tokenmaxxing 1.56.0 → 1.58.0

package/src/lib/codexusage.ts

@@ -1,7 +1,8 @@
 import { z } from "zod";
 import { http, safeErrorDetail } from "./http.ts";
+import { errorMessage } from "./log.ts";
 import { env } from "./paths.ts";
-import { CodexUsageSchema, JsonTextSchema, type CodexAuthJson, type CodexUsage, type Window } from "./types.ts";
+import { JsonTextSchema, type CodexAuthJson, type CodexUsage, type Window } from "./types.ts";
 import { codexIdentityOf } from "./codexauth.ts";
 import { familyTokens } from "./usage.ts";
 
@@ -63,8 +64,7 @@ export async function fetchCodexUsage(input: { auth: CodexAuthJson; at: number }
       },
     });
   } catch (e) {
-    const message = e instanceof Error ? e.message : String(e);
-    throw new CodexUsageReadError(`endpoint unreachable: ${message}`);
+    throw new CodexUsageReadError(`endpoint unreachable: ${errorMessage(e)}`);
   }
   const text = await res.text();
   if (!res.ok) {
@@ -76,7 +76,7 @@ export async function fetchCodexUsage(input: { auth: CodexAuthJson; at: number }
   }
   const wire = parsed.data;
 
-  return CodexUsageSchema.parse({
+  return {
     accountId: wire.account_id,
     email: wire.email ?? null,
     planType: wire.plan_type ?? null,
@@ -84,7 +84,7 @@ export async function fetchCodexUsage(input: { auth: CodexAuthJson; at: number }
       ...toWindows(wire.rate_limit, null, at),
       ...(wire.additional_rate_limits ?? []).flatMap((row) => toWindows(row.rate_limit, row.limit_name, at)),
     ],
-  });
+  };
 }
 
 const LIMIT_LABEL_ABBREVIATIONS = new Map([["reserve", "rsrv"]]);

package/src/lib/compact.ts

@@ -2,14 +2,11 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { delay } from "es-toolkit";
 import { z } from "zod";
-import { log } from "./log.ts";
+import { errorMessage, log } from "./log.ts";
+import { readLines } from "./proc.ts";
 import { JsonTextSchema } from "./types.ts";
 
-const CompactOutcomeSchema = z.discriminatedUnion("ok", [
-  z.object({ ok: z.literal(true) }),
-  z.object({ ok: z.literal(false), reason: z.string() }),
-]);
-export type CompactOutcome = z.infer<typeof CompactOutcomeSchema>;
+export type CompactOutcome = { ok: true } | { ok: false; reason: string };
 
 export const CLAUDE_COMPACT_KILL_MS = 300_000;
 const PIPE_GRACE_MS = 2_000;
@@ -108,20 +105,10 @@ export async function compactCodexThread(input: { real: string; threadId: string
       }
     };
     (async () => {
-      let buffered = "";
-      for await (const chunk of p.stdout) {
-        buffered += Buffer.from(chunk).toString("utf8");
-        let nl = buffered.indexOf("\n");
-        while (nl >= 0) {
-          onLine(buffered.slice(0, nl));
-          buffered = buffered.slice(nl + 1);
-          nl = buffered.indexOf("\n");
-        }
-      }
-      if (buffered.trim() !== "") onLine(buffered);
+      for await (const line of readLines(p.stdout)) onLine(line);
       const err = (await stderrText).trim().slice(0, 200);
       finish({ ok: false, reason: p.exitCode === null ? `app-server killed after ${CODEX_COMPACT_KILL_MS / 1000}s` : `app-server exited ${p.exitCode}: ${err}` });
-    })().catch((e) => finish({ ok: false, reason: e instanceof Error ? e.message : String(e) }));
+    })().catch((e) => finish({ ok: false, reason: errorMessage(e) }));
     send({ id: INIT_ID, method: "initialize", params: { clientInfo: { name: "tokenmaxxing", version: packageVersion() } } });
   });
 

package/src/lib/credstore.ts

@@ -1,16 +1,11 @@
 import { mkdirSync, readFileSync, unlinkSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { z } from "zod";
 import { writeFileAtomic } from "./atomic.ts";
 import * as kc from "./keychain.ts";
 import { keychain as kcNames, namespacedCredService, storeDirFor } from "./paths.ts";
 import { CredentialBlobSchema, ErrnoSchema, type OAuthCreds } from "./types.ts";
 
-const CredTargetSchema = z.discriminatedUnion("kind", [
-  z.object({ kind: z.literal("keychain"), service: z.string(), account: z.string() }),
-  z.object({ kind: z.literal("file"), path: z.string() }),
-]);
-export type CredTarget = z.infer<typeof CredTargetSchema>;
+export type CredTarget = ({ kind: "keychain" } & kc.KeychainTarget) | { kind: "file"; path: string };
 
 const darwin = process.platform === "darwin";
 

package/src/lib/decide.ts

@@ -1,19 +1,12 @@
-import { z } from "zod";
 import { withLock } from "./lock.ts";
-import { POST_SWAP_COOLDOWN_MS, loadAccounts, loadConfig, loadLastSwapAt, saveAccounts } from "./state.ts";
+import { loadAccounts, loadConfig, saveAccounts } from "./state.ts";
 import { isExhausted, limitWindows, nextWeeklyReset, pickBest, pickEarliestReset, sessionWindow, thresholdBars, usableAt, weeklyWindow, type PickCtx } from "./picker.ts";
 import { familyTokens } from "./usage.ts";
-import { log } from "./log.ts";
+import { errorMessage, log } from "./log.ts";
 import type { Observation, Provider } from "./provider.ts";
-import { AccountSchema, type Account, type EnforcedLimit } from "./types.ts";
+import type { Account, EnforcedLimit } from "./types.ts";
 
-const SwapDecisionSchema = z.object({
-  swapped: z.boolean(),
-  account: AccountSchema.nullable(),
-  reason: z.string(),
-  waitUntil: z.number().optional(),
-});
-export type SwapDecision = z.infer<typeof SwapDecisionSchema>;
+export type SwapDecision = { swapped: boolean; account: Account | null; reason: string; waitUntil?: number };
 
 const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
 const FIVE_HOURS_MS = 5 * 60 * 60 * 1000;
@@ -45,12 +38,6 @@ function enforcedWall(limit: EnforcedLimit, account: Account, now: number): numb
 
 export async function evaluateAndMaybeSwap(p: Provider, now = Date.now(), canRespawn = false, enforced: EnforcedLimit | null = null, seatId: string | null = p.liveId()): Promise<SwapDecision> {
   const activeId = seatId;
-
-  const lastSwapAt = loadLastSwapAt(p.pool);
-  if (!enforced && lastSwapAt != null && now - lastSwapAt < POST_SWAP_COOLDOWN_MS) {
-    return { swapped: false, account: null, reason: "post-swap-cooldown" };
-  }
-
   const cfg = loadConfig();
   const bars = thresholdBars(cfg);
   const stored0 = loadAccounts(p.pool).accounts.find((a) => a.id === activeId);
@@ -63,10 +50,6 @@ export async function evaluateAndMaybeSwap(p: Provider, now = Date.now(), canRes
   }
 
   return withLock(p.pool.lockFile, async () => {
-    const lastSwapAt2 = loadLastSwapAt(p.pool);
-    if (!enforced && lastSwapAt2 != null && now - lastSwapAt2 < POST_SWAP_COOLDOWN_MS) {
-      return { swapped: false, account: null, reason: "raced-already-swapped" };
-    }
     const idx = loadAccounts(p.pool);
     const id2 = seatId;
     const active = id2 ? idx.accounts.find((a) => a.id === id2) : undefined;
@@ -113,15 +96,14 @@ export async function evaluateAndMaybeSwap(p: Provider, now = Date.now(), canRes
       return { swapped: false, account: null, reason: "needs-respawn" };
     }
 
-    const seatOf = (cur: { activeId: string | null; accounts: Account[] }): Account | null =>
-      cur.accounts.find((a) => a.id === id2) ?? cur.accounts.find((a) => a.id === cur.activeId) ?? null;
+    const seatOf = (cur: { accounts: Account[] }): Account | null => cur.accounts.find((a) => a.id === id2) ?? null;
 
     const rejected = new Set<string>();
     const usable = (accounts: Account[]): Account[] => accounts.filter((a) => !rejected.has(a.id) && (p.seats === "shared" || a.id === id2 || !present.has(a.id)));
     const skipOrThrow = (e: unknown, candidate: Account): void => {
       if (p.classifySwapError(e) === "fatal") throw e;
       rejected.add(candidate.id);
-      log("decide.candidate_rejected", { account: candidate.id.slice(0, 8), error: e instanceof Error ? e.message : String(e) });
+      log("decide.candidate_rejected", { account: candidate.id.slice(0, 8), error: errorMessage(e) });
     };
     while (true) {
       const cur = loadAccounts(p.pool);

package/src/lib/grok.ts

@@ -1,11 +1,11 @@
-import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import { mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { writeFileAtomic } from "./atomic.ts";
 import { grokAuthJsonFor, grokPaths, grokPool, grokSeatFromEnv, grokStoreDirFor } from "./paths.ts";
-import type { Observation, Provider, SampleReport } from "./provider.ts";
-import { loadAccounts, loadConfig, pinBinOverride, type Harvest } from "./state.ts";
-import type { Account } from "./types.ts";
+import type { Provider } from "./provider.ts";
+import { loadAccounts, type Harvest } from "./state.ts";
+import { statusOnlyProvider, type AuthEntry } from "./statusonly.ts";
 import { c } from "../cli/render.ts";
 
 const GrokAuthEntrySchema = z.looseObject({
@@ -18,85 +18,10 @@ const GrokAuthEntrySchema = z.looseObject({
 });
 type GrokAuthEntry = z.infer<typeof GrokAuthEntrySchema>;
 
-function parseGrokAuthFile(path: string): { key: string; entry: GrokAuthEntry }[] {
-  let raw: unknown;
-  try {
-    raw = JSON.parse(readFileSync(path, "utf8"));
-  } catch {
-    return [];
-  }
-  const map = z.record(z.string(), z.unknown()).safeParse(raw);
-  if (!map.success) return [];
-  const out: { key: string; entry: GrokAuthEntry }[] = [];
-  for (const [key, value] of Object.entries(map.data)) {
-    const parsed = GrokAuthEntrySchema.safeParse(value);
-    if (parsed.success) out.push({ key, entry: parsed.data });
-  }
-  return out;
-}
-
-function identityOf(key: string, entry: GrokAuthEntry): { id: string; email: string | null } {
-  const id = entry.user_id ?? entry.principal_id ?? key;
-  return { id, email: entry.email ?? null };
-}
-
-function resolveRealGrok(): string {
-  const cfg = loadConfig();
-  if (cfg.grokBin) {
-    if (!existsSync(cfg.grokBin)) throw new Error(`configured grokBin does not exist: ${cfg.grokBin} - fix config.json`);
-    return cfg.grokBin;
-  }
-  for (const d of (process.env.PATH ?? "").split(":")) {
-    if (!d) continue;
-    const cand = join(d, "grok");
-    try {
-      if (existsSync(cand)) return cand;
-    } catch {
-      continue;
-    }
-  }
-  throw new Error("could not locate the real `grok` binary (set grokBin in config.json)");
-}
-
-function liveId(): string | null {
-  return grokSeatFromEnv(loadAccounts(grokPool).accounts.map((a) => a.id));
-}
-
-function presence(): Map<string, number> {
-  return new Map();
-}
-
-async function observeLive(account: Account): Promise<Observation | null> {
-  return account.lastUsageAt != null ? { windows: account.windows, at: account.lastUsageAt } : null;
-}
-
-async function samplePool(accounts: Account[]): Promise<Map<string, SampleReport>> {
-  const reports = new Map<string, SampleReport>();
-  for (const a of accounts) {
-    reports.set(a.id, (await storeUsable(a)) ? { ok: true, source: "probe" } : { ok: false, reason: "no usable credential in this account's store - run `tokenmaxxing auth --grok`" });
-  }
-  return reports;
-}
-
-async function storeUsable(a: Account): Promise<boolean> {
-  try {
-    const entries = parseGrokAuthFile(grokAuthJsonFor(a.id));
-    return entries.some((e) => identityOf(e.key, e.entry).id === a.id && (e.entry.refresh_token ?? "") !== "");
-  } catch {
-    return false;
-  }
-}
-
-async function removeCredentials(a: Account): Promise<void> {
-  rmSync(grokStoreDirFor(a.id), { recursive: true, force: true });
-}
-
-function harvestOf(key: string, entry: GrokAuthEntry): Harvest | null {
-  const { id, email } = identityOf(key, entry);
-  if (!id) return null;
+function harvestOf(id: string, key: string, entry: GrokAuthEntry): Harvest {
   return {
     id,
-    email,
+    email: entry.email ?? null,
     tier: null,
     sample: null,
     park: async () => {
@@ -106,83 +31,44 @@ function harvestOf(key: string, entry: GrokAuthEntry): Harvest | null {
   };
 }
 
-async function login(): Promise<Harvest | null> {
-  const real = resolveRealGrok();
-  const onboardDir = grokPaths.onboardDir;
-  rmSync(onboardDir, { recursive: true, force: true });
-  mkdirSync(onboardDir, { recursive: true });
-  const p = Bun.spawn([real, "login"], {
-    stdin: "inherit",
-    stdout: "inherit",
-    stderr: "inherit",
-    env: { ...process.env, GROK_HOME: onboardDir, TOKENMAXXING_PROBE: "1" },
-  });
-  await p.exited;
+function readAuth(path: string): AuthEntry[] {
+  let raw: unknown;
   try {
-    if (p.exitCode !== 0) {
-      console.error(c.red("no grok login landed in the isolated home - nothing added."));
-      return null;
-    }
-    const entries = parseGrokAuthFile(join(onboardDir, "auth.json"));
-    if (entries.length === 0) {
-      console.error(c.red("no grok login landed in the isolated home - nothing added."));
-      return null;
-    }
-    return harvestOf(entries[0]!.key, entries[0]!.entry);
-  } finally {
-    rmSync(onboardDir, { recursive: true, force: true });
-  }
-}
-
-async function importLive(): Promise<Harvest | null> {
-  console.log(c.cyan("Opening an isolated grok login for your first pooled account - the login you already have stays as it is."));
-  console.log();
-  const live = parseGrokAuthFile(join(grokPaths.home, "auth.json"));
-  if (live.length > 0) {
-    console.log(c.dim(`found ${live.length} grok login(s) in ${grokPaths.home} - pooling the first; use \`tokenmaxxing add --grok\` for the rest.`));
-    const h = harvestOf(live[0]!.key, live[0]!.entry);
-    if (h) return h;
+    raw = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return [];
   }
-  return login();
-}
-
-function preflight(): void {
-  const real = resolveRealGrok();
-  const p = Bun.spawnSync([real, "--version"], { stdout: "pipe", stderr: "pipe", timeout: 15_000 });
-  const out = (p.stdout?.toString() ?? "").trim().toLowerCase();
-  if (p.exitCode !== 0 || !out.includes("grok")) {
-    throw new Error(`grok binary failed verification: ${real}`);
+  const map = z.record(z.string(), z.unknown()).safeParse(raw);
+  if (!map.success) return [];
+  const out: AuthEntry[] = [];
+  for (const [key, value] of Object.entries(map.data)) {
+    const parsed = GrokAuthEntrySchema.safeParse(value);
+    if (!parsed.success) continue;
+    const entry = parsed.data;
+    const id = entry.user_id ?? entry.principal_id ?? key;
+    out.push({ id, usable: (entry.refresh_token ?? "") !== "", harvest: id === "" ? null : harvestOf(id, key, entry) });
   }
-  pinBinOverride({ key: "grokBin", bin: real });
-}
-
-function install(): void {
-  console.log(c.dim("grok pool is status-only: no supervisor or hooks installed. Use `tokenmaxxing status` to view pooled grok accounts."));
+  return out;
 }
 
-export const grok: Provider = {
+export const grok: Provider = statusOnlyProvider({
   name: "grok",
   flag: " --grok",
   pool: grokPool,
-  seats: "live",
-  waitsWhenDepleted: false,
-  statusOnly: true,
-  liveId,
-  presence,
-  gatedFamilies: () => null,
-  observeLive,
-  samplePool,
-  mergeWindows: (next) => next,
-  swap: async () => {
-    throw new Error("grok moves are not supported yet (status-only pool)");
-  },
-  classifySwapError: () => "fatal",
-  removeCredentials,
-  storeUsable,
-  login,
-  importLive,
-  preflight,
-  install,
+  binName: "grok",
+  binKey: "grokBin",
+  storeDirFor: grokStoreDirFor,
+  authJsonFor: grokAuthJsonFor,
+  onboardDir: grokPaths.onboardDir,
+  homeEnv: "GROK_HOME",
+  loginArgs: ["login"],
+  onboardAuthRel: "auth.json",
+  liveAuthPath: () => join(grokPaths.home, "auth.json"),
+  readAuth,
+  liveId: () => grokSeatFromEnv(loadAccounts(grokPool).accounts.map((a) => a.id)),
+  versionOk: (out) => out.trim().toLowerCase().includes("grok"),
+  importIntro: "Opening an isolated grok login for your first pooled account - the login you already have stays as it is.",
+  foundLive: (count) => `found ${count} grok login(s) in ${grokPaths.home} - pooling the first; use \`tokenmaxxing add --grok\` for the rest.`,
+  installNotice: "grok pool is status-only: no supervisor or hooks installed. Use `tokenmaxxing status` to view pooled grok accounts.",
   loginStep: () => `Sign in in the browser session that opens (or run ${c.bold("grok login --device-auth")} on headless hosts first).`,
-  windowLabel: (name) => name.toLowerCase(),
-};
+});

package/src/lib/http.ts

@@ -17,8 +17,7 @@ const PlainErrorBodySchema = z.looseObject({
   message: z.string().optional(),
 });
 
-const ErrorDetailSchema = z.object({ code: z.string().nullable(), fields: z.array(z.string()) });
-type ErrorDetail = z.infer<typeof ErrorDetailSchema>;
+type ErrorDetail = { code: string | null; fields: string[] };
 
 function parseErrorBody(text: string): ErrorDetail | null {
   const json = JsonTextSchema.safeParse(text).data;

package/src/lib/install.ts

@@ -2,21 +2,14 @@ import { accessSync, appendFileSync, constants, existsSync, mkdirSync, readFileS
 import { basename, dirname, join, resolve } from "node:path";
 import { escape } from "es-toolkit";
 import { z } from "zod";
-import { codexPaths, codexStoreDirFor, HOME, paths } from "./paths.ts";
+import { codexPaths, codexStoreDirFor, HOME, optionalEnv, paths } from "./paths.ts";
 import { writeFileAtomic } from "./atomic.ts";
 import { installedBin, installSettings, isOurHookCommand, uninstallSettings } from "./settings.ts";
 import { resolveRealClaude } from "./claudebin.ts";
 import { loadConfig } from "./state.ts";
 import { ErrnoSchema } from "./types.ts";
 
-const InstallOutcomeSchema = z.object({
-  claudeWrapper: z.string(),
-  installedBin: z.string(),
-  pathAhead: z.boolean(),
-  timerLoaded: z.boolean(),
-  checkIntervalS: z.number().int().positive(),
-});
-export type InstallOutcome = z.infer<typeof InstallOutcomeSchema>;
+export type InstallOutcome = { claudeWrapper: string; installedBin: string; pathAhead: boolean; timerLoaded: boolean; checkIntervalS: number };
 
 export function isBinDirAhead(): boolean {
   const dirs = (process.env.PATH ?? "").split(":");
@@ -31,10 +24,10 @@ export function isBinDirAhead(): boolean {
   }
 }
 
-const EnvFlagSchema = z.enum(["1", "true", "yes"]).optional().catch(undefined);
+const envFlag = (name: string): boolean => z.stringbool().optional().parse(optionalEnv(name)) === true;
 
 export function isNixPackaged(): boolean {
-  if (EnvFlagSchema.parse(process.env.TOKENMAXXING_NIX) != null) return true;
+  if (envFlag("TOKENMAXXING_NIX")) return true;
   try {
     return realpathSync(Bun.main).startsWith("/nix/store/");
   } catch {
@@ -43,7 +36,7 @@ export function isNixPackaged(): boolean {
 }
 
 export function skipImperativeTimer(): boolean {
-  return EnvFlagSchema.parse(process.env.TOKENMAXXING_SKIP_TIMER) != null;
+  return envFlag("TOKENMAXXING_SKIP_TIMER");
 }
 
 function isNixStorePath(path: string): boolean {
@@ -51,7 +44,7 @@ function isNixStorePath(path: string): boolean {
 }
 
 function cannotWriteRcTarget(target: string): boolean {
-  if (EnvFlagSchema.parse(process.env.TOKENMAXXING_SKIP_SHELL_RC) != null) return true;
+  if (envFlag("TOKENMAXXING_SKIP_SHELL_RC")) return true;
   if (isNixStorePath(target)) return true;
   if (!existsSync(target)) return false;
   try {
@@ -177,26 +170,21 @@ export function codexStopHookGroupIndex(): number | null {
   return idx >= 0 ? idx : null;
 }
 
+const CodexHookStateSchema = z.looseObject({
+  hooks: z.looseObject({ state: z.record(z.string(), z.looseObject({ trusted_hash: z.unknown().optional() })).optional() }).optional(),
+});
+
 export function codexStoreHookTrust(accountId: string): "trusted" | "untrusted" | "unknown" {
   const group = codexStopHookGroupIndex();
   if (group == null) return "unknown";
   const key = `${join(codexStoreDirFor(accountId), "hooks.json")}:stop:${group}:0`;
-  let text: string;
+  let config: z.infer<typeof CodexHookStateSchema>;
   try {
-    text = readFileSync(join(codexPaths.home, "config.toml"), "utf8");
+    config = CodexHookStateSchema.parse(Bun.TOML.parse(readFileSync(join(codexPaths.home, "config.toml"), "utf8")));
   } catch {
     return "unknown";
   }
-  let inBlock = false;
-  for (const line of text.split("\n")) {
-    const trimmed = line.trim();
-    if (trimmed.startsWith("[")) {
-      inBlock = trimmed.startsWith("[hooks.state.") && trimmed.includes(key);
-    } else if (inBlock && trimmed.startsWith("trusted_hash")) {
-      return "trusted";
-    }
-  }
-  return "untrusted";
+  return config.hooks?.state?.[key]?.trusted_hash !== undefined ? "trusted" : "untrusted";
 }
 
 export function codexSupervisorLink(): string {
@@ -375,8 +363,8 @@ function uninstallCheckTimer(live: boolean): TimerOutcome {
 }
 
 export function shellRcPath(): string | null {
-  const override = process.env.TOKENMAXXING_SHELL_RC;
-  if (override && override.length > 0) return override;
+  const override = optionalEnv("TOKENMAXXING_SHELL_RC");
+  if (override != null) return override;
   const shell = basename(process.env.SHELL ?? "");
   if (shell === "zsh") return join(process.env.ZDOTDIR || HOME, ".zshrc");
   if (shell === "bash") return join(HOME, ".bashrc");
@@ -417,12 +405,7 @@ export function ensurePathInRc(rc: string): "added" | "present" | "skipped" {
   return "added";
 }
 
-const ShellShadowerSchema = z.object({
-  kind: z.enum(["shadow", "bypass"]),
-  name: z.string(),
-  line: z.string(),
-});
-export type ShellShadower = z.infer<typeof ShellShadowerSchema>;
+export type ShellShadower = { kind: "shadow" | "bypass"; name: string; line: string };
 
 export function findClaudeShadowers(rcText: string): ShellShadower[] {
   const out: ShellShadower[] = [];
@@ -433,14 +416,14 @@ export function findClaudeShadowers(rcText: string): ShellShadower[] {
     const alias = line.match(/^alias\s+([A-Za-z0-9_-]+)=(.*)$/);
     if (alias) {
       if (alias[1] === "claude") {
-        out.push(ShellShadowerSchema.parse({ kind: "shadow", name: "claude", line }));
+        out.push({ kind: "shadow", name: "claude", line });
       } else if (absClaude.test(alias[2]!)) {
-        out.push(ShellShadowerSchema.parse({ kind: "bypass", name: alias[1]!, line }));
+        out.push({ kind: "bypass", name: alias[1]!, line });
       }
       continue;
     }
     if (/^(?:function\s+)?claude\s*\(\)/.test(line)) {
-      out.push(ShellShadowerSchema.parse({ kind: "shadow", name: "claude", line }));
+      out.push({ kind: "shadow", name: "claude", line });
     }
   }
   return out;
@@ -462,8 +445,7 @@ export function removePathFromRc(rc: string): boolean {
   return true;
 }
 
-const UninstallOutcomeSchema = z.object({ timer: z.enum(["removed", "skipped", "still-loaded"]), pathLineRemoved: z.boolean() });
-export type UninstallOutcome = z.infer<typeof UninstallOutcomeSchema>;
+export type UninstallOutcome = { timer: "removed" | "skipped" | "still-loaded"; pathLineRemoved: boolean };
 
 export function loginHome(): string {
   const cmd = process.platform === "darwin" ? ["id", "-P"] : ["getent", "passwd", String(process.getuid?.() ?? "")];

package/src/lib/keychain.ts

@@ -1,7 +1,4 @@
-import { z } from "zod";
-
-const KeychainTargetSchema = z.object({ service: z.string(), account: z.string() });
-export type KeychainTarget = z.infer<typeof KeychainTargetSchema>;
+export type KeychainTarget = { service: string; account: string };
 
 const SECURITY = "/usr/bin/security";
 const INTERACTIVE_MAX_LINE = 4000;

package/src/lib/log.ts

@@ -1,10 +1,13 @@
 import { appendFileSync, existsSync, mkdirSync, renameSync, statSync } from "node:fs";
 import { dirname } from "node:path";
-import { z } from "zod";
 import { paths } from "./paths.ts";
 
 const LOG_MAX_BYTES = 5_000_000;
 
+export function errorMessage(e: unknown): string {
+  return e instanceof Error ? e.message : String(e);
+}
+
 function redact(s: string): string {
   return s
     .replace(/\b(sk-ant-[A-Za-z0-9._-]{6,})/g, "sk-ant-***")
@@ -22,10 +25,7 @@ export function log(event: string, fields: Record<string, unknown> = {}): void {
   try {
     line = Object.entries(fields)
       .filter(([, v]) => v !== undefined)
-      .map(([k, v]) => {
-        const str = z.string().safeParse(v);
-        return `${k}=${redact(str.success ? str.data : JSON.stringify(v))}`;
-      })
+      .map(([k, v]) => `${k}=${redact(typeof v === "string" ? v : JSON.stringify(v))}`)
       .join(" ");
     mkdirSync(dirname(paths.logFile), { recursive: true });
     if (existsSync(paths.logFile) && statSync(paths.logFile).size > LOG_MAX_BYTES) {

package/src/lib/oauth.ts

@@ -1,6 +1,7 @@
 import { http, safeErrorDetail } from "./http.ts";
 import { env } from "./paths.ts";
-import { JsonTextSchema, ProfileResponseSchema, TokenIdentitySchema, type OAuthCreds, type TokenIdentity } from "./types.ts";
+import { errorMessage } from "./log.ts";
+import { JsonTextSchema, ProfileResponseSchema, type OAuthCreds, type TokenIdentity } from "./types.ts";
 
 const PROFILE_URL = env("TOKENMAXXING_OAUTH_PROFILE_URL", "https://api.anthropic.com/api/oauth/profile");
 
@@ -41,23 +42,23 @@ export async function fetchTokenIdentity(accessToken: string, signal?: AbortSign
       signal,
     });
   } catch (e) {
-    throw new IdentityUnavailableError(null, e instanceof Error ? e.message : String(e));
+    throw new IdentityUnavailableError(null, errorMessage(e));
   }
   let text: string;
   try {
     text = await res.text();
   } catch (e) {
-    throw new IdentityUnavailableError(res.status, `profile response body unreadable: ${e instanceof Error ? e.message : String(e)}`);
+    throw new IdentityUnavailableError(res.status, `profile response body unreadable: ${errorMessage(e)}`);
   }
   if (!res.ok) throw new IdentityUnavailableError(res.status, safeErrorDetail({ text }));
   const parsed = ProfileResponseSchema.safeParse(JsonTextSchema.safeParse(text).data);
   if (!parsed.success) throw new IdentityUnavailableError(res.status, `profile endpoint returned an unrecognized body (${text.length} bytes, withheld)`);
-  return TokenIdentitySchema.parse({
+  return {
     accountUuid: parsed.data.account.uuid,
     email: parsed.data.account.email ?? null,
     organizationUuid: parsed.data.organization.uuid,
     organizationName: parsed.data.organization.name ?? null,
-  });
+  };
 }
 
 export function describeIdentity(id: TokenIdentity): string {