tokenmaxxing 1.55.0 → 1.57.0

package/DESIGN.md

@@ -59,7 +59,7 @@ The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limi
 4. Write `respawn/<session-id>` (atomic temp+rename) naming the target, with `waitUntil` now for a plain move or the soonest reset when the pool is depleted. No credential is written.
 
 ### 3.3 Move and depleted-pool pause (supervisor)
-The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed turn boundary, deletes the marker, resets the terminal, compacts the conversation when the marker asks for it (`compact: true` from the Stop and SessionStart hooks and from the supervisor's own seat watch, `false` from StopFailure: it runs `claude -p --resume <sid> /compact` under the old seat's store, bounded at five minutes, and a failure only prints why), and (when `waitUntil` is in the future) shows an interruptible countdown to the reset; then it relaunches `claude --resume <sid>` with `CLAUDE_SECURESTORAGE_CONFIG_DIR` set to the target's store and rewrites the session's presence. The resumed process reads that store cold → runs on the target account, same conversation. The relaunch submits a first prompt that names the move (and the compaction, when it landed) and asks Claude to continue the task, so the conversation goes on without a keystroke: in a terminal session it is the positional prompt after the session id; in a stream-json session (`--input-format stream-json`, where the binary ignores a positional prompt) the supervisor owns stdin, relays the harness's lines to the child through a pipe, and writes the prompt as the first `user` line of the new process. The supervisor's own notices go to stderr, so a stream-json stdout stays parseable. The `SessionStart` hook (every source) re-runs the decision before the first turn and writes the same marker if the seat is already over its bar or the pool is depleted. The supervisor also watches its own seat every ten seconds while the child runs (account record plus tee, the same bars) and writes the marker itself when the seat is at or over a bar, so a move never depends on a hook firing: a harness session between turns whose background workflow burns the window, or a subagent refusal that stamped the wall, is moved within seconds. SIGTERM to the supervisor is forwarded to the child and the supervisor exits after it, so a harness that stops the wrapper (the Agent SDK does) never leaves an orphaned claude on the old seat. A marker whose `launchedAt` does not match the running child is discarded, and after a Ctrl-C on the countdown a later marker whose `waitUntil` falls inside the skipped wait is ignored. A marker that fails to parse is never deleted and never treated as absent: the supervisor stops the child, restores the terminal, and exits naming the marker path.
+The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed turn boundary, deletes the marker, resets the terminal, compacts the conversation when the marker asks for it (`compact: true` from the Stop and SessionStart hooks and from the supervisor's own seat watch, `false` from StopFailure: it runs `claude -p --resume <sid> /compact` under the old seat's store, bounded at five minutes, and a failure only prints why), and (when `waitUntil` is in the future) shows an interruptible countdown to the reset; then it relaunches `claude --resume <sid>` with `CLAUDE_SECURESTORAGE_CONFIG_DIR` set to the target's store and rewrites the session's presence. The resumed process reads that store cold → runs on the target account, same conversation. The relaunch submits a first prompt that names the move (and the compaction, when it landed) and asks Claude to continue the task, so the conversation goes on without a keystroke: in a terminal session it is the positional prompt after the session id; in a stream-json session (`--input-format stream-json`, where the binary ignores a positional prompt) the supervisor owns stdin, relays the harness's lines to the child through a pipe, and writes the prompt as the first `user` line of the new process. In a terminal session the supervisor's own notices go to stderr. In a stream-json session (`--output-format stream-json`, read from the effective flags like the relay) there is no terminal and no statusline, so the supervisor writes each notice (the compaction and its failure, the move, the depleted-pool wait with its resume time, the resume) to stdout as a `system` line of subtype `informational` and level `warning`, the shape Claude Code emits for its own print-mode notices, which the harness renders in the conversation while the stream stays parseable; the per-second countdown ticks stay terminal-only, and the supervisor writes only while no child is running. The `SessionStart` hook (every source) re-runs the decision before the first turn and writes the same marker if the seat is already over its bar or the pool is depleted. The supervisor also watches its own seat every ten seconds while the child runs (account record plus tee, the same bars) and writes the marker itself when the seat is at or over a bar, so a move never depends on a hook firing: a harness session between turns whose background workflow burns the window, or a subagent refusal that stamped the wall, is moved within seconds. SIGTERM to the supervisor is forwarded to the child and the supervisor exits after it, so a harness that stops the wrapper (the Agent SDK does) never leaves an orphaned claude on the old seat. A marker whose `launchedAt` does not match the running child is discarded, and after a Ctrl-C on the countdown a later marker whose `waitUntil` falls inside the skipped wait is ignored. A marker that fails to parse is never deleted and never treated as absent: the supervisor stops the child, restores the terminal, and exits naming the marker path.
 
 ### 3.4 Placement (supervisor, under the pool lock)
 1. Fold every account's tee into the index.

package/README.md

@@ -73,7 +73,7 @@ claude                  # use claude as always; each session gets its own accoun
 | `tokenmaxxing check` | fold fresh tees, sample up to three stale accounts, and self-update a Bun global install once a day; the periodic timer runs this every tick |
 | `tokenmaxxing doctor` | verify the install: PATH order, `claudeBin`, the five settings entries, the timer, the credential identity of every Codex store and of every Claude store whose access token is still fresh (an expiring Claude token is reported as unverifiable, not as a failure), codex hook trust, setup-token age, and shell aliases that shadow `claude` |
 | `tokenmaxxing rename [--codex \| --grok \| --opencode-go] <sel> <label>` / `rm [...] <sel>` | manage a pool (one email can hold both a claude and a codex account); `rm` is refused for an account with a running supervised session |
-| `tokenmaxxing uninstall` | remove the shims, settings entries, codex Stop hook, check timer, and rc PATH line (accounts/stores kept) |
+| `tokenmaxxing uninstall [--yes]` | print the targets, then remove the shims, settings entries, codex Stop hook, check timer, and rc PATH line (accounts/stores kept); refused without `--yes` when `HOME` is the login home |
 | `tokenmaxxing setup-token [--print \| rm <label\|uuid>]` | Cursor Cloud only: mint one `claude setup-token` per pooled account (a browser sign-in each) and print the `TOKENMAXXING_TOKENS` secret value; `--print` prints the stored set, `rm` drops one |
 | `tokenmaxxing cursor init [dir]` | write the Claude relay subagent and `.cursor/environment.json` into a repo |
 | `tokenmaxxing cloud run [--session <id>] [--max-turns <n>] "<prompt>"` | on a Cursor Cloud VM: run `claude -p` on a setup token, rotate to the next token on a usage limit |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.55.0",
+  "version": "1.57.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts, start each session on its own account, and resume a session on a fresher account when quota fills.",
   "type": "module",
   "license": "MIT",

package/src/entries/supervisor.ts

@@ -50,6 +50,7 @@ const AnalysisSchema = z.object({
   resumeId: z.string().nullable(),
   continueLatest: z.boolean(),
   streamInput: z.boolean(),
+  streamOutput: z.boolean(),
 });
 type Analysis = z.infer<typeof AnalysisSchema>;
 
@@ -58,6 +59,7 @@ export function analyzeArgs(argv: string[]): Analysis {
   let resumeId: string | null = null;
   let continueLatest = false;
   let streamInput = false;
+  let streamOutput = false;
   let printMode = false;
   let invalidSessionArg = false;
   let pickerResume = false;
@@ -66,7 +68,8 @@ export function analyzeArgs(argv: string[]): Analysis {
 
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i]!;
-    if (a === "-p" || a === "--print") printMode = true;
+    if (a === "--") break;
+    else if (a === "-p" || a === "--print") printMode = true;
     else if (a === "--version" || a === "-v" || a === "--help" || a === "-h") printMode = true;
     else if (a === "--session-id") {
       const next = argv[++i] ?? null;
@@ -92,6 +95,8 @@ export function analyzeArgs(argv: string[]): Analysis {
     }
     else if (a === "--input-format") streamInput = argv[++i] === "stream-json";
     else if (a.startsWith("--input-format=")) streamInput = a.slice("--input-format=".length) === "stream-json";
+    else if (a === "--output-format") streamOutput = argv[++i] === "stream-json";
+    else if (a.startsWith("--output-format=")) streamOutput = a.slice("--output-format=".length) === "stream-json";
     else if (VALUE_TAKING_ROOT_FLAGS.has(a)) i++;
     else if (VARIADIC_ROOT_FLAGS.has(a)) {
       while (i + 1 < argv.length && !argv[i + 1]!.startsWith("-")) i++;
@@ -107,7 +112,7 @@ export function analyzeArgs(argv: string[]): Analysis {
   const isSubcmd = firstPositional !== null && NONINTERACTIVE_SUBCMDS.has(firstPositional);
   const forkResume = forkSession && (resumeId !== null || continueLatest);
   const manage = !printMode && !isSubcmd && !invalidSessionArg && !pickerResume && !forkResume && !process.env.TOKENMAXXING_PROBE;
-  return { manage, sessionId, resumeId, continueLatest, streamInput };
+  return { manage, sessionId, resumeId, continueLatest, streamInput, streamOutput };
 }
 
 export function stripSessionFlags(argv: string[]): string[] {
@@ -222,20 +227,34 @@ async function moveExhaustedSeat(seat: Account, sid: string, gate: MarkerGate):
   return true;
 }
 
-async function countdownWait(acct: string, until: number): Promise<boolean> {
+type Say = (terminal: string, text: string) => void;
+
+function systemLine(sid: string, text: string): string {
+  return `${JSON.stringify({ type: "system", subtype: "informational", content: text, level: "warning", uuid: crypto.randomUUID(), session_id: sid })}\n`;
+}
+
+const clockFmt = new Intl.DateTimeFormat("en-US", { hour: "2-digit", minute: "2-digit", hourCycle: "h23", timeZoneName: "short" });
+
+async function countdownWait(acct: string, until: number, out: { stream: boolean; say: Say }): Promise<boolean> {
   let aborted = false;
   const onInt = () => { aborted = true; };
   process.on("SIGINT", onInt);
-  process.stderr.write(`\n\x1b[36m⏳ tokenmaxxing: all accounts at their limit. Resuming on ${acct} when it resets (Ctrl-C to resume now).\x1b[0m\n`);
+  const minutes = Math.max(1, Math.ceil((until - Date.now()) / 60000));
+  out.say(
+    `\n\x1b[36m⏳ tokenmaxxing: all accounts at their limit. Resuming on ${acct} when it resets (Ctrl-C to resume now).\x1b[0m\n`,
+    `tokenmaxxing: all accounts at their limit. Resuming at ${clockFmt.format(until)} (in ${minutes} min) on ${acct}.`,
+  );
   while (!aborted && Date.now() < until) {
-    const left = until - Date.now();
-    const m = Math.floor(left / 60000);
-    const s = Math.floor((left % 60000) / 1000);
-    process.stderr.write(`\r\x1b[36m   resuming in ${m}m ${String(s).padStart(2, "0")}s \x1b[0m`);
+    if (!out.stream) {
+      const left = until - Date.now();
+      const m = Math.floor(left / 60000);
+      const s = Math.floor((left % 60000) / 1000);
+      process.stderr.write(`\r\x1b[36m   resuming in ${m}m ${String(s).padStart(2, "0")}s \x1b[0m`);
+    }
     await Bun.sleep(1000);
   }
   process.removeListener("SIGINT", onInt);
-  process.stderr.write(`\n\x1b[36m↻ resuming on ${acct}...\x1b[0m\n`);
+  out.say(`\n\x1b[36m↻ resuming on ${acct}...\x1b[0m\n`, `tokenmaxxing: resuming on ${acct}.`);
   return aborted;
 }
 
@@ -406,7 +425,14 @@ export async function runSupervisor(argv: string[]): Promise<number> {
   process.on("SIGINT", () => {});
   process.on("SIGHUP", () => {});
 
-  const relay = analyzeArgs(base).streamInput ? new StdinRelay() : null;
+  const effective = analyzeArgs(base);
+  const relay = effective.streamInput ? new StdinRelay() : null;
+  const stream = effective.streamOutput;
+  let noticeSid = sid;
+  const say: Say = (terminal, text) => {
+    if (stream) process.stdout.write(systemLine(noticeSid, text));
+    else process.stderr.write(terminal);
+  };
   let firstLine: string | null = null;
   let respawns = 0;
   let overriddenUntil = 0;
@@ -475,23 +501,24 @@ export async function runSupervisor(argv: string[]): Promise<number> {
     if (m) {
       rmSync(marker, { force: true });
       respawns++;
+      noticeSid = m.sessionId;
       const label = loadAccounts(claudePool).accounts.find((a) => a.id === m.accountId)?.label ?? m.accountId.slice(0, 8);
       const resumable = existsSync(transcriptPath(m.sessionId));
       let compacted = false;
       if (m.compact && seat && resumable) {
-        process.stderr.write(`\n\x1b[36m↻ tokenmaxxing: compacting the conversation on ${seat.label} before the move...\x1b[0m\n`);
+        say(`\n\x1b[36m↻ tokenmaxxing: compacting the conversation on ${seat.label} before the move...\x1b[0m\n`, `tokenmaxxing: compacting the conversation on ${seat.label} before the move.`);
         const compactEnv: Record<string, string | undefined> = { ...childEnv, TOKENMAXXING_PROBE: "1", CLAUDE_SECURESTORAGE_CONFIG_DIR: storeDirFor(seat.id) };
         delete compactEnv.TOKENMAXXING_SUPERVISED;
         delete compactEnv.TOKENMAXXING_SESSION_ID;
         delete compactEnv.TOKENMAXXING_LAUNCHED_AT;
         const outcome = await compactClaudeSession({ real, sid: m.sessionId, env: compactEnv });
         log("supervisor.compact", { sid: m.sessionId.slice(0, 8), seat: seat.id.slice(0, 8), ok: outcome.ok, reason: outcome.ok ? undefined : outcome.reason });
-        if (!outcome.ok) process.stderr.write(`\x1b[33m   compaction did not land (${outcome.reason}) - resuming with the full context\x1b[0m\n`);
+        if (!outcome.ok) say(`\x1b[33m   compaction did not land (${outcome.reason}) - resuming with the full context\x1b[0m\n`, `tokenmaxxing: compaction did not land; resuming with the full context. (${outcome.reason})`);
         compacted = outcome.ok;
       }
       if (m.waitUntil > Date.now()) {
-        if (await countdownWait(label, m.waitUntil)) overriddenUntil = m.waitUntil;
-      } else process.stderr.write(`\n\x1b[36m↻ tokenmaxxing: moving to ${label} - resuming...\x1b[0m\n`);
+        if (await countdownWait(label, m.waitUntil, { stream, say })) overriddenUntil = m.waitUntil;
+      } else say(`\n\x1b[36m↻ tokenmaxxing: moving to ${label} - resuming...\x1b[0m\n`, `tokenmaxxing: moving to ${label} and resuming.`);
       wanted = m.accountId;
       saveSessionFlags(m.sessionId, persistable, process.cwd());
       const prompt = resumable ? resumePrompt(compacted) : null;

package/src/lib/install.ts

@@ -1,5 +1,5 @@
 import { accessSync, appendFileSync, constants, existsSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
-import { basename, dirname, join } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { escape } from "es-toolkit";
 import { z } from "zod";
 import { codexPaths, codexStoreDirFor, HOME, paths } from "./paths.ts";
@@ -343,21 +343,35 @@ function systemdTimerActive(): "active" | "not-active" | "unavailable" {
   }
 }
 
-function uninstallCheckTimer(): boolean {
-  if (skipImperativeTimer()) return true;
+function removeTimerUnits(): void {
+  if (process.platform === "darwin") {
+    rmSync(launchdPlist(), { force: true });
+    return;
+  }
+  rmSync(join(paths.systemdUserDir, "tokenmaxxing-check.timer"), { force: true });
+  rmSync(join(paths.systemdUserDir, "tokenmaxxing-check.service"), { force: true });
+}
+
+type TimerOutcome = "removed" | "skipped" | "still-loaded";
+
+function uninstallCheckTimer(live: boolean): TimerOutcome {
+  if (skipImperativeTimer()) return "skipped";
+  if (!live) {
+    removeTimerUnits();
+    return "removed";
+  }
   if (process.platform === "darwin") {
     const domain = launchdDomain();
     const loaded = launchdJobLoaded();
     const deactivated = loaded === "loaded" && domain != null ? run(["launchctl", "bootout", `${domain}/${LAUNCHD_LABEL}`]) : loaded === "not-loaded";
-    rmSync(launchdPlist(), { force: true });
-    return deactivated;
+    removeTimerUnits();
+    return deactivated ? "removed" : "still-loaded";
   }
   const active = systemdTimerActive();
   const deactivated = active === "active" ? run(["systemctl", "--user", "disable", "--now", "tokenmaxxing-check.timer"]) : active === "not-active";
-  rmSync(join(paths.systemdUserDir, "tokenmaxxing-check.timer"), { force: true });
-  rmSync(join(paths.systemdUserDir, "tokenmaxxing-check.service"), { force: true });
+  removeTimerUnits();
   run(["systemctl", "--user", "daemon-reload"]);
-  return deactivated;
+  return deactivated ? "removed" : "still-loaded";
 }
 
 export function shellRcPath(): string | null {
@@ -448,17 +462,47 @@ export function removePathFromRc(rc: string): boolean {
   return true;
 }
 
-const UninstallOutcomeSchema = z.object({ timerDeactivated: z.boolean(), pathLineRemoved: z.boolean() });
+const UninstallOutcomeSchema = z.object({ timer: z.enum(["removed", "skipped", "still-loaded"]), pathLineRemoved: z.boolean() });
 export type UninstallOutcome = z.infer<typeof UninstallOutcomeSchema>;
 
-export function uninstallSupervisor(): UninstallOutcome {
+export function loginHome(): string {
+  const cmd = process.platform === "darwin" ? ["id", "-P"] : ["getent", "passwd", String(process.getuid?.() ?? "")];
+  const proc = Bun.spawnSync(cmd, { stdout: "pipe", stderr: "ignore", timeout: 10_000 });
+  const home = proc.stdout.toString().trim().split(":").at(-2);
+  if (proc.exitCode !== 0 || home == null || home === "") throw new Error(`cannot read the login home: ${cmd.join(" ")} failed`);
+  return home;
+}
+
+export function onLoginHome(): boolean {
+  return resolve(HOME) === resolve(loginHome());
+}
+
+export function uninstallTargets(live: boolean): string[] {
+  const timer =
+    process.platform === "darwin"
+      ? `${launchdPlist()}${live ? ` (and launchctl bootout gui/${process.getuid?.() ?? "?"}/${LAUNCHD_LABEL})` : ""}`
+      : `${join(paths.systemdUserDir, "tokenmaxxing-check.timer")} and .service${live ? " (and systemctl --user disable --now tokenmaxxing-check.timer)" : ""}`;
+  const rc = shellRcPath();
+  return [
+    `${paths.claudeSettings}: the hook and statusline entries`,
+    `${codexPaths.hooksJson}: the codex Stop hook entry`,
+    ...(skipImperativeTimer() ? [] : [timer]),
+    paths.supervisorLink,
+    codexSupervisorLink(),
+    join(paths.binDir, "xx"),
+    installedBin(),
+    ...(rc == null ? [] : [`${rc}: the ${PATH_LINE_MARK} line`]),
+  ];
+}
+
+export function uninstallSupervisor(input: { liveTimer: boolean }): UninstallOutcome {
   uninstallSettings();
-  const timerDeactivated = uninstallCheckTimer();
+  const timer = uninstallCheckTimer(input.liveTimer);
   uninstallCodexSupervisor();
   for (const f of [paths.supervisorLink, join(paths.binDir, "xx"), installedBin()]) {
     if (existsSync(f)) rmSync(f, { force: true });
   }
   const rc = shellRcPath();
   const pathLineRemoved = rc != null && removePathFromRc(rc);
-  return { timerDeactivated, pathLineRemoved };
+  return { timer, pathLineRemoved };
 }

package/src/main.ts

@@ -25,11 +25,13 @@ import { cmdConfig } from "./cli/config.ts";
 import { cmdSetupToken } from "./cli/setuptoken.ts";
 import { cmdCloudRun } from "./cli/cloudrun.ts";
 import { cmdCursorInit } from "./cli/cursorinit.ts";
-import { timerDeactivationHint, uninstallSupervisor } from "./lib/install.ts";
+import { onLoginHome, timerDeactivationHint, uninstallSupervisor, uninstallTargets } from "./lib/install.ts";
+import { HOME } from "./lib/paths.ts";
 import { c, emitError } from "./cli/render.ts";
 
 const JSON_FLAG = "--json";
 const CACHED_FLAG = "--cached";
+const YES_FLAG = "--yes";
 const CODEX_FLAG = "--codex";
 const GROK_FLAG = "--grok";
 const OPENCODE_GO_FLAG = "--opencode-go";
@@ -54,7 +56,7 @@ function printHelp(): void {
   ${c.cyan("tokenmaxxing doctor")}     verify the install is intact
   ${c.cyan("tokenmaxxing rename")} [--codex | --grok | --opencode-go] <sel> <label>
   ${c.cyan("tokenmaxxing rm")} [--codex | --grok | --opencode-go] <sel>
-  ${c.cyan("tokenmaxxing uninstall")}  remove supervisor + settings entries
+  ${c.cyan("tokenmaxxing uninstall")} [--yes]  print the targets, then remove supervisor + settings entries (refused without ${c.cyan("--yes")} when HOME is the login home)
   ${c.cyan("tokenmaxxing setup-token")} [--print | rm <label|uuid>]  Cursor Cloud only: mint one \`claude setup-token\` per pooled account (browser sign-in each) and print the TOKENMAXXING_TOKENS secret value; ${c.cyan("--print")} prints the stored set, ${c.cyan("rm")} drops one
   ${c.cyan("tokenmaxxing cursor init")} [dir]  write the Claude relay subagent (.cursor/agents/claude.md) and .cursor/environment.json into a repo
   ${c.cyan("tokenmaxxing cloud run")} [--session <id>] [--max-turns <n>] "<prompt>"  on a Cursor Cloud VM: run claude -p on a setup token from TOKENMAXXING_TOKENS, rotate to the next token on a usage limit
@@ -84,13 +86,14 @@ async function main(): Promise<number> {
   jsonMode = argv.includes(JSON_FLAG);
   const json = jsonMode;
   const cached = argv.includes(CACHED_FLAG);
+  const yes = argv.includes(YES_FLAG);
   const providerFlags = [CODEX_FLAG, GROK_FLAG, OPENCODE_GO_FLAG].filter((f) => argv.includes(f));
   if (providerFlags.length > 1) {
     emitError({ json, message: `${providerFlags.join(" and ")} are mutually exclusive - pick one pool` });
     return 2;
   }
   const provider = argv.includes(CODEX_FLAG) ? codex : argv.includes(GROK_FLAG) ? grok : argv.includes(OPENCODE_GO_FLAG) ? opencodeGo : claude;
-  const args = argv.filter((a) => a !== JSON_FLAG && a !== CACHED_FLAG && a !== CODEX_FLAG && a !== GROK_FLAG && a !== OPENCODE_GO_FLAG);
+  const args = argv.filter((a) => a !== JSON_FLAG && a !== CACHED_FLAG && a !== YES_FLAG && a !== CODEX_FLAG && a !== GROK_FLAG && a !== OPENCODE_GO_FLAG);
   const sub = args[0];
 
   if (cached && sub != null && sub !== "status") {
@@ -98,6 +101,11 @@ async function main(): Promise<number> {
     return 2;
   }
 
+  if (yes && sub !== "uninstall") {
+    emitError({ json, message: `${YES_FLAG} applies to uninstall only, not ${sub ?? "status"}` });
+    return 2;
+  }
+
   if (provider === codex && (sub == null || !CODEX_COMMANDS.has(sub))) {
     emitError({ json, message: `${CODEX_FLAG} applies to ${[...CODEX_COMMANDS].join(", ")}, not ${sub ?? "status"}` });
     return 2;
@@ -155,15 +163,25 @@ async function main(): Promise<number> {
       return 2;
     }
     case "uninstall": {
-      const out = uninstallSupervisor();
+      if (args.length > 1) {
+        emitError({ message: `unknown uninstall option: ${args[1]} (uninstall takes only ${YES_FLAG})` });
+        return 2;
+      }
+      const live = onLoginHome();
+      console.log(`uninstall removes:\n${uninstallTargets(live).map((t) => `  ${t}`).join("\n")}`);
+      if (live && !yes) {
+        emitError({ message: `refused: HOME is the login home (${HOME}) - rerun with ${YES_FLAG} to remove these from the live install` });
+        return 2;
+      }
+      const out = uninstallSupervisor({ liveTimer: live });
       const removed = [
         "supervisor wrapper",
         "settings entries",
-        ...(out.timerDeactivated ? ["check timer"] : []),
+        ...(out.timer === "removed" ? ["check timer"] : []),
         ...(out.pathLineRemoved ? ["rc PATH line"] : []),
       ];
       console.log(`removed ${removed.join(", ")}`);
-      if (!out.timerDeactivated) console.log(c.yellow(`⚠ the check job may still be loaded - run: ${timerDeactivationHint()}`));
+      if (out.timer === "still-loaded") console.log(c.yellow(`⚠ the check job may still be loaded - run: ${timerDeactivationHint()}`));
       if (!out.pathLineRemoved) console.log(c.dim("(no tokenmaxxing PATH line found in the shell rc)"));
       console.log(`kept: accounts.json, config.json, and every account credential store (claude: stores/ and its keychain items on macOS; codex: codex-stores/; grok: grok-stores/; opencode-go: opencode-go-stores/) - remove accounts with \`xx rm\` to delete their credentials`);
       return 0;