tokenmaxxing 1.2.0 → 1.2.1

package/DESIGN.md

@@ -107,7 +107,7 @@ A local Socket Mode daemon (no public URL) that turns Slack threads into Claude
 - **One Slack app per daemon** (live incident 2026-07-20): Slack Socket Mode delivers each event envelope to exactly one of an app's open connections, so two serve daemons sharing one Slack app steal each other's events - mentions usually survive (Slack emits `app_mention` plus `message.channels` for one mention and the Chat SDK dedupes them per-process), but a non-mention thread follow-up rides a single envelope and silently dies when the wrong daemon receives it. No code can route Slack's load-balancing (the hello frame's `num_connections` is discarded by `@slack/socket-mode` before any event fires), so the constraint is documented (docs limitations page) and diagnosed: `serve.unlinked_channel` logs once per channel per run with the shared-app explanation. Every host needs its own Slack app with its own tokens.
 - **Todo checklist card**: TodoWrite is bookkeeping, not a real tool run, so it never opens a generic card. Instead each stream gets one stable-id "Todos" card (id `todos`, subagents `todos-<parent_tool_use_id>`) that updates in place on every TodoWrite: `✅ content` for completed, `🔄 activeForm` for the in-progress item (live narration), `⬜ content` for pending (the Chat SDK Plan object's own iconography); card status goes complete only when every item is completed. The "Todos have been modified successfully" tool_result is suppressed, but a FAILED TodoWrite flips the card to error (the optimistic checklist must not claim a state that never took effect). Card ids do not carry across messages, so a TodoWrite after a dead-segment recovery starts a fresh card in the follow-on message: accepted, the latest state is always in the newest message. claude >= 2.1.142 defaults to the structured Task tools and never emits TodoWrite, so relayThread sets `CLAUDE_CODE_ENABLE_TASKS: "0"` in the spawn env (the documented opt-out; without it the checklist card is inert).
 - **Terminal echo** (2026-07-18): the daemon registers a `log()` echo (`setLogEcho` in log.ts, off by default so hooks and the statusline keep their stdout protocols clean), so every event while it runs - serve.* plus the in-process swap/decision events from `ensureBestAccount()`/`stopHookCheck` - also prints one colored line in the foreground terminal (`formatLogLine`: dim HH:MM:SS, event painted red/yellow/cyan by structural endsWith severity, redacted fields). `serve.turn_done`/`serve.turn_failed` (with seconds) close every relayed turn, so a foreground `xx serve` is observable without tailing `tokenmaxxing.log`.
-- **Live-verified end-to-end** (2026-07-18, #tokenmaxxing-dogfooding): mention opens a session (worktree-per-thread at the time), replies stream, thread follow-ups resume with context, cards + fenced code render, segmentation and queue folding behave. Plus the hermetic suite: schemas/links, stream mapping, fail-fast paths.
+- **Live-verified end-to-end** (2026-07-18, in a live workspace channel): mention opens a session (worktree-per-thread at the time), replies stream, thread follow-ups resume with context, cards + fenced code render, segmentation and queue folding behave. Plus the hermetic suite: schemas/links, stream mapping, fail-fast paths.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",

package/src/entries/codexsupervisor.ts

@@ -13,7 +13,7 @@ import { join } from "node:path";
 import { z } from "zod";
 import { codexPaths, paths } from "../lib/paths.ts";
 import { withLock } from "../lib/lock.ts";
-import { LOOP_DIAGNOSIS, MAX_WRAP_DEPTH, WRAP_DEPTH_ENV, WRAP_RATE_MAX, WRAP_RATE_WINDOW_MS, wrapDepth, wrapperEntryRateTripped } from "../lib/claudebin.ts";
+import { LOOP_DIAGNOSIS, MAX_WRAP_DEPTH, UNMANAGED_ENV, WRAP_DEPTH_ENV, WRAP_RATE_MAX, WRAP_RATE_WINDOW_MS, wrapDepth, wrapperEntryRateTripped } from "../lib/claudebin.ts";
 import { resolveRealCodex } from "../lib/codexbin.ts";
 import { clearCodexPresence, writeCodexPresence } from "../lib/codexpresence.ts";
 import { liveCodexAccountId } from "../lib/codexsample.ts";
@@ -92,7 +92,10 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
   const real = resolveRealCodex();
   const childEnv = { ...process.env, [WRAP_DEPTH_ENV]: String(depth + 1) };
 
-  if (!shouldManageCodex({ argv })) {
+  // The unmanaged-zone sentinel forces passthrough regardless of argv, exactly
+  // like the claude shim: a serve turn's agent running `codex exec` must reach
+  // the real codex instead of dying at the shared depth cap.
+  if (!shouldManageCodex({ argv }) || process.env[UNMANAGED_ENV]) {
     // STRIP the supervisor pairing env from unmanaged spawns: a nested codex
     // launched from inside a supervised session (e.g. its agent running
     // `codex exec ...`) would otherwise inherit the OUTER session's id, and

package/src/entries/supervisor.ts

@@ -12,7 +12,7 @@ import { join } from "node:path";
 import { maxBy } from "es-toolkit";
 import { z } from "zod";
 import { paths } from "../lib/paths.ts";
-import { LOOP_DIAGNOSIS, MAX_WRAP_DEPTH, WRAP_DEPTH_ENV, WRAP_RATE_MAX, WRAP_RATE_WINDOW_MS, resolveRealClaude, wrapDepth, wrapperEntryRateTripped } from "../lib/claudebin.ts";
+import { LOOP_DIAGNOSIS, MAX_WRAP_DEPTH, UNMANAGED_ENV, WRAP_DEPTH_ENV, WRAP_RATE_MAX, WRAP_RATE_WINDOW_MS, resolveRealClaude, wrapDepth, wrapperEntryRateTripped } from "../lib/claudebin.ts";
 import { saveTermios, restoreTermios } from "../lib/tty.ts";
 import { loadSessionFlags, pruneStaleSessions, saveSessionFlags } from "../lib/sessions.ts";
 import { RespawnMarkerSchema } from "../lib/types.ts";
@@ -274,7 +274,13 @@ export async function runSupervisor(argv: string[]): Promise<number> {
   const childEnv = { ...process.env, [WRAP_DEPTH_ENV]: String(depth + 1) };
 
   // Pass-through: no session management, no respawn - exact stock behavior.
-  if (!info.manage) {
+  // The unmanaged-zone sentinel (pooledSpawnEnv) forces it regardless of argv:
+  // everything below an SDK-driven session runs the real claude unsupervised,
+  // so a repo script invoking `claude` from inside a serve turn works instead
+  // of dying at the depth cap. The sentinel rides childEnv, so the whole
+  // subtree stays unmanaged, and depth still counts wrapper entries toward
+  // the cap above, keeping a poisoned pin inside the zone bounded.
+  if (!info.manage || process.env[UNMANAGED_ENV]) {
     // STRIP the supervision pairing env (mirrors the codex shim's passthrough
     // arm, closing-review catch): a nested unmanaged claude inside a
     // supervised session (e.g. the agent running `claude -p ...`) would

package/src/lib/claudebin.ts

@@ -15,6 +15,14 @@ import { writeFileAtomic } from "./atomic.ts";
  *  fork-bombing the machine (2026-07-12: ~1800 runaway bun processes). */
 export const WRAP_DEPTH_ENV = "TOKENMAXXING_WRAP_DEPTH";
 export const MAX_WRAP_DEPTH = 5;
+/** "No session management anywhere below this env": the wrapper passes a
+ *  `claude`/`codex` invocation straight through to the real binary, unmanaged.
+ *  Set by pooledSpawnEnv so an SDK-driven session's descendants (an agent
+ *  running `bun run validate` whose script invokes `claude -p`) still work
+ *  instead of dying at the depth cap, which is a LOOP diagnostic, not an
+ *  unmanaged-zone marker. Depth keeps incrementing per wrapper entry under
+ *  this sentinel, so a poisoned pin inside the zone still aborts at the cap. */
+export const UNMANAGED_ENV = "TOKENMAXXING_UNMANAGED";
 /** Stable fragment of the loop-abort diagnostic; verifyRealClaude greps a
  *  child's stderr for it to name the failure precisely. */
 export const LOOP_DIAGNOSIS = "wrapper re-entered without reaching the real claude";

package/src/lib/slackstate.ts

@@ -310,7 +310,8 @@ export function bareChannelId(id: string): string {
  * Strip a leading Slack mention OF THE BOT from message text. Two forms: raw
  * mrkdwn ("<@U0123> rest") and the bare form the Chat SDK's incoming
  * mrkdwn->markdown normalization produces ("@U0123 rest") - observed live
- * 2026-07-18 when a relayed prompt arrived starting "@U0BHS1YKNSK". Only a
+ * 2026-07-18 when a relayed prompt arrived starting with the bot's bare
+ * "@U..." token. Only a
  * token whose id equals botUserId is stripped (review catch 2026-07-18:
  * handleTurn runs this over every subscribed message, so a follow-up starting
  * with a colleague's mention must keep it - the prompt would otherwise lose

package/src/sdk.ts

@@ -14,7 +14,7 @@
 // dependency set (zod, es-toolkit, ky).
 
 import { z } from "zod";
-import { MAX_WRAP_DEPTH, WRAP_DEPTH_ENV, resolveRealClaude } from "./lib/claudebin.ts";
+import { UNMANAGED_ENV, resolveRealClaude } from "./lib/claudebin.ts";
 import { evaluateAndMaybeSwap, type SwapDecision } from "./lib/decide.ts";
 import { CRED_ENV_OVERRIDES } from "./lib/usage.ts";
 import { log } from "./lib/log.ts";
@@ -52,9 +52,13 @@ const AMBIENT_STORE_VARS = ["CLAUDE_SECURESTORAGE_CONFIG_DIR", "CLAUDE_CONFIG_DI
  * The env an SDK-spawned claude must run under to meter the POOLED live
  * credential: every ambient credential override is scrubbed (claude honors
  * them BEFORE its keychain/file lookup, so one inherited ANTHROPIC_API_KEY
- * silently meters the wrong account), and the wrap depth is preset to the cap
- * so a poisoned claudeBin pin that leads back into the tokenmaxxing wrapper
- * aborts on first entry instead of fork-bombing.
+ * silently meters the wrong account), and the unmanaged-zone sentinel is set
+ * so a descendant invoking `claude`/`codex` through the on-PATH wrapper gets a
+ * passthrough to the real binary instead of nested supervision (or, before
+ * this sentinel existed, a depth-cap abort that broke legitimate nested runs
+ * like a repo's `bun run validate` invoking `claude -p`). The wrap depth is
+ * NOT preset: it keeps counting real wrapper entries, so a poisoned claudeBin
+ * pin below here still dies at the cap.
  *
  * Returns a FULL environment, not a patch: the Agent SDK's Options.env
  * REPLACES the subprocess env rather than merging over process.env (verified
@@ -69,7 +73,7 @@ export function pooledSpawnEnv(): Record<string, string> {
       );
     }
   }
-  const env: Record<string, string> = { ...process.env, [WRAP_DEPTH_ENV]: String(MAX_WRAP_DEPTH) };
+  const env: Record<string, string> = { ...process.env, [UNMANAGED_ENV]: "1" };
   for (const k of CRED_ENV_OVERRIDES) delete env[k];
   return env;
 }