tokenmaxxing 1.39.0 → 1.41.0

package/src/lib/claudejson.ts

@@ -1,30 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { z } from "zod";
-import { paths } from "./paths.ts";
-import { writeFileAtomic } from "./atomic.ts";
-import { OAuthAccountSchema, type OAuthAccount } from "./types.ts";
-
-const ClaudeJsonSchema = z.record(z.string(), z.unknown());
-
-function readClaudeJson(): Record<string, unknown> {
-  if (!existsSync(paths.claudeJson)) return {};
-  return ClaudeJsonSchema.parse(JSON.parse(readFileSync(paths.claudeJson, "utf8")));
-}
-
-export function readOAuthAccount(): OAuthAccount | null {
-  const parsed = OAuthAccountSchema.safeParse(readClaudeJson()["oauthAccount"]);
-  return parsed.success ? parsed.data : null;
-}
-
-export function isApiKeyMode(): boolean {
-  if (process.env.ANTHROPIC_API_KEY || process.env.ANTHROPIC_AUTH_TOKEN) return true;
-  const j = readClaudeJson();
-  if (z.string().min(1).safeParse(j["apiKeyHelper"]).success) return true;
-  return false;
-}
-
-export function swapOAuthAccount(next: OAuthAccount): void {
-  const j = readClaudeJson();
-  j["oauthAccount"] = next;
-  writeFileAtomic(paths.claudeJson, JSON.stringify(j, null, 2) + "\n", 0o600);
-}

package/src/lib/codexpresence.ts

@@ -1,64 +0,0 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { z } from "zod";
-import { codexPaths } from "./paths.ts";
-import { writeFileAtomic } from "./atomic.ts";
-import { pidExists, pidStartTime } from "./proc.ts";
-import { ErrnoSchema, JsonTextSchema } from "./types.ts";
-
-const PresenceSchema = z.object({
-  accountId: z.string(),
-  pid: z.number(),
-  startedAt: z.string(),
-});
-
-export function writeCodexPresence(input: { supervisorId: string; accountId: string; pid?: number }): void {
-  const pid = input.pid ?? process.pid;
-  const startedAt = pidStartTime(pid);
-  if (startedAt == null) throw new Error(`could not read pid ${pid}'s start time (ps lstart) - refusing to write an unverifiable presence file`);
-  mkdirSync(codexPaths.presenceDir, { recursive: true });
-  writeFileAtomic(
-    join(codexPaths.presenceDir, input.supervisorId),
-    JSON.stringify(PresenceSchema.parse({ accountId: input.accountId, pid, startedAt })),
-  );
-}
-
-export function clearCodexPresence(input: { supervisorId: string }): void {
-  rmSync(join(codexPaths.presenceDir, input.supervisorId), { force: true });
-}
-
-const LivingPresenceSchema = z.object({ supervisorId: z.string(), accountId: z.string() });
-export type LivingPresence = z.infer<typeof LivingPresenceSchema>;
-
-export function livingCodexPresences(): LivingPresence[] {
-  const living: LivingPresence[] = [];
-  if (!existsSync(codexPaths.presenceDir)) return living;
-  for (const name of readdirSync(codexPaths.presenceDir)) {
-    const file = join(codexPaths.presenceDir, name);
-    let raw: string;
-    try {
-      raw = readFileSync(file, "utf8");
-    } catch (e) {
-      if (ErrnoSchema.safeParse(e).data?.code === "ENOENT") continue;
-      throw e;
-    }
-    const parsed = PresenceSchema.safeParse(JsonTextSchema.safeParse(raw).data);
-    if (!parsed.success) {
-      throw new Error(`${file} is not a readable presence record - it may belong to a RUNNING codex session, refusing to treat it as absent; remove the file (or respawn that session) to proceed`);
-    }
-    const observed = pidStartTime(parsed.data.pid);
-    if (observed !== parsed.data.startedAt) {
-      if (observed == null && pidExists(parsed.data.pid)) {
-        throw new Error(`ps could not read the start time of live pid ${parsed.data.pid} (${file}) - refusing to clear a presence file that may guard a RUNNING codex session`);
-      }
-      rmSync(file, { force: true });
-      continue;
-    }
-    living.push(LivingPresenceSchema.parse({ supervisorId: name, accountId: parsed.data.accountId }));
-  }
-  return living;
-}
-
-export function presentCodexAccountIds(): Set<string> {
-  return new Set(livingCodexPresences().map((presence) => presence.accountId));
-}

package/src/lib/swap.ts

@@ -1,198 +0,0 @@
-import { clearDepletedWait, clearUsageSnapshots, loadAccounts, saveAccounts, saveLastSwapAt } from "./state.ts";
-import { readItem, writeItem, liveTarget, parkedTarget, claudeAiOauthOnly, mergeIntoLive } from "./credstore.ts";
-import { refreshCredential, isAccessTokenExpiring, isDeadCredential, fetchTokenIdentity, describeIdentity, IdentityUnavailableError, InvalidGrantError, RefreshRejectedError } from "./oauth.ts";
-import { swapOAuthAccount } from "./claudejson.ts";
-import { withClaudeRefreshLock } from "./claudelock.ts";
-import { claudePool, credItemFor } from "./paths.ts";
-import { log } from "./log.ts";
-import { CredentialBlobSchema, type Account, type OAuthCreds, type TokenIdentity } from "./types.ts";
-
-function parseBlob(raw: string) {
-  return CredentialBlobSchema.parse(JSON.parse(raw));
-}
-
-export async function performSwap(target: Account): Promise<void> {
-  const idx = loadAccounts(claudePool);
-  const oauthAccount = target.oauthAccount;
-  if (!oauthAccount) throw new Error(`${target.label} has no oauthAccount on its record - re-add it with \`tokenmaxxing auth ${target.label}\``);
-
-  const preLive = await readItem(liveTarget());
-  let liveOwner: Account | null = null;
-  let liveCreds: OAuthCreds | null = null;
-  let expectedLiveToken: string | null = null;
-  if (preLive) {
-    liveCreds = parseBlob(preLive).claudeAiOauth;
-    expectedLiveToken = liveCreds.accessToken;
-    if (isDeadCredential(liveCreds)) {
-      liveCreds = null;
-      log("swap.live_dead", {});
-    } else if (isAccessTokenExpiring(liveCreds, 60_000)) {
-      try {
-        await withClaudeRefreshLock(async (lock) => {
-          const raw2 = await readItem(liveTarget());
-          if (raw2 == null) throw new Error("live credential vanished while waiting for the refresh lock");
-          const current = parseBlob(raw2).claudeAiOauth;
-          const next = isAccessTokenExpiring(current, 60_000) ? await refreshCredential(current) : current;
-          liveCreds = next;
-          expectedLiveToken = next.accessToken;
-          if (next === current) return;
-          if (lock.compromised()) throw new Error("refresh lock compromised mid-refresh - discarding the live rewrite");
-          await writeItem(liveTarget(), mergeIntoLive(raw2, next));
-        });
-      } catch (e) {
-        if (!(e instanceof InvalidGrantError)) throw e;
-        liveCreds = null;
-        log("swap.harvest_skipped_dead_live", {});
-      }
-    }
-    if (liveCreds != null) {
-      let identity: TokenIdentity;
-      try {
-        identity = await fetchTokenIdentity(liveCreds.accessToken);
-      } catch (e) {
-        throw new Error(`cannot resolve the live credential's owner (${e instanceof Error ? e.message : String(e)}) - refusing to swap over it; the next check retries`);
-      }
-      liveOwner = idx.accounts.find((a) => a.id === identity.accountUuid) ?? null;
-      if (!liveOwner) {
-        throw new Error(
-          `live credential belongs to ${describeIdentity(identity)}, which is not in the pool - refusing to swap over it; import it first with \`tokenmaxxing add\``,
-        );
-      }
-      if (liveOwner.id !== idx.activeId) {
-        log("swap.harvest_drift", {
-          labeled: idx.activeId?.slice(0, 8) ?? null,
-          actual: liveOwner.id.slice(0, 8),
-        });
-      }
-    }
-  }
-
-  const selfSwap = liveOwner != null && liveOwner.id === target.id;
-  let fresh: OAuthCreds | null = null;
-  if (!selfSwap) {
-    const parkedRaw = await readItem(parkedTarget(credItemFor(target.id)));
-    if (!parkedRaw) throw new Error(`no parked credential for ${target.label}`);
-    const parked = parseBlob(parkedRaw).claudeAiOauth;
-    const markDead = (detail: string): InvalidGrantError => {
-      const t = idx.accounts.find((a) => a.id === target.id);
-      if (t) { t.needsReauth = true; saveAccounts(claudePool, idx); }
-      log("swap.invalid_grant", { account: target.id.slice(0, 8), detail });
-      return new InvalidGrantError(detail);
-    };
-    if (isDeadCredential(parked)) throw markDead("parked credential was cleared after a failed refresh - re-auth with `tokenmaxxing auth`");
-    let parkedOwner: TokenIdentity | null = null;
-    try {
-      parkedOwner = await fetchTokenIdentity(parked.accessToken);
-    } catch (e) {
-      if (!(e instanceof IdentityUnavailableError && e.status === 401)) throw e;
-      log("swap.parked_token_stale", { account: target.id.slice(0, 8) });
-    }
-    if (parkedOwner != null && parkedOwner.accountUuid !== target.id) {
-      const owner = idx.accounts.find((a) => a.id === parkedOwner.accountUuid) ?? null;
-      let kept = "was left in place";
-      if (owner != null && owner.id !== liveOwner?.id) {
-        await writeItem(parkedTarget(credItemFor(owner.id)), JSON.stringify({ claudeAiOauth: parked }));
-        log("swap.parked_relocated", { account: owner.id.slice(0, 8) });
-        kept = "was copied to that account's slot";
-      }
-      throw markDead(`parked credential belongs to ${describeIdentity(parkedOwner)} - refusing to spend another account's grant; the pair ${kept}; re-auth with \`tokenmaxxing auth ${target.label}\``);
-    }
-    const refreshParked = async (): Promise<OAuthCreds> => {
-      try {
-        return await refreshCredential(parked);
-      } catch (e) {
-        if (e instanceof InvalidGrantError) throw markDead(e.detail);
-        if (e instanceof RefreshRejectedError) log("swap.refresh_rejected", { account: target.id.slice(0, 8), status: e.status, detail: e.detail });
-        throw e;
-      }
-    };
-    if (parkedOwner != null) {
-      fresh = await refreshParked();
-    } else {
-      fresh = await withClaudeRefreshLock(async (lock) => {
-        const rotated = await refreshParked();
-        let freshOwner: TokenIdentity;
-        try {
-          freshOwner = await fetchTokenIdentity(rotated.accessToken);
-        } catch (e) {
-          await writeItem(parkedTarget(credItemFor(target.id)), JSON.stringify({ claudeAiOauth: rotated }));
-          throw new Error(`refreshed the parked credential but cannot verify its owner (${e instanceof Error ? e.message : String(e)}) - kept the rotated token parked; the next check retries`);
-        }
-        if (freshOwner.accountUuid !== target.id) {
-          const owner = idx.accounts.find((a) => a.id === freshOwner.accountUuid) ?? null;
-          const kept = await keepRotatedPair({ fresh: rotated, owner, fallback: target, liveOwnerId: liveOwner?.id ?? null, expectedLiveToken, lock });
-          throw markDead(`parked credential belongs to ${describeIdentity(freshOwner)}, whose grant this refresh rotated - the rotated token ${kept}; re-auth with \`tokenmaxxing auth ${target.label}\``);
-        }
-        return rotated;
-      });
-    }
-    await writeItem(parkedTarget(credItemFor(target.id)), JSON.stringify({ claudeAiOauth: fresh }));
-  }
-
-  await withClaudeRefreshLock(async (lock) => {
-    const currentLive = await readItem(liveTarget());
-    if (lock.compromised()) throw new Error("refresh lock compromised - aborting the swap before any write");
-
-    const currentToken = currentLive == null ? null : parseBlob(currentLive).claudeAiOauth.accessToken;
-    if (currentToken !== expectedLiveToken) {
-      throw new Error("live credential changed while unlocked (concurrent /login or refresh) - aborting this swap; the next check re-resolves the owner and retries");
-    }
-
-    if (liveOwner && currentLive) {
-      await writeItem(parkedTarget(credItemFor(liveOwner.id)), claudeAiOauthOnly(currentLive));
-      log("swap.harvest", { account: liveOwner.id.slice(0, 8) });
-    }
-
-    if (fresh != null) {
-      await writeItem(liveTarget(), mergeIntoLive(currentLive, fresh));
-    }
-    swapOAuthAccount(oauthAccount);
-    idx.activeId = target.id;
-    const t2 = idx.accounts.find((a) => a.id === target.id);
-    if (t2) { t2.needsReauth = false; }
-    saveAccounts(claudePool, idx);
-    clearUsageSnapshots();
-    clearDepletedWait();
-    saveLastSwapAt(claudePool, Date.now());
-  });
-  log("swap.done", { account: target.id.slice(0, 8), label: target.label });
-}
-
-export async function keepRotatedPair(input: {
-  fresh: OAuthCreds;
-  owner: Account | null;
-  fallback: Account;
-  liveOwnerId: string | null;
-  expectedLiveToken: string | null;
-  lock: { compromised: () => boolean };
-}): Promise<string> {
-  const { fresh, owner } = input;
-  if (owner == null) {
-    await writeItem(parkedTarget(credItemFor(input.fallback.id)), JSON.stringify({ claudeAiOauth: fresh }));
-    log("swap.rotated_kept_in_stamped_slot", { account: input.fallback.id.slice(0, 8) });
-    return "was kept in this account's stamped slot because its owner is not in the pool";
-  }
-  const park = async (): Promise<void> => {
-    await writeItem(parkedTarget(credItemFor(owner.id)), JSON.stringify({ claudeAiOauth: fresh }));
-    log("swap.rotated_parked_rescued", { account: owner.id.slice(0, 8) });
-  };
-  if (input.liveOwnerId !== owner.id) {
-    await park();
-    return "was parked under that account";
-  }
-  try {
-    const currentLive = await readItem(liveTarget());
-    if (input.lock.compromised()) throw new Error("refresh lock compromised");
-    if (currentLive == null || parseBlob(currentLive).claudeAiOauth.accessToken !== input.expectedLiveToken) throw new Error("live credential changed while unlocked");
-    await writeItem(liveTarget(), mergeIntoLive(currentLive, fresh));
-    log("swap.rotated_live_rescued", { account: owner.id.slice(0, 8) });
-    return "was installed into the live store so that account's sessions continue";
-  } catch (e) {
-    await park();
-    return `was parked under that account (${e instanceof Error ? e.message : String(e)})`;
-  }
-}
-
-export function isSkippableSwapError(e: unknown): boolean {
-  return e instanceof InvalidGrantError || e instanceof RefreshRejectedError || e instanceof IdentityUnavailableError;
-}