tokenmaxxing 1.60.0 → 1.62.0

package/DESIGN.md

@@ -38,10 +38,10 @@ It is a process manager only - spawn with inherited stdio (stdin through a relay
   - `live/<session-id>` - PID-validated presence per supervised session, naming its account; placement counts them.
   - `respawn/<session-id>` - per-session respawn markers (the hook→supervisor signal): the target account, the session to resume, a `waitUntil`, a `compact` flag, and the launch time the marker was written for.
   - `bin/claude` and `bin/codex` - the supervisors, beside the `tokenmaxxing` and `xx` entry points.
-  - `sessions/<sid>.json`, `sample/`, `onboard/`, `setup-tokens.json`, `setup-token/`, `cloud/`, `update.json`, `spawnrate.json`, `tokenmaxxing.log`, the codex `codex-onboard/`, `codex-respawn/`, and `codex-live/`, and the `grok-*` and `opencode-go-*` state of the status-only pools: the full table is in [State directory layout](docs/content/docs/state-directory.mdx).
+  - `sessions/<sid>.json`, `onboard/`, `setup-tokens.json`, `setup-token/`, `cloud/`, `update.json`, `spawnrate.json`, `tokenmaxxing.log`, the codex `codex-onboard/`, `codex-respawn/`, and `codex-live/`, and the `grok-*` and `opencode-go-*` state of the status-only pools: the full table is in [State directory layout](docs/content/docs/state-directory.mdx).
 - Per-account **credential stores** follow the platform's Claude Code store: macOS = a login-keychain item keyed by the store path (never plaintext on disk); Linux = a 0600 `.credentials.json` inside the 0700 store directory (the same plaintext model claude itself uses - its Linux build has no keyring path at all, binary-verified 2.1.205). One `credstore` facade dispatches on a `{kind: keychain|file}` target; call sites never branch on platform. tokenmaxxing writes a store once, at onboarding; Claude Code's own refresh is the only writer afterwards.
 
-- A periodic check job (`com.tokenmaxxing.check` launchd agent on macOS, `tokenmaxxing-check.timer` systemd user timer on Linux) running `tokenmaxxing check` once per tick (`policy.checkIntervalMs`, 60s by default): it runs the decision with no seat (nothing moves), folds fresh tees into the index, samples up to three accounts whose last sample attempt is oldest (the direct no-spend usage GET first, and for a near-expiry token or a failed read the `/usage` probe under the store to refresh the token, then the GET again), and on a Bun global install checks npm for a newer version once a day, so the cached figures every placement reads stay fresh.
+- A periodic check job (`com.tokenmaxxing.check` launchd agent on macOS, `tokenmaxxing-check.timer` systemd user timer on Linux) running `tokenmaxxing check` once per tick (`policy.checkIntervalMs`, 60s by default): it runs the decision with no seat (nothing moves), folds fresh tees into the index, samples up to three accounts whose last sample attempt is oldest (the direct no-spend usage GET), deletes leftover dead state files at the state root, and on a Bun global install checks npm for a newer version once a day, so the cached figures every placement reads stay fresh.
 
 The switching path runs no long-lived daemon. The statusline pushes usage. Hooks and the supervisor react. The periodic check job above is the only recurring process. The `claude` binary, `~/.claude.json`, and Claude Code's default credential store are untouched; inside `~/.claude` only `settings.json` gets the five entries.
 
@@ -50,7 +50,7 @@ The switching path runs no long-lived daemon. The statusline pushes usage. Hooks
 ## 3. How a move happens
 
 ### 3.1 Usage feed (free, push-based)
-The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limits.{five_hour,seven_day}.{used_percentage,resets_at}`, after every turn, 300ms debounce, zero cost). tokenmaxxing's statusLine tees that to `usage/<uuid8>.json` for the session's seat, read from the inherited `CLAUDE_SECURESTORAGE_CONFIG_DIR` (write-on-change, O(ms)), and renders its own native line (it replaced the earlier pass-through delegation on 2026-07-11: install takes the statusLine slot outright, so a pre-existing custom statusline command is overwritten). A session with no pooled seat writes no tee. The seat is sampled when its tee is older than `policy.usagePollTtlMs`, and for the per-model rows when the active model is a gated family: the direct no-spend usage read with the seat's stored token, and, when that token is near expiry or the read fails, `claude -p '/usage' --output-format json` under the seat's store, whose output is discarded, then the direct read again with the token Claude Code refreshed into the store. The probe runs with a throwaway `CLAUDE_CONFIG_DIR` so no hooks load and `TOKENMAXXING_PROBE=1` in the environment so the hook entries return at once should any load (hooks fire in `-p` too; the compact child sets it as well). It scrubs every ambient credential override claude reads before the store (`CLAUDE_CODE_OAUTH_TOKEN`, `CLAUDE_SECURESTORAGE_CONFIG_DIR`, etc.) and then sets the store it means to read. The sample takes one attempt per interval; a failed sample doubles the interval up to 30 minutes, and a success resets it.
+The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limits.{five_hour,seven_day}.{used_percentage,resets_at}`, after every turn, 300ms debounce, zero cost). tokenmaxxing's statusLine tees that to `usage/<uuid8>.json` for the session's seat, read from the inherited `CLAUDE_SECURESTORAGE_CONFIG_DIR` (write-on-change, O(ms)), and renders its own native line (it replaced the earlier pass-through delegation on 2026-07-11: install takes the statusLine slot outright, so a pre-existing custom statusline command is overwritten). A session with no pooled seat writes no tee. The seat is sampled when its tee is older than `policy.usagePollTtlMs`, and for the per-model rows when the active model is a gated family: the direct no-spend usage read with the seat's stored token. The compact child still sets `TOKENMAXXING_PROBE=1` so the hook entries return at once. The sample takes one attempt per interval; a failed sample doubles the interval up to 30 minutes, and a success resets it. An expired stored access token stays unmeasured until a session on that store refreshes it.
 
 ### 3.2 Detect + decide + signal (Stop hook, per turn)
 1. Resolve the seat: the pooled account whose store the inherited `CLAUDE_SECURESTORAGE_CONFIG_DIR` names. No seat (a session started outside the supervisor) means nothing to move.
@@ -59,7 +59,7 @@ The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limi
 4. Write `respawn/<session-id>` (atomic temp+rename) naming the target, with `waitUntil` now for a plain move or the soonest reset when the pool is depleted. No credential is written.
 
 ### 3.3 Move and depleted-pool pause (supervisor)
-The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed turn boundary, deletes the marker, resets the terminal, compacts the conversation when the marker asks for it (`compact: true` from the Stop and SessionStart hooks and from the supervisor's own seat watch, `false` from StopFailure: it runs `claude -p --resume <sid> /compact` under the old seat's store, bounded at five minutes, and a failure only prints why), and (when `waitUntil` is in the future) shows an interruptible countdown to the reset; then it relaunches `claude --resume <sid>` with `CLAUDE_SECURESTORAGE_CONFIG_DIR` set to the target's store and rewrites the session's presence. The resumed process reads that store cold → runs on the target account, same conversation. The relaunch submits a first prompt that names the move (and the compaction, when it landed) and asks Claude to continue the task, so the conversation goes on without a keystroke: in a terminal session it is the positional prompt after the session id; in a stream-json session (`--input-format stream-json`, where the binary ignores a positional prompt) the supervisor owns stdin, relays the harness's lines to the child through a pipe, and writes the prompt as the first `user` line of the new process. In a terminal session the supervisor's own notices go to stderr. In a stream-json session (`--output-format stream-json`, read from the effective flags like the relay) there is no terminal and no statusline, so the supervisor writes each notice (the compaction and its failure, the move, the depleted-pool wait with its resume time, the resume) to stdout as a `system` line of subtype `informational` and level `warning`, the shape Claude Code emits for its own print-mode notices, which the harness renders in the conversation while the stream stays parseable; the per-second countdown ticks stay terminal-only, and the supervisor writes only while no child is running. The `SessionStart` hook (every source) re-runs the decision before the first turn and writes the same marker if the seat is already over its bar or the pool is depleted. The supervisor also watches its own seat every ten seconds while the child runs (account record plus tee, the same bars) and writes the marker itself when the seat is at or over a bar, so a move never depends on a hook firing: a harness session between turns whose background workflow burns the window, or a subagent refusal that stamped the wall, is moved within seconds. SIGTERM to the supervisor is forwarded to the child and the supervisor exits after it, so a harness that stops the wrapper (the Agent SDK does) never leaves an orphaned claude on the old seat. A marker whose `launchedAt` does not match the running child is discarded, and after a Ctrl-C on the countdown a later marker whose `waitUntil` falls inside the skipped wait is ignored. A marker that fails to parse is never deleted and never treated as absent: the supervisor stops the child, restores the terminal, and exits naming the marker path.
+The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed turn boundary, deletes the marker, resets the terminal, compacts the conversation when the marker asks for it (`compact: true` from the Stop and SessionStart hooks and from the supervisor's own seat watch, `false` from StopFailure: it runs `claude -p --resume <sid> /compact` under the old seat's store, bounded at five minutes, and a failure only prints why), and (when `waitUntil` is in the future) shows an interruptible countdown to the reset; then it relaunches `claude --resume <sid>` with `CLAUDE_SECURESTORAGE_CONFIG_DIR` set to the target's store and rewrites the session's presence. The resumed process reads that store cold → runs on the target account, same conversation. The relaunch submits a first prompt that names the move (and the compaction, when it landed) and asks Claude to continue the task, so the conversation goes on without a keystroke: in a terminal session it is the positional prompt after the session id; in a stream-json session (`--input-format stream-json`, where the binary ignores a positional prompt) the supervisor owns stdin, relays the harness's lines to the child through a pipe, and writes the prompt as the first `user` line of the new process. In a terminal session the supervisor's own notices go to stderr. In a stream-json session (`--output-format stream-json`, read from the effective flags like the relay) there is no terminal and no statusline, so the supervisor writes each notice (the compaction and its failure, the move, the depleted-pool wait with its resume time, the resume) to stdout as a `system` line of subtype `informational` and level `warning`, the shape Claude Code emits for its own print-mode notices, which the harness renders in the conversation while the stream stays parseable; the per-second countdown ticks stay terminal-only, and the supervisor writes only while no child is running. The `SessionStart` hook (every source) re-runs the decision before the first turn and writes the same marker if the seat is already over its bar or the pool is depleted. The supervisor also watches its own seat every ten seconds while the child runs (account record plus tee, the same bars) and writes the marker itself when the seat is at or over a bar, so a move never depends on a hook firing: a harness session between turns whose background workflow burns the window, or a subagent refusal that stamped the wall, is moved within seconds. SIGTERM to the supervisor is forwarded to the child and the supervisor exits after it, so a harness that stops the wrapper (the Agent SDK does) never leaves an orphaned claude on the old seat. A marker whose `launchedAt` does not match the running child is discarded, and after a Ctrl-C on the countdown a later marker whose `waitUntil` falls inside the skipped wait is ignored. A marker that fails to parse is never deleted and never treated as absent: the supervisor stops the child, restores the terminal, and exits naming the marker path. In a stream-json session that fatal, the wrap-depth abort, the wrap-rate abort, and a failed presence write also go to stdout as the same `informational`/`warning` line.
 
 ### 3.4 Placement (supervisor, under the pool lock)
 1. Fold every account's tee into the index.
@@ -67,14 +67,14 @@ The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed
 3. Spawn claude with the store env set, then write `live/<sid>` with the child's pid and start time. The lock covers the pick and the presence write, so concurrent launches see each other.
 
 ### 3.5 Multiple concurrent sessions
-Each terminal ran the supervisor, so each has its own child `claude`, its own `--session-id`, its own seat, and its own presence file. Sessions spread over the pool at launch (the second launch never lands on the first's account while another fresh account exists), sessions on one account share its store and coordinate refreshes through Claude Code's own store-rooted refresh lock, and each session moves on its own seat's figures. A move never touches another session. Only a shared state read is serialized: the pool lock covers decisions, placement, and the sampler's reservation; the tick's `/usage` child runs outside it, while a live `status` probes under it.
+Each terminal ran the supervisor, so each has its own child `claude`, its own `--session-id`, its own seat, and its own presence file. Sessions spread over the pool at launch (the second launch never lands on the first's account while another fresh account exists), sessions on one account share its store and coordinate refreshes through Claude Code's own store-rooted refresh lock, and each session moves on its own seat's figures. A move never touches another session. Only a shared state read is serialized: the pool lock covers decisions, placement, and the sampler's reservation; the tick's usage GET runs outside it, while a live `status` samples under it.
 
 ---
 
 ## 4. Onboarding (no `adopt`)
 
 - **`tokenmaxxing init` logs your first pooled account in through an isolated browser sign-in, even if you are already signed in.** The login runs in a throwaway `CLAUDE_CONFIG_DIR=~/.config/tokenmaxxing/onboard`, its token's owner is verified through the profile endpoint (`GET /api/oauth/profile`, matched on `account.uuid`), and the credential is harvested once into that account's store; the throwaway home and its credential item are deleted. The login you already had keeps its own grant in Claude Code's default store for sessions started outside the supervisor; it is never copied, because a copy of one grant in two stores dies at the first refresh. `init` also installs the supervisor + the five settings entries.
-- **`tokenmaxxing add`** - registers *additional* accounts the same way, one store each. `CLAUDE_CONFIG_DIR` is SET by tokenmaxxing only for throwaway homes like this one, the probe homes under `sample/`, and the `setup-token/` mint homes; a session's store is always set through `CLAUDE_SECURESTORAGE_CONFIG_DIR`.
+- **`tokenmaxxing add`** - registers *additional* accounts the same way, one store each. `CLAUDE_CONFIG_DIR` is SET by tokenmaxxing only for throwaway homes like this one and the `setup-token/` mint homes; a session's store is always set through `CLAUDE_SECURESTORAGE_CONFIG_DIR`.
 - **`tokenmaxxing auth [sel | --all]`** - reauthenticates an *existing* pool member whose store died (a needs-reauth account can never heal on its own: the dead grant is exactly what Claude Code's refresh would need). Same isolated-login harvest as `add`, but it states which email to sign in with and **requires the login to land on the target account** (verified `accountUuid` must match, else nothing changes). Bare `auth` lists the pool with emails and asks which; `--all` walks every account that is flagged or whose store holds no usable credential, one by one.
 - Both commands exercise `security` reads/writes interactively (where a macOS keychain ACL prompt is acceptable), so the first access never happens cold inside a headless hook.
 
@@ -84,13 +84,13 @@ Each terminal ran the supervisor, so each has its own child `claude`, its own `-
 The [switching policy](docs/content/docs/switching.mdx) is one rule: under both bars, hold; at or over a bar, move to the usable account that ranks first; nothing usable, wait for the soonest reset. The same ranking places a session at launch.
 
 - Ranking (decided by consult for #79): greatest remaining headroom to the session bar divided by the number of sessions after placement, `(bar - used) / (sessions + 1)`, then highest pace pressure (remaining percent of the binding gated per-model cap, or of the weekly aggregate for an account with no gated row, over time to its reset), then soonest weekly reset, then lowest weekly usage; unknown usage ranks last. Organization membership is not an input. Codex drops the headroom key, keeps the pace ordering and the weekly tie-breaks, and excludes accounts running in another codex session, because codex has no cross-process refresh lock and two sessions must never share a login.
-- Selection reads the cached figures only, after folding every account's tee. Each periodic check tick samples up to three accounts whose last sample attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`, over the direct no-spend usage read with the account's stored token, and, when the token is near expiry or that read fails, over the `/usage` child under its store followed by the read again with the refreshed token, so every account is attempted about once per three ticks per pooled account, or once per `policy.usagePollTtlMs` plus a tick when that is longer, and its cached figure is as fresh as its last successful attempt or its sessions' latest push. The pool lock covers only the reservation and the result write, never the read or the `/usage` child.
+- Selection reads the cached figures only, after folding every account's tee. Each periodic check tick samples up to three accounts whose last sample attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`, over the direct no-spend usage read with the account's stored token, so every account is attempted about once per three ticks per pooled account, or once per `policy.usagePollTtlMs` plus a tick when that is longer, and its cached figure is as fresh as its last successful attempt or its sessions' latest push. The pool lock covers only the reservation and the result write, never the usage GET. An expired stored access token stays unmeasured until a session on that store refreshes it.
 - The depleted pause happens at the bar, not at 100; Codex has no pause and rides its account until the server refuses it, because a running sibling cannot adopt another account without restarting.
 - Neither pool has a post-swap cooldown or a manual `switch`: a move is a respawn of one session under a fixed store, so nothing another session reads is invalidated by it, and placement at launch replaces the manual pick.
 
 The [profile](docs/content/docs/switching-profile.mdx) records observed cache rewrites across swaps and does not infer subscription quota savings.
 
-**Model-aware trigger.** Claude subscriptions also enforce **per-model weekly caps** - currently only for Sonnet and Fable (there is no Opus-only quota), and Fable's tighter limit binds *before* the aggregate (e.g. 80% week-Fable at only 50% week-all-models). This cap isn't in statusLine stdin, so when the session's model is in `policy.switchModels`, or the seat's tee is older than the TTL, we read it from the `limits[]` rows of the direct no-spend usage read for the seat (free, 0 tokens, one attempt with backoff, with the `/usage` probe under the seat's store refreshing the token when the read needs it) and add `week(<activeModel>) >= threshold` to the trigger. A Fable session moves on the Fable cap; a Sonnet session rides the aggregate. Candidate screening applies the same per-model gate: a burnt Fable cap screens an account out of a move. A session's model is the `--model` value it was launched with: the supervisor reads it from the launch flags, uses it for launch placement and the seat watch, and hands it to the session's hooks in `TOKENMAXXING_MODEL`, which the hooks read ahead of the per-account tee. With the default `policy.switchModels`, a session launched as Opus, Sonnet, or Haiku gates no per-model cap, so it runs on an account whose Fable cap is spent while the session and weekly windows have headroom. A launch without `--model`, or with a value that names no model family (`best`, `opusplan`), is unknown: launch placement and the seat watch gate every configured family for it, and its hooks fall back to the model in the account's tee. A move off a walled seat, or one that follows a subagent's five-hour or weekly refusal, screens candidates on every configured family whatever the launch model.
+**Model-aware trigger.** Claude subscriptions also enforce **per-model weekly caps** - currently only for Sonnet and Fable (there is no Opus-only quota), and Fable's tighter limit binds *before* the aggregate (e.g. 80% week-Fable at only 50% week-all-models). This cap isn't in statusLine stdin, so when the session's model is in `policy.switchModels`, or the seat's tee is older than the TTL, we read it from the `limits[]` rows of the direct no-spend usage read for the seat (free, 0 tokens, one attempt with backoff) and add `week(<activeModel>) >= threshold` to the trigger. A Fable session moves on the Fable cap; a Sonnet session rides the aggregate. Candidate screening applies the same per-model gate: a burnt Fable cap screens an account out of a move. A session's model is the `--model` value it was launched with: the supervisor reads it from the launch flags, uses it for launch placement and the seat watch, and hands it to the session's hooks in `TOKENMAXXING_MODEL`, which the hooks read ahead of the per-account tee. With the default `policy.switchModels`, a session launched as Opus, Sonnet, or Haiku gates no per-model cap, so it runs on an account whose Fable cap is spent while the session and weekly windows have headroom. A launch without `--model`, or with a value that names no model family (`best`, `opusplan`), is unknown: launch placement and the seat watch gate every configured family for it, and its hooks fall back to the model in the account's tee. A move off a walled seat, or one that follows a subagent's five-hour or weekly refusal, screens candidates on every configured family whatever the launch model.
 
 ---
 
@@ -132,12 +132,12 @@ TypeScript on Bun, shipped as source: one multi-call entry (`src/main.ts`, `#!/u
 
 ### 2026-09-12 (per-account stores, 1.37.0)
 
-Hermetic run on Linux under a throwaway `HOME` and `TOKENMAXXING_HOME`, a stub `claude` that records its environment and answers `-p /usage` from a per-store fixture, and a synthetic three-account version 2 pool with equal headroom on two accounts and the third over its session bar. Usage no longer comes from that output, so repeating the run against the current code needs two other pieces: a stub usage endpoint named by `TOKENMAXXING_OAUTH_USAGE_URL` that answers per access token, and a stub `claude` whose `-p /usage` run leaves a credential in the store with an access token that is not near expiry.
+Hermetic run on Linux under a throwaway `HOME` and `TOKENMAXXING_HOME`, a stub `claude` that records its environment, and a synthetic three-account version 2 pool with equal headroom on two accounts and the third over its session bar. Usage comes from a stub usage endpoint named by `TOKENMAXXING_OAUTH_USAGE_URL` that answers per access token. There is no `/usage` spawn.
 
 1. **Placement - ✅.** The first supervised launch spawned the stub with `CLAUDE_SECURESTORAGE_CONFIG_DIR=stores/<first account>` and wrote its presence; the second launch, with equal headroom, landed on the other account.
 2. **Plain move - ✅.** A 95% session tee for the second session's account made its Stop hook write the marker; the supervisor relaunched `--resume <sid>` under the first account's store within a second and rewrote the presence file.
 3. **Wall move - ✅.** A five-hour refusal row fed to the first session's StopFailure hook stamped `enforcedUntil` on its seat and moved the session to the account that had just been freed; a Stop hook on the walled seat moved the remaining session off it too.
-4. **Sampling - ✅.** The check tick probed the stalest account under its store with the `-tick` probe home; live `status` probed the accounts without a fresh tee under their stores and read the one with a fresh tee from the tee.
+4. **Sampling - ✅.** The check tick sampled the stalest account over the direct usage GET with the stored token; live `status` sampled the accounts without a fresh tee the same way and read the one with a fresh tee from the tee.
 5. **Stores never move - ✅.** SHA-256 of every store's `.credentials.json` was identical before and after; no `creds/` directory and no root `usage.json` appeared; the SessionStart hook on a seat under its bars wrote no marker; stopping the children cleared every presence file.
 
 The `pooledSpawnEnv` helper the issue names left with the SDK surface in 1.23.0; the supervisor's launch environment is the one spawn-env site.

package/README.md

@@ -90,7 +90,7 @@ The bars' headroom is deliberate: it's the budget to reach a clean turn boundary
 
 Launches and moves rank usable accounts by session-window headroom per running session, `(bar - used) / (sessions + 1)`, so two fresh accounts alternate and a third session goes to whichever has more headroom left per session; ties break by pace pressure (remaining percent of the binding gated per-model cap, or of the weekly aggregate for an account with no gated row, divided by time to its reset, highest first), then soonest weekly reset, then lowest weekly use. Organization membership is not an input.
 
-- Every periodic check tick folds fresh statusline tees into the index and samples up to three accounts whose last sample attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`: the direct no-spend usage read first, and, only for a near-expiry token or a failed read, `claude -p '/usage'` under the account's store to refresh the token, followed by that read again; a move reads the cached figures, which are as fresh as each account's last successful attempt or its sessions' latest push.
+- Every periodic check tick folds fresh statusline tees into the index and samples up to three accounts whose last sample attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`, with the direct no-spend usage read; a move reads the cached figures, which are as fresh as each account's last successful attempt or its sessions' latest push. An expired stored access token stays unmeasured until a session on that store refreshes it.
 - When no account is usable, the session pauses until the soonest reset if that lands within `policy.maxWaitMs`, and otherwise stays put.
 
 See [How switching decides](docs/content/docs/switching.mdx) for the policy and the [cache-cost profile](docs/content/docs/switching-profile.mdx) for measurements and their limits.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.60.0",
+  "version": "1.62.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts, start each session on its own account, and resume a session on a fresher account when quota fills.",
   "type": "module",
   "license": "MIT",

package/src/cli/check.ts

@@ -1,6 +1,7 @@
 import { claude } from "../lib/claude.ts";
 import { evaluateAndMaybeSwap } from "../lib/decide.ts";
 import { sampleOldest } from "../lib/sample.ts";
+import { pruneStaleSessions } from "../lib/sessions.ts";
 import { loadConfig } from "../lib/state.ts";
 import { maybeAutoUpdate } from "../lib/update.ts";
 import { errorMessage, log } from "../lib/log.ts";
@@ -10,6 +11,7 @@ export async function cmdCheck(json = false): Promise<number> {
   const now = Date.now();
   let d;
   try {
+    pruneStaleSessions(now);
     d = await evaluateAndMaybeSwap(claude, now);
     await sampleOldest(loadConfig());
     await maybeAutoUpdate();

package/src/cli/seat.ts

@@ -0,0 +1,62 @@
+import { observeCodex } from "../lib/codex.ts";
+import { codexStoreUsable, ensureCodexStoreHome } from "../lib/codexauth.ts";
+import { withLock } from "../lib/lock.ts";
+import { log } from "../lib/log.ts";
+import { codexPaths, codexPool } from "../lib/paths.ts";
+import { livingPresences, writePresence } from "../lib/presence.ts";
+import { isExhausted, pickBest, thresholdBars, type PickCtx } from "../lib/picker.ts";
+import { loadAccounts, loadConfig } from "../lib/state.ts";
+import { emitError } from "./render.ts";
+
+export async function cmdSeat(pidRaw: string | undefined, extra: string[]): Promise<number> {
+  const pid = pidRaw != null && /^(0|[1-9][0-9]*)$/.test(pidRaw) ? Number(pidRaw) : NaN;
+  if (!Number.isSafeInteger(pid) || pid < 2 || extra.length > 0) {
+    emitError({ message: "usage: tokenmaxxing seat --codex <pid> - print the CODEX_HOME of one pooled account, reserved until <pid> exits" });
+    return 2;
+  }
+  const now = Date.now();
+  const seatId = `seat-${pid}`;
+  const cfg = loadConfig();
+  await Promise.all(
+    loadAccounts(codexPool)
+      .accounts.filter((a) => a.needsReauth !== true && codexStoreUsable(a.id))
+      .map((a) => observeCodex(a, cfg, now, { probe: true, refresh: false })),
+  );
+  const granted = await withLock(codexPool.lockFile, (): { store: string; id: string; reused: boolean } | { denied: string } | null => {
+    const ctx: PickCtx = { now, thresholds: thresholdBars(loadConfig()), currentId: null, families: null, seats: null };
+    const idx = loadAccounts(codexPool);
+    const living = livingPresences(codexPaths.presenceDir);
+    const held = living.find((p) => p.id === seatId);
+    const heldAccount = held ? (idx.accounts.find((x) => x.id === held.accountId) ?? null) : null;
+    if (heldAccount) {
+      if (heldAccount.needsReauth === true) {
+        return { denied: "the account this pid holds needs reauthentication - run `tokenmaxxing auth --codex` and borrow again" };
+      }
+      if (!codexStoreUsable(heldAccount.id)) {
+        return { denied: "the account this pid holds has no usable credential in its store - refusing to hand back a credential-less seat" };
+      }
+      return { store: ensureCodexStoreHome(heldAccount.id), id: heldAccount.id, reused: true };
+    }
+    const present = new Map<string, number>();
+    for (const p of living) present.set(p.accountId, (present.get(p.accountId) ?? 0) + 1);
+    const usable = idx.accounts.filter(
+      (a) => a.needsReauth !== true && !isExhausted(a, ctx) && !present.has(a.id) && codexStoreUsable(a.id)
+    );
+    const picked = pickBest(usable, ctx);
+    if (!picked) return null;
+    const store = ensureCodexStoreHome(picked.id);
+    writePresence({ dir: codexPaths.presenceDir, id: seatId, accountId: picked.id, pid });
+    return { store, id: picked.id, reused: false };
+  });
+  if (!granted) {
+    emitError({ message: "no usable codex account (pool empty, every account live in another session, or every account at a limit) - use the ambient codex login" });
+    return 1;
+  }
+  if ("denied" in granted) {
+    emitError({ message: granted.denied });
+    return 1;
+  }
+  log("seat.grant", { account: granted.id.slice(0, 8), pid, reused: granted.reused });
+  console.log(granted.store);
+  return 0;
+}

package/src/entries/codexstophook.ts

@@ -9,6 +9,7 @@ import { resolveRealCodex } from "../lib/codexbin.ts";
 import { compactCodexThread } from "../lib/compact.ts";
 import { evaluateAndMaybeSwap } from "../lib/decide.ts";
 import { isExhausted } from "../lib/picker.ts";
+import { livingPresences } from "../lib/presence.ts";
 import { readStdin } from "../lib/proc.ts";
 import { loadAccounts, loadConfig } from "../lib/state.ts";
 import { CODEX_SUPERVISOR_ID_ENV } from "./codexsupervisor.ts";
@@ -39,6 +40,12 @@ async function handleCodexStop(rawStdin: string): Promise<void> {
       log("codexstop.unsupervised_skip", {});
       return;
     }
+    const own = livingPresences(codexPaths.presenceDir).find((p) => p.id === supervisorId);
+    const seat = codex.liveId();
+    if (!own || own.accountId !== seat) {
+      log("codexstop.foreign_seat", { supervisorId: supervisorId.slice(0, 8), seat: seat?.slice(0, 8) ?? null });
+      return;
+    }
     const now = Date.now();
     await compactBeforeMove({ sessionId, now });
     const decision = await evaluateAndMaybeSwap(codex, now);

package/src/entries/codexsupervisor.ts

@@ -5,13 +5,14 @@ import { codexPaths, codexPool } from "../lib/paths.ts";
 import { withLock } from "../lib/lock.ts";
 import { UNMANAGED_ENV, WRAP_DEPTH_ENV, wrapDepth } from "../lib/claudebin.ts";
 import { resolveRealCodex } from "../lib/codexbin.ts";
-import { ensureCodexStoreHome } from "../lib/codexauth.ts";
-import { pickCodexSeat } from "../lib/codex.ts";
-import { clearPresence } from "../lib/presence.ts";
+import { codexStoreUsable, ensureCodexStoreHome } from "../lib/codexauth.ts";
+import { codexPickCtx, pickCodexSeat } from "../lib/codex.ts";
+import { clearPresence, livingPresences } from "../lib/presence.ts";
+import { isExhausted } from "../lib/picker.ts";
 import { exitStatus, loopGuardTripped, raceMarkerOrExit, recordPresenceOrStop, runPassthrough } from "../lib/supervise.ts";
 import { saveTermios } from "../lib/tty.ts";
 import { loadAccounts } from "../lib/state.ts";
-import { CodexRespawnMarkerSchema } from "../lib/types.ts";
+import { CodexRespawnMarkerSchema, type Account } from "../lib/types.ts";
 import { errorMessage, log } from "../lib/log.ts";
 
 export const CODEX_SUPERVISOR_ID_ENV = "TOKENMAXXING_CODEX_SUPERVISOR_ID";
@@ -55,6 +56,20 @@ export function shouldManageCodex(input: { argv: string[] }): boolean {
   return firstPositional === null || !NONINTERACTIVE_SUBCMDS.has(firstPositional);
 }
 
+function validWanted(input: { wanted: string | null; now: number; supervisorId: string }): Account | null {
+  if (input.wanted == null) return null;
+  const a = loadAccounts(codexPool).accounts.find((x) => x.id === input.wanted);
+  if (!a || a.needsReauth === true) return null;
+  if (isExhausted(a, codexPickCtx(input.now, input.wanted))) return null;
+  if (!codexStoreUsable(a.id)) return null;
+  const foreign = livingPresences(codexPaths.presenceDir).some((p) => p.accountId === a.id && p.id !== input.supervisorId);
+  if (foreign) {
+    log("codexsupervisor.wanted_present", { account: a.id.slice(0, 8) });
+    return null;
+  }
+  return a;
+}
+
 export async function runCodexSupervisor(input: { argv: string[] }): Promise<number> {
   const { argv } = input;
   if (loopGuardTripped("codex")) return 1;
@@ -83,8 +98,9 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
     if (existsSync(marker)) rmSync(marker, { force: true });
 
     const launchedAt = Date.now();
-    const { child } = await withLock(codexPool.lockFile, async () => {
-      const picked = (wanted == null ? null : (loadAccounts(codexPool).accounts.find((a) => a.id === wanted) ?? null)) ?? pickCodexSeat(launchedAt, wanted);
+    const { child, seat } = await withLock(codexPool.lockFile, async () => {
+      clearPresence({ dir: codexPaths.presenceDir, id: supervisorId });
+      const picked = validWanted({ wanted, now: launchedAt, supervisorId }) ?? pickCodexSeat(launchedAt);
       log("codexsupervisor.launch", { supervisorId: supervisorId.slice(0, 8), respawns, seat: picked?.id.slice(0, 8) ?? null, args: launchArgs.join(" ") });
       const store = picked ? ensureCodexStoreHome(picked.id) : undefined;
       const spawned = Bun.spawn([real, ...launchArgs], {
@@ -110,6 +126,9 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
       }
       return { child: spawned, seat: picked };
     });
+    if (respawns > 0) {
+      process.stdout.write(`\n\x1b[36m↻ tokenmaxxing: switched codex to ${seat?.label ?? "the ambient codex login"} - resuming...\x1b[0m\n`);
+    }
 
     await raceMarkerOrExit({
       child,
@@ -125,8 +144,6 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
     if (payload) {
       rmSync(marker, { force: true });
       respawns++;
-      const label = loadAccounts(codexPool).accounts.find((a) => a.id === payload.accountId)?.label ?? payload.accountId.slice(0, 8);
-      process.stdout.write(`\n\x1b[36m↻ tokenmaxxing: switched codex to ${label} - resuming...\x1b[0m\n`);
       wanted = payload.accountId;
       launchArgs = payload.sessionId ? ["resume", payload.sessionId] : ["resume", "--last"];
       continue;

package/src/entries/stopfailurehook.ts

@@ -41,6 +41,10 @@ export async function runStopFailureHook(): Promise<number> {
   const stdinSid = stdin.session_id;
   const session = supervisedSession();
   const mainLoop = stdin.agent_id === undefined;
+  if (stdinSid != null && session != null && stdinSid !== session.sid) {
+    log("stopfailure.nested_session", { stdin: stdinSid.slice(0, 8), supervised: session.sid.slice(0, 8) });
+    return 0;
+  }
   const canRespawn = session != null && mainLoop;
 
   try {

package/src/entries/stophook.ts

@@ -17,6 +17,11 @@ export async function runBoundaryHook(event: "stop" | "sessionstart"): Promise<n
   const parsed = BoundaryStdin.safeParse(JsonTextSchema.safeParse(await readStdin()).data);
   const stdin = parsed.success ? parsed.data : {};
   const session = supervisedSession();
+  const nested = stdin.session_id != null && session != null && stdin.session_id !== session.sid;
+  if (nested) {
+    log(`${event}.nested_session`, { stdin: stdin.session_id?.slice(0, 8), supervised: session?.sid.slice(0, 8) });
+    return 0;
+  }
 
   try {
     const decision = await evaluateAndMaybeSwap(claude, Date.now(), session != null);

package/src/entries/supervisor.ts

@@ -187,7 +187,7 @@ function consumableMarker(marker: string, gate: MarkerGate): z.infer<typeof Resp
   } catch (e) {
     log("supervisor.marker_invalid", { err: errorMessage(e) });
     throw new Error(
-      `${marker} is corrupt (unparsable JSON or off-schema) - the session was stopped instead of guessing whether the pool is depleted; inspect the marker, then run \`claude --resume ${basename(marker)}\` (a fresh launch clears it)`,
+      `tokenmaxxing: the session was stopped because the respawn marker is corrupt. Inspect ${marker}, then run \`claude --resume ${basename(marker)}\` (a fresh launch clears it)`,
     );
   }
   if (m.launchedAt !== undefined && m.launchedAt !== gate.launchedAt) {
@@ -330,10 +330,36 @@ class StdinRelay {
   }
 }
 
+function bareResumeStream(info: Analysis, argv: string[], sid: string | null): boolean {
+  if (!info.manage || process.env[UNMANAGED_ENV] || info.sessionId != null || stripSessionFlags(argv).length !== 0 || sid == null) return false;
+  try {
+    const persisted = loadSessionFlags(sid);
+    return persisted != null && analyzeArgs(persisted).streamOutput;
+  } catch {
+    return false;
+  }
+}
+
 export async function runSupervisor(argv: string[]): Promise<number> {
-  if (loopGuardTripped("claude")) return 1;
-  const real = resolveRealClaude();
   const info = analyzeArgs(argv);
+  const drivenSid = info.sessionId ?? info.resumeId ?? (info.continueLatest ? latestSessionForCwd() : null);
+  const earlyStream = info.streamOutput || bareResumeStream(info, argv, drivenSid);
+  const earlySid = drivenSid ?? crypto.randomUUID();
+  if (loopGuardTripped("claude")) {
+    if (earlyStream) {
+      process.stdout.write(systemLine(earlySid, "tokenmaxxing: wrapper re-entered without reaching the real Claude. Fix claudeBin, then run tokenmaxxing doctor."));
+    }
+    return 1;
+  }
+  let real: string;
+  try {
+    real = resolveRealClaude();
+  } catch (e) {
+    if (!earlyStream) throw e;
+    process.stdout.write(systemLine(earlySid, `tokenmaxxing: ${errorMessage(e)}`));
+    log("supervisor.resolve_failed", { err: errorMessage(e) });
+    return 1;
+  }
   const childEnv = { ...process.env, [WRAP_DEPTH_ENV]: String(wrapDepth() + 1) };
 
   let child: Subprocess | null = null;
@@ -397,6 +423,7 @@ export async function runSupervisor(argv: string[]): Promise<number> {
   let respawns = 0;
   let overriddenUntil = 0;
   let wanted: string | null = null;
+  try {
   while (true) {
     if (existsSync(marker)) rmSync(marker, { force: true });
 
@@ -488,4 +515,11 @@ export async function runSupervisor(argv: string[]): Promise<number> {
     log("supervisor.exit", { sid, respawns, code: proc.exitCode, signal: proc.signalCode, terminated: terminating || undefined });
     return exitStatus(proc);
   }
+  } catch (e) {
+    const msg = errorMessage(e);
+    const text = msg.startsWith("tokenmaxxing:") ? msg : `tokenmaxxing: ${msg}`;
+    say(`\n\x1b[31m${text}\x1b[0m\n`, text);
+    log("supervisor.fatal", { err: msg });
+    return 1;
+  }
 }

package/src/lib/codex.ts

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { writeFileAtomic } from "./atomic.ts";
 import { MAX_WRAP_DEPTH, WRAP_DEPTH_ENV } from "./claudebin.ts";
-import { codexIdentityOf, deleteCodexStoreAuth, isCodexAccessExpiring, readCodexAuthAt, readCodexStoreAuth, writeCodexStoreAuth } from "./codexauth.ts";
+import { codexIdentityOf, codexStoreUsable, deleteCodexStoreAuth, isCodexAccessExpiring, readCodexAuthAt, readCodexStoreAuth, writeCodexStoreAuth } from "./codexauth.ts";
 import { resolveRealCodex, verifyRealCodex } from "./codexbin.ts";
 import { CodexInvalidGrantError, CodexRefreshFailedError, refreshCodexAuth } from "./codexoauth.ts";
 import { seatCounts } from "./presence.ts";
@@ -42,7 +42,7 @@ function applyUsage(account: Account, usage: CodexUsage, at: number): void {
 
 type CodexReadOutcome = { ok: true; usage: CodexUsage; at: number } | { ok: false; reason: string; deadGrant: boolean };
 
-async function readCodexUsage(account: Account, now: number): Promise<CodexReadOutcome> {
+async function readCodexUsage(account: Account, now: number, refresh: boolean): Promise<CodexReadOutcome> {
   let auth: CodexAuthJson | null;
   try {
     auth = readCodexStoreAuth(account.id);
@@ -52,6 +52,9 @@ async function readCodexUsage(account: Account, now: number): Promise<CodexReadO
   if (!auth) return { ok: false, reason: "no credential in this account's store - run `tokenmaxxing auth --codex`", deadGrant: false };
   try {
     if (isCodexAccessExpiring({ auth, now })) {
+      if (!refresh) {
+        return { ok: false, reason: "stored access token is expiring and this read never refreshes a store", deadGrant: false };
+      }
       if (seatCounts(codexPaths.presenceDir).has(account.id)) {
         return { ok: false, reason: "running in a live codex session (store refresh unsafe)", deadGrant: false };
       }
@@ -67,9 +70,9 @@ async function readCodexUsage(account: Account, now: number): Promise<CodexReadO
   }
 }
 
-async function observeLive(account: Account, cfg: Config, now: number, opts: { probe: boolean }): Promise<Observation | null> {
+export async function observeCodex(account: Account, cfg: Config, now: number, opts: { probe: boolean; refresh: boolean }): Promise<Observation | null> {
   if (opts.probe && (account.lastUsageAt == null || now - account.lastUsageAt > cfg.policy.usagePollTtlMs)) {
-    const outcome = await readCodexUsage(account, now);
+    const outcome = await readCodexUsage(account, now, opts.refresh);
     await withLock(codexPool.lockFile, () => {
       const idx = loadAccounts(codexPool);
       const a = idx.accounts.find((x) => x.id === account.id);
@@ -92,7 +95,7 @@ async function samplePool(accounts: Account[], _liveId: string | null, now: numb
   const reports = new Map<string, SampleReport>();
   await Promise.all(
     accounts.map(async (account) => {
-      const outcome = await readCodexUsage(account, now);
+      const outcome = await readCodexUsage(account, now, true);
       if (outcome.ok) {
         applyUsage(account, outcome.usage, outcome.at);
         reports.set(account.id, { ok: true, source: "probe" });
@@ -216,17 +219,11 @@ export function codexPickCtx(now: number, currentId: string | null): PickCtx {
   return { now, thresholds: thresholdBars(loadConfig()), currentId, families: null, seats: null };
 }
 
-export function pickCodexSeat(now: number, wantedId: string | null = null): Account | null {
-  const cfg = loadConfig();
-  const idx = loadAccounts(codexPool);
-  const ctx: PickCtx = { now, thresholds: thresholdBars(cfg), currentId: null, families: null, seats: null };
-  if (wantedId != null) {
-    const wanted = idx.accounts.find((a) => a.id === wantedId && a.needsReauth !== true && !isExhausted(a, { ...ctx, currentId: wantedId }));
-    if (wanted) return wanted;
-  }
+export function pickCodexSeat(now: number): Account | null {
+  const ctx = codexPickCtx(now, null);
   const present = seatCounts(codexPaths.presenceDir);
-  const usable = idx.accounts.filter((a) => a.needsReauth !== true && !isExhausted(a, ctx) && !present.has(a.id));
-  return pickBest(usable, ctx) ?? pickEarliestReset(idx.accounts.filter((a) => a.needsReauth !== true && !present.has(a.id)), ctx)?.account ?? null;
+  const open = loadAccounts(codexPool).accounts.filter((a) => a.needsReauth !== true && !present.has(a.id) && codexStoreUsable(a.id));
+  return pickBest(open.filter((a) => !isExhausted(a, ctx)), ctx) ?? pickEarliestReset(open, ctx)?.account ?? null;
 }
 
 export const codex: Provider = {
@@ -239,19 +236,13 @@ export const codex: Provider = {
   liveId,
   presence,
   gatedFamilies: () => null,
-  observeLive,
+  observeLive: (account, cfg, now, opts) => observeCodex(account, cfg, now, { probe: opts.probe, refresh: true }),
   samplePool,
   mergeWindows: (next) => next,
   swap: prepareMove,
   classifySwapError: (e) => (e instanceof CodexInvalidGrantError ? "dead-grant" : e instanceof StoreUnusableError ? "skip" : "fatal"),
   removeCredentials: async (a) => deleteCodexStoreAuth(a.id),
-  storeUsable: async (a) => {
-    try {
-      return readCodexStoreAuth(a.id) != null;
-    } catch {
-      return false;
-    }
-  },
+  storeUsable: async (a) => codexStoreUsable(a.id),
   login,
   importLive,
   preflight,

package/src/lib/codexauth.ts

@@ -23,6 +23,14 @@ export function readCodexStoreAuth(accountId: string): CodexAuthJson | null {
   return readCodexAuthAt({ path: codexAuthJsonFor(accountId) });
 }
 
+export function codexStoreUsable(accountId: string): boolean {
+  try {
+    return readCodexStoreAuth(accountId) != null;
+  } catch {
+    return false;
+  }
+}
+
 export function writeCodexStoreAuth(accountId: string, auth: CodexAuthJson): void {
   mkdirSync(codexStoreDirFor(accountId), { recursive: true });
   writeFileAtomic(codexAuthJsonFor(accountId), JSON.stringify(CodexAuthJsonSchema.parse(auth), null, 2), 0o600);

package/src/lib/decide.ts

@@ -1,6 +1,6 @@
 import { withLock } from "./lock.ts";
 import { loadAccounts, loadConfig, saveAccounts } from "./state.ts";
-import { isExhausted, limitWindows, nextWeeklyReset, pickBest, pickEarliestReset, sessionWindow, thresholdBars, usableAt, weeklyWindow, type PickCtx } from "./picker.ts";
+import { isExhausted, limitWindows, liveUsed, nextWeeklyReset, pickBest, pickEarliestReset, sessionWindow, thresholdBars, usableAt, weeklyWindow, type PickCtx } from "./picker.ts";
 import { familyTokens } from "./usage.ts";
 import { errorMessage, log } from "./log.ts";
 import type { Observation, Provider } from "./provider.ts";
@@ -19,6 +19,12 @@ function isOver(account: Account | undefined, observed: Observation | null, ctx:
   return isExhausted({ ...account, windows: observed.windows }, ctx);
 }
 
+function modelKindCovered(limit: EnforcedLimit, account: Account, now: number, weeklyBar: number): boolean {
+  if (limit.kind !== "model" || limit.family == null) return false;
+  const family = limit.family;
+  return limitWindows(account).some((w) => familyTokens(w.name ?? "").includes(family) && liveUsed(w, now) >= weeklyBar);
+}
+
 function enforcedWall(limit: EnforcedLimit, account: Account, now: number): number {
   const { family } = limit;
   const familyReset =
@@ -57,13 +63,18 @@ export async function evaluateAndMaybeSwap(p: Provider, now = Date.now(), canRes
 
     const origin = enforced ? idx.accounts.find((a) => a.id === enforced.account) : undefined;
     const prior = origin?.enforcedUntil != null && origin.enforcedUntil > now;
+    let stamped = false;
     if (enforced && origin) {
-      origin.enforcedUntil = Math.max(origin.enforcedUntil ?? 0, enforcedWall(enforced, origin, now));
+      const covered = modelKindCovered(enforced, origin, now, bars.weekly);
+      if (!covered || prior) {
+        origin.enforcedUntil = Math.max(origin.enforcedUntil ?? 0, enforcedWall(enforced, origin, now));
+        stamped = true;
+      }
       origin.lastProbeAt = now;
       saveAccounts(p.pool, idx);
-      log("usage.enforced_limit", { kind: enforced.kind, family: enforced.family ?? undefined, resetsAt: origin.enforcedUntil, blind: prior || enforced.blind, live: origin === active });
+      log("usage.enforced_limit", { kind: enforced.kind, family: enforced.family ?? undefined, resetsAt: origin.enforcedUntil, blind: prior || enforced.blind, live: origin === active, covered: covered && !prior });
     }
-    const enforced2 = enforced && origin && origin === active ? enforced : null;
+    const enforced2 = stamped && origin === active ? enforced : null;
 
     if (id2 != null && !active) {
       return { swapped: false, account: null, reason: "live-credential-not-in-pool" };

package/src/lib/opencodego.ts

@@ -23,7 +23,7 @@ function liveAuthPath(): string {
 function idOfKey(key: string): string {
   const h = new Bun.CryptoHasher("sha256");
   h.update(`opencode-go:${key}`);
-  return `opencode-go-${h.digest("hex")}`;
+  return h.digest("hex");
 }
 
 function harvestOf(key: string): Harvest {

package/src/lib/sample.ts

@@ -1,18 +1,15 @@
-import { mkdirSync } from "node:fs";
-import { join } from "node:path";
-import { writeFileAtomic } from "./atomic.ts";
 import { readStore } from "./credstore.ts";
 import { withLock } from "./lock.ts";
 import { errorMessage, log } from "./log.ts";
-import { claudeTierLabel, isAccessTokenExpiring, isDeadCredential } from "./oauth.ts";
-import { claudePool, paths, sampleDirFor, storeDirFor } from "./paths.ts";
+import { claudeTierLabel, isDeadCredential } from "./oauth.ts";
+import { claudePool, paths } from "./paths.ts";
 import { seatCounts } from "./presence.ts";
 import type { Observation } from "./provider.ts";
 import { loadAccounts, loadUsageSnapshot, saveAccounts } from "./state.ts";
-import { fetchUsageDirect, mergeWindows, refreshViaProbe, windowsOf } from "./usage.ts";
+import { fetchUsageDirect, mergeWindows, windowsOf } from "./usage.ts";
 import type { Account, Config, UsageWindows } from "./types.ts";
 
-export type SampleOutcome = { ok: true; usage: UsageWindows; via: "get" | "probe" } | { ok: false; reason: string };
+export type SampleOutcome = { ok: true; usage: UsageWindows; via: "get" } | { ok: false; reason: string };
 
 type PreparedSample = { ok: true; token: string | null } | { ok: false; reason: string };
 
@@ -48,27 +45,13 @@ export async function prepareSample(account: Account): Promise<PreparedSample> {
   }
   if (!account.oauthAccount) return { ok: false, reason: "account record has no oauthAccount - run `tokenmaxxing auth`" };
   account.tier = claudeTierLabel(creds) ?? account.tier;
-  return { ok: true, token: isAccessTokenExpiring(creds) ? null : creds.accessToken };
+  return { ok: true, token: creds.accessToken };
 }
 
-async function refreshedToken(account: Account, suffix: string): Promise<string | null> {
-  const dir = sampleDirFor(account.id, suffix);
-  mkdirSync(dir, { recursive: true });
-  writeFileAtomic(join(dir, ".claude.json"), JSON.stringify({ oauthAccount: account.oauthAccount, hasCompletedOnboarding: true }));
-  if (!(await refreshViaProbe({ configDir: dir, store: storeDirFor(account.id) }))) return null;
-  const prepared = await prepareSample(account);
-  return prepared.ok ? prepared.token : null;
-}
-
-export async function runSample(account: Account, token: string | null, suffix = ""): Promise<SampleOutcome> {
-  if (token) {
-    const usage = await fetchUsageDirect(token);
-    if (usage) return { ok: true, usage, via: "get" };
-  }
-  const fresh = await refreshedToken(account, suffix);
-  if (!fresh) return { ok: false, reason: "the `/usage` probe left no usable access token in the store (see log)" };
-  const usage = await fetchUsageDirect(fresh);
-  return usage ? { ok: true, usage, via: "probe" } : { ok: false, reason: "usage read failed after the `/usage` probe (see log)" };
+export async function runSample(account: Account, token: string | null): Promise<SampleOutcome> {
+  if (!token) return { ok: false, reason: "no usable access token in the store - run `tokenmaxxing auth`" };
+  const usage = await fetchUsageDirect(token);
+  return usage ? { ok: true, usage, via: "get" } : { ok: false, reason: "usage read failed (see log)" };
 }
 
 export async function sampleAccountUsage(account: Account): Promise<SampleOutcome> {
@@ -114,7 +97,7 @@ export async function sampleOldest(cfg: Config): Promise<void> {
   await Promise.all(
     reserved.map(async ({ account, token }) => {
       const startedAt = Date.now();
-      const outcome = await runSample(account, token, "-tick");
+      const outcome = await runSample(account, token);
       await withLock(claudePool.lockFile, () => {
         const idx = loadAccounts(claudePool);
         const stored = idx.accounts.find((a) => a.id === account.id);

package/src/lib/sessions.ts

@@ -24,7 +24,19 @@ export function loadSessionFlags(sid: string): string[] | null {
   return SessionSchema.parse(JSON.parse(readFileSync(f, "utf8"))).flags;
 }
 
+const DEAD_STATE_FILES = ["model-usage.json", "accounts.json.v1-backup", "codex-accounts.json.v1-backup"];
+
+function pruneDeadState(): void {
+  for (const name of DEAD_STATE_FILES) {
+    try {
+      rmSync(join(paths.home, name), { force: true });
+    } catch {
+    }
+  }
+}
+
 export function pruneStaleSessions(now: number): void {
+  pruneDeadState();
   const dir = join(paths.home, "sessions");
   if (!existsSync(dir)) return;
   for (const f of readdirSync(dir)) {

package/src/lib/supervise.ts

@@ -63,7 +63,7 @@ export async function recordPresenceOrStop(input: { child: ChildHandle; dir: str
         input.child.kill();
         await input.child.exited;
         restoreTermios(input.savedTermios);
-        throw new Error(input.message);
+        throw new Error(input.message.startsWith("tokenmaxxing:") ? input.message : `tokenmaxxing: ${input.message}`);
       }
       await Bun.sleep(100);
     }

package/src/lib/usage.ts

@@ -1,7 +1,5 @@
 import { closeSync, fstatSync, openSync, readSync } from "node:fs";
-import { delay } from "es-toolkit";
 import { z } from "zod";
-import { MAX_WRAP_DEPTH, WRAP_DEPTH_ENV, resolveRealClaude } from "./claudebin.ts";
 import { http } from "./http.ts";
 import { errorMessage, log } from "./log.ts";
 import { env } from "./paths.ts";
@@ -177,40 +175,12 @@ export const CRED_ENV_OVERRIDES = [
   "CLAUDE_CODE_USE_VERTEX",
 ] as const;
 
-const PROBE_KILL_MS = 60_000;
-const PIPE_GRACE_MS = 2_000;
-
 export function scrubCredentialEnv(env: Record<string, string>): Record<string, string> {
   const scrubbed = { ...env };
   for (const k of CRED_ENV_OVERRIDES) delete scrubbed[k];
   return scrubbed;
 }
 
-export type ProbeTarget = { configDir: string; store: string };
-
-export async function refreshViaProbe(target: ProbeTarget): Promise<boolean> {
-  const env = scrubCredentialEnv({ ...process.env, TOKENMAXXING_PROBE: "1", [WRAP_DEPTH_ENV]: String(MAX_WRAP_DEPTH) });
-  env.CLAUDE_CONFIG_DIR = target.configDir;
-  env.CLAUDE_SECURESTORAGE_CONFIG_DIR = target.store;
-  try {
-    const p = Bun.spawn([resolveRealClaude(), "-p", "/usage", "--output-format", "json"], { env, stdout: "ignore", stderr: "pipe", timeout: PROBE_KILL_MS, killSignal: "SIGKILL" });
-    const stderr = await Promise.race([new Response(p.stderr).text(), p.exited.then(() => delay(PIPE_GRACE_MS)).then(() => null)]);
-    await p.exited;
-    if (stderr === null) {
-      log("usage.probe_failed", { err: "output pipes still open after child exit (leaked descendant)" });
-      return false;
-    }
-    if (p.exitCode !== 0) {
-      log("usage.probe_failed", { exit: p.exitCode ?? "signal", stderr: stderr.trim().slice(0, 200) });
-      return false;
-    }
-    return true;
-  } catch (e) {
-    log("usage.probe_failed", { err: errorMessage(e) });
-    return false;
-  }
-}
-
 const USAGE_URL = env("TOKENMAXXING_OAUTH_USAGE_URL", "https://api.anthropic.com/api/oauth/usage");
 const USAGE_DEADLINE_MS = 10_000;
 

package/src/main.ts

@@ -21,6 +21,7 @@ import { cmdRm } from "./cli/rm.ts";
 import { cmdRename } from "./cli/rename.ts";
 import { cmdCheck } from "./cli/check.ts";
 import { cmdConfig } from "./cli/config.ts";
+import { cmdSeat } from "./cli/seat.ts";
 import { cmdSetupToken } from "./cli/setuptoken.ts";
 import { cmdCloudRun } from "./cli/cloudrun.ts";
 import { cmdCursorInit } from "./cli/cursorinit.ts";
@@ -36,7 +37,7 @@ const CODEX_FLAG = "--codex";
 const GROK_FLAG = "--grok";
 const OPENCODE_GO_FLAG = "--opencode-go";
 const JSON_COMMANDS = new Set(["status", "config", "check"]);
-const CODEX_COMMANDS = new Set(["init", "add", "auth", "rm", "rename"]);
+const CODEX_COMMANDS = new Set(["init", "add", "auth", "rm", "rename", "seat"]);
 const STATUS_ONLY_COMMANDS = new Set(["init", "add", "auth", "rm", "rename"]);
 
 function printHelp(): void {
@@ -56,6 +57,7 @@ function printHelp(): void {
   ${c.cyan("tokenmaxxing doctor")}     verify the install is intact
   ${c.cyan("tokenmaxxing rename")} [--codex | --grok | --opencode-go] <sel> <label>
   ${c.cyan("tokenmaxxing rm")} [--codex | --grok | --opencode-go] <sel>
+  ${c.cyan("tokenmaxxing seat --codex")} <pid>  borrow one pooled codex account for an unattended consumer (plugin, script): prints the CODEX_HOME to set, reserved until <pid> exits; exit 1 = none usable, fall back to the ambient login
   ${c.cyan("tokenmaxxing uninstall")} [--yes]  print the targets, then remove supervisor + settings entries (refused without ${c.cyan("--yes")} when HOME is the login home)
   ${c.cyan("tokenmaxxing setup-token")} [--print | rm <label|uuid>]  Cursor Cloud only: mint one \`claude setup-token\` per pooled account (browser sign-in each) and print the TOKENMAXXING_TOKENS secret value; ${c.cyan("--print")} prints the stored set, ${c.cyan("rm")} drops one
   ${c.cyan("tokenmaxxing cursor init")} [dir]  write the Claude relay subagent (.cursor/agents/claude.md) and .cursor/environment.json into a repo
@@ -151,6 +153,13 @@ async function main(): Promise<number> {
     case "doctor": return cmdDoctor();
     case "rm": return cmdRm(provider, args[1]);
     case "rename": return cmdRename(provider, args.slice(1));
+    case "seat": {
+      if (provider !== codex) {
+        emitError({ message: `seat borrows a pooled codex account - pass ${CODEX_FLAG} (usage: tokenmaxxing seat ${CODEX_FLAG} <pid>)` });
+        return 2;
+      }
+      return cmdSeat(args[1], args.slice(2));
+    }
     case "setup-token": return cmdSetupToken(args.slice(1));
     case "cursor": {
       if (args[1] === "init") return cmdCursorInit(args.slice(2));