey = key != null && usableApiKey(key.id) != null ? key : null;

package/src/lib/muse.ts

@@ -0,0 +1,82 @@
+import { z } from "zod";
+import { writeFileAtomic } from "./atomic.ts";
+import { museAuthJsonFor, musePaths, musePool, museStoreDirFor } from "./paths.ts";
+import type { SampleReport } from "./provider.ts";
+import { readJsonFile, type Harvest } from "./state.ts";
+import { statusOnlyProvider, type AuthEntry } from "./statusonly.ts";
+import { ErrnoSchema, type Account } from "./types.ts";
+import { c } from "../cli/render.ts";
+
+const MuseProviderSchema = z.looseObject({
+  access_token: z.string().optional(),
+  api_key: z.string().optional(),
+  user_email: z.string().nullish(),
+});
+
+const MuseAuthSchema = z.looseObject({
+  providers: z.record(z.string(), z.unknown()),
+});
+type MuseAuth = z.infer<typeof MuseAuthSchema>;
+
+function readFile(path: string): MuseAuth | null {
+  try {
+    return readJsonFile(path, MuseAuthSchema);
+  } catch (e) {
+    if (ErrnoSchema.safeParse(e).data?.code === "ENOENT") return null;
+    throw e;
+  }
+}
+
+function readAuth(path: string): AuthEntry[] {
+  const file = readFile(path);
+  if (file == null) return [];
+  const out: AuthEntry[] = [];
+  for (const [key, value] of Object.entries(file.providers)) {
+    const parsed = MuseProviderSchema.safeParse(value);
+    if (!parsed.success) continue;
+    const email = parsed.data.user_email?.trim().toLowerCase() ?? "";
+    const id = email === "" ? "" : new Bun.CryptoHasher("sha256").update(email).digest("hex");
+    const harvest: Harvest | null =
+      id === ""
+        ? null
+        : {
+            id,
+            email,
+            tier: null,
+            sample: null,
+            park: async () => {
+              writeFileAtomic(museAuthJsonFor(id), JSON.stringify({ ...file, providers: { [key]: value } }, null, 2), 0o600);
+            },
+          };
+    out.push({ id, usable: (parsed.data.access_token ?? "") !== "" || (parsed.data.api_key ?? "") !== "", harvest });
+  }
+  return out;
+}
+
+async function samplePool(accounts: Account[]): Promise<Map<string, SampleReport>> {
+  return new Map(accounts.map((a) => [a.id, { ok: false, reason: "Muse Code exposes no read-only quota endpoint" }]));
+}
+
+export const muse = statusOnlyProvider({
+  name: "muse",
+  flag: " --muse",
+  pool: musePool,
+  binName: "muse",
+  binKey: "museBin",
+  storeDirFor: museStoreDirFor,
+  authJsonFor: museAuthJsonFor,
+  onboardDir: musePaths.onboardDir,
+  homeEnv: "XDG_CONFIG_HOME",
+  loginArgs: ["login"],
+  onboardAuthRel: "muse/auth.json",
+  liveAuthPath: () => musePaths.authJson,
+  readAuth,
+  liveId: () => null,
+  presence: () => new Map(),
+  versionOk: (out) => out.toLowerCase().includes("muse code"),
+  importIntro: "Opening an isolated Muse Code login for your first pooled account - the login you already have stays as it is.",
+  foundLive: (count) => `found ${count} Muse Code login(s) in ${musePaths.authJson} - pooling the first; use \`tokenmaxxing add --muse\` for the rest.`,
+  installNotice: "muse pool is status-only: no supervisor or hooks installed. Use `tokenmaxxing status` to view pooled Muse Code accounts.",
+  loginStep: () => `Approve the code in the browser that ${c.bold("muse login")} opens.`,
+  samplePool,
+});

package/src/lib/paths.ts

@@ -58,6 +58,11 @@ export const grokPool = {
   lockFile: join(TM_HOME, "grok-lock"),
 } as const;
 
+export const musePool = {
+  accountsJson: join(TM_HOME, "muse-accounts.json"),
+  lockFile: join(TM_HOME, "muse-lock"),
+} as const;
+
 export type PoolPaths = { accountsJson: string; lockFile: string };
 
 const CODEX_HOME = env("TOKENMAXXING_CODEX_HOME", env("CODEX_HOME", join(HOME, ".codex")));
@@ -122,6 +127,20 @@ export function grokAuthJsonFor(accountId: string): string {
   return join(grokStoreDirFor(accountId), "auth.json");
 }
 
+export const musePaths = {
+  authJson: join(env("XDG_CONFIG_HOME", join(HOME, ".config")), "muse", "auth.json"),
+  storesDir: join(TM_HOME, "muse-stores"),
+  onboardDir: join(TM_HOME, "muse-onboard"),
+} as const;
+
+export function museStoreDirFor(accountId: string): string {
+  return join(musePaths.storesDir, shortId(accountId));
+}
+
+export function museAuthJsonFor(accountId: string): string {
+  return join(museStoreDirFor(accountId), "auth.json");
+}
+
 export function grokSeatFromEnv(accountIds: string[], env: Record<string, string | undefined> = process.env): string | null {
   const home = env.GROK_HOME;
   if (home == null || home === "") return null;

package/src/lib/picker.ts

@@ -169,8 +169,7 @@ const MIN_SEAT_HEADROOM = 5;
 function seatFull(a: Account, ctx: PickCtx): boolean {
   const session = sessionWindow(a);
   if (ctx.seats == null || session == null || spendsCredits(a, ctx.thresholds)) return false;
-  const fresh = barFor(a, session, ctx.thresholds, windowEnd(session)) / ((ctx.seats.get(a.id) ?? 0) + 1);
-  return seatHeadroom(a, ctx) < MIN_SEAT_HEADROOM && fresh >= MIN_SEAT_HEADROOM;
+  return seatHeadroom(a, ctx) < MIN_SEAT_HEADROOM;
 }
 
 export function onCredits(a: Account, ctx: PickCtx): boolean {
@@ -187,15 +186,17 @@ const swapPreference = (ctx: PickCtx) => [
 ];
 
 export function pickBest(accounts: Account[], ctx: PickCtx): Account | null {
-  const usable = accounts.filter((a) => a.id !== ctx.currentId && !a.needsReauth && !isExhausted(a, ctx) && !seatFull(a, ctx));
-  return sortBy(usable, swapPreference(ctx))[0] ?? null;
+  const usable = accounts.filter((a) => a.id !== ctx.currentId && !a.needsReauth && !isExhausted(a, ctx));
+  const open = usable.filter((a) => !seatFull(a, ctx));
+  return sortBy(open.length > 0 ? open : usable, swapPreference(ctx))[0] ?? null;
 }
 
 export function usableAt(a: Account, ctx: PickCtx): number {
   const blocking = blockingUntil(a, ctx).filter((t) => t > ctx.now);
   const at = blocking.length ? Math.max(...blocking) : ctx.now;
   const session = sessionWindow(a);
-  return session != null && seatFull(a, { ...ctx, now: at }) ? windowEnd(session) : at;
+  const end = session != null ? windowEnd(session) : 0;
+  return session != null && end > at && seatFull(a, { ...ctx, now: at }) ? end : at;
 }
 
 export type EarliestReset = { account: Account; availableAt: number };

package/src/lib/provider.ts

@@ -26,7 +26,7 @@ export class StoreUnusableError extends Error {
 }
 
 export type Provider = {
-  name: "claude" | "codex" | "grok";
+  name: "claude" | "codex" | "grok" | "muse";
   flag: string;
   pool: PoolPaths;
   seats: "shared" | "live";

package/src/lib/sessions.ts

@@ -2,7 +2,7 @@ import { existsSync, readdirSync, realpathSync, rmSync, statSync, type Dirent }
 import { basename, join, sep } from "node:path";
 import { z } from "zod";
 import { errorMessage, log } from "./log.ts";
-import { codexPaths, grokPaths, paths, piPaths } from "./paths.ts";
+import { codexPaths, grokPaths, musePaths, paths, piPaths } from "./paths.ts";
 import { stagingTarget, writeFileAtomic } from "./atomic.ts";
 import { presencePid } from "./presence.ts";
 import { readJsonFile } from "./state.ts";
@@ -44,7 +44,7 @@ function recordLiveSession(sid: string, current: string): void {
 
 const TMP_GRACE_MS = 3600 * 1000;
 
-const SWEEP_PARENTS = [paths.storesDir, codexPaths.storesDir, grokPaths.storesDir, join(piPaths.storesDir, "claude"), join(piPaths.storesDir, "codex"), paths.costDir];
+const SWEEP_PARENTS = [paths.storesDir, codexPaths.storesDir, grokPaths.storesDir, musePaths.storesDir, join(piPaths.storesDir, "claude"), join(piPaths.storesDir, "codex"), paths.costDir];
 
 function listDir(dir: string, root: string): Dirent[] {
   if (!existsSync(dir)) return [];

package/src/lib/state.ts

@@ -34,11 +34,12 @@ export function loadConfig(): Config {
   cfg.claudeBin = optionalEnv("TOKENMAXXING_CLAUDE_BIN") ?? cfg.claudeBin;
   cfg.codexBin = optionalEnv("TOKENMAXXING_CODEX_BIN") ?? cfg.codexBin;
   cfg.grokBin = optionalEnv("TOKENMAXXING_GROK_BIN") ?? cfg.grokBin;
+  cfg.museBin = optionalEnv("TOKENMAXXING_MUSE_BIN") ?? cfg.museBin;
   cfg.piBin = optionalEnv("TOKENMAXXING_PI_BIN") ?? cfg.piBin;
   return cfg;
 }
 
-export type BinKey = "claudeBin" | "codexBin" | "grokBin" | "piBin";
+export type BinKey = "claudeBin" | "codexBin" | "grokBin" | "museBin" | "piBin";
 
 export function pinBinOverride(input: { key: BinKey; bin: string }): void {
   const raw: Record<string, unknown> = existsSync(paths.configJson) ? readJsonFile(paths.configJson, z.record(z.string(), z.unknown())) : {};

package/src/lib/statusonly.ts

@@ -14,7 +14,7 @@ export type StatusOnlySpec = {
   flag: string;
   pool: PoolPaths;
   binName: string;
-  binKey: "grokBin";
+  binKey: "grokBin" | "museBin";
   storeDirFor: (accountId: string) => string;
   authJsonFor: (accountId: string) => string;
   onboardDir: string;

package/src/lib/supervise.ts

@@ -15,42 +15,7 @@ export const SEAT_RETRY_MS = 60_000;
 
 export type Say = (terminal: string, text: string) => void;
 
-const clockFmt = new Intl.DateTimeFormat("en-US", { hour: "2-digit", minute: "2-digit", hourCycle: "h23", timeZoneName: "short" });
-
-function waitHoldLines(sid: string, until: number): { start: string; stop: string } {
-  const line = (fields: Record<string, unknown>): string =>
-    `${JSON.stringify({ type: "system", task_id: `tokenmaxxing-wait-${sid}`, uuid: crypto.randomUUID(), session_id: sid, ...fields })}\n`;
-  return {
-    start: line({ subtype: "task_started", task_type: "local_bash", description: `Waiting until ${clockFmt.format(until)} for a Claude account to reset` }),
-    stop: line({ subtype: "task_notification", status: "completed", output_file: "", summary: "The wait for a Claude account to reset ended" }),
-  };
-}
-
-export async function countdownWait(acct: string, until: number, out: { stream: boolean; say: Say; holdSid?: string }): Promise<boolean> {
-  let aborted = false;
-  const onInt = () => { aborted = true; };
-  process.on("SIGINT", onInt);
-  const minutes = Math.max(1, Math.ceil((until - Date.now()) / 60000));
-  out.say(
-    `\n\x1b[36m⏳ tokenmaxxing: all accounts at their limit. Resuming on ${acct} when it resets (Ctrl-C to resume now).\x1b[0m\n`,
-    `tokenmaxxing: all accounts at their limit. Resuming at ${clockFmt.format(until)} (in ${minutes} min) on ${acct}.`,
-  );
-  const hold = out.stream && out.holdSid !== undefined ? waitHoldLines(out.holdSid, until) : null;
-  if (hold) process.stdout.write(hold.start);
-  while (!aborted && Date.now() < until) {
-    if (!out.stream) {
-      const left = until - Date.now();
-      const m = Math.floor(left / 60000);
-      const s = Math.floor((left % 60000) / 1000);
-      process.stderr.write(`\r\x1b[36m   resuming in ${m}m ${String(s).padStart(2, "0")}s \x1b[0m`);
-    }
-    await Bun.sleep(1000);
-  }
-  process.removeListener("SIGINT", onInt);
-  if (hold) process.stdout.write(hold.stop);
-  out.say(`\n\x1b[36m↻ resuming on ${acct}...\x1b[0m\n`, `tokenmaxxing: resuming on ${acct}.`);
-  return aborted;
-}
+export const clockFmt = new Intl.DateTimeFormat("en-US", { hour: "2-digit", minute: "2-digit", hourCycle: "h23", timeZoneName: "short" });
 
 type ChildHandle = {
   pid: number;

package/src/lib/types.ts

@@ -116,6 +116,7 @@ export const ConfigSchema = z
     claudeBin: z.string().default(""),
     codexBin: z.string().default(""),
     grokBin: z.string().default(""),
+    museBin: z.string().default(""),
     piBin: z.string().default(""),
     policy: z
       .object({

package/src/main.ts

@@ -13,6 +13,7 @@ import { runPiSupervisor } from "./entries/pisupervisor.ts";
 import { claude } from "./lib/claude.ts";
 import { codex } from "./lib/codex.ts";
 import { grok } from "./lib/grok.ts";
+import { muse } from "./lib/muse.ts";
 import { cmdInit, cmdInitPi } from "./cli/init.ts";
 import { cmdAdd } from "./cli/add.ts";
 import { cmdAuth } from "./cli/auth.ts";
@@ -36,6 +37,7 @@ const CACHED_FLAG = "--cached";
 const YES_FLAG = "--yes";
 const CODEX_FLAG = "--codex";
 const GROK_FLAG = "--grok";
+const MUSE_FLAG = "--muse";
 const PI_FLAG = "--pi";
 const JSON_COMMANDS = new Set(["status", "config", "check"]);
 const CODEX_COMMANDS = new Set(["init", "add", "auth", "emails", "rm", "rename", "seat"]);
@@ -51,17 +53,18 @@ function printHelp(): void {
   ${c.cyan("tokenmaxxing init --codex")}  same for codex: log in the first account, isolated, install codex supervisor + Stop hook
   ${c.cyan("tokenmaxxing init --pi")}     install the pi supervisor: pi sessions run on pooled Claude or ChatGPT accounts that are logged into pi
   ${c.cyan("tokenmaxxing init --grok")}   pool grok Build logins (status-only: no supervisor yet)
+  ${c.cyan("tokenmaxxing init --muse")}   pool Muse Code logins (status-only: no supervisor and no usage read)
   ${c.cyan("tokenmaxxing add")}        register an additional account (isolated login)
-  ${c.cyan("tokenmaxxing add")} --codex | --grok   same for the codex or grok pool
-  ${c.cyan("tokenmaxxing auth")} [--codex | --grok] [sel | --all]  reauthenticate a pooled account in place (bare = pick from a list; --all = every account that is flagged or has no usable credential in its store, one by one)
-  ${c.cyan("tokenmaxxing auth")} [--codex | --grok] --emails <email>...  log in and pool each listed email, skipping the ones already pooled (for moving to a new host: paste the output of ${c.cyan("emails")} from the old one)
-  ${c.cyan("tokenmaxxing emails")} [--codex | --grok]  print every pooled account's email, one per line, to copy into ${c.cyan("auth --emails")} on another host
+  ${c.cyan("tokenmaxxing add")} --codex | --grok | --muse   same for the codex, grok, or muse pool
+  ${c.cyan("tokenmaxxing auth")} [--codex | --grok | --muse] [sel | --all]  reauthenticate a pooled account in place (bare = pick from a list; --all = every account that is flagged or has no usable credential in its store, one by one)
+  ${c.cyan("tokenmaxxing auth")} [--codex | --grok | --muse] --emails <email>...  log in and pool each listed email, skipping the ones already pooled (for moving to a new host: paste the output of ${c.cyan("emails")} from the old one)
+  ${c.cyan("tokenmaxxing emails")} [--codex | --grok | --muse]  print every pooled account's email, one per line, to copy into ${c.cyan("auth --emails")} on another host
   ${c.cyan("tokenmaxxing auth --pi")} [--codex] [sel | --all]  log a pooled Claude account (or a codex account with --codex) into pi, isolated (bare = pick from a list; --all = every account without a pi login)
   ${c.cyan("tokenmaxxing status")} [--cached]  accounts with 5h / weekly / per-model usage bars (--cached: the stored figures, no sampling)
   ${c.cyan("tokenmaxxing config")}     print the config path and the effective values (edit the file in an editor)
   ${c.cyan("tokenmaxxing doctor")}     verify the install is intact
-  ${c.cyan("tokenmaxxing rename")} [--codex | --grok] <sel> <label>
-  ${c.cyan("tokenmaxxing rm")} [--codex | --grok] <sel>
+  ${c.cyan("tokenmaxxing rename")} [--codex | --grok | --muse] <sel> <label>
+  ${c.cyan("tokenmaxxing rm")} [--codex | --grok | --muse] <sel>
   ${c.cyan("tokenmaxxing key add")} <label> [credit-usd] [workspace-id]  store an Anthropic or OpenRouter (sk-or-...) API key read from stdin or the prompt; Claude sessions run on it only while every pooled Claude account is at its limit (workspace-id: for a key that spans several workspaces; an OpenRouter key takes neither argument and reads its credit from OpenRouter)
   ${c.cyan("tokenmaxxing key credit")} <label> <usd>  set the key's balance as the Console shows it and restart its spend count (an OpenRouter key takes no amount: key credit <label> clears its refusal)
   ${c.cyan("tokenmaxxing key rm")} <label>  delete the key and its stored secret (refused while a session runs on it)
@@ -101,14 +104,14 @@ async function main(): Promise<number> {
   const json = jsonMode;
   const cached = argv.includes(CACHED_FLAG);
   const yes = argv.includes(YES_FLAG);
-  const providerFlags = [CODEX_FLAG, GROK_FLAG].filter((f) => argv.includes(f));
+  const providerFlags = [CODEX_FLAG, GROK_FLAG, MUSE_FLAG].filter((f) => argv.includes(f));
   if (providerFlags.length > 1) {
     emitError({ json, message: `${providerFlags.join(" and ")} are mutually exclusive - pick one pool` });
     return 2;
   }
-  const provider = argv.includes(CODEX_FLAG) ? codex : argv.includes(GROK_FLAG) ? grok : claude;
+  const provider = argv.includes(CODEX_FLAG) ? codex : argv.includes(GROK_FLAG) ? grok : argv.includes(MUSE_FLAG) ? muse : claude;
   const pi = argv.includes(PI_FLAG);
-  const args = argv.filter((a) => a !== JSON_FLAG && a !== CACHED_FLAG && a !== YES_FLAG && a !== CODEX_FLAG && a !== GROK_FLAG && a !== PI_FLAG);
+  const args = argv.filter((a) => a !== JSON_FLAG && a !== CACHED_FLAG && a !== YES_FLAG && a !== CODEX_FLAG && a !== GROK_FLAG && a !== MUSE_FLAG && a !== PI_FLAG);
   const sub = args[0];
 
   if (pi && sub !== "init" && sub !== "auth") {
@@ -136,8 +139,8 @@ async function main(): Promise<number> {
     return 2;
   }
 
-  if (provider === grok && (sub == null || !STATUS_ONLY_COMMANDS.has(sub))) {
-    emitError({ json, message: `${GROK_FLAG} applies to ${[...STATUS_ONLY_COMMANDS].join(", ")}, not ${sub ?? "status"}` });
+  if (provider.statusOnly && (sub == null || !STATUS_ONLY_COMMANDS.has(sub))) {
+    emitError({ json, message: `${provider.flag.trim()} applies to ${[...STATUS_ONLY_COMMANDS].join(", ")}, not ${sub ?? "status"}` });
     return 2;
   }
 
@@ -208,7 +211,7 @@ async function main(): Promise<number> {
       if (out.timer === "still-loaded") console.log(c.yellow(`⚠ the check job may still be loaded - run: ${deactivationHint(CHECK_JOB)}`));
       if (out.hub === "still-loaded") console.log(c.yellow(`⚠ the usage hub job may still be loaded - run: ${deactivationHint(HUB_JOB)}`));
       if (!out.pathLineRemoved) console.log(c.dim("(no tokenmaxxing PATH line found in the shell rc)"));
-      console.log(`kept: accounts.json, config.json, and every account credential store (claude: stores/ and its keychain items on macOS; codex: codex-stores/; pi: pi-stores/; grok: grok-stores/), plus api-keys.json and the API keys in api-keys/ - remove accounts with \`xx rm\` and keys with \`xx key rm\` to delete their credentials`);
+      console.log(`kept: accounts.json, config.json, and every account credential store (claude: stores/ and its keychain items on macOS; codex: codex-stores/; pi: pi-stores/; grok: grok-stores/; muse: muse-stores/), plus api-keys.json and the API keys in api-keys/ - remove accounts with \`xx rm\` and keys with \`xx key rm\` to delete their credentials`);
       return 0;
     }
     case "help":