tokenmaxxing 1.33.0 → 1.35.0

package/src/cli/init.ts

@@ -1,149 +1,52 @@
 import { mkdirSync } from "node:fs";
-import { isApiKeyMode, readOAuthAccount } from "../lib/claudejson.ts";
-import { readItem, writeItem, liveTarget, parkedTarget, mergeIntoLive } from "../lib/credstore.ts";
-import { refreshCredential, isAccessTokenExpiring, isDeadCredential, fetchTokenIdentity, describeIdentity } from "../lib/oauth.ts";
-import { withClaudeRefreshLock } from "../lib/claudelock.ts";
-import { loadAccounts, saveAccounts, loadConfig, pinBinOverride } from "../lib/state.ts";
 import { withLock } from "../lib/lock.ts";
-import { installSupervisor, shellRcPath, ensurePathInRc, managedShellRcSkipLines, timerActivationHint, type InstallOutcome } from "../lib/install.ts";
-import { resolveVerifiedClaude } from "../lib/claudebin.ts";
-import { credItemFor, paths } from "../lib/paths.ts";
-import { CredentialBlobSchema, type Account } from "../lib/types.ts";
-import { c, claudeTierLabel } from "./render.ts";
+import { paths } from "../lib/paths.ts";
+import type { Provider } from "../lib/provider.ts";
+import { loadAccounts, loadConfig, saveAccounts, upsertAccount } from "../lib/state.ts";
+import { c, count } from "./render.ts";
 
-function ensurePathAhead(): void {
-  const rc = shellRcPath();
-  if (!rc) {
-    console.log(c.yellow(`⚠ add to your shell rc: export PATH="${paths.binDir}:$PATH"`));
-    return;
-  }
-  const outcome = ensurePathInRc(rc);
-  if (outcome === "added") console.log(`${c.green("✓")} added ${paths.binDir} to PATH in ${rc} - restart your shell (or \`source ${rc}\`)`);
-  else if (outcome === "skipped") {
-    const hint = managedShellRcSkipLines();
-    console.log(c.yellow(`⚠ ${hint.headline}`));
-    console.log(c.yellow(`  ${hint.detail}`));
-    console.log(c.yellow(`  ${hint.exportLine}`));
-  } else console.log(c.yellow(`⚠ PATH line already in ${rc} - restart your shell to pick it up`));
-}
-
-function reportTimer(out: InstallOutcome): void {
-  if (out.timerLoaded) console.log(`${c.green("✓")} periodic check timer active (every ${out.checkIntervalS}s)`);
-  else console.log(c.yellow(`⚠ check timer written but not activated - run: ${timerActivationHint()}`));
-}
-
-export function printUsage(): void {
+export function printUsage(p: Provider): void {
   console.log();
   console.log(`  ${c.bold("how to use")} - ${c.cyan("xx")} is shorthand for ${c.cyan("tokenmaxxing")}:`);
-  console.log(`    ${c.cyan("claude")}             use claude as always; it switches accounts near quota automatically`);
+  console.log(`    ${c.cyan(p.name)}             use ${p.name} as always; it switches accounts near quota automatically`);
   console.log(`    ${c.cyan("xx")}                 show the pool with usage bars (same as ${c.cyan("xx status")})`);
-  console.log(`    ${c.cyan("xx add")}             log in and pool another account`);
-  console.log(`    ${c.cyan("xx switch")}          hop to the best account right now (the automatic switching needs no command)`);
+  console.log(`    ${c.cyan(`xx add${p.flag}`)}             log in and pool another account`);
+  console.log(`    ${c.cyan(`xx switch${p.flag}`)}          hop to the best account right now (the automatic switching needs no command)`);
   console.log(`    ${c.cyan("xx help")}            everything else`);
 }
 
-export async function cmdInit(): Promise<number> {
+export async function cmdInit(p: Provider): Promise<number> {
   mkdirSync(paths.home, { recursive: true });
   loadConfig();
+  p.preflight();
 
-  const existingIdx = loadAccounts();
-  if (existingIdx.accounts.length > 0) {
-    const out = installSupervisor();
-    pinBinOverride({ key: "claudeBin", bin: resolveVerifiedClaude() });
-    const active = existingIdx.accounts.find((a) => a.accountUuid === existingIdx.activeAccountUuid);
-    console.log(`${c.green("✓")} re-installed supervisor + hooks (pool already has ${existingIdx.accounts.length} account${existingIdx.accounts.length === 1 ? "" : "s"} - not re-importing)`);
-    reportTimer(out);
-    if (!out.pathAhead) ensurePathAhead();
+  const existing = loadAccounts(p.pool);
+  if (existing.accounts.length > 0) {
+    p.install();
+    const active = existing.accounts.find((a) => a.id === existing.activeId);
+    console.log(`${c.green("✓")} re-installed (pool already has ${count({ n: existing.accounts.length, noun: "account" })} - not re-importing)`);
     console.log(`  active: ${c.bold(active?.label ?? "unknown")}`);
-    printUsage();
+    printUsage(p);
     return 0;
   }
 
-  if (isApiKeyMode()) {
-    console.error(c.yellow("tokenmaxxing pools subscription accounts, but you're authed via API key / apiKeyHelper."));
-    console.error(`Run ${c.cyan("claude")} → ${c.cyan("/login")} with a Pro/Max account first, then re-run ${c.cyan("tokenmaxxing init")}.`);
-    return 1;
-  }
-
-  const oauthAccount = readOAuthAccount();
-  const liveRaw = await readItem(liveTarget());
-  if (!oauthAccount || !liveRaw) {
-    console.error(c.red("no active Claude subscription login found (missing oauthAccount or credential)."));
-    console.error(`Run ${c.cyan("claude")} → ${c.cyan("/login")} first, then re-run ${c.cyan("tokenmaxxing init")}.`);
-    return 1;
-  }
+  const harvested = await p.importLive();
+  if (!harvested) return 1;
 
-  let blob;
-  try {
-    blob = CredentialBlobSchema.parse(JSON.parse(liveRaw));
-  } catch {
-    console.error(c.red("the live credential is not a recognizable Claude OAuth blob."));
-    return 1;
-  }
-
-  let creds = blob.claudeAiOauth;
-  if (isDeadCredential(creds)) {
-    console.error(c.red("the live credential was cleared after a failed refresh."));
-    console.error(`Run ${c.cyan("claude")} → ${c.cyan("/login")} first, then re-run ${c.cyan("tokenmaxxing init")}.`);
-    return 1;
-  }
-  if (isAccessTokenExpiring(creds)) {
-    await withClaudeRefreshLock(async (lock) => {
-      const raw2 = await readItem(liveTarget());
-      if (raw2 == null) throw new Error("live credential vanished while waiting for the refresh lock");
-      const current = CredentialBlobSchema.parse(JSON.parse(raw2)).claudeAiOauth;
-      creds = isAccessTokenExpiring(current) ? await refreshCredential(current) : current;
-      if (creds === current) return;
-      if (lock.compromised()) throw new Error("refresh lock compromised mid-refresh - discarding the live rewrite");
-      await writeItem(liveTarget(), mergeIntoLive(raw2, creds));
-    });
-  }
-  const identity = await fetchTokenIdentity(creds.accessToken);
-  if (identity.accountUuid !== oauthAccount.accountUuid) {
-    console.error(c.red(`the live credential belongs to ${describeIdentity(identity)}, but ~/.claude.json identifies ${oauthAccount.emailAddress} - identity drift.`));
-    console.error(`Run ${c.cyan("claude")} → ${c.cyan("/login")} to realign them, then re-run ${c.cyan("tokenmaxxing init")}.`);
-    return 1;
-  }
-
-  const uuid = oauthAccount.accountUuid;
-  const keychainItem = credItemFor(uuid);
-  const account = await withLock(paths.lockFile, async () => {
-    await writeItem(parkedTarget(keychainItem), JSON.stringify({ claudeAiOauth: creds }));
-    const idx = loadAccounts();
-    const existing = idx.accounts.find((a) => a.accountUuid === uuid);
-    const imported: Account = {
-      accountUuid: uuid,
-      email: oauthAccount.emailAddress,
-      organizationUuid: oauthAccount.organizationUuid,
-      label: existing?.label ?? oauthAccount.emailAddress,
-      keychainItem,
-      oauthAccount,
-      addedAt: existing?.addedAt ?? new Date().toISOString(),
-      subscriptionType: blob.claudeAiOauth.subscriptionType,
-      rateLimitTier: blob.claudeAiOauth.rateLimitTier,
-      needsReauth: false,
-    };
-    if (existing) Object.assign(existing, imported);
-    else idx.accounts.push(imported);
-    idx.activeAccountUuid = uuid;
-    saveAccounts(idx);
+  const account = await withLock(p.pool.lockFile, async () => {
+    await harvested.park();
+    const idx = loadAccounts(p.pool);
+    const imported = upsertAccount(idx, harvested, p.mergeWindows);
+    idx.activeId = harvested.id;
+    saveAccounts(p.pool, idx);
     return imported;
   });
 
-  pinBinOverride({ key: "claudeBin", bin: resolveVerifiedClaude() });
-
-  const out = installSupervisor();
-
-  console.log(`${c.green("✓")} imported current account → ${c.bold(account.email)} (${claudeTierLabel(account) ?? "?"})`);
-  console.log(`${c.green("✓")} installed ${c.bold("claude")} supervisor + statusLine/Stop/SessionStart hooks`);
-  reportTimer(out);
-  if (!out.pathAhead) {
-    console.log();
-    ensurePathAhead();
-  }
-  const poolSize = loadAccounts().accounts.length;
+  console.log(`${c.green("✓")} imported current account → ${c.bold(account.label)} (${account.tier ?? "?"})`);
+  p.install();
+  const poolSize = loadAccounts(p.pool).accounts.length;
   console.log();
-  console.log(`  pool ready (${poolSize} account${poolSize === 1 ? "" : "s"})`);
-  printUsage();
+  console.log(`  pool ready (${count({ n: poolSize, noun: "account" })})`);
+  printUsage(p);
   return 0;
 }

package/src/cli/rename.ts

@@ -1,76 +1,40 @@
 import { withLock } from "../lib/lock.ts";
-import { codexPaths, paths } from "../lib/paths.ts";
+import type { Provider } from "../lib/provider.ts";
 import { loadAccounts, saveAccounts } from "../lib/state.ts";
-import { loadCodexAccounts, saveCodexAccounts } from "../lib/codexstate.ts";
-import { c, emitError, emitJson, plain } from "./render.ts";
-import type { Account, CodexAccount } from "../lib/types.ts";
+import { c, emitError, plain } from "./render.ts";
+import type { Account } from "../lib/types.ts";
 
 export function findAccount(accounts: Account[], selector: string): Account | undefined {
-  const s = selector.toLowerCase();
-  return (
-    accounts.find((a) => a.email.toLowerCase() === s) ??
-    accounts.find((a) => a.label.toLowerCase() === s) ??
-    accounts.find((a) => a.accountUuid.toLowerCase().startsWith(s))
-  );
-}
-
-export function findCodexAccount(accounts: CodexAccount[], selector: string): CodexAccount | undefined {
   const s = selector.toLowerCase();
   return (
     accounts.find((a) => a.email?.toLowerCase() === s) ??
     accounts.find((a) => a.label.toLowerCase() === s) ??
-    accounts.find((a) => a.accountId.toLowerCase().startsWith(s))
+    accounts.find((a) => a.id.toLowerCase().startsWith(s))
   );
 }
 
-async function renameCodexAccount(input: { selector: string; newLabel: string; json: boolean }): Promise<number> {
-  const { selector, newLabel, json } = input;
-  return withLock(codexPaths.lockFile, async () => {
-    const index = loadCodexAccounts();
-    const account = findCodexAccount(index.accounts, selector);
-    if (!account) {
-      emitError({ json, message: `no codex account matches "${selector}"` });
-      return 1;
-    }
-    const taken = index.accounts.find((x) => x.accountId !== account.accountId && x.label.toLowerCase() === newLabel.toLowerCase());
-    if (taken) {
-      emitError({ json, message: `label "${newLabel}" is already used by ${taken.accountId.slice(0, 8)} - labels must be unique within the pool` });
-      return 1;
-    }
-    const old = account.label;
-    account.label = newLabel;
-    saveCodexAccounts({ index });
-    if (json) emitJson({ ok: true, pool: "codex", from: old, to: newLabel });
-    else console.log(`renamed codex account ${c.dim(old)} → ${c.bold(newLabel)}`);
-    return 0;
-  });
-}
-
-export async function cmdRename(argv: string[], json = false): Promise<number> {
-  const codex = argv.includes("--codex");
-  const [selector, newLabel] = argv.filter((a) => a !== "--codex");
+export async function cmdRename(p: Provider, argv: string[]): Promise<number> {
+  const [selector, newLabel] = argv;
   if (!selector || !newLabel) {
-    emitError({ json, message: "usage: tokenmaxxing rename [--codex] <email|label|id> <new-label>", paint: plain });
+    emitError({ message: "usage: tokenmaxxing rename [--codex] <email|label|id> <new-label>", paint: plain });
     return 2;
   }
-  if (codex) return renameCodexAccount({ selector, newLabel, json });
-  return withLock(paths.lockFile, async () => {
-    const idx = loadAccounts();
+  return withLock(p.pool.lockFile, async () => {
+    const idx = loadAccounts(p.pool);
     const a = findAccount(idx.accounts, selector);
     if (!a) {
-      emitError({ json, message: `no claude account matches "${selector}" (codex accounts rename via --codex)` });
+      emitError({ message: `no ${p.name} account matches "${selector}"` });
       return 1;
     }
-    const taken = idx.accounts.find((x) => x.accountUuid !== a.accountUuid && x.label.toLowerCase() === newLabel.toLowerCase());
+    const taken = idx.accounts.find((x) => x.id !== a.id && x.label.toLowerCase() === newLabel.toLowerCase());
     if (taken) {
-      emitError({ json, message: `label "${newLabel}" is already used by ${taken.email} - labels must be unique within the pool` });
+      emitError({ message: `label "${newLabel}" is already used by ${taken.email ?? taken.id.slice(0, 8)} - labels must be unique within the pool` });
       return 1;
     }
     const old = a.label;
     a.label = newLabel;
-    saveAccounts(idx);
-    if (json) emitJson({ ok: true, pool: "claude", from: old, to: newLabel });
-    else console.log(`renamed ${c.dim(old)} → ${c.bold(newLabel)}`);
+    saveAccounts(p.pool, idx);
+    console.log(`renamed ${c.dim(old)} → ${c.bold(newLabel)}`);
     return 0;
   });
 }

package/src/cli/render.ts

@@ -33,13 +33,6 @@ export function makeUsagePaint(input: { enabled: boolean; truecolor: boolean })
     };
 }
 
-export function claudeTierLabel(input: { subscriptionType?: string; rateLimitTier?: string }): string | null {
-  const segments = input.rateLimitTier?.split("_") ?? [];
-  const multiplier = segments.find((seg) => seg.length > 1 && seg.endsWith("x") && Number.isInteger(Number(seg.slice(0, -1))));
-  if (input.subscriptionType == null) return multiplier ?? null;
-  return multiplier ? `${input.subscriptionType} ${multiplier}` : input.subscriptionType;
-}
-
 export function count(input: { n: number; noun: string }): string {
   return `${input.n} ${input.noun}${input.n === 1 ? "" : "s"}`;
 }
@@ -82,7 +75,7 @@ export function emitJson(value: unknown): void {
 }
 
 export function emitError(input: {
-  json: boolean;
+  json?: boolean;
   message: string;
   notes?: string[];
   extra?: Record<string, unknown>;

package/src/cli/rm.ts

@@ -1,63 +1,46 @@
-import { rmSync } from "node:fs";
-import { join } from "node:path";
-import { deleteItem, isolatedTarget, liveTarget, parkedTarget, readItem } from "../lib/credstore.ts";
-import { fetchTokenIdentity } from "../lib/oauth.ts";
 import { withLock } from "../lib/lock.ts";
-import { credItemFor, paths } from "../lib/paths.ts";
-import { loadSetupTokens, saveSetupTokens } from "../lib/setuptokens.ts";
+import type { Provider } from "../lib/provider.ts";
 import { loadAccounts, saveAccounts } from "../lib/state.ts";
-import { CredentialBlobSchema } from "../lib/types.ts";
 import { findAccount } from "./rename.ts";
-import { c, emitError, emitJson, plain } from "./render.ts";
+import { c, emitError, plain } from "./render.ts";
 
-export async function cmdRm(selector?: string, json = false): Promise<number> {
+export async function cmdRm(p: Provider, selector?: string): Promise<number> {
   if (!selector) {
-    emitError({ json, message: "usage: tokenmaxxing rm <email|label|uuid>", paint: plain });
+    emitError({ message: `usage: tokenmaxxing rm${p.flag} <email|label|id>`, paint: plain });
     return 2;
   }
-  return withLock(paths.lockFile, async () => {
-    const idx = loadAccounts();
+  return withLock(p.pool.lockFile, async () => {
+    const idx = loadAccounts(p.pool);
     const a = findAccount(idx.accounts, selector);
     if (!a) {
-      emitError({ json, message: `no account matches "${selector}"` });
+      emitError({ message: `no account matches "${selector}"` });
       return 1;
     }
-    if (a.accountUuid === idx.activeAccountUuid) {
-      emitError({ json, message: `${a.email} is the ACTIVE account - switch away before removing it.` });
+    if (a.id === idx.activeId) {
+      emitError({ message: `${a.label} is the ACTIVE account - switch away before removing it.` });
       return 1;
     }
-    const live = await readItem(liveTarget());
-    if (live != null) {
-      let liveAccount: string;
-      try {
-        const liveCreds = CredentialBlobSchema.parse(JSON.parse(live)).claudeAiOauth;
-        liveAccount = (await fetchTokenIdentity(liveCreds.accessToken)).accountUuid;
-      } catch (e) {
-        emitError({
-          json,
-          message: `cannot verify which account the LIVE credential belongs to (${e instanceof Error ? e.message : String(e)}) - refusing to remove while the live owner is unknown; repair the live credential or retry once the profile endpoint is reachable.`,
-        });
-        return 1;
-      }
-      if (liveAccount === a.accountUuid) {
-        emitError({ json, message: `${a.email}'s credential is currently LIVE (the active label is stale - a manual /login drifted it); run \`tokenmaxxing switch\` to move off it first.` });
-        return 1;
-      }
+    let liveOwner: string | null;
+    try {
+      liveOwner = await p.liveOwner();
+    } catch (e) {
+      emitError({
+        message: `cannot verify which account the LIVE credential belongs to (${e instanceof Error ? e.message : String(e)}) - refusing to remove while the live owner is unknown; repair the live credential or retry once the profile endpoint is reachable.`,
+      });
+      return 1;
     }
-    const setupTokens = loadSetupTokens();
-    await deleteItem(parkedTarget(a.keychainItem));
-    const item = credItemFor(a.accountUuid);
-    for (const sampleDir of [join(paths.sampleDir, item), join(paths.sampleDir, `${item}-tick`)]) {
-      await deleteItem(isolatedTarget(sampleDir));
-      rmSync(sampleDir, { recursive: true, force: true });
+    if (liveOwner === a.id) {
+      emitError({ message: `${a.label}'s credential is currently LIVE (the active label is stale - a manual login drifted it); run \`tokenmaxxing switch${p.flag}\` to move off it first.` });
+      return 1;
     }
-    idx.accounts = idx.accounts.filter((x) => x.accountUuid !== a.accountUuid);
-    saveAccounts(idx);
-    if (setupTokens.tokens.some((t) => t.accountUuid === a.accountUuid)) {
-      saveSetupTokens({ ...setupTokens, tokens: setupTokens.tokens.filter((t) => t.accountUuid !== a.accountUuid) });
+    if (p.presentIds().has(a.id)) {
+      emitError({ message: `${a.label} is running in a live ${p.name} session - close that session before removing it.` });
+      return 1;
     }
-    if (json) emitJson({ ok: true, pool: "claude", removed: a.label, remaining: idx.accounts.length });
-    else console.log(`removed ${c.bold(a.label)} from the pool (${idx.accounts.length} left)`);
+    await p.removeCredentials(a);
+    idx.accounts = idx.accounts.filter((x) => x.id !== a.id);
+    saveAccounts(p.pool, idx);
+    console.log(`removed ${c.bold(a.label)} from the pool (${idx.accounts.length} left)`);
     return 0;
   });
 }

package/src/cli/setuptoken.ts

@@ -2,12 +2,12 @@ import { mkdirSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { resolveRealClaude } from "../lib/claudebin.ts";
 import { withLock } from "../lib/lock.ts";
-import { paths } from "../lib/paths.ts";
+import { claudePool, credItemFor, paths } from "../lib/paths.ts";
 import { loadAccounts } from "../lib/state.ts";
 import { scrubCredentialEnv } from "../lib/usage.ts";
 import { CURSOR_SECRET_VALUE_CAP_BYTES, cursorSecretValue, loadSetupTokens, saveSetupTokens, type SetupToken } from "../lib/setuptokens.ts";
 import type { Account } from "../lib/types.ts";
-import { c, emitError, emitJson } from "./render.ts";
+import { c, emitError } from "./render.ts";
 
 const TOKEN_BEGIN_MARKER = "Your OAuth token (valid for";
 const TOKEN_END_MARKER = "Store this token securely";
@@ -53,19 +53,19 @@ async function mint(input: { real: string; item: string }): Promise<string | nul
 
 function currentTokens(tokens: SetupToken[], accounts: Account[]): { label: string; token: string }[] {
   return accounts.flatMap((a) => {
-    const stored = tokens.find((t) => t.accountUuid === a.accountUuid);
+    const stored = tokens.find((t) => t.accountUuid === a.id);
     return stored ? [{ label: a.label, token: stored.token }] : [];
   });
 }
 
-async function rmToken(selector: string, json: boolean): Promise<number> {
-  const outcome = await withLock(paths.lockFile, async (): Promise<{ error: string } | { kept: SetupToken[] }> => {
+async function rmToken(selector: string): Promise<number> {
+  const outcome = await withLock(claudePool.lockFile, async (): Promise<{ error: string } | { kept: SetupToken[] }> => {
     const store = loadSetupTokens();
-    const accounts = loadAccounts().accounts;
+    const accounts = loadAccounts(claudePool).accounts;
     const pooled = accounts.find((a) => a.label === selector);
-    const orphan = (t: SetupToken) => !accounts.some((a) => a.accountUuid === t.accountUuid);
+    const orphan = (t: SetupToken) => !accounts.some((a) => a.id === t.accountUuid);
     const targets = store.tokens.filter((t) =>
-      t.accountUuid === selector || (pooled ? t.accountUuid === pooled.accountUuid : t.label === selector && orphan(t)),
+      t.accountUuid === selector || (pooled ? t.accountUuid === pooled.id : t.label === selector && orphan(t)),
     );
     if (targets.length === 0) return { error: `no setup token stored for "${selector}"` };
     if (targets.length > 1) return { error: `"${selector}" matches ${targets.length} stored tokens (${targets.map((t) => `${t.label} ${t.accountUuid}`).join(", ")}) - nothing removed` };
@@ -74,50 +74,41 @@ async function rmToken(selector: string, json: boolean): Promise<number> {
     return { kept };
   });
   if ("error" in outcome) {
-    emitError({ json, message: outcome.error });
+    emitError({ message: outcome.error });
     return 1;
   }
-  const remaining = outcome.kept;
-  if (json) {
-    emitJson({ ok: true, removed: selector, remaining: remaining.map((t) => t.label) });
-    return 0;
-  }
   console.log(`removed the setup token for ${selector} (local only: Claude Code documents no revocation for setup tokens)`);
   return 0;
 }
 
-export async function cmdSetupToken(args: string[], json = false): Promise<number> {
+export async function cmdSetupToken(args: string[]): Promise<number> {
   const [sub, label] = args;
-  if (sub === "rm" && label !== undefined && args.length === 2) return rmToken(label, json);
+  if (sub === "rm" && label !== undefined && args.length === 2) return rmToken(label);
   const print = sub === "--print" && args.length === 1;
   if (args.length > 0 && !print) {
-    emitError({ json, message: USAGE });
-    return 2;
-  }
-  if (json && !print) {
-    emitError({ json, message: "setup-token mints through a browser login flow and has no --json form; `setup-token --print --json` prints the stored set" });
+    emitError({ message: USAGE });
     return 2;
   }
   let store = loadSetupTokens();
-  let idx = loadAccounts();
+  let idx = loadAccounts(claudePool);
   if (!print) {
     if (idx.accounts.length === 0) {
-      emitError({ json, message: "no accounts in the pool - run `tokenmaxxing init` first" });
+      emitError({ message: "no accounts in the pool - run `tokenmaxxing init` first" });
       return 1;
     }
     const real = resolveRealClaude();
-    const missing = idx.accounts.filter((a) => !store.tokens.some((t) => t.accountUuid === a.accountUuid));
+    const missing = idx.accounts.filter((a) => !store.tokens.some((t) => t.accountUuid === a.id));
     if (missing.length === 0) console.log(c.dim("every pooled account already has a stored setup token (`setup-token rm <label>` drops one so it can be re-minted)"));
     for (const a of missing) {
       console.log();
-      console.log(`${c.bold(a.label)} - sign into this account in the browser (${a.email})`);
-      const token = await mint({ real, item: a.keychainItem });
+      console.log(`${c.bold(a.label)} - sign into this account in the browser (${a.email ?? a.label})`);
+      const token = await mint({ real, item: credItemFor(a.id) });
       if (!token) return 1;
-      const stored = await withLock(paths.lockFile, async () => {
-        if (!loadAccounts().accounts.some((x) => x.accountUuid === a.accountUuid)) return false;
+      const stored = await withLock(claudePool.lockFile, async () => {
+        if (!loadAccounts(claudePool).accounts.some((x) => x.id === a.id)) return false;
         const fresh = loadSetupTokens();
-        const tokens = fresh.tokens.filter((t) => t.accountUuid !== a.accountUuid);
-        saveSetupTokens({ ...fresh, tokens: [...tokens, { accountUuid: a.accountUuid, label: a.label, token, mintedAt: Date.now() }] });
+        const tokens = fresh.tokens.filter((t) => t.accountUuid !== a.id);
+        saveSetupTokens({ ...fresh, tokens: [...tokens, { accountUuid: a.id, label: a.label, token, mintedAt: Date.now() }] });
         return true;
       });
       if (!stored) {
@@ -127,26 +118,22 @@ export async function cmdSetupToken(args: string[], json = false): Promise<numbe
       console.log(`${c.green("✓")} stored the setup token for ${c.bold(a.label)} ${c.dim("(ownership not verified: an inference-only token cannot read the profile endpoint, so the label is the sign-in you chose)")}`);
     }
     store = loadSetupTokens();
-    idx = loadAccounts();
+    idx = loadAccounts(claudePool);
   }
   if (store.tokens.length === 0) {
-    emitError({ json, message: "no setup tokens stored - run `tokenmaxxing setup-token` to mint them" });
+    emitError({ message: "no setup tokens stored - run `tokenmaxxing setup-token` to mint them" });
     return 1;
   }
   const tokens = currentTokens(store.tokens, idx.accounts);
   const orphaned = store.tokens
-    .filter((t) => !idx.accounts.some((a) => a.accountUuid === t.accountUuid))
+    .filter((t) => !idx.accounts.some((a) => a.id === t.accountUuid))
     .map((t) => ({ label: t.label, accountUuid: t.accountUuid }));
   if (tokens.length === 0) {
-    emitError({ json, message: "no stored setup token belongs to a pooled account - run `tokenmaxxing setup-token` to mint them" });
+    emitError({ message: "no stored setup token belongs to a pooled account - run `tokenmaxxing setup-token` to mint them" });
     return 1;
   }
   const secret = cursorSecretValue(tokens);
   const bytes = Buffer.byteLength(secret);
-  if (json) {
-    emitJson({ ok: true, tokens, orphaned, bytes, cap: CURSOR_SECRET_VALUE_CAP_BYTES });
-    return 0;
-  }
   console.log();
   if (orphaned.length > 0) {
     console.log(c.dim(`left out of the secret (no longer in the pool): ${orphaned.map((t) => `${t.label} (${t.accountUuid})`).join(", ")}; \`setup-token rm <label|uuid>\` drops one`));