tokenmaxxing 1.59.0 → 1.61.0

package/DESIGN.md

@@ -38,10 +38,10 @@ It is a process manager only - spawn with inherited stdio (stdin through a relay
   - `live/<session-id>` - PID-validated presence per supervised session, naming its account; placement counts them.
   - `respawn/<session-id>` - per-session respawn markers (the hook→supervisor signal): the target account, the session to resume, a `waitUntil`, a `compact` flag, and the launch time the marker was written for.
   - `bin/claude` and `bin/codex` - the supervisors, beside the `tokenmaxxing` and `xx` entry points.
-  - `sessions/<sid>.json`, `sample/`, `onboard/`, `setup-tokens.json`, `setup-token/`, `cloud/`, `update.json`, `spawnrate.json`, `tokenmaxxing.log`, the codex `codex-onboard/`, `codex-respawn/`, and `codex-live/`, and the `grok-*` and `opencode-go-*` state of the status-only pools: the full table is in [State directory layout](docs/content/docs/state-directory.mdx).
+  - `sessions/<sid>.json`, `onboard/`, `setup-tokens.json`, `setup-token/`, `cloud/`, `update.json`, `spawnrate.json`, `tokenmaxxing.log`, the codex `codex-onboard/`, `codex-respawn/`, and `codex-live/`, and the `grok-*` and `opencode-go-*` state of the status-only pools: the full table is in [State directory layout](docs/content/docs/state-directory.mdx).
 - Per-account **credential stores** follow the platform's Claude Code store: macOS = a login-keychain item keyed by the store path (never plaintext on disk); Linux = a 0600 `.credentials.json` inside the 0700 store directory (the same plaintext model claude itself uses - its Linux build has no keyring path at all, binary-verified 2.1.205). One `credstore` facade dispatches on a `{kind: keychain|file}` target; call sites never branch on platform. tokenmaxxing writes a store once, at onboarding; Claude Code's own refresh is the only writer afterwards.
 
-- A periodic check job (`com.tokenmaxxing.check` launchd agent on macOS, `tokenmaxxing-check.timer` systemd user timer on Linux) running `tokenmaxxing check` once per tick (`policy.checkIntervalMs`, 60s by default): it runs the decision with no seat (nothing moves), folds fresh tees into the index, samples up to three accounts whose last sample attempt is oldest (the direct no-spend usage GET first, and for a near-expiry token or a failed read the `/usage` probe under the store to refresh the token, then the GET again), and on a Bun global install checks npm for a newer version once a day, so the cached figures every placement reads stay fresh.
+- A periodic check job (`com.tokenmaxxing.check` launchd agent on macOS, `tokenmaxxing-check.timer` systemd user timer on Linux) running `tokenmaxxing check` once per tick (`policy.checkIntervalMs`, 60s by default): it runs the decision with no seat (nothing moves), folds fresh tees into the index, samples up to three accounts whose last sample attempt is oldest (the direct no-spend usage GET), deletes leftover dead state files at the state root, and on a Bun global install checks npm for a newer version once a day, so the cached figures every placement reads stay fresh.
 
 The switching path runs no long-lived daemon. The statusline pushes usage. Hooks and the supervisor react. The periodic check job above is the only recurring process. The `claude` binary, `~/.claude.json`, and Claude Code's default credential store are untouched; inside `~/.claude` only `settings.json` gets the five entries.
 
@@ -50,7 +50,7 @@ The switching path runs no long-lived daemon. The statusline pushes usage. Hooks
 ## 3. How a move happens
 
 ### 3.1 Usage feed (free, push-based)
-The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limits.{five_hour,seven_day}.{used_percentage,resets_at}`, after every turn, 300ms debounce, zero cost). tokenmaxxing's statusLine tees that to `usage/<uuid8>.json` for the session's seat, read from the inherited `CLAUDE_SECURESTORAGE_CONFIG_DIR` (write-on-change, O(ms)), and renders its own native line (it replaced the earlier pass-through delegation on 2026-07-11: install takes the statusLine slot outright, so a pre-existing custom statusline command is overwritten). A session with no pooled seat writes no tee. The seat is sampled when its tee is older than `policy.usagePollTtlMs`, and for the per-model rows when the active model is a gated family: the direct no-spend usage read with the seat's stored token, and, when that token is near expiry or the read fails, `claude -p '/usage' --output-format json` under the seat's store, whose output is discarded, then the direct read again with the token Claude Code refreshed into the store. The probe runs with a throwaway `CLAUDE_CONFIG_DIR` so no hooks load and `TOKENMAXXING_PROBE=1` in the environment so the hook entries return at once should any load (hooks fire in `-p` too; the compact child sets it as well). It scrubs every ambient credential override claude reads before the store (`CLAUDE_CODE_OAUTH_TOKEN`, `CLAUDE_SECURESTORAGE_CONFIG_DIR`, etc.) and then sets the store it means to read. The sample takes one attempt per interval; a failed sample doubles the interval up to 30 minutes, and a success resets it.
+The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limits.{five_hour,seven_day}.{used_percentage,resets_at}`, after every turn, 300ms debounce, zero cost). tokenmaxxing's statusLine tees that to `usage/<uuid8>.json` for the session's seat, read from the inherited `CLAUDE_SECURESTORAGE_CONFIG_DIR` (write-on-change, O(ms)), and renders its own native line (it replaced the earlier pass-through delegation on 2026-07-11: install takes the statusLine slot outright, so a pre-existing custom statusline command is overwritten). A session with no pooled seat writes no tee. The seat is sampled when its tee is older than `policy.usagePollTtlMs`, and for the per-model rows when the active model is a gated family: the direct no-spend usage read with the seat's stored token. The compact child still sets `TOKENMAXXING_PROBE=1` so the hook entries return at once. The sample takes one attempt per interval; a failed sample doubles the interval up to 30 minutes, and a success resets it. An expired stored access token stays unmeasured until a session on that store refreshes it.
 
 ### 3.2 Detect + decide + signal (Stop hook, per turn)
 1. Resolve the seat: the pooled account whose store the inherited `CLAUDE_SECURESTORAGE_CONFIG_DIR` names. No seat (a session started outside the supervisor) means nothing to move.
@@ -59,7 +59,7 @@ The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limi
 4. Write `respawn/<session-id>` (atomic temp+rename) naming the target, with `waitUntil` now for a plain move or the soonest reset when the pool is depleted. No credential is written.
 
 ### 3.3 Move and depleted-pool pause (supervisor)
-The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed turn boundary, deletes the marker, resets the terminal, compacts the conversation when the marker asks for it (`compact: true` from the Stop and SessionStart hooks and from the supervisor's own seat watch, `false` from StopFailure: it runs `claude -p --resume <sid> /compact` under the old seat's store, bounded at five minutes, and a failure only prints why), and (when `waitUntil` is in the future) shows an interruptible countdown to the reset; then it relaunches `claude --resume <sid>` with `CLAUDE_SECURESTORAGE_CONFIG_DIR` set to the target's store and rewrites the session's presence. The resumed process reads that store cold → runs on the target account, same conversation. The relaunch submits a first prompt that names the move (and the compaction, when it landed) and asks Claude to continue the task, so the conversation goes on without a keystroke: in a terminal session it is the positional prompt after the session id; in a stream-json session (`--input-format stream-json`, where the binary ignores a positional prompt) the supervisor owns stdin, relays the harness's lines to the child through a pipe, and writes the prompt as the first `user` line of the new process. In a terminal session the supervisor's own notices go to stderr. In a stream-json session (`--output-format stream-json`, read from the effective flags like the relay) there is no terminal and no statusline, so the supervisor writes each notice (the compaction and its failure, the move, the depleted-pool wait with its resume time, the resume) to stdout as a `system` line of subtype `informational` and level `warning`, the shape Claude Code emits for its own print-mode notices, which the harness renders in the conversation while the stream stays parseable; the per-second countdown ticks stay terminal-only, and the supervisor writes only while no child is running. The `SessionStart` hook (every source) re-runs the decision before the first turn and writes the same marker if the seat is already over its bar or the pool is depleted. The supervisor also watches its own seat every ten seconds while the child runs (account record plus tee, the same bars) and writes the marker itself when the seat is at or over a bar, so a move never depends on a hook firing: a harness session between turns whose background workflow burns the window, or a subagent refusal that stamped the wall, is moved within seconds. SIGTERM to the supervisor is forwarded to the child and the supervisor exits after it, so a harness that stops the wrapper (the Agent SDK does) never leaves an orphaned claude on the old seat. A marker whose `launchedAt` does not match the running child is discarded, and after a Ctrl-C on the countdown a later marker whose `waitUntil` falls inside the skipped wait is ignored. A marker that fails to parse is never deleted and never treated as absent: the supervisor stops the child, restores the terminal, and exits naming the marker path.
+The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed turn boundary, deletes the marker, resets the terminal, compacts the conversation when the marker asks for it (`compact: true` from the Stop and SessionStart hooks and from the supervisor's own seat watch, `false` from StopFailure: it runs `claude -p --resume <sid> /compact` under the old seat's store, bounded at five minutes, and a failure only prints why), and (when `waitUntil` is in the future) shows an interruptible countdown to the reset; then it relaunches `claude --resume <sid>` with `CLAUDE_SECURESTORAGE_CONFIG_DIR` set to the target's store and rewrites the session's presence. The resumed process reads that store cold → runs on the target account, same conversation. The relaunch submits a first prompt that names the move (and the compaction, when it landed) and asks Claude to continue the task, so the conversation goes on without a keystroke: in a terminal session it is the positional prompt after the session id; in a stream-json session (`--input-format stream-json`, where the binary ignores a positional prompt) the supervisor owns stdin, relays the harness's lines to the child through a pipe, and writes the prompt as the first `user` line of the new process. In a terminal session the supervisor's own notices go to stderr. In a stream-json session (`--output-format stream-json`, read from the effective flags like the relay) there is no terminal and no statusline, so the supervisor writes each notice (the compaction and its failure, the move, the depleted-pool wait with its resume time, the resume) to stdout as a `system` line of subtype `informational` and level `warning`, the shape Claude Code emits for its own print-mode notices, which the harness renders in the conversation while the stream stays parseable; the per-second countdown ticks stay terminal-only, and the supervisor writes only while no child is running. The `SessionStart` hook (every source) re-runs the decision before the first turn and writes the same marker if the seat is already over its bar or the pool is depleted. The supervisor also watches its own seat every ten seconds while the child runs (account record plus tee, the same bars) and writes the marker itself when the seat is at or over a bar, so a move never depends on a hook firing: a harness session between turns whose background workflow burns the window, or a subagent refusal that stamped the wall, is moved within seconds. SIGTERM to the supervisor is forwarded to the child and the supervisor exits after it, so a harness that stops the wrapper (the Agent SDK does) never leaves an orphaned claude on the old seat. A marker whose `launchedAt` does not match the running child is discarded, and after a Ctrl-C on the countdown a later marker whose `waitUntil` falls inside the skipped wait is ignored. A marker that fails to parse is never deleted and never treated as absent: the supervisor stops the child, restores the terminal, and exits naming the marker path. In a stream-json session that fatal, the wrap-depth abort, the wrap-rate abort, and a failed presence write also go to stdout as the same `informational`/`warning` line.
 
 ### 3.4 Placement (supervisor, under the pool lock)
 1. Fold every account's tee into the index.
@@ -67,14 +67,14 @@ The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed
 3. Spawn claude with the store env set, then write `live/<sid>` with the child's pid and start time. The lock covers the pick and the presence write, so concurrent launches see each other.
 
 ### 3.5 Multiple concurrent sessions
-Each terminal ran the supervisor, so each has its own child `claude`, its own `--session-id`, its own seat, and its own presence file. Sessions spread over the pool at launch (the second launch never lands on the first's account while another fresh account exists), sessions on one account share its store and coordinate refreshes through Claude Code's own store-rooted refresh lock, and each session moves on its own seat's figures. A move never touches another session. Only a shared state read is serialized: the pool lock covers decisions, placement, and the sampler's reservation; the tick's `/usage` child runs outside it, while a live `status` probes under it.
+Each terminal ran the supervisor, so each has its own child `claude`, its own `--session-id`, its own seat, and its own presence file. Sessions spread over the pool at launch (the second launch never lands on the first's account while another fresh account exists), sessions on one account share its store and coordinate refreshes through Claude Code's own store-rooted refresh lock, and each session moves on its own seat's figures. A move never touches another session. Only a shared state read is serialized: the pool lock covers decisions, placement, and the sampler's reservation; the tick's usage GET runs outside it, while a live `status` samples under it.
 
 ---
 
 ## 4. Onboarding (no `adopt`)
 
 - **`tokenmaxxing init` logs your first pooled account in through an isolated browser sign-in, even if you are already signed in.** The login runs in a throwaway `CLAUDE_CONFIG_DIR=~/.config/tokenmaxxing/onboard`, its token's owner is verified through the profile endpoint (`GET /api/oauth/profile`, matched on `account.uuid`), and the credential is harvested once into that account's store; the throwaway home and its credential item are deleted. The login you already had keeps its own grant in Claude Code's default store for sessions started outside the supervisor; it is never copied, because a copy of one grant in two stores dies at the first refresh. `init` also installs the supervisor + the five settings entries.
-- **`tokenmaxxing add`** - registers *additional* accounts the same way, one store each. `CLAUDE_CONFIG_DIR` is SET by tokenmaxxing only for throwaway homes like this one, the probe homes under `sample/`, and the `setup-token/` mint homes; a session's store is always set through `CLAUDE_SECURESTORAGE_CONFIG_DIR`.
+- **`tokenmaxxing add`** - registers *additional* accounts the same way, one store each. `CLAUDE_CONFIG_DIR` is SET by tokenmaxxing only for throwaway homes like this one and the `setup-token/` mint homes; a session's store is always set through `CLAUDE_SECURESTORAGE_CONFIG_DIR`.
 - **`tokenmaxxing auth [sel | --all]`** - reauthenticates an *existing* pool member whose store died (a needs-reauth account can never heal on its own: the dead grant is exactly what Claude Code's refresh would need). Same isolated-login harvest as `add`, but it states which email to sign in with and **requires the login to land on the target account** (verified `accountUuid` must match, else nothing changes). Bare `auth` lists the pool with emails and asks which; `--all` walks every account that is flagged or whose store holds no usable credential, one by one.
 - Both commands exercise `security` reads/writes interactively (where a macOS keychain ACL prompt is acceptable), so the first access never happens cold inside a headless hook.
 
@@ -84,13 +84,13 @@ Each terminal ran the supervisor, so each has its own child `claude`, its own `-
 The [switching policy](docs/content/docs/switching.mdx) is one rule: under both bars, hold; at or over a bar, move to the usable account that ranks first; nothing usable, wait for the soonest reset. The same ranking places a session at launch.
 
 - Ranking (decided by consult for #79): greatest remaining headroom to the session bar divided by the number of sessions after placement, `(bar - used) / (sessions + 1)`, then highest pace pressure (remaining percent of the binding gated per-model cap, or of the weekly aggregate for an account with no gated row, over time to its reset), then soonest weekly reset, then lowest weekly usage; unknown usage ranks last. Organization membership is not an input. Codex drops the headroom key, keeps the pace ordering and the weekly tie-breaks, and excludes accounts running in another codex session, because codex has no cross-process refresh lock and two sessions must never share a login.
-- Selection reads the cached figures only, after folding every account's tee. Each periodic check tick samples up to three accounts whose last sample attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`, over the direct no-spend usage read with the account's stored token, and, when the token is near expiry or that read fails, over the `/usage` child under its store followed by the read again with the refreshed token, so every account is attempted about once per three ticks per pooled account, or once per `policy.usagePollTtlMs` plus a tick when that is longer, and its cached figure is as fresh as its last successful attempt or its sessions' latest push. The pool lock covers only the reservation and the result write, never the read or the `/usage` child.
+- Selection reads the cached figures only, after folding every account's tee. Each periodic check tick samples up to three accounts whose last sample attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`, over the direct no-spend usage read with the account's stored token, so every account is attempted about once per three ticks per pooled account, or once per `policy.usagePollTtlMs` plus a tick when that is longer, and its cached figure is as fresh as its last successful attempt or its sessions' latest push. The pool lock covers only the reservation and the result write, never the usage GET. An expired stored access token stays unmeasured until a session on that store refreshes it.
 - The depleted pause happens at the bar, not at 100; Codex has no pause and rides its account until the server refuses it, because a running sibling cannot adopt another account without restarting.
 - Neither pool has a post-swap cooldown or a manual `switch`: a move is a respawn of one session under a fixed store, so nothing another session reads is invalidated by it, and placement at launch replaces the manual pick.
 
 The [profile](docs/content/docs/switching-profile.mdx) records observed cache rewrites across swaps and does not infer subscription quota savings.
 
-**Model-aware trigger.** Claude subscriptions also enforce **per-model weekly caps** - currently only for Sonnet and Fable (there is no Opus-only quota), and Fable's tighter limit binds *before* the aggregate (e.g. 80% week-Fable at only 50% week-all-models). This cap isn't in statusLine stdin, so when the session's model is in `policy.switchModels`, or the seat's tee is older than the TTL, we read it from the `limits[]` rows of the direct no-spend usage read for the seat (free, 0 tokens, one attempt with backoff, with the `/usage` probe under the seat's store refreshing the token when the read needs it) and add `week(<activeModel>) >= threshold` to the trigger. A Fable session moves on the Fable cap; a Sonnet session rides the aggregate. Candidate screening applies the same per-model gate: a burnt Fable cap screens an account out of a move. A session's model is the `--model` value it was launched with: the supervisor reads it from the launch flags, uses it for launch placement and the seat watch, and hands it to the session's hooks in `TOKENMAXXING_MODEL`, which the hooks read ahead of the per-account tee. With the default `policy.switchModels`, a session launched as Opus, Sonnet, or Haiku gates no per-model cap, so it runs on an account whose Fable cap is spent while the session and weekly windows have headroom. A launch without `--model`, or with a value that names no model family (`best`, `opusplan`), is unknown: launch placement and the seat watch gate every configured family for it, and its hooks fall back to the model in the account's tee. A move off a walled seat, or one that follows a subagent's five-hour or weekly refusal, screens candidates on every configured family whatever the launch model.
+**Model-aware trigger.** Claude subscriptions also enforce **per-model weekly caps** - currently only for Sonnet and Fable (there is no Opus-only quota), and Fable's tighter limit binds *before* the aggregate (e.g. 80% week-Fable at only 50% week-all-models). This cap isn't in statusLine stdin, so when the session's model is in `policy.switchModels`, or the seat's tee is older than the TTL, we read it from the `limits[]` rows of the direct no-spend usage read for the seat (free, 0 tokens, one attempt with backoff) and add `week(<activeModel>) >= threshold` to the trigger. A Fable session moves on the Fable cap; a Sonnet session rides the aggregate. Candidate screening applies the same per-model gate: a burnt Fable cap screens an account out of a move. A session's model is the `--model` value it was launched with: the supervisor reads it from the launch flags, uses it for launch placement and the seat watch, and hands it to the session's hooks in `TOKENMAXXING_MODEL`, which the hooks read ahead of the per-account tee. With the default `policy.switchModels`, a session launched as Opus, Sonnet, or Haiku gates no per-model cap, so it runs on an account whose Fable cap is spent while the session and weekly windows have headroom. A launch without `--model`, or with a value that names no model family (`best`, `opusplan`), is unknown: launch placement and the seat watch gate every configured family for it, and its hooks fall back to the model in the account's tee. A move off a walled seat, or one that follows a subagent's five-hour or weekly refusal, screens candidates on every configured family whatever the launch model.
 
 ---
 
@@ -115,7 +115,7 @@ The [profile](docs/content/docs/switching-profile.mdx) records observed cache re
 
 **Removed (1.37.0, issue #79):** the shared live credential and everything that served it: the swap-time harvest, park, and install, tokenmaxxing's own OAuth refresh grant and its interlock with Claude Code's refresh lock, the `~/.claude.json` `oauthAccount` rewrite, the 45-second post-swap cooldown, the pool-wide depleted-wait record, the parked-credential slots (`creds/`, `tokenmaxxing-cred-*`), the ambient `CLAUDE_CONFIG_DIR` refusal, and manual `switch` for the Claude pool.
 
-**Shipped since (0.13.0):** Codex as a second pool with its own state (`codex-accounts.json`, per-account `codex-stores/`, own flock). Since 1.35.0 the engine is one: a generic account record (`id`, `label`, `email`, `tier`, `windows`), one picker, one decision, and one set of account commands run against a `Provider` (`src/lib/provider.ts`); `src/lib/claude.ts` and `src/lib/codex.ts` hold only what differs per product (credential store, identity, usage source, presence, login and install flows), and the provider's `seats` capability (`shared` for Claude, `live` for Codex) is how the engine knows whether present accounts stay candidates and whether a move needs the caller's respawn. Codex differences that shaped it: restart IS the switch (a running codex refuses another account's credential), one store per pooled account with `CODEX_HOME` set per session (everything but `auth.json` symlinked to the shared home, so resume works across stores), usage is a free direct GET with epoch resets and a duration-classified window set (the weekly window is primary on current plans), the refresh token rotates with reuse punished (persisted into the account's own store the instant it returns, never refreshed for an account running in another session), and the codex Stop hook drives the auto-switch through a codex supervisor shim that respawns `codex resume <session-id>` under the target's store (hooks must be trusted once via `/hooks`). Since 1.44.0 two status-only pools, grok and opencode-go, share the engine's account commands and state layout with `statusOnly: true` and no supervisor, hooks, or usage source ([Status-only pools](docs/content/docs/status-only-pools.mdx)).
+**Shipped since (0.13.0):** Codex as a second pool with its own state (`codex-accounts.json`, per-account `codex-stores/`, own flock). Since 1.35.0 the engine is one: a generic account record (`id`, `label`, `email`, `tier`, `windows`), one picker, one decision, and one set of account commands run against a `Provider` (`src/lib/provider.ts`); `src/lib/claude.ts` and `src/lib/codex.ts` hold only what differs per product (credential store, identity, usage source, presence, login and install flows), and the provider's `seats` capability (`shared` for Claude, `live` for Codex) is how the engine knows whether present accounts stay candidates and whether a move needs the caller's respawn. Codex differences that shaped it: restart IS the switch (a running codex refuses another account's credential), one store per pooled account with `CODEX_HOME` set per session (everything but `auth.json` symlinked to the shared home, so resume works across stores), usage is a free direct GET with epoch resets and a duration-classified window set (the weekly window is primary on current plans), the refresh token rotates with reuse punished (persisted into the account's own store the instant it returns, never refreshed for an account running in another session), and the codex Stop hook drives the auto-switch through a codex supervisor shim that respawns `codex resume <session-id>` under the target's store (hooks must be trusted once via `/hooks`). Since 1.44.0 two status-only pools, grok and opencode-go, share the engine's account commands and state layout with `statusOnly: true` and no supervisor or hooks ([Status-only pools](docs/content/docs/status-only-pools.mdx)). grok `status` reads the weekly subscription credit window from the credits billing GET; opencode-go has no usage source.
 
 **Shipped since (1.29.0):** a Cursor Cloud relay. A cloud VM has no keychain, no pool state, and no supervisor, so the path uses what it does have (environment variables, a shell, repo files) and a different credential primitive, one-year inference-only setup tokens, minted once per pooled account by `tokenmaxxing setup-token` on the owner's machine and carried to the VM as one user-scoped Runtime Secret (`TOKENMAXXING_TOKENS`). `tokenmaxxing cursor init` writes `.cursor/environment.json` and a `claude` project subagent (`.cursor/agents/claude.md`) that forwards each task to `tokenmaxxing cloud run`, which spawns `claude -p --dangerously-skip-permissions --output-format json` under `CLAUDE_CODE_OAUTH_TOKEN` and pins the thread to that token (the API caches by exact prefix, so a rotation busts one thread, not all). A setup token carries no usage signal, so rotation is reactive. A run whose transcript gained a non-transient rate-limit row during that run (the structured row the StopFailure hook reads) walls the label until the reset the row names (five hours without one) and resumes the same session on the next token; the result's `api_error_status` alone never walls, so a transient 429 or an older row from a previous token does not cascade across the pool. The local switching engine never reads a setup token; `/usage` prints no percentages under one. Details in [Cursor Cloud](docs/content/docs/cursor-cloud.mdx).
 
@@ -132,12 +132,12 @@ TypeScript on Bun, shipped as source: one multi-call entry (`src/main.ts`, `#!/u
 
 ### 2026-09-12 (per-account stores, 1.37.0)
 
-Hermetic run on Linux under a throwaway `HOME` and `TOKENMAXXING_HOME`, a stub `claude` that records its environment and answers `-p /usage` from a per-store fixture, and a synthetic three-account version 2 pool with equal headroom on two accounts and the third over its session bar. Usage no longer comes from that output, so repeating the run against the current code needs two other pieces: a stub usage endpoint named by `TOKENMAXXING_OAUTH_USAGE_URL` that answers per access token, and a stub `claude` whose `-p /usage` run leaves a credential in the store with an access token that is not near expiry.
+Hermetic run on Linux under a throwaway `HOME` and `TOKENMAXXING_HOME`, a stub `claude` that records its environment, and a synthetic three-account version 2 pool with equal headroom on two accounts and the third over its session bar. Usage comes from a stub usage endpoint named by `TOKENMAXXING_OAUTH_USAGE_URL` that answers per access token. There is no `/usage` spawn.
 
 1. **Placement - ✅.** The first supervised launch spawned the stub with `CLAUDE_SECURESTORAGE_CONFIG_DIR=stores/<first account>` and wrote its presence; the second launch, with equal headroom, landed on the other account.
 2. **Plain move - ✅.** A 95% session tee for the second session's account made its Stop hook write the marker; the supervisor relaunched `--resume <sid>` under the first account's store within a second and rewrote the presence file.
 3. **Wall move - ✅.** A five-hour refusal row fed to the first session's StopFailure hook stamped `enforcedUntil` on its seat and moved the session to the account that had just been freed; a Stop hook on the walled seat moved the remaining session off it too.
-4. **Sampling - ✅.** The check tick probed the stalest account under its store with the `-tick` probe home; live `status` probed the accounts without a fresh tee under their stores and read the one with a fresh tee from the tee.
+4. **Sampling - ✅.** The check tick sampled the stalest account over the direct usage GET with the stored token; live `status` sampled the accounts without a fresh tee the same way and read the one with a fresh tee from the tee.
 5. **Stores never move - ✅.** SHA-256 of every store's `.credentials.json` was identical before and after; no `creds/` directory and no root `usage.json` appeared; the SessionStart hook on a seat under its bars wrote no marker; stopping the children cleared every presence file.
 
 The `pooledSpawnEnv` helper the issue names left with the SDK surface in 1.23.0; the supervisor's launch environment is the one spawn-env site.

package/README.md

@@ -90,7 +90,7 @@ The bars' headroom is deliberate: it's the budget to reach a clean turn boundary
 
 Launches and moves rank usable accounts by session-window headroom per running session, `(bar - used) / (sessions + 1)`, so two fresh accounts alternate and a third session goes to whichever has more headroom left per session; ties break by pace pressure (remaining percent of the binding gated per-model cap, or of the weekly aggregate for an account with no gated row, divided by time to its reset, highest first), then soonest weekly reset, then lowest weekly use. Organization membership is not an input.
 
-- Every periodic check tick folds fresh statusline tees into the index and samples up to three accounts whose last sample attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`: the direct no-spend usage read first, and, only for a near-expiry token or a failed read, `claude -p '/usage'` under the account's store to refresh the token, followed by that read again; a move reads the cached figures, which are as fresh as each account's last successful attempt or its sessions' latest push.
+- Every periodic check tick folds fresh statusline tees into the index and samples up to three accounts whose last sample attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`, with the direct no-spend usage read; a move reads the cached figures, which are as fresh as each account's last successful attempt or its sessions' latest push. An expired stored access token stays unmeasured until a session on that store refreshes it.
 - When no account is usable, the session pauses until the soonest reset if that lands within `policy.maxWaitMs`, and otherwise stays put.
 
 See [How switching decides](docs/content/docs/switching.mdx) for the policy and the [cache-cost profile](docs/content/docs/switching-profile.mdx) for measurements and their limits.
@@ -142,7 +142,7 @@ A Cursor Cloud Agent can hand substantial work to Claude Code running on your ow
 - **One shared identity file.** `~/.claude.json` holds one `oauthAccount` that Claude Code rewrites after whichever session refreshed last, so `/status` can show another session's email; the statusline's `◆` marks the account a session actually uses.
 - **Keychain (macOS).** The first keychain access for a new store happens inside the interactive `init`, `add`, or `auth` run, where a prompt can be answered, not inside a headless hook.
 - **Plaintext credentials (Linux).** Claude Code itself stores Linux credentials as a 0600 plaintext file; a store follows the same model.
-- **Status-only pools carry no usage.** grok and opencode-go accounts render with no bars and never move.
+- **Status-only pools do not switch.** grok `status` shows the weekly subscription credit window; opencode-go accounts still render with no bars. Neither pool moves.
 
 ## How it's built
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.59.0",
+  "version": "1.61.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts, start each session on its own account, and resume a session on a fresher account when quota fills.",
   "type": "module",
   "license": "MIT",

package/src/cli/check.ts

@@ -1,6 +1,7 @@
 import { claude } from "../lib/claude.ts";
 import { evaluateAndMaybeSwap } from "../lib/decide.ts";
 import { sampleOldest } from "../lib/sample.ts";
+import { pruneStaleSessions } from "../lib/sessions.ts";
 import { loadConfig } from "../lib/state.ts";
 import { maybeAutoUpdate } from "../lib/update.ts";
 import { errorMessage, log } from "../lib/log.ts";
@@ -10,6 +11,7 @@ export async function cmdCheck(json = false): Promise<number> {
   const now = Date.now();
   let d;
   try {
+    pruneStaleSessions(now);
     d = await evaluateAndMaybeSwap(claude, now);
     await sampleOldest(loadConfig());
     await maybeAutoUpdate();

package/src/entries/stopfailurehook.ts

@@ -41,6 +41,10 @@ export async function runStopFailureHook(): Promise<number> {
   const stdinSid = stdin.session_id;
   const session = supervisedSession();
   const mainLoop = stdin.agent_id === undefined;
+  if (stdinSid != null && session != null && stdinSid !== session.sid) {
+    log("stopfailure.nested_session", { stdin: stdinSid.slice(0, 8), supervised: session.sid.slice(0, 8) });
+    return 0;
+  }
   const canRespawn = session != null && mainLoop;
 
   try {

package/src/entries/stophook.ts

@@ -17,6 +17,11 @@ export async function runBoundaryHook(event: "stop" | "sessionstart"): Promise<n
   const parsed = BoundaryStdin.safeParse(JsonTextSchema.safeParse(await readStdin()).data);
   const stdin = parsed.success ? parsed.data : {};
   const session = supervisedSession();
+  const nested = stdin.session_id != null && session != null && stdin.session_id !== session.sid;
+  if (nested) {
+    log(`${event}.nested_session`, { stdin: stdin.session_id?.slice(0, 8), supervised: session?.sid.slice(0, 8) });
+    return 0;
+  }
 
   try {
     const decision = await evaluateAndMaybeSwap(claude, Date.now(), session != null);

package/src/entries/supervisor.ts

@@ -187,7 +187,7 @@ function consumableMarker(marker: string, gate: MarkerGate): z.infer<typeof Resp
   } catch (e) {
     log("supervisor.marker_invalid", { err: errorMessage(e) });
     throw new Error(
-      `${marker} is corrupt (unparsable JSON or off-schema) - the session was stopped instead of guessing whether the pool is depleted; inspect the marker, then run \`claude --resume ${basename(marker)}\` (a fresh launch clears it)`,
+      `tokenmaxxing: the session was stopped because the respawn marker is corrupt. Inspect ${marker}, then run \`claude --resume ${basename(marker)}\` (a fresh launch clears it)`,
     );
   }
   if (m.launchedAt !== undefined && m.launchedAt !== gate.launchedAt) {
@@ -330,10 +330,36 @@ class StdinRelay {
   }
 }
 
+function bareResumeStream(info: Analysis, argv: string[], sid: string | null): boolean {
+  if (!info.manage || process.env[UNMANAGED_ENV] || info.sessionId != null || stripSessionFlags(argv).length !== 0 || sid == null) return false;
+  try {
+    const persisted = loadSessionFlags(sid);
+    return persisted != null && analyzeArgs(persisted).streamOutput;
+  } catch {
+    return false;
+  }
+}
+
 export async function runSupervisor(argv: string[]): Promise<number> {
-  if (loopGuardTripped("claude")) return 1;
-  const real = resolveRealClaude();
   const info = analyzeArgs(argv);
+  const drivenSid = info.sessionId ?? info.resumeId ?? (info.continueLatest ? latestSessionForCwd() : null);
+  const earlyStream = info.streamOutput || bareResumeStream(info, argv, drivenSid);
+  const earlySid = drivenSid ?? crypto.randomUUID();
+  if (loopGuardTripped("claude")) {
+    if (earlyStream) {
+      process.stdout.write(systemLine(earlySid, "tokenmaxxing: wrapper re-entered without reaching the real Claude. Fix claudeBin, then run tokenmaxxing doctor."));
+    }
+    return 1;
+  }
+  let real: string;
+  try {
+    real = resolveRealClaude();
+  } catch (e) {
+    if (!earlyStream) throw e;
+    process.stdout.write(systemLine(earlySid, `tokenmaxxing: ${errorMessage(e)}`));
+    log("supervisor.resolve_failed", { err: errorMessage(e) });
+    return 1;
+  }
   const childEnv = { ...process.env, [WRAP_DEPTH_ENV]: String(wrapDepth() + 1) };
 
   let child: Subprocess | null = null;
@@ -397,6 +423,7 @@ export async function runSupervisor(argv: string[]): Promise<number> {
   let respawns = 0;
   let overriddenUntil = 0;
   let wanted: string | null = null;
+  try {
   while (true) {
     if (existsSync(marker)) rmSync(marker, { force: true });
 
@@ -488,4 +515,11 @@ export async function runSupervisor(argv: string[]): Promise<number> {
     log("supervisor.exit", { sid, respawns, code: proc.exitCode, signal: proc.signalCode, terminated: terminating || undefined });
     return exitStatus(proc);
   }
+  } catch (e) {
+    const msg = errorMessage(e);
+    const text = msg.startsWith("tokenmaxxing:") ? msg : `tokenmaxxing: ${msg}`;
+    say(`\n\x1b[31m${text}\x1b[0m\n`, text);
+    log("supervisor.fatal", { err: msg });
+    return 1;
+  }
 }

package/src/lib/decide.ts

@@ -1,6 +1,6 @@
 import { withLock } from "./lock.ts";
 import { loadAccounts, loadConfig, saveAccounts } from "./state.ts";
-import { isExhausted, limitWindows, nextWeeklyReset, pickBest, pickEarliestReset, sessionWindow, thresholdBars, usableAt, weeklyWindow, type PickCtx } from "./picker.ts";
+import { isExhausted, limitWindows, liveUsed, nextWeeklyReset, pickBest, pickEarliestReset, sessionWindow, thresholdBars, usableAt, weeklyWindow, type PickCtx } from "./picker.ts";
 import { familyTokens } from "./usage.ts";
 import { errorMessage, log } from "./log.ts";
 import type { Observation, Provider } from "./provider.ts";
@@ -19,6 +19,12 @@ function isOver(account: Account | undefined, observed: Observation | null, ctx:
   return isExhausted({ ...account, windows: observed.windows }, ctx);
 }
 
+function modelKindCovered(limit: EnforcedLimit, account: Account, now: number, weeklyBar: number): boolean {
+  if (limit.kind !== "model" || limit.family == null) return false;
+  const family = limit.family;
+  return limitWindows(account).some((w) => familyTokens(w.name ?? "").includes(family) && liveUsed(w, now) >= weeklyBar);
+}
+
 function enforcedWall(limit: EnforcedLimit, account: Account, now: number): number {
   const { family } = limit;
   const familyReset =
@@ -57,13 +63,18 @@ export async function evaluateAndMaybeSwap(p: Provider, now = Date.now(), canRes
 
     const origin = enforced ? idx.accounts.find((a) => a.id === enforced.account) : undefined;
     const prior = origin?.enforcedUntil != null && origin.enforcedUntil > now;
+    let stamped = false;
     if (enforced && origin) {
-      origin.enforcedUntil = Math.max(origin.enforcedUntil ?? 0, enforcedWall(enforced, origin, now));
+      const covered = modelKindCovered(enforced, origin, now, bars.weekly);
+      if (!covered || prior) {
+        origin.enforcedUntil = Math.max(origin.enforcedUntil ?? 0, enforcedWall(enforced, origin, now));
+        stamped = true;
+      }
       origin.lastProbeAt = now;
       saveAccounts(p.pool, idx);
-      log("usage.enforced_limit", { kind: enforced.kind, family: enforced.family ?? undefined, resetsAt: origin.enforcedUntil, blind: prior || enforced.blind, live: origin === active });
+      log("usage.enforced_limit", { kind: enforced.kind, family: enforced.family ?? undefined, resetsAt: origin.enforcedUntil, blind: prior || enforced.blind, live: origin === active, covered: covered && !prior });
     }
-    const enforced2 = enforced && origin && origin === active ? enforced : null;
+    const enforced2 = stamped && origin === active ? enforced : null;
 
     if (id2 != null && !active) {
       return { swapped: false, account: null, reason: "live-credential-not-in-pool" };

package/src/lib/grok.ts

@@ -2,10 +2,13 @@ import { mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { writeFileAtomic } from "./atomic.ts";
+import { fetchGrokUsage, GrokUsageReadError } from "./grokusage.ts";
+import { errorMessage } from "./log.ts";
 import { grokAuthJsonFor, grokPaths, grokPool, grokSeatFromEnv, grokStoreDirFor } from "./paths.ts";
-import type { Provider } from "./provider.ts";
+import type { Provider, SampleReport } from "./provider.ts";
 import { loadAccounts, type Harvest } from "./state.ts";
 import { statusOnlyProvider, type AuthEntry } from "./statusonly.ts";
+import type { Account } from "./types.ts";
 import { c } from "../cli/render.ts";
 
 const GrokAuthEntrySchema = z.looseObject({
@@ -13,11 +16,14 @@ const GrokAuthEntrySchema = z.looseObject({
   principal_id: z.string().optional(),
   email: z.string().nullish(),
   first_name: z.string().nullish(),
+  key: z.string().optional(),
   refresh_token: z.string().optional(),
   expires_at: z.string().nullish(),
 });
 type GrokAuthEntry = z.infer<typeof GrokAuthEntrySchema>;
 
+type GrokCred = { id: string; token: string; expiresAt: number | null };
+
 function harvestOf(id: string, key: string, entry: GrokAuthEntry): Harvest {
   return {
     id,
@@ -31,7 +37,7 @@ function harvestOf(id: string, key: string, entry: GrokAuthEntry): Harvest {
   };
 }
 
-function readAuth(path: string): AuthEntry[] {
+function readMap(path: string): [string, GrokAuthEntry][] {
   let raw: unknown;
   try {
     raw = JSON.parse(readFileSync(path, "utf8"));
@@ -40,18 +46,87 @@ function readAuth(path: string): AuthEntry[] {
   }
   const map = z.record(z.string(), z.unknown()).safeParse(raw);
   if (!map.success) return [];
-  const out: AuthEntry[] = [];
+  const out: [string, GrokAuthEntry][] = [];
   for (const [key, value] of Object.entries(map.data)) {
     const parsed = GrokAuthEntrySchema.safeParse(value);
     if (!parsed.success) continue;
-    const entry = parsed.data;
+    out.push([key, parsed.data]);
+  }
+  return out;
+}
+
+function readAuth(path: string): AuthEntry[] {
+  const out: AuthEntry[] = [];
+  for (const [key, entry] of readMap(path)) {
     const id = entry.user_id ?? entry.principal_id ?? key;
     out.push({ id, usable: (entry.refresh_token ?? "") !== "", harvest: id === "" ? null : harvestOf(id, key, entry) });
   }
   return out;
 }
 
-export const grok: Provider = statusOnlyProvider({
+function credsIn(path: string): GrokCred[] {
+  const out: GrokCred[] = [];
+  for (const [key, entry] of readMap(path)) {
+    const id = entry.user_id ?? entry.principal_id ?? key;
+    const token = entry.key ?? "";
+    if (id === "" || token === "") continue;
+    const expiresAt = entry.expires_at != null ? Date.parse(entry.expires_at) : null;
+    out.push({ id, token, expiresAt: expiresAt != null && Number.isFinite(expiresAt) ? expiresAt : null });
+  }
+  return out;
+}
+
+function liveCred(accountId: string): GrokCred | null {
+  return credsIn(join(grokPaths.home, "auth.json")).find((c) => c.id === accountId) ?? null;
+}
+
+function bearerFor(accountId: string, now: number): { token: string; from: "store" | "live" } | null {
+  const store = credsIn(grokAuthJsonFor(accountId)).find((c) => c.id === accountId) ?? null;
+  const live = liveCred(accountId);
+  if (store != null && (store.expiresAt == null || store.expiresAt > now + 60_000)) return { token: store.token, from: "store" };
+  if (live != null) return { token: live.token, from: "live" };
+  if (store != null) return { token: store.token, from: "store" };
+  return null;
+}
+
+async function readGrokUsage(account: Account, now: number): Promise<{ ok: true; at: number } | { ok: false; reason: string }> {
+  const first = bearerFor(account.id, now);
+  if (first == null) return { ok: false, reason: "no usable credential in this account's store - run `tokenmaxxing auth --grok`" };
+  try {
+    const usage = await fetchGrokUsage({ token: first.token, at: now });
+    account.windows = usage.windows;
+    account.lastUsageAt = usage.at;
+    return { ok: true, at: usage.at };
+  } catch (e) {
+    if (e instanceof GrokUsageReadError && e.status === 401 && first.from === "store") {
+      const live = liveCred(account.id);
+      if (live != null && live.token !== first.token) {
+        try {
+          const usage = await fetchGrokUsage({ token: live.token, at: now });
+          account.windows = usage.windows;
+          account.lastUsageAt = usage.at;
+          return { ok: true, at: usage.at };
+        } catch (retry) {
+          return { ok: false, reason: retry instanceof GrokUsageReadError ? retry.message : errorMessage(retry) };
+        }
+      }
+    }
+    return { ok: false, reason: e instanceof GrokUsageReadError ? e.message : errorMessage(e) };
+  }
+}
+
+async function samplePool(accounts: Account[], _liveId: string | null, now: number): Promise<Map<string, SampleReport>> {
+  const reports = new Map<string, SampleReport>();
+  await Promise.all(
+    accounts.map(async (account) => {
+      const outcome = await readGrokUsage(account, now);
+      reports.set(account.id, outcome.ok ? { ok: true, source: "probe" } : { ok: false, reason: outcome.reason });
+    }),
+  );
+  return reports;
+}
+
+const base = statusOnlyProvider({
   name: "grok",
   flag: " --grok",
   pool: grokPool,
@@ -72,3 +147,8 @@ export const grok: Provider = statusOnlyProvider({
   installNotice: "grok pool is status-only: no supervisor or hooks installed. Use `tokenmaxxing status` to view pooled grok accounts.",
   loginStep: () => `Sign in in the browser session that opens (or run ${c.bold("grok login --device-auth")} on headless hosts first).`,
 });
+
+export const grok: Provider = {
+  ...base,
+  samplePool,
+};

package/src/lib/grokusage.ts

@@ -0,0 +1,75 @@
+import { z } from "zod";
+import { http, safeErrorDetail } from "./http.ts";
+import { errorMessage } from "./log.ts";
+import { env } from "./paths.ts";
+import { JsonTextSchema, type Window } from "./types.ts";
+
+export class GrokUsageReadError extends Error {
+  status: number | null;
+  constructor(detail: string, status: number | null = null) {
+    super(`grok usage read failed: ${detail}`);
+    this.name = "GrokUsageReadError";
+    this.status = status;
+  }
+}
+
+const InstantSchema = z.iso.datetime({ offset: true });
+
+const CreditsPeriodSchema = z.looseObject({
+  start: InstantSchema,
+  end: InstantSchema,
+});
+
+const CreditsConfigSchema = z.looseObject({
+  currentPeriod: CreditsPeriodSchema,
+  creditUsagePercent: z.number(),
+});
+
+const CreditsBillingSchema = z.looseObject({
+  config: CreditsConfigSchema,
+});
+
+export type GrokUsage = { windows: Window[]; at: number };
+
+function usageUrl(): string {
+  return env("TOKENMAXXING_GROK_USAGE_URL", "https://cli-chat-proxy.grok.com/v1/billing?format=credits");
+}
+
+export async function fetchGrokUsage(input: { token: string; at: number }): Promise<GrokUsage> {
+  const { token, at } = input;
+  let res: Response;
+  try {
+    res = await http.get(usageUrl(), {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/json",
+        "User-Agent": "grok",
+      },
+    });
+  } catch (e) {
+    throw new GrokUsageReadError(`endpoint unreachable: ${errorMessage(e)}`);
+  }
+  const text = await res.text();
+  if (!res.ok) {
+    throw new GrokUsageReadError(`HTTP ${res.status}: ${safeErrorDetail({ text })}`, res.status);
+  }
+  const parsed = CreditsBillingSchema.safeParse(JsonTextSchema.safeParse(text).data);
+  if (!parsed.success) {
+    throw new GrokUsageReadError("endpoint returned an unexpected body shape (withheld)");
+  }
+  const period = parsed.data.config.currentPeriod;
+  const start = Date.parse(period.start);
+  const end = Date.parse(period.end);
+  return {
+    at,
+    windows: [
+      {
+        name: null,
+        usedPercentage: parsed.data.config.creditUsagePercent,
+        resetsAt: Number.isFinite(end) ? end : null,
+        windowSeconds: Number.isFinite(start) && Number.isFinite(end) && end > start ? Math.round((end - start) / 1000) : null,
+        sampledAt: at,
+      },
+    ],
+  };
+}

package/src/lib/opencodego.ts

@@ -23,7 +23,7 @@ function liveAuthPath(): string {
 function idOfKey(key: string): string {
   const h = new Bun.CryptoHasher("sha256");
   h.update(`opencode-go:${key}`);
-  return `opencode-go-${h.digest("hex")}`;
+  return h.digest("hex");
 }
 
 function harvestOf(key: string): Harvest {

package/src/lib/sample.ts

@@ -1,18 +1,15 @@
-import { mkdirSync } from "node:fs";
-import { join } from "node:path";
-import { writeFileAtomic } from "./atomic.ts";
 import { readStore } from "./credstore.ts";
 import { withLock } from "./lock.ts";
 import { errorMessage, log } from "./log.ts";
-import { claudeTierLabel, isAccessTokenExpiring, isDeadCredential } from "./oauth.ts";
-import { claudePool, paths, sampleDirFor, storeDirFor } from "./paths.ts";
+import { claudeTierLabel, isDeadCredential } from "./oauth.ts";
+import { claudePool, paths } from "./paths.ts";
 import { seatCounts } from "./presence.ts";
 import type { Observation } from "./provider.ts";
 import { loadAccounts, loadUsageSnapshot, saveAccounts } from "./state.ts";
-import { fetchUsageDirect, mergeWindows, refreshViaProbe, windowsOf } from "./usage.ts";
+import { fetchUsageDirect, mergeWindows, windowsOf } from "./usage.ts";
 import type { Account, Config, UsageWindows } from "./types.ts";
 
-export type SampleOutcome = { ok: true; usage: UsageWindows; via: "get" | "probe" } | { ok: false; reason: string };
+export type SampleOutcome = { ok: true; usage: UsageWindows; via: "get" } | { ok: false; reason: string };
 
 type PreparedSample = { ok: true; token: string | null } | { ok: false; reason: string };
 
@@ -48,27 +45,13 @@ export async function prepareSample(account: Account): Promise<PreparedSample> {
   }
   if (!account.oauthAccount) return { ok: false, reason: "account record has no oauthAccount - run `tokenmaxxing auth`" };
   account.tier = claudeTierLabel(creds) ?? account.tier;
-  return { ok: true, token: isAccessTokenExpiring(creds) ? null : creds.accessToken };
+  return { ok: true, token: creds.accessToken };
 }
 
-async function refreshedToken(account: Account, suffix: string): Promise<string | null> {
-  const dir = sampleDirFor(account.id, suffix);
-  mkdirSync(dir, { recursive: true });
-  writeFileAtomic(join(dir, ".claude.json"), JSON.stringify({ oauthAccount: account.oauthAccount, hasCompletedOnboarding: true }));
-  if (!(await refreshViaProbe({ configDir: dir, store: storeDirFor(account.id) }))) return null;
-  const prepared = await prepareSample(account);
-  return prepared.ok ? prepared.token : null;
-}
-
-export async function runSample(account: Account, token: string | null, suffix = ""): Promise<SampleOutcome> {
-  if (token) {
-    const usage = await fetchUsageDirect(token);
-    if (usage) return { ok: true, usage, via: "get" };
-  }
-  const fresh = await refreshedToken(account, suffix);
-  if (!fresh) return { ok: false, reason: "the `/usage` probe left no usable access token in the store (see log)" };
-  const usage = await fetchUsageDirect(fresh);
-  return usage ? { ok: true, usage, via: "probe" } : { ok: false, reason: "usage read failed after the `/usage` probe (see log)" };
+export async function runSample(account: Account, token: string | null): Promise<SampleOutcome> {
+  if (!token) return { ok: false, reason: "no usable access token in the store - run `tokenmaxxing auth`" };
+  const usage = await fetchUsageDirect(token);
+  return usage ? { ok: true, usage, via: "get" } : { ok: false, reason: "usage read failed (see log)" };
 }
 
 export async function sampleAccountUsage(account: Account): Promise<SampleOutcome> {
@@ -114,7 +97,7 @@ export async function sampleOldest(cfg: Config): Promise<void> {
   await Promise.all(
     reserved.map(async ({ account, token }) => {
       const startedAt = Date.now();
-      const outcome = await runSample(account, token, "-tick");
+      const outcome = await runSample(account, token);
       await withLock(claudePool.lockFile, () => {
         const idx = loadAccounts(claudePool);
         const stored = idx.accounts.find((a) => a.id === account.id);

package/src/lib/sessions.ts

@@ -24,7 +24,19 @@ export function loadSessionFlags(sid: string): string[] | null {
   return SessionSchema.parse(JSON.parse(readFileSync(f, "utf8"))).flags;
 }
 
+const DEAD_STATE_FILES = ["model-usage.json", "accounts.json.v1-backup", "codex-accounts.json.v1-backup"];
+
+function pruneDeadState(): void {
+  for (const name of DEAD_STATE_FILES) {
+    try {
+      rmSync(join(paths.home, name), { force: true });
+    } catch {
+    }
+  }
+}
+
 export function pruneStaleSessions(now: number): void {
+  pruneDeadState();
   const dir = join(paths.home, "sessions");
   if (!existsSync(dir)) return;
   for (const f of readdirSync(dir)) {

package/src/lib/supervise.ts

@@ -63,7 +63,7 @@ export async function recordPresenceOrStop(input: { child: ChildHandle; dir: str
         input.child.kill();
         await input.child.exited;
         restoreTermios(input.savedTermios);
-        throw new Error(input.message);
+        throw new Error(input.message.startsWith("tokenmaxxing:") ? input.message : `tokenmaxxing: ${input.message}`);
       }
       await Bun.sleep(100);
     }

package/src/lib/usage.ts

@@ -1,7 +1,5 @@
 import { closeSync, fstatSync, openSync, readSync } from "node:fs";
-import { delay } from "es-toolkit";
 import { z } from "zod";
-import { MAX_WRAP_DEPTH, WRAP_DEPTH_ENV, resolveRealClaude } from "./claudebin.ts";
 import { http } from "./http.ts";
 import { errorMessage, log } from "./log.ts";
 import { env } from "./paths.ts";
@@ -177,40 +175,12 @@ export const CRED_ENV_OVERRIDES = [
   "CLAUDE_CODE_USE_VERTEX",
 ] as const;
 
-const PROBE_KILL_MS = 60_000;
-const PIPE_GRACE_MS = 2_000;
-
 export function scrubCredentialEnv(env: Record<string, string>): Record<string, string> {
   const scrubbed = { ...env };
   for (const k of CRED_ENV_OVERRIDES) delete scrubbed[k];
   return scrubbed;
 }
 
-export type ProbeTarget = { configDir: string; store: string };
-
-export async function refreshViaProbe(target: ProbeTarget): Promise<boolean> {
-  const env = scrubCredentialEnv({ ...process.env, TOKENMAXXING_PROBE: "1", [WRAP_DEPTH_ENV]: String(MAX_WRAP_DEPTH) });
-  env.CLAUDE_CONFIG_DIR = target.configDir;
-  env.CLAUDE_SECURESTORAGE_CONFIG_DIR = target.store;
-  try {
-    const p = Bun.spawn([resolveRealClaude(), "-p", "/usage", "--output-format", "json"], { env, stdout: "ignore", stderr: "pipe", timeout: PROBE_KILL_MS, killSignal: "SIGKILL" });
-    const stderr = await Promise.race([new Response(p.stderr).text(), p.exited.then(() => delay(PIPE_GRACE_MS)).then(() => null)]);
-    await p.exited;
-    if (stderr === null) {
-      log("usage.probe_failed", { err: "output pipes still open after child exit (leaked descendant)" });
-      return false;
-    }
-    if (p.exitCode !== 0) {
-      log("usage.probe_failed", { exit: p.exitCode ?? "signal", stderr: stderr.trim().slice(0, 200) });
-      return false;
-    }
-    return true;
-  } catch (e) {
-    log("usage.probe_failed", { err: errorMessage(e) });
-    return false;
-  }
-}
-
 const USAGE_URL = env("TOKENMAXXING_OAUTH_USAGE_URL", "https://api.anthropic.com/api/oauth/usage");
 const USAGE_DEADLINE_MS = 10_000;