tokenmaxxing 1.34.0 → 1.38.0

package/src/lib/state.ts

@@ -1,16 +1,19 @@
 import { closeSync, existsSync, fstatSync, openSync, readFileSync, rmSync, utimesSync } from "node:fs";
 import { isEqual } from "es-toolkit";
 import { z } from "zod";
-import { paths, realClaudeBinFromEnv, realCodexBinFromEnv } from "./paths.ts";
+import { paths, realClaudeBinFromEnv, realCodexBinFromEnv, type PoolPaths } from "./paths.ts";
 import { writeFileAtomic } from "./atomic.ts";
 import {
   AccountsIndexSchema,
   ConfigSchema,
+  ErrnoSchema,
   LastSwapSchema,
   UsageStateSchema,
+  type Account,
   type AccountsIndex,
   type Config,
   type UsageState,
+  type Window,
 } from "./types.ts";
 
 export function loadConfig(): Config {
@@ -44,25 +47,56 @@ export function pinBinOverride(input: { key: "claudeBin" | "codexBin"; bin: stri
   writeFileAtomic(paths.configJson, JSON.stringify(raw, null, 2) + "\n");
 }
 
-const emptyIndex = (): AccountsIndex => ({ version: 1, activeAccountUuid: null, accounts: [] });
+const emptyIndex = (): AccountsIndex => ({ version: 2, activeId: null, accounts: [] });
 
-export function loadAccounts(): AccountsIndex {
-  if (!existsSync(paths.accountsJson)) return emptyIndex();
+export function loadAccounts(pool: PoolPaths): AccountsIndex {
+  if (!existsSync(pool.accountsJson)) return emptyIndex();
   let json: unknown;
   try {
-    json = JSON.parse(readFileSync(paths.accountsJson, "utf8"));
+    json = JSON.parse(readFileSync(pool.accountsJson, "utf8"));
   } catch {
-    throw new Error(`${paths.accountsJson} is corrupt (unparsable JSON) - refusing to treat a damaged pool as empty; repair or remove the file`);
+    throw new Error(`${pool.accountsJson} is corrupt (unparsable JSON) - refusing to treat a damaged pool as empty; repair or remove the file`);
   }
   const parsed = AccountsIndexSchema.safeParse(json);
   if (!parsed.success) {
-    throw new Error(`${paths.accountsJson} does not match the accounts schema - refusing to treat a damaged pool as empty; repair or remove the file`);
+    throw new Error(`${pool.accountsJson} does not match the accounts schema - refusing to treat a damaged pool as empty; repair or remove the file`);
   }
   return parsed.data;
 }
 
-export function saveAccounts(idx: AccountsIndex): void {
-  writeFileAtomic(paths.accountsJson, JSON.stringify(AccountsIndexSchema.parse(idx), null, 2) + "\n");
+export function saveAccounts(pool: PoolPaths, idx: AccountsIndex): void {
+  writeFileAtomic(pool.accountsJson, JSON.stringify(AccountsIndexSchema.parse(idx), null, 2) + "\n");
+}
+
+export type Harvest = {
+  id: string;
+  email: string | null;
+  tier: string | null;
+  oauthAccount?: Account["oauthAccount"];
+  sample: { windows: Window[]; at: number } | null;
+  park: () => Promise<void>;
+};
+
+export function upsertAccount(
+  idx: AccountsIndex,
+  h: Harvest,
+  mergeWindows: (next: Window[], prev: Window[]) => Window[],
+): Account {
+  const existing = idx.accounts.find((a) => a.id === h.id);
+  const fresh: Account = {
+    id: h.id,
+    label: existing?.label ?? h.email ?? h.id.slice(0, 8),
+    email: h.email,
+    tier: h.tier,
+    addedAt: existing?.addedAt ?? new Date().toISOString(),
+    windows: h.sample ? mergeWindows(h.sample.windows, existing?.windows ?? []) : (existing?.windows ?? []),
+    lastUsageAt: h.sample ? h.sample.at : existing?.lastUsageAt,
+    needsReauth: false,
+    ...(h.oauthAccount ? { oauthAccount: h.oauthAccount } : {}),
+  };
+  if (existing) Object.assign(existing, fresh);
+  else idx.accounts.push(fresh);
+  return existing ?? fresh;
 }
 
 export function loadUsageSnapshot(): { state: UsageState; at: number } | null {
@@ -91,22 +125,22 @@ export function clearUsageSnapshots(): void {
   rmSync(paths.usageJson, { force: true });
 }
 
-export function loadLastSwapAt(): number | null {
-  if (!existsSync(paths.lastSwapJson)) return null;
+export function loadLastSwapAt(pool: PoolPaths): number | null {
+  if (!existsSync(pool.lastSwapJson)) return null;
   let json: unknown;
   try {
-    json = JSON.parse(readFileSync(paths.lastSwapJson, "utf8"));
+    json = JSON.parse(readFileSync(pool.lastSwapJson, "utf8"));
   } catch {
-    throw new Error(`${paths.lastSwapJson} is corrupt (unparsable JSON) - refusing to treat a damaged swap clock as never-swapped; repair or remove the file`);
+    throw new Error(`${pool.lastSwapJson} is corrupt (unparsable JSON) - refusing to treat a damaged swap clock as never-swapped; repair or remove the file`);
   }
   return LastSwapSchema.parse(json).ts;
 }
 
-export function saveLastSwapAt(ts: number): void {
-  writeFileAtomic(paths.lastSwapJson, JSON.stringify(LastSwapSchema.parse({ ts })));
+export function saveLastSwapAt(pool: PoolPaths, ts: number): void {
+  writeFileAtomic(pool.lastSwapJson, JSON.stringify(LastSwapSchema.parse({ ts })));
 }
 
-const DepletedWaitSchema = z.object({ waitUntil: z.number(), accountUuid: z.string(), ts: z.number() });
+const DepletedWaitSchema = z.object({ waitUntil: z.number(), id: z.string(), ts: z.number() });
 export type DepletedWait = z.infer<typeof DepletedWaitSchema>;
 
 export function loadDepletedWait(): DepletedWait | null {
@@ -148,8 +182,7 @@ export function writeUsage(input: UsageState, opts: { stamp?: boolean } = {}): b
     try {
       utimesSync(paths.usageJson, new Date(next.ts), new Date(next.ts));
     } catch (e) {
-      const errno = z.object({ code: z.string() }).safeParse(e);
-      if (!errno.success || errno.data.code !== "ENOENT") throw e;
+      if (ErrnoSchema.safeParse(e).data?.code !== "ENOENT") throw e;
     }
     return false;
   }

package/src/lib/swap.ts

@@ -3,6 +3,7 @@ import { readItem, writeItem, liveTarget, parkedTarget, claudeAiOauthOnly, merge
 import { refreshCredential, isAccessTokenExpiring, isDeadCredential, fetchTokenIdentity, describeIdentity, IdentityUnavailableError, InvalidGrantError, RefreshRejectedError } from "./oauth.ts";
 import { swapOAuthAccount } from "./claudejson.ts";
 import { withClaudeRefreshLock } from "./claudelock.ts";
+import { claudePool, credItemFor } from "./paths.ts";
 import { log } from "./log.ts";
 import { CredentialBlobSchema, type Account, type OAuthCreds, type TokenIdentity } from "./types.ts";
 
@@ -11,7 +12,9 @@ function parseBlob(raw: string) {
 }
 
 export async function performSwap(target: Account): Promise<void> {
-  const idx = loadAccounts();
+  const idx = loadAccounts(claudePool);
+  const oauthAccount = target.oauthAccount;
+  if (!oauthAccount) throw new Error(`${target.label} has no oauthAccount on its record - re-add it with \`tokenmaxxing auth ${target.label}\``);
 
   const preLive = await readItem(liveTarget());
   let liveOwner: Account | null = null;
@@ -49,31 +52,31 @@ export async function performSwap(target: Account): Promise<void> {
       } catch (e) {
         throw new Error(`cannot resolve the live credential's owner (${e instanceof Error ? e.message : String(e)}) - refusing to swap over it; the next check retries`);
       }
-      liveOwner = idx.accounts.find((a) => a.accountUuid === identity.accountUuid) ?? null;
+      liveOwner = idx.accounts.find((a) => a.id === identity.accountUuid) ?? null;
       if (!liveOwner) {
         throw new Error(
           `live credential belongs to ${describeIdentity(identity)}, which is not in the pool - refusing to swap over it; import it first with \`tokenmaxxing add\``,
         );
       }
-      if (liveOwner.accountUuid !== idx.activeAccountUuid) {
+      if (liveOwner.id !== idx.activeId) {
         log("swap.harvest_drift", {
-          labeled: idx.activeAccountUuid?.slice(0, 8) ?? null,
-          actual: liveOwner.accountUuid.slice(0, 8),
+          labeled: idx.activeId?.slice(0, 8) ?? null,
+          actual: liveOwner.id.slice(0, 8),
         });
       }
     }
   }
 
-  const selfSwap = liveOwner != null && liveOwner.accountUuid === target.accountUuid;
+  const selfSwap = liveOwner != null && liveOwner.id === target.id;
   let fresh: OAuthCreds | null = null;
   if (!selfSwap) {
-    const parkedRaw = await readItem(parkedTarget(target.keychainItem));
-    if (!parkedRaw) throw new Error(`no parked credential for ${target.email}`);
+    const parkedRaw = await readItem(parkedTarget(credItemFor(target.id)));
+    if (!parkedRaw) throw new Error(`no parked credential for ${target.label}`);
     const parked = parseBlob(parkedRaw).claudeAiOauth;
     const markDead = (detail: string): InvalidGrantError => {
-      const t = idx.accounts.find((a) => a.accountUuid === target.accountUuid);
-      if (t) { t.needsReauth = true; saveAccounts(idx); }
-      log("swap.invalid_grant", { account: target.accountUuid.slice(0, 8), detail });
+      const t = idx.accounts.find((a) => a.id === target.id);
+      if (t) { t.needsReauth = true; saveAccounts(claudePool, idx); }
+      log("swap.invalid_grant", { account: target.id.slice(0, 8), detail });
       return new InvalidGrantError(detail);
     };
     if (isDeadCredential(parked)) throw markDead("parked credential was cleared after a failed refresh - re-auth with `tokenmaxxing auth`");
@@ -82,14 +85,14 @@ export async function performSwap(target: Account): Promise<void> {
       parkedOwner = await fetchTokenIdentity(parked.accessToken);
     } catch (e) {
       if (!(e instanceof IdentityUnavailableError && e.status === 401)) throw e;
-      log("swap.parked_token_stale", { account: target.accountUuid.slice(0, 8) });
+      log("swap.parked_token_stale", { account: target.id.slice(0, 8) });
     }
-    if (parkedOwner != null && parkedOwner.accountUuid !== target.accountUuid) {
-      const owner = idx.accounts.find((a) => a.accountUuid === parkedOwner.accountUuid) ?? null;
+    if (parkedOwner != null && parkedOwner.accountUuid !== target.id) {
+      const owner = idx.accounts.find((a) => a.id === parkedOwner.accountUuid) ?? null;
       let kept = "was left in place";
-      if (owner != null && owner.accountUuid !== liveOwner?.accountUuid) {
-        await writeItem(parkedTarget(owner.keychainItem), JSON.stringify({ claudeAiOauth: parked }));
-        log("swap.parked_relocated", { account: owner.accountUuid.slice(0, 8) });
+      if (owner != null && owner.id !== liveOwner?.id) {
+        await writeItem(parkedTarget(credItemFor(owner.id)), JSON.stringify({ claudeAiOauth: parked }));
+        log("swap.parked_relocated", { account: owner.id.slice(0, 8) });
         kept = "was copied to that account's slot";
       }
       throw markDead(`parked credential belongs to ${describeIdentity(parkedOwner)} - refusing to spend another account's grant; the pair ${kept}; re-auth with \`tokenmaxxing auth ${target.label}\``);
@@ -99,7 +102,7 @@ export async function performSwap(target: Account): Promise<void> {
         return await refreshCredential(parked);
       } catch (e) {
         if (e instanceof InvalidGrantError) throw markDead(e.detail);
-        if (e instanceof RefreshRejectedError) log("swap.refresh_rejected", { account: target.accountUuid.slice(0, 8), status: e.status, detail: e.detail });
+        if (e instanceof RefreshRejectedError) log("swap.refresh_rejected", { account: target.id.slice(0, 8), status: e.status, detail: e.detail });
         throw e;
       }
     };
@@ -112,18 +115,18 @@ export async function performSwap(target: Account): Promise<void> {
         try {
           freshOwner = await fetchTokenIdentity(rotated.accessToken);
         } catch (e) {
-          await writeItem(parkedTarget(target.keychainItem), JSON.stringify({ claudeAiOauth: rotated }));
+          await writeItem(parkedTarget(credItemFor(target.id)), JSON.stringify({ claudeAiOauth: rotated }));
           throw new Error(`refreshed the parked credential but cannot verify its owner (${e instanceof Error ? e.message : String(e)}) - kept the rotated token parked; the next check retries`);
         }
-        if (freshOwner.accountUuid !== target.accountUuid) {
-          const owner = idx.accounts.find((a) => a.accountUuid === freshOwner.accountUuid) ?? null;
-          const kept = await keepRotatedPair({ fresh: rotated, owner, fallback: target, liveOwnerUuid: liveOwner?.accountUuid ?? null, expectedLiveToken, lock });
+        if (freshOwner.accountUuid !== target.id) {
+          const owner = idx.accounts.find((a) => a.id === freshOwner.accountUuid) ?? null;
+          const kept = await keepRotatedPair({ fresh: rotated, owner, fallback: target, liveOwnerId: liveOwner?.id ?? null, expectedLiveToken, lock });
           throw markDead(`parked credential belongs to ${describeIdentity(freshOwner)}, whose grant this refresh rotated - the rotated token ${kept}; re-auth with \`tokenmaxxing auth ${target.label}\``);
         }
         return rotated;
       });
     }
-    await writeItem(parkedTarget(target.keychainItem), JSON.stringify({ claudeAiOauth: fresh }));
+    await writeItem(parkedTarget(credItemFor(target.id)), JSON.stringify({ claudeAiOauth: fresh }));
   }
 
   await withClaudeRefreshLock(async (lock) => {
@@ -136,44 +139,44 @@ export async function performSwap(target: Account): Promise<void> {
     }
 
     if (liveOwner && currentLive) {
-      await writeItem(parkedTarget(liveOwner.keychainItem), claudeAiOauthOnly(currentLive));
-      log("swap.harvest", { account: liveOwner.accountUuid.slice(0, 8) });
+      await writeItem(parkedTarget(credItemFor(liveOwner.id)), claudeAiOauthOnly(currentLive));
+      log("swap.harvest", { account: liveOwner.id.slice(0, 8) });
     }
 
     if (fresh != null) {
       await writeItem(liveTarget(), mergeIntoLive(currentLive, fresh));
     }
-    swapOAuthAccount(target.oauthAccount);
-    idx.activeAccountUuid = target.accountUuid;
-    const t2 = idx.accounts.find((a) => a.accountUuid === target.accountUuid);
+    swapOAuthAccount(oauthAccount);
+    idx.activeId = target.id;
+    const t2 = idx.accounts.find((a) => a.id === target.id);
     if (t2) { t2.needsReauth = false; }
-    saveAccounts(idx);
+    saveAccounts(claudePool, idx);
     clearUsageSnapshots();
     clearDepletedWait();
-    saveLastSwapAt(Date.now());
+    saveLastSwapAt(claudePool, Date.now());
   });
-  log("swap.done", { account: target.accountUuid.slice(0, 8), email: target.email });
+  log("swap.done", { account: target.id.slice(0, 8), label: target.label });
 }
 
 export async function keepRotatedPair(input: {
   fresh: OAuthCreds;
   owner: Account | null;
   fallback: Account;
-  liveOwnerUuid: string | null;
+  liveOwnerId: string | null;
   expectedLiveToken: string | null;
   lock: { compromised: () => boolean };
 }): Promise<string> {
   const { fresh, owner } = input;
   if (owner == null) {
-    await writeItem(parkedTarget(input.fallback.keychainItem), JSON.stringify({ claudeAiOauth: fresh }));
-    log("swap.rotated_kept_in_stamped_slot", { account: input.fallback.accountUuid.slice(0, 8) });
+    await writeItem(parkedTarget(credItemFor(input.fallback.id)), JSON.stringify({ claudeAiOauth: fresh }));
+    log("swap.rotated_kept_in_stamped_slot", { account: input.fallback.id.slice(0, 8) });
     return "was kept in this account's stamped slot because its owner is not in the pool";
   }
   const park = async (): Promise<void> => {
-    await writeItem(parkedTarget(owner.keychainItem), JSON.stringify({ claudeAiOauth: fresh }));
-    log("swap.rotated_parked_rescued", { account: owner.accountUuid.slice(0, 8) });
+    await writeItem(parkedTarget(credItemFor(owner.id)), JSON.stringify({ claudeAiOauth: fresh }));
+    log("swap.rotated_parked_rescued", { account: owner.id.slice(0, 8) });
   };
-  if (input.liveOwnerUuid !== owner.accountUuid) {
+  if (input.liveOwnerId !== owner.id) {
     await park();
     return "was parked under that account";
   }
@@ -182,7 +185,7 @@ export async function keepRotatedPair(input: {
     if (input.lock.compromised()) throw new Error("refresh lock compromised");
     if (currentLive == null || parseBlob(currentLive).claudeAiOauth.accessToken !== input.expectedLiveToken) throw new Error("live credential changed while unlocked");
     await writeItem(liveTarget(), mergeIntoLive(currentLive, fresh));
-    log("swap.rotated_live_rescued", { account: owner.accountUuid.slice(0, 8) });
+    log("swap.rotated_live_rescued", { account: owner.id.slice(0, 8) });
     return "was installed into the live store so that account's sessions continue";
   } catch (e) {
     await park();

package/src/lib/types.ts

@@ -38,10 +38,18 @@ const AggregateWindowsSchema = z.object({
 
 export const UsageWindowsSchema = AggregateWindowsSchema.extend({
   perModel: z.record(z.string(), UsageWindowSchema).default({}),
-  rowsAt: z.number().optional(),
 });
 export type UsageWindows = z.infer<typeof UsageWindowsSchema>;
 
+export const WindowSchema = z.object({
+  name: z.string().nullable(),
+  usedPercentage: z.number(),
+  resetsAt: z.number().nullable(),
+  windowSeconds: z.number().nullable(),
+  sampledAt: z.number(),
+});
+export type Window = z.infer<typeof WindowSchema>;
+
 const ModelInfoSchema = z.object({ id: z.string(), display: z.string() });
 export type ModelInfo = z.infer<typeof ModelInfoSchema>;
 
@@ -54,26 +62,23 @@ export const UsageStateSchema = AggregateWindowsSchema.extend({
 export type UsageState = z.infer<typeof UsageStateSchema>;
 
 export const AccountSchema = z.object({
-  accountUuid: z.string(),
-  email: z.string(),
-  organizationUuid: z.string(),
+  id: z.string(),
   label: z.string(),
-  keychainItem: z.string(),
-  oauthAccount: OAuthAccountSchema,
+  email: z.string().nullable(),
+  tier: z.string().nullable(),
   addedAt: z.string(),
-  lastUsage: UsageWindowsSchema.optional(),
+  windows: z.array(WindowSchema).default([]),
   lastUsageAt: z.number().optional(),
   lastProbeAt: z.number().optional(),
   enforcedUntil: z.number().optional(),
   needsReauth: z.boolean().optional(),
-  subscriptionType: z.string().optional(),
-  rateLimitTier: z.string().optional(),
+  oauthAccount: OAuthAccountSchema.optional(),
 });
 export type Account = z.infer<typeof AccountSchema>;
 
 export const AccountsIndexSchema = z.object({
-  version: z.literal(1),
-  activeAccountUuid: z.string().nullable(),
+  version: z.literal(2),
+  activeId: z.string().nullable(),
   accounts: z.array(AccountSchema).default([]),
 });
 
@@ -216,53 +221,14 @@ export const CodexAuthJsonSchema = z.looseObject({
 });
 export type CodexAuthJson = z.infer<typeof CodexAuthJsonSchema>;
 
-const CodexWindowSchema = z.object({
-  usedPercentage: z.number(),
-  resetsAt: z.number().nullable(),
-  windowSeconds: z.number().nullable(),
-});
-export type CodexWindow = z.infer<typeof CodexWindowSchema>;
-
 export const CodexUsageSchema = z.object({
   accountId: z.string(),
   email: z.string().nullable(),
   planType: z.string().nullable(),
-  aggregate: z.array(CodexWindowSchema),
-  perLimit: z.record(z.string(), z.array(CodexWindowSchema)),
+  windows: z.array(WindowSchema),
 });
 export type CodexUsage = z.infer<typeof CodexUsageSchema>;
 
-const BareFileNameSchema = z
-  .string()
-  .refine((s) => s.length > 0 && s !== "." && s !== ".." && !s.includes("/") && !s.includes("\\"), {
-    message: "credFile must be a bare file name, not a path",
-  });
-
-export const CodexAccountSchema = z.object({
-  accountId: z.string(),
-  email: z.string().nullable(),
-  label: z.string(),
-  planType: z.string().nullable(),
-  credFile: BareFileNameSchema,
-  addedAt: z.string(),
-  needsReauth: z.boolean().optional(),
-  lastUsage: z
-    .object({
-      aggregate: z.array(CodexWindowSchema),
-      perLimit: z.record(z.string(), z.array(CodexWindowSchema)),
-    })
-    .optional(),
-  lastUsageAt: z.number().optional(),
-});
-export type CodexAccount = z.infer<typeof CodexAccountSchema>;
-
-export const CodexAccountsIndexSchema = z.object({
-  version: z.literal(1),
-  activeAccountId: z.string().nullable(),
-  accounts: z.array(CodexAccountSchema).default([]),
-});
-export type CodexAccountsIndex = z.infer<typeof CodexAccountsIndexSchema>;
-
 export const CodexStopStdinSchema = z.looseObject({
   session_id: z.string().optional(),
   hook_event_name: z.string().optional(),
@@ -278,3 +244,17 @@ export const CodexReconcileMarkerSchema = z.object({
   accountId: z.string(),
   ts: z.number(),
 });
+
+export const ErrnoSchema = z.object({ code: z.string() });
+
+export const JsonTextSchema = z.codec(z.string(), z.unknown(), {
+  decode: (text, ctx) => {
+    try {
+      return JSON.parse(text);
+    } catch {
+      ctx.issues.push({ code: "invalid_format", format: "json", input: text });
+      return z.NEVER;
+    }
+  },
+  encode: (value) => JSON.stringify(value),
+});

package/src/lib/usage.ts

@@ -3,7 +3,7 @@ import { delay } from "es-toolkit";
 import { z } from "zod";
 import { MAX_WRAP_DEPTH, WRAP_DEPTH_ENV, resolveRealClaude } from "./claudebin.ts";
 import { log } from "./log.ts";
-import { RateLimitsStdinSchema, type ModelInfo, type UsageWindow, type UsageWindows } from "./types.ts";
+import { JsonTextSchema, RateLimitsStdinSchema, type ModelInfo, type UsageWindow, type UsageWindows, type Window } from "./types.ts";
 
 export function normalizeResetsAt(v: unknown): number | null {
   const num = z.number().finite().safeParse(v);
@@ -239,9 +239,22 @@ export function parseUsageText(text: string, now = Date.now()): UsageWindows | n
   return { fiveHour, sevenDay, perModel };
 }
 
-export function keepRows(next: UsageWindows, prev: UsageWindows | undefined, at: number): UsageWindows {
-  if (Object.keys(next.perModel).length > 0 && (prev?.rowsAt == null || prev.rowsAt <= at)) return { ...next, rowsAt: at };
-  return { ...next, perModel: prev?.perModel ?? {}, ...(prev?.rowsAt != null ? { rowsAt: prev.rowsAt } : {}) };
+const FIVE_HOURS_S = 5 * 3600;
+const WEEK_S = 7 * 24 * 3600;
+
+export function windowsOf(u: UsageWindows, at: number): Window[] {
+  return [
+    { name: null, ...u.fiveHour, windowSeconds: FIVE_HOURS_S, sampledAt: at },
+    { name: null, ...u.sevenDay, windowSeconds: WEEK_S, sampledAt: at },
+    ...Object.entries(u.perModel).map(([name, w]) => ({ name, ...w, windowSeconds: WEEK_S, sampledAt: at })),
+  ];
+}
+
+export function mergeWindows(next: Window[], prev: Window[]): Window[] {
+  const named = (ws: Window[]) => ws.filter((w) => w.name != null);
+  const newest = (ws: Window[]) => Math.max(0, ...ws.map((w) => w.sampledAt));
+  const rows = named(next).length > 0 && newest(named(prev)) <= newest(named(next)) ? named(next) : named(prev);
+  return [...next.filter((w) => w.name == null), ...rows];
 }
 
 export const CRED_ENV_OVERRIDES = [
@@ -266,21 +279,16 @@ const SpawnResultSchema = z.object({
 type SpawnResult = z.infer<typeof SpawnResultSchema>;
 
 async function spawnClaudeBounded(cmd: string[], env: Record<string, string>): Promise<SpawnResult | null> {
-  const p = Bun.spawn(cmd, { env, stdout: "pipe", stderr: "pipe" });
-  const killer = setTimeout(() => p.kill("SIGKILL"), PROBE_KILL_MS);
-  try {
-    const reads = Promise.all([new Response(p.stdout).text(), new Response(p.stderr).text()]);
-    const settled = await Promise.race([
-      reads,
-      p.exited.then(() => delay(PIPE_GRACE_MS)).then(() => null),
-    ]);
-    if (settled === null) return null;
-    const [stdout, stderr] = settled;
-    await p.exited;
-    return { exitCode: p.exitCode, stdout, stderr };
-  } finally {
-    clearTimeout(killer);
-  }
+  const p = Bun.spawn(cmd, { env, stdout: "pipe", stderr: "pipe", timeout: PROBE_KILL_MS, killSignal: "SIGKILL" });
+  const reads = Promise.all([new Response(p.stdout).text(), new Response(p.stderr).text()]);
+  const settled = await Promise.race([
+    reads,
+    p.exited.then(() => delay(PIPE_GRACE_MS)).then(() => null),
+  ]);
+  if (settled === null) return null;
+  const [stdout, stderr] = settled;
+  await p.exited;
+  return { exitCode: p.exitCode, stdout, stderr };
 }
 
 async function probeUsageOnce(env: Record<string, string>, now: number): Promise<UsageWindows | null> {
@@ -301,7 +309,7 @@ async function probeUsageOnce(env: Record<string, string>, now: number): Promise
     return null;
   }
 
-  const j = z.object({ result: z.string() }).safeParse((() => { try { return JSON.parse(out); } catch { return null; } })());
+  const j = z.object({ result: z.string() }).safeParse(JsonTextSchema.safeParse(out).data);
   const text = j.success ? j.data.result : out;
   const full = parseUsageText(text, now);
   if (!full) {

package/src/main.ts

@@ -7,18 +7,16 @@ import { runSubagentStatusline } from "./entries/subagentstatusline.ts";
 import { runStopHook } from "./entries/stophook.ts";
 import { runStopFailureHook } from "./entries/stopfailurehook.ts";
 import { runSessionStart } from "./entries/sessionstart.ts";
+import { runCodexSupervisor } from "./entries/codexsupervisor.ts";
+import { runCodexStopHook } from "./entries/codexstophook.ts";
+import { claude } from "./lib/claude.ts";
+import { codex } from "./lib/codex.ts";
 import { cmdInit } from "./cli/init.ts";
 import { cmdAdd } from "./cli/add.ts";
 import { cmdAuth } from "./cli/auth.ts";
-import { cmdCodexAdd } from "./cli/codexadd.ts";
-import { cmdCodexInit } from "./cli/codexinit.ts";
-import { cmdCodexSwitch } from "./cli/codexswitch.ts";
-import { runCodexSupervisor } from "./entries/codexsupervisor.ts";
-import { runCodexStopHook } from "./entries/codexstophook.ts";
 import { cmdStatus } from "./cli/status.ts";
 import { cmdDoctor } from "./cli/doctor.ts";
 import { cmdRm } from "./cli/rm.ts";
-import { cmdCodexRm } from "./cli/codexrm.ts";
 import { cmdRename } from "./cli/rename.ts";
 import { cmdSwitch } from "./cli/switch.ts";
 import { cmdCheck } from "./cli/check.ts";
@@ -31,7 +29,9 @@ import { c, emitError } from "./cli/render.ts";
 
 const JSON_FLAG = "--json";
 const CACHED_FLAG = "--cached";
+const CODEX_FLAG = "--codex";
 const JSON_COMMANDS = new Set(["status", "config", "check", "switch"]);
+const CODEX_COMMANDS = new Set(["init", "add", "auth", "switch", "rm", "rename"]);
 
 function printHelp(): void {
   console.log(`${c.bold("tokenmaxxing")} - automatic Claude Code account switching
@@ -43,7 +43,7 @@ function printHelp(): void {
   ${c.cyan("tokenmaxxing init --codex")}  same for codex: import login, install codex supervisor + Stop hook (trust it via /hooks)
   ${c.cyan("tokenmaxxing add")}        register an additional account (isolated login)
   ${c.cyan("tokenmaxxing add --codex")}   register an additional codex account (isolated login)
-  ${c.cyan("tokenmaxxing auth")} [sel | --all]  reauthenticate a pooled account in place (bare = pick from a list; --all = every needs-reauth account, one by one)
+  ${c.cyan("tokenmaxxing auth")} [--codex] [sel | --all]  reauthenticate a pooled account in place (bare = pick from a list; --all = every needs-reauth account, one by one)
   ${c.cyan("tokenmaxxing switch --codex")} [sel]  switch the codex pool (takes effect on next codex start)
   ${c.cyan("tokenmaxxing status")} [--cached]  accounts with 5h / weekly / per-model usage bars (--cached: the stored figures, no sampling)
   ${c.cyan("tokenmaxxing config")}     print the config path and the effective values (edit the file in an editor)
@@ -80,7 +80,8 @@ async function main(): Promise<number> {
   jsonMode = argv.includes(JSON_FLAG);
   const json = jsonMode;
   const cached = argv.includes(CACHED_FLAG);
-  const args = argv.filter((a) => a !== JSON_FLAG && a !== CACHED_FLAG);
+  const provider = argv.includes(CODEX_FLAG) ? codex : claude;
+  const args = argv.filter((a) => a !== JSON_FLAG && a !== CACHED_FLAG && a !== CODEX_FLAG);
   const sub = args[0];
 
   if (cached && sub != null && sub !== "status") {
@@ -88,6 +89,11 @@ async function main(): Promise<number> {
     return 2;
   }
 
+  if (provider === codex && (sub == null || !CODEX_COMMANDS.has(sub))) {
+    emitError({ json, message: `${CODEX_FLAG} applies to ${[...CODEX_COMMANDS].join(", ")}, not ${sub ?? "status"}` });
+    return 2;
+  }
+
   if (json && sub != null && !JSON_COMMANDS.has(sub)) {
     emitError({ json, message: `${sub} has no ${JSON_FLAG} form (${JSON_FLAG} applies to ${[...JSON_COMMANDS].join(", ")})` });
     return 2;
@@ -120,10 +126,7 @@ async function main(): Promise<number> {
       }
       return cmdStatus({ json, cached });
     }
-    case "switch": {
-      const rest = args.slice(1).filter((a) => a !== "--codex");
-      return args.includes("--codex") ? cmdCodexSwitch(rest[0], json) : cmdSwitch(rest[0], json);
-    }
+    case "switch": return cmdSwitch(provider, args[1], json);
     case "check": {
       if (args.length > 1) {
         emitError({ json, message: `unknown check option: ${args[1]} (check takes no options; the timer runs a plain check every tick)` });
@@ -132,15 +135,12 @@ async function main(): Promise<number> {
       return cmdCheck(json);
     }
     case "config": return cmdConfig(args.slice(1), json);
-    case "init": return args.includes("--codex") ? cmdCodexInit() : cmdInit();
-    case "add": return args.includes("--codex") ? cmdCodexAdd() : cmdAdd();
-    case "auth": return cmdAuth(args.slice(1));
+    case "init": return cmdInit(provider);
+    case "add": return cmdAdd(provider);
+    case "auth": return cmdAuth(provider, args.slice(1));
     case "doctor": return cmdDoctor();
-    case "rm": {
-      const rest = args.slice(1).filter((a) => a !== "--codex");
-      return args.includes("--codex") ? cmdCodexRm(rest[0]) : cmdRm(rest[0]);
-    }
-    case "rename": return cmdRename(args.slice(1));
+    case "rm": return cmdRm(provider, args[1]);
+    case "rename": return cmdRename(provider, args.slice(1));
     case "setup-token": return cmdSetupToken(args.slice(1));
     case "cursor": {
       if (args[1] === "init") return cmdCursorInit(args.slice(2));