tokenmaxxing 1.57.0 → 1.58.0

package/src/lib/claude.ts

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import { mkdirSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { readItem, writeItem, deleteItem, isolatedTarget, readStore, storeTarget, claudeAiOauthOnly } from "./credstore.ts";
@@ -6,7 +6,7 @@ import { resolveRealClaude, resolveVerifiedClaude } from "./claudebin.ts";
 import { withClaudeRefreshLock } from "./claudelock.ts";
 import { ensurePathInRc, installSupervisor, managedShellRcSkipLines, shellRcPath, timerActivationHint } from "./install.ts";
 import { withLock } from "./lock.ts";
-import { log } from "./log.ts";
+import { errorMessage, log } from "./log.ts";
 import { claudeTierLabel, describeIdentity, fetchTokenIdentity, isDeadCredential, InvalidGrantError } from "./oauth.ts";
 import { claudePool, paths, sampleDirFor, seatFromEnv, storeDirFor } from "./paths.ts";
 import { pickBest, pickEarliestReset, thresholdBars, type PickCtx } from "./picker.ts";
@@ -16,8 +16,8 @@ import { foldTee, sampleAccountUsage, teeObservation } from "./sample.ts";
 import { clearUsageSnapshot, loadAccounts, loadConfig, loadUsageSnapshot, pinBinOverride, saveAccounts, type Harvest } from "./state.ts";
 import { loadSetupTokens, saveSetupTokens } from "./setuptokens.ts";
 import { saveTermios, restoreTermios } from "./tty.ts";
-import { CRED_ENV_OVERRIDES, fetchUsageDirect, gatedFamilies, mergeWindows, windowsOf } from "./usage.ts";
-import { CredentialBlobSchema, OAuthAccountSchema, type Account, type Config } from "./types.ts";
+import { fetchUsageDirect, gatedFamilies, mergeWindows, scrubCredentialEnv, windowsOf } from "./usage.ts";
+import { CredentialBlobSchema, JsonTextSchema, OAuthAccountSchema, type Account, type Config } from "./types.ts";
 import { c } from "../cli/render.ts";
 
 class StoreUnusableError extends Error {
@@ -46,7 +46,7 @@ async function observeLive(account: Account, cfg: Config, now: number, opts: { p
   const needsPerModel = snap != null && gatedFamilies(snap.state.model, cfg.policy.switchModels).length > 0;
   if (opts.probe && !probeAttempted && (!fresh || needsPerModel)) {
     const startedAt = Date.now();
-    const outcome = await sampleAccountUsage(account, { retries: 0 });
+    const outcome = await sampleAccountUsage(account);
     await withLock(claudePool.lockFile, () => {
       const idx = loadAccounts(claudePool);
       const a = idx.accounts.find((x) => x.id === account.id);
@@ -100,7 +100,7 @@ async function prepareMove(target: Account): Promise<void> {
   try {
     creds = await readStore(target.id);
   } catch (e) {
-    throw new StoreUnusableError(`${target.label}'s store is unreadable (${e instanceof Error ? e.message : String(e)}) - re-auth with \`tokenmaxxing auth ${target.label}\``);
+    throw new StoreUnusableError(`${target.label}'s store is unreadable (${errorMessage(e)}) - re-auth with \`tokenmaxxing auth ${target.label}\``);
   }
   if (!creds) throw new StoreUnusableError(`${target.label} has no credential in its store - re-auth with \`tokenmaxxing auth ${target.label}\``);
   if (isDeadCredential(creds)) {
@@ -147,11 +147,11 @@ async function removeCredentials(a: Account): Promise<void> {
   }
 }
 
+const IdentityReadySchema = z.looseObject({ oauthAccount: z.looseObject({ accountUuid: z.string().min(1) }) });
+
 function identityReady(cjPath: string): boolean {
-  if (!existsSync(cjPath)) return false;
   try {
-    const oauthAccount = JSON.parse(readFileSync(cjPath, "utf8")).oauthAccount;
-    return z.object({ accountUuid: z.string().min(1) }).safeParse(oauthAccount).success;
+    return IdentityReadySchema.safeParse(JsonTextSchema.safeParse(readFileSync(cjPath, "utf8")).data).success;
   } catch {
     return false;
   }
@@ -167,8 +167,7 @@ async function login(): Promise<Harvest | null> {
   const real = resolveRealClaude();
 
   const savedTermios = saveTermios();
-  const env: Record<string, string> = { ...process.env, CLAUDE_CONFIG_DIR: onboardDir, TOKENMAXXING_PROBE: "1", TOKENMAXXING_SUPERVISED: "" };
-  for (const key of CRED_ENV_OVERRIDES) delete env[key];
+  const env = scrubCredentialEnv({ ...process.env, CLAUDE_CONFIG_DIR: onboardDir, TOKENMAXXING_PROBE: "1", TOKENMAXXING_SUPERVISED: "" });
   const p = Bun.spawn([real], {
     stdin: "inherit",
     stdout: "inherit",
@@ -208,7 +207,7 @@ async function login(): Promise<Harvest | null> {
     try {
       identity = await fetchTokenIdentity(blob.claudeAiOauth.accessToken);
     } catch (e) {
-      console.error(c.red(`could not verify which account the login belongs to (${e instanceof Error ? e.message : String(e)}) - nothing changed.`));
+      console.error(c.red(`could not verify which account the login belongs to (${errorMessage(e)}) - nothing changed.`));
       return null;
     }
     if (identity.accountUuid !== oauthAccount.accountUuid) {

package/src/lib/claudebin.ts

@@ -2,6 +2,7 @@ import { existsSync, mkdirSync, readFileSync, realpathSync, statSync } from "nod
 import { dirname, join } from "node:path";
 import { uniq } from "es-toolkit";
 import { z } from "zod";
+import { errorMessage } from "./log.ts";
 import { paths } from "./paths.ts";
 import { loadConfig } from "./state.ts";
 import { writeFileAtomic } from "./atomic.ts";
@@ -9,7 +10,7 @@ import { writeFileAtomic } from "./atomic.ts";
 export const WRAP_DEPTH_ENV = "TOKENMAXXING_WRAP_DEPTH";
 export const MAX_WRAP_DEPTH = 5;
 export const UNMANAGED_ENV = "TOKENMAXXING_UNMANAGED";
-export const LOOP_DIAGNOSIS = "wrapper re-entered without reaching the real claude";
+export const LOOP_DIAGNOSIS = "wrapper re-entered without reaching the real";
 
 export function wrapDepth(env: Record<string, string | undefined> = process.env): number {
   const n = Number(env[WRAP_DEPTH_ENV] ?? "");
@@ -96,7 +97,7 @@ export function verifyRealClaude(bin: string): string | null {
   try {
     p = Bun.spawnSync([bin, "--version"], { env, stdout: "pipe", stderr: "pipe", timeout: 15_000, killSignal: "SIGKILL" });
   } catch (e) {
-    return e instanceof Error ? e.message : String(e);
+    return errorMessage(e);
   }
   const outText = (p.stdout?.toString() ?? "").trim();
   const err = (p.stderr?.toString() ?? "").trim();

package/src/lib/claudelock.ts

@@ -1,7 +1,7 @@
 import { mkdirSync, realpathSync, rmdirSync, statSync, utimesSync } from "node:fs";
 import { join } from "node:path";
 import { delay } from "es-toolkit";
-import { log } from "./log.ts";
+import { errorMessage, log } from "./log.ts";
 import { ErrnoSchema } from "./types.ts";
 
 const STALE_MS = 60_000;
@@ -48,7 +48,7 @@ export async function withClaudeRefreshLock<T>(
           break;
         }
       } catch (e) {
-        log("claudelock.legacy_error", { err: e instanceof Error ? e.message : String(e) });
+        log("claudelock.legacy_error", { err: errorMessage(e) });
         held.push(primary);
         break;
       }

package/src/lib/cloud.ts

@@ -6,8 +6,8 @@ import { paths } from "./paths.ts";
 import { writeFileAtomic } from "./atomic.ts";
 import { UNMANAGED_ENV, resolveRealClaude } from "./claudebin.ts";
 import { pidExists } from "./proc.ts";
-import { CloudTokenSchema, CloudTokensSchema, type CloudToken } from "./setuptokens.ts";
-import { normalizeResetsAt, parseErrorBody, readTranscriptTail, scrubCredentialEnv } from "./usage.ts";
+import { CloudTokensSchema, type CloudToken } from "./setuptokens.ts";
+import { parseErrorBody, readTranscriptTail, scrubCredentialEnv } from "./usage.ts";
 
 export const TOKENS_ENV = "TOKENMAXXING_TOKENS";
 export const FALLBACK_WALL_MS = 5 * 3_600_000;
@@ -73,11 +73,7 @@ export function saveCloudWalled(walled: Record<string, number>): void {
   writeFileAtomic(paths.cloudWalledJson, JSON.stringify(WalledSchema.parse(walled), null, 2) + "\n");
 }
 
-const PickSchema = z.discriminatedUnion("ok", [
-  z.object({ ok: z.literal(true), token: CloudTokenSchema }),
-  z.object({ ok: z.literal(false), earliestReset: z.number() }),
-]);
-export type Pick = z.infer<typeof PickSchema>;
+export type Pick = { ok: true; token: CloudToken } | { ok: false; earliestReset: number };
 
 export function pickToken(input: {
   tokens: CloudToken[];
@@ -171,6 +167,6 @@ export function limitWallUntil(input: { sessionId: string; sinceBytes: number; n
   const row = rows.findLast((r) => r.isApiErrorMessage === true);
   if (!row || row.error !== "rate_limit" || row.apiErrorIsTransient === true) return null;
   if ((row.quotaLimits?.rateLimitType ?? "") === "" && parseErrorBody(row.errorDetails)?.error?.type !== "rate_limit_error") return null;
-  const resetsAt = row.quotaLimits?.resetsAt != null ? normalizeResetsAt(row.quotaLimits.resetsAt) : null;
+  const resetsAt = row.quotaLimits?.resetsAt ?? null;
   return resetsAt != null && resetsAt > input.now ? resetsAt : input.now + FALLBACK_WALL_MS;
 }

package/src/lib/codex.ts

@@ -9,7 +9,7 @@ import { seatCounts } from "./presence.ts";
 import { CodexUsageReadError, codexLimitLabel, fetchCodexUsage } from "./codexusage.ts";
 import { codexSupervisorLink, ensurePathInRc, installCodexSupervisor, managedShellRcSkipLines, shellRcPath } from "./install.ts";
 import { withLock } from "./lock.ts";
-import { log } from "./log.ts";
+import { errorMessage, log } from "./log.ts";
 import { codexPaths, codexPool, codexSeatFromEnv } from "./paths.ts";
 import { isExhausted, pickBest, pickEarliestReset, thresholdBars, type PickCtx } from "./picker.ts";
 import type { Observation, Provider, SampleReport } from "./provider.ts";
@@ -47,7 +47,7 @@ async function readCodexUsage(account: Account, now: number): Promise<CodexReadO
   try {
     auth = readCodexStoreAuth(account.id);
   } catch (e) {
-    return { ok: false, reason: `store credential unreadable (${(e instanceof Error ? e.message : String(e)).slice(0, 80)})`, deadGrant: false };
+    return { ok: false, reason: `store credential unreadable (${errorMessage(e).slice(0, 80)})`, deadGrant: false };
   }
   if (!auth) return { ok: false, reason: "no credential in this account's store - run `tokenmaxxing auth --codex`", deadGrant: false };
   try {
@@ -110,7 +110,7 @@ async function prepareMove(target: Account): Promise<void> {
   try {
     auth = readCodexStoreAuth(target.id);
   } catch (e) {
-    throw new StoreUnusableError(`${target.label}'s store is unreadable (${e instanceof Error ? e.message : String(e)}) - re-auth with \`tokenmaxxing auth --codex ${target.label}\``);
+    throw new StoreUnusableError(`${target.label}'s store is unreadable (${errorMessage(e)}) - re-auth with \`tokenmaxxing auth --codex ${target.label}\``);
   }
   if (!auth) throw new StoreUnusableError(`${target.label} has no credential in its store - re-auth with \`tokenmaxxing auth --codex ${target.label}\``);
   log("move.prepared", { account: target.id.slice(0, 8), label: target.label });

package/src/lib/codexauth.ts

@@ -84,12 +84,7 @@ function decodeJwtPayload(input: { jwt: string }): unknown {
   return JSON.parse(payload);
 }
 
-const CodexIdentitySchema = z.object({
-  accountId: z.string(),
-  email: z.string().nullable(),
-  planType: z.string().nullable(),
-});
-export type CodexIdentity = z.infer<typeof CodexIdentitySchema>;
+export type CodexIdentity = { accountId: string; email: string | null; planType: string | null };
 
 export function codexIdentityOf(input: { auth: CodexAuthJson }): CodexIdentity {
   const { auth } = input;
@@ -99,11 +94,7 @@ export function codexIdentityOf(input: { auth: CodexAuthJson }): CodexIdentity {
   if (!accountId) {
     throw new Error("codex credential carries no account id (neither tokens.account_id nor the id_token claim)");
   }
-  return CodexIdentitySchema.parse({
-    accountId,
-    email: claims.email ?? null,
-    planType: authClaims?.chatgpt_plan_type ?? null,
-  });
+  return { accountId, email: claims.email ?? null, planType: authClaims?.chatgpt_plan_type ?? null };
 }
 
 export function isCodexAccessExpiring(input: { auth: CodexAuthJson; skewMs?: number; now?: number }): boolean {

package/src/lib/codexbin.ts

@@ -1,6 +1,7 @@
 import { existsSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { LOOP_DIAGNOSIS, MAX_WRAP_DEPTH, WRAP_DEPTH_ENV, pointsBackAtUs } from "./claudebin.ts";
+import { errorMessage } from "./log.ts";
 import { loadConfig } from "./state.ts";
 import { paths } from "./paths.ts";
 
@@ -41,7 +42,7 @@ export function verifyRealCodex(input: { bin: string }): string | null {
   try {
     p = Bun.spawnSync([input.bin, "--version"], { env, stdout: "pipe", stderr: "pipe", timeout: 15_000, killSignal: "SIGKILL" });
   } catch (e) {
-    return e instanceof Error ? e.message : String(e);
+    return errorMessage(e);
   }
   const outText = (p.stdout?.toString() ?? "").trim();
   const err = (p.stderr?.toString() ?? "").trim();

package/src/lib/codexoauth.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { http, oauthErrorCode, safeErrorDetail } from "./http.ts";
+import { errorMessage } from "./log.ts";
 import { env } from "./paths.ts";
 import { CodexAuthJsonSchema, JsonTextSchema, type CodexAuthJson } from "./types.ts";
 
@@ -38,16 +39,10 @@ export async function refreshCodexAuth(input: { auth: CodexAuthJson; now?: numbe
   let res: Response;
   try {
     res = await http.post(TOKEN_URL, {
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        client_id: CLIENT_ID,
-        grant_type: "refresh_token",
-        refresh_token: auth.tokens.refresh_token,
-      }),
+      json: { client_id: CLIENT_ID, grant_type: "refresh_token", refresh_token: auth.tokens.refresh_token },
     });
   } catch (e) {
-    const message = e instanceof Error ? e.message : String(e);
-    throw new CodexRefreshFailedError(`endpoint unreachable: ${message}`);
+    throw new CodexRefreshFailedError(`endpoint unreachable: ${errorMessage(e)}`);
   }
 
   const text = await res.text();

package/src/lib/codexusage.ts

@@ -1,7 +1,8 @@
 import { z } from "zod";
 import { http, safeErrorDetail } from "./http.ts";
+import { errorMessage } from "./log.ts";
 import { env } from "./paths.ts";
-import { CodexUsageSchema, JsonTextSchema, type CodexAuthJson, type CodexUsage, type Window } from "./types.ts";
+import { JsonTextSchema, type CodexAuthJson, type CodexUsage, type Window } from "./types.ts";
 import { codexIdentityOf } from "./codexauth.ts";
 import { familyTokens } from "./usage.ts";
 
@@ -63,8 +64,7 @@ export async function fetchCodexUsage(input: { auth: CodexAuthJson; at: number }
       },
     });
   } catch (e) {
-    const message = e instanceof Error ? e.message : String(e);
-    throw new CodexUsageReadError(`endpoint unreachable: ${message}`);
+    throw new CodexUsageReadError(`endpoint unreachable: ${errorMessage(e)}`);
   }
   const text = await res.text();
   if (!res.ok) {
@@ -76,7 +76,7 @@ export async function fetchCodexUsage(input: { auth: CodexAuthJson; at: number }
   }
   const wire = parsed.data;
 
-  return CodexUsageSchema.parse({
+  return {
     accountId: wire.account_id,
     email: wire.email ?? null,
     planType: wire.plan_type ?? null,
@@ -84,7 +84,7 @@ export async function fetchCodexUsage(input: { auth: CodexAuthJson; at: number }
       ...toWindows(wire.rate_limit, null, at),
       ...(wire.additional_rate_limits ?? []).flatMap((row) => toWindows(row.rate_limit, row.limit_name, at)),
     ],
-  });
+  };
 }
 
 const LIMIT_LABEL_ABBREVIATIONS = new Map([["reserve", "rsrv"]]);

package/src/lib/compact.ts

@@ -2,14 +2,11 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { delay } from "es-toolkit";
 import { z } from "zod";
-import { log } from "./log.ts";
+import { errorMessage, log } from "./log.ts";
+import { readLines } from "./proc.ts";
 import { JsonTextSchema } from "./types.ts";
 
-const CompactOutcomeSchema = z.discriminatedUnion("ok", [
-  z.object({ ok: z.literal(true) }),
-  z.object({ ok: z.literal(false), reason: z.string() }),
-]);
-export type CompactOutcome = z.infer<typeof CompactOutcomeSchema>;
+export type CompactOutcome = { ok: true } | { ok: false; reason: string };
 
 export const CLAUDE_COMPACT_KILL_MS = 300_000;
 const PIPE_GRACE_MS = 2_000;
@@ -108,20 +105,10 @@ export async function compactCodexThread(input: { real: string; threadId: string
       }
     };
     (async () => {
-      let buffered = "";
-      for await (const chunk of p.stdout) {
-        buffered += Buffer.from(chunk).toString("utf8");
-        let nl = buffered.indexOf("\n");
-        while (nl >= 0) {
-          onLine(buffered.slice(0, nl));
-          buffered = buffered.slice(nl + 1);
-          nl = buffered.indexOf("\n");
-        }
-      }
-      if (buffered.trim() !== "") onLine(buffered);
+      for await (const line of readLines(p.stdout)) onLine(line);
       const err = (await stderrText).trim().slice(0, 200);
       finish({ ok: false, reason: p.exitCode === null ? `app-server killed after ${CODEX_COMPACT_KILL_MS / 1000}s` : `app-server exited ${p.exitCode}: ${err}` });
-    })().catch((e) => finish({ ok: false, reason: e instanceof Error ? e.message : String(e) }));
+    })().catch((e) => finish({ ok: false, reason: errorMessage(e) }));
     send({ id: INIT_ID, method: "initialize", params: { clientInfo: { name: "tokenmaxxing", version: packageVersion() } } });
   });
 

package/src/lib/credstore.ts

@@ -1,16 +1,11 @@
 import { mkdirSync, readFileSync, unlinkSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { z } from "zod";
 import { writeFileAtomic } from "./atomic.ts";
 import * as kc from "./keychain.ts";
 import { keychain as kcNames, namespacedCredService, storeDirFor } from "./paths.ts";
 import { CredentialBlobSchema, ErrnoSchema, type OAuthCreds } from "./types.ts";
 
-const CredTargetSchema = z.discriminatedUnion("kind", [
-  z.object({ kind: z.literal("keychain"), service: z.string(), account: z.string() }),
-  z.object({ kind: z.literal("file"), path: z.string() }),
-]);
-export type CredTarget = z.infer<typeof CredTargetSchema>;
+export type CredTarget = ({ kind: "keychain" } & kc.KeychainTarget) | { kind: "file"; path: string };
 
 const darwin = process.platform === "darwin";
 

package/src/lib/decide.ts

@@ -1,19 +1,12 @@
-import { z } from "zod";
 import { withLock } from "./lock.ts";
-import { POST_SWAP_COOLDOWN_MS, loadAccounts, loadConfig, loadLastSwapAt, saveAccounts } from "./state.ts";
+import { loadAccounts, loadConfig, saveAccounts } from "./state.ts";
 import { isExhausted, limitWindows, nextWeeklyReset, pickBest, pickEarliestReset, sessionWindow, thresholdBars, usableAt, weeklyWindow, type PickCtx } from "./picker.ts";
 import { familyTokens } from "./usage.ts";
-import { log } from "./log.ts";
+import { errorMessage, log } from "./log.ts";
 import type { Observation, Provider } from "./provider.ts";
-import { AccountSchema, type Account, type EnforcedLimit } from "./types.ts";
+import type { Account, EnforcedLimit } from "./types.ts";
 
-const SwapDecisionSchema = z.object({
-  swapped: z.boolean(),
-  account: AccountSchema.nullable(),
-  reason: z.string(),
-  waitUntil: z.number().optional(),
-});
-export type SwapDecision = z.infer<typeof SwapDecisionSchema>;
+export type SwapDecision = { swapped: boolean; account: Account | null; reason: string; waitUntil?: number };
 
 const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
 const FIVE_HOURS_MS = 5 * 60 * 60 * 1000;
@@ -45,12 +38,6 @@ function enforcedWall(limit: EnforcedLimit, account: Account, now: number): numb
 
 export async function evaluateAndMaybeSwap(p: Provider, now = Date.now(), canRespawn = false, enforced: EnforcedLimit | null = null, seatId: string | null = p.liveId()): Promise<SwapDecision> {
   const activeId = seatId;
-
-  const lastSwapAt = loadLastSwapAt(p.pool);
-  if (!enforced && lastSwapAt != null && now - lastSwapAt < POST_SWAP_COOLDOWN_MS) {
-    return { swapped: false, account: null, reason: "post-swap-cooldown" };
-  }
-
   const cfg = loadConfig();
   const bars = thresholdBars(cfg);
   const stored0 = loadAccounts(p.pool).accounts.find((a) => a.id === activeId);
@@ -63,10 +50,6 @@ export async function evaluateAndMaybeSwap(p: Provider, now = Date.now(), canRes
   }
 
   return withLock(p.pool.lockFile, async () => {
-    const lastSwapAt2 = loadLastSwapAt(p.pool);
-    if (!enforced && lastSwapAt2 != null && now - lastSwapAt2 < POST_SWAP_COOLDOWN_MS) {
-      return { swapped: false, account: null, reason: "raced-already-swapped" };
-    }
     const idx = loadAccounts(p.pool);
     const id2 = seatId;
     const active = id2 ? idx.accounts.find((a) => a.id === id2) : undefined;
@@ -113,15 +96,14 @@ export async function evaluateAndMaybeSwap(p: Provider, now = Date.now(), canRes
       return { swapped: false, account: null, reason: "needs-respawn" };
     }
 
-    const seatOf = (cur: { activeId: string | null; accounts: Account[] }): Account | null =>
-      cur.accounts.find((a) => a.id === id2) ?? cur.accounts.find((a) => a.id === cur.activeId) ?? null;
+    const seatOf = (cur: { accounts: Account[] }): Account | null => cur.accounts.find((a) => a.id === id2) ?? null;
 
     const rejected = new Set<string>();
     const usable = (accounts: Account[]): Account[] => accounts.filter((a) => !rejected.has(a.id) && (p.seats === "shared" || a.id === id2 || !present.has(a.id)));
     const skipOrThrow = (e: unknown, candidate: Account): void => {
       if (p.classifySwapError(e) === "fatal") throw e;
       rejected.add(candidate.id);
-      log("decide.candidate_rejected", { account: candidate.id.slice(0, 8), error: e instanceof Error ? e.message : String(e) });
+      log("decide.candidate_rejected", { account: candidate.id.slice(0, 8), error: errorMessage(e) });
     };
     while (true) {
       const cur = loadAccounts(p.pool);

package/src/lib/grok.ts

@@ -1,11 +1,11 @@
-import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import { mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { writeFileAtomic } from "./atomic.ts";
 import { grokAuthJsonFor, grokPaths, grokPool, grokSeatFromEnv, grokStoreDirFor } from "./paths.ts";
-import type { Observation, Provider, SampleReport } from "./provider.ts";
-import { loadAccounts, loadConfig, pinBinOverride, type Harvest } from "./state.ts";
-import type { Account } from "./types.ts";
+import type { Provider } from "./provider.ts";
+import { loadAccounts, type Harvest } from "./state.ts";
+import { statusOnlyProvider, type AuthEntry } from "./statusonly.ts";
 import { c } from "../cli/render.ts";
 
 const GrokAuthEntrySchema = z.looseObject({
@@ -18,85 +18,10 @@ const GrokAuthEntrySchema = z.looseObject({
 });
 type GrokAuthEntry = z.infer<typeof GrokAuthEntrySchema>;
 
-function parseGrokAuthFile(path: string): { key: string; entry: GrokAuthEntry }[] {
-  let raw: unknown;
-  try {
-    raw = JSON.parse(readFileSync(path, "utf8"));
-  } catch {
-    return [];
-  }
-  const map = z.record(z.string(), z.unknown()).safeParse(raw);
-  if (!map.success) return [];
-  const out: { key: string; entry: GrokAuthEntry }[] = [];
-  for (const [key, value] of Object.entries(map.data)) {
-    const parsed = GrokAuthEntrySchema.safeParse(value);
-    if (parsed.success) out.push({ key, entry: parsed.data });
-  }
-  return out;
-}
-
-function identityOf(key: string, entry: GrokAuthEntry): { id: string; email: string | null } {
-  const id = entry.user_id ?? entry.principal_id ?? key;
-  return { id, email: entry.email ?? null };
-}
-
-function resolveRealGrok(): string {
-  const cfg = loadConfig();
-  if (cfg.grokBin) {
-    if (!existsSync(cfg.grokBin)) throw new Error(`configured grokBin does not exist: ${cfg.grokBin} - fix config.json`);
-    return cfg.grokBin;
-  }
-  for (const d of (process.env.PATH ?? "").split(":")) {
-    if (!d) continue;
-    const cand = join(d, "grok");
-    try {
-      if (existsSync(cand)) return cand;
-    } catch {
-      continue;
-    }
-  }
-  throw new Error("could not locate the real `grok` binary (set grokBin in config.json)");
-}
-
-function liveId(): string | null {
-  return grokSeatFromEnv(loadAccounts(grokPool).accounts.map((a) => a.id));
-}
-
-function presence(): Map<string, number> {
-  return new Map();
-}
-
-async function observeLive(account: Account): Promise<Observation | null> {
-  return account.lastUsageAt != null ? { windows: account.windows, at: account.lastUsageAt } : null;
-}
-
-async function samplePool(accounts: Account[]): Promise<Map<string, SampleReport>> {
-  const reports = new Map<string, SampleReport>();
-  for (const a of accounts) {
-    reports.set(a.id, (await storeUsable(a)) ? { ok: true, source: "probe" } : { ok: false, reason: "no usable credential in this account's store - run `tokenmaxxing auth --grok`" });
-  }
-  return reports;
-}
-
-async function storeUsable(a: Account): Promise<boolean> {
-  try {
-    const entries = parseGrokAuthFile(grokAuthJsonFor(a.id));
-    return entries.some((e) => identityOf(e.key, e.entry).id === a.id && (e.entry.refresh_token ?? "") !== "");
-  } catch {
-    return false;
-  }
-}
-
-async function removeCredentials(a: Account): Promise<void> {
-  rmSync(grokStoreDirFor(a.id), { recursive: true, force: true });
-}
-
-function harvestOf(key: string, entry: GrokAuthEntry): Harvest | null {
-  const { id, email } = identityOf(key, entry);
-  if (!id) return null;
+function harvestOf(id: string, key: string, entry: GrokAuthEntry): Harvest {
   return {
     id,
-    email,
+    email: entry.email ?? null,
     tier: null,
     sample: null,
     park: async () => {
@@ -106,83 +31,44 @@ function harvestOf(key: string, entry: GrokAuthEntry): Harvest | null {
   };
 }
 
-async function login(): Promise<Harvest | null> {
-  const real = resolveRealGrok();
-  const onboardDir = grokPaths.onboardDir;
-  rmSync(onboardDir, { recursive: true, force: true });
-  mkdirSync(onboardDir, { recursive: true });
-  const p = Bun.spawn([real, "login"], {
-    stdin: "inherit",
-    stdout: "inherit",
-    stderr: "inherit",
-    env: { ...process.env, GROK_HOME: onboardDir, TOKENMAXXING_PROBE: "1" },
-  });
-  await p.exited;
+function readAuth(path: string): AuthEntry[] {
+  let raw: unknown;
   try {
-    if (p.exitCode !== 0) {
-      console.error(c.red("no grok login landed in the isolated home - nothing added."));
-      return null;
-    }
-    const entries = parseGrokAuthFile(join(onboardDir, "auth.json"));
-    if (entries.length === 0) {
-      console.error(c.red("no grok login landed in the isolated home - nothing added."));
-      return null;
-    }
-    return harvestOf(entries[0]!.key, entries[0]!.entry);
-  } finally {
-    rmSync(onboardDir, { recursive: true, force: true });
-  }
-}
-
-async function importLive(): Promise<Harvest | null> {
-  console.log(c.cyan("Opening an isolated grok login for your first pooled account - the login you already have stays as it is."));
-  console.log();
-  const live = parseGrokAuthFile(join(grokPaths.home, "auth.json"));
-  if (live.length > 0) {
-    console.log(c.dim(`found ${live.length} grok login(s) in ${grokPaths.home} - pooling the first; use \`tokenmaxxing add --grok\` for the rest.`));
-    const h = harvestOf(live[0]!.key, live[0]!.entry);
-    if (h) return h;
+    raw = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return [];
   }
-  return login();
-}
-
-function preflight(): void {
-  const real = resolveRealGrok();
-  const p = Bun.spawnSync([real, "--version"], { stdout: "pipe", stderr: "pipe", timeout: 15_000 });
-  const out = (p.stdout?.toString() ?? "").trim().toLowerCase();
-  if (p.exitCode !== 0 || !out.includes("grok")) {
-    throw new Error(`grok binary failed verification: ${real}`);
+  const map = z.record(z.string(), z.unknown()).safeParse(raw);
+  if (!map.success) return [];
+  const out: AuthEntry[] = [];
+  for (const [key, value] of Object.entries(map.data)) {
+    const parsed = GrokAuthEntrySchema.safeParse(value);
+    if (!parsed.success) continue;
+    const entry = parsed.data;
+    const id = entry.user_id ?? entry.principal_id ?? key;
+    out.push({ id, usable: (entry.refresh_token ?? "") !== "", harvest: id === "" ? null : harvestOf(id, key, entry) });
   }
-  pinBinOverride({ key: "grokBin", bin: real });
-}
-
-function install(): void {
-  console.log(c.dim("grok pool is status-only: no supervisor or hooks installed. Use `tokenmaxxing status` to view pooled grok accounts."));
+  return out;
 }
 
-export const grok: Provider = {
+export const grok: Provider = statusOnlyProvider({
   name: "grok",
   flag: " --grok",
   pool: grokPool,
-  seats: "live",
-  waitsWhenDepleted: false,
-  statusOnly: true,
-  liveId,
-  presence,
-  gatedFamilies: () => null,
-  observeLive,
-  samplePool,
-  mergeWindows: (next) => next,
-  swap: async () => {
-    throw new Error("grok moves are not supported yet (status-only pool)");
-  },
-  classifySwapError: () => "fatal",
-  removeCredentials,
-  storeUsable,
-  login,
-  importLive,
-  preflight,
-  install,
+  binName: "grok",
+  binKey: "grokBin",
+  storeDirFor: grokStoreDirFor,
+  authJsonFor: grokAuthJsonFor,
+  onboardDir: grokPaths.onboardDir,
+  homeEnv: "GROK_HOME",
+  loginArgs: ["login"],
+  onboardAuthRel: "auth.json",
+  liveAuthPath: () => join(grokPaths.home, "auth.json"),
+  readAuth,
+  liveId: () => grokSeatFromEnv(loadAccounts(grokPool).accounts.map((a) => a.id)),
+  versionOk: (out) => out.trim().toLowerCase().includes("grok"),
+  importIntro: "Opening an isolated grok login for your first pooled account - the login you already have stays as it is.",
+  foundLive: (count) => `found ${count} grok login(s) in ${grokPaths.home} - pooling the first; use \`tokenmaxxing add --grok\` for the rest.`,
+  installNotice: "grok pool is status-only: no supervisor or hooks installed. Use `tokenmaxxing status` to view pooled grok accounts.",
   loginStep: () => `Sign in in the browser session that opens (or run ${c.bold("grok login --device-auth")} on headless hosts first).`,
-  windowLabel: (name) => name.toLowerCase(),
-};
+});

package/src/lib/http.ts

@@ -17,8 +17,7 @@ const PlainErrorBodySchema = z.looseObject({
   message: z.string().optional(),
 });
 
-const ErrorDetailSchema = z.object({ code: z.string().nullable(), fields: z.array(z.string()) });
-type ErrorDetail = z.infer<typeof ErrorDetailSchema>;
+type ErrorDetail = { code: string | null; fields: string[] };
 
 function parseErrorBody(text: string): ErrorDetail | null {
   const json = JsonTextSchema.safeParse(text).data;