tokenmaxxing 1.51.0 → 1.53.0

package/DESIGN.md

@@ -41,7 +41,7 @@ It is a process manager only - spawn with inherited stdio (stdin through a relay
   - `sessions/<sid>.json`, `sample/`, `onboard/`, `setup-tokens.json`, `setup-token/`, `cloud/`, `update.json`, `spawnrate.json`, `tokenmaxxing.log`, the codex `codex-onboard/`, `codex-respawn/`, and `codex-live/`, and the `grok-*` and `opencode-go-*` state of the status-only pools: the full table is in [State directory layout](docs/content/docs/state-directory.mdx).
 - Per-account **credential stores** follow the platform's Claude Code store: macOS = a login-keychain item keyed by the store path (never plaintext on disk); Linux = a 0600 `.credentials.json` inside the 0700 store directory (the same plaintext model claude itself uses - its Linux build has no keyring path at all, binary-verified 2.1.205). One `credstore` facade dispatches on a `{kind: keychain|file}` target; call sites never branch on platform. tokenmaxxing writes a store once, at onboarding; Claude Code's own refresh is the only writer afterwards.
 
-- A periodic check job (`com.tokenmaxxing.check` launchd agent on macOS, `tokenmaxxing-check.timer` systemd user timer on Linux) running `tokenmaxxing check` once per tick (`policy.checkIntervalMs`, 60s by default): it runs the decision with no seat (nothing moves), folds fresh tees into the index, samples up to three accounts whose last `/usage` attempt is oldest (the direct no-spend usage GET for an idle account with a fresh token, the `/usage` probe under the store otherwise), and on a Bun global install checks npm for a newer version once a day, so the cached figures every placement reads stay fresh.
+- A periodic check job (`com.tokenmaxxing.check` launchd agent on macOS, `tokenmaxxing-check.timer` systemd user timer on Linux) running `tokenmaxxing check` once per tick (`policy.checkIntervalMs`, 60s by default): it runs the decision with no seat (nothing moves), folds fresh tees into the index, samples up to three accounts whose last sample attempt is oldest (the direct no-spend usage GET first, the `/usage` probe under the store for a near-expiry token or a failed read), and on a Bun global install checks npm for a newer version once a day, so the cached figures every placement reads stay fresh.
 
 The switching path runs no long-lived daemon. The statusline pushes usage. Hooks and the supervisor react. The periodic check job above is the only recurring process. The `claude` binary, `~/.claude.json`, and Claude Code's default credential store are untouched; inside `~/.claude` only `settings.json` gets the five entries.
 
@@ -59,7 +59,7 @@ The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limi
 4. Write `respawn/<session-id>` (atomic temp+rename) naming the target, with `waitUntil` now for a plain move or the soonest reset when the pool is depleted. No credential is written.
 
 ### 3.3 Move and depleted-pool pause (supervisor)
-The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed turn boundary, deletes the marker, resets the terminal, compacts the conversation when the marker asks for it (`compact: true` from the Stop and SessionStart hooks, `false` from StopFailure: it runs `claude -p --resume <sid> /compact` under the old seat's store, bounded at five minutes, and a failure only prints why), and (when `waitUntil` is in the future) shows an interruptible countdown to the reset; then it relaunches `claude --resume <sid>` with `CLAUDE_SECURESTORAGE_CONFIG_DIR` set to the target's store and rewrites the session's presence. The resumed process reads that store cold → runs on the target account, same conversation. The relaunch submits a first prompt that names the move (and the compaction, when it landed) and asks Claude to continue the task, so the conversation goes on without a keystroke: in a terminal session it is the positional prompt after the session id; in a stream-json session (`--input-format stream-json`, where the binary ignores a positional prompt) the supervisor owns stdin, relays the harness's lines to the child through a pipe, and writes the prompt as the first `user` line of the new process. The supervisor's own notices go to stderr, so a stream-json stdout stays parseable. The `SessionStart` hook (every source) re-runs the decision before the first turn and writes the same marker if the seat is already over its bar or the pool is depleted. A marker whose `launchedAt` does not match the running child is discarded, and after a Ctrl-C on the countdown a later marker whose `waitUntil` falls inside the skipped wait is ignored. A marker that fails to parse is never deleted and never treated as absent: the supervisor stops the child, restores the terminal, and exits naming the marker path.
+The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed turn boundary, deletes the marker, resets the terminal, compacts the conversation when the marker asks for it (`compact: true` from the Stop and SessionStart hooks and from the supervisor's own seat watch, `false` from StopFailure: it runs `claude -p --resume <sid> /compact` under the old seat's store, bounded at five minutes, and a failure only prints why), and (when `waitUntil` is in the future) shows an interruptible countdown to the reset; then it relaunches `claude --resume <sid>` with `CLAUDE_SECURESTORAGE_CONFIG_DIR` set to the target's store and rewrites the session's presence. The resumed process reads that store cold → runs on the target account, same conversation. The relaunch submits a first prompt that names the move (and the compaction, when it landed) and asks Claude to continue the task, so the conversation goes on without a keystroke: in a terminal session it is the positional prompt after the session id; in a stream-json session (`--input-format stream-json`, where the binary ignores a positional prompt) the supervisor owns stdin, relays the harness's lines to the child through a pipe, and writes the prompt as the first `user` line of the new process. The supervisor's own notices go to stderr, so a stream-json stdout stays parseable. The `SessionStart` hook (every source) re-runs the decision before the first turn and writes the same marker if the seat is already over its bar or the pool is depleted. The supervisor also watches its own seat every ten seconds while the child runs (account record plus tee, the same bars) and writes the marker itself when the seat is at or over a bar, so a move never depends on a hook firing: a harness session between turns whose background workflow burns the window, or a subagent refusal that stamped the wall, is moved within seconds. SIGTERM to the supervisor is forwarded to the child and the supervisor exits after it, so a harness that stops the wrapper (the Agent SDK does) never leaves an orphaned claude on the old seat. A marker whose `launchedAt` does not match the running child is discarded, and after a Ctrl-C on the countdown a later marker whose `waitUntil` falls inside the skipped wait is ignored. A marker that fails to parse is never deleted and never treated as absent: the supervisor stops the child, restores the terminal, and exits naming the marker path.
 
 ### 3.4 Placement (supervisor, under the pool lock)
 1. Fold every account's tee into the index.
@@ -84,7 +84,7 @@ Each terminal ran the supervisor, so each has its own child `claude`, its own `-
 The [switching policy](docs/content/docs/switching.mdx) is one rule: under both bars, hold; at or over a bar, move to the usable account that ranks first; nothing usable, wait for the soonest reset. The same ranking places a session at launch.
 
 - Ranking (decided by consult for #79): greatest remaining headroom to the session bar divided by the number of sessions after placement, `(bar - used) / (sessions + 1)`, then highest pace pressure (remaining percent of the binding gated per-model cap, or of the weekly aggregate for an account with no gated row, over time to its reset), then soonest weekly reset, then lowest weekly usage; unknown usage ranks last. Organization membership is not an input. Codex drops the headroom key, keeps the pace ordering and the weekly tie-breaks, and excludes accounts running in another codex session, because codex has no cross-process refresh lock and two sessions must never share a login.
-- Selection reads the cached figures only, after folding every account's tee. Each periodic check tick samples up to three accounts whose last `/usage` attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`, under each account's store, so every account is attempted about once per three ticks per pooled account, or once per `policy.usagePollTtlMs` plus a tick when that is longer, and its cached figure is as fresh as its last successful attempt or its sessions' latest push. The pool lock covers only the reservation and the result write, never the `/usage` child.
+- Selection reads the cached figures only, after folding every account's tee. Each periodic check tick samples up to three accounts whose last sample attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`, over the direct no-spend usage read with the account's stored token, or the `/usage` child under its store when the token is near expiry or the read fails, so every account is attempted about once per three ticks per pooled account, or once per `policy.usagePollTtlMs` plus a tick when that is longer, and its cached figure is as fresh as its last successful attempt or its sessions' latest push. The pool lock covers only the reservation and the result write, never the read or the `/usage` child.
 - The depleted pause happens at the bar, not at 100; Codex has no pause and rides its account until the server refuses it, because a running sibling cannot adopt another account without restarting.
 - Neither pool has a post-swap cooldown or a manual `switch`: a move is a respawn of one session under a fixed store, so nothing another session reads is invalidated by it, and placement at launch replaces the manual pick.
 

package/README.md

@@ -90,7 +90,7 @@ The bars' headroom is deliberate: it's the budget to reach a clean turn boundary
 
 Launches and moves rank usable accounts by session-window headroom per running session, `(bar - used) / (sessions + 1)`, so two fresh accounts alternate and a third session goes to whichever has more headroom left per session; ties break by pace pressure (remaining percent of the binding gated per-model cap, or of the weekly aggregate for an account with no gated row, divided by time to its reset, highest first), then soonest weekly reset, then lowest weekly use. Organization membership is not an input.
 
-- Every periodic check tick folds fresh statusline tees into the index and samples up to three accounts whose last `/usage` attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`: an idle account with a fresh token through the direct no-spend usage read, the rest through `claude -p '/usage'` under the account's store; a move reads the cached figures, which are as fresh as each account's last successful attempt or its sessions' latest push.
+- Every periodic check tick folds fresh statusline tees into the index and samples up to three accounts whose last sample attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`: the direct no-spend usage read first, and `claude -p '/usage'` under the account's store only for a near-expiry token or a failed read; a move reads the cached figures, which are as fresh as each account's last successful attempt or its sessions' latest push.
 - When no account is usable, the session pauses until the soonest reset if that lands within `policy.maxWaitMs`, and otherwise stays put.
 
 See [How switching decides](docs/content/docs/switching.mdx) for the policy and the [cache-cost profile](docs/content/docs/switching-profile.mdx) for measurements and their limits.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.51.0",
+  "version": "1.53.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts, start each session on its own account, and resume a session on a fresher account when quota fills.",
   "type": "module",
   "license": "MIT",

package/src/entries/stopfailurehook.ts

@@ -3,7 +3,7 @@ import { claude } from "../lib/claude.ts";
 import { evaluateAndMaybeSwap } from "../lib/decide.ts";
 import { supervisedSession, writeRespawnMarker } from "../lib/sessions.ts";
 import { loadConfig } from "../lib/state.ts";
-import { classifyEnforcedLimit, findEnforcedRow, parseErrorBody, readTranscriptTail } from "../lib/usage.ts";
+import { classifyEnforcedLimit, findEnforcedRow, parseErrorBody, readTranscriptTail, type TranscriptRow } from "../lib/usage.ts";
 import { paths } from "../lib/paths.ts";
 import { JsonTextSchema, type EnforcedLimit } from "../lib/types.ts";
 import { log } from "../lib/log.ts";
@@ -17,6 +17,18 @@ const StopFailureStdin = z.looseObject({
   last_assistant_message: z.string().optional().catch(undefined),
 });
 
+const ROW_WAIT_MS = 3_000;
+const ROW_POLL_MS = 200;
+
+async function awaitEnforcedRow(input: { transcriptPath: string; lastAssistantMessage: string | undefined; now: number }): Promise<TranscriptRow | null> {
+  const deadline = Date.now() + ROW_WAIT_MS;
+  while (true) {
+    const row = findEnforcedRow({ rows: readTranscriptTail(input.transcriptPath), lastAssistantMessage: input.lastAssistantMessage, now: input.now });
+    if (row || Date.now() >= deadline) return row;
+    await Bun.sleep(ROW_POLL_MS);
+  }
+}
+
 export async function runStopFailureHook(): Promise<number> {
   if (process.env.TOKENMAXXING_PROBE) return 0;
 
@@ -35,7 +47,7 @@ export async function runStopFailureHook(): Promise<number> {
   try {
     const cfg = loadConfig();
     const row = stdin.transcript_path
-      ? findEnforcedRow({ rows: readTranscriptTail(stdin.transcript_path), lastAssistantMessage: stdin.last_assistant_message, now })
+      ? await awaitEnforcedRow({ transcriptPath: stdin.transcript_path, lastAssistantMessage: stdin.last_assistant_message, now })
       : null;
     const limit = row ? classifyEnforcedLimit(row, cfg.policy.switchModels) : null;
 
@@ -46,6 +58,7 @@ export async function runStopFailureHook(): Promise<number> {
     } else {
       log("stopfailure.unclassified", {
         seat: account != null,
+        subagent: !mainLoop,
         row: row != null,
         type: row?.quotaLimits?.rateLimitType,
         transient: row?.apiErrorIsTransient,

package/src/entries/supervisor.ts

@@ -5,13 +5,16 @@ import { maxBy } from "es-toolkit";
 import { z } from "zod";
 import { claudePool, paths, storeDirFor } from "../lib/paths.ts";
 import { LOOP_DIAGNOSIS, MAX_WRAP_DEPTH, UNMANAGED_ENV, WRAP_DEPTH_ENV, WRAP_RATE_MAX, WRAP_RATE_WINDOW_MS, resolveRealClaude, wrapDepth, wrapperEntryRateTripped } from "../lib/claudebin.ts";
-import { pickSeat } from "../lib/claude.ts";
+import { claude, pickSeat } from "../lib/claude.ts";
 import { compactClaudeSession } from "../lib/compact.ts";
+import { evaluateAndMaybeSwap } from "../lib/decide.ts";
 import { withLock } from "../lib/lock.ts";
+import { thresholdBars, usableAt } from "../lib/picker.ts";
 import { clearPresence, writePresence } from "../lib/presence.ts";
+import { teeObservation } from "../lib/sample.ts";
 import { saveTermios, restoreTermios } from "../lib/tty.ts";
-import { loadSessionFlags, pruneStaleSessions, saveSessionFlags } from "../lib/sessions.ts";
-import { loadAccounts } from "../lib/state.ts";
+import { loadSessionFlags, pruneStaleSessions, saveSessionFlags, writeRespawnMarker } from "../lib/sessions.ts";
+import { loadAccounts, loadConfig } from "../lib/state.ts";
 import { RespawnMarkerSchema, type Account } from "../lib/types.ts";
 import { log } from "../lib/log.ts";
 
@@ -190,6 +193,35 @@ function consumableMarker(marker: string, gate: MarkerGate): z.infer<typeof Resp
   return m;
 }
 
+const SEAT_POLL_MS = 10_000;
+const SEAT_RETRY_MS = 60_000;
+
+function seatBlockedUntil(seatId: string, now: number): number | null {
+  const account = loadAccounts(claudePool).accounts.find((a) => a.id === seatId);
+  if (!account) return null;
+  const cfg = loadConfig();
+  const observed = teeObservation(account);
+  const current = observed ? { ...account, windows: observed.windows } : account;
+  const until = usableAt(current, { now, thresholds: thresholdBars(cfg), currentId: seatId, families: cfg.policy.switchModels, seats: null });
+  return until > now ? until : null;
+}
+
+async function moveExhaustedSeat(seat: Account, sid: string, gate: MarkerGate): Promise<boolean> {
+  try {
+    const now = Date.now();
+    const until = seatBlockedUntil(seat.id, now);
+    if (until == null || until <= gate.overriddenUntil) return false;
+    const decision = await evaluateAndMaybeSwap(claude, now, true, null, seat.id);
+    log("supervisor.seat_exhausted", { seat: seat.id.slice(0, 8), until, reason: decision.reason, account: decision.account?.id.slice(0, 8), waitUntil: decision.waitUntil });
+    if (decision.account && (decision.swapped || decision.waitUntil !== undefined)) {
+      writeRespawnMarker({ session: { sid, launchedAt: gate.launchedAt }, sessionId: sid, accountId: decision.account.id, waitUntil: decision.waitUntil ?? now, compact: true });
+    }
+  } catch (e) {
+    log("supervisor.seat_watch_error", { err: e instanceof Error ? e.message : String(e) });
+  }
+  return true;
+}
+
 async function countdownWait(acct: string, until: number): Promise<boolean> {
   let aborted = false;
   const onInt = () => { aborted = true; };
@@ -324,11 +356,20 @@ export async function runSupervisor(argv: string[]): Promise<number> {
   const info = analyzeArgs(argv);
   const childEnv = { ...process.env, [WRAP_DEPTH_ENV]: String(depth + 1) };
 
+  let child: Subprocess | null = null;
+  let terminating = false;
+  process.on("SIGTERM", () => {
+    terminating = true;
+    if (child) child.kill("SIGTERM");
+    else process.exit(143);
+  });
+
   if (!info.manage || process.env[UNMANAGED_ENV]) {
     const passthroughEnv: Record<string, string | undefined> = { ...childEnv };
     delete passthroughEnv.TOKENMAXXING_SUPERVISED;
     delete passthroughEnv.TOKENMAXXING_SESSION_ID;
     const p = Bun.spawn([real, ...argv], { stdin: "inherit", stdout: "inherit", stderr: "inherit", env: passthroughEnv });
+    child = p;
     await p.exited;
     return p.exitCode ?? (p.signalCode ? 1 : 0);
   }
@@ -374,7 +415,7 @@ export async function runSupervisor(argv: string[]): Promise<number> {
     if (existsSync(marker)) rmSync(marker, { force: true });
 
     const gate: MarkerGate = { launchedAt: Date.now(), overriddenUntil };
-    const { child, seat } = await withLock(claudePool.lockFile, async () => {
+    const { child: proc, seat } = await withLock(claudePool.lockFile, async () => {
       const picked = (wanted == null ? null : (loadAccounts(claudePool).accounts.find((a) => a.id === wanted) ?? null)) ?? pickSeat(gate.launchedAt);
       log("supervisor.launch", { sid, respawns, seat: picked?.id.slice(0, 8) ?? null, args: launchArgs.join(" "), injected: firstLine !== null });
       const spawned = Bun.spawn([real, ...launchArgs], {
@@ -395,35 +436,42 @@ export async function runSupervisor(argv: string[]): Promise<number> {
       return { child: spawned, seat: picked };
     });
 
+    child = proc;
     let done = false;
+    let seatCheckAt = 0;
     const markerWatch = (async () => {
       while (!done) {
         if (existsSync(marker) && consumableMarker(marker, gate) != null) return true;
+        if (seat && !terminating && Date.now() >= seatCheckAt) {
+          const decided = await moveExhaustedSeat(seat, sid, gate);
+          seatCheckAt = Date.now() + (decided ? SEAT_RETRY_MS : SEAT_POLL_MS);
+        }
         await Bun.sleep(150);
       }
       return false;
     })();
-    const exited = child.exited.then(() => { done = true; return "exit" as const; });
+    const exited = proc.exited.then(() => { done = true; return "exit" as const; });
     try {
       const winner = await Promise.race([exited, markerWatch.then((m) => (m ? "marker" : "exit"))]);
       if (winner === "marker") {
         relay?.detach();
-        child.kill();
+        proc.kill();
       }
     } catch (e) {
       relay?.detach();
-      child.kill();
+      proc.kill();
       clearPresence({ dir: paths.presenceDir, id: sid });
       throw e;
     } finally {
-      await child.exited;
+      await proc.exited;
+      child = null;
       relay?.detach();
       done = true;
       await markerWatch.catch(() => {});
       restoreTermios(savedTermios);
     }
 
-    const m = existsSync(marker) ? consumableMarker(marker, gate) : null;
+    const m = !terminating && existsSync(marker) ? consumableMarker(marker, gate) : null;
     if (m) {
       rmSync(marker, { force: true });
       respawns++;
@@ -452,7 +500,7 @@ export async function runSupervisor(argv: string[]): Promise<number> {
       continue;
     }
     clearPresence({ dir: paths.presenceDir, id: sid });
-    log("supervisor.exit", { sid, respawns, code: child.exitCode, signal: child.signalCode });
-    return child.exitCode ?? (child.signalCode ? 1 : 0);
+    log("supervisor.exit", { sid, respawns, code: proc.exitCode, signal: proc.signalCode, terminated: terminating || undefined });
+    return proc.exitCode ?? (proc.signalCode ? 1 : 0);
   }
 }

package/src/lib/claude.ts

@@ -12,11 +12,11 @@ import { claudePool, paths, sampleDirFor, seatFromEnv, storeDirFor } from "./pat
 import { pickBest, pickEarliestReset, thresholdBars, type PickCtx } from "./picker.ts";
 import { seatCounts } from "./presence.ts";
 import type { Observation, Provider, SampleReport } from "./provider.ts";
-import { foldTee, probeAccountUsage, teeObservation } from "./sample.ts";
+import { foldTee, sampleAccountUsage, teeObservation } from "./sample.ts";
 import { clearUsageSnapshot, loadAccounts, loadConfig, loadUsageSnapshot, pinBinOverride, saveAccounts, type Harvest } from "./state.ts";
 import { loadSetupTokens, saveSetupTokens } from "./setuptokens.ts";
 import { saveTermios, restoreTermios } from "./tty.ts";
-import { CRED_ENV_OVERRIDES, gatedFamilies, mergeWindows, probeUsage, windowsOf } from "./usage.ts";
+import { CRED_ENV_OVERRIDES, fetchUsageDirect, gatedFamilies, mergeWindows, windowsOf } from "./usage.ts";
 import { CredentialBlobSchema, OAuthAccountSchema, type Account, type Config } from "./types.ts";
 import { c } from "../cli/render.ts";
 
@@ -46,7 +46,7 @@ async function observeLive(account: Account, cfg: Config, now: number, opts: { p
   const needsPerModel = snap != null && gatedFamilies(snap.state.model, cfg.policy.switchModels).length > 0;
   if (opts.probe && !probeAttempted && (!fresh || needsPerModel)) {
     const startedAt = Date.now();
-    const outcome = await probeAccountUsage(account, { retries: 0 });
+    const outcome = await sampleAccountUsage(account, { retries: 0 });
     await withLock(claudePool.lockFile, () => {
       const idx = loadAccounts(claudePool);
       const a = idx.accounts.find((x) => x.id === account.id);
@@ -81,7 +81,7 @@ async function samplePool(accounts: Account[]): Promise<Map<string, SampleReport
         reports.set(a.id, { ok: true, source: "statusline" });
         return;
       }
-      const outcome = await probeAccountUsage(a);
+      const outcome = await sampleAccountUsage(a);
       if (!outcome.ok) {
         reports.set(a.id, { ok: false, reason: outcome.reason });
         return;
@@ -217,7 +217,7 @@ async function login(): Promise<Harvest | null> {
     }
 
     console.log(c.dim("sampling usage..."));
-    const sampled = await probeUsage({ configDir: onboardDir });
+    const sampled = await fetchUsageDirect(blob.claudeAiOauth.accessToken);
     if (!sampled) console.log(c.yellow("could not sample usage now - it will fill in on first use."));
     const at = Date.now();
     const id = oauthAccount.accountUuid;

package/src/lib/decide.ts

@@ -43,8 +43,8 @@ function enforcedWall(limit: EnforcedLimit, account: Account, now: number): numb
   return limit.resetsAt ?? cachedReset ?? now + (limit.kind === "session" ? FIVE_HOURS_MS : WEEK_MS);
 }
 
-export async function evaluateAndMaybeSwap(p: Provider, now = Date.now(), canRespawn = false, enforced: EnforcedLimit | null = null): Promise<SwapDecision> {
-  const activeId = p.liveId();
+export async function evaluateAndMaybeSwap(p: Provider, now = Date.now(), canRespawn = false, enforced: EnforcedLimit | null = null, seatId: string | null = p.liveId()): Promise<SwapDecision> {
+  const activeId = seatId;
 
   const lastSwapAt = loadLastSwapAt(p.pool);
   if (!enforced && lastSwapAt != null && now - lastSwapAt < POST_SWAP_COOLDOWN_MS) {
@@ -68,7 +68,7 @@ export async function evaluateAndMaybeSwap(p: Provider, now = Date.now(), canRes
       return { swapped: false, account: null, reason: "raced-already-swapped" };
     }
     const idx = loadAccounts(p.pool);
-    const id2 = p.liveId();
+    const id2 = seatId;
     const active = id2 ? idx.accounts.find((a) => a.id === id2) : undefined;
 
     const origin = enforced ? idx.accounts.find((a) => a.id === enforced.account) : undefined;

package/src/lib/sample.ts

@@ -14,16 +14,16 @@ import { fetchUsageDirect, mergeWindows, probeUsage, windowsOf } from "./usage.t
 import { UsageWindowsSchema, type Account, type Config } from "./types.ts";
 
 const SampleOutcomeSchema = z.discriminatedUnion("ok", [
-  z.object({ ok: z.literal(true), usage: UsageWindowsSchema }),
+  z.object({ ok: z.literal(true), usage: UsageWindowsSchema, via: z.enum(["get", "probe"]) }),
   z.object({ ok: z.literal(false), reason: z.string() }),
 ]);
 export type SampleOutcome = z.infer<typeof SampleOutcomeSchema>;
 
-const PreparedProbeSchema = z.discriminatedUnion("ok", [
-  z.object({ ok: z.literal(true), dir: z.string() }),
+const PreparedSampleSchema = z.discriminatedUnion("ok", [
+  z.object({ ok: z.literal(true), token: z.string().nullable() }),
   z.object({ ok: z.literal(false), reason: z.string() }),
 ]);
-type PreparedProbe = z.infer<typeof PreparedProbeSchema>;
+type PreparedSample = z.infer<typeof PreparedSampleSchema>;
 
 export function teeObservation(account: Account): Observation | null {
   const stored = account.lastUsageAt != null ? { windows: account.windows, at: account.lastUsageAt } : null;
@@ -43,7 +43,7 @@ export function foldTee(account: Account): boolean {
   return true;
 }
 
-export async function prepareProbe(account: Account, suffix = ""): Promise<PreparedProbe> {
+export async function prepareSample(account: Account): Promise<PreparedSample> {
   let creds;
   try {
     creds = await readStore(account.id);
@@ -57,20 +57,28 @@ export async function prepareProbe(account: Account, suffix = ""): Promise<Prepa
   }
   if (!account.oauthAccount) return { ok: false, reason: "account record has no oauthAccount - run `tokenmaxxing auth`" };
   account.tier = claudeTierLabel(creds) ?? account.tier;
+  return { ok: true, token: isAccessTokenExpiring(creds) ? null : creds.accessToken };
+}
+
+async function runProbe(account: Account, suffix: string, retries: number | undefined): Promise<SampleOutcome> {
   const dir = sampleDirFor(account.id, suffix);
   mkdirSync(dir, { recursive: true });
   writeFileAtomic(join(dir, ".claude.json"), JSON.stringify({ oauthAccount: account.oauthAccount, hasCompletedOnboarding: true }));
-  return { ok: true, dir };
+  const usage = await probeUsage({ configDir: dir, store: storeDirFor(account.id) }, Date.now(), { retries });
+  return usage ? { ok: true, usage, via: "probe" } : { ok: false, reason: "`/usage` returned no limit data (see log)" };
 }
 
-export async function runProbe(account: Account, dir: string, opts: { retries?: number }): Promise<SampleOutcome> {
-  const usage = await probeUsage({ configDir: dir, store: storeDirFor(account.id) }, Date.now(), { retries: opts.retries });
-  return usage ? { ok: true, usage } : { ok: false, reason: "`/usage` returned no limit data (see log)" };
+export async function runSample(account: Account, token: string | null, opts: { retries?: number; suffix?: string }): Promise<SampleOutcome> {
+  if (token) {
+    const usage = await fetchUsageDirect(token);
+    if (usage) return { ok: true, usage, via: "get" };
+  }
+  return runProbe(account, opts.suffix ?? "", opts.retries);
 }
 
-export async function probeAccountUsage(account: Account, opts: { retries?: number } = {}): Promise<SampleOutcome> {
-  const prepared = await prepareProbe(account);
-  return prepared.ok ? runProbe(account, prepared.dir, opts) : prepared;
+export async function sampleAccountUsage(account: Account, opts: { retries?: number } = {}): Promise<SampleOutcome> {
+  const prepared = await prepareSample(account);
+  return prepared.ok ? runSample(account, prepared.token, opts) : prepared;
 }
 
 const SAMPLE_BATCH = 3;
@@ -83,18 +91,19 @@ export async function sampleOldest(cfg: Config): Promise<void> {
     let dirty = false;
     for (const a of idx.accounts) dirty = foldTee(a) || dirty;
     const sampledAt = (a: Account) => Math.max(a.lastUsageAt ?? 0, a.lastProbeAt ?? 0);
+    const seats = seatCounts(paths.presenceDir);
     const stale = idx.accounts
       .filter((a) => a.needsReauth !== true && now - sampledAt(a) > cfg.policy.usagePollTtlMs)
-      .sort((a, b) => sampledAt(a) - sampledAt(b))
+      .sort((a, b) => Number(seats.has(b.id)) - Number(seats.has(a.id)) || sampledAt(a) - sampledAt(b))
       .slice(0, SAMPLE_BATCH);
     if (stale.length === 0) {
       if (dirty) saveAccounts(claudePool, idx);
       return [];
     }
-    const batch: { account: Account; dir: string; token: string | null }[] = [];
+    const batch: { account: Account; token: string | null }[] = [];
     for (const target of stale) {
       target.lastProbeAt = now;
-      const prepared = await prepareProbe(target, "-tick");
+      const prepared = await prepareSample(target);
       if (!prepared.ok) {
         target.storeFails = (target.storeFails ?? 0) + 1;
         if (target.storeFails >= STORE_FAILS_REAUTH) target.needsReauth = true;
@@ -102,32 +111,15 @@ export async function sampleOldest(cfg: Config): Promise<void> {
         continue;
       }
       target.storeFails = 0;
-      let token: string | null = null;
-      if (!seatCounts(paths.presenceDir).has(target.id)) {
-        const creds = await readStore(target.id).catch(() => null);
-        if (creds && !isDeadCredential(creds) && !isAccessTokenExpiring(creds)) token = creds.accessToken;
-      }
-      batch.push({ account: target, dir: prepared.dir, token });
+      batch.push({ account: target, token: prepared.token });
     }
     saveAccounts(claudePool, idx);
     return batch;
   });
   await Promise.all(
-    reserved.map(async ({ account, dir, token }) => {
+    reserved.map(async ({ account, token }) => {
       const startedAt = Date.now();
-      let via = "probe";
-      let outcome: SampleOutcome;
-      if (token) {
-        const usage = await fetchUsageDirect(token);
-        if (usage) {
-          via = "get";
-          outcome = { ok: true, usage };
-        } else {
-          outcome = await runProbe(account, dir, { retries: 0 });
-        }
-      } else {
-        outcome = await runProbe(account, dir, { retries: 0 });
-      }
+      const outcome = await runSample(account, token, { retries: 0, suffix: "-tick" });
       await withLock(claudePool.lockFile, () => {
         const idx = loadAccounts(claudePool);
         const stored = idx.accounts.find((a) => a.id === account.id);
@@ -138,7 +130,7 @@ export async function sampleOldest(cfg: Config): Promise<void> {
         }
         log(outcome.ok ? "sample.ok" : "sample.failed", {
           account: account.id.slice(0, 8),
-          ...(outcome.ok ? { via } : { reason: outcome.reason.slice(0, 200) }),
+          ...(outcome.ok ? { via: outcome.via } : { reason: outcome.reason.slice(0, 200) }),
         });
       });
     }),

package/src/lib/usage.ts

@@ -359,12 +359,28 @@ export async function probeUsage(target: ProbeTarget, now = Date.now(), opts: {
 const USAGE_URL = env("TOKENMAXXING_OAUTH_USAGE_URL", "https://api.anthropic.com/api/oauth/usage");
 const USAGE_DEADLINE_MS = 10_000;
 
-const UsageWindowResponseSchema = z.object({ utilization: z.number(), resets_at: z.number().nullable().optional() });
-const UsageResponseSchema = z.object({
-  rate_limits: z
-    .object({ five_hour: UsageWindowResponseSchema.nullish(), seven_day: UsageWindowResponseSchema.nullish() })
-    .nullish(),
+const UsageLimitSchema = z.looseObject({ utilization: z.number(), resets_at: z.unknown() });
+const UsageScopedLimitSchema = z.looseObject({
+  kind: z.string(),
+  percent: z.number(),
+  resets_at: z.unknown(),
+  scope: z.looseObject({ model: z.looseObject({ display_name: z.string() }) }),
 });
+const UsageResponseSchema = z.looseObject({
+  five_hour: UsageLimitSchema.nullish(),
+  seven_day: UsageLimitSchema.nullish(),
+  limits: z.array(z.unknown()).nullish(),
+});
+
+function scopedRows(limits: unknown[]): Record<string, UsageWindow> {
+  const perModel: Record<string, UsageWindow> = {};
+  for (const raw of limits) {
+    const row = UsageScopedLimitSchema.safeParse(raw);
+    if (!row.success || row.data.kind !== "weekly_scoped") continue;
+    perModel[row.data.scope.model.display_name] = { usedPercentage: row.data.percent, resetsAt: normalizeResetsAt(row.data.resets_at) };
+  }
+  return perModel;
+}
 
 export async function fetchUsageDirect(accessToken: string): Promise<UsageWindows | null> {
   let res: Response;
@@ -382,15 +398,10 @@ export async function fetchUsageDirect(accessToken: string): Promise<UsageWindow
     return null;
   }
   const parsed = UsageResponseSchema.safeParse(JsonTextSchema.safeParse(await res.text()).data);
-  const five = parsed.success ? parsed.data.rate_limits?.five_hour : null;
-  const seven = parsed.success ? parsed.data.rate_limits?.seven_day : null;
-  if (!five || !seven) {
+  if (!parsed.success || !parsed.data.five_hour || !parsed.data.seven_day) {
     log("usage.get_incomplete", { ok: parsed.success });
     return null;
   }
-  const win = (w: z.infer<typeof UsageWindowResponseSchema>): UsageWindow => ({
-    usedPercentage: w.utilization * 100,
-    resetsAt: w.resets_at != null ? w.resets_at * 1000 : null,
-  });
-  return { fiveHour: win(five), sevenDay: win(seven), perModel: {} };
+  const win = (w: z.infer<typeof UsageLimitSchema>): UsageWindow => ({ usedPercentage: w.utilization, resetsAt: normalizeResetsAt(w.resets_at) });
+  return { fiveHour: win(parsed.data.five_hour), sevenDay: win(parsed.data.seven_day), perModel: scopedRows(parsed.data.limits ?? []) };
 }