tokenmaxxing 1.54.0 → 1.56.0

package/DESIGN.md

@@ -124,7 +124,7 @@ The [profile](docs/content/docs/switching-profile.mdx) records observed cache re
 ---
 
 ## 8. Stack
-TypeScript on Bun, shipped as source: one multi-call entry (`src/main.ts`, `#!/usr/bin/env bun`) serves the CLI, the `claude` and `codex` supervisors, the statusLine and subagent statusLine shims, and the hooks; `init` installs a 2-line shim that `exec`s bun on the installed package's entry (a longer `/bin/sh` shim under Nix that drops its own directory from PATH; the Stop path runs every turn, and bun's start-up stays low-millisecond). A Bun global install refreshes itself from npm on the check tick, once a day. Published to npm as `tokenmaxxing` (source, platform-independent - a compiled binary was tried and shipped one architecture's Mach-O to every platform). Shipping is PR-based since 2026-07-18: work reaches main only through a pull request (branch, PR, CI green, a 10-minute review wait, every review handled, merge, teardown), and a merge that changes a packed file releases itself: CI assigns the next minor version on main, publishes, and tags it (details in AGENTS.md "Release and CI"). The supervisor spawns claude with inherited stdio (a relay pipe on stdin for a stream-json session) and restores saved `stty -g` termios between runs - no PTY layer; resize and signals flow through the shared foreground process group.
+TypeScript on Bun, shipped as source: one multi-call entry (`src/main.ts`, `#!/usr/bin/env bun`) serves the CLI, the `claude` and `codex` supervisors, the statusLine and subagent statusLine shims, and the hooks; `init` installs a 2-line shim that `exec`s bun on the installed package's entry with `--no-env-file`, so a `.env` in the working directory is not imported into the supervisor or the session (a longer `/bin/sh` shim under Nix that drops its own directory from PATH; the Stop path runs every turn, and bun's start-up stays low-millisecond). A Bun global install refreshes itself from npm on the check tick, once a day. Published to npm as `tokenmaxxing` (source, platform-independent - a compiled binary was tried and shipped one architecture's Mach-O to every platform). Shipping is PR-based since 2026-07-18: work reaches main only through a pull request (branch, PR, CI green, a 10-minute review wait, every review handled, merge, teardown), and a merge that changes a packed file releases itself: CI assigns the next minor version on main, publishes, and tags it (details in AGENTS.md "Release and CI"). The supervisor spawns claude with inherited stdio (a relay pipe on stdin for a stream-json session) and restores saved `stty -g` termios between runs - no PTY layer; resize and signals flow through the shared foreground process group.
 
 ---
 

package/README.md

@@ -73,7 +73,7 @@ claude                  # use claude as always; each session gets its own accoun
 | `tokenmaxxing check` | fold fresh tees, sample up to three stale accounts, and self-update a Bun global install once a day; the periodic timer runs this every tick |
 | `tokenmaxxing doctor` | verify the install: PATH order, `claudeBin`, the five settings entries, the timer, the credential identity of every Codex store and of every Claude store whose access token is still fresh (an expiring Claude token is reported as unverifiable, not as a failure), codex hook trust, setup-token age, and shell aliases that shadow `claude` |
 | `tokenmaxxing rename [--codex \| --grok \| --opencode-go] <sel> <label>` / `rm [...] <sel>` | manage a pool (one email can hold both a claude and a codex account); `rm` is refused for an account with a running supervised session |
-| `tokenmaxxing uninstall` | remove the shims, settings entries, codex Stop hook, check timer, and rc PATH line (accounts/stores kept) |
+| `tokenmaxxing uninstall [--yes]` | print the targets, then remove the shims, settings entries, codex Stop hook, check timer, and rc PATH line (accounts/stores kept); refused without `--yes` when `HOME` is the login home |
 | `tokenmaxxing setup-token [--print \| rm <label\|uuid>]` | Cursor Cloud only: mint one `claude setup-token` per pooled account (a browser sign-in each) and print the `TOKENMAXXING_TOKENS` secret value; `--print` prints the stored set, `rm` drops one |
 | `tokenmaxxing cursor init [dir]` | write the Claude relay subagent and `.cursor/environment.json` into a repo |
 | `tokenmaxxing cloud run [--session <id>] [--max-turns <n>] "<prompt>"` | on a Cursor Cloud VM: run `claude -p` on a setup token, rotate to the next token on a usage limit |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.54.0",
+  "version": "1.56.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts, start each session on its own account, and resume a session on a fresher account when quota fills.",
   "type": "module",
   "license": "MIT",

package/src/lib/install.ts

@@ -1,5 +1,5 @@
 import { accessSync, appendFileSync, constants, existsSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
-import { basename, dirname, join } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { escape } from "es-toolkit";
 import { z } from "zod";
 import { codexPaths, codexStoreDirFor, HOME, paths } from "./paths.ts";
@@ -86,7 +86,7 @@ export PATH
 if command -v tokenmaxxing >/dev/null 2>&1; then
   exec tokenmaxxing "$@"
 fi
-exec ${JSON.stringify(bun)} run ${JSON.stringify(entry)} "$@"
+exec ${JSON.stringify(bun)} --no-env-file run ${JSON.stringify(entry)} "$@"
 `;
 }
 
@@ -97,7 +97,7 @@ export function installSupervisor(): InstallOutcome {
   if (isNixPackaged()) {
     writeFileAtomic(target, nixSupervisorShim(process.execPath, entry), 0o755);
   } else {
-    writeFileAtomic(target, `#!/bin/sh\nexec ${JSON.stringify(process.execPath)} run ${JSON.stringify(entry)} "$@"\n`, 0o755);
+    writeFileAtomic(target, `#!/bin/sh\nexec ${JSON.stringify(process.execPath)} --no-env-file run ${JSON.stringify(entry)} "$@"\n`, 0o755);
   }
 
   writeFileAtomic(paths.supervisorLink, `#!/bin/sh\nexec ${JSON.stringify(target)} __supervise "$@"\n`, 0o755);
@@ -343,21 +343,35 @@ function systemdTimerActive(): "active" | "not-active" | "unavailable" {
   }
 }
 
-function uninstallCheckTimer(): boolean {
-  if (skipImperativeTimer()) return true;
+function removeTimerUnits(): void {
+  if (process.platform === "darwin") {
+    rmSync(launchdPlist(), { force: true });
+    return;
+  }
+  rmSync(join(paths.systemdUserDir, "tokenmaxxing-check.timer"), { force: true });
+  rmSync(join(paths.systemdUserDir, "tokenmaxxing-check.service"), { force: true });
+}
+
+type TimerOutcome = "removed" | "skipped" | "still-loaded";
+
+function uninstallCheckTimer(live: boolean): TimerOutcome {
+  if (skipImperativeTimer()) return "skipped";
+  if (!live) {
+    removeTimerUnits();
+    return "removed";
+  }
   if (process.platform === "darwin") {
     const domain = launchdDomain();
     const loaded = launchdJobLoaded();
     const deactivated = loaded === "loaded" && domain != null ? run(["launchctl", "bootout", `${domain}/${LAUNCHD_LABEL}`]) : loaded === "not-loaded";
-    rmSync(launchdPlist(), { force: true });
-    return deactivated;
+    removeTimerUnits();
+    return deactivated ? "removed" : "still-loaded";
   }
   const active = systemdTimerActive();
   const deactivated = active === "active" ? run(["systemctl", "--user", "disable", "--now", "tokenmaxxing-check.timer"]) : active === "not-active";
-  rmSync(join(paths.systemdUserDir, "tokenmaxxing-check.timer"), { force: true });
-  rmSync(join(paths.systemdUserDir, "tokenmaxxing-check.service"), { force: true });
+  removeTimerUnits();
   run(["systemctl", "--user", "daemon-reload"]);
-  return deactivated;
+  return deactivated ? "removed" : "still-loaded";
 }
 
 export function shellRcPath(): string | null {
@@ -448,17 +462,47 @@ export function removePathFromRc(rc: string): boolean {
   return true;
 }
 
-const UninstallOutcomeSchema = z.object({ timerDeactivated: z.boolean(), pathLineRemoved: z.boolean() });
+const UninstallOutcomeSchema = z.object({ timer: z.enum(["removed", "skipped", "still-loaded"]), pathLineRemoved: z.boolean() });
 export type UninstallOutcome = z.infer<typeof UninstallOutcomeSchema>;
 
-export function uninstallSupervisor(): UninstallOutcome {
+export function loginHome(): string {
+  const cmd = process.platform === "darwin" ? ["id", "-P"] : ["getent", "passwd", String(process.getuid?.() ?? "")];
+  const proc = Bun.spawnSync(cmd, { stdout: "pipe", stderr: "ignore", timeout: 10_000 });
+  const home = proc.stdout.toString().trim().split(":").at(-2);
+  if (proc.exitCode !== 0 || home == null || home === "") throw new Error(`cannot read the login home: ${cmd.join(" ")} failed`);
+  return home;
+}
+
+export function onLoginHome(): boolean {
+  return resolve(HOME) === resolve(loginHome());
+}
+
+export function uninstallTargets(live: boolean): string[] {
+  const timer =
+    process.platform === "darwin"
+      ? `${launchdPlist()}${live ? ` (and launchctl bootout gui/${process.getuid?.() ?? "?"}/${LAUNCHD_LABEL})` : ""}`
+      : `${join(paths.systemdUserDir, "tokenmaxxing-check.timer")} and .service${live ? " (and systemctl --user disable --now tokenmaxxing-check.timer)" : ""}`;
+  const rc = shellRcPath();
+  return [
+    `${paths.claudeSettings}: the hook and statusline entries`,
+    `${codexPaths.hooksJson}: the codex Stop hook entry`,
+    ...(skipImperativeTimer() ? [] : [timer]),
+    paths.supervisorLink,
+    codexSupervisorLink(),
+    join(paths.binDir, "xx"),
+    installedBin(),
+    ...(rc == null ? [] : [`${rc}: the ${PATH_LINE_MARK} line`]),
+  ];
+}
+
+export function uninstallSupervisor(input: { liveTimer: boolean }): UninstallOutcome {
   uninstallSettings();
-  const timerDeactivated = uninstallCheckTimer();
+  const timer = uninstallCheckTimer(input.liveTimer);
   uninstallCodexSupervisor();
   for (const f of [paths.supervisorLink, join(paths.binDir, "xx"), installedBin()]) {
     if (existsSync(f)) rmSync(f, { force: true });
   }
   const rc = shellRcPath();
   const pathLineRemoved = rc != null && removePathFromRc(rc);
-  return { timerDeactivated, pathLineRemoved };
+  return { timer, pathLineRemoved };
 }

package/src/main.ts

@@ -25,11 +25,13 @@ import { cmdConfig } from "./cli/config.ts";
 import { cmdSetupToken } from "./cli/setuptoken.ts";
 import { cmdCloudRun } from "./cli/cloudrun.ts";
 import { cmdCursorInit } from "./cli/cursorinit.ts";
-import { timerDeactivationHint, uninstallSupervisor } from "./lib/install.ts";
+import { onLoginHome, timerDeactivationHint, uninstallSupervisor, uninstallTargets } from "./lib/install.ts";
+import { HOME } from "./lib/paths.ts";
 import { c, emitError } from "./cli/render.ts";
 
 const JSON_FLAG = "--json";
 const CACHED_FLAG = "--cached";
+const YES_FLAG = "--yes";
 const CODEX_FLAG = "--codex";
 const GROK_FLAG = "--grok";
 const OPENCODE_GO_FLAG = "--opencode-go";
@@ -54,7 +56,7 @@ function printHelp(): void {
   ${c.cyan("tokenmaxxing doctor")}     verify the install is intact
   ${c.cyan("tokenmaxxing rename")} [--codex | --grok | --opencode-go] <sel> <label>
   ${c.cyan("tokenmaxxing rm")} [--codex | --grok | --opencode-go] <sel>
-  ${c.cyan("tokenmaxxing uninstall")}  remove supervisor + settings entries
+  ${c.cyan("tokenmaxxing uninstall")} [--yes]  print the targets, then remove supervisor + settings entries (refused without ${c.cyan("--yes")} when HOME is the login home)
   ${c.cyan("tokenmaxxing setup-token")} [--print | rm <label|uuid>]  Cursor Cloud only: mint one \`claude setup-token\` per pooled account (browser sign-in each) and print the TOKENMAXXING_TOKENS secret value; ${c.cyan("--print")} prints the stored set, ${c.cyan("rm")} drops one
   ${c.cyan("tokenmaxxing cursor init")} [dir]  write the Claude relay subagent (.cursor/agents/claude.md) and .cursor/environment.json into a repo
   ${c.cyan("tokenmaxxing cloud run")} [--session <id>] [--max-turns <n>] "<prompt>"  on a Cursor Cloud VM: run claude -p on a setup token from TOKENMAXXING_TOKENS, rotate to the next token on a usage limit
@@ -84,13 +86,14 @@ async function main(): Promise<number> {
   jsonMode = argv.includes(JSON_FLAG);
   const json = jsonMode;
   const cached = argv.includes(CACHED_FLAG);
+  const yes = argv.includes(YES_FLAG);
   const providerFlags = [CODEX_FLAG, GROK_FLAG, OPENCODE_GO_FLAG].filter((f) => argv.includes(f));
   if (providerFlags.length > 1) {
     emitError({ json, message: `${providerFlags.join(" and ")} are mutually exclusive - pick one pool` });
     return 2;
   }
   const provider = argv.includes(CODEX_FLAG) ? codex : argv.includes(GROK_FLAG) ? grok : argv.includes(OPENCODE_GO_FLAG) ? opencodeGo : claude;
-  const args = argv.filter((a) => a !== JSON_FLAG && a !== CACHED_FLAG && a !== CODEX_FLAG && a !== GROK_FLAG && a !== OPENCODE_GO_FLAG);
+  const args = argv.filter((a) => a !== JSON_FLAG && a !== CACHED_FLAG && a !== YES_FLAG && a !== CODEX_FLAG && a !== GROK_FLAG && a !== OPENCODE_GO_FLAG);
   const sub = args[0];
 
   if (cached && sub != null && sub !== "status") {
@@ -98,6 +101,11 @@ async function main(): Promise<number> {
     return 2;
   }
 
+  if (yes && sub !== "uninstall") {
+    emitError({ json, message: `${YES_FLAG} applies to uninstall only, not ${sub ?? "status"}` });
+    return 2;
+  }
+
   if (provider === codex && (sub == null || !CODEX_COMMANDS.has(sub))) {
     emitError({ json, message: `${CODEX_FLAG} applies to ${[...CODEX_COMMANDS].join(", ")}, not ${sub ?? "status"}` });
     return 2;
@@ -155,15 +163,25 @@ async function main(): Promise<number> {
       return 2;
     }
     case "uninstall": {
-      const out = uninstallSupervisor();
+      if (args.length > 1) {
+        emitError({ message: `unknown uninstall option: ${args[1]} (uninstall takes only ${YES_FLAG})` });
+        return 2;
+      }
+      const live = onLoginHome();
+      console.log(`uninstall removes:\n${uninstallTargets(live).map((t) => `  ${t}`).join("\n")}`);
+      if (live && !yes) {
+        emitError({ message: `refused: HOME is the login home (${HOME}) - rerun with ${YES_FLAG} to remove these from the live install` });
+        return 2;
+      }
+      const out = uninstallSupervisor({ liveTimer: live });
       const removed = [
         "supervisor wrapper",
         "settings entries",
-        ...(out.timerDeactivated ? ["check timer"] : []),
+        ...(out.timer === "removed" ? ["check timer"] : []),
         ...(out.pathLineRemoved ? ["rc PATH line"] : []),
       ];
       console.log(`removed ${removed.join(", ")}`);
-      if (!out.timerDeactivated) console.log(c.yellow(`⚠ the check job may still be loaded - run: ${timerDeactivationHint()}`));
+      if (out.timer === "still-loaded") console.log(c.yellow(`⚠ the check job may still be loaded - run: ${timerDeactivationHint()}`));
       if (!out.pathLineRemoved) console.log(c.dim("(no tokenmaxxing PATH line found in the shell rc)"));
       console.log(`kept: accounts.json, config.json, and every account credential store (claude: stores/ and its keychain items on macOS; codex: codex-stores/; grok: grok-stores/; opencode-go: opencode-go-stores/) - remove accounts with \`xx rm\` to delete their credentials`);
       return 0;