tokenmaxxing 1.26.0 → 1.28.0

package/DESIGN.md

@@ -50,7 +50,7 @@ The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limi
 
 ### 3.2 Detect + swap + signal (Stop hook, per turn)
 1. Read `usage.json` and exit while the live account is under both bars, as defined in the [switching policy](docs/content/docs/switching.mdx).
-2. Take the pool lock, re-check state, select a candidate under the [switching policy](docs/content/docs/switching.mdx), and attempt bounded verification of stale usage before swapping the credential.
+2. Take the pool lock, re-check state, select a candidate under the [switching policy](docs/content/docs/switching.mdx) from the cached usage figures, and swap the credential.
 3. Done - the running session adopts the new credential on its own within a request or two. Only when the pool is depleted (the decision returned a `waitUntil`: pre-parked on the soonest-recovering account, or staying on the current one when it recovers first) does the hook write `respawn/<session_id>` (atomic temp+rename).
 
 ### 3.3 Depleted-pool pause (supervisor)
@@ -82,10 +82,7 @@ Each terminal ran the supervisor, so each has its own child `claude` and its own
 The [switching policy](docs/content/docs/switching.mdx) is one rule: under both bars, hold; at or over a bar, move to the usable account with the highest pace pressure; nothing usable, wait for the soonest reset.
 
 - Automatic and manual switching rank by pace pressure alone; organization membership is not an input.
-- Successful candidate probes persist their results and restart selection.
-- Verification attempts at most two candidates with a shared 12-second deadline per candidate for identity reads and CLI execution.
-- Expiring access tokens are not refreshed for verification, and the isolated CLI receives no refresh grant.
-- Failed or budget-limited verification uses the existing cached data, so stale-target handoffs remain possible.
+- Selection reads the cached figures only. Each periodic check tick samples the parked account whose last `/usage` attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`, so every parked account is attempted about once per tick per pooled account, or once per `policy.usagePollTtlMs` plus a tick when that is longer, and its cached figure is as fresh as its last successful attempt. No sample runs inside the post-swap cooldown. The pool lock covers only the reservation (its owner lookups and refresh under one 20-second deadline) and the result write, never the `/usage` child.
 - The depleted pause happens at the bar, not at 100; Codex has no pause and rides its account until the server refuses it, because a running sibling cannot adopt another account without restarting.
 
 The [profile](docs/content/docs/switching-profile.mdx) records observed cache rewrites across swaps and does not infer subscription quota savings.

package/README.md

@@ -70,8 +70,7 @@ claude                  # use claude as always
 | `tokenmaxxing switch --codex [sel]` | switch the codex pool (takes effect on the next codex start) |
 | `tokenmaxxing ls` | list pooled accounts |
 | `tokenmaxxing status` | accounts with 5h / weekly usage bars, active + exhausted-until-reset |
-| `tokenmaxxing status --ping [--count N]` | additionally ping every account (one tiny haiku request each) so all 5h session timers start now, then sample fresh; `--count N` pings N randomly picked accounts instead, to stagger the resets |
-| `tokenmaxxing watch [seconds]` | live status: re-render every N seconds (default 120, floor 30; never pings) |
+| `tokenmaxxing watch [seconds]` | live status: re-render every N seconds (default 120, floor 30) |
 | `tokenmaxxing config` | effective config with sources; `get`/`set`/`unset` dotted keys, `tidy` prunes unknown keys |
 | `tokenmaxxing doctor` | verify the supervisor + settings entries survived |
 | `tokenmaxxing rename [--codex] <sel> <label>` / `rm [--codex] <sel>` | manage the pool (`--codex` targets the codex pool: one email can hold both a claude and a codex account) |
@@ -89,8 +88,7 @@ The bars' headroom is deliberate: it's the budget to reach a clean turn boundary
 
 Selection ranks usable candidates by remaining weekly percentage divided by time to reset, highest first; organization membership is not an input, and manual `tokenmaxxing switch` uses the same ranking.
 
-- Candidate verification makes at most two bounded `/usage` attempts per evaluation and re-ranks successful samples before switching.
-- Failed verification leaves cached figures in force, so it cannot guarantee a fresh target.
+- Every periodic check tick samples the parked account whose last `/usage` attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`, so every parked account is attempted about once per tick per pooled account, or once per `usagePollTtlMs` plus a tick when that is longer; the swap reads the cached figures, which are as fresh as each account's last successful attempt. No sample runs inside the 45-second post-swap cooldown.
 - When no account is usable, the session pauses until the soonest reset if that lands within `policy.maxWaitMs`, and otherwise stays put.
 
 See [How switching decides](docs/content/docs/switching.mdx) for the policy and the [cache-cost profile](docs/content/docs/switching-profile.mdx) for measurements and their limits.
@@ -111,7 +109,7 @@ See [How switching decides](docs/content/docs/switching.mdx) for the policy and
 }
 ```
 
-`thresholds.session` and `thresholds.weekly` are the two bars, one number each (an array `thresholds.session`, the former ladder, fails config loading with a message naming the field); `projectionMargin` is a fixed safety margin subtracted from each threshold bar (effective bar = threshold - margin), so a large turn is less likely to blow past a bar between checks; `switchModels` names the models whose per-model cap triggers a switch; `usagePollTtlMs` is how long a `/usage` per-model poll stays fresh; `maxWaitMs` bounds the depleted-pool countdown - a soonest reset further out than this does not pause the session (no respawn marker is written and the session simply keeps hitting its limit until an account recovers); `checkIntervalMs` is the periodic check tick (default 60s), which `init` writes into the timer - re-run `tokenmaxxing init` after changing it so the timer unit picks up the new tick.
+`thresholds.session` and `thresholds.weekly` are the two bars, one number each (an array `thresholds.session`, the former ladder, fails config loading with a message naming the field); `projectionMargin` is a fixed safety margin subtracted from each threshold bar (effective bar = threshold - margin), so a large turn is less likely to blow past a bar between checks; `switchModels` names the models whose per-model cap triggers a switch; `usagePollTtlMs` is how long a `/usage` attempt stays fresh, for the live per-model poll and for the parked account each check tick samples; `maxWaitMs` bounds the depleted-pool countdown - a soonest reset further out than this does not pause the session (no respawn marker is written and the session simply keeps hitting its limit until an account recovers); `checkIntervalMs` is the periodic check tick (default 60s), which `init` writes into the timer - re-run `tokenmaxxing init` after changing it so the timer unit picks up the new tick.
 
 State lives entirely in `~/.config/tokenmaxxing/`. Per-account credentials follow the platform's Claude Code store: the login keychain on macOS (`tokenmaxxing-cred-<uuid8>` items, never plaintext on disk), 0600 files under `~/.config/tokenmaxxing/creds/` on Linux (the same plaintext model claude itself uses for `~/.claude/.credentials.json`).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.26.0",
+  "version": "1.28.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",

package/src/cli/check.ts

@@ -1,11 +1,15 @@
 import { evaluateAndMaybeSwap } from "../lib/decide.ts";
+import { sampleOldestParked } from "../lib/sample.ts";
+import { loadConfig } from "../lib/state.ts";
 import { log } from "../lib/log.ts";
 import { c, emitError, emitJson, fmtReset } from "./render.ts";
 
 export async function cmdCheck(json = false): Promise<number> {
+  const now = Date.now();
   let d;
   try {
-    d = await evaluateAndMaybeSwap(Date.now());
+    d = await evaluateAndMaybeSwap(now);
+    await sampleOldestParked(loadConfig());
   } catch (e) {
     const detail = e instanceof Error ? e.message : String(e);
     log("check.error", { err: detail });

package/src/cli/init.ts

@@ -37,7 +37,6 @@ export function printUsage(): void {
   console.log(`  ${c.bold("how to use")} - ${c.cyan("xx")} is shorthand for ${c.cyan("tokenmaxxing")}:`);
   console.log(`    ${c.cyan("claude")}             use claude as always; it switches accounts near quota automatically`);
   console.log(`    ${c.cyan("xx")}                 show the pool with usage bars (same as ${c.cyan("xx status")})`);
-  console.log(`    ${c.cyan("xx status --ping")}   ping every account (one tiny haiku request each) so all 5h timers start now, then sample fresh; ${c.cyan("--count N")} pings N random accounts instead`);
   console.log(`    ${c.cyan("xx add")}             log in and pool another account`);
   console.log(`    ${c.cyan("xx switch")}          hop to the best account right now (the automatic switching needs no command)`);
   console.log(`    ${c.cyan("xx help")}            everything else`);

package/src/cli/rm.ts

@@ -44,9 +44,11 @@ export async function cmdRm(selector?: string, json = false): Promise<number> {
       }
     }
     await deleteItem(parkedTarget(a.keychainItem));
-    const sampleDir = join(paths.sampleDir, credItemFor(a.accountUuid));
-    await deleteItem(isolatedTarget(sampleDir));
-    rmSync(sampleDir, { recursive: true, force: true });
+    const item = credItemFor(a.accountUuid);
+    for (const sampleDir of [join(paths.sampleDir, item), join(paths.sampleDir, `${item}-tick`)]) {
+      await deleteItem(isolatedTarget(sampleDir));
+      rmSync(sampleDir, { recursive: true, force: true });
+    }
     idx.accounts = idx.accounts.filter((x) => x.accountUuid !== a.accountUuid);
     saveAccounts(idx);
     if (json) emitJson({ ok: true, pool: "claude", removed: a.label, remaining: idx.accounts.length });

package/src/cli/status.ts

@@ -1,4 +1,4 @@
-import { chunk, sampleSize, sortBy } from "es-toolkit";
+import { chunk, sortBy } from "es-toolkit";
 import { z } from "zod";
 import { loadAccounts, loadConfig, loadUsage, loadUsageSnapshot, loadModelUsage, saveAccounts } from "../lib/state.ts";
 import { readOAuthAccount } from "../lib/claudejson.ts";
@@ -32,9 +32,6 @@ const ClaudeStatusAccountSchema = z.object({
   perModel: z.record(z.string(), UsageWindowSchema),
   usageAt: z.number().nullable(),
   sample: SampleReportSchema,
-  pingError: z.string().nullable(),
-  pingRejected: z.boolean(),
-  pinged: z.boolean(),
 });
 type ClaudeStatusAccount = z.infer<typeof ClaudeStatusAccountSchema>;
 
@@ -86,31 +83,14 @@ function currentCodexWindow(w: CodexWindow, now: number): CodexWindow {
   return { ...currentWindow(w, !isSessionWindow({ window: w }), now), windowSeconds: w.windowSeconds };
 }
 
-function pickForPing(accounts: Account[], pingCount: number | undefined): Account[] {
-  if (pingCount == null) return accounts;
-  const usable = accounts.filter((a) => a.needsReauth !== true);
-  return sampleSize(usable, Math.min(pingCount, usable.length));
-}
-
-function progressNote(input: { ping: boolean; pingCount: number | undefined; picked: Account[]; total: number }): string {
-  const { ping, pingCount, picked, total } = input;
-  if (!ping) return "sampling live usage...";
-  if (pingCount == null) return "pinging every account (starts each 5h session timer) + sampling live usage...";
-  if (picked.length === 0) return "no account to ping (every account needs reauth), sampling live usage...";
-  return `pinging ${picked.length} of ${count({ n: total, noun: "account" })} (${picked.map((a) => a.label || a.email).join(", ")}) so their 5h session timers start now + sampling live usage...`;
-}
-
-async function collectClaude(input: { cfg: Config; ping: boolean; pingCount: number | undefined; now: number }): Promise<StatusReport["claude"]> {
-  const { cfg, ping, pingCount, now } = input;
+async function collectClaude(input: { cfg: Config; now: number }): Promise<StatusReport["claude"]> {
+  const { cfg, now } = input;
   let idx = loadAccounts();
   const samples = new Map<string, { outcome: SampleOutcome; viaTee: boolean }>();
-  let pings = new Set<string>();
   if (idx.accounts.length > 0) {
     await withLock(paths.lockFile, async () => {
       idx = loadAccounts();
-      const picked = ping ? pickForPing(idx.accounts, pingCount) : [];
-      pings = new Set(picked.map((a) => a.accountUuid));
-      console.error(c.dim(progressNote({ ping, pingCount, picked, total: idx.accounts.length })));
+      console.error(c.dim("sampling live usage..."));
       const tee = loadUsageSnapshot();
       const live = tee?.state ?? null;
       const teeAt = tee?.at ?? null;
@@ -129,27 +109,12 @@ async function collectClaude(input: { cfg: Config; ping: boolean; pingCount: num
                 perModel: modelUsage && modelUsage.account === a.accountUuid ? modelUsage.perModel : {},
               }
             : null;
-        let viaTee = false;
-        let outcome: SampleOutcome;
-        if (pings.has(a.accountUuid)) {
-          outcome = isActive ? await probeActiveUsage(a, { ping: true }) : await probeParkedUsage(a, { ping: true });
-          if (!outcome.ok && fromStatusLine && outcome.reason.includes("no limit data")) {
-            const failed = outcome;
-            outcome = { ok: true, usage: fromStatusLine };
-            if (failed.pingError != null) {
-              outcome.pingError = failed.pingError;
-              outcome.pingRejected = failed.pingRejected;
-            }
-            viaTee = true;
-          }
-        } else {
-          viaTee = fromStatusLine != null;
-          outcome = fromStatusLine
-            ? { ok: true, usage: fromStatusLine }
-            : isActive
-              ? await probeActiveUsage(a)
-              : await probeParkedUsage(a);
-        }
+        const viaTee = fromStatusLine != null;
+        const outcome: SampleOutcome = fromStatusLine
+          ? { ok: true, usage: fromStatusLine }
+          : isActive
+            ? await probeActiveUsage(a)
+            : await probeParkedUsage(a);
         samples.set(a.accountUuid, { outcome, viaTee });
         if (!outcome.ok) return;
         a.lastUsage = { fiveHour: outcome.usage.session, sevenDay: outcome.usage.weekAll };
@@ -192,9 +157,6 @@ async function collectClaude(input: { cfg: Config; ping: boolean; pingCount: num
       perModel: Object.fromEntries(Object.entries(perModel).map(([name, w]) => [name, currentWindow(w, true, now)])),
       usageAt: a.lastUsageAt ?? null,
       sample: sampled.outcome.ok ? { ok: true, source: sampled.viaTee ? "statusline" : "probe" } : { ok: false, reason: sampled.outcome.reason },
-      pingError: sampled.outcome.pingError ?? null,
-      pingRejected: sampled.outcome.pingRejected === true,
-      pinged: pings.has(a.accountUuid) && sampled.outcome.ok && sampled.outcome.pingError == null && aggregate != null && aggregate.fiveHour.resetsAt == null,
     };
   });
   return {
@@ -383,18 +345,6 @@ function claudeCard(a: ClaudeStatusAccount, now: number, staleAfterMs: number):
   if (!a.sample.ok) {
     notes.push(...sampleFailedNotes({ cached: a.usage != null || Object.keys(a.perModel).length > 0, usageAt: a.usageAt, reason: a.sample.reason, now }));
   }
-  if (a.pingError != null && a.pingRejected) {
-    const at = a.pingError.indexOf(": ");
-    const head = at >= 0 ? a.pingError.slice(0, at) : a.pingError;
-    const tail = at >= 0 ? a.pingError.slice(at + 2) : "";
-    notes.push({ paint: c.yellow, text: `ping ${head}${tail ? ":" : ""}` });
-    if (tail) notes.push({ paint: c.dim, text: tail });
-  } else if (a.pingError != null) {
-    notes.push({ paint: c.yellow, text: "ping failed (5h timer may not have started):" }, { paint: c.dim, text: a.pingError });
-  }
-  if (a.pinged) {
-    notes.push({ paint: c.dim, text: "pinged - 5h timer started this run; the usage feed lags, re-run status shortly for the fresh window" });
-  }
   return { lines, notes };
 }
 
@@ -415,11 +365,11 @@ function renderClaude(input: { claude: StatusReport["claude"]; codexPooled: bool
   renderGrid(claude.accounts.map((a) => claudeCard(a, now, staleAfterMs)));
 }
 
-export async function cmdStatus(opts: { ping?: boolean; pingCount?: number; json?: boolean; preRender?: () => void } = {}): Promise<number> {
-  const { ping = false, pingCount, json = false } = opts;
+export async function cmdStatus(opts: { json?: boolean; preRender?: () => void } = {}): Promise<number> {
+  const { json = false } = opts;
   const cfg = loadConfig();
   const now = Date.now();
-  const claude = await collectClaude({ cfg, ping, pingCount, now });
+  const claude = await collectClaude({ cfg, now });
   if (!json) {
     opts.preRender?.();
     const at = Date.now();

package/src/lib/decide.ts

@@ -4,9 +4,8 @@ import { withLock } from "./lock.ts";
 import { paths } from "./paths.ts";
 import { POST_SWAP_COOLDOWN_MS, loadAccounts, loadConfig, loadDepletedWait, loadLastSwapAt, loadUsage, loadUsageSnapshot, loadModelUsage, saveAccounts, saveDepletedWait, saveModelUsage, writeUsage } from "./state.ts";
 import { readOAuthAccount } from "./claudejson.ts";
-import { isSkippableSwapError, performSwap, type VerifyVerdict } from "./swap.ts";
-import { probeParkedUsage } from "./sample.ts";
-import { isExhausted, nextWeeklyReset, pickBest, pickEarliestReset, thresholdBars, usableAt, type PickCtx } from "./picker.ts";
+import { isSkippableSwapError, performSwap } from "./swap.ts";
+import { nextWeeklyReset, pickBest, pickEarliestReset, thresholdBars, usableAt } from "./picker.ts";
 import { familyTokens, gatedFamilies, probeUsage, type EnforcedClass } from "./usage.ts";
 import { log } from "./log.ts";
 import { AccountSchema, ModelUsageStateSchema, UsageStateSchema, type Account, type Config, type EnforcedLimit, type ModelUsageState, type Thresholds, type UsageState, type UsageWindow } from "./types.ts";
@@ -21,8 +20,6 @@ export type SwapDecision = z.infer<typeof SwapDecisionSchema>;
 
 const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
 const FIVE_HOURS_MS = 5 * 60 * 60 * 1000;
-const VERIFY_PROBE_BUDGET = 2;
-const VERIFY_PROBE_KILL_MS = 12_000;
 
 function liveUsed(input: { window: UsageWindow; windowMs: number; sampledAt: number; now: number }): number {
   const { window: w, windowMs, sampledAt, now } = input;
@@ -186,53 +183,12 @@ export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = fals
       rejected.add(candidate.accountUuid);
       log("decide.candidate_rejected", { account: candidate.accountUuid.slice(0, 8), error: e instanceof Error ? e.message : String(e) });
     };
-    let probeBudget = VERIFY_PROBE_BUDGET;
-    const verified = async (candidate: Account, ctx: PickCtx): Promise<VerifyVerdict> => {
-      if (candidate.lastUsageAt != null && now - candidate.lastUsageAt <= cfg.policy.usagePollTtlMs) return "go";
-      const short = candidate.accountUuid.slice(0, 8);
-      const idx2 = loadAccounts();
-      const stored = idx2.accounts.find((a) => a.accountUuid === candidate.accountUuid);
-      if (!stored) return "go";
-      if (probeBudget <= 0) {
-        log("decide.verify_budget_spent", { account: short });
-        return "go";
-      }
-      probeBudget -= 1;
-      const sample = await probeParkedUsage(stored, { retries: 0, refreshParked: false, killMs: VERIFY_PROBE_KILL_MS, signal: AbortSignal.timeout(VERIFY_PROBE_KILL_MS) });
-      if (sample.ok) {
-        const at = Date.now();
-        stored.lastUsage = { fiveHour: sample.usage.session, sevenDay: sample.usage.weekAll };
-        stored.lastUsageAt = at;
-        if (Object.keys(sample.usage.perModel).length > 0) {
-          stored.lastPerModel = sample.usage.perModel;
-          stored.lastPerModelAt = at;
-        }
-      }
-      if (sample.ok || stored.needsReauth === true) saveAccounts(idx2);
-      if (stored.needsReauth === true) {
-        rejected.add(candidate.accountUuid);
-        log("decide.candidate_rejected", { account: short, error: "needs reauth" });
-        return "skip";
-      }
-      if (!sample.ok) {
-        log("decide.candidate_unverified", { account: short });
-        return "go";
-      }
-      log(isExhausted(stored, ctx) ? "decide.candidate_walled" : "decide.candidate_verified", {
-        account: short,
-        session: sample.usage.session.usedPercentage,
-        weekly: sample.usage.weekAll.usedPercentage,
-      });
-      return "rerank";
-    };
-
     while (true) {
       const cur = loadAccounts();
       const seat = seatOf(cur);
       const ctx = { now, thresholds: bars, currentAccountUuid: seat?.accountUuid ?? null, switchFamilies };
       const best = pickBest(usable(cur.accounts), ctx);
       if (!best) break;
-      if ((await verified(best, ctx)) !== "go") continue;
       try {
         await performSwap(best);
       } catch (e) {

package/src/lib/oauth.ts

@@ -40,7 +40,7 @@ export function isDeadCredential(creds: OAuthCreds): boolean {
   return creds.refreshToken === "" || creds.accessToken === "";
 }
 
-export async function refreshCredential(creds: OAuthCreds, now = Date.now()): Promise<OAuthCreds> {
+export async function refreshCredential(creds: OAuthCreds, now = Date.now(), signal?: AbortSignal): Promise<OAuthCreds> {
   if (isDeadCredential(creds)) throw new InvalidGrantError("credential was cleared after a failed refresh");
   const scope = (creds.scopes?.length ? creds.scopes : DEFAULT_SCOPES).join(" ");
   const body = {
@@ -55,6 +55,7 @@ export async function refreshCredential(creds: OAuthCreds, now = Date.now()): Pr
     res = await http.post(TOKEN_URL, {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(body),
+      signal,
     });
   } catch (e) {
     throw new Error(`token endpoint unreachable: ${e instanceof Error ? e.message : String(e)}`);

package/src/lib/sample.ts

@@ -1,19 +1,22 @@
 import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { minBy } from "es-toolkit";
 import { z } from "zod";
 import { readItem, writeItem, deleteItem, liveTarget, parkedTarget, isolatedTarget, claudeAiOauthOnly, mergeIntoLive } from "./credstore.ts";
 import { credItemFor, paths } from "./paths.ts";
 import { withClaudeRefreshLock } from "./claudelock.ts";
+import { withLock } from "./lock.ts";
+import { readOAuthAccount } from "./claudejson.ts";
 import { refreshCredential, isAccessTokenExpiring, isDeadCredential, fetchTokenIdentity, describeIdentity, IdentityUnavailableError, InvalidGrantError } from "./oauth.ts";
-import { FullUsageSchema, pingSession, probeUsage } from "./usage.ts";
-import { loadAccounts } from "./state.ts";
+import { FullUsageSchema, probeUsage } from "./usage.ts";
+import { POST_SWAP_COOLDOWN_MS, loadAccounts, loadLastSwapAt, saveAccounts } from "./state.ts";
 import { keepRotatedPair } from "./swap.ts";
 import { log } from "./log.ts";
-import { CredentialBlobSchema, TokenIdentitySchema, type Account, type OAuthCreds, type TokenIdentity } from "./types.ts";
+import { CredentialBlobSchema, TokenIdentitySchema, type Account, type Config, type OAuthCreds, type TokenIdentity } from "./types.ts";
 
 const SampleOutcomeSchema = z.discriminatedUnion("ok", [
-  z.object({ ok: z.literal(true), usage: FullUsageSchema, pingError: z.string().optional(), pingRejected: z.boolean().optional() }),
-  z.object({ ok: z.literal(false), reason: z.string(), pingError: z.string().optional(), pingRejected: z.boolean().optional() }),
+  z.object({ ok: z.literal(true), usage: FullUsageSchema }),
+  z.object({ ok: z.literal(false), reason: z.string() }),
 ]);
 export type SampleOutcome = z.infer<typeof SampleOutcomeSchema>;
 
@@ -44,10 +47,12 @@ function refreshPlanFields(account: Account, creds: OAuthCreds): void {
   if (creds.rateLimitTier != null) account.rateLimitTier = creds.rateLimitTier;
 }
 
-export async function probeParkedUsage(
-  account: Account,
-  opts: { ping?: boolean; retries?: number; refreshParked?: boolean; killMs?: number; signal?: AbortSignal } = {},
-): Promise<SampleOutcome> {
+const ProbeFailureSchema = z.object({ ok: z.literal(false), reason: z.string() });
+type ProbeFailure = z.infer<typeof ProbeFailureSchema>;
+const PreparedProbeSchema = z.discriminatedUnion("ok", [z.object({ ok: z.literal(true), dir: z.string(), installed: z.string() }), ProbeFailureSchema]);
+type PreparedProbe = z.infer<typeof PreparedProbeSchema>;
+
+async function prepareParkedProbe(account: Account, dir: string, signal?: AbortSignal): Promise<PreparedProbe> {
   const backup = parkedTarget(account.keychainItem);
   const parkedRaw = await readItem(backup);
   if (!parkedRaw) return { ok: false, reason: "no parked credential - run `tokenmaxxing auth`" };
@@ -62,13 +67,11 @@ export async function probeParkedUsage(
     account.needsReauth = true;
     return { ok: false, reason: "parked credential was cleared after a failed refresh - re-auth with `tokenmaxxing auth`" };
   }
-  if (opts.refreshParked === false && isAccessTokenExpiring(creds, 300_000)) {
-    return { ok: false, reason: "parked access token is near expiry - verification requires an unexpired token" };
-  }
 
   const liveRaw = await readItem(liveTarget());
   let liveAccount: string | null = null;
   let liveToken: string | null = null;
+  let liveRefresh: string | null = null;
   if (liveRaw != null) {
     let liveCreds: OAuthCreds;
     try {
@@ -78,8 +81,9 @@ export async function probeParkedUsage(
     }
     if (!isDeadCredential(liveCreds)) {
       liveToken = liveCreds.accessToken;
+      liveRefresh = liveCreds.refreshToken;
       try {
-        liveAccount = (await fetchTokenIdentity(liveCreds.accessToken, opts.signal)).accountUuid;
+        liveAccount = (await fetchTokenIdentity(liveCreds.accessToken, signal)).accountUuid;
       } catch (e) {
         return { ok: false, reason: `cannot verify the live credential's owner (${(e instanceof Error ? e.message : String(e)).slice(0, 80)}) - refusing to sample a possibly-live account` };
       }
@@ -98,10 +102,7 @@ export async function probeParkedUsage(
   };
 
   if (isAccessTokenExpiring(creds, 300_000)) {
-    if (opts.refreshParked === false) {
-      return { ok: false, reason: "parked access token is near expiry - verification requires an unexpired token" };
-    }
-    const owner = await checkIdentity(creds, account);
+    const owner = await checkIdentity(creds, account, signal);
     if (owner.status === "mismatch") {
       const kept = await relocate(owner.owner);
       account.needsReauth = true;
@@ -110,9 +111,9 @@ export async function probeParkedUsage(
     if (owner.status === "unavailable" && !owner.stale) {
       return { ok: false, reason: `${owner.reason} - refusing to refresh a parked credential whose owner cannot be verified` };
     }
-    const rotate = async (): Promise<{ fresh: OAuthCreds } | { failed: SampleOutcome }> => {
+    const rotate = async (): Promise<{ fresh: OAuthCreds } | { failed: ProbeFailure }> => {
       try {
-        return { fresh: await refreshCredential(creds) };
+        return { fresh: await refreshCredential(creds, Date.now(), signal) };
       } catch (e) {
         if (e instanceof InvalidGrantError) {
           account.needsReauth = true;
@@ -121,16 +122,24 @@ export async function probeParkedUsage(
         return { failed: { ok: false, reason: `token refresh failed: ${e instanceof Error ? e.message : String(e)}` } };
       }
     };
-    let result: { fresh: OAuthCreds } | { failed: SampleOutcome };
+    let result: { fresh: OAuthCreds } | { failed: ProbeFailure };
     if (owner.status === "match") {
       result = await rotate();
     } else {
+      if (liveRefresh != null && creds.refreshToken === liveRefresh) {
+        return { ok: false, reason: "this slot holds a copy of the LIVE login's grant - refusing to rotate it from a parked slot; run `tokenmaxxing switch` to reconcile" };
+      }
       try {
+        signal?.throwIfAborted();
         result = await withClaudeRefreshLock(async (lock) => {
           const rotated = await rotate();
           if ("failed" in rotated) return rotated;
-          const verified = await checkIdentity(rotated.fresh, account);
-          if (verified.status !== "mismatch") return rotated;
+          const verified = await checkIdentity(rotated.fresh, account, signal);
+          if (verified.status === "match") return rotated;
+          if (verified.status === "unavailable") {
+            await writeItem(backup, JSON.stringify({ claudeAiOauth: rotated.fresh }));
+            return { failed: { ok: false, reason: `${verified.reason} - the rotated pair stays in this slot unverified until the next pass` } };
+          }
           const trueOwner = loadAccounts().accounts.find((a) => a.accountUuid === verified.owner.accountUuid) ?? null;
           const kept = await keepRotatedPair({ fresh: rotated.fresh, owner: trueOwner, fallback: account, liveOwnerUuid: liveAccount, expectedLiveToken: liveToken, lock });
           account.needsReauth = true;
@@ -145,7 +154,7 @@ export async function probeParkedUsage(
     await writeItem(backup, JSON.stringify({ claudeAiOauth: creds }));
   }
 
-  const identity = await checkIdentity(creds, account, opts.signal);
+  const identity = await checkIdentity(creds, account, signal);
   if (identity.status === "mismatch") {
     const kept = await relocate(identity.owner);
     account.needsReauth = true;
@@ -156,35 +165,100 @@ export async function probeParkedUsage(
   }
   refreshPlanFields(account, creds);
 
-  const dir = join(paths.sampleDir, credItemFor(account.accountUuid));
   rmSync(dir, { recursive: true, force: true });
   mkdirSync(dir, { recursive: true });
-  const isoTarget = isolatedTarget(dir);
-  const installed = JSON.stringify({ claudeAiOauth: opts.refreshParked === false ? { ...creds, refreshToken: "" } : creds });
-
+  const installed = JSON.stringify({ claudeAiOauth: creds });
   try {
-    await writeItem(isoTarget, installed);
+    await writeItem(isolatedTarget(dir), installed);
     writeFileSync(join(dir, ".claude.json"), JSON.stringify({ oauthAccount: account.oauthAccount, hasCompletedOnboarding: true }));
-    const ping = opts.ping ? await pingSession(dir) : null;
-    const usage = await probeUsage(dir, Date.now(), opts);
-    const outcome: SampleOutcome = usage
-      ? { ok: true, usage }
-      : { ok: false, reason: "`/usage` returned no limit data (see log)" };
-    if (ping != null) {
-      outcome.pingError = ping.reason;
-      outcome.pingRejected = ping.rejected;
+  } catch (e) {
+    await finishParkedProbe(account, { dir, installed });
+    throw e;
+  }
+  return { ok: true, dir, installed };
+}
+
+async function runParkedProbe(dir: string, opts: { retries?: number }): Promise<SampleOutcome> {
+  const usage = await probeUsage(dir, Date.now(), { retries: opts.retries });
+  return usage ? { ok: true, usage } : { ok: false, reason: "`/usage` returned no limit data (see log)" };
+}
+
+async function finishParkedProbe(account: Account, prepared: { dir: string; installed: string }): Promise<void> {
+  const isoTarget = isolatedTarget(prepared.dir);
+  const backup = parkedTarget(account.keychainItem);
+  try {
+    const afterIso = await readItem(isoTarget);
+    if (afterIso && afterIso !== prepared.installed) {
+      const parkedNow = await readItem(backup);
+      const installedToken = CredentialBlobSchema.parse(JSON.parse(prepared.installed)).claudeAiOauth.accessToken;
+      const parkedToken = parkedNow == null ? null : CredentialBlobSchema.parse(JSON.parse(parkedNow)).claudeAiOauth.accessToken;
+      if (parkedToken === installedToken) await writeItem(backup, claudeAiOauthOnly(afterIso));
+      else log("sample.harvest_skipped", { account: account.accountUuid.slice(0, 8) });
     }
-    return outcome;
   } finally {
-    try {
-      if (opts.refreshParked !== false) {
-        const afterIso = await readItem(isoTarget);
-        if (afterIso && afterIso !== installed) await writeItem(backup, claudeAiOauthOnly(afterIso));
-      }
-    } finally {
-      await deleteItem(isoTarget);
-      rmSync(dir, { recursive: true, force: true });
+    await deleteItem(isoTarget);
+    rmSync(prepared.dir, { recursive: true, force: true });
+  }
+}
+
+export async function probeParkedUsage(account: Account): Promise<SampleOutcome> {
+  const prepared = await prepareParkedProbe(account, join(paths.sampleDir, credItemFor(account.accountUuid)));
+  if (!prepared.ok) return prepared;
+  try {
+    return await runParkedProbe(prepared.dir, {});
+  } finally {
+    await finishParkedProbe(account, prepared);
+  }
+}
+
+const PREPARE_DEADLINE_MS = 20_000;
+
+export async function sampleOldestParked(cfg: Config): Promise<void> {
+  const reserved = await withLock(paths.lockFile, async () => {
+    const now = Date.now();
+    const lastSwapAt = loadLastSwapAt();
+    if (lastSwapAt != null && now - lastSwapAt < POST_SWAP_COOLDOWN_MS) return null;
+    const idx = loadAccounts();
+    const live = readOAuthAccount()?.accountUuid ?? null;
+    const sampledAt = (a: Account) => Math.max(a.lastUsageAt ?? 0, a.lastProbeAt ?? 0);
+    const stale = idx.accounts.filter((a) => a.accountUuid !== live && a.needsReauth !== true && now - sampledAt(a) > cfg.policy.usagePollTtlMs);
+    const target = minBy(stale, sampledAt);
+    if (!target) return null;
+    target.lastProbeAt = now;
+    const prepared = await prepareParkedProbe(target, join(paths.sampleDir, `${credItemFor(target.accountUuid)}-tick`), AbortSignal.timeout(PREPARE_DEADLINE_MS));
+    saveAccounts(idx);
+    if (!prepared.ok) {
+      log("sample.parked_failed", { account: target.accountUuid.slice(0, 8), reason: prepared.reason.slice(0, 200) });
+      return null;
     }
+    return { account: target, prepared };
+  });
+  if (!reserved) return;
+  const { account, prepared } = reserved;
+  const startedAt = Date.now();
+  let outcome: SampleOutcome | null = null;
+  try {
+    outcome = await runParkedProbe(prepared.dir, { retries: 0 });
+  } finally {
+    await withLock(paths.lockFile, async () => {
+      await finishParkedProbe(account, prepared);
+      if (outcome == null) return;
+      const idx = loadAccounts();
+      const stored = idx.accounts.find((a) => a.accountUuid === account.accountUuid);
+      if (stored && outcome.ok && (stored.lastUsageAt == null || startedAt > stored.lastUsageAt)) {
+        stored.lastUsage = { fiveHour: outcome.usage.session, sevenDay: outcome.usage.weekAll };
+        stored.lastUsageAt = startedAt;
+        if (Object.keys(outcome.usage.perModel).length > 0) {
+          stored.lastPerModel = outcome.usage.perModel;
+          stored.lastPerModelAt = startedAt;
+        }
+        saveAccounts(idx);
+      }
+      log(outcome.ok ? "sample.parked_ok" : "sample.parked_failed", {
+        account: account.accountUuid.slice(0, 8),
+        ...(outcome.ok ? {} : { reason: outcome.reason.slice(0, 200) }),
+      });
+    });
   }
 }
 
@@ -211,7 +285,7 @@ export async function ensureLiveTokenFresh(): Promise<void> {
   });
 }
 
-export async function probeActiveUsage(account: Account, opts: { ping?: boolean } = {}): Promise<SampleOutcome> {
+export async function probeActiveUsage(account: Account): Promise<SampleOutcome> {
   try {
     await ensureLiveTokenFresh();
   } catch (e) {
@@ -232,12 +306,6 @@ export async function probeActiveUsage(account: Account, opts: { ping?: boolean
   if (identity.status === "unavailable") return { ok: false, reason: identity.reason };
   refreshPlanFields(account, creds);
 
-  const ping = opts.ping ? await pingSession() : null;
   const usage = await probeUsage();
-  const outcome: SampleOutcome = usage ? { ok: true, usage } : { ok: false, reason: "`/usage` returned no limit data (see log)" };
-  if (ping != null) {
-    outcome.pingError = ping.reason;
-    outcome.pingRejected = ping.rejected;
-  }
-  return outcome;
+  return usage ? { ok: true, usage } : { ok: false, reason: "`/usage` returned no limit data (see log)" };
 }

package/src/lib/swap.ts

@@ -1,4 +1,3 @@
-import { z } from "zod";
 import { clearDepletedWait, clearUsageSnapshots, loadAccounts, saveAccounts, saveLastSwapAt } from "./state.ts";
 import { readItem, writeItem, liveTarget, parkedTarget, claudeAiOauthOnly, mergeIntoLive } from "./credstore.ts";
 import { refreshCredential, isAccessTokenExpiring, isDeadCredential, fetchTokenIdentity, describeIdentity, IdentityUnavailableError, InvalidGrantError, RefreshRejectedError } from "./oauth.ts";
@@ -11,9 +10,6 @@ function parseBlob(raw: string) {
   return CredentialBlobSchema.parse(JSON.parse(raw));
 }
 
-const VerifyVerdictSchema = z.enum(["go", "rerank", "skip"]);
-export type VerifyVerdict = z.infer<typeof VerifyVerdictSchema>;
-
 export async function performSwap(target: Account): Promise<void> {
   const idx = loadAccounts();
 

package/src/lib/types.ts

@@ -68,6 +68,7 @@ export const AccountSchema = z.object({
   lastPerModel: z.record(z.string(), UsageWindowSchema).optional(),
   lastPerModelAt: z.number().optional(),
   lastUsageAt: z.number().optional(),
+  lastProbeAt: z.number().optional(),
   enforcedUntil: z.number().optional(),
   needsReauth: z.boolean().optional(),
   subscriptionType: z.string().optional(),

package/src/lib/usage.ts

@@ -1,10 +1,8 @@
-import { closeSync, existsSync, fstatSync, mkdirSync, openSync, readSync } from "node:fs";
-import { join } from "node:path";
+import { closeSync, fstatSync, openSync, readSync } from "node:fs";
 import { delay } from "es-toolkit";
 import { z } from "zod";
 import { MAX_WRAP_DEPTH, WRAP_DEPTH_ENV, resolveRealClaude } from "./claudebin.ts";
 import { log } from "./log.ts";
-import { paths } from "./paths.ts";
 import { RateLimitsStdinSchema, UsageWindowSchema, type ModelInfo, type UsageWindow, type UsageWindows } from "./types.ts";
 
 export function normalizeResetsAt(v: unknown): number | null {
@@ -282,18 +280,9 @@ const SpawnResultSchema = z.object({
 });
 type SpawnResult = z.infer<typeof SpawnResultSchema>;
 
-async function spawnClaudeBounded(
-  cmd: string[],
-  env: Record<string, string>,
-  cwd?: string,
-  killMs = PROBE_KILL_MS,
-  signal?: AbortSignal,
-): Promise<SpawnResult | null> {
-  signal?.throwIfAborted();
-  const p = Bun.spawn(cmd, { env, cwd, stdout: "pipe", stderr: "pipe" });
-  const abort = () => p.kill("SIGKILL");
-  signal?.addEventListener("abort", abort, { once: true });
-  const killer = setTimeout(() => p.kill("SIGKILL"), killMs);
+async function spawnClaudeBounded(cmd: string[], env: Record<string, string>): Promise<SpawnResult | null> {
+  const p = Bun.spawn(cmd, { env, stdout: "pipe", stderr: "pipe" });
+  const killer = setTimeout(() => p.kill("SIGKILL"), PROBE_KILL_MS);
   try {
     const reads = Promise.all([new Response(p.stdout).text(), new Response(p.stderr).text()]);
     const settled = await Promise.race([
@@ -306,14 +295,13 @@ async function spawnClaudeBounded(
     return { exitCode: p.exitCode, stdout, stderr };
   } finally {
     clearTimeout(killer);
-    signal?.removeEventListener("abort", abort);
   }
 }
 
-async function probeUsageOnce(env: Record<string, string>, now: number, killMs: number, signal?: AbortSignal): Promise<FullUsage | null> {
+async function probeUsageOnce(env: Record<string, string>, now: number): Promise<FullUsage | null> {
   let out: string;
   try {
-    const r = await spawnClaudeBounded([resolveRealClaude(), "-p", "/usage", "--output-format", "json"], env, undefined, killMs, signal);
+    const r = await spawnClaudeBounded([resolveRealClaude(), "-p", "/usage", "--output-format", "json"], env);
     if (r === null) {
       log("usage.probe_failed", { err: "output pipes still open after child exit (leaked descendant)" });
       return null;
@@ -351,81 +339,16 @@ function probeEnv(configDir?: string): Record<string, string> {
   return env;
 }
 
-export async function probeUsage(configDir?: string, now = Date.now(), opts: { retries?: number; killMs?: number; signal?: AbortSignal } = {}): Promise<FullUsage | null> {
+export async function probeUsage(configDir?: string, now = Date.now(), opts: { retries?: number } = {}): Promise<FullUsage | null> {
   const env = probeEnv(configDir);
 
   for (let attempt = 0; ; attempt++) {
-    const full = await probeUsageOnce(env, now, opts.killMs ?? PROBE_KILL_MS, opts.signal);
+    const full = await probeUsageOnce(env, now);
     if (full) return full;
-    if (attempt >= (opts.retries ?? PROBE_RETRY_DELAYS_MS.length) || opts.signal?.aborted) {
+    if (attempt >= (opts.retries ?? PROBE_RETRY_DELAYS_MS.length)) {
       log("usage.probe_gave_up", { attempts: attempt + 1 });
       return null;
     }
     await delay(PROBE_RETRY_DELAYS_MS[Math.min(attempt, PROBE_RETRY_DELAYS_MS.length - 1)]!);
   }
 }
-
-const PING_ARGS = [
-  "-p", "Reply with exactly: ok",
-  "--model", "haiku",
-  "--settings", '{"disableAllHooks":true}',
-  "--output-format", "json",
-];
-
-const PingResultSchema = z.looseObject({ is_error: z.boolean().optional(), result: z.string().optional(), session_id: z.string().optional() });
-
-export const PingFailureSchema = z.object({ reason: z.string(), rejected: z.boolean() });
-export type PingFailure = z.infer<typeof PingFailureSchema>;
-
-export function transcriptSlug(cwd: string): string {
-  return cwd.replace(/[^a-zA-Z0-9]/g, "-");
-}
-
-export function pingTranscriptPath(input: { configDir: string; cwd: string; sessionId: string }): string {
-  return join(input.configDir, "projects", transcriptSlug(input.cwd), `${input.sessionId}.jsonl`);
-}
-
-const LIMIT_LABELS: Record<string, string> = { five_hour: "5h", seven_day: "weekly" };
-
-export function pingRejection(rows: TranscriptRow[]): string | null {
-  const row = rows.findLast((r) => r.isApiErrorMessage === true);
-  if (!row || row.error !== "rate_limit" || row.apiErrorIsTransient === true) return null;
-  const type = row.quotaLimits?.rateLimitType ?? "";
-  if (type === "" && parseErrorBody(row.errorDetails)?.error?.type !== "rate_limit_error") return null;
-  const label = LIMIT_LABELS[type] ?? (type !== "" ? type.replace(/_/g, " ") : "usage");
-  const text = transcriptRowText(row);
-  return `${label} limit${text ? `: ${text}` : ""}`;
-}
-
-export async function pingSession(configDir?: string): Promise<PingFailure | null> {
-  const cwd = join(paths.sampleDir, "ping-cwd");
-  const fail = (reason: string, rejected = false): PingFailure => {
-    log("usage.ping_failed", { dir: configDir ?? "live", rejected, reason: reason.slice(0, 200) });
-    return { reason, rejected };
-  };
-  let r: SpawnResult | null;
-  try {
-    mkdirSync(cwd, { recursive: true });
-    r = await spawnClaudeBounded([resolveRealClaude(), ...PING_ARGS], probeEnv(configDir), cwd);
-  } catch (e) {
-    return fail(e instanceof Error ? e.message : String(e));
-  }
-  if (r === null) return fail("output pipes still open after child exit (leaked descendant)");
-  const parsed = PingResultSchema.safeParse((() => { try { return JSON.parse(r.stdout); } catch { return null; } })());
-  const result = parsed.success ? parsed.data : null;
-  if (r.exitCode === 0 && result?.is_error === false) {
-    log("usage.ping_ok", { dir: configDir ?? "live" });
-    return null;
-  }
-  if (result?.session_id) {
-    const transcript = pingTranscriptPath({ configDir: configDir ?? paths.claudeDir, cwd, sessionId: result.session_id });
-    const rejection = existsSync(transcript) ? pingRejection(readTranscriptTail(transcript)) : null;
-    if (rejection) return fail(`rejected at the ${rejection}`.slice(0, 200), true);
-  }
-  if (r.exitCode !== 0) {
-    const detail = result?.result?.trim() || r.stderr.trim() || r.stdout.trim();
-    return fail(`claude exited ${r.exitCode ?? "on signal"}: ${detail.slice(0, 160)}`);
-  }
-  if (result?.is_error === true) return fail((result.result?.trim() || "request errored").slice(0, 160));
-  return fail(`unrecognized ping output: ${r.stdout.trim().slice(0, 120)}`);
-}

package/src/main.ts

@@ -45,8 +45,7 @@ function printHelp(): void {
   ${c.cyan("tokenmaxxing switch --codex")} [sel]  switch the codex pool (takes effect on next codex start)
   ${c.cyan("tokenmaxxing ls")}         list pooled accounts
   ${c.cyan("tokenmaxxing status")}     accounts with 5h / weekly / per-model usage bars
-  ${c.cyan("tokenmaxxing status --ping")} [--count N]  ping every account (one tiny haiku request each) so all 5h session timers start now, then sample fresh; ${c.cyan("--count N")} pings N randomly picked accounts instead, to stagger the resets; ${c.cyan("xx --ping")} works too
-  ${c.cyan("tokenmaxxing watch")} [seconds]  live status: re-render every N seconds (default 120, never pings)
+  ${c.cyan("tokenmaxxing watch")} [seconds]  live status: re-render every N seconds (default 120)
   ${c.cyan("tokenmaxxing config")} [get|set|unset|tidy]  inspect and edit config.json (bare = effective config with sources)
   ${c.cyan("tokenmaxxing doctor")}     verify the install is intact
   ${c.cyan("tokenmaxxing rename")} [--codex] <sel> <label>
@@ -60,28 +59,6 @@ function printHelp(): void {
 
 let jsonMode = false;
 
-function statusFlags(rest: string[]): { ping: boolean; pingCount: number | undefined } | { error: string } {
-  let ping = false;
-  let pingCount: number | undefined;
-  for (let i = 0; i < rest.length; i++) {
-    const arg = rest[i]!;
-    if (arg === "--ping") {
-      ping = true;
-      continue;
-    }
-    if (arg === "--count") {
-      if (pingCount != null) return { error: "--count may only be given once" };
-      const raw = rest[++i];
-      pingCount = Number(raw);
-      if (!Number.isInteger(pingCount) || pingCount < 1) return { error: `--count needs a positive whole number of accounts, got: ${raw ?? "nothing"}` };
-      continue;
-    }
-    return { error: `unknown status option: ${arg} (status takes --ping and --count N)` };
-  }
-  if (pingCount != null && !ping) return { error: "--count only applies together with --ping" };
-  return { ping, pingCount };
-}
-
 async function main(): Promise<number> {
   if (process.platform !== "darwin" && process.platform !== "linux") {
     console.error(`tokenmaxxing supports macOS and Linux only (this is ${process.platform})`);
@@ -126,15 +103,13 @@ async function main(): Promise<number> {
     case "__session-start": return runSessionStart();
     case "__codex-stop-hook": return runCodexStopHook();
     case undefined:
-    case "status":
-    case "--ping":
-    case "--count": {
-      const flags = statusFlags(sub === "status" ? args.slice(1) : args);
-      if ("error" in flags) {
-        emitError({ json, message: flags.error });
+    case "status": {
+      const extra = args[1];
+      if (extra != null) {
+        emitError({ json, message: `unknown status option: ${extra} (status takes no options)` });
         return 2;
       }
-      return cmdStatus({ ...flags, json });
+      return cmdStatus({ json });
     }
     case "switch": {
       const rest = args.slice(1).filter((a) => a !== "--codex");