tokenmaxxing 1.25.0 → 1.26.0

package/DESIGN.md

@@ -54,7 +54,7 @@ The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limi
 3. Done - the running session adopts the new credential on its own within a request or two. Only when the pool is depleted (the decision returned a `waitUntil`: pre-parked on the soonest-recovering account, or staying on the current one when it recovers first) does the hook write `respawn/<session_id>` (atomic temp+rename).
 
 ### 3.3 Depleted-pool pause (supervisor)
-The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed turn boundary, deletes the marker, resets the terminal, shows an interruptible countdown to the reset, and relaunches `claude --resume <sid>` when it passes. The resumed process reads the keychain cold → runs on the recovered account, same conversation. The `SessionStart` hook (source `resume`) re-checks the account before the first turn as a backstop.
+The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed turn boundary, deletes the marker, resets the terminal, shows an interruptible countdown to the reset, and relaunches `claude --resume <sid>` when it passes. The resumed process reads the keychain cold → runs on the recovered account, same conversation. The `SessionStart` hook (source `resume`) re-checks the account before the first turn as a backstop. A marker that fails to parse is never deleted and treated as absent. The supervisor stops the child, restores the terminal, and exits naming the marker path.
 
 ### 3.4 Swap sequence (under the lock)
 1. **Harvest the live credential into its TRUE owner's backup** - read the current `Claude Code-credentials` blob and resolve which account it actually belongs to via the profile endpoint (`GET /api/oauth/profile`, matched on `account.uuid`), NOT the `accounts.json` active label and NOT the organization (team seats share one). The label drifts from the live blob (a kill mid-swap, a manual `/login`), and harvesting by label once overwrote another account's backup and destroyed its only credential. Mandatory anyway: Claude rotates the refresh token in place, so older backups are dead. Refuse the swap if the live credential belongs to no pooled account.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.25.0",
+  "version": "1.26.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",

package/src/entries/codexsupervisor.ts

@@ -21,13 +21,14 @@ const NONINTERACTIVE_SUBCMDS = new Set([
 
 const PASSTHROUGH_FLAGS = new Set(["--version", "-V", "--help", "-h"]);
 
-function consumableCodexMarker(marker: string): z.infer<typeof CodexRespawnMarkerSchema> | null {
+function readCodexMarker(marker: string): z.infer<typeof CodexRespawnMarkerSchema> {
   try {
     return CodexRespawnMarkerSchema.parse(JSON.parse(readFileSync(marker, "utf8")));
   } catch (e) {
-    rmSync(marker, { force: true });
     log("codexsupervisor.marker_invalid", { err: e instanceof Error ? e.message : String(e) });
-    return null;
+    throw new Error(
+      `${marker} is corrupt (unparsable JSON or off-schema) - auth.json may already hold another account, so the codex session was stopped instead of resumed on stale credentials; inspect and remove the marker, then run \`codex resume\``,
+    );
   }
 }
 
@@ -126,7 +127,10 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
     let done = false;
     const markerWatch = (async () => {
       while (!done) {
-        if (existsSync(marker) && consumableCodexMarker(marker) != null) return true;
+        if (existsSync(marker)) {
+          readCodexMarker(marker);
+          return true;
+        }
         await Bun.sleep(150);
       }
       return false;
@@ -135,17 +139,20 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
       done = true;
       return "exit";
     });
-    const winner = await Promise.race([exited, markerWatch.then((found) => (found ? "marker" : "exit"))]);
-
-    if (winner === "marker") {
+    try {
+      const winner = await Promise.race([exited, markerWatch.then((found) => (found ? "marker" : "exit"))]);
+      if (winner === "marker") child.kill();
+    } catch (e) {
       child.kill();
+      throw e;
+    } finally {
+      await child.exited;
+      done = true;
+      await markerWatch.catch(() => false);
+      restoreTermios(savedTermios);
     }
-    await child.exited;
-    done = true;
-    await markerWatch.catch(() => false);
-    restoreTermios(savedTermios);
 
-    const payload = existsSync(marker) ? consumableCodexMarker(marker) : null;
+    const payload = existsSync(marker) ? readCodexMarker(marker) : null;
     if (payload) {
       rmSync(marker, { force: true });
       respawns++;

package/src/entries/supervisor.ts

@@ -1,5 +1,5 @@
 import { existsSync, mkdirSync, readFileSync, rmSync, readdirSync, statSync } from "node:fs";
-import { join } from "node:path";
+import { basename, join } from "node:path";
 import { maxBy } from "es-toolkit";
 import { z } from "zod";
 import { paths } from "../lib/paths.ts";
@@ -152,9 +152,10 @@ function consumableMarker(marker: string, gate: MarkerGate): z.infer<typeof Resp
   try {
     m = RespawnMarkerSchema.parse(JSON.parse(readFileSync(marker, "utf8")));
   } catch (e) {
-    rmSync(marker, { force: true });
     log("supervisor.marker_invalid", { err: e instanceof Error ? e.message : String(e) });
-    return null;
+    throw new Error(
+      `${marker} is corrupt (unparsable JSON or off-schema) - the session was stopped instead of guessing whether the pool is depleted; inspect the marker, then run \`claude --resume ${basename(marker)}\` (a fresh launch clears it)`,
+    );
   }
   if (m.launchedAt !== undefined && m.launchedAt !== gate.launchedAt) {
     rmSync(marker, { force: true });
@@ -270,15 +271,18 @@ export async function runSupervisor(argv: string[]): Promise<number> {
       return false;
     })();
     const exited = child.exited.then(() => { done = true; return "exit" as const; });
-    const winner = await Promise.race([exited, markerWatch.then((m) => (m ? "marker" : "exit"))]);
-
-    if (winner === "marker") {
+    try {
+      const winner = await Promise.race([exited, markerWatch.then((m) => (m ? "marker" : "exit"))]);
+      if (winner === "marker") child.kill();
+    } catch (e) {
       child.kill();
+      throw e;
+    } finally {
+      await child.exited;
+      done = true;
+      await markerWatch.catch(() => {});
+      restoreTermios(savedTermios);
     }
-    await child.exited;
-    done = true;
-    await markerWatch.catch(() => {});
-    restoreTermios(savedTermios);
 
     const m = existsSync(marker) ? consumableMarker(marker, gate) : null;
     if (m) {

package/src/lib/codexoauth.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { http, safeErrorDetail } from "./http.ts";
+import { http, oauthErrorCode, safeErrorDetail } from "./http.ts";
 import { CodexAuthJsonSchema, type CodexAuthJson } from "./types.ts";
 
 const EnvOverrideSchema = z.string().min(1).optional().catch(undefined);
@@ -26,12 +26,12 @@ const CodexRefreshResponseSchema = z.looseObject({
   refresh_token: z.string().optional(),
 });
 
-const DEAD_GRANT_MARKERS = [
+const DEAD_GRANT_CODES = new Set([
   "invalid_grant",
   "refresh_token_reused",
   "refresh_token_expired",
   "refresh_token_invalidated",
-];
+]);
 
 export async function refreshCodexAuth(input: { auth: CodexAuthJson; now?: number }): Promise<CodexAuthJson> {
   const { auth, now = Date.now() } = input;
@@ -53,7 +53,8 @@ export async function refreshCodexAuth(input: { auth: CodexAuthJson; now?: numbe
   const text = await res.text();
   if (!res.ok) {
     const detail = safeErrorDetail({ text });
-    if (DEAD_GRANT_MARKERS.some((marker) => text.includes(marker))) {
+    const code = oauthErrorCode({ text })?.toLowerCase();
+    if (code != null && DEAD_GRANT_CODES.has(code)) {
       throw new CodexInvalidGrantError(detail);
     }
     throw new CodexRefreshFailedError(`HTTP ${res.status}: ${detail}`);

package/src/lib/http.ts

@@ -7,7 +7,7 @@ const OAuthErrorBodySchema = z.looseObject({
 });
 
 const NestedErrorBodySchema = z.looseObject({
-  error: z.looseObject({ type: z.string().optional(), message: z.string().optional() }),
+  error: z.looseObject({ code: z.string().nullish(), type: z.string().optional(), message: z.string().optional() }),
   request_id: z.string().nullish(),
 });
 
@@ -31,7 +31,8 @@ function parseErrorBody(text: string): ErrorDetail | null {
   const nested = NestedErrorBodySchema.safeParse(json);
   if (nested.success) {
     const requestId = nested.data.request_id ? ` (${nested.data.request_id})` : "";
-    return { code: nested.data.error.type ?? null, fields: [nested.data.error.type ?? "", (nested.data.error.message ?? "") + requestId] };
+    const code = nested.data.error.code ?? nested.data.error.type ?? null;
+    return { code, fields: [code ?? "", (nested.data.error.message ?? "") + requestId] };
   }
   const plain = PlainErrorBodySchema.safeParse(json);
   if (plain.success) return { code: null, fields: [plain.data.detail ?? "", plain.data.message ?? ""] };