tokenmaxxing 1.39.0 → 1.41.0

package/src/entries/supervisor.ts

@@ -1,12 +1,17 @@
 import { existsSync, mkdirSync, readFileSync, rmSync, readdirSync, statSync } from "node:fs";
 import { basename, join } from "node:path";
+import type { Subprocess } from "bun";
 import { maxBy } from "es-toolkit";
 import { z } from "zod";
-import { paths } from "../lib/paths.ts";
+import { claudePool, paths, storeDirFor } from "../lib/paths.ts";
 import { LOOP_DIAGNOSIS, MAX_WRAP_DEPTH, UNMANAGED_ENV, WRAP_DEPTH_ENV, WRAP_RATE_MAX, WRAP_RATE_WINDOW_MS, resolveRealClaude, wrapDepth, wrapperEntryRateTripped } from "../lib/claudebin.ts";
+import { pickSeat } from "../lib/claude.ts";
+import { withLock } from "../lib/lock.ts";
+import { clearPresence, writePresence } from "../lib/presence.ts";
 import { saveTermios, restoreTermios } from "../lib/tty.ts";
 import { loadSessionFlags, pruneStaleSessions, saveSessionFlags } from "../lib/sessions.ts";
-import { RespawnMarkerSchema } from "../lib/types.ts";
+import { loadAccounts } from "../lib/state.ts";
+import { RespawnMarkerSchema, type Account } from "../lib/types.ts";
 import { log } from "../lib/log.ts";
 
 const NONINTERACTIVE_SUBCMDS = new Set([
@@ -187,6 +192,25 @@ async function countdownWait(acct: string, until: number): Promise<boolean> {
   return aborted;
 }
 
+async function recordPresence(child: Subprocess, sid: string, seat: Account, savedTermios: string | null): Promise<void> {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      writePresence({ dir: paths.presenceDir, id: sid, accountId: seat.id, pid: child.pid });
+      return;
+    } catch (e) {
+      if (child.exitCode !== null || child.signalCode !== null) return;
+      if (attempt >= 9) {
+        log("supervisor.presence_failed", { err: e instanceof Error ? e.message : String(e) });
+        child.kill();
+        await child.exited;
+        restoreTermios(savedTermios);
+        throw new Error("could not write the session presence file - refusing to run a session whose seat placement cannot see");
+      }
+      await Bun.sleep(100);
+    }
+  }
+}
+
 export async function runSupervisor(argv: string[]): Promise<number> {
   const depth = wrapDepth();
   if (depth >= MAX_WRAP_DEPTH) {
@@ -250,16 +274,28 @@ export async function runSupervisor(argv: string[]): Promise<number> {
 
   let respawns = 0;
   let overriddenUntil = 0;
+  let wanted: string | null = null;
   while (true) {
     if (existsSync(marker)) rmSync(marker, { force: true });
-    log("supervisor.launch", { sid, respawns, args: launchArgs.join(" ") });
 
     const gate: MarkerGate = { launchedAt: Date.now(), overriddenUntil };
-    const child = Bun.spawn([real, ...launchArgs], {
-      stdin: "inherit",
-      stdout: "inherit",
-      stderr: "inherit",
-      env: { ...childEnv, TOKENMAXXING_SUPERVISED: "1", TOKENMAXXING_SESSION_ID: sid, TOKENMAXXING_LAUNCHED_AT: String(gate.launchedAt) },
+    const child = await withLock(claudePool.lockFile, async () => {
+      const seat = (wanted == null ? null : (loadAccounts(claudePool).accounts.find((a) => a.id === wanted) ?? null)) ?? pickSeat(gate.launchedAt);
+      log("supervisor.launch", { sid, respawns, seat: seat?.id.slice(0, 8) ?? null, args: launchArgs.join(" ") });
+      const spawned = Bun.spawn([real, ...launchArgs], {
+        stdin: "inherit",
+        stdout: "inherit",
+        stderr: "inherit",
+        env: {
+          ...childEnv,
+          TOKENMAXXING_SUPERVISED: "1",
+          TOKENMAXXING_SESSION_ID: sid,
+          TOKENMAXXING_LAUNCHED_AT: String(gate.launchedAt),
+          ...(seat ? { CLAUDE_SECURESTORAGE_CONFIG_DIR: storeDirFor(seat.id) } : {}),
+        },
+      });
+      if (seat) await recordPresence(spawned, sid, seat, savedTermios);
+      return spawned;
     });
 
     let done = false;
@@ -276,6 +312,7 @@ export async function runSupervisor(argv: string[]): Promise<number> {
       if (winner === "marker") child.kill();
     } catch (e) {
       child.kill();
+      clearPresence({ dir: paths.presenceDir, id: sid });
       throw e;
     } finally {
       await child.exited;
@@ -288,13 +325,16 @@ export async function runSupervisor(argv: string[]): Promise<number> {
     if (m) {
       rmSync(marker, { force: true });
       respawns++;
+      const label = loadAccounts(claudePool).accounts.find((a) => a.id === m.accountId)?.label ?? m.accountId.slice(0, 8);
       if (m.waitUntil > Date.now()) {
-        if (await countdownWait(m.account, m.waitUntil)) overriddenUntil = m.waitUntil;
-      } else process.stdout.write(`\n\x1b[36m↻ tokenmaxxing: switched to ${m.account} - resuming...\x1b[0m\n`);
+        if (await countdownWait(label, m.waitUntil)) overriddenUntil = m.waitUntil;
+      } else process.stdout.write(`\n\x1b[36m↻ tokenmaxxing: moving to ${label} - resuming...\x1b[0m\n`);
+      wanted = m.accountId;
       saveSessionFlags(m.sessionId, persistable, process.cwd());
       launchArgs = ["--resume", m.sessionId, ...persistable];
       continue;
     }
+    clearPresence({ dir: paths.presenceDir, id: sid });
     log("supervisor.exit", { sid, respawns, code: child.exitCode, signal: child.signalCode });
     return child.exitCode ?? (child.signalCode ? 1 : 0);
   }

package/src/lib/claude.ts

@@ -1,126 +1,139 @@
 import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
-import { readItem, writeItem, deleteItem, liveTarget, parkedTarget, isolatedTarget, claudeAiOauthOnly, mergeIntoLive } from "./credstore.ts";
+import { readItem, writeItem, deleteItem, isolatedTarget, readStore, storeTarget, claudeAiOauthOnly } from "./credstore.ts";
 import { resolveRealClaude, resolveVerifiedClaude } from "./claudebin.ts";
 import { withClaudeRefreshLock } from "./claudelock.ts";
-import { isApiKeyMode, readOAuthAccount } from "./claudejson.ts";
 import { ensurePathInRc, installSupervisor, managedShellRcSkipLines, shellRcPath, timerActivationHint } from "./install.ts";
 import { withLock } from "./lock.ts";
 import { log } from "./log.ts";
-import { claudeTierLabel, describeIdentity, fetchTokenIdentity, isAccessTokenExpiring, isDeadCredential, refreshCredential, InvalidGrantError } from "./oauth.ts";
-import { claudePool, credItemFor, paths } from "./paths.ts";
+import { claudeTierLabel, describeIdentity, fetchTokenIdentity, isDeadCredential, InvalidGrantError } from "./oauth.ts";
+import { claudePool, paths, sampleDirFor, seatFromEnv, storeDirFor } from "./paths.ts";
+import { pickBest, pickEarliestReset, thresholdBars, type PickCtx } from "./picker.ts";
+import { seatCounts } from "./presence.ts";
 import type { Observation, Provider, SampleReport } from "./provider.ts";
-import { ensureLiveTokenFresh, probeActiveUsage, probeParkedUsage } from "./sample.ts";
-import { loadAccounts, loadUsage, loadUsageSnapshot, pinBinOverride, saveAccounts, writeUsage, type Harvest } from "./state.ts";
-import { isSkippableSwapError, performSwap } from "./swap.ts";
+import { foldTee, probeAccountUsage, teeObservation } from "./sample.ts";
+import { clearUsageSnapshot, loadAccounts, loadConfig, loadUsageSnapshot, pinBinOverride, saveAccounts, type Harvest } from "./state.ts";
 import { loadSetupTokens, saveSetupTokens } from "./setuptokens.ts";
 import { saveTermios, restoreTermios } from "./tty.ts";
-import { CRED_ENV_OVERRIDES, familyTokens, gatedFamilies, mergeWindows, probeUsage, windowsOf } from "./usage.ts";
-import { CredentialBlobSchema, OAuthAccountSchema, type Account, type Config, type UsageState } from "./types.ts";
+import { CRED_ENV_OVERRIDES, gatedFamilies, mergeWindows, probeUsage, windowsOf } from "./usage.ts";
+import { CredentialBlobSchema, OAuthAccountSchema, type Account, type Config } from "./types.ts";
 import { c } from "../cli/render.ts";
 
-function teeObservation(account: Account, snap: { state: UsageState; at: number } | null): Observation | null {
-  if (!snap || snap.state.account !== account.id) return null;
-  if (account.lastUsageAt != null && snap.at < account.lastUsageAt) return { windows: account.windows, at: account.lastUsageAt };
-  const at = snap.state.sampledAt ?? snap.at;
-  const aggregate = windowsOf({ fiveHour: snap.state.fiveHour, sevenDay: snap.state.sevenDay, perModel: {} }, at);
-  return { windows: mergeWindows(aggregate, account.windows), at };
+class StoreUnusableError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "StoreUnusableError";
+  }
+}
+
+function liveId(): string | null {
+  return seatFromEnv(loadAccounts(claudePool).accounts.map((a) => a.id));
+}
+
+function presence(): Map<string, number> {
+  return seatCounts(paths.presenceDir);
 }
 
 async function observeLive(account: Account, cfg: Config, now: number, opts: { probe: boolean }): Promise<Observation | null> {
-  let snap = loadUsageSnapshot();
   const ttl = cfg.policy.usagePollTtlMs;
   const probeAttempted = account.lastProbeAt != null && now - account.lastProbeAt <= ttl;
-  const fresh = snap != null && snap.state.account === account.id && now - snap.at <= ttl;
+  const snap = loadUsageSnapshot(account.id);
+  const fresh = snap != null && now - snap.at <= ttl;
   const needsPerModel = snap != null && gatedFamilies(snap.state.model, cfg.policy.switchModels).length > 0;
   if (opts.probe && !probeAttempted && (!fresh || needsPerModel)) {
     const startedAt = Date.now();
-    const full = await probeUsage();
-    const ts = Date.now();
-    if (readOAuthAccount()?.accountUuid === account.id) {
-      if (full) {
-        const teed = loadUsageSnapshot();
-        if (teed && teed.state.account === account.id && ts - teed.at <= ttl) {
-          snap = teed;
-        } else {
-          const state: UsageState = { fiveHour: full.fiveHour, sevenDay: full.sevenDay, account: account.id, ts, model: null };
-          writeUsage(state);
-          snap = { state, at: ts };
-        }
-        const expected = gatedFamilies(snap.state.model, cfg.policy.switchModels);
-        const rows = Object.keys(full.perModel);
-        if (expected.length > 0 && !expected.some((f) => rows.some((k) => familyTokens(k).includes(f)))) {
-          log("usage.no_permodel_row", { families: expected.join(","), rows: rows.join(",") });
-        }
+    const outcome = await probeAccountUsage(account);
+    await withLock(claudePool.lockFile, () => {
+      const idx = loadAccounts(claudePool);
+      const a = idx.accounts.find((x) => x.id === account.id);
+      if (!a) return;
+      a.lastProbeAt = startedAt;
+      a.tier = account.tier;
+      if (account.needsReauth) a.needsReauth = true;
+      if (outcome.ok && (a.lastUsageAt == null || startedAt > a.lastUsageAt)) {
+        a.windows = mergeWindows(windowsOf(outcome.usage, startedAt), a.windows);
+        a.lastUsageAt = startedAt;
       }
-      await withLock(claudePool.lockFile, () => {
-        const idx = loadAccounts(claudePool);
-        const a = idx.accounts.find((x) => x.id === account.id);
-        if (!a) return;
-        a.lastProbeAt = startedAt;
-        if (full) {
-          const probed = windowsOf(full, startedAt);
-          const aggregate = a.windows.some((w) => w.name == null) ? a.windows.filter((w) => w.name == null) : probed.filter((w) => w.name == null);
-          if (a.lastUsageAt == null) a.lastUsageAt = startedAt;
-          a.windows = mergeWindows([...aggregate, ...probed.filter((w) => w.name != null)], a.windows);
-        }
-        saveAccounts(claudePool, idx);
-      });
-    }
+      saveAccounts(claudePool, idx);
+    });
   }
   const current = loadAccounts(claudePool).accounts.find((a) => a.id === account.id) ?? account;
-  return teeObservation(current, snap);
+  return teeObservation(current);
 }
 
-async function samplePool(accounts: Account[], liveId: string | null): Promise<Map<string, SampleReport>> {
+async function samplePool(accounts: Account[]): Promise<Map<string, SampleReport>> {
   const reports = new Map<string, SampleReport>();
-  const tee = loadUsageSnapshot();
-  const probeOne = async (a: Account): Promise<void> => {
-    const isActive = liveId != null && liveId === a.id;
-    const teeCurrent = tee != null && (a.lastUsageAt == null || tee.at >= a.lastUsageAt);
-    if (isActive && tee && teeCurrent && tee.state.account === a.id) {
-      const at = tee.state.sampledAt ?? tee.at;
+  await Promise.all(
+    accounts.map(async (a) => {
+      const tee = loadUsageSnapshot(a.id);
+      const teeAt = tee == null ? null : (tee.state.sampledAt ?? tee.state.ts);
+      if (teeAt != null && (a.lastUsageAt == null || teeAt >= a.lastUsageAt)) {
+        foldTee(a);
+        reports.set(a.id, { ok: true, source: "statusline" });
+        return;
+      }
+      const outcome = await probeAccountUsage(a);
+      if (!outcome.ok) {
+        reports.set(a.id, { ok: false, reason: outcome.reason });
+        return;
+      }
+      const at = Date.now();
       a.lastUsageAt = at;
-      a.windows = mergeWindows(windowsOf({ fiveHour: tee.state.fiveHour, sevenDay: tee.state.sevenDay, perModel: {} }, at), a.windows);
-      reports.set(a.id, { ok: true, source: "statusline" });
-      return;
-    }
-    const outcome = isActive ? await probeActiveUsage(a) : await probeParkedUsage(a);
-    if (!outcome.ok) {
-      reports.set(a.id, { ok: false, reason: outcome.reason });
-      return;
+      a.windows = mergeWindows(windowsOf(outcome.usage, at), a.windows);
+      reports.set(a.id, { ok: true, source: "probe" });
+    }),
+  );
+  return reports;
+}
+
+async function prepareMove(target: Account): Promise<void> {
+  let creds;
+  try {
+    creds = await readStore(target.id);
+  } catch (e) {
+    throw new StoreUnusableError(`${target.label}'s store is unreadable (${e instanceof Error ? e.message : String(e)}) - re-auth with \`tokenmaxxing auth ${target.label}\``);
+  }
+  if (!creds) throw new StoreUnusableError(`${target.label} has no credential in its store - re-auth with \`tokenmaxxing auth ${target.label}\``);
+  if (isDeadCredential(creds)) {
+    const idx = loadAccounts(claudePool);
+    const t = idx.accounts.find((a) => a.id === target.id);
+    if (t) {
+      t.needsReauth = true;
+      saveAccounts(claudePool, idx);
     }
-    const at = Date.now();
-    a.lastUsageAt = at;
-    a.windows = mergeWindows(windowsOf(outcome.usage, at), a.windows);
-    reports.set(a.id, { ok: true, source: "probe" });
-  };
-  const active = accounts.find((a) => liveId != null && liveId === a.id) ?? null;
-  if (active) await probeOne(active);
+    log("move.invalid_grant", { account: target.id.slice(0, 8) });
+    throw new InvalidGrantError(`${target.label}'s store was cleared after a failed refresh - re-auth with \`tokenmaxxing auth ${target.label}\``);
+  }
+  log("move.prepared", { account: target.id.slice(0, 8), label: target.label });
+}
+
+async function storeUsable(a: Account): Promise<boolean> {
   try {
-    await ensureLiveTokenFresh();
+    const creds = await readStore(a.id);
+    return creds != null && !isDeadCredential(creds);
   } catch {
+    return false;
   }
-  await Promise.all(accounts.filter((a) => a !== active).map(probeOne));
-  return reports;
 }
 
-async function liveOwner(): Promise<string | null> {
-  const live = await readItem(liveTarget());
-  if (live == null) return null;
-  const creds = CredentialBlobSchema.parse(JSON.parse(live)).claudeAiOauth;
-  return (await fetchTokenIdentity(creds.accessToken)).accountUuid;
+export function pickSeat(now: number): Account | null {
+  const cfg = loadConfig();
+  const idx = loadAccounts(claudePool);
+  let dirty = false;
+  for (const a of idx.accounts) dirty = foldTee(a) || dirty;
+  if (dirty) saveAccounts(claudePool, idx);
+  const ctx: PickCtx = { now, thresholds: thresholdBars(cfg), currentId: null, families: cfg.policy.switchModels, seats: presence() };
+  return pickBest(idx.accounts, ctx) ?? pickEarliestReset(idx.accounts, ctx)?.account ?? null;
 }
 
 async function removeCredentials(a: Account): Promise<void> {
+  await deleteItem(storeTarget(a.id));
+  rmSync(storeDirFor(a.id), { recursive: true, force: true });
+  rmSync(`${storeDirFor(a.id)}.lock`, { recursive: true, force: true });
+  for (const dir of [sampleDirFor(a.id), sampleDirFor(a.id, "-tick")]) rmSync(dir, { recursive: true, force: true });
+  clearUsageSnapshot(a.id);
   const setupTokens = loadSetupTokens();
-  const item = credItemFor(a.id);
-  await deleteItem(parkedTarget(item));
-  for (const sampleDir of [join(paths.sampleDir, item), join(paths.sampleDir, `${item}-tick`)]) {
-    await deleteItem(isolatedTarget(sampleDir));
-    rmSync(sampleDir, { recursive: true, force: true });
-  }
   if (setupTokens.tokens.some((t) => t.accountUuid === a.id)) {
     saveSetupTokens({ ...setupTokens, tokens: setupTokens.tokens.filter((t) => t.accountUuid !== a.id) });
   }
@@ -169,7 +182,7 @@ async function login(): Promise<Harvest | null> {
     await onExit;
     restoreTermios(savedTermios);
 
-    const blobRaw = await readItem(iso);
+    const blobRaw = await withClaudeRefreshLock(onboardDir, () => readItem(iso));
     if (!blobRaw || !identityReady(cjPath)) {
       console.error(c.red("no login detected in the isolated session - nothing changed."));
       return null;
@@ -183,9 +196,20 @@ async function login(): Promise<Harvest | null> {
       console.error(c.red("could not parse the onboarded account's credential/identity."));
       return null;
     }
+    let identity;
+    try {
+      identity = await fetchTokenIdentity(blob.claudeAiOauth.accessToken);
+    } catch (e) {
+      console.error(c.red(`could not verify which account the login belongs to (${e instanceof Error ? e.message : String(e)}) - nothing changed.`));
+      return null;
+    }
+    if (identity.accountUuid !== oauthAccount.accountUuid) {
+      console.error(c.red(`the login's credential belongs to ${describeIdentity(identity)}, but its identity file names ${oauthAccount.emailAddress} - nothing changed.`));
+      return null;
+    }
 
     console.log(c.dim("sampling usage..."));
-    const sampled = await probeUsage(onboardDir);
+    const sampled = await probeUsage({ configDir: onboardDir });
     if (!sampled) console.log(c.yellow("could not sample usage now - it will fill in on first use."));
     const at = Date.now();
     const id = oauthAccount.accountUuid;
@@ -195,7 +219,7 @@ async function login(): Promise<Harvest | null> {
       tier: claudeTierLabel(blob.claudeAiOauth),
       oauthAccount,
       sample: sampled ? { windows: windowsOf(sampled, at), at } : null,
-      park: () => writeItem(parkedTarget(credItemFor(id)), claudeAiOauthOnly(blobRaw)),
+      park: () => writeItem(storeTarget(id), claudeAiOauthOnly(blobRaw)),
     };
   } finally {
     if (p.exitCode === null) {
@@ -208,63 +232,13 @@ async function login(): Promise<Harvest | null> {
   }
 }
 
-async function importLive(): Promise<Harvest | null> {
-  if (isApiKeyMode()) {
-    console.error(c.yellow("tokenmaxxing pools subscription accounts, but you're authed via API key / apiKeyHelper."));
-    console.error(`Run ${c.cyan("claude")} → ${c.cyan("/login")} with a Pro/Max account first, then re-run ${c.cyan("tokenmaxxing init")}.`);
-    return null;
-  }
+const loginStep = (who: string) => `In the session that opens, run  ${c.bold("/login")}  with ${who}. It closes itself once you're in.`;
 
-  const oauthAccount = readOAuthAccount();
-  const liveRaw = await readItem(liveTarget());
-  if (!oauthAccount || !liveRaw) {
-    console.error(c.red("no active Claude subscription login found (missing oauthAccount or credential)."));
-    console.error(`Run ${c.cyan("claude")} → ${c.cyan("/login")} first, then re-run ${c.cyan("tokenmaxxing init")}.`);
-    return null;
-  }
-
-  let blob;
-  try {
-    blob = CredentialBlobSchema.parse(JSON.parse(liveRaw));
-  } catch {
-    console.error(c.red("the live credential is not a recognizable Claude OAuth blob."));
-    return null;
-  }
-
-  let creds = blob.claudeAiOauth;
-  if (isDeadCredential(creds)) {
-    console.error(c.red("the live credential was cleared after a failed refresh."));
-    console.error(`Run ${c.cyan("claude")} → ${c.cyan("/login")} first, then re-run ${c.cyan("tokenmaxxing init")}.`);
-    return null;
-  }
-  if (isAccessTokenExpiring(creds)) {
-    await withClaudeRefreshLock(async (lock) => {
-      const raw2 = await readItem(liveTarget());
-      if (raw2 == null) throw new Error("live credential vanished while waiting for the refresh lock");
-      const current = CredentialBlobSchema.parse(JSON.parse(raw2)).claudeAiOauth;
-      creds = isAccessTokenExpiring(current) ? await refreshCredential(current) : current;
-      if (creds === current) return;
-      if (lock.compromised()) throw new Error("refresh lock compromised mid-refresh - discarding the live rewrite");
-      await writeItem(liveTarget(), mergeIntoLive(raw2, creds));
-    });
-  }
-  const identity = await fetchTokenIdentity(creds.accessToken);
-  if (identity.accountUuid !== oauthAccount.accountUuid) {
-    console.error(c.red(`the live credential belongs to ${describeIdentity(identity)}, but ~/.claude.json identifies ${oauthAccount.emailAddress} - identity drift.`));
-    console.error(`Run ${c.cyan("claude")} → ${c.cyan("/login")} to realign them, then re-run ${c.cyan("tokenmaxxing init")}.`);
-    return null;
-  }
-
-  const id = oauthAccount.accountUuid;
-  const parked = JSON.stringify({ claudeAiOauth: creds });
-  return {
-    id,
-    email: oauthAccount.emailAddress,
-    tier: claudeTierLabel(creds),
-    oauthAccount,
-    sample: null,
-    park: () => writeItem(parkedTarget(credItemFor(id)), parked),
-  };
+async function importLive(): Promise<Harvest | null> {
+  console.log(c.cyan("Opening an isolated login for your first pooled account - the login you already have stays as it is for sessions started outside the supervisor."));
+  console.log(c.dim(loginStep("the first account to pool")));
+  console.log();
+  return login();
 }
 
 function ensurePathAhead(): void {
@@ -285,7 +259,7 @@ function ensurePathAhead(): void {
 
 function install(): void {
   const out = installSupervisor();
-  console.log(`${c.green("✓")} installed ${c.bold("claude")} supervisor + statusLine/Stop/SessionStart hooks`);
+  console.log(`${c.green("✓")} installed ${c.bold("claude")} supervisor + statusLine/Stop/StopFailure/SessionStart hooks`);
   if (out.timerLoaded) console.log(`${c.green("✓")} periodic check timer active (every ${out.checkIntervalS}s)`);
   else console.log(c.yellow(`⚠ check timer written but not activated - run: ${timerActivationHint()}`));
   if (!out.pathAhead) {
@@ -298,23 +272,25 @@ export const claude: Provider = {
   name: "claude",
   flag: "",
   pool: claudePool,
+  seats: "shared",
   waitsWhenDepleted: true,
-  switchMargin: 1,
-  switchNote: "",
-  liveId: () => readOAuthAccount()?.accountUuid ?? null,
-  liveOwner,
-  presentIds: () => new Set(),
-  gatedFamilies: (cfg) => gatedFamilies(loadUsage()?.model ?? null, cfg.policy.switchModels),
+  liveId,
+  presence,
+  gatedFamilies: (cfg) => {
+    const seat = liveId();
+    return gatedFamilies(seat == null ? null : (loadUsageSnapshot(seat)?.state.model ?? null), cfg.policy.switchModels);
+  },
   observeLive,
   samplePool,
   mergeWindows,
-  swap: performSwap,
-  classifySwapError: (e) => (e instanceof InvalidGrantError ? "dead-grant" : isSkippableSwapError(e) ? "skip" : "fatal"),
+  swap: prepareMove,
+  classifySwapError: (e) => (e instanceof InvalidGrantError ? "dead-grant" : e instanceof StoreUnusableError ? "skip" : "fatal"),
   removeCredentials,
+  storeUsable,
   login,
   importLive,
   preflight: () => pinBinOverride({ key: "claudeBin", bin: resolveVerifiedClaude() }),
   install,
-  loginStep: (who) => `In the session that opens, run  ${c.bold("/login")}  with ${who}. It closes itself once you're in.`,
+  loginStep,
   windowLabel: (name) => name.toLowerCase(),
 };

package/src/lib/claudelock.ts

@@ -1,7 +1,6 @@
 import { mkdirSync, realpathSync, rmdirSync, statSync, utimesSync } from "node:fs";
 import { join } from "node:path";
 import { delay } from "es-toolkit";
-import { credDir } from "./paths.ts";
 import { log } from "./log.ts";
 import { ErrnoSchema } from "./types.ts";
 
@@ -28,12 +27,12 @@ function tryAcquire(lockDir: string): boolean {
 }
 
 export async function withClaudeRefreshLock<T>(
+  dir: string,
   fn: (lock: { compromised: () => boolean }) => Promise<T> | T,
   opts: { attempts?: number; retryMs?: number; heartbeatMs?: number } = {},
 ): Promise<T> {
   const attempts = opts.attempts ?? ATTEMPTS;
   const retryMs = opts.retryMs ?? RETRY_MS;
-  const dir = credDir();
   mkdirSync(dir, { recursive: true });
   const primary = join(dir, ".oauth_refresh.lock");
   let legacyRoot = dir;
@@ -58,7 +57,7 @@ export async function withClaudeRefreshLock<T>(
     if (attempt >= attempts) {
       log("claudelock.contested", { attempts: attempt });
       throw new Error(
-        "claude's credential-refresh lock is contested (a token refresh is likely mid-flight) - not touching the live credential store; retry shortly",
+        "claude's credential-refresh lock is contested (a token refresh is likely mid-flight) - not touching the credential store; retry shortly",
       );
     }
     await delay(retryMs + Math.random() * retryMs);

package/src/lib/codex.ts

@@ -5,7 +5,7 @@ import { MAX_WRAP_DEPTH, WRAP_DEPTH_ENV } from "./claudebin.ts";
 import { codexIdentityOf, deleteParkedCodexAuth, isCodexAccessExpiring, liveCodexAccountId, readCodexAuthAt, readLiveCodexAuth, readParkedCodexAuth, writeLiveCodexAuth, writeParkedCodexAuth } from "./codexauth.ts";
 import { resolveRealCodex, verifyRealCodex } from "./codexbin.ts";
 import { CodexInvalidGrantError, CodexRefreshFailedError, refreshCodexAuth } from "./codexoauth.ts";
-import { livingCodexPresences, presentCodexAccountIds } from "./codexpresence.ts";
+import { livingPresences, seatCounts } from "./presence.ts";
 import { CodexUsageReadError, codexLimitLabel, fetchCodexUsage } from "./codexusage.ts";
 import { codexSupervisorLink, ensurePathInRc, installCodexSupervisor, managedShellRcSkipLines, shellRcPath } from "./install.ts";
 import { withLock } from "./lock.ts";
@@ -33,7 +33,7 @@ async function sampleLiveOntoOwner(now: number): Promise<void> {
   const owner = idx.accounts.find((a) => a.id === identity.accountId);
   if (!owner) return;
 
-  if (isCodexAccessExpiring({ auth: live, now }) && !presentCodexAccountIds().has(identity.accountId)) {
+  if (isCodexAccessExpiring({ auth: live, now }) && !seatCounts(codexPaths.presenceDir).has(identity.accountId)) {
     try {
       live = await refreshCodexAuth({ auth: live, now });
     } catch (e) {
@@ -69,7 +69,7 @@ async function sampleAccount(account: Account, liveId: string | null, now: numbe
     let auth = isLive ? readLiveCodexAuth() : readParkedCodexAuth({ credFile });
     if (!auth) return { ok: false, reason: isLive ? "live auth.json vanished" : "no parked credential", deadGrant: false };
     if (isCodexAccessExpiring({ auth, now })) {
-      const running = presentCodexAccountIds().has(account.id);
+      const running = seatCounts(codexPaths.presenceDir).has(account.id);
       if (running && !isLive) {
         return { ok: false, reason: "running in a live codex session (parked token refresh unsafe)", deadGrant: false };
       }
@@ -232,7 +232,7 @@ async function importLive(): Promise<Harvest | null> {
   const identity = codexIdentityOf({ auth: live });
   const usage = await sampleLogin(live);
 
-  if (presentCodexAccountIds().has(identity.accountId)) {
+  if (seatCounts(codexPaths.presenceDir).has(identity.accountId)) {
     console.error(c.red("a live supervised codex session is running this account - its token rotates under us, so parking a snapshot now could poison the backup."));
     console.error(c.dim("close that codex session (or let it exit) and re-run `tokenmaxxing init --codex`."));
     return null;
@@ -244,7 +244,7 @@ async function importLive(): Promise<Harvest | null> {
     tier: usage?.usage.planType ?? identity.planType,
     sample: usage ? { windows: usage.usage.windows, at: usage.at } : null,
     park: async () => {
-      if (presentCodexAccountIds().has(identity.accountId)) {
+      if (seatCounts(codexPaths.presenceDir).has(identity.accountId)) {
         throw new Error("a live supervised codex session started running this account mid-init - close it and re-run `tokenmaxxing init --codex`");
       }
       const fresh2 = readLiveCodexAuth();
@@ -292,7 +292,7 @@ function install(): void {
 }
 
 export function codexPickCtx(now: number, currentId: string | null): PickCtx {
-  return { now, thresholds: thresholdBars(loadConfig()), currentId, families: null };
+  return { now, thresholds: thresholdBars(loadConfig()), currentId, families: null, seats: null };
 }
 
 export function reconcileSiblings(now: number): void {
@@ -301,9 +301,9 @@ export function reconcileSiblings(now: number): void {
   const idx = loadAccounts(codexPool);
   const liveAccount = idx.accounts.find((a) => a.id === liveId);
   if (!liveAccount || liveAccount.needsReauth === true || isExhausted(liveAccount, codexPickCtx(now, liveId))) return;
-  const living = livingCodexPresences();
+  const living = livingPresences(codexPaths.presenceDir);
   if (existsSync(codexPaths.reconcileDir)) {
-    const alive = new Set(living.map((presence) => presence.supervisorId));
+    const alive = new Set(living.map((presence) => presence.id));
     for (const name of readdirSync(codexPaths.reconcileDir)) {
       if (!alive.has(name)) rmSync(join(codexPaths.reconcileDir, name), { force: true });
     }
@@ -311,11 +311,11 @@ export function reconcileSiblings(now: number): void {
   for (const presence of living) {
     if (presence.accountId === liveId) continue;
     if (!idx.accounts.some((a) => a.id === presence.accountId)) continue;
-    const markerPath = join(codexPaths.reconcileDir, presence.supervisorId);
+    const markerPath = join(codexPaths.reconcileDir, presence.id);
     if (existsSync(markerPath)) continue;
     mkdirSync(codexPaths.reconcileDir, { recursive: true });
     writeFileAtomic(markerPath, JSON.stringify(CodexReconcileMarkerSchema.parse({ accountId: presence.accountId, ts: now })));
-    log("codex.reconcile_signal", { supervisorId: presence.supervisorId.slice(0, 8), account: presence.accountId.slice(0, 8) });
+    log("codex.reconcile_signal", { supervisorId: presence.id.slice(0, 8), account: presence.accountId.slice(0, 8) });
   }
 }
 
@@ -323,12 +323,10 @@ export const codex: Provider = {
   name: "codex",
   flag: " --codex",
   pool: codexPool,
+  seats: "live",
   waitsWhenDepleted: false,
-  switchMargin: 1.2,
-  switchNote: " (takes effect on the next codex start)",
   liveId: liveCodexAccountId,
-  liveOwner: async () => liveCodexAccountId(),
-  presentIds: presentCodexAccountIds,
+  presence: () => seatCounts(codexPaths.presenceDir),
   gatedFamilies: () => null,
   observeLive,
   samplePool,
@@ -336,6 +334,13 @@ export const codex: Provider = {
   swap,
   classifySwapError: (e) => (e instanceof CodexInvalidGrantError ? "dead-grant" : "fatal"),
   removeCredentials: async (a) => deleteParkedCodexAuth({ credFile: codexCredItemFor(a.id) }),
+  storeUsable: async (a) => {
+    try {
+      return readParkedCodexAuth({ credFile: codexCredItemFor(a.id) }) != null;
+    } catch {
+      return false;
+    }
+  },
   login,
   importLive,
   preflight,