tokenmaxxing 1.56.0 → 1.58.0

package/DESIGN.md

@@ -31,7 +31,7 @@ It is a process manager only - spawn with inherited stdio (stdin through a relay
 - Five `~/.claude/settings.json` entries (merged - other settings keys are preserved, but the `statusLine` slot is taken over): the tokenmaxxing `statusLine` renderer (native since 2026-07-11; it also tees usage), a `subagentStatusLine` (per-subagent rows in the agents panel), a `Stop` hook, a `StopFailure` hook, a `SessionStart` hook.
 - **`~/.config/tokenmaxxing/`** - the single home for config and state:
   - `config.json` - SPARSE overrides only (thresholds.session/weekly, claudeBin/codexBin/grokBin/opencodeBin pins, policy.*); defaults apply at read time, `xx config` prints the path and the effective values, and edits happen in an editor.
-  - `accounts.json` - non-secret index `{id, label, email, tier, addedAt, windows, lastUsageAt, lastProbeAt, probeFails, storeFails, enforcedUntil, needsReauth, oauthAccount}` (each cached window carries its name, duration, reset, and sample time; the same shape serves the Codex pool as `codex-accounts.json`). `activeId` is `null` for both pools: there is no pool-wide active account.
+  - `accounts.json` - non-secret index `{id, label, email, tier, addedAt, windows, lastUsageAt, lastProbeAt, probeFails, storeFails, enforcedUntil, needsReauth, oauthAccount}` (each cached window carries its name, duration, reset, and sample time; the same shape serves the Codex pool as `codex-accounts.json`). Neither index names an active account: the schema is `{version, accounts}`, and an older file that still carries `activeId` loads and drops the key on the next save.
   - `stores/<uuid8>/` - one Claude Code credential store per pooled account (see below).
   - `codex-stores/<uuid8>/` - one Codex credential store per pooled account: its `auth.json`, with everything else symlinked to the shared `~/.codex` so sessions, history, and config stay shared and `codex resume` works across stores.
   - `usage/<uuid8>.json` - the statusline tee per account, written by the sessions running on it.
@@ -41,7 +41,7 @@ It is a process manager only - spawn with inherited stdio (stdin through a relay
   - `sessions/<sid>.json`, `sample/`, `onboard/`, `setup-tokens.json`, `setup-token/`, `cloud/`, `update.json`, `spawnrate.json`, `tokenmaxxing.log`, the codex `codex-onboard/`, `codex-respawn/`, and `codex-live/`, and the `grok-*` and `opencode-go-*` state of the status-only pools: the full table is in [State directory layout](docs/content/docs/state-directory.mdx).
 - Per-account **credential stores** follow the platform's Claude Code store: macOS = a login-keychain item keyed by the store path (never plaintext on disk); Linux = a 0600 `.credentials.json` inside the 0700 store directory (the same plaintext model claude itself uses - its Linux build has no keyring path at all, binary-verified 2.1.205). One `credstore` facade dispatches on a `{kind: keychain|file}` target; call sites never branch on platform. tokenmaxxing writes a store once, at onboarding; Claude Code's own refresh is the only writer afterwards.
 
-- A periodic check job (`com.tokenmaxxing.check` launchd agent on macOS, `tokenmaxxing-check.timer` systemd user timer on Linux) running `tokenmaxxing check` once per tick (`policy.checkIntervalMs`, 60s by default): it runs the decision with no seat (nothing moves), folds fresh tees into the index, samples up to three accounts whose last sample attempt is oldest (the direct no-spend usage GET first, the `/usage` probe under the store for a near-expiry token or a failed read), and on a Bun global install checks npm for a newer version once a day, so the cached figures every placement reads stay fresh.
+- A periodic check job (`com.tokenmaxxing.check` launchd agent on macOS, `tokenmaxxing-check.timer` systemd user timer on Linux) running `tokenmaxxing check` once per tick (`policy.checkIntervalMs`, 60s by default): it runs the decision with no seat (nothing moves), folds fresh tees into the index, samples up to three accounts whose last sample attempt is oldest (the direct no-spend usage GET first, and for a near-expiry token or a failed read the `/usage` probe under the store to refresh the token, then the GET again), and on a Bun global install checks npm for a newer version once a day, so the cached figures every placement reads stay fresh.
 
 The switching path runs no long-lived daemon. The statusline pushes usage. Hooks and the supervisor react. The periodic check job above is the only recurring process. The `claude` binary, `~/.claude.json`, and Claude Code's default credential store are untouched; inside `~/.claude` only `settings.json` gets the five entries.
 
@@ -50,7 +50,7 @@ The switching path runs no long-lived daemon. The statusline pushes usage. Hooks
 ## 3. How a move happens
 
 ### 3.1 Usage feed (free, push-based)
-The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limits.{five_hour,seven_day}.{used_percentage,resets_at}`, after every turn, 300ms debounce, zero cost). tokenmaxxing's statusLine tees that to `usage/<uuid8>.json` for the session's seat, read from the inherited `CLAUDE_SECURESTORAGE_CONFIG_DIR` (write-on-change, O(ms)), and renders its own native line (it replaced the earlier pass-through delegation on 2026-07-11: install takes the statusLine slot outright, so a pre-existing custom statusline command is overwritten). A session with no pooled seat writes no tee. Fallback when the seat's tee is older than `policy.usagePollTtlMs`, and the per-model read when the active model is a gated family: `claude -p '/usage'` under the seat's store, with a throwaway `CLAUDE_CONFIG_DIR` so no hooks load and `TOKENMAXXING_PROBE=1` in the environment so the hook entries return at once should any load (hooks fire in `-p` too; the compact child sets it as well). The probe scrubs every ambient credential override claude reads before the store (`CLAUDE_CODE_OAUTH_TOKEN`, `CLAUDE_SECURESTORAGE_CONFIG_DIR`, etc.) and then sets the store it means to read. It takes one attempt per interval; a silent result (claude prints local stats with no percentages when its own usage fetch throttles) doubles the interval up to 30 minutes, and a success resets it.
+The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limits.{five_hour,seven_day}.{used_percentage,resets_at}`, after every turn, 300ms debounce, zero cost). tokenmaxxing's statusLine tees that to `usage/<uuid8>.json` for the session's seat, read from the inherited `CLAUDE_SECURESTORAGE_CONFIG_DIR` (write-on-change, O(ms)), and renders its own native line (it replaced the earlier pass-through delegation on 2026-07-11: install takes the statusLine slot outright, so a pre-existing custom statusline command is overwritten). A session with no pooled seat writes no tee. The seat is sampled when its tee is older than `policy.usagePollTtlMs`, and for the per-model rows when the active model is a gated family: the direct no-spend usage read with the seat's stored token, and, when that token is near expiry or the read fails, `claude -p '/usage' --output-format json` under the seat's store, whose output is discarded, then the direct read again with the token Claude Code refreshed into the store. The probe runs with a throwaway `CLAUDE_CONFIG_DIR` so no hooks load and `TOKENMAXXING_PROBE=1` in the environment so the hook entries return at once should any load (hooks fire in `-p` too; the compact child sets it as well). It scrubs every ambient credential override claude reads before the store (`CLAUDE_CODE_OAUTH_TOKEN`, `CLAUDE_SECURESTORAGE_CONFIG_DIR`, etc.) and then sets the store it means to read. The sample takes one attempt per interval; a failed sample doubles the interval up to 30 minutes, and a success resets it.
 
 ### 3.2 Detect + decide + signal (Stop hook, per turn)
 1. Resolve the seat: the pooled account whose store the inherited `CLAUDE_SECURESTORAGE_CONFIG_DIR` names. No seat (a session started outside the supervisor) means nothing to move.
@@ -59,7 +59,7 @@ The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limi
 4. Write `respawn/<session-id>` (atomic temp+rename) naming the target, with `waitUntil` now for a plain move or the soonest reset when the pool is depleted. No credential is written.
 
 ### 3.3 Move and depleted-pool pause (supervisor)
-The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed turn boundary, deletes the marker, resets the terminal, compacts the conversation when the marker asks for it (`compact: true` from the Stop and SessionStart hooks and from the supervisor's own seat watch, `false` from StopFailure: it runs `claude -p --resume <sid> /compact` under the old seat's store, bounded at five minutes, and a failure only prints why), and (when `waitUntil` is in the future) shows an interruptible countdown to the reset; then it relaunches `claude --resume <sid>` with `CLAUDE_SECURESTORAGE_CONFIG_DIR` set to the target's store and rewrites the session's presence. The resumed process reads that store cold → runs on the target account, same conversation. The relaunch submits a first prompt that names the move (and the compaction, when it landed) and asks Claude to continue the task, so the conversation goes on without a keystroke: in a terminal session it is the positional prompt after the session id; in a stream-json session (`--input-format stream-json`, where the binary ignores a positional prompt) the supervisor owns stdin, relays the harness's lines to the child through a pipe, and writes the prompt as the first `user` line of the new process. The supervisor's own notices go to stderr, so a stream-json stdout stays parseable. The `SessionStart` hook (every source) re-runs the decision before the first turn and writes the same marker if the seat is already over its bar or the pool is depleted. The supervisor also watches its own seat every ten seconds while the child runs (account record plus tee, the same bars) and writes the marker itself when the seat is at or over a bar, so a move never depends on a hook firing: a harness session between turns whose background workflow burns the window, or a subagent refusal that stamped the wall, is moved within seconds. SIGTERM to the supervisor is forwarded to the child and the supervisor exits after it, so a harness that stops the wrapper (the Agent SDK does) never leaves an orphaned claude on the old seat. A marker whose `launchedAt` does not match the running child is discarded, and after a Ctrl-C on the countdown a later marker whose `waitUntil` falls inside the skipped wait is ignored. A marker that fails to parse is never deleted and never treated as absent: the supervisor stops the child, restores the terminal, and exits naming the marker path.
+The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed turn boundary, deletes the marker, resets the terminal, compacts the conversation when the marker asks for it (`compact: true` from the Stop and SessionStart hooks and from the supervisor's own seat watch, `false` from StopFailure: it runs `claude -p --resume <sid> /compact` under the old seat's store, bounded at five minutes, and a failure only prints why), and (when `waitUntil` is in the future) shows an interruptible countdown to the reset; then it relaunches `claude --resume <sid>` with `CLAUDE_SECURESTORAGE_CONFIG_DIR` set to the target's store and rewrites the session's presence. The resumed process reads that store cold → runs on the target account, same conversation. The relaunch submits a first prompt that names the move (and the compaction, when it landed) and asks Claude to continue the task, so the conversation goes on without a keystroke: in a terminal session it is the positional prompt after the session id; in a stream-json session (`--input-format stream-json`, where the binary ignores a positional prompt) the supervisor owns stdin, relays the harness's lines to the child through a pipe, and writes the prompt as the first `user` line of the new process. In a terminal session the supervisor's own notices go to stderr. In a stream-json session (`--output-format stream-json`, read from the effective flags like the relay) there is no terminal and no statusline, so the supervisor writes each notice (the compaction and its failure, the move, the depleted-pool wait with its resume time, the resume) to stdout as a `system` line of subtype `informational` and level `warning`, the shape Claude Code emits for its own print-mode notices, which the harness renders in the conversation while the stream stays parseable; the per-second countdown ticks stay terminal-only, and the supervisor writes only while no child is running. The `SessionStart` hook (every source) re-runs the decision before the first turn and writes the same marker if the seat is already over its bar or the pool is depleted. The supervisor also watches its own seat every ten seconds while the child runs (account record plus tee, the same bars) and writes the marker itself when the seat is at or over a bar, so a move never depends on a hook firing: a harness session between turns whose background workflow burns the window, or a subagent refusal that stamped the wall, is moved within seconds. SIGTERM to the supervisor is forwarded to the child and the supervisor exits after it, so a harness that stops the wrapper (the Agent SDK does) never leaves an orphaned claude on the old seat. A marker whose `launchedAt` does not match the running child is discarded, and after a Ctrl-C on the countdown a later marker whose `waitUntil` falls inside the skipped wait is ignored. A marker that fails to parse is never deleted and never treated as absent: the supervisor stops the child, restores the terminal, and exits naming the marker path.
 
 ### 3.4 Placement (supervisor, under the pool lock)
 1. Fold every account's tee into the index.
@@ -84,13 +84,13 @@ Each terminal ran the supervisor, so each has its own child `claude`, its own `-
 The [switching policy](docs/content/docs/switching.mdx) is one rule: under both bars, hold; at or over a bar, move to the usable account that ranks first; nothing usable, wait for the soonest reset. The same ranking places a session at launch.
 
 - Ranking (decided by consult for #79): greatest remaining headroom to the session bar divided by the number of sessions after placement, `(bar - used) / (sessions + 1)`, then highest pace pressure (remaining percent of the binding gated per-model cap, or of the weekly aggregate for an account with no gated row, over time to its reset), then soonest weekly reset, then lowest weekly usage; unknown usage ranks last. Organization membership is not an input. Codex drops the headroom key, keeps the pace ordering and the weekly tie-breaks, and excludes accounts running in another codex session, because codex has no cross-process refresh lock and two sessions must never share a login.
-- Selection reads the cached figures only, after folding every account's tee. Each periodic check tick samples up to three accounts whose last sample attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`, over the direct no-spend usage read with the account's stored token, or the `/usage` child under its store when the token is near expiry or the read fails, so every account is attempted about once per three ticks per pooled account, or once per `policy.usagePollTtlMs` plus a tick when that is longer, and its cached figure is as fresh as its last successful attempt or its sessions' latest push. The pool lock covers only the reservation and the result write, never the read or the `/usage` child.
+- Selection reads the cached figures only, after folding every account's tee. Each periodic check tick samples up to three accounts whose last sample attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`, over the direct no-spend usage read with the account's stored token, and, when the token is near expiry or that read fails, over the `/usage` child under its store followed by the read again with the refreshed token, so every account is attempted about once per three ticks per pooled account, or once per `policy.usagePollTtlMs` plus a tick when that is longer, and its cached figure is as fresh as its last successful attempt or its sessions' latest push. The pool lock covers only the reservation and the result write, never the read or the `/usage` child.
 - The depleted pause happens at the bar, not at 100; Codex has no pause and rides its account until the server refuses it, because a running sibling cannot adopt another account without restarting.
 - Neither pool has a post-swap cooldown or a manual `switch`: a move is a respawn of one session under a fixed store, so nothing another session reads is invalidated by it, and placement at launch replaces the manual pick.
 
 The [profile](docs/content/docs/switching-profile.mdx) records observed cache rewrites across swaps and does not infer subscription quota savings.
 
-**Model-aware trigger.** Claude subscriptions also enforce **per-model weekly caps** - currently only for Sonnet and Fable (there is no Opus-only quota), and Fable's tighter limit binds *before* the aggregate (e.g. 80% week-Fable at only 50% week-all-models). This cap isn't in statusLine stdin, so when the active model is in `policy.switchModels`, or the seat's tee is older than the TTL, we read it from `claude -p '/usage'` under the seat's store (free, 0 tokens, one attempt with backoff) and add `week(<activeModel>) >= threshold` to the trigger. A Fable session moves on the Fable cap; a Sonnet session rides the aggregate. Candidate screening applies the same per-model gate: a burnt Fable cap screens an account out of a move, and a launch, whose model is unknown, gates every configured family.
+**Model-aware trigger.** Claude subscriptions also enforce **per-model weekly caps** - currently only for Sonnet and Fable (there is no Opus-only quota), and Fable's tighter limit binds *before* the aggregate (e.g. 80% week-Fable at only 50% week-all-models). This cap isn't in statusLine stdin, so when the active model is in `policy.switchModels`, or the seat's tee is older than the TTL, we read it from the `limits[]` rows of the direct no-spend usage read for the seat (free, 0 tokens, one attempt with backoff, with the `/usage` probe under the seat's store refreshing the token when the read needs it) and add `week(<activeModel>) >= threshold` to the trigger. A Fable session moves on the Fable cap; a Sonnet session rides the aggregate. Candidate screening applies the same per-model gate: a burnt Fable cap screens an account out of a move, and a launch, whose model is unknown, gates every configured family.
 
 ---
 
@@ -132,7 +132,7 @@ TypeScript on Bun, shipped as source: one multi-call entry (`src/main.ts`, `#!/u
 
 ### 2026-09-12 (per-account stores, 1.37.0)
 
-Hermetic run on Linux under a throwaway `HOME` and `TOKENMAXXING_HOME`, a stub `claude` that records its environment and answers `-p /usage` from a per-store fixture, and a synthetic three-account version 2 pool with equal headroom on two accounts and the third over its session bar:
+Hermetic run on Linux under a throwaway `HOME` and `TOKENMAXXING_HOME`, a stub `claude` that records its environment and answers `-p /usage` from a per-store fixture, and a synthetic three-account version 2 pool with equal headroom on two accounts and the third over its session bar. Usage no longer comes from that output, so repeating the run against the current code needs two other pieces: a stub usage endpoint named by `TOKENMAXXING_OAUTH_USAGE_URL` that answers per access token, and a stub `claude` whose `-p /usage` run leaves a credential in the store with an access token that is not near expiry.
 
 1. **Placement - ✅.** The first supervised launch spawned the stub with `CLAUDE_SECURESTORAGE_CONFIG_DIR=stores/<first account>` and wrote its presence; the second launch, with equal headroom, landed on the other account.
 2. **Plain move - ✅.** A 95% session tee for the second session's account made its Stop hook write the marker; the supervisor relaunched `--resume <sid>` under the first account's store within a second and rewrote the presence file.

package/README.md

@@ -84,13 +84,13 @@ claude                  # use claude as always; each session gets its own accoun
 Each session runs on its own seat. One rule: while the seat is under its bars, nothing happens; once it is at or over a bar, the session moves to the usable account that ranks first. The session bar is `thresholds.session` (90) minus `policy.projectionMargin` (3), so **87%** of the 5-hour window by default, and the weekly bar is **98%**. The bars also screen candidates on any of:
 
 - **Session** (5-hour) or **week (all models)** - the aggregate windows, fed free/push-based by the statusLine into one tee per account.
-- **Per-model weekly cap** - the most capable model (Fable) has its own tighter weekly limit that binds *before* the aggregate (per-model caps currently exist only for Sonnet and Fable, and Sonnet's is generous). tokenmaxxing reads it from `claude -p '/usage'` under the seat's store (free, 0 tokens, one attempt per interval) whenever the seat's tee is older than `policy.usagePollTtlMs` or the active model is one of `policy.switchModels`, backing off after silent probes, so a Fable session moves on the Fable cap while a Sonnet session rides the aggregate.
+- **Per-model weekly cap** - the most capable model (Fable) has its own tighter weekly limit that binds *before* the aggregate (per-model caps currently exist only for Sonnet and Fable, and Sonnet's is generous). tokenmaxxing reads it from the direct no-spend usage read for the seat (free, 0 tokens, one attempt per interval) whenever the seat's tee is older than `policy.usagePollTtlMs` or the active model is one of `policy.switchModels`, backing off after a failed sample, so a Fable session moves on the Fable cap while a Sonnet session rides the aggregate.
 
 The bars' headroom is deliberate: it's the budget to reach a clean turn boundary before the account's real limit. The session bar sits lower (90, minus the margin) because a 5-hour reset is cheap to sit out; weekly quota is use-it-or-lose-it, so it drains closer to the limit (98).
 
 Launches and moves rank usable accounts by session-window headroom per running session, `(bar - used) / (sessions + 1)`, so two fresh accounts alternate and a third session goes to whichever has more headroom left per session; ties break by pace pressure (remaining percent of the binding gated per-model cap, or of the weekly aggregate for an account with no gated row, divided by time to its reset, highest first), then soonest weekly reset, then lowest weekly use. Organization membership is not an input.
 
-- Every periodic check tick folds fresh statusline tees into the index and samples up to three accounts whose last sample attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`: the direct no-spend usage read first, and `claude -p '/usage'` under the account's store only for a near-expiry token or a failed read; a move reads the cached figures, which are as fresh as each account's last successful attempt or its sessions' latest push.
+- Every periodic check tick folds fresh statusline tees into the index and samples up to three accounts whose last sample attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`: the direct no-spend usage read first, and, only for a near-expiry token or a failed read, `claude -p '/usage'` under the account's store to refresh the token, followed by that read again; a move reads the cached figures, which are as fresh as each account's last successful attempt or its sessions' latest push.
 - When no account is usable, the session pauses until the soonest reset if that lands within `policy.maxWaitMs`, and otherwise stays put.
 
 See [How switching decides](docs/content/docs/switching.mdx) for the policy and the [cache-cost profile](docs/content/docs/switching-profile.mdx) for measurements and their limits.
@@ -112,7 +112,7 @@ See [How switching decides](docs/content/docs/switching.mdx) for the policy and
 }
 ```
 
-`thresholds.session` and `thresholds.weekly` are the two bars, one number each (an array `thresholds.session`, the former ladder, fails config loading with a message naming the field); `projectionMargin` is a fixed safety margin subtracted from the session bar only (default 3), so a large turn is less likely to blow past the 5-hour bar between checks; the weekly bar takes no margin because one turn cannot overshoot a week; `switchModels` names the models whose per-model cap triggers a move; `usagePollTtlMs` is how long a `/usage` attempt stays fresh, for a seat's probe and for the accounts each check tick samples; `maxWaitMs` bounds the depleted-pool countdown - a soonest reset further out than this does not pause the session (no respawn marker is written and the session simply keeps hitting its limit until an account recovers); `checkIntervalMs` is the periodic check tick (default 60s), which `init` writes into the timer - re-run `tokenmaxxing init` after changing it so the timer unit picks up the new tick. `claudeBin`, `codexBin`, `grokBin`, and `opencodeBin` pin the real binaries; `init` writes them, and `TOKENMAXXING_CLAUDE_BIN`, `TOKENMAXXING_CODEX_BIN`, `TOKENMAXXING_GROK_BIN`, and `TOKENMAXXING_OPENCODE_BIN` override them for one process, except that `init` pins the binary it resolved into `config.json`.
+`thresholds.session` and `thresholds.weekly` are the two bars, one number each (an array `thresholds.session`, the former ladder, fails config loading with a message naming the field); `projectionMargin` is a fixed safety margin subtracted from the session bar only (default 3), so a large turn is less likely to blow past the 5-hour bar between checks; the weekly bar takes no margin because one turn cannot overshoot a week; `switchModels` names the models whose per-model cap triggers a move; `usagePollTtlMs` is how long a usage sample stays fresh, for a seat's own sample and for the accounts each check tick samples; `maxWaitMs` bounds the depleted-pool countdown - a soonest reset further out than this does not pause the session (no respawn marker is written and the session simply keeps hitting its limit until an account recovers); `checkIntervalMs` is the periodic check tick (default 60s), which `init` writes into the timer - re-run `tokenmaxxing init` after changing it so the timer unit picks up the new tick. `claudeBin`, `codexBin`, `grokBin`, and `opencodeBin` pin the real binaries; `init` writes them, and `TOKENMAXXING_CLAUDE_BIN`, `TOKENMAXXING_CODEX_BIN`, `TOKENMAXXING_GROK_BIN`, and `TOKENMAXXING_OPENCODE_BIN` override them for one process, except that `init` pins the binary it resolved into `config.json`.
 
 State lives in `~/.config/tokenmaxxing/`; outside it the install touches Claude Code's `settings.json`, codex's `hooks.json`, the timer unit, and your shell rc. Each account's credential store is `stores/<uuid8>/`, which Claude Code reads and refreshes as its own: on macOS the credential is a login-keychain item keyed by the store path (never plaintext on disk), on Linux a 0600 `.credentials.json` inside the store (the same plaintext model claude itself uses for `~/.claude/.credentials.json`).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.56.0",
+  "version": "1.58.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts, start each session on its own account, and resume a session on a fresher account when quota fills.",
   "type": "module",
   "license": "MIT",

package/src/cli/auth.ts

@@ -1,5 +1,4 @@
 import { partition } from "es-toolkit";
-import { z } from "zod";
 import { withLock } from "../lib/lock.ts";
 import type { Provider } from "../lib/provider.ts";
 import { loadAccounts, saveAccounts, upsertAccount } from "../lib/state.ts";
@@ -10,13 +9,7 @@ import type { Account, AccountsIndex } from "../lib/types.ts";
 
 const AUTH_USAGE = "usage: tokenmaxxing auth [--codex | --grok | --opencode-go] [<email|label|id> | --all]";
 
-const AuthPlanSchema = z.discriminatedUnion("kind", [
-  z.object({ kind: z.literal("usage") }),
-  z.object({ kind: z.literal("error"), message: z.string() }),
-  z.object({ kind: z.literal("pick") }),
-  z.object({ kind: z.literal("targets"), ids: z.array(z.string()) }),
-]);
-export type AuthPlan = z.infer<typeof AuthPlanSchema>;
+export type AuthPlan = { kind: "usage" } | { kind: "error"; message: string } | { kind: "pick" } | { kind: "targets"; ids: string[] };
 
 export function planAuth(input: { p: Provider; accounts: Account[]; argv: string[]; needsAuth: Set<string> }): AuthPlan {
   const all = input.argv.includes("--all");
@@ -45,7 +38,6 @@ function askWhichAccount(idx: AccountsIndex, needsAuth: Set<string>): Account |
   console.log("which account do you want to reauthenticate?");
   for (const [i, a] of ordered.entries()) {
     const flags: string[] = [];
-    if (a.id === idx.activeId) flags.push(c.green("active"));
     if (a.needsReauth) flags.push(c.red("needs-reauth"));
     else if (needsAuth.has(a.id)) flags.push(c.red("no-credential"));
     const labelNote = a.email != null && a.label !== a.email ? ` (${a.label})` : "";
@@ -84,7 +76,7 @@ async function reauthOne(p: Provider, target: Account): Promise<boolean> {
     return false;
   }
 
-  const result = await withLock(p.pool.lockFile, async () => {
+  const account = await withLock(p.pool.lockFile, async () => {
     const idx = loadAccounts(p.pool);
     if (!idx.accounts.some((a) => a.id === target.id)) {
       console.error(c.red(`${target.label} was removed from the pool while the login was open - nothing written; re-add it with \`tokenmaxxing add${p.flag}\` if wanted`));
@@ -93,15 +85,12 @@ async function reauthOne(p: Provider, target: Account): Promise<boolean> {
     await harvested.park();
     const account = upsertAccount(idx, harvested, p.mergeWindows);
     saveAccounts(p.pool, idx);
-    return { account, isActive: idx.activeId === target.id };
+    return account;
   });
-  if (result === null) return false;
+  if (account === null) return false;
 
-  const note = harvested.sample ? usageNote(result.account) : "";
-  console.log(`${c.green("✓")} reauthed ${c.bold(result.account.email ?? result.account.label)} (${result.account.tier ?? "?"})${note}`);
-  if (result.isActive) {
-    console.log(c.dim("this account has a running session: it keeps its current login until it respawns."));
-  }
+  const note = harvested.sample ? usageNote(account) : "";
+  console.log(`${c.green("✓")} reauthed ${c.bold(account.email ?? account.label)} (${account.tier ?? "?"})${note}`);
   return true;
 }
 

package/src/cli/check.ts

@@ -3,7 +3,7 @@ import { evaluateAndMaybeSwap } from "../lib/decide.ts";
 import { sampleOldest } from "../lib/sample.ts";
 import { loadConfig } from "../lib/state.ts";
 import { maybeAutoUpdate } from "../lib/update.ts";
-import { log } from "../lib/log.ts";
+import { errorMessage, log } from "../lib/log.ts";
 import { c, emitError, emitJson, fmtReset } from "./render.ts";
 
 export async function cmdCheck(json = false): Promise<number> {
@@ -14,7 +14,7 @@ export async function cmdCheck(json = false): Promise<number> {
     await sampleOldest(loadConfig());
     await maybeAutoUpdate();
   } catch (e) {
-    const detail = e instanceof Error ? e.message : String(e);
+    const detail = errorMessage(e);
     log("check.error", { err: detail });
     emitError({ json, message: `check failed: ${detail}` });
     return 1;

package/src/cli/cloudrun.ts

@@ -1,4 +1,6 @@
+import { parseArgs } from "node:util";
 import { withLock } from "../lib/lock.ts";
+import { errorMessage } from "../lib/log.ts";
 import { paths } from "../lib/paths.ts";
 import {
   limitWallUntil,
@@ -17,26 +19,17 @@ import { c, emitError, fmtReset } from "./render.ts";
 const USAGE = "usage: tokenmaxxing cloud run [--session <id>] [--max-turns <n>] \"<prompt>\" (the prompt is also read from stdin)";
 
 function parseFlags(args: string[]): { session: string | null; maxTurns: number | null; prompt: string | null } | { error: string } {
-  let session: string | null = null;
-  let maxTurns: number | null = null;
-  const positional: string[] = [];
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i]!;
-    if (arg === "--session") {
-      const raw = args[++i];
-      if (raw == null || raw === "") return { error: "--session needs a session id" };
-      session = raw;
-      continue;
-    }
-    if (arg === "--max-turns") {
-      const raw = args[++i];
-      maxTurns = Number(raw);
-      if (!Number.isInteger(maxTurns) || maxTurns < 1) return { error: `--max-turns needs a positive whole number, got: ${raw ?? "nothing"}` };
-      continue;
-    }
-    positional.push(arg);
+  let parsed;
+  try {
+    parsed = parseArgs({ args, options: { session: { type: "string" }, "max-turns": { type: "string" } }, allowPositionals: true });
+  } catch (e) {
+    return { error: errorMessage(e) };
   }
-  return { session, maxTurns, prompt: positional.length > 0 ? positional.join(" ") : null };
+  const { session, "max-turns": rawTurns } = parsed.values;
+  if (session === "") return { error: "--session needs a session id" };
+  const maxTurns = rawTurns == null ? null : Number(rawTurns);
+  if (maxTurns != null && (!Number.isInteger(maxTurns) || maxTurns < 1)) return { error: `--max-turns needs a positive whole number, got: ${rawTurns}` };
+  return { session: session ?? null, maxTurns, prompt: parsed.positionals.length > 0 ? parsed.positionals.join(" ") : null };
 }
 
 export async function cmdCloudRun(args: string[]): Promise<number> {

package/src/cli/config.ts

@@ -1,3 +1,4 @@
+import { errorMessage } from "../lib/log.ts";
 import { paths } from "../lib/paths.ts";
 import { loadConfig } from "../lib/state.ts";
 import type { Config } from "../lib/types.ts";
@@ -12,7 +13,7 @@ export function cmdConfig(args: string[], json = false): number {
   try {
     effective = loadConfig();
   } catch (e) {
-    emitError({ json, message: e instanceof Error ? e.message : String(e), extra: { path: paths.configJson } });
+    emitError({ json, message: errorMessage(e), extra: { path: paths.configJson } });
     return 1;
   }
   if (json) {

package/src/cli/doctor.ts

@@ -2,6 +2,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { verifyRealClaude } from "../lib/claudebin.ts";
 import { checkSettings, installedBin } from "../lib/settings.ts";
 import { checkTimerHealthy, codexStoreHookTrust, findClaudeShadowers, isBinDirAhead, shellRcPath, timerActivationHint } from "../lib/install.ts";
+import { errorMessage } from "../lib/log.ts";
 import { claudePool, codexPool, paths } from "../lib/paths.ts";
 import { loadAccounts, loadConfig } from "../lib/state.ts";
 import { readStore } from "../lib/credstore.ts";
@@ -39,7 +40,7 @@ export async function cmdDoctor(): Promise<number> {
     try {
       creds = await readStore(a.id);
     } catch (e) {
-      check(false, `store credential readable for ${a.label}`, (e instanceof Error ? e.message : String(e)).slice(0, 100));
+      check(false, `store credential readable for ${a.label}`, errorMessage(e).slice(0, 100));
       continue;
     }
     check(creds != null, `store credential present for ${a.label}`, `run \`tokenmaxxing auth ${a.label}\``);
@@ -51,7 +52,7 @@ export async function cmdDoctor(): Promise<number> {
           const identity = await fetchTokenIdentity(creds.accessToken);
           check(identity.accountUuid === a.id, `store credential identity matches ${a.label}`, `token belongs to ${describeIdentity(identity)} - run \`tokenmaxxing auth ${a.label}\``);
         } catch (e) {
-          check(false, `store credential identity matches ${a.label}`, (e instanceof Error ? e.message : String(e)).slice(0, 100));
+          check(false, `store credential identity matches ${a.label}`, errorMessage(e).slice(0, 100));
         }
       }
     }
@@ -68,7 +69,7 @@ export async function cmdDoctor(): Promise<number> {
     try {
       auth = readCodexStoreAuth(a.id);
     } catch (e) {
-      authErr = (e instanceof Error ? e.message : String(e)).slice(0, 100);
+      authErr = errorMessage(e).slice(0, 100);
     }
     check(auth != null, `codex store credential present for ${a.label}`, authErr ?? `run \`tokenmaxxing auth --codex ${a.label}\``);
     if (auth) {
@@ -78,7 +79,7 @@ export async function cmdDoctor(): Promise<number> {
         match = codexIdentityOf({ auth }).accountId === a.id;
         if (!match) matchHint = `store credential belongs to another account - ${matchHint}`;
       } catch (e) {
-        matchHint = (e instanceof Error ? e.message : String(e)).slice(0, 100);
+        matchHint = errorMessage(e).slice(0, 100);
       }
       check(match, `codex store credential identity matches ${a.label}`, matchHint);
     }

package/src/cli/init.ts

@@ -38,7 +38,6 @@ export async function cmdInit(p: Provider): Promise<number> {
     await harvested.park();
     const idx = loadAccounts(p.pool);
     const imported = upsertAccount(idx, harvested, p.mergeWindows);
-    idx.activeId = null;
     saveAccounts(p.pool, idx);
     return imported;
   });

package/src/cli/render.ts

@@ -14,6 +14,11 @@ export function makeColors(enabled: boolean) {
 
 export const c = makeColors(!process.env.NO_COLOR && !!process.stdout.isTTY);
 
+export function statuslineColor(): { color: boolean; truecolor: boolean } {
+  const colorterm = process.env.COLORTERM ?? "";
+  return { color: !process.env.NO_COLOR, truecolor: colorterm.includes("truecolor") || colorterm.includes("24bit") };
+}
+
 function rampRgb(usedPct: number): { r: number; g: number } {
   const u = clamp(usedPct, 0, 100);
   if (u >= 95) return { r: 255, g: 0 };
@@ -46,23 +51,33 @@ export function bar(pct: number, width = 16): string {
   return `${paint(body)} ${label}`;
 }
 
+function splitDuration(ms: number): { dsec: number; d: number; h: number; m: number } {
+  const dsec = Math.round(ms / 1000);
+  return { dsec, d: Math.floor(dsec / 86400), h: Math.floor((dsec % 86400) / 3600), m: Math.floor((dsec % 3600) / 60) };
+}
+
 export function fmtReset(epochMs: number | null | undefined, now = Date.now()): string {
   if (epochMs == null) return "";
-  const dsec = Math.round((epochMs - now) / 1000);
+  const { dsec, d, h, m } = splitDuration(epochMs - now);
   if (dsec <= 0) return "reset now";
-  const h = Math.floor(dsec / 3600);
-  const m = Math.floor((dsec % 3600) / 60);
-  if (h > 24) return `resets in ${Math.floor(h / 24)}d${h % 24}h`;
-  if (h > 0) return `resets in ${h}h${m}m`;
+  const hours = d * 24 + h;
+  if (hours > 24) return `resets in ${d}d${h}h`;
+  if (hours > 0) return `resets in ${hours}h${m}m`;
   return `resets in ${m}m`;
 }
 
+export function fmtResetShort(epochMs: number | null | undefined, now = Date.now()): string {
+  if (epochMs == null) return "";
+  const { dsec, d, h, m } = splitDuration(epochMs - now);
+  if (dsec <= 0) return "";
+  if (d > 0) return `${d}d`;
+  if (h > 0) return `${h}h`;
+  return `${Math.max(m, 1)}m`;
+}
+
 export function fmtAgo(epochMs: number, now = Date.now()): string {
-  const dsec = Math.max(0, Math.round((now - epochMs) / 1000));
+  const { dsec, d, h, m } = splitDuration(now - epochMs);
   if (dsec < 60) return "just now";
-  const d = Math.floor(dsec / 86400);
-  const h = Math.floor((dsec % 86400) / 3600);
-  const m = Math.floor((dsec % 3600) / 60);
   if (d > 0) return `${d}d ago`;
   if (h > 0) return `${h}h ago`;
   return `${m}m ago`;

package/src/cli/rm.ts

@@ -16,10 +16,6 @@ export async function cmdRm(p: Provider, selector?: string): Promise<number> {
       emitError({ message: `no account matches "${selector}"` });
       return 1;
     }
-    if (a.id === idx.activeId) {
-      emitError({ message: `${a.label} is the ACTIVE account - switch away before removing it.` });
-      return 1;
-    }
     if (p.liveId() === a.id) {
       emitError({ message: `${a.label} is the ${p.name} login this command runs under - remove it from a session on another account.` });
       return 1;

package/src/cli/status.ts

@@ -1,5 +1,4 @@
 import { chunk, sortBy } from "es-toolkit";
-import { z } from "zod";
 import { claude } from "../lib/claude.ts";
 import { codex } from "../lib/codex.ts";
 import { grok } from "../lib/grok.ts";
@@ -10,53 +9,34 @@ import { codexPool, grokPool, opencodeGoPool } from "../lib/paths.ts";
 import { earliestReset, gatedWindows, isExhausted, isSessionWindow, limitWindows, liveUsed, nextWeeklyReset, sessionWindow, thresholdBars, weeklyWindow } from "../lib/picker.ts";
 import type { Provider, SampleReport } from "../lib/provider.ts";
 import { bar, c, count, emitJson, fmtAgo } from "./render.ts";
-import { ThresholdsSchema, type Account, type Config, type Window } from "../lib/types.ts";
+import type { Account, Config, Thresholds, Window } from "../lib/types.ts";
 
-const SampleReportSchema = z.discriminatedUnion("ok", [
-  z.object({ ok: z.literal(true), source: z.enum(["statusline", "probe", "cached"]) }),
-  z.object({ ok: z.literal(false), reason: z.string() }),
-]);
+type WindowReport = { usedPercentage: number; resetsAt: number | null; windowSeconds: number | null };
 
-const WindowReportSchema = z.object({
-  usedPercentage: z.number(),
-  resetsAt: z.number().nullable(),
-  windowSeconds: z.number().nullable(),
-});
-type WindowReport = z.infer<typeof WindowReportSchema>;
+type StatusAccount = {
+  label: string;
+  email: string | null;
+  id: string;
+  tier: string | null;
+  active: boolean;
+  sessions: number;
+  needsReauth: boolean;
+  exhausted: boolean;
+  usage: { fiveHour: WindowReport | null; week: WindowReport | null; limits: (WindowReport & { name: string })[] } | null;
+  usageAt: number | null;
+  limitsAt: number | null;
+  sample: SampleReport | { ok: true; source: "cached" };
+};
 
-const StatusAccountSchema = z.object({
-  label: z.string(),
-  email: z.string().nullable(),
-  id: z.string(),
-  tier: z.string().nullable(),
-  active: z.boolean(),
-  sessions: z.number(),
-  needsReauth: z.boolean(),
-  exhausted: z.boolean(),
-  usage: z
-    .object({
-      fiveHour: WindowReportSchema.nullable(),
-      week: WindowReportSchema.nullable(),
-      limits: z.array(WindowReportSchema.extend({ name: z.string() })),
-    })
-    .nullable(),
-  usageAt: z.number().nullable(),
-  limitsAt: z.number().nullable(),
-  sample: SampleReportSchema,
-});
-type StatusAccount = z.infer<typeof StatusAccountSchema>;
+type PoolReport = {
+  thresholds: Thresholds;
+  bars: Thresholds;
+  projectionMargin: number;
+  gatedNote: string | null;
+  accounts: StatusAccount[];
+};
 
-const PoolReportSchema = z.object({
-  thresholds: ThresholdsSchema,
-  bars: ThresholdsSchema,
-  projectionMargin: z.number(),
-  gatedNote: z.string().nullable(),
-  accounts: z.array(StatusAccountSchema),
-});
-type PoolReport = z.infer<typeof PoolReportSchema>;
-
-const StatusReportSchema = z.object({ now: z.number(), claude: PoolReportSchema, codex: PoolReportSchema, grok: PoolReportSchema, opencodeGo: PoolReportSchema });
-export type StatusReport = z.infer<typeof StatusReportSchema>;
+export type StatusReport = { now: number; claude: PoolReport; codex: PoolReport; grok: PoolReport; opencodeGo: PoolReport };
 
 function currentWindow(w: Window, now: number): WindowReport {
   const passed = w.resetsAt != null && w.resetsAt <= now;
@@ -104,23 +84,20 @@ function gatedNote(accounts: Account[], families: string[] | null, weeklyBar: nu
 async function collect(p: Provider, cfg: Config, now: number, cached: boolean): Promise<PoolReport> {
   let idx = loadAccounts(p.pool);
   let reports = new Map<string, SampleReport>();
-  let liveId: string | null = p.seats === "live" ? idx.activeId : null;
-  if (!cached) {
-    liveId = null;
-    if (idx.accounts.length > 0) {
-      await withLock(p.pool.lockFile, async () => {
-        idx = loadAccounts(p.pool);
-        console.error(c.dim(`sampling ${p.name} usage...`));
-        liveId = p.liveId();
-        reports = await p.samplePool(idx.accounts, liveId, now);
-        saveAccounts(p.pool, idx);
-      });
-    }
+  let liveId: string | null = null;
+  if (!cached && idx.accounts.length > 0) {
+    await withLock(p.pool.lockFile, async () => {
+      idx = loadAccounts(p.pool);
+      console.error(c.dim(`sampling ${p.name} usage...`));
+      liveId = p.liveId();
+      reports = await p.samplePool(idx.accounts, liveId, now);
+      saveAccounts(p.pool, idx);
+    });
   }
 
   const bars = thresholdBars(cfg);
   const present = p.presence();
-  const ctx = { now, thresholds: bars, currentId: idx.activeId, families: p.gatedFamilies(cfg), seats: null };
+  const ctx = { now, thresholds: bars, currentId: null, families: p.gatedFamilies(cfg), seats: null };
   const ordered = sortBy(idx.accounts, [(a) => (a.needsReauth ? 1 : 0), (a) => earliestReset(a, now)]);
   const accounts = ordered.map((a): StatusAccount => {
     const limits = limitWindows(a);

package/src/entries/codexstophook.ts

@@ -1,7 +1,7 @@
 import { join } from "node:path";
 import { mkdirSync } from "node:fs";
-import { z } from "zod";
-import { codexPaths } from "../lib/paths.ts";
+import type { z } from "zod";
+import { codexPaths, optionalEnv } from "../lib/paths.ts";
 import { writeFileAtomic } from "../lib/atomic.ts";
 import { MAX_WRAP_DEPTH, WRAP_DEPTH_ENV } from "../lib/claudebin.ts";
 import { codex, codexPickCtx } from "../lib/codex.ts";
@@ -9,12 +9,11 @@ import { resolveRealCodex } from "../lib/codexbin.ts";
 import { compactCodexThread } from "../lib/compact.ts";
 import { evaluateAndMaybeSwap } from "../lib/decide.ts";
 import { isExhausted } from "../lib/picker.ts";
+import { readStdin } from "../lib/proc.ts";
 import { loadAccounts, loadConfig } from "../lib/state.ts";
 import { CODEX_SUPERVISOR_ID_ENV } from "./codexsupervisor.ts";
 import { CodexRespawnMarkerSchema, CodexStopStdinSchema, JsonTextSchema } from "../lib/types.ts";
-import { log } from "../lib/log.ts";
-
-const SupervisorIdSchema = z.string().min(1).optional().catch(undefined);
+import { errorMessage, log } from "../lib/log.ts";
 
 async function compactBeforeMove(input: { sessionId: string | null; now: number }): Promise<void> {
   const { sessionId, now } = input;
@@ -30,18 +29,12 @@ async function compactBeforeMove(input: { sessionId: string | null; now: number
   await compactCodexThread({ real: resolveRealCodex(), threadId: sessionId, env });
 }
 
-async function readStdin(): Promise<string> {
-  const chunks: Uint8Array[] = [];
-  for await (const chunk of Bun.stdin.stream()) chunks.push(chunk);
-  return Buffer.concat(chunks).toString("utf8");
-}
-
-export async function handleCodexStop(input: { rawStdin: string }): Promise<void> {
-  const parsed = CodexStopStdinSchema.safeParse(JsonTextSchema.safeParse(input.rawStdin).data);
+async function handleCodexStop(rawStdin: string): Promise<void> {
+  const parsed = CodexStopStdinSchema.safeParse(JsonTextSchema.safeParse(rawStdin).data);
   const sessionId = parsed.success ? (parsed.data.session_id ?? null) : null;
 
   try {
-    const supervisorId = SupervisorIdSchema.parse(process.env[CODEX_SUPERVISOR_ID_ENV]);
+    const supervisorId = optionalEnv(CODEX_SUPERVISOR_ID_ENV);
     if (supervisorId === undefined) {
       log("codexstop.unsupervised_skip", {});
       return;
@@ -51,24 +44,18 @@ export async function handleCodexStop(input: { rawStdin: string }): Promise<void
     const decision = await evaluateAndMaybeSwap(codex, now);
     if (decision.swapped && decision.account) {
       mkdirSync(codexPaths.respawnDir, { recursive: true });
-      const payload = CodexRespawnMarkerSchema.parse({
-        accountId: decision.account.id,
-        sessionId,
-        ts: Date.now(),
-      });
+      const payload: z.infer<typeof CodexRespawnMarkerSchema> = { accountId: decision.account.id, sessionId, ts: Date.now() };
       writeFileAtomic(join(codexPaths.respawnDir, supervisorId), JSON.stringify(payload));
       log("codexstop.marker", { supervisorId: supervisorId.slice(0, 8) });
       return;
     }
   } catch (e) {
-    log("codexstop.error", { err: e instanceof Error ? e.message : String(e) });
+    log("codexstop.error", { err: errorMessage(e) });
   }
 }
 
 export async function runCodexStopHook(): Promise<number> {
-  if (!process.env.TOKENMAXXING_PROBE) {
-    await handleCodexStop({ rawStdin: await readStdin() });
-  }
+  if (!process.env.TOKENMAXXING_PROBE) await handleCodexStop(await readStdin());
   process.stdout.write("{}");
   return 0;
 }