tokenmaxxing 1.34.0 → 1.35.0

package/src/main.ts

@@ -7,18 +7,16 @@ import { runSubagentStatusline } from "./entries/subagentstatusline.ts";
 import { runStopHook } from "./entries/stophook.ts";
 import { runStopFailureHook } from "./entries/stopfailurehook.ts";
 import { runSessionStart } from "./entries/sessionstart.ts";
+import { runCodexSupervisor } from "./entries/codexsupervisor.ts";
+import { runCodexStopHook } from "./entries/codexstophook.ts";
+import { claude } from "./lib/claude.ts";
+import { codex } from "./lib/codex.ts";
 import { cmdInit } from "./cli/init.ts";
 import { cmdAdd } from "./cli/add.ts";
 import { cmdAuth } from "./cli/auth.ts";
-import { cmdCodexAdd } from "./cli/codexadd.ts";
-import { cmdCodexInit } from "./cli/codexinit.ts";
-import { cmdCodexSwitch } from "./cli/codexswitch.ts";
-import { runCodexSupervisor } from "./entries/codexsupervisor.ts";
-import { runCodexStopHook } from "./entries/codexstophook.ts";
 import { cmdStatus } from "./cli/status.ts";
 import { cmdDoctor } from "./cli/doctor.ts";
 import { cmdRm } from "./cli/rm.ts";
-import { cmdCodexRm } from "./cli/codexrm.ts";
 import { cmdRename } from "./cli/rename.ts";
 import { cmdSwitch } from "./cli/switch.ts";
 import { cmdCheck } from "./cli/check.ts";
@@ -31,7 +29,9 @@ import { c, emitError } from "./cli/render.ts";
 
 const JSON_FLAG = "--json";
 const CACHED_FLAG = "--cached";
+const CODEX_FLAG = "--codex";
 const JSON_COMMANDS = new Set(["status", "config", "check", "switch"]);
+const CODEX_COMMANDS = new Set(["init", "add", "auth", "switch", "rm", "rename"]);
 
 function printHelp(): void {
   console.log(`${c.bold("tokenmaxxing")} - automatic Claude Code account switching
@@ -43,7 +43,7 @@ function printHelp(): void {
   ${c.cyan("tokenmaxxing init --codex")}  same for codex: import login, install codex supervisor + Stop hook (trust it via /hooks)
   ${c.cyan("tokenmaxxing add")}        register an additional account (isolated login)
   ${c.cyan("tokenmaxxing add --codex")}   register an additional codex account (isolated login)
-  ${c.cyan("tokenmaxxing auth")} [sel | --all]  reauthenticate a pooled account in place (bare = pick from a list; --all = every needs-reauth account, one by one)
+  ${c.cyan("tokenmaxxing auth")} [--codex] [sel | --all]  reauthenticate a pooled account in place (bare = pick from a list; --all = every needs-reauth account, one by one)
   ${c.cyan("tokenmaxxing switch --codex")} [sel]  switch the codex pool (takes effect on next codex start)
   ${c.cyan("tokenmaxxing status")} [--cached]  accounts with 5h / weekly / per-model usage bars (--cached: the stored figures, no sampling)
   ${c.cyan("tokenmaxxing config")}     print the config path and the effective values (edit the file in an editor)
@@ -80,7 +80,8 @@ async function main(): Promise<number> {
   jsonMode = argv.includes(JSON_FLAG);
   const json = jsonMode;
   const cached = argv.includes(CACHED_FLAG);
-  const args = argv.filter((a) => a !== JSON_FLAG && a !== CACHED_FLAG);
+  const provider = argv.includes(CODEX_FLAG) ? codex : claude;
+  const args = argv.filter((a) => a !== JSON_FLAG && a !== CACHED_FLAG && a !== CODEX_FLAG);
   const sub = args[0];
 
   if (cached && sub != null && sub !== "status") {
@@ -88,6 +89,11 @@ async function main(): Promise<number> {
     return 2;
   }
 
+  if (provider === codex && (sub == null || !CODEX_COMMANDS.has(sub))) {
+    emitError({ json, message: `${CODEX_FLAG} applies to ${[...CODEX_COMMANDS].join(", ")}, not ${sub ?? "status"}` });
+    return 2;
+  }
+
   if (json && sub != null && !JSON_COMMANDS.has(sub)) {
     emitError({ json, message: `${sub} has no ${JSON_FLAG} form (${JSON_FLAG} applies to ${[...JSON_COMMANDS].join(", ")})` });
     return 2;
@@ -120,10 +126,7 @@ async function main(): Promise<number> {
       }
       return cmdStatus({ json, cached });
     }
-    case "switch": {
-      const rest = args.slice(1).filter((a) => a !== "--codex");
-      return args.includes("--codex") ? cmdCodexSwitch(rest[0], json) : cmdSwitch(rest[0], json);
-    }
+    case "switch": return cmdSwitch(provider, args[1], json);
     case "check": {
       if (args.length > 1) {
         emitError({ json, message: `unknown check option: ${args[1]} (check takes no options; the timer runs a plain check every tick)` });
@@ -132,15 +135,12 @@ async function main(): Promise<number> {
       return cmdCheck(json);
     }
     case "config": return cmdConfig(args.slice(1), json);
-    case "init": return args.includes("--codex") ? cmdCodexInit() : cmdInit();
-    case "add": return args.includes("--codex") ? cmdCodexAdd() : cmdAdd();
-    case "auth": return cmdAuth(args.slice(1));
+    case "init": return cmdInit(provider);
+    case "add": return cmdAdd(provider);
+    case "auth": return cmdAuth(provider, args.slice(1));
     case "doctor": return cmdDoctor();
-    case "rm": {
-      const rest = args.slice(1).filter((a) => a !== "--codex");
-      return args.includes("--codex") ? cmdCodexRm(rest[0]) : cmdRm(rest[0]);
-    }
-    case "rename": return cmdRename(args.slice(1));
+    case "rm": return cmdRm(provider, args[1]);
+    case "rename": return cmdRename(provider, args.slice(1));
     case "setup-token": return cmdSetupToken(args.slice(1));
     case "cursor": {
       if (args[1] === "init") return cmdCursorInit(args.slice(2));

package/src/cli/codexadd.ts

@@ -1,89 +0,0 @@
-import { mkdirSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { MAX_WRAP_DEPTH, WRAP_DEPTH_ENV } from "../lib/claudebin.ts";
-import { resolveRealCodex } from "../lib/codexbin.ts";
-import { codexIdentityOf, readCodexAuthAt, writeParkedCodexAuth } from "../lib/codexauth.ts";
-import { CodexUsageReadError, fetchCodexUsage } from "../lib/codexusage.ts";
-import { loadCodexAccounts, saveCodexAccounts } from "../lib/codexstate.ts";
-import { saveTermios, restoreTermios } from "../lib/tty.ts";
-import { withLock } from "../lib/lock.ts";
-import { codexCredItemFor, codexPaths } from "../lib/paths.ts";
-import { writeFileAtomic } from "../lib/atomic.ts";
-import type { CodexAccount, CodexUsage } from "../lib/types.ts";
-import { c, count } from "./render.ts";
-
-export async function cmdCodexAdd(): Promise<number> {
-  const real = resolveRealCodex();
-  const onboardDir = codexPaths.onboardDir;
-  rmSync(onboardDir, { recursive: true, force: true });
-  mkdirSync(onboardDir, { recursive: true });
-  writeFileAtomic(join(onboardDir, "config.toml"), 'cli_auth_credentials_store = "file"\n');
-
-  console.log(c.cyan("Opening an isolated codex login - your primary login is untouched."));
-  console.log(c.dim("Open the URL codex prints, enter the code, and sign in with the account to add; the command exits once you're in."));
-  console.log();
-
-  const savedTermios = saveTermios();
-  const p = Bun.spawn([real, "login", "--device-auth"], {
-    stdin: "inherit",
-    stdout: "inherit",
-    stderr: "inherit",
-    env: {
-      ...process.env,
-      CODEX_HOME: onboardDir,
-      TOKENMAXXING_PROBE: "1",
-      [WRAP_DEPTH_ENV]: String(MAX_WRAP_DEPTH),
-    },
-  });
-  await p.exited;
-  restoreTermios(savedTermios);
-
-  let account: CodexAccount;
-  let poolSize: number;
-  try {
-    const auth = readCodexAuthAt({ path: join(onboardDir, "auth.json") });
-    if (p.exitCode !== 0 || !auth) {
-      console.error(c.red("no codex login landed in the isolated home - nothing added."));
-      return 1;
-    }
-
-    const identity = codexIdentityOf({ auth });
-    console.log(c.dim("sampling usage..."));
-    let usage: CodexUsage | null = null;
-    try {
-      usage = await fetchCodexUsage({ auth });
-    } catch (e) {
-      if (!(e instanceof CodexUsageReadError)) throw e;
-      console.log(c.yellow("could not sample usage now - it will fill in on first use."));
-    }
-
-    const credFile = codexCredItemFor(identity.accountId);
-    writeParkedCodexAuth({ credFile, auth });
-
-    ({ account, poolSize } = await withLock(codexPaths.lockFile, () => {
-      const index = loadCodexAccounts();
-      const existing = index.accounts.find((entry) => entry.accountId === identity.accountId);
-      const fresh: CodexAccount = {
-        accountId: identity.accountId,
-        email: usage?.email ?? identity.email,
-        label: existing?.label ?? usage?.email ?? identity.email ?? identity.accountId.slice(0, 8),
-        planType: usage?.planType ?? identity.planType,
-        credFile,
-        addedAt: existing?.addedAt ?? new Date().toISOString(),
-        needsReauth: false,
-        lastUsage: usage ? { aggregate: usage.aggregate, perLimit: usage.perLimit } : existing?.lastUsage,
-        lastUsageAt: usage ? Date.now() : existing?.lastUsageAt,
-      };
-      if (existing) Object.assign(existing, fresh);
-      else index.accounts.push(fresh);
-      saveCodexAccounts({ index });
-      return { account: fresh, poolSize: index.accounts.length };
-    }));
-  } finally {
-    rmSync(onboardDir, { recursive: true, force: true });
-  }
-
-  console.log();
-  console.log(`${c.green("✓")} added codex account ${c.bold(account.label)} (${account.planType ?? "?"}) - codex pool now has ${count({ n: poolSize, noun: "account" })}`);
-  return 0;
-}

package/src/cli/codexinit.ts

@@ -1,120 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { resolveRealCodex, verifyRealCodex } from "../lib/codexbin.ts";
-import { codexIdentityOf, readLiveCodexAuth, writeParkedCodexAuth } from "../lib/codexauth.ts";
-import { CodexUsageReadError, fetchCodexUsage } from "../lib/codexusage.ts";
-import { loadCodexAccounts, saveCodexAccounts } from "../lib/codexstate.ts";
-import { loadConfig, pinBinOverride } from "../lib/state.ts";
-import { installCodexSupervisor, codexSupervisorLink, ensurePathInRc, managedShellRcSkipLines, shellRcPath } from "../lib/install.ts";
-import { withLock } from "../lib/lock.ts";
-import { presentCodexAccountIds } from "../lib/codexpresence.ts";
-import { codexCredItemFor, codexPaths } from "../lib/paths.ts";
-import type { CodexAccount, CodexUsage } from "../lib/types.ts";
-import { c } from "./render.ts";
-
-function storePinnedAwayFromFile(): boolean {
-  const configToml = `${codexPaths.home}/config.toml`;
-  if (!existsSync(configToml)) return false;
-  for (const rawLine of readFileSync(configToml, "utf8").split("\n")) {
-    const line = rawLine.trim();
-    if (!line.startsWith("cli_auth_credentials_store")) continue;
-    const rest = line.slice("cli_auth_credentials_store".length).trimStart();
-    if (!rest.startsWith("=")) continue;
-    const beforeComment = rest.slice(1).split("#", 1)[0]!;
-    const value = beforeComment.replaceAll('"', "").replaceAll("'", "").trim();
-    return value !== "file";
-  }
-  return false;
-}
-
-export async function cmdCodexInit(): Promise<number> {
-  loadConfig();
-  const real = resolveRealCodex();
-  const fail = verifyRealCodex({ bin: real });
-  if (fail !== null) {
-    console.error(c.red(`codex binary failed verification: ${real}: ${fail}`));
-    return 1;
-  }
-  pinBinOverride({ key: "codexBin", bin: real });
-
-  if (storePinnedAwayFromFile()) {
-    console.error(c.red("codex config.toml pins cli_auth_credentials_store away from the plain auth.json file tokenmaxxing swaps."));
-    console.error(c.dim('recovery: set cli_auth_credentials_store = "file" in ~/.codex/config.toml, run `codex login`, then re-run this.'));
-    return 1;
-  }
-
-  const live = readLiveCodexAuth();
-  if (!live) {
-    console.error(c.red(`no codex login found at ${codexPaths.authJson} - run \`codex login\` first, then re-run this.`));
-    return 1;
-  }
-  const identity = codexIdentityOf({ auth: live });
-
-  console.log(c.dim("sampling usage..."));
-  let usage: CodexUsage | null = null;
-  try {
-    usage = await fetchCodexUsage({ auth: live });
-  } catch (e) {
-    if (!(e instanceof CodexUsageReadError)) throw e;
-    console.log(c.yellow("could not sample usage now - it will fill in on first use."));
-  }
-
-  const credFile = codexCredItemFor(identity.accountId);
-
-  if (presentCodexAccountIds().has(identity.accountId)) {
-    console.error(c.red("a live supervised codex session is running this account - its token rotates under us, so parking a snapshot now could poison the backup."));
-    console.error(c.dim("close that codex session (or let it exit) and re-run `tokenmaxxing init --codex`."));
-    return 1;
-  }
-
-  const account = await withLock(codexPaths.lockFile, () => {
-    if (presentCodexAccountIds().has(identity.accountId)) {
-      throw new Error("a live supervised codex session started running this account mid-init - close it and re-run `tokenmaxxing init --codex`");
-    }
-    const fresh2 = readLiveCodexAuth();
-    if (!fresh2 || codexIdentityOf({ auth: fresh2 }).accountId !== identity.accountId) {
-      throw new Error("the live codex login changed while init was running (a concurrent swap?) - re-run `tokenmaxxing init --codex`");
-    }
-    writeParkedCodexAuth({ credFile, auth: fresh2 });
-    const index = loadCodexAccounts();
-    const existing = index.accounts.find((entry) => entry.accountId === identity.accountId);
-    const fresh: CodexAccount = {
-      accountId: identity.accountId,
-      email: usage?.email ?? identity.email,
-      label: existing?.label ?? usage?.email ?? identity.email ?? identity.accountId.slice(0, 8),
-      planType: usage?.planType ?? identity.planType,
-      credFile,
-      addedAt: existing?.addedAt ?? new Date().toISOString(),
-      needsReauth: false,
-      lastUsage: usage ? { aggregate: usage.aggregate, perLimit: usage.perLimit } : existing?.lastUsage,
-      lastUsageAt: usage ? Date.now() : existing?.lastUsageAt,
-    };
-    if (existing) Object.assign(existing, fresh);
-    else index.accounts.push(fresh);
-    index.activeAccountId = identity.accountId;
-    saveCodexAccounts({ index });
-    return fresh;
-  });
-
-  installCodexSupervisor();
-  const rc = shellRcPath();
-  if (rc) {
-    const pathOutcome = ensurePathInRc(rc);
-    if (pathOutcome === "skipped") {
-      const hint = managedShellRcSkipLines();
-      console.log();
-      console.log(c.yellow(`⚠ ${hint.headline}`));
-      console.log(c.yellow(`  ${hint.detail}`));
-      console.log(c.yellow(`  ${hint.exportLine}`));
-    }
-  }
-
-  console.log();
-  console.log(`${c.green("✓")} imported codex account ${c.bold(account.label)} (${account.planType ?? "?"})`);
-  console.log(`${c.green("✓")} codex supervisor installed at ${codexSupervisorLink()}`);
-  console.log(`${c.green("✓")} Stop hook declared in ${codexPaths.hooksJson}`);
-  console.log();
-  console.log(c.bold(c.yellow("one manual step: codex skips untrusted hooks.")));
-  console.log(c.yellow("open codex, run /hooks, and trust the tokenmaxxing Stop hook - auto-switching is inert until then."));
-  console.log(c.dim("then add more accounts with `tokenmaxxing add --codex`."));
-  return 0;
-}

package/src/cli/codexrm.ts

@@ -1,36 +0,0 @@
-import { withLock } from "../lib/lock.ts";
-import { codexPaths } from "../lib/paths.ts";
-import { loadCodexAccounts, saveCodexAccounts } from "../lib/codexstate.ts";
-import { deleteParkedCodexAuth } from "../lib/codexauth.ts";
-import { liveCodexAccountId } from "../lib/codexsample.ts";
-import { presentCodexAccountIds } from "../lib/codexpresence.ts";
-import { findCodexAccount } from "./rename.ts";
-import { c, emitError, plain } from "./render.ts";
-
-export async function cmdCodexRm(selector?: string): Promise<number> {
-  if (!selector) {
-    emitError({ message: "usage: tokenmaxxing rm --codex <email|label|id>", paint: plain });
-    return 2;
-  }
-  return withLock(codexPaths.lockFile, async () => {
-    const index = loadCodexAccounts();
-    const account = findCodexAccount(index.accounts, selector);
-    if (!account) {
-      emitError({ message: `no codex account matches "${selector}"` });
-      return 1;
-    }
-    if (liveCodexAccountId() === account.accountId) {
-      emitError({ message: `${account.label} is the LIVE codex account - run \`tokenmaxxing switch --codex\` to move off it first.` });
-      return 1;
-    }
-    if (presentCodexAccountIds().has(account.accountId)) {
-      emitError({ message: `${account.label} is running in a live codex session - close that session before removing it.` });
-      return 1;
-    }
-    deleteParkedCodexAuth({ credFile: account.credFile });
-    index.accounts = index.accounts.filter((x) => x.accountId !== account.accountId);
-    saveCodexAccounts({ index });
-    console.log(`removed codex account ${c.bold(account.label)} from the pool (${index.accounts.length} left)`);
-    return 0;
-  });
-}

package/src/cli/codexswitch.ts

@@ -1,113 +0,0 @@
-import { withLock } from "../lib/lock.ts";
-import { codexPaths } from "../lib/paths.ts";
-import { loadConfig } from "../lib/state.ts";
-import { loadCodexAccounts } from "../lib/codexstate.ts";
-import { codexCurrentWins, pickBestCodex } from "../lib/codexpick.ts";
-import { performCodexSwap } from "../lib/codexswap.ts";
-import { CodexInvalidGrantError } from "../lib/codexoauth.ts";
-import { liveCodexAccountId } from "../lib/codexsample.ts";
-import { presentCodexAccountIds, targetableCodexAccounts } from "../lib/codexpresence.ts";
-import { thresholdBars } from "../lib/picker.ts";
-import { c, emitError, emitJson } from "./render.ts";
-
-export async function cmdCodexSwitch(sel?: string, json = false): Promise<number> {
-  const deadGrants: string[] = [];
-  const withDeadGrants = (report: Record<string, unknown>) => (deadGrants.length > 0 ? { ...report, deadGrants } : report);
-  const emit = (text: string, report: Record<string, unknown>): void => {
-    if (json) emitJson({ ok: true, ...withDeadGrants(report) });
-    else console.log(text);
-  };
-  const fail = (message: string, opts: { paint?: (s: string) => string; notes?: string[]; extra?: Record<string, unknown> } = {}): number => {
-    emitError({ json, message, paint: opts.paint, notes: opts.notes, extra: withDeadGrants(opts.extra ?? {}) });
-    return 1;
-  };
-  const deadGrantMessage = (label: string) => `${label}'s refresh token is dead - re-add it with \`tokenmaxxing add --codex\``;
-  const cfg = loadConfig();
-  const bars = thresholdBars(cfg);
-  const now = Date.now();
-
-  return withLock(codexPaths.lockFile, async () => {
-    const index = loadCodexAccounts();
-    if (index.accounts.length === 0) {
-      if (json) emitJson({ ok: false, error: "no codex accounts yet - run `tokenmaxxing init --codex`" });
-      else console.log(c.dim("no codex accounts yet - run `tokenmaxxing init --codex`"));
-      return 1;
-    }
-    const currentId = liveCodexAccountId();
-
-    if (sel) {
-      const target = index.accounts.find(
-        (account) => account.label === sel || account.email === sel || account.accountId.startsWith(sel),
-      );
-      if (!target) {
-        return fail(`no codex account matches "${sel}"`, {
-          notes: index.accounts.map((account) => `  ${account.label} (${account.accountId.slice(0, 8)})`),
-          extra: { accounts: index.accounts.map((account) => account.label) },
-        });
-      }
-      if (target.accountId === currentId) {
-        emit(`already on ${c.bold(target.label)}`, { switched: false, account: target.label, reason: "already-on" });
-        return 0;
-      }
-      if (presentCodexAccountIds().has(target.accountId)) {
-        return fail(`${target.label} is running in a live codex session - swapping onto it would break that session's credential`);
-      }
-      if (target.needsReauth) {
-        return fail(`${target.label} needs re-auth - run \`codex login\` in an isolated home and \`tokenmaxxing add --codex\``);
-      }
-      try {
-        await performCodexSwap({ target });
-      } catch (e) {
-        if (e instanceof CodexInvalidGrantError) {
-          deadGrants.push(target.label);
-          return fail(deadGrantMessage(target.label));
-        }
-        throw e;
-      }
-      emit(`${c.green("✓")} switched codex to ${c.bold(target.label)} (takes effect on the next codex start)`, {
-        switched: true,
-        account: target.label,
-        reason: "selected",
-      });
-      return 0;
-    }
-
-    while (true) {
-      const current = loadCodexAccounts();
-      const candidates = targetableCodexAccounts({ accounts: current.accounts, activeAccountId: currentId });
-      const active = candidates.find((account) => account.accountId === currentId) ?? null;
-      if (codexCurrentWins({ active, accounts: candidates, thresholds: bars, now })) {
-        emit(`already on the best codex account: ${c.bold(active?.label ?? "?")}`, {
-          switched: false,
-          account: active?.label ?? null,
-          reason: "current-wins",
-        });
-        return 0;
-      }
-      const best = pickBestCodex({ accounts: candidates, thresholds: bars, now, currentAccountId: currentId });
-      if (!best) {
-        const message = "no usable codex switch target (all at their bars, unmeasured, or needing reauth)";
-        const reauthNeeded = current.accounts.filter((account) => account.needsReauth).map((account) => account.label);
-        if (json) return fail(message, { extra: { reauthNeeded } });
-        console.log(c.yellow(message));
-        return 1;
-      }
-      try {
-        await performCodexSwap({ target: best });
-      } catch (e) {
-        if (e instanceof CodexInvalidGrantError) {
-          deadGrants.push(best.label);
-          if (!json) console.error(c.red(deadGrantMessage(best.label)));
-          continue;
-        }
-        throw e;
-      }
-      emit(`${c.green("✓")} switched codex to ${c.bold(best.label)} (takes effect on the next codex start)`, {
-        switched: true,
-        account: best.label,
-        reason: "best",
-      });
-      return 0;
-    }
-  });
-}

package/src/cli/onboard.ts

@@ -1,92 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { z } from "zod";
-import { readItem, deleteItem, isolatedTarget } from "../lib/credstore.ts";
-import { resolveRealClaude } from "../lib/claudebin.ts";
-import { CRED_ENV_OVERRIDES, probeUsage } from "../lib/usage.ts";
-import { saveTermios, restoreTermios } from "../lib/tty.ts";
-import { paths } from "../lib/paths.ts";
-import { CredentialBlobSchema, OAuthAccountSchema, UsageWindowsSchema } from "../lib/types.ts";
-import { c } from "./render.ts";
-
-const HarvestedLoginSchema = z.object({
-  blobRaw: z.string(),
-  blob: CredentialBlobSchema,
-  oauthAccount: OAuthAccountSchema,
-  sampled: UsageWindowsSchema.nullable(),
-});
-export type HarvestedLogin = z.infer<typeof HarvestedLoginSchema>;
-
-function identityReady(cjPath: string): boolean {
-  if (!existsSync(cjPath)) return false;
-  try {
-    const oauthAccount = JSON.parse(readFileSync(cjPath, "utf8")).oauthAccount;
-    return z.object({ accountUuid: z.string().min(1) }).safeParse(oauthAccount).success;
-  } catch {
-    return false;
-  }
-}
-
-export async function harvestIsolatedLogin(): Promise<HarvestedLogin | null> {
-  const onboardDir = paths.onboardDir;
-  rmSync(onboardDir, { recursive: true, force: true });
-  mkdirSync(onboardDir, { recursive: true });
-  const iso = isolatedTarget(onboardDir);
-  await deleteItem(iso);
-  const cjPath = join(onboardDir, ".claude.json");
-  const real = resolveRealClaude();
-
-  const savedTermios = saveTermios();
-  const env: Record<string, string> = { ...process.env, CLAUDE_CONFIG_DIR: onboardDir, TOKENMAXXING_PROBE: "1", TOKENMAXXING_SUPERVISED: "" };
-  for (const key of CRED_ENV_OVERRIDES) delete env[key];
-  const p = Bun.spawn([real], {
-    stdin: "inherit",
-    stdout: "inherit",
-    stderr: "inherit",
-    env,
-  });
-
-  try {
-    let exited = false;
-    const onExit = p.exited.then(() => { exited = true; });
-    while (!exited) {
-      await Bun.sleep(400);
-      if (identityReady(cjPath) && (await readItem(iso))) {
-        p.kill();
-        break;
-      }
-    }
-    await p.exited;
-    await onExit;
-    restoreTermios(savedTermios);
-
-    const blobRaw = await readItem(iso);
-    if (!blobRaw || !identityReady(cjPath)) {
-      console.error(c.red("no login detected in the isolated session - nothing changed."));
-      return null;
-    }
-
-    let blob, oauthAccount;
-    try {
-      blob = CredentialBlobSchema.parse(JSON.parse(blobRaw));
-      oauthAccount = OAuthAccountSchema.parse(JSON.parse(readFileSync(cjPath, "utf8")).oauthAccount);
-    } catch {
-      console.error(c.red("could not parse the onboarded account's credential/identity."));
-      return null;
-    }
-
-    console.log(c.dim("sampling usage..."));
-    const sampled = await probeUsage(onboardDir);
-    if (!sampled) console.log(c.yellow("could not sample usage now - it will fill in on first use."));
-
-    return { blobRaw, blob, oauthAccount, sampled };
-  } finally {
-    if (p.exitCode === null) {
-      p.kill();
-      await p.exited;
-    }
-    restoreTermios(savedTermios);
-    await deleteItem(iso);
-    rmSync(onboardDir, { recursive: true, force: true });
-  }
-}