tokenmaxxing 1.57.0 → 1.59.0

package/src/entries/supervisor.ts

@@ -4,19 +4,22 @@ import type { FileSink, Subprocess } from "bun";
 import { maxBy } from "es-toolkit";
 import { z } from "zod";
 import { claudePool, paths, storeDirFor } from "../lib/paths.ts";
-import { LOOP_DIAGNOSIS, MAX_WRAP_DEPTH, UNMANAGED_ENV, WRAP_DEPTH_ENV, WRAP_RATE_MAX, WRAP_RATE_WINDOW_MS, resolveRealClaude, wrapDepth, wrapperEntryRateTripped } from "../lib/claudebin.ts";
+import { UNMANAGED_ENV, WRAP_DEPTH_ENV, resolveRealClaude, wrapDepth } from "../lib/claudebin.ts";
 import { claude, pickSeat } from "../lib/claude.ts";
 import { compactClaudeSession } from "../lib/compact.ts";
 import { evaluateAndMaybeSwap } from "../lib/decide.ts";
 import { withLock } from "../lib/lock.ts";
 import { thresholdBars, usableAt } from "../lib/picker.ts";
-import { clearPresence, writePresence } from "../lib/presence.ts";
+import { clearPresence } from "../lib/presence.ts";
+import { readLines } from "../lib/proc.ts";
 import { teeObservation } from "../lib/sample.ts";
-import { saveTermios, restoreTermios } from "../lib/tty.ts";
+import { exitStatus, loopGuardTripped, raceMarkerOrExit, recordPresenceOrStop, runPassthrough } from "../lib/supervise.ts";
+import { saveTermios } from "../lib/tty.ts";
 import { loadSessionFlags, pruneStaleSessions, saveSessionFlags, writeRespawnMarker } from "../lib/sessions.ts";
 import { loadAccounts, loadConfig } from "../lib/state.ts";
-import { RespawnMarkerSchema, type Account } from "../lib/types.ts";
-import { log } from "../lib/log.ts";
+import { gatedFamilies, modelFromFlag } from "../lib/usage.ts";
+import { RespawnMarkerSchema, type Account, type Config, type ModelInfo } from "../lib/types.ts";
+import { errorMessage, log } from "../lib/log.ts";
 
 const NONINTERACTIVE_SUBCMDS = new Set([
   "mcp", "config", "doctor", "update", "install", "migrate-installer",
@@ -44,15 +47,15 @@ const OPTIONAL_VALUE_ROOT_FLAGS = new Set([
 
 const isUuid = (s: string) => z.uuid().safeParse(s).success;
 
-const AnalysisSchema = z.object({
-  manage: z.boolean(),
-  sessionId: z.string().nullable(),
-  resumeId: z.string().nullable(),
-  continueLatest: z.boolean(),
-  streamInput: z.boolean(),
-  streamOutput: z.boolean(),
-});
-type Analysis = z.infer<typeof AnalysisSchema>;
+type Analysis = {
+  manage: boolean;
+  sessionId: string | null;
+  resumeId: string | null;
+  continueLatest: boolean;
+  streamInput: boolean;
+  streamOutput: boolean;
+  model: string | null;
+};
 
 export function analyzeArgs(argv: string[]): Analysis {
   let sessionId: string | null = null;
@@ -60,6 +63,7 @@ export function analyzeArgs(argv: string[]): Analysis {
   let continueLatest = false;
   let streamInput = false;
   let streamOutput = false;
+  let model: string | null = null;
   let printMode = false;
   let invalidSessionArg = false;
   let pickerResume = false;
@@ -97,6 +101,8 @@ export function analyzeArgs(argv: string[]): Analysis {
     else if (a.startsWith("--input-format=")) streamInput = a.slice("--input-format=".length) === "stream-json";
     else if (a === "--output-format") streamOutput = argv[++i] === "stream-json";
     else if (a.startsWith("--output-format=")) streamOutput = a.slice("--output-format=".length) === "stream-json";
+    else if (a === "--model") model = argv[++i] ?? null;
+    else if (a.startsWith("--model=")) model = a.slice("--model=".length);
     else if (VALUE_TAKING_ROOT_FLAGS.has(a)) i++;
     else if (VARIADIC_ROOT_FLAGS.has(a)) {
       while (i + 1 < argv.length && !argv[i + 1]!.startsWith("-")) i++;
@@ -112,7 +118,7 @@ export function analyzeArgs(argv: string[]): Analysis {
   const isSubcmd = firstPositional !== null && NONINTERACTIVE_SUBCMDS.has(firstPositional);
   const forkResume = forkSession && (resumeId !== null || continueLatest);
   const manage = !printMode && !isSubcmd && !invalidSessionArg && !pickerResume && !forkResume && !process.env.TOKENMAXXING_PROBE;
-  return { manage, sessionId, resumeId, continueLatest, streamInput, streamOutput };
+  return { manage, sessionId, resumeId, continueLatest, streamInput, streamOutput, model };
 }
 
 export function stripSessionFlags(argv: string[]): string[] {
@@ -169,18 +175,17 @@ function latestSessionForCwd(): string | null {
   }
 }
 
-const MarkerGateSchema = z.object({
-  launchedAt: z.number(),
-  overriddenUntil: z.number(),
-});
-type MarkerGate = z.infer<typeof MarkerGateSchema>;
+type MarkerGate = {
+  launchedAt: number;
+  overriddenUntil: number;
+};
 
 function consumableMarker(marker: string, gate: MarkerGate): z.infer<typeof RespawnMarkerSchema> | null {
   let m: z.infer<typeof RespawnMarkerSchema>;
   try {
     m = RespawnMarkerSchema.parse(JSON.parse(readFileSync(marker, "utf8")));
   } catch (e) {
-    log("supervisor.marker_invalid", { err: e instanceof Error ? e.message : String(e) });
+    log("supervisor.marker_invalid", { err: errorMessage(e) });
     throw new Error(
       `${marker} is corrupt (unparsable JSON or off-schema) - the session was stopped instead of guessing whether the pool is depleted; inspect the marker, then run \`claude --resume ${basename(marker)}\` (a fresh launch clears it)`,
     );
@@ -201,28 +206,29 @@ function consumableMarker(marker: string, gate: MarkerGate): z.infer<typeof Resp
 const SEAT_POLL_MS = 10_000;
 const SEAT_RETRY_MS = 60_000;
 
-function seatBlockedUntil(seatId: string, now: number): number | null {
+function seatBlockedUntil(seatId: string, now: number, families: string[], cfg: Config): number | null {
   const account = loadAccounts(claudePool).accounts.find((a) => a.id === seatId);
   if (!account) return null;
-  const cfg = loadConfig();
   const observed = teeObservation(account);
   const current = observed ? { ...account, windows: observed.windows } : account;
-  const until = usableAt(current, { now, thresholds: thresholdBars(cfg), currentId: seatId, families: cfg.policy.switchModels, seats: null });
+  const until = usableAt(current, { now, thresholds: thresholdBars(cfg), currentId: seatId, families, seats: null });
   return until > now ? until : null;
 }
 
-async function moveExhaustedSeat(seat: Account, sid: string, gate: MarkerGate): Promise<boolean> {
+async function moveExhaustedSeat(seat: Account, sid: string, gate: MarkerGate, model: ModelInfo | null): Promise<boolean> {
   try {
     const now = Date.now();
-    const until = seatBlockedUntil(seat.id, now);
+    const cfg = loadConfig();
+    const families = gatedFamilies(model, cfg.policy.switchModels);
+    const until = seatBlockedUntil(seat.id, now, families, cfg);
     if (until == null || until <= gate.overriddenUntil) return false;
-    const decision = await evaluateAndMaybeSwap(claude, now, true, null, seat.id);
+    const decision = await evaluateAndMaybeSwap(claude, now, true, null, seat.id, families);
     log("supervisor.seat_exhausted", { seat: seat.id.slice(0, 8), until, reason: decision.reason, account: decision.account?.id.slice(0, 8), waitUntil: decision.waitUntil });
     if (decision.account && (decision.swapped || decision.waitUntil !== undefined)) {
       writeRespawnMarker({ session: { sid, launchedAt: gate.launchedAt }, sessionId: sid, accountId: decision.account.id, waitUntil: decision.waitUntil ?? now, compact: true });
     }
   } catch (e) {
-    log("supervisor.seat_watch_error", { err: e instanceof Error ? e.message : String(e) });
+    log("supervisor.seat_watch_error", { err: errorMessage(e) });
   }
   return true;
 }
@@ -276,7 +282,7 @@ class StdinRelay {
 
   constructor() {
     this.pump()
-      .catch((e: unknown) => log("supervisor.relay_read_failed", { err: e instanceof Error ? e.message : String(e) }))
+      .catch((e: unknown) => log("supervisor.relay_read_failed", { err: errorMessage(e) }))
       .finally(() => {
         this.ended = true;
         this.close();
@@ -296,19 +302,7 @@ class StdinRelay {
   }
 
   private async pump(): Promise<void> {
-    const decoder = new TextDecoder();
-    let pending = "";
-    for await (const chunk of Bun.stdin.stream()) {
-      pending += decoder.decode(chunk, { stream: true });
-      let nl = pending.indexOf("\n");
-      while (nl !== -1) {
-        this.forward(pending.slice(0, nl + 1));
-        pending = pending.slice(nl + 1);
-        nl = pending.indexOf("\n");
-      }
-    }
-    pending += decoder.decode();
-    if (pending.length > 0) this.forward(`${pending}\n`);
+    for await (const line of readLines(Bun.stdin.stream())) this.forward(`${line}\n`);
   }
 
   private forward(line: string): void {
@@ -318,7 +312,7 @@ class StdinRelay {
         this.sink.flush();
         return;
       } catch (e) {
-        log("supervisor.relay_write_failed", { err: e instanceof Error ? e.message : String(e) });
+        log("supervisor.relay_write_failed", { err: errorMessage(e) });
         this.sink = null;
       }
     }
@@ -330,50 +324,17 @@ class StdinRelay {
     try {
       this.sink.end();
     } catch (e) {
-      log("supervisor.relay_end_failed", { err: e instanceof Error ? e.message : String(e) });
+      log("supervisor.relay_end_failed", { err: errorMessage(e) });
     }
     this.sink = null;
   }
 }
 
-async function recordPresence(child: Subprocess, sid: string, seat: Account, savedTermios: string | null): Promise<void> {
-  for (let attempt = 0; ; attempt++) {
-    try {
-      writePresence({ dir: paths.presenceDir, id: sid, accountId: seat.id, pid: child.pid });
-      return;
-    } catch (e) {
-      if (child.exitCode !== null || child.signalCode !== null) return;
-      if (attempt >= 9) {
-        log("supervisor.presence_failed", { err: e instanceof Error ? e.message : String(e) });
-        child.kill();
-        await child.exited;
-        restoreTermios(savedTermios);
-        throw new Error("could not write the session presence file - refusing to run a session whose seat placement cannot see");
-      }
-      await Bun.sleep(100);
-    }
-  }
-}
-
 export async function runSupervisor(argv: string[]): Promise<number> {
-  const depth = wrapDepth();
-  if (depth >= MAX_WRAP_DEPTH) {
-    console.error(
-      `tokenmaxxing: ${LOOP_DIAGNOSIS} (depth ${depth}) - claudeBin in ${paths.configJson} does not launch the real Claude binary. Fix claudeBin, then run \`tokenmaxxing doctor\`.`,
-    );
-    log("supervisor.loop_abort", { depth });
-    return 1;
-  }
-  if (wrapperEntryRateTripped(Date.now())) {
-    console.error(
-      `tokenmaxxing: ${LOOP_DIAGNOSIS} (over ${WRAP_RATE_MAX} wrapper entries in ${WRAP_RATE_WINDOW_MS / 1000}s) - claudeBin in ${paths.configJson} does not launch the real Claude binary. Fix claudeBin, then run \`tokenmaxxing doctor\`.`,
-    );
-    log("supervisor.rate_abort", { max: WRAP_RATE_MAX });
-    return 1;
-  }
+  if (loopGuardTripped("claude")) return 1;
   const real = resolveRealClaude();
   const info = analyzeArgs(argv);
-  const childEnv = { ...process.env, [WRAP_DEPTH_ENV]: String(depth + 1) };
+  const childEnv = { ...process.env, [WRAP_DEPTH_ENV]: String(wrapDepth() + 1) };
 
   let child: Subprocess | null = null;
   let terminating = false;
@@ -387,10 +348,8 @@ export async function runSupervisor(argv: string[]): Promise<number> {
     const passthroughEnv: Record<string, string | undefined> = { ...childEnv };
     delete passthroughEnv.TOKENMAXXING_SUPERVISED;
     delete passthroughEnv.TOKENMAXXING_SESSION_ID;
-    const p = Bun.spawn([real, ...argv], { stdin: "inherit", stdout: "inherit", stderr: "inherit", env: passthroughEnv });
-    child = p;
-    await p.exited;
-    return p.exitCode ?? (p.signalCode ? 1 : 0);
+    delete passthroughEnv.TOKENMAXXING_MODEL;
+    return runPassthrough({ real, argv, env: passthroughEnv, onSpawn: (p) => { child = p; } });
   }
 
   let base = stripSessionFlags(argv);
@@ -428,6 +387,7 @@ export async function runSupervisor(argv: string[]): Promise<number> {
   const effective = analyzeArgs(base);
   const relay = effective.streamInput ? new StdinRelay() : null;
   const stream = effective.streamOutput;
+  const model = modelFromFlag(effective.model);
   let noticeSid = sid;
   const say: Say = (terminal, text) => {
     if (stream) process.stdout.write(systemLine(noticeSid, text));
@@ -442,7 +402,7 @@ export async function runSupervisor(argv: string[]): Promise<number> {
 
     const gate: MarkerGate = { launchedAt: Date.now(), overriddenUntil };
     const { child: proc, seat } = await withLock(claudePool.lockFile, async () => {
-      const picked = (wanted == null ? null : (loadAccounts(claudePool).accounts.find((a) => a.id === wanted) ?? null)) ?? pickSeat(gate.launchedAt);
+      const picked = (wanted == null ? null : (loadAccounts(claudePool).accounts.find((a) => a.id === wanted) ?? null)) ?? pickSeat(gate.launchedAt, model);
       log("supervisor.launch", { sid, respawns, seat: picked?.id.slice(0, 8) ?? null, args: launchArgs.join(" "), injected: firstLine !== null });
       const spawned = Bun.spawn([real, ...launchArgs], {
         stdin: relay === null ? "inherit" : "pipe",
@@ -453,49 +413,46 @@ export async function runSupervisor(argv: string[]): Promise<number> {
           TOKENMAXXING_SUPERVISED: "1",
           TOKENMAXXING_SESSION_ID: sid,
           TOKENMAXXING_LAUNCHED_AT: String(gate.launchedAt),
+          TOKENMAXXING_MODEL: effective.model ?? "",
           ...(picked ? { CLAUDE_SECURESTORAGE_CONFIG_DIR: storeDirFor(picked.id) } : {}),
         },
       });
       if (relay !== null) relay.attach(spawned.stdin!, firstLine);
       firstLine = null;
-      if (picked) await recordPresence(spawned, sid, picked, savedTermios);
+      if (picked) {
+        await recordPresenceOrStop({
+          child: spawned,
+          dir: paths.presenceDir,
+          id: sid,
+          accountId: picked.id,
+          event: "supervisor.presence_failed",
+          message: "could not write the session presence file - refusing to run a session whose seat placement cannot see",
+          savedTermios,
+        });
+      }
       return { child: spawned, seat: picked };
     });
 
     child = proc;
-    let done = false;
     let seatCheckAt = 0;
-    const markerWatch = (async () => {
-      while (!done) {
+    await raceMarkerOrExit({
+      child: proc,
+      tick: async () => {
         if (existsSync(marker) && consumableMarker(marker, gate) != null) return true;
         if (seat && !terminating && Date.now() >= seatCheckAt) {
-          const decided = await moveExhaustedSeat(seat, sid, gate);
+          const decided = await moveExhaustedSeat(seat, sid, gate, model);
           seatCheckAt = Date.now() + (decided ? SEAT_RETRY_MS : SEAT_POLL_MS);
         }
-        await Bun.sleep(150);
-      }
-      return false;
-    })();
-    const exited = proc.exited.then(() => { done = true; return "exit" as const; });
-    try {
-      const winner = await Promise.race([exited, markerWatch.then((m) => (m ? "marker" : "exit"))]);
-      if (winner === "marker") {
+        return false;
+      },
+      savedTermios,
+      onKill: () => relay?.detach(),
+      onError: () => clearPresence({ dir: paths.presenceDir, id: sid }),
+      onExited: () => {
+        child = null;
         relay?.detach();
-        proc.kill();
-      }
-    } catch (e) {
-      relay?.detach();
-      proc.kill();
-      clearPresence({ dir: paths.presenceDir, id: sid });
-      throw e;
-    } finally {
-      await proc.exited;
-      child = null;
-      relay?.detach();
-      done = true;
-      await markerWatch.catch(() => {});
-      restoreTermios(savedTermios);
-    }
+      },
+    });
 
     const m = !terminating && existsSync(marker) ? consumableMarker(marker, gate) : null;
     if (m) {
@@ -511,6 +468,7 @@ export async function runSupervisor(argv: string[]): Promise<number> {
         delete compactEnv.TOKENMAXXING_SUPERVISED;
         delete compactEnv.TOKENMAXXING_SESSION_ID;
         delete compactEnv.TOKENMAXXING_LAUNCHED_AT;
+        delete compactEnv.TOKENMAXXING_MODEL;
         const outcome = await compactClaudeSession({ real, sid: m.sessionId, env: compactEnv });
         log("supervisor.compact", { sid: m.sessionId.slice(0, 8), seat: seat.id.slice(0, 8), ok: outcome.ok, reason: outcome.ok ? undefined : outcome.reason });
         if (!outcome.ok) say(`\x1b[33m   compaction did not land (${outcome.reason}) - resuming with the full context\x1b[0m\n`, `tokenmaxxing: compaction did not land; resuming with the full context. (${outcome.reason})`);
@@ -528,6 +486,6 @@ export async function runSupervisor(argv: string[]): Promise<number> {
     }
     clearPresence({ dir: paths.presenceDir, id: sid });
     log("supervisor.exit", { sid, respawns, code: proc.exitCode, signal: proc.signalCode, terminated: terminating || undefined });
-    return proc.exitCode ?? (proc.signalCode ? 1 : 0);
+    return exitStatus(proc);
   }
 }

package/src/lib/claude.ts

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import { mkdirSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { readItem, writeItem, deleteItem, isolatedTarget, readStore, storeTarget, claudeAiOauthOnly } from "./credstore.ts";
@@ -6,9 +6,9 @@ import { resolveRealClaude, resolveVerifiedClaude } from "./claudebin.ts";
 import { withClaudeRefreshLock } from "./claudelock.ts";
 import { ensurePathInRc, installSupervisor, managedShellRcSkipLines, shellRcPath, timerActivationHint } from "./install.ts";
 import { withLock } from "./lock.ts";
-import { log } from "./log.ts";
+import { errorMessage, log } from "./log.ts";
 import { claudeTierLabel, describeIdentity, fetchTokenIdentity, isDeadCredential, InvalidGrantError } from "./oauth.ts";
-import { claudePool, paths, sampleDirFor, seatFromEnv, storeDirFor } from "./paths.ts";
+import { claudePool, env, paths, sampleDirFor, seatFromEnv, storeDirFor } from "./paths.ts";
 import { pickBest, pickEarliestReset, thresholdBars, type PickCtx } from "./picker.ts";
 import { seatCounts } from "./presence.ts";
 import type { Observation, Provider, SampleReport } from "./provider.ts";
@@ -16,8 +16,8 @@ import { foldTee, sampleAccountUsage, teeObservation } from "./sample.ts";
 import { clearUsageSnapshot, loadAccounts, loadConfig, loadUsageSnapshot, pinBinOverride, saveAccounts, type Harvest } from "./state.ts";
 import { loadSetupTokens, saveSetupTokens } from "./setuptokens.ts";
 import { saveTermios, restoreTermios } from "./tty.ts";
-import { CRED_ENV_OVERRIDES, fetchUsageDirect, gatedFamilies, mergeWindows, windowsOf } from "./usage.ts";
-import { CredentialBlobSchema, OAuthAccountSchema, type Account, type Config } from "./types.ts";
+import { fetchUsageDirect, gatedFamilies, mergeWindows, modelFromFlag, scrubCredentialEnv, windowsOf } from "./usage.ts";
+import { CredentialBlobSchema, JsonTextSchema, OAuthAccountSchema, type Account, type Config, type ModelInfo } from "./types.ts";
 import { c } from "../cli/render.ts";
 
 class StoreUnusableError extends Error {
@@ -37,16 +37,15 @@ function presence(): Map<string, number> {
 
 const PROBE_BACKOFF_CAP_MS = 30 * 60 * 1000;
 
-async function observeLive(account: Account, cfg: Config, now: number, opts: { probe: boolean }): Promise<Observation | null> {
+async function observeLive(account: Account, cfg: Config, now: number, opts: { probe: boolean; perModel: boolean }): Promise<Observation | null> {
   const ttl = cfg.policy.usagePollTtlMs;
   const interval = Math.min(ttl * 2 ** (account.probeFails ?? 0), PROBE_BACKOFF_CAP_MS);
   const probeAttempted = account.lastProbeAt != null && now - account.lastProbeAt <= interval;
   const snap = loadUsageSnapshot(account.id);
   const fresh = snap != null && now - snap.at <= ttl;
-  const needsPerModel = snap != null && gatedFamilies(snap.state.model, cfg.policy.switchModels).length > 0;
-  if (opts.probe && !probeAttempted && (!fresh || needsPerModel)) {
+  if (opts.probe && !probeAttempted && (!fresh || opts.perModel)) {
     const startedAt = Date.now();
-    const outcome = await sampleAccountUsage(account, { retries: 0 });
+    const outcome = await sampleAccountUsage(account);
     await withLock(claudePool.lockFile, () => {
       const idx = loadAccounts(claudePool);
       const a = idx.accounts.find((x) => x.id === account.id);
@@ -100,7 +99,7 @@ async function prepareMove(target: Account): Promise<void> {
   try {
     creds = await readStore(target.id);
   } catch (e) {
-    throw new StoreUnusableError(`${target.label}'s store is unreadable (${e instanceof Error ? e.message : String(e)}) - re-auth with \`tokenmaxxing auth ${target.label}\``);
+    throw new StoreUnusableError(`${target.label}'s store is unreadable (${errorMessage(e)}) - re-auth with \`tokenmaxxing auth ${target.label}\``);
   }
   if (!creds) throw new StoreUnusableError(`${target.label} has no credential in its store - re-auth with \`tokenmaxxing auth ${target.label}\``);
   if (isDeadCredential(creds)) {
@@ -125,13 +124,13 @@ async function storeUsable(a: Account): Promise<boolean> {
   }
 }
 
-export function pickSeat(now: number): Account | null {
+export function pickSeat(now: number, model: ModelInfo | null): Account | null {
   const cfg = loadConfig();
   const idx = loadAccounts(claudePool);
   let dirty = false;
   for (const a of idx.accounts) dirty = foldTee(a) || dirty;
   if (dirty) saveAccounts(claudePool, idx);
-  const ctx: PickCtx = { now, thresholds: thresholdBars(cfg), currentId: null, families: cfg.policy.switchModels, seats: presence() };
+  const ctx: PickCtx = { now, thresholds: thresholdBars(cfg), currentId: null, families: gatedFamilies(model, cfg.policy.switchModels), seats: presence() };
   return pickBest(idx.accounts, ctx) ?? pickEarliestReset(idx.accounts, ctx)?.account ?? null;
 }
 
@@ -147,11 +146,11 @@ async function removeCredentials(a: Account): Promise<void> {
   }
 }
 
+const IdentityReadySchema = z.looseObject({ oauthAccount: z.looseObject({ accountUuid: z.string().min(1) }) });
+
 function identityReady(cjPath: string): boolean {
-  if (!existsSync(cjPath)) return false;
   try {
-    const oauthAccount = JSON.parse(readFileSync(cjPath, "utf8")).oauthAccount;
-    return z.object({ accountUuid: z.string().min(1) }).safeParse(oauthAccount).success;
+    return IdentityReadySchema.safeParse(JsonTextSchema.safeParse(readFileSync(cjPath, "utf8")).data).success;
   } catch {
     return false;
   }
@@ -167,8 +166,7 @@ async function login(): Promise<Harvest | null> {
   const real = resolveRealClaude();
 
   const savedTermios = saveTermios();
-  const env: Record<string, string> = { ...process.env, CLAUDE_CONFIG_DIR: onboardDir, TOKENMAXXING_PROBE: "1", TOKENMAXXING_SUPERVISED: "" };
-  for (const key of CRED_ENV_OVERRIDES) delete env[key];
+  const env = scrubCredentialEnv({ ...process.env, CLAUDE_CONFIG_DIR: onboardDir, TOKENMAXXING_PROBE: "1", TOKENMAXXING_SUPERVISED: "" });
   const p = Bun.spawn([real], {
     stdin: "inherit",
     stdout: "inherit",
@@ -208,7 +206,7 @@ async function login(): Promise<Harvest | null> {
     try {
       identity = await fetchTokenIdentity(blob.claudeAiOauth.accessToken);
     } catch (e) {
-      console.error(c.red(`could not verify which account the login belongs to (${e instanceof Error ? e.message : String(e)}) - nothing changed.`));
+      console.error(c.red(`could not verify which account the login belongs to (${errorMessage(e)}) - nothing changed.`));
       return null;
     }
     if (identity.accountUuid !== oauthAccount.accountUuid) {
@@ -287,7 +285,8 @@ export const claude: Provider = {
   presence,
   gatedFamilies: (cfg) => {
     const seat = liveId();
-    return gatedFamilies(seat == null ? null : (loadUsageSnapshot(seat)?.state.model ?? null), cfg.policy.switchModels);
+    const model = modelFromFlag(env("TOKENMAXXING_MODEL", "")) ?? (seat == null ? null : (loadUsageSnapshot(seat)?.state.model ?? null));
+    return gatedFamilies(model, cfg.policy.switchModels);
   },
   observeLive,
   samplePool,

package/src/lib/claudebin.ts

@@ -2,6 +2,7 @@ import { existsSync, mkdirSync, readFileSync, realpathSync, statSync } from "nod
 import { dirname, join } from "node:path";
 import { uniq } from "es-toolkit";
 import { z } from "zod";
+import { errorMessage } from "./log.ts";
 import { paths } from "./paths.ts";
 import { loadConfig } from "./state.ts";
 import { writeFileAtomic } from "./atomic.ts";
@@ -9,7 +10,7 @@ import { writeFileAtomic } from "./atomic.ts";
 export const WRAP_DEPTH_ENV = "TOKENMAXXING_WRAP_DEPTH";
 export const MAX_WRAP_DEPTH = 5;
 export const UNMANAGED_ENV = "TOKENMAXXING_UNMANAGED";
-export const LOOP_DIAGNOSIS = "wrapper re-entered without reaching the real claude";
+export const LOOP_DIAGNOSIS = "wrapper re-entered without reaching the real";
 
 export function wrapDepth(env: Record<string, string | undefined> = process.env): number {
   const n = Number(env[WRAP_DEPTH_ENV] ?? "");
@@ -96,7 +97,7 @@ export function verifyRealClaude(bin: string): string | null {
   try {
     p = Bun.spawnSync([bin, "--version"], { env, stdout: "pipe", stderr: "pipe", timeout: 15_000, killSignal: "SIGKILL" });
   } catch (e) {
-    return e instanceof Error ? e.message : String(e);
+    return errorMessage(e);
   }
   const outText = (p.stdout?.toString() ?? "").trim();
   const err = (p.stderr?.toString() ?? "").trim();

package/src/lib/claudelock.ts

@@ -1,7 +1,7 @@
 import { mkdirSync, realpathSync, rmdirSync, statSync, utimesSync } from "node:fs";
 import { join } from "node:path";
 import { delay } from "es-toolkit";
-import { log } from "./log.ts";
+import { errorMessage, log } from "./log.ts";
 import { ErrnoSchema } from "./types.ts";
 
 const STALE_MS = 60_000;
@@ -48,7 +48,7 @@ export async function withClaudeRefreshLock<T>(
           break;
         }
       } catch (e) {
-        log("claudelock.legacy_error", { err: e instanceof Error ? e.message : String(e) });
+        log("claudelock.legacy_error", { err: errorMessage(e) });
         held.push(primary);
         break;
       }

package/src/lib/cloud.ts

@@ -6,8 +6,8 @@ import { paths } from "./paths.ts";
 import { writeFileAtomic } from "./atomic.ts";
 import { UNMANAGED_ENV, resolveRealClaude } from "./claudebin.ts";
 import { pidExists } from "./proc.ts";
-import { CloudTokenSchema, CloudTokensSchema, type CloudToken } from "./setuptokens.ts";
-import { normalizeResetsAt, parseErrorBody, readTranscriptTail, scrubCredentialEnv } from "./usage.ts";
+import { CloudTokensSchema, type CloudToken } from "./setuptokens.ts";
+import { parseErrorBody, readTranscriptTail, scrubCredentialEnv } from "./usage.ts";
 
 export const TOKENS_ENV = "TOKENMAXXING_TOKENS";
 export const FALLBACK_WALL_MS = 5 * 3_600_000;
@@ -73,11 +73,7 @@ export function saveCloudWalled(walled: Record<string, number>): void {
   writeFileAtomic(paths.cloudWalledJson, JSON.stringify(WalledSchema.parse(walled), null, 2) + "\n");
 }
 
-const PickSchema = z.discriminatedUnion("ok", [
-  z.object({ ok: z.literal(true), token: CloudTokenSchema }),
-  z.object({ ok: z.literal(false), earliestReset: z.number() }),
-]);
-export type Pick = z.infer<typeof PickSchema>;
+export type Pick = { ok: true; token: CloudToken } | { ok: false; earliestReset: number };
 
 export function pickToken(input: {
   tokens: CloudToken[];
@@ -171,6 +167,6 @@ export function limitWallUntil(input: { sessionId: string; sinceBytes: number; n
   const row = rows.findLast((r) => r.isApiErrorMessage === true);
   if (!row || row.error !== "rate_limit" || row.apiErrorIsTransient === true) return null;
   if ((row.quotaLimits?.rateLimitType ?? "") === "" && parseErrorBody(row.errorDetails)?.error?.type !== "rate_limit_error") return null;
-  const resetsAt = row.quotaLimits?.resetsAt != null ? normalizeResetsAt(row.quotaLimits.resetsAt) : null;
+  const resetsAt = row.quotaLimits?.resetsAt ?? null;
   return resetsAt != null && resetsAt > input.now ? resetsAt : input.now + FALLBACK_WALL_MS;
 }

package/src/lib/codex.ts

@@ -9,7 +9,7 @@ import { seatCounts } from "./presence.ts";
 import { CodexUsageReadError, codexLimitLabel, fetchCodexUsage } from "./codexusage.ts";
 import { codexSupervisorLink, ensurePathInRc, installCodexSupervisor, managedShellRcSkipLines, shellRcPath } from "./install.ts";
 import { withLock } from "./lock.ts";
-import { log } from "./log.ts";
+import { errorMessage, log } from "./log.ts";
 import { codexPaths, codexPool, codexSeatFromEnv } from "./paths.ts";
 import { isExhausted, pickBest, pickEarliestReset, thresholdBars, type PickCtx } from "./picker.ts";
 import type { Observation, Provider, SampleReport } from "./provider.ts";
@@ -47,7 +47,7 @@ async function readCodexUsage(account: Account, now: number): Promise<CodexReadO
   try {
     auth = readCodexStoreAuth(account.id);
   } catch (e) {
-    return { ok: false, reason: `store credential unreadable (${(e instanceof Error ? e.message : String(e)).slice(0, 80)})`, deadGrant: false };
+    return { ok: false, reason: `store credential unreadable (${errorMessage(e).slice(0, 80)})`, deadGrant: false };
   }
   if (!auth) return { ok: false, reason: "no credential in this account's store - run `tokenmaxxing auth --codex`", deadGrant: false };
   try {
@@ -110,7 +110,7 @@ async function prepareMove(target: Account): Promise<void> {
   try {
     auth = readCodexStoreAuth(target.id);
   } catch (e) {
-    throw new StoreUnusableError(`${target.label}'s store is unreadable (${e instanceof Error ? e.message : String(e)}) - re-auth with \`tokenmaxxing auth --codex ${target.label}\``);
+    throw new StoreUnusableError(`${target.label}'s store is unreadable (${errorMessage(e)}) - re-auth with \`tokenmaxxing auth --codex ${target.label}\``);
   }
   if (!auth) throw new StoreUnusableError(`${target.label} has no credential in its store - re-auth with \`tokenmaxxing auth --codex ${target.label}\``);
   log("move.prepared", { account: target.id.slice(0, 8), label: target.label });

package/src/lib/codexauth.ts

@@ -84,12 +84,7 @@ function decodeJwtPayload(input: { jwt: string }): unknown {
   return JSON.parse(payload);
 }
 
-const CodexIdentitySchema = z.object({
-  accountId: z.string(),
-  email: z.string().nullable(),
-  planType: z.string().nullable(),
-});
-export type CodexIdentity = z.infer<typeof CodexIdentitySchema>;
+export type CodexIdentity = { accountId: string; email: string | null; planType: string | null };
 
 export function codexIdentityOf(input: { auth: CodexAuthJson }): CodexIdentity {
   const { auth } = input;
@@ -99,11 +94,7 @@ export function codexIdentityOf(input: { auth: CodexAuthJson }): CodexIdentity {
   if (!accountId) {
     throw new Error("codex credential carries no account id (neither tokens.account_id nor the id_token claim)");
   }
-  return CodexIdentitySchema.parse({
-    accountId,
-    email: claims.email ?? null,
-    planType: authClaims?.chatgpt_plan_type ?? null,
-  });
+  return { accountId, email: claims.email ?? null, planType: authClaims?.chatgpt_plan_type ?? null };
 }
 
 export function isCodexAccessExpiring(input: { auth: CodexAuthJson; skewMs?: number; now?: number }): boolean {

package/src/lib/codexbin.ts

@@ -1,6 +1,7 @@
 import { existsSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { LOOP_DIAGNOSIS, MAX_WRAP_DEPTH, WRAP_DEPTH_ENV, pointsBackAtUs } from "./claudebin.ts";
+import { errorMessage } from "./log.ts";
 import { loadConfig } from "./state.ts";
 import { paths } from "./paths.ts";
 
@@ -41,7 +42,7 @@ export function verifyRealCodex(input: { bin: string }): string | null {
   try {
     p = Bun.spawnSync([input.bin, "--version"], { env, stdout: "pipe", stderr: "pipe", timeout: 15_000, killSignal: "SIGKILL" });
   } catch (e) {
-    return e instanceof Error ? e.message : String(e);
+    return errorMessage(e);
   }
   const outText = (p.stdout?.toString() ?? "").trim();
   const err = (p.stderr?.toString() ?? "").trim();

package/src/lib/codexoauth.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { http, oauthErrorCode, safeErrorDetail } from "./http.ts";
+import { errorMessage } from "./log.ts";
 import { env } from "./paths.ts";
 import { CodexAuthJsonSchema, JsonTextSchema, type CodexAuthJson } from "./types.ts";
 
@@ -38,16 +39,10 @@ export async function refreshCodexAuth(input: { auth: CodexAuthJson; now?: numbe
   let res: Response;
   try {
     res = await http.post(TOKEN_URL, {
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        client_id: CLIENT_ID,
-        grant_type: "refresh_token",
-        refresh_token: auth.tokens.refresh_token,
-      }),
+      json: { client_id: CLIENT_ID, grant_type: "refresh_token", refresh_token: auth.tokens.refresh_token },
     });
   } catch (e) {
-    const message = e instanceof Error ? e.message : String(e);
-    throw new CodexRefreshFailedError(`endpoint unreachable: ${message}`);
+    throw new CodexRefreshFailedError(`endpoint unreachable: ${errorMessage(e)}`);
   }
 
   const text = await res.text();