tokenmaxxing 1.38.0 → 1.40.0

package/src/lib/update.ts

@@ -0,0 +1,133 @@
+import { existsSync, lstatSync, readFileSync, realpathSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { z } from "zod";
+import { writeFileAtomic } from "./atomic.ts";
+import { http } from "./http.ts";
+import { isNixPackaged } from "./install.ts";
+import { withLock } from "./lock.ts";
+import { log } from "./log.ts";
+import { HOME, paths } from "./paths.ts";
+
+const UPDATE_INTERVAL_MS = 24 * 60 * 60 * 1000;
+const INSTALL_DEADLINE_MS = 60_000;
+const REGISTRY_DEADLINE_MS = 15_000;
+
+const OverrideSchema = z.string().min(1).optional().catch(undefined);
+const AttemptSchema = z.object({ attemptedAt: z.number() });
+const VersionSchema = z.object({ version: z.string().min(1) });
+const LatestSchema = z.object({ version: z.string().min(1), engines: z.looseObject({ bun: z.string().min(1).optional() }).optional() });
+
+const updateJson = join(paths.home, "update.json");
+const updateLock = join(paths.home, "update.lock");
+
+function registry(): { base: URL; authorization: string | null } {
+  const raw = OverrideSchema.parse(process.env.TOKENMAXXING_NPM_REGISTRY) ?? "https://registry.npmjs.org";
+  const base = new URL(raw.endsWith("/") ? raw : `${raw}/`);
+  const authorization =
+    base.username !== "" || base.password !== "" ? `Basic ${btoa(`${decodeURIComponent(base.username)}:${decodeURIComponent(base.password)}`)}` : null;
+  base.username = "";
+  base.password = "";
+  return { base, authorization };
+}
+
+function realOrNull(path: string): string | null {
+  try {
+    return realpathSync(path);
+  } catch {
+    return null;
+  }
+}
+
+function globalRootCandidates(): string[] {
+  const globalDir = OverrideSchema.parse(process.env.BUN_INSTALL_GLOBAL_DIR);
+  const bunInstall = OverrideSchema.parse(process.env.BUN_INSTALL);
+  return [
+    ...(globalDir != null ? [globalDir] : []),
+    ...(bunInstall != null ? [join(bunInstall, "install", "global")] : []),
+    join(dirname(dirname(process.execPath)), "install", "global"),
+    join(HOME, ".bun", "install", "global"),
+  ].map((candidate) => resolve(candidate));
+}
+
+function packageDir(root: string): string {
+  return join(root, "node_modules", "tokenmaxxing");
+}
+
+function registryPackageDir(root: string): string | null {
+  const dir = packageDir(root);
+  try {
+    return lstatSync(dir).isSymbolicLink() ? null : dir;
+  } catch {
+    return null;
+  }
+}
+
+function detectGlobalRoot(): string | null {
+  if (isNixPackaged()) return null;
+  const entry = realOrNull(Bun.main);
+  if (entry == null) return null;
+  return (
+    globalRootCandidates().find((root) => {
+      const dir = registryPackageDir(root);
+      return dir != null && entry === realOrNull(join(dir, "src", "main.ts"));
+    }) ?? null
+  );
+}
+
+function installedVersion(root: string): string {
+  return VersionSchema.parse(JSON.parse(readFileSync(join(packageDir(root), "package.json"), "utf8"))).version;
+}
+
+function isDue(now: number): boolean {
+  if (!existsSync(updateJson)) return true;
+  let json: unknown;
+  try {
+    json = JSON.parse(readFileSync(updateJson, "utf8"));
+  } catch {
+    throw new Error(`${updateJson} is corrupt (unparsable JSON) - repair or remove the file`);
+  }
+  return now - AttemptSchema.parse(json).attemptedAt >= UPDATE_INTERVAL_MS;
+}
+
+async function updateToLatest(root: string): Promise<void> {
+  const current = installedVersion(root);
+  const { base, authorization } = registry();
+  const latestUrl = new URL("tokenmaxxing/latest", base).href;
+  const signal = AbortSignal.timeout(REGISTRY_DEADLINE_MS);
+  const response = await http.get(latestUrl, { signal, headers: authorization ? { authorization } : undefined });
+  if (!response.ok) throw new Error(`${latestUrl} answered HTTP ${response.status}`);
+  const latest = LatestSchema.parse(await response.json());
+  if (Bun.semver.order(latest.version, current) <= 0) return;
+  const floor = latest.engines?.bun;
+  if (floor != null && !Bun.semver.satisfies(Bun.version, floor)) {
+    throw new Error(`tokenmaxxing@${latest.version} needs bun ${floor}, this is bun ${Bun.version}`);
+  }
+  const child = Bun.spawn([process.execPath, "add", "-g", "--registry", base.href, `tokenmaxxing@${latest.version}`], {
+    cwd: paths.home,
+    env: { ...process.env, BUN_INSTALL_GLOBAL_DIR: root },
+    stdout: "ignore",
+    stderr: "inherit",
+    timeout: INSTALL_DEADLINE_MS,
+    killSignal: "SIGKILL",
+  });
+  await child.exited;
+  if (child.exitCode !== 0) throw new Error(`bun add -g tokenmaxxing@${latest.version} exited ${child.signalCode ?? child.exitCode}`);
+  const installed = installedVersion(root);
+  if (installed !== latest.version) throw new Error(`bun add -g tokenmaxxing@${latest.version} left ${installed} installed`);
+  log("update.done", { from: current, to: latest.version });
+}
+
+export async function maybeAutoUpdate(): Promise<void> {
+  const root = detectGlobalRoot();
+  if (root == null) return;
+  await withLock(updateLock, async () => {
+    const now = Date.now();
+    if (!isDue(now)) return;
+    writeFileAtomic(updateJson, JSON.stringify({ attemptedAt: now }) + "\n");
+    try {
+      await updateToLatest(root);
+    } catch (e) {
+      throw new Error(`self-update from npm failed: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  });
+}

package/src/lib/usage.ts

@@ -331,14 +331,17 @@ export function scrubCredentialEnv(env: Record<string, string>): Record<string,
   return scrubbed;
 }
 
-function probeEnv(configDir?: string): Record<string, string> {
+export type ProbeTarget = { configDir: string; store?: string };
+
+function probeEnv(target: ProbeTarget): Record<string, string> {
   const env = scrubCredentialEnv({ ...process.env, TOKENMAXXING_PROBE: "1", [WRAP_DEPTH_ENV]: String(MAX_WRAP_DEPTH) });
-  if (configDir) env.CLAUDE_CONFIG_DIR = configDir;
+  env.CLAUDE_CONFIG_DIR = target.configDir;
+  if (target.store) env.CLAUDE_SECURESTORAGE_CONFIG_DIR = target.store;
   return env;
 }
 
-export async function probeUsage(configDir?: string, now = Date.now(), opts: { retries?: number } = {}): Promise<UsageWindows | null> {
-  const env = probeEnv(configDir);
+export async function probeUsage(target: ProbeTarget, now = Date.now(), opts: { retries?: number } = {}): Promise<UsageWindows | null> {
+  const env = probeEnv(target);
 
   for (let attempt = 0; ; attempt++) {
     const full = await probeUsageOnce(env, now);

package/src/main.ts

@@ -37,9 +37,8 @@ function printHelp(): void {
   console.log(`${c.bold("tokenmaxxing")} - automatic Claude Code account switching
 
   ${c.cyan("tokenmaxxing")}            show the pool with usage bars (alias of ${c.cyan("status")})
-  ${c.cyan("tokenmaxxing switch")} [sel]  switch to the best (or a specific) account; no-op when already on it
-  ${c.cyan("tokenmaxxing check")}      evaluate once, switch if over threshold (run by the periodic timer)
-  ${c.cyan("tokenmaxxing init")}       import the current account + install supervisor & hooks
+  ${c.cyan("tokenmaxxing check")}      sample the account whose usage figure is oldest (run by the periodic timer)
+  ${c.cyan("tokenmaxxing init")}       log in the first account (isolated) + install supervisor & hooks
   ${c.cyan("tokenmaxxing init --codex")}  same for codex: import login, install codex supervisor + Stop hook (trust it via /hooks)
   ${c.cyan("tokenmaxxing add")}        register an additional account (isolated login)
   ${c.cyan("tokenmaxxing add --codex")}   register an additional codex account (isolated login)
@@ -98,18 +97,6 @@ async function main(): Promise<number> {
     emitError({ json, message: `${sub} has no ${JSON_FLAG} form (${JSON_FLAG} applies to ${[...JSON_COMMANDS].join(", ")})` });
     return 2;
   }
-  if (!(sub != null && sub.startsWith("__")) && !process.env.TOKENMAXXING_PROBE) {
-    const nonEmpty = (v: string | undefined) => (v != null && v !== "" ? v : null);
-    const ambient = nonEmpty(process.env.CLAUDE_SECURESTORAGE_CONFIG_DIR) ?? nonEmpty(process.env.CLAUDE_CONFIG_DIR);
-    if (ambient != null) {
-      emitError({
-        json,
-        message: `CLAUDE_CONFIG_DIR / CLAUDE_SECURESTORAGE_CONFIG_DIR is set (${ambient}): claude uses a namespaced credential store there that tokenmaxxing does not manage - unset it (or run from a clean shell) and retry.`,
-      });
-      return 1;
-    }
-  }
-
   switch (sub) {
     case "__statusline": return runStatusline();
     case "__subagent-statusline": return runSubagentStatusline();
@@ -126,7 +113,13 @@ async function main(): Promise<number> {
       }
       return cmdStatus({ json, cached });
     }
-    case "switch": return cmdSwitch(provider, args[1], json);
+    case "switch": {
+      if (provider !== codex) {
+        emitError({ json, message: "Claude account placement is per session at launch; manual switching is available with `tokenmaxxing switch --codex`." });
+        return 2;
+      }
+      return cmdSwitch(args[1], json);
+    }
     case "check": {
       if (args.length > 1) {
         emitError({ json, message: `unknown check option: ${args[1]} (check takes no options; the timer runs a plain check every tick)` });
@@ -163,7 +156,7 @@ async function main(): Promise<number> {
       console.log(`removed ${removed.join(", ")}`);
       if (!out.timerDeactivated) console.log(c.yellow(`⚠ the check job may still be loaded - run: ${timerDeactivationHint()}`));
       if (!out.pathLineRemoved) console.log(c.dim("(no tokenmaxxing PATH line found in the shell rc)"));
-      console.log(`kept: accounts.json, config.json, and every parked credential (claude - macOS: keychain items, Linux: creds/; codex: codex-creds/) - remove accounts with \`xx rm\` to delete their credentials`);
+      console.log(`kept: accounts.json, config.json, and every account credential store (claude: stores/ and its keychain items on macOS; codex: codex-creds/) - remove accounts with \`xx rm\` to delete their credentials`);
       return 0;
     }
     case "help":

package/src/lib/claudejson.ts

@@ -1,30 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { z } from "zod";
-import { paths } from "./paths.ts";
-import { writeFileAtomic } from "./atomic.ts";
-import { OAuthAccountSchema, type OAuthAccount } from "./types.ts";
-
-const ClaudeJsonSchema = z.record(z.string(), z.unknown());
-
-function readClaudeJson(): Record<string, unknown> {
-  if (!existsSync(paths.claudeJson)) return {};
-  return ClaudeJsonSchema.parse(JSON.parse(readFileSync(paths.claudeJson, "utf8")));
-}
-
-export function readOAuthAccount(): OAuthAccount | null {
-  const parsed = OAuthAccountSchema.safeParse(readClaudeJson()["oauthAccount"]);
-  return parsed.success ? parsed.data : null;
-}
-
-export function isApiKeyMode(): boolean {
-  if (process.env.ANTHROPIC_API_KEY || process.env.ANTHROPIC_AUTH_TOKEN) return true;
-  const j = readClaudeJson();
-  if (z.string().min(1).safeParse(j["apiKeyHelper"]).success) return true;
-  return false;
-}
-
-export function swapOAuthAccount(next: OAuthAccount): void {
-  const j = readClaudeJson();
-  j["oauthAccount"] = next;
-  writeFileAtomic(paths.claudeJson, JSON.stringify(j, null, 2) + "\n", 0o600);
-}

package/src/lib/codexpresence.ts

@@ -1,64 +0,0 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { z } from "zod";
-import { codexPaths } from "./paths.ts";
-import { writeFileAtomic } from "./atomic.ts";
-import { pidExists, pidStartTime } from "./proc.ts";
-import { ErrnoSchema, JsonTextSchema } from "./types.ts";
-
-const PresenceSchema = z.object({
-  accountId: z.string(),
-  pid: z.number(),
-  startedAt: z.string(),
-});
-
-export function writeCodexPresence(input: { supervisorId: string; accountId: string; pid?: number }): void {
-  const pid = input.pid ?? process.pid;
-  const startedAt = pidStartTime(pid);
-  if (startedAt == null) throw new Error(`could not read pid ${pid}'s start time (ps lstart) - refusing to write an unverifiable presence file`);
-  mkdirSync(codexPaths.presenceDir, { recursive: true });
-  writeFileAtomic(
-    join(codexPaths.presenceDir, input.supervisorId),
-    JSON.stringify(PresenceSchema.parse({ accountId: input.accountId, pid, startedAt })),
-  );
-}
-
-export function clearCodexPresence(input: { supervisorId: string }): void {
-  rmSync(join(codexPaths.presenceDir, input.supervisorId), { force: true });
-}
-
-const LivingPresenceSchema = z.object({ supervisorId: z.string(), accountId: z.string() });
-export type LivingPresence = z.infer<typeof LivingPresenceSchema>;
-
-export function livingCodexPresences(): LivingPresence[] {
-  const living: LivingPresence[] = [];
-  if (!existsSync(codexPaths.presenceDir)) return living;
-  for (const name of readdirSync(codexPaths.presenceDir)) {
-    const file = join(codexPaths.presenceDir, name);
-    let raw: string;
-    try {
-      raw = readFileSync(file, "utf8");
-    } catch (e) {
-      if (ErrnoSchema.safeParse(e).data?.code === "ENOENT") continue;
-      throw e;
-    }
-    const parsed = PresenceSchema.safeParse(JsonTextSchema.safeParse(raw).data);
-    if (!parsed.success) {
-      throw new Error(`${file} is not a readable presence record - it may belong to a RUNNING codex session, refusing to treat it as absent; remove the file (or respawn that session) to proceed`);
-    }
-    const observed = pidStartTime(parsed.data.pid);
-    if (observed !== parsed.data.startedAt) {
-      if (observed == null && pidExists(parsed.data.pid)) {
-        throw new Error(`ps could not read the start time of live pid ${parsed.data.pid} (${file}) - refusing to clear a presence file that may guard a RUNNING codex session`);
-      }
-      rmSync(file, { force: true });
-      continue;
-    }
-    living.push(LivingPresenceSchema.parse({ supervisorId: name, accountId: parsed.data.accountId }));
-  }
-  return living;
-}
-
-export function presentCodexAccountIds(): Set<string> {
-  return new Set(livingCodexPresences().map((presence) => presence.accountId));
-}

package/src/lib/swap.ts

@@ -1,198 +0,0 @@
-import { clearDepletedWait, clearUsageSnapshots, loadAccounts, saveAccounts, saveLastSwapAt } from "./state.ts";
-import { readItem, writeItem, liveTarget, parkedTarget, claudeAiOauthOnly, mergeIntoLive } from "./credstore.ts";
-import { refreshCredential, isAccessTokenExpiring, isDeadCredential, fetchTokenIdentity, describeIdentity, IdentityUnavailableError, InvalidGrantError, RefreshRejectedError } from "./oauth.ts";
-import { swapOAuthAccount } from "./claudejson.ts";
-import { withClaudeRefreshLock } from "./claudelock.ts";
-import { claudePool, credItemFor } from "./paths.ts";
-import { log } from "./log.ts";
-import { CredentialBlobSchema, type Account, type OAuthCreds, type TokenIdentity } from "./types.ts";
-
-function parseBlob(raw: string) {
-  return CredentialBlobSchema.parse(JSON.parse(raw));
-}
-
-export async function performSwap(target: Account): Promise<void> {
-  const idx = loadAccounts(claudePool);
-  const oauthAccount = target.oauthAccount;
-  if (!oauthAccount) throw new Error(`${target.label} has no oauthAccount on its record - re-add it with \`tokenmaxxing auth ${target.label}\``);
-
-  const preLive = await readItem(liveTarget());
-  let liveOwner: Account | null = null;
-  let liveCreds: OAuthCreds | null = null;
-  let expectedLiveToken: string | null = null;
-  if (preLive) {
-    liveCreds = parseBlob(preLive).claudeAiOauth;
-    expectedLiveToken = liveCreds.accessToken;
-    if (isDeadCredential(liveCreds)) {
-      liveCreds = null;
-      log("swap.live_dead", {});
-    } else if (isAccessTokenExpiring(liveCreds, 60_000)) {
-      try {
-        await withClaudeRefreshLock(async (lock) => {
-          const raw2 = await readItem(liveTarget());
-          if (raw2 == null) throw new Error("live credential vanished while waiting for the refresh lock");
-          const current = parseBlob(raw2).claudeAiOauth;
-          const next = isAccessTokenExpiring(current, 60_000) ? await refreshCredential(current) : current;
-          liveCreds = next;
-          expectedLiveToken = next.accessToken;
-          if (next === current) return;
-          if (lock.compromised()) throw new Error("refresh lock compromised mid-refresh - discarding the live rewrite");
-          await writeItem(liveTarget(), mergeIntoLive(raw2, next));
-        });
-      } catch (e) {
-        if (!(e instanceof InvalidGrantError)) throw e;
-        liveCreds = null;
-        log("swap.harvest_skipped_dead_live", {});
-      }
-    }
-    if (liveCreds != null) {
-      let identity: TokenIdentity;
-      try {
-        identity = await fetchTokenIdentity(liveCreds.accessToken);
-      } catch (e) {
-        throw new Error(`cannot resolve the live credential's owner (${e instanceof Error ? e.message : String(e)}) - refusing to swap over it; the next check retries`);
-      }
-      liveOwner = idx.accounts.find((a) => a.id === identity.accountUuid) ?? null;
-      if (!liveOwner) {
-        throw new Error(
-          `live credential belongs to ${describeIdentity(identity)}, which is not in the pool - refusing to swap over it; import it first with \`tokenmaxxing add\``,
-        );
-      }
-      if (liveOwner.id !== idx.activeId) {
-        log("swap.harvest_drift", {
-          labeled: idx.activeId?.slice(0, 8) ?? null,
-          actual: liveOwner.id.slice(0, 8),
-        });
-      }
-    }
-  }
-
-  const selfSwap = liveOwner != null && liveOwner.id === target.id;
-  let fresh: OAuthCreds | null = null;
-  if (!selfSwap) {
-    const parkedRaw = await readItem(parkedTarget(credItemFor(target.id)));
-    if (!parkedRaw) throw new Error(`no parked credential for ${target.label}`);
-    const parked = parseBlob(parkedRaw).claudeAiOauth;
-    const markDead = (detail: string): InvalidGrantError => {
-      const t = idx.accounts.find((a) => a.id === target.id);
-      if (t) { t.needsReauth = true; saveAccounts(claudePool, idx); }
-      log("swap.invalid_grant", { account: target.id.slice(0, 8), detail });
-      return new InvalidGrantError(detail);
-    };
-    if (isDeadCredential(parked)) throw markDead("parked credential was cleared after a failed refresh - re-auth with `tokenmaxxing auth`");
-    let parkedOwner: TokenIdentity | null = null;
-    try {
-      parkedOwner = await fetchTokenIdentity(parked.accessToken);
-    } catch (e) {
-      if (!(e instanceof IdentityUnavailableError && e.status === 401)) throw e;
-      log("swap.parked_token_stale", { account: target.id.slice(0, 8) });
-    }
-    if (parkedOwner != null && parkedOwner.accountUuid !== target.id) {
-      const owner = idx.accounts.find((a) => a.id === parkedOwner.accountUuid) ?? null;
-      let kept = "was left in place";
-      if (owner != null && owner.id !== liveOwner?.id) {
-        await writeItem(parkedTarget(credItemFor(owner.id)), JSON.stringify({ claudeAiOauth: parked }));
-        log("swap.parked_relocated", { account: owner.id.slice(0, 8) });
-        kept = "was copied to that account's slot";
-      }
-      throw markDead(`parked credential belongs to ${describeIdentity(parkedOwner)} - refusing to spend another account's grant; the pair ${kept}; re-auth with \`tokenmaxxing auth ${target.label}\``);
-    }
-    const refreshParked = async (): Promise<OAuthCreds> => {
-      try {
-        return await refreshCredential(parked);
-      } catch (e) {
-        if (e instanceof InvalidGrantError) throw markDead(e.detail);
-        if (e instanceof RefreshRejectedError) log("swap.refresh_rejected", { account: target.id.slice(0, 8), status: e.status, detail: e.detail });
-        throw e;
-      }
-    };
-    if (parkedOwner != null) {
-      fresh = await refreshParked();
-    } else {
-      fresh = await withClaudeRefreshLock(async (lock) => {
-        const rotated = await refreshParked();
-        let freshOwner: TokenIdentity;
-        try {
-          freshOwner = await fetchTokenIdentity(rotated.accessToken);
-        } catch (e) {
-          await writeItem(parkedTarget(credItemFor(target.id)), JSON.stringify({ claudeAiOauth: rotated }));
-          throw new Error(`refreshed the parked credential but cannot verify its owner (${e instanceof Error ? e.message : String(e)}) - kept the rotated token parked; the next check retries`);
-        }
-        if (freshOwner.accountUuid !== target.id) {
-          const owner = idx.accounts.find((a) => a.id === freshOwner.accountUuid) ?? null;
-          const kept = await keepRotatedPair({ fresh: rotated, owner, fallback: target, liveOwnerId: liveOwner?.id ?? null, expectedLiveToken, lock });
-          throw markDead(`parked credential belongs to ${describeIdentity(freshOwner)}, whose grant this refresh rotated - the rotated token ${kept}; re-auth with \`tokenmaxxing auth ${target.label}\``);
-        }
-        return rotated;
-      });
-    }
-    await writeItem(parkedTarget(credItemFor(target.id)), JSON.stringify({ claudeAiOauth: fresh }));
-  }
-
-  await withClaudeRefreshLock(async (lock) => {
-    const currentLive = await readItem(liveTarget());
-    if (lock.compromised()) throw new Error("refresh lock compromised - aborting the swap before any write");
-
-    const currentToken = currentLive == null ? null : parseBlob(currentLive).claudeAiOauth.accessToken;
-    if (currentToken !== expectedLiveToken) {
-      throw new Error("live credential changed while unlocked (concurrent /login or refresh) - aborting this swap; the next check re-resolves the owner and retries");
-    }
-
-    if (liveOwner && currentLive) {
-      await writeItem(parkedTarget(credItemFor(liveOwner.id)), claudeAiOauthOnly(currentLive));
-      log("swap.harvest", { account: liveOwner.id.slice(0, 8) });
-    }
-
-    if (fresh != null) {
-      await writeItem(liveTarget(), mergeIntoLive(currentLive, fresh));
-    }
-    swapOAuthAccount(oauthAccount);
-    idx.activeId = target.id;
-    const t2 = idx.accounts.find((a) => a.id === target.id);
-    if (t2) { t2.needsReauth = false; }
-    saveAccounts(claudePool, idx);
-    clearUsageSnapshots();
-    clearDepletedWait();
-    saveLastSwapAt(claudePool, Date.now());
-  });
-  log("swap.done", { account: target.id.slice(0, 8), label: target.label });
-}
-
-export async function keepRotatedPair(input: {
-  fresh: OAuthCreds;
-  owner: Account | null;
-  fallback: Account;
-  liveOwnerId: string | null;
-  expectedLiveToken: string | null;
-  lock: { compromised: () => boolean };
-}): Promise<string> {
-  const { fresh, owner } = input;
-  if (owner == null) {
-    await writeItem(parkedTarget(credItemFor(input.fallback.id)), JSON.stringify({ claudeAiOauth: fresh }));
-    log("swap.rotated_kept_in_stamped_slot", { account: input.fallback.id.slice(0, 8) });
-    return "was kept in this account's stamped slot because its owner is not in the pool";
-  }
-  const park = async (): Promise<void> => {
-    await writeItem(parkedTarget(credItemFor(owner.id)), JSON.stringify({ claudeAiOauth: fresh }));
-    log("swap.rotated_parked_rescued", { account: owner.id.slice(0, 8) });
-  };
-  if (input.liveOwnerId !== owner.id) {
-    await park();
-    return "was parked under that account";
-  }
-  try {
-    const currentLive = await readItem(liveTarget());
-    if (input.lock.compromised()) throw new Error("refresh lock compromised");
-    if (currentLive == null || parseBlob(currentLive).claudeAiOauth.accessToken !== input.expectedLiveToken) throw new Error("live credential changed while unlocked");
-    await writeItem(liveTarget(), mergeIntoLive(currentLive, fresh));
-    log("swap.rotated_live_rescued", { account: owner.id.slice(0, 8) });
-    return "was installed into the live store so that account's sessions continue";
-  } catch (e) {
-    await park();
-    return `was parked under that account (${e instanceof Error ? e.message : String(e)})`;
-  }
-}
-
-export function isSkippableSwapError(e: unknown): boolean {
-  return e instanceof InvalidGrantError || e instanceof RefreshRejectedError || e instanceof IdentityUnavailableError;
-}