tokenmaxxing 1.20.0 → 1.23.0

package/src/lib/state.ts

@@ -1,11 +1,10 @@
 import { closeSync, existsSync, fstatSync, openSync, readFileSync, rmSync, utimesSync } from "node:fs";
-import { isEqual, uniq } from "es-toolkit";
+import { isEqual } from "es-toolkit";
 import { z } from "zod";
 import { paths, realClaudeBinFromEnv, realCodexBinFromEnv } from "./paths.ts";
 import { writeFileAtomic } from "./atomic.ts";
 import {
   AccountsIndexSchema,
-  BankedResetProvidersSchema,
   ConfigSchema,
   LastSwapSchema,
   ModelUsageStateSchema,
@@ -14,11 +13,8 @@ import {
   UsageStateSchema,
   type AccountsIndex,
   type Config,
-  type FamilyAnchor,
   type ModelUsageState,
   type UsageState,
-  type UsageWindow,
-  type WindowAnchor,
 } from "./types.ts";
 
 const DEFAULT_CONFIG: Config = {
@@ -34,7 +30,6 @@ const DEFAULT_CONFIG: Config = {
     usagePollTtlMs: 90_000,
     maxWaitMs: 3_600_000,
     checkIntervalMs: 60_000,
-    preferToUseBankedReset: [],
   },
 };
 
@@ -55,7 +50,6 @@ export const ConfigFileSchema = z
         usagePollTtlMs: z.number().int().positive(),
         maxWaitMs: z.number().int().positive(),
         checkIntervalMs: z.number().int().min(10_000),
-        preferToUseBankedReset: BankedResetProvidersSchema,
       })
       .partial(),
   })
@@ -89,9 +83,6 @@ export function mergeConfigFile(p: z.infer<typeof ConfigFileSchema>): MergeOutco
   if (p.policy?.switchModels) {
     cfg.policy.switchModels = p.policy.switchModels.map((s) => s.toLowerCase());
   }
-  if (p.policy?.preferToUseBankedReset) {
-    cfg.policy.preferToUseBankedReset = uniq(p.policy.preferToUseBankedReset);
-  }
   const envBin = realClaudeBinFromEnv();
   if (envBin) cfg.claudeBin = envBin;
   const envCodexBin = realCodexBinFromEnv();
@@ -196,29 +187,6 @@ export function saveLastSwapAt(ts: number): void {
   writeFileAtomic(paths.lastSwapJson, JSON.stringify(LastSwapSchema.parse({ ts })));
 }
 
-export function loadLastResetAt(): number | null {
-  if (!existsSync(paths.lastResetJson)) return null;
-  let json: unknown;
-  try {
-    json = JSON.parse(readFileSync(paths.lastResetJson, "utf8"));
-  } catch {
-    throw new Error(`${paths.lastResetJson} is corrupt (unparsable JSON) - refusing to treat a damaged reset clock as never-reset; repair or remove the file`);
-  }
-  return LastSwapSchema.parse(json).ts;
-}
-
-export function saveLastResetAt(ts: number): void {
-  writeFileAtomic(paths.lastResetJson, JSON.stringify(LastSwapSchema.parse({ ts })));
-}
-
-export function loadLastSeatChangeAt(): number | null {
-  const swapAt = loadLastSwapAt();
-  const resetAt = loadLastResetAt();
-  if (swapAt == null) return resetAt;
-  if (resetAt == null) return swapAt;
-  return Math.max(swapAt, resetAt);
-}
-
 const DepletedWaitSchema = z.object({ waitUntil: z.number(), accountUuid: z.string(), ts: z.number() });
 export type DepletedWait = z.infer<typeof DepletedWaitSchema>;
 
@@ -270,61 +238,13 @@ export function clearNextCheck(): void {
 
 const USAGE_TS_REFRESH_MS = 10 * 60_000;
 const SAMPLED_AT_REFRESH_MS = 30_000;
-const SESSION_COST_MIN_DELTA = 25;
-
-function anchorHolds(anchor: WindowAnchor, next: UsageState): boolean {
-  return (
-    anchor.fiveHourResetsAt === next.fiveHour.resetsAt &&
-    anchor.sevenDayResetsAt === next.sevenDay.resetsAt &&
-    next.fiveHour.usedPercentage >= anchor.session &&
-    next.sevenDay.usedPercentage >= anchor.weekly
-  );
-}
-
-export function measureSessionWindow(prev: UsageState | null, next: UsageState, stamp: boolean): Pick<UsageState, "anchor" | "sessionWindowWeeklyCost"> {
-  const same = prev != null && prev.account === next.account;
-  const carried = same ? prev.sessionWindowWeeklyCost : undefined;
-  if (stamp) return { ...(same && prev.anchor ? { anchor: prev.anchor } : {}), ...(carried != null ? { sessionWindowWeeklyCost: carried } : {}) };
-  const anchor: WindowAnchor =
-    same && prev.anchor && anchorHolds(prev.anchor, next)
-      ? prev.anchor
-      : { fiveHourResetsAt: next.fiveHour.resetsAt, sevenDayResetsAt: next.sevenDay.resetsAt, session: next.fiveHour.usedPercentage, weekly: next.sevenDay.usedPercentage };
-  const sessionDelta = next.fiveHour.usedPercentage - anchor.session;
-  const weeklyDelta = next.sevenDay.usedPercentage - anchor.weekly;
-  const measured = sessionDelta >= SESSION_COST_MIN_DELTA && weeklyDelta > 0 ? (100 * weeklyDelta) / sessionDelta : undefined;
-  const cost = measured ?? carried;
-  return { anchor, ...(cost != null ? { sessionWindowWeeklyCost: cost } : {}) };
-}
-
-function familyAnchorHolds(anchor: FamilyAnchor, session: UsageWindow, caps: Record<string, number>): boolean {
-  return (
-    anchor.fiveHourResetsAt === session.resetsAt &&
-    session.usedPercentage >= anchor.session &&
-    Object.entries(caps).every(([family, used]) => anchor.caps[family] == null || used >= anchor.caps[family])
-  );
-}
-
-export function measureFamilyWindow(prev: ModelUsageState | null, account: string | null, session: UsageWindow | null, caps: Record<string, number>): Pick<ModelUsageState, "anchor" | "familyCosts"> {
-  const same = prev != null && prev.account === account;
-  const carried = same ? prev.familyCosts : undefined;
-  if (session == null) return { ...(same && prev.anchor ? { anchor: prev.anchor } : {}), ...(carried != null ? { familyCosts: carried } : {}) };
-  const held = same && prev.anchor && familyAnchorHolds(prev.anchor, session, caps) ? prev.anchor : null;
-  const anchor: FamilyAnchor = held ? { ...held, caps: { ...caps, ...held.caps } } : { fiveHourResetsAt: session.resetsAt, session: session.usedPercentage, caps };
-  const sessionDelta = session.usedPercentage - anchor.session;
-  const measured = Object.entries(caps).flatMap(([family, used]) => {
-    const capDelta = used - (anchor.caps[family] ?? used);
-    return sessionDelta >= SESSION_COST_MIN_DELTA && capDelta > 0 ? [[family, (100 * capDelta) / sessionDelta] as const] : [];
-  });
-  const familyCosts = { ...carried, ...Object.fromEntries(measured) };
-  return { anchor, ...(Object.keys(familyCosts).length > 0 ? { familyCosts } : {}) };
-}
 
 export function writeUsage(input: UsageState, opts: { stamp?: boolean } = {}): boolean {
   const prev = loadUsage();
   const stamp = opts.stamp === true;
   const carriedSampleAt = prev != null && prev.account === input.account ? (prev.sampledAt ?? prev.ts) : undefined;
   const sampledAt = stamp ? (carriedSampleAt ?? input.sampledAt) : input.ts;
-  const next: UsageState = { ...input, ...measureSessionWindow(prev, input, stamp), ...(sampledAt != null ? { sampledAt } : {}) };
+  const next: UsageState = { ...input, ...(sampledAt != null ? { sampledAt } : {}) };
   if (
     prev &&
     isEqual({ ...prev, ts: 0, sampledAt: 0 }, { ...next, ts: 0, sampledAt: 0 }) &&

package/src/lib/types.ts

@@ -41,51 +41,22 @@ export type UsageWindows = z.infer<typeof UsageWindowsSchema>;
 const ModelInfoSchema = z.object({ id: z.string(), display: z.string() });
 export type ModelInfo = z.infer<typeof ModelInfoSchema>;
 
-const WindowAnchorSchema = z.object({
-  fiveHourResetsAt: z.number().nullable(),
-  sevenDayResetsAt: z.number().nullable(),
-  session: z.number(),
-  weekly: z.number(),
-});
-export type WindowAnchor = z.infer<typeof WindowAnchorSchema>;
-
 export const UsageStateSchema = UsageWindowsSchema.extend({
   account: z.string().nullable(),
   ts: z.number(),
   model: ModelInfoSchema.nullable().default(null),
-  anchor: WindowAnchorSchema.optional(),
-  sessionWindowWeeklyCost: z.number().positive().optional(),
   sampledAt: z.number().optional(),
 });
 export type UsageState = z.infer<typeof UsageStateSchema>;
 
-const FamilyAnchorSchema = z.object({
-  fiveHourResetsAt: z.number().nullable(),
-  session: z.number(),
-  caps: z.record(z.string(), z.number()),
-});
-export type FamilyAnchor = z.infer<typeof FamilyAnchorSchema>;
-
 export const ModelUsageStateSchema = z.object({
   perModel: z.record(z.string(), UsageWindowSchema).default({}),
   account: z.string().nullable(),
   ts: z.number(),
   sampledAt: z.number().optional(),
-  anchor: FamilyAnchorSchema.optional(),
-  familyCosts: z.record(z.string(), z.number()).optional(),
 });
 export type ModelUsageState = z.infer<typeof ModelUsageStateSchema>;
 
-export const BankedResetOutcomeSchema = z.enum(["reset", "already_used", "not_limited", "ineligible", "unavailable", "rate_limited", "auth_error", "error"]);
-export type BankedResetOutcome = z.infer<typeof BankedResetOutcomeSchema>;
-
-export const BankedResetRecordSchema = z.object({
-  outcome: BankedResetOutcomeSchema,
-  at: z.number(),
-  nextAvailableAt: z.number().nullable(),
-});
-export type BankedResetRecord = z.infer<typeof BankedResetRecordSchema>;
-
 export const AccountSchema = z.object({
   accountUuid: z.string(),
   email: z.string(),
@@ -102,8 +73,6 @@ export const AccountSchema = z.object({
   needsReauth: z.boolean().optional(),
   subscriptionType: z.string().optional(),
   rateLimitTier: z.string().optional(),
-  sessionWindowWeeklyCost: z.number().positive().optional(),
-  bankedReset: BankedResetRecordSchema.optional(),
 });
 export type Account = z.infer<typeof AccountSchema>;
 
@@ -120,7 +89,6 @@ export const NextCheckSchema = z.object({ dueAt: z.number(), ts: z.number() });
 
 export const EnforcedLimitSchema = z.object({
   account: z.string(),
-  kind: z.enum(["session", "weekly", "model"]),
   family: z.string().nullable(),
   resetsAt: z.number().nullable(),
   windowMs: z.number(),
@@ -145,10 +113,6 @@ export const ScreeningThresholdsSchema = z.object({
   weekly: z.number().min(0).max(100),
 });
 
-export const BankedResetProviderSchema = z.enum(["claude", "codex"]);
-export type BankedResetProvider = z.infer<typeof BankedResetProviderSchema>;
-export const BankedResetProvidersSchema = z.array(BankedResetProviderSchema);
-
 export const ConfigSchema = z
   .object({
     thresholds: ScreeningThresholdsSchema,
@@ -163,7 +127,6 @@ export const ConfigSchema = z
       usagePollTtlMs: z.number().int().positive(),
       maxWaitMs: z.number().int().positive(),
       checkIntervalMs: z.number().int().min(10_000),
-      preferToUseBankedReset: BankedResetProvidersSchema,
     }),
   })
   .refine((cfg) => cfg.policy.projectionMargin < Math.min(...cfg.thresholds.session, cfg.thresholds.weekly), {
@@ -181,7 +144,6 @@ export const RespawnMarkerSchema = z.object({
   sessionId: z.string(),
   prompt: z.string().optional(),
   launchedAt: z.number().optional(),
-  reset: z.boolean().optional(),
 });
 
 export const RateLimitsStdinSchema = z.looseObject({
@@ -281,21 +243,9 @@ export const CodexUsageSchema = z.object({
   planType: z.string().nullable(),
   aggregate: z.array(CodexWindowSchema),
   perLimit: z.record(z.string(), z.array(CodexWindowSchema)),
-  resetCredits: z.number().int().nullable(),
-  reachedType: z.string().nullable(),
 });
 export type CodexUsage = z.infer<typeof CodexUsageSchema>;
 
-export const CodexBankedResetOutcomeSchema = z.enum(["reset", "nothing_to_reset", "no_credit", "already_redeemed", "auth_error", "error"]);
-export type CodexBankedResetOutcome = z.infer<typeof CodexBankedResetOutcomeSchema>;
-
-export const CodexBankedResetRecordSchema = z.object({
-  outcome: CodexBankedResetOutcomeSchema,
-  at: z.number(),
-  key: z.string().optional(),
-});
-export type CodexBankedResetRecord = z.infer<typeof CodexBankedResetRecordSchema>;
-
 const BareFileNameSchema = z
   .string()
   .refine((s) => s.length > 0 && s !== "." && s !== ".." && !s.includes("/") && !s.includes("\\"), {
@@ -314,12 +264,9 @@ export const CodexAccountSchema = z.object({
     .object({
       aggregate: z.array(CodexWindowSchema),
       perLimit: z.record(z.string(), z.array(CodexWindowSchema)),
-      resetCredits: z.number().int().nullable().optional(),
-      reachedType: z.string().nullable().optional(),
     })
     .optional(),
   lastUsageAt: z.number().optional(),
-  bankedReset: CodexBankedResetRecordSchema.optional(),
 });
 export type CodexAccount = z.infer<typeof CodexAccountSchema>;
 

package/agent-plugin/bin/tokenmaxxing-mcp

@@ -1,7 +0,0 @@
-#!/usr/bin/env bun
-import { main } from "../../src/entries/mcp.ts";
-
-main().catch((e: unknown) => {
-  console.error(e instanceof Error ? e.message : String(e));
-  process.exit(1);
-});

package/agent-plugin/mcp.json

@@ -1,10 +0,0 @@
-{
-  "$schema": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
-  "mcpServers": {
-    "tokenmaxxing": {
-      "type": "stdio",
-      "command": "./bin/tokenmaxxing-mcp",
-      "cwd": "${PLUGIN_ROOT}"
-    }
-  }
-}

package/agent-plugin/plugin.json

@@ -1,20 +0,0 @@
-{
-  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
-  "name": "tokenmaxxing",
-  "version": "1.20.0",
-  "description": "Pool Claude Code and Codex logins, switch on pace pressure, and expose safe ops tools to agent clients.",
-  "author": {
-    "name": "anaclumos",
-    "url": "https://github.com/anaclumos"
-  },
-  "homepage": "https://github.com/anaclumos/tokenmaxxing",
-  "repository": "https://github.com/anaclumos/tokenmaxxing",
-  "license": "MIT",
-  "keywords": [
-    "claude",
-    "codex",
-    "quota",
-    "account-switching",
-    "mcp"
-  ]
-}

package/agent-plugin/skills/codex-pool/SKILL.md

@@ -1,23 +0,0 @@
----
-name: codex-pool
-description: Operate the Codex side of the pool (restart-is-switch, no Layer 2, never target a running sibling). Use for codex init/switch/status questions or MCP pool_switch with codex=true.
----
-
-# Codex pool
-
-## Mechanics
-
-- No hot-swap: restart IS the switch (`codex resume <sid>`). A credential write takes effect on the next codex start.
-- Auto-switching needs trusted hooks (`/hooks`). Do not clobber the user's `notify` key in `config.toml`.
-- Refresh-token reuse is punished; a superseded token can kill the grant family. Persist every rotation immediately.
-- An account running in another supervised session is never a swap target and never sampler-refreshed. Parked does not mean idle.
-- Classify windows by DURATION, never by position. Some plans have no 5h window.
-- Layer 2 wall squeeze is Claude-only. Do not extend it to Codex.
-
-## Agent actions
-
-- Read: `pool_ls` / `pool_status` (Codex section included when present).
-- Mutate: MCP `pool_switch` with `codex=true`, `confirm=true`, and `TOKENMAXXING_AGENT_MUTATIONS=1` after user approval.
-- Interactive `init --codex` / `add --codex` / reauth stay human-driven.
-
-See [references/codex.md](references/codex.md).

package/agent-plugin/skills/codex-pool/references/codex.md

@@ -1,5 +0,0 @@
-# Codex references
-
-- `docs/content/docs/codex.mdx`
-- `src/lib/codexdecide.ts`, `src/lib/codexpick.ts`, `src/lib/codexswap.ts`
-- `.memory/cc-codex-auth-mechanics.md`

package/agent-plugin/skills/credentials-hygiene/SKILL.md

@@ -1,27 +0,0 @@
----
-name: credentials-hygiene
-description: Credential and identity rules for tokenmaxxing (fetchTokenIdentity account-uuid identity, flock, no blob compare, never print secrets). Use before any auth, swap, or credential-touching change.
----
-
-# Credentials hygiene
-
-## Identity
-
-- Identity is the `accountUuid` that `fetchTokenIdentity` reports for a token (`GET /api/oauth/profile`), never the organization, never a stored label, and never a blob byte compare. Every seat of a Team plan shares one `organizationUuid`, so an org-keyed lookup collapses the seats onto one account. Two rotations of one account differ byte-for-byte.
-- Park a credential under its token's real owner. Commit the active label in the same critical section as credential writes.
-- Every live-store write goes through `withClaudeRefreshLock` (Claude). Near-expiry sessions can rotate into the live store at any moment.
-- A refresh rotation revokes the previous access token at once, so refreshing any copy of a credential that is live elsewhere kills those sessions' token.
-
-## Isolation
-
-- Refuse ambient `CLAUDE_CONFIG_DIR` / `CLAUDE_SECURESTORAGE_CONFIG_DIR` in CLI, SDK, and MCP.
-- A missing namespaced keychain item never falls back to the live one.
-- Same accounts pooled on several hosts race on refresh (documented limitation).
-
-## Agent hard stops
-
-- No tool may return keychain blobs, `.credentials.json`, `auth.json`, or OAuth access/refresh tokens.
-- Do not bypass Claude `/usage` with direct `GET /api/oauth/usage` (owner-rejected; 429s on the active session).
-- Prefer MCP read tools; never `cat` credential paths into the transcript.
-
-See [references/credentials.md](references/credentials.md).

package/agent-plugin/skills/credentials-hygiene/references/credentials.md

@@ -1,6 +0,0 @@
-# Credential references
-
-- `docs/content/docs/credentials.mdx`
-- `DESIGN.md` sections on install and swap
-- `.memory/cc-codex-auth-mechanics.md`
-- `src/lib/credstore.ts`, `src/lib/oauth.ts`

package/agent-plugin/skills/doctor-diagnostics/SKILL.md

@@ -1,26 +0,0 @@
----
-name: doctor-diagnostics
-description: Diagnose a broken or incomplete tokenmaxxing install (supervisor, hooks, timer, credential identity). Use when doctor fails, PATH looks wrong, or identity drift is suspected. Prefer the MCP doctor tool.
----
-
-# Doctor and diagnostics
-
-## Prefer MCP
-
-Call `doctor`. It checks the supervisor wrapper, settings hooks, periodic timer, live/parked credential presence, and org identity match. Output is pass/fail plus labels.
-
-Also useful: `config_get` (no key) for effective config sources, and `pool_ls` for needs-reauth.
-
-## Hard stops
-
-- Never dump keychain items, `.credentials.json`, `auth.json`, or OAuth tokens into chat.
-- Doctor never refreshes tokens. Expired access tokens show as unverifiable identity, not as a prompt to paste secrets.
-- Do not run `init` / `add` / `auth` from an agent session without the user present for interactive login.
-
-## Common repairs (ask before mutating)
-
-- Missing wrapper or hooks: user runs `tokenmaxxing init` (or `init --codex`).
-- needs-reauth: user runs `tokenmaxxing auth <label>` (or `--all`).
-- PATH: `binDir` must precede the real claude.
-
-See [references/troubleshooting.md](references/troubleshooting.md).

package/agent-plugin/skills/doctor-diagnostics/references/troubleshooting.md

@@ -1,5 +0,0 @@
-# Troubleshooting pointers
-
-- `docs/content/docs/troubleshooting.mdx`
-- `docs/content/docs/state-directory.mdx` for where state lives under `~/.config/tokenmaxxing` (or `TOKENMAXXING_HOME`)
-- Ambient `CLAUDE_CONFIG_DIR` / `CLAUDE_SECURESTORAGE_CONFIG_DIR` must be unset for CLI, SDK, and this MCP server

package/agent-plugin/skills/pool-status/SKILL.md

@@ -1,27 +0,0 @@
----
-name: pool-status
-description: Read the Claude and Codex account pool safely (list, usage bars, watch). Use when checking quota, which account is active, needs-reauth, or before any switch. Prefer MCP pool_ls and pool_status over raw shell.
----
-
-# Pool status (safe reads)
-
-## Prefer MCP
-
-- `pool_ls` for labels, active marker, needs-reauth
-- `pool_status` for 5h / weekly / per-model bars (free `/usage` path)
-
-If MCP is unavailable, run `tokenmaxxing ls --json` or `tokenmaxxing status --json` (alias `xx`) and parse the document. Never add `--ping`.
-
-## Hard stops
-
-- Do not run `status --ping` or bare `xx --ping`. That pings every account with a real request and opens each 5h window.
-- Do not print credential files, keychain blobs, or OAuth tokens. Labels and status only.
-- Do not kill sessions or supervisors to "free" an account.
-
-## Notes
-
-- Active Claude usage often comes from the statusLine tee; parked accounts are probed in isolation.
-- `watch` re-renders status on an interval and never pings.
-- Hermetic agents: set `TOKENMAXXING_HOME` to a throwaway directory. That isolates state files only: `init`, `uninstall`, and the codex hook install still write settings.json, codex `hooks.json`, the shell rc, and the timer unit under `HOME`, so never run them from an agent.
-
-See [references/commands.md](references/commands.md).

package/agent-plugin/skills/pool-status/references/commands.md

@@ -1,9 +0,0 @@
-# Status and list commands
-
-- `tokenmaxxing` / `tokenmaxxing status`: sample and show bars; persists cached usage for the picker.
-- `tokenmaxxing status --ping [--count N]`: DENIED for agents without explicit user approval. Meters every account, or N random ones under `--count`.
-- `tokenmaxxing ls`: compact list.
-- `tokenmaxxing watch [seconds]`: live re-render (default 120), never `--ping`.
-- `--json` on any of these: one JSON document on stdout (`ok` mirrors the exit code); parse it instead of scraping the bars. `watch --json` prints one document per tick and never exits on its own.
-
-Docs: `docs/content/docs/commands.mdx`.

package/agent-plugin/skills/safe-contribution/SKILL.md

@@ -1,27 +0,0 @@
----
-name: safe-contribution
-description: Safely change and ship tokenmaxxing (verification without a test suite, PR window, Mac vs Linux skew, public-repo hygiene). Use when editing this repo, opening PRs, or verifying decision-path changes.
----
-
-# Safe contribution
-
-## Verify
-
-- The repo carries no test code and no comments (owner ruling 2026-09-02). Never add tests, a test script, or comments.
-- Verify with `bun run typecheck`, then hermetic CLI runs: `TOKENMAXXING_HOME=/tmp/xx-test bun run src/main.ts ...` (for decision-path changes, write accounts.json, usage.json, config.json, and a claude.json under that root and run `check`; point `TOKENMAXXING_KEYCHAIN_SERVICE` and `TOKENMAXXING_KEYCHAIN_ACCOUNT` at throwaway names and `TOKENMAXXING_CLAUDE_JSON` at that claude.json, because the CLI resolves claude.json from HOME, not from `TOKENMAXXING_HOME`).
-- Ask before any run that meters real quota (`status --ping`, live-pool inference). Free `/usage` / plain status is fine.
-
-## Ship
-
-- Work on a branch; bump `package.json` and `agent-plugin/plugin.json` to the same version in the same PR; open PR; wait the full review window; handle every review; merge; `gh release create v<version>`; verify npm publish.
-- A PR that changes no packed file skips the bump and the release, and merging it is shipping it. Check membership with `npm pack --dry-run`, not the `files` array: the tarball is `src`, `agent-plugin`, `README.md`, `DESIGN.md`, `LICENSE`, and `package.json`, the last two always packed though `files` never names them. So a `docs/`, `.memory/`, or AGENTS.md change is exempt, while a LICENSE or metadata change is not. Everything else, the full review window included, still applies.
-- Never push directly to main. npm trusted publishing is bound to workflow filename `ci.yml`.
-
-## Machine gotchas
-
-- The owner's Mac may run this working tree live. Do not kill sessions or supervisors without asking.
-- Linux boxes often run an older npm global: compare installed version before "works on Mac not Linux" debugging.
-- Repo is PUBLIC: no Slack IDs, device info, or secrets in commits, PRs, docs, or `.memory`.
-- Do not reintroduce banned patterns listed in `AGENTS.md` (Stop text-sniff failsafe, rejected statusline formats, old-state shims).
-
-See [references/ship.md](references/ship.md).

package/agent-plugin/skills/safe-contribution/references/ship.md

@@ -1,5 +0,0 @@
-# Ship and testing references
-
-- `AGENTS.md` (Release and CI, Testing, Do not reintroduce)
-- `.memory/shipping-pr-based.md`
-- `.memory/review-window-is-mandatory-full-length.md`

package/agent-plugin/skills/sdk-pairing/SKILL.md

@@ -1,34 +0,0 @@
----
-name: sdk-pairing
-description: Pair tokenmaxxing with the Claude Agent SDK (ensureBestAccount, pooledOptions, stopHookCheck). Use when building or debugging Bun agents that spawn Claude through the pooled credential store.
----
-
-# SDK pairing
-
-Import from the package root (`tokenmaxxing` → `src/sdk.ts`). Bun only.
-
-```ts
-import { query } from "@anthropic-ai/claude-agent-sdk";
-import { ensureBestAccount, pooledOptions, stopHookCheck } from "tokenmaxxing";
-
-await ensureBestAccount();
-for await (const message of query({
-  prompt: "...",
-  options: {
-    ...pooledOptions(),
-    hooks: { Stop: [{ hooks: [stopHookCheck] }] },
-  },
-})) {
-}
-```
-
-The loop body receives the message stream; keep the session id from the init message for `resume` across swaps.
-
-## Rules
-
-- Call `ensureBestAccount()` before each `query()` spawn (no mid-query hot-swap).
-- `pooledOptions()` pins the real claude binary and a full replacement env with credential overrides scrubbed. It throws if `CLAUDE_CONFIG_DIR` or `CLAUDE_SECURESTORAGE_CONFIG_DIR` is set.
-- `stopHookCheck` re-decides at turn boundaries; errors are swallowed so a broken check does not abort the turn.
-- Own-accounts only (see terms docs). Offering pooled subscription logins to third parties is a ToS problem.
-
-See [references/sdk.md](references/sdk.md).

package/agent-plugin/skills/sdk-pairing/references/sdk.md

@@ -1,6 +0,0 @@
-# SDK references
-
-- `src/sdk.ts` (self-documenting header)
-- `docs/content/docs/sdk.mdx`
-- `docs/content/docs/terms.mdx`
-- `.memory/agent-sdk-auth-surface.md`

package/agent-plugin/skills/switching-policy/SKILL.md

@@ -1,35 +0,0 @@
----
-name: switching-policy
-description: Explain and apply tokenmaxxing switch policy (greedy vs hard path, pace pressure, Layer 2 wall squeeze Claude-only, model-family matching). Use before pool_switch, pool_check, or when changing thresholds.
----
-
-# Switching policy
-
-## Vocabulary
-
-- **Engaged**: session used >= `policy.greedySessionFloor` (default 80) or any screening bar crossed.
-- **GREEDY path** permits lateral moves only within the incumbent organization and retains `greedySwapMargin` hysteresis.
-- **HARD path** starts at a crossed screening bar and may cross organizations, with Layer 2 as its fallback.
-- **Organization preference** requires measured headroom in session, aggregate weekly and gated model windows under the [policy](references/policy.md).
-- **Verification** attempts at most two stale candidates per evaluation, with a 12-second deadline covering identity reads and the CLI for each candidate.
-- **Probe results** are persisted and re-ranked, while screening exhaustion remains eligible for the wall squeeze and reset selection.
-- **Unavailable verification** leaves cached figures in force, and verification never spends a parked refresh grant.
-- **Manual switch** retains pure pace ranking with no organization preference or incumbent margin.
-- **Pace pressure**: remaining weekly percent / time to weekly reset (highest first). Not most-remaining.
-- **Effective bars**: `effectiveBars(cfg, pool)` = the active rung of the 5h ladder (`thresholds.session`, default `[90]`, a single rung: the lowest rung some pooled account, the current one included, still clears) and the weekly bar, each minus `policy.projectionMargin`. Trigger and screening must share these bars or swaps ping-pong. Codex reads `terminalBars(cfg)`, the top rung only. The check cadence is capped one band per rung climbed, and every band is a multiple of the tick `policy.checkIntervalMs` (default 60000).
-- **Banked reset**: opt-in via `policy.preferToUseBankedReset` (a provider list, default `[]`), hard path only. Claude: the seat holds between the session rung and the wall while a reset is believed available and the weekly windows have room for one more measured session window (`sessionWindowWeeklyCost`; unmeasured swaps), claims the `/limit-reset` server call at the wall, and keeps the seat on `reset` (the failed turn is retriggered in place). Codex: rides to the wall while a reset credit exists, consumes one, no restart. The greedy path never resets.
-
-## Layer 2 (Claude only)
-
-When the hard path finds no usable target, judge against the wall (`hardThresholds` minus margin). Under-wall seat HOLDS; walled seat swaps to best under-wall sibling. Codex has no Layer 2 last-drop swap (cannot hot-adopt).
-
-## Model matching
-
-Match model families by exact token after splitting id/display on spaces, dots, and hyphens (`familyTokens` / `matchedFamily` in `src/lib/usage.ts`). Never exact full display strings (names drift: "Fable" / "Fable 5"). Unmeasured usage is unknown and ranks last, never 0 / first. Per-model weekly caps: Sonnet and Fable exist; only Fable gates a switch by default (`policy.switchModels`).
-
-## Agent actions
-
-- Explain with this skill; mutate only via MCP `pool_switch` / `pool_check` with user approval, `confirm=true`, and `TOKENMAXXING_AGENT_MUTATIONS=1`.
-- Do not reintroduce Stop-hook text-sniffing limit failsafes.
-
-See [references/policy.md](references/policy.md).

package/agent-plugin/skills/switching-policy/references/policy.md

@@ -1,10 +0,0 @@
-# Policy sources
-
-- `docs/content/docs/switching.mdx`
-- `src/lib/decide.ts`, `src/lib/picker.ts`
-- `src/lib/bankedreset.ts`, `src/lib/codexreset.ts` (banked limit resets)
-- `.cursor/rules/switch-verification.md`
-
-Automatic organization preference requires session usage below `greedySessionFloor` and more than `max(1, session bar - greedySessionFloor)` points below every applicable bar.
-
-The exact policy, defaults, verification limits and manual-switch behavior live in `docs/content/docs/switching.mdx`.