tokenmaxxing 1.68.0 → 1.69.0

package/DESIGN.md

@@ -39,7 +39,7 @@ It is a process manager only - spawn with inherited stdio (stdin through a relay
   - `respawn/<session-id>` - per-session respawn markers (the hook→supervisor signal): the target account, the session to resume, a `waitUntil`, a `compact` flag, and the launch time the marker was written for.
   - `wait-queue.json` - the depleted-pool wait claims (`{sessionId, accountId, at, waitUntil}`), so at most four sessions wait on one account; a session that arrives when every account already has four waiters takes the soonest reset anyway.
   - `bin/claude` and `bin/codex` - the supervisors, beside the `tokenmaxxing` and `xx` entry points.
-  - `sessions/<sid>.json`, `onboard/`, `setup-tokens.json`, `setup-token/`, `cloud/`, `hub-key`, `update.json`, `spawnrate.json`, `tokenmaxxing.log`, the codex `codex-onboard/`, `codex-respawn/`, and `codex-live/`, and the `grok-*` and `opencode-go-*` state of the status-only pools: the full table is in [State directory layout](docs/content/docs/state-directory.mdx).
+  - `sessions/<sid>.json`, `onboard/`, `hub-key`, `update.json`, `spawnrate.json`, `tokenmaxxing.log`, the codex `codex-onboard/`, `codex-respawn/`, and `codex-live/`, and the `grok-*` and `opencode-go-*` state of the status-only pools: the full table is in [State directory layout](docs/content/docs/state-directory.mdx).
 - Per-account **credential stores** follow the platform's Claude Code store: macOS = a login-keychain item keyed by the store path (never plaintext on disk); Linux = a 0600 `.credentials.json` inside the 0700 store directory (the same plaintext model claude itself uses - its Linux build has no keyring path at all, binary-verified 2.1.205). One `credstore` facade dispatches on a `{kind: keychain|file}` target; call sites never branch on platform. tokenmaxxing writes a store once, at onboarding; Claude Code's own refresh is the only writer afterwards.
 
 - A periodic check job (`com.tokenmaxxing.check` launchd agent on macOS, `tokenmaxxing-check.timer` systemd user timer on Linux) running `tokenmaxxing check` once per tick (`policy.checkIntervalMs`, 60s by default): it runs the decision with no seat (nothing moves), folds fresh tees into the index, samples up to three accounts whose last sample attempt is oldest (the direct no-spend usage GET), deletes leftover dead state files at the state root, and on a Bun global install checks npm for a newer version once a day, so the cached figures every placement reads stay fresh.
@@ -76,7 +76,7 @@ Each terminal ran the supervisor, so each has its own child `claude`, its own `-
 ## 4. Onboarding (no `adopt`)
 
 - **`tokenmaxxing init` logs your first pooled account in through an isolated browser sign-in, even if you are already signed in.** The login runs in a throwaway `CLAUDE_CONFIG_DIR=~/.config/tokenmaxxing/onboard`, its token's owner is verified through the profile endpoint (`GET /api/oauth/profile`, matched on `account.uuid`), and the credential is harvested once into that account's store; the throwaway home and its credential item are deleted. The login you already had keeps its own grant in Claude Code's default store for sessions started outside the supervisor; it is never copied, because a copy of one grant in two stores dies at the first refresh. `init` also installs the supervisor + the five settings entries.
-- **`tokenmaxxing add`** - registers *additional* accounts the same way, one store each. `CLAUDE_CONFIG_DIR` is SET by tokenmaxxing only for throwaway homes like this one and the `setup-token/` mint homes; a session's store is always set through `CLAUDE_SECURESTORAGE_CONFIG_DIR`.
+- **`tokenmaxxing add`** - registers *additional* accounts the same way, one store each. `CLAUDE_CONFIG_DIR` is SET by tokenmaxxing only for throwaway homes like this one; a session's store is always set through `CLAUDE_SECURESTORAGE_CONFIG_DIR`.
 - **`tokenmaxxing auth [sel | --all]`** - reauthenticates an *existing* pool member whose store died (a needs-reauth account can never heal on its own: the dead grant is exactly what Claude Code's refresh would need). Same isolated-login harvest as `add`, but it states which email to sign in with and **requires the login to land on the target account** (verified `accountUuid` must match, else nothing changes). Bare `auth` lists the pool with emails and asks which; `--all` walks every account that is flagged or whose store holds no usable credential, one by one.
 - Both commands exercise `security` reads/writes interactively (where a macOS keychain ACL prompt is acceptable), so the first access never happens cold inside a headless hook.
 
@@ -119,7 +119,7 @@ The [profile](docs/content/docs/switching-profile.mdx) records observed cache re
 
 **Shipped since (0.13.0):** Codex as a second pool with its own state (`codex-accounts.json`, per-account `codex-stores/`, own flock). Since 1.35.0 the engine is one: a generic account record (`id`, `label`, `email`, `tier`, `windows`), one picker, one decision, and one set of account commands run against a `Provider` (`src/lib/provider.ts`); `src/lib/claude.ts` and `src/lib/codex.ts` hold only what differs per product (credential store, identity, usage source, presence, login and install flows), and the provider's `seats` capability (`shared` for Claude, `live` for Codex) is how the engine knows whether present accounts stay candidates and whether a move needs the caller's respawn. Codex differences that shaped it: restart IS the switch (a running codex refuses another account's credential), one store per pooled account with `CODEX_HOME` set per session (everything but `auth.json` symlinked to the shared home, so resume works across stores), usage is a free direct GET with epoch resets and a duration-classified window set (the weekly window is primary on current plans), the refresh token rotates with reuse punished (persisted into the account's own store the instant it returns, never refreshed for an account running in another session), and the codex Stop hook drives the auto-switch through a codex supervisor shim that respawns `codex resume <session-id>` under the target's store (hooks must be trusted once via `/hooks`). Since 1.44.0 two status-only pools, grok and opencode-go, share the engine's account commands and state layout with `statusOnly: true` and no supervisor or hooks ([Status-only pools](docs/content/docs/status-only-pools.mdx)). grok `status` reads the weekly subscription credit window from the credits billing GET; opencode-go has no usage source.
 
-**Shipped since (1.29.0):** a Cursor Cloud relay. A cloud VM has no keychain, no pool state, and no supervisor, so the path uses what it does have (environment variables, a shell, repo files) and a different credential primitive, one-year inference-only setup tokens, minted once per pooled account by `tokenmaxxing setup-token` on the owner's machine and carried to the VM as one user-scoped Runtime Secret (`TOKENMAXXING_TOKENS`). `tokenmaxxing cursor init` writes `.cursor/environment.json` and a `claude` project subagent (`.cursor/agents/claude.md`) that forwards each task to `tokenmaxxing cloud run`, which spawns `claude -p --dangerously-skip-permissions --output-format json` under `CLAUDE_CODE_OAUTH_TOKEN` and pins the thread to that token (the API caches by exact prefix, so a rotation busts one thread, not all). A setup token carries no usage signal, so rotation is reactive. A run whose transcript gained a non-transient rate-limit row during that run (the structured row the StopFailure hook reads) walls the label until the reset the row names (five hours without one) and resumes the same session on the next token; the result's `api_error_status` alone never walls, so a transient 429 or an older row from a previous token does not cascade across the pool. The local switching engine never reads a setup token; `/usage` prints no percentages under one. Details in [Cursor Cloud](docs/content/docs/cursor-cloud.mdx).
+**Removed (issue #173):** the Cursor Cloud relay and its setup tokens: `tokenmaxxing setup-token`, `tokenmaxxing cursor init`, `tokenmaxxing cloud run`, `setup-tokens.json`, `TOKENMAXXING_TOKENS`, and the `cloud/` state.
 
 **Non-goals:** an API/MITM proxy; reimplementing OAuth beyond the read-only identity check at onboarding; Slack as a message bus; soft concurrency caps.
 

package/README.md

@@ -71,13 +71,10 @@ claude                  # use claude as always; each session gets its own accoun
 | `tokenmaxxing status [--cached]` | every pool: accounts with 5h / weekly / per-model usage bars, live session counts, exhausted-until-reset; `--cached` renders the stored figures without sampling |
 | `tokenmaxxing config` | the config path and the effective values; edit the file in an editor, a bad value fails the next load with the field name |
 | `tokenmaxxing check` | fold fresh tees, sample up to three stale accounts, and self-update a Bun global install once a day; the periodic timer runs this every tick |
-| `tokenmaxxing doctor` | verify the install: PATH order, `claudeBin`, the five settings entries, the timer, the hub service, the credential identity of every Codex store and of every Claude store whose access token is still fresh (an expiring Claude token is reported as unverifiable, not as a failure), codex hook trust, setup-token age, and shell aliases that shadow `claude` |
+| `tokenmaxxing doctor` | verify the install: PATH order, `claudeBin`, the five settings entries, the timer, the hub service, the credential identity of every Codex store and of every Claude store whose access token is still fresh (an expiring Claude token is reported as unverifiable, not as a failure), codex hook trust, and shell aliases that shadow `claude` |
 | `tokenmaxxing rename [--codex \| --grok \| --opencode-go] <sel> <label>` / `rm [...] <sel>` | manage a pool (one email can hold both a claude and a codex account); `rm` is refused for an account with a running supervised session |
 | `tokenmaxxing serve` | serve the CLIProxyAPI-compatible usage API on `http://localhost:8317` (`hub.port`) so a dashboard such as T3 Code's "Add a CLIProxyAPI hub" shows the quota of every pooled Claude and Codex account; the management key is the contents of `hub-key` in the state directory, minted on the first run, and `init` runs it as a background service beside the check timer. Details in [Usage hub](docs/content/docs/hub.mdx) |
 | `tokenmaxxing uninstall [--yes]` | print the targets, then remove the shims, settings entries, codex Stop hook, check timer, hub service, and rc PATH line (accounts/stores kept); refused without `--yes` when `HOME` is the login home |
-| `tokenmaxxing setup-token [--print \| rm <label\|uuid>]` | Cursor Cloud only: mint one `claude setup-token` per pooled account (a browser sign-in each) and print the `TOKENMAXXING_TOKENS` secret value; `--print` prints the stored set, `rm` drops one |
-| `tokenmaxxing cursor init [dir]` | write the Claude relay subagent and `.cursor/environment.json` into a repo |
-| `tokenmaxxing cloud run [--session <id>] [--max-turns <n>] "<prompt>"` | on a Cursor Cloud VM: run `claude -p` on a setup token, rotate to the next token on a usage limit |
 | `--json` | machine-readable output: one JSON document on stdout for `status`, `config`, and `check` (`ok` mirrors the exit code, failures add `error`) |
 
 ## How switching decides
@@ -131,10 +128,6 @@ Codex mechanics differ from Claude Code in one hard way: a running codex process
 
 Two codex-specific facts worth knowing: codex does not run hooks it has not been told to trust, so after `init --codex` you must open codex once and trust the tokenmaxxing Stop hook via `/hooks` (auto-switching is inert until then); and each codex session runs on its own store, so no live `auth.json` is ever shared: tokenmaxxing refreshes a parked account's token only when it reads usage for it, never one a session is running on, and a move is a restart at an idle turn boundary. `init --codex` refuses a `~/.codex/config.toml` that pins `cli_auth_credentials_store` away from `file`.
 
-## Cursor Cloud
-
-A Cursor Cloud Agent can hand substantial work to Claude Code running on your own accounts. The VM has no keychain and no supervisor, so this path uses setup tokens instead. `tokenmaxxing setup-token` mints one `claude setup-token` per pooled account on your machine and prints the value for a user-scoped Runtime Secret named `TOKENMAXXING_TOKENS`; `tokenmaxxing cursor init` writes a `claude` project subagent and an `environment.json` install line into the repo; on the VM, the subagent forwards each task to `tokenmaxxing cloud run`, which runs `claude -p` on one token per thread and moves the thread to the next token when a run ends on a usage limit. Setup tokens are inference-only and report no usage percentages, so cloud rotation is reactive and the local switching engine never reads one. Details and limits in [Cursor Cloud](docs/content/docs/cursor-cloud.mdx).
-
 ## Honest limitations
 
 - **A move restarts the process.** The session resumes the same transcript under the new account and continues on its own from a first prompt the supervisor submits, but the process restarts; a bar-triggered move compacts the conversation on the old account first, so the first turn on the new account uploads the summary, while a move after a refusal re-uploads the full context once (prompt cache is org-scoped).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.68.0",
+  "version": "1.69.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts, start each session on its own account, and resume a session on a fresher account when quota fills.",
   "type": "module",
   "license": "MIT",

package/src/cli/doctor.ts

@@ -8,8 +8,7 @@ import { loadAccounts, loadConfig } from "../lib/state.ts";
 import { readStore } from "../lib/credstore.ts";
 import { codexIdentityOf, readCodexStoreAuth } from "../lib/codexauth.ts";
 import { isAccessTokenExpiring, isDeadCredential, fetchTokenIdentity, describeIdentity } from "../lib/oauth.ts";
-import { SETUP_TOKEN_STALE_MS, loadSetupTokens } from "../lib/setuptokens.ts";
-import { c, fmtAgo } from "./render.ts";
+import { c } from "./render.ts";
 
 export async function cmdDoctor(): Promise<number> {
   let failed = 0;
@@ -93,15 +92,6 @@ export async function cmdDoctor(): Promise<number> {
     else if (trust === "unknown") note(`${a.label} (codex): hook trust unknown (no hooks.json or config.toml yet - launch a supervised session once, then trust via /hooks)`);
   }
 
-  if (existsSync(paths.setupTokensJson)) {
-    const setupTokens = loadSetupTokens().tokens;
-    for (const a of idx.accounts) {
-      const token = setupTokens.find((t) => t.accountUuid === a.id);
-      if (!token) warn(`no setup token stored for ${a.label} - run \`tokenmaxxing setup-token\` to mint one for Cursor Cloud`);
-      else if (Date.now() - token.mintedAt > SETUP_TOKEN_STALE_MS) warn(`the setup token for ${a.label} was minted ${fmtAgo(token.mintedAt)} and expires a year after minting - \`tokenmaxxing setup-token rm ${a.label}\` then \`tokenmaxxing setup-token\` re-mints it`);
-    }
-  }
-
   const cfg = loadConfig();
   check(!!cfg.claudeBin && existsSync(cfg.claudeBin), "real claude binary resolved", "set claudeBin in config.json");
   if (cfg.claudeBin && existsSync(cfg.claudeBin)) {

package/src/lib/claude.ts

@@ -14,7 +14,6 @@ import { seatCounts } from "./presence.ts";
 import type { Observation, Provider, SampleReport } from "./provider.ts";
 import { foldTee, sampleAccountUsage, teeObservation, usageBlockedUntil } from "./sample.ts";
 import { clearUsageSnapshot, loadAccounts, loadConfig, loadUsageSnapshot, pinBinOverride, saveAccounts, type Harvest } from "./state.ts";
-import { loadSetupTokens, saveSetupTokens } from "./setuptokens.ts";
 import { saveTermios, restoreTermios } from "./tty.ts";
 import { fetchUsageDirect, gatedFamilies, mergeWindows, modelFromFlag, scrubCredentialEnv, windowsOf } from "./usage.ts";
 import { CredentialBlobSchema, JsonTextSchema, OAuthAccountSchema, type Account, type Config, type ModelInfo } from "./types.ts";
@@ -141,10 +140,6 @@ async function removeCredentials(a: Account): Promise<void> {
   rmSync(storeDirFor(a.id), { recursive: true, force: true });
   rmSync(`${storeDirFor(a.id)}.lock`, { recursive: true, force: true });
   clearUsageSnapshot(a.id);
-  const setupTokens = loadSetupTokens();
-  if (setupTokens.tokens.some((t) => t.accountUuid === a.id)) {
-    saveSetupTokens({ ...setupTokens, tokens: setupTokens.tokens.filter((t) => t.accountUuid !== a.id) });
-  }
 }
 
 const IdentityReadySchema = z.looseObject({ oauthAccount: z.looseObject({ accountUuid: z.string().min(1) }) });

package/src/lib/paths.ts

@@ -27,12 +27,6 @@ export const paths = {
   logFile: join(TM_HOME, "tokenmaxxing.log"),
   onboardDir: join(TM_HOME, "onboard"),
   storesDir: join(TM_HOME, "stores"),
-  setupTokensJson: join(TM_HOME, "setup-tokens.json"),
-  setupTokenDir: join(TM_HOME, "setup-token"),
-  cloudDir: join(TM_HOME, "cloud"),
-  cloudSessionsJson: join(TM_HOME, "cloud", "sessions.json"),
-  cloudWalledJson: join(TM_HOME, "cloud", "walled.json"),
-  cloudLockFile: join(TM_HOME, "cloud", "lock"),
   hubKeyFile: join(TM_HOME, "hub-key"),
 
   claudeSettings: env(

package/src/lib/sessions.ts

@@ -56,6 +56,9 @@ const DEAD_STATE_ENTRIES = [
   "codex-creds",
   "codex-reconcile",
   "sample",
+  "setup-tokens.json",
+  "setup-token",
+  "cloud",
 ];
 
 const TMP_MARKER = ".tmp.";
@@ -76,7 +79,7 @@ function listDir(dir: string, root: string): Dirent[] {
 }
 
 function tmpSweepDirs(root: string): string[] {
-  const dirs = [paths.home, paths.usageDir, paths.presenceDir, paths.respawnDir, sessionsDir(), paths.binDir, paths.cloudDir, codexPaths.presenceDir, codexPaths.respawnDir, codexPaths.onboardDir];
+  const dirs = [paths.home, paths.usageDir, paths.presenceDir, paths.respawnDir, sessionsDir(), paths.binDir, codexPaths.presenceDir, codexPaths.respawnDir, codexPaths.onboardDir];
   for (const parent of STORE_PARENTS) {
     for (const child of listDir(parent, root)) {
       if (child.isDirectory()) dirs.push(join(parent, child.name));

package/src/main.ts

@@ -22,9 +22,6 @@ import { cmdRename } from "./cli/rename.ts";
 import { cmdCheck } from "./cli/check.ts";
 import { cmdConfig } from "./cli/config.ts";
 import { cmdSeat } from "./cli/seat.ts";
-import { cmdSetupToken } from "./cli/setuptoken.ts";
-import { cmdCloudRun } from "./cli/cloudrun.ts";
-import { cmdCursorInit } from "./cli/cursorinit.ts";
 import { cmdServe } from "./cli/serve.ts";
 import { hubDeactivationHint, onLoginHome, timerDeactivationHint, uninstallSupervisor, uninstallTargets } from "./lib/install.ts";
 import { errorMessage } from "./lib/log.ts";
@@ -61,9 +58,6 @@ function printHelp(): void {
   ${c.cyan("tokenmaxxing seat --codex")} <pid>  borrow one pooled codex account for an unattended consumer (plugin, script): prints the CODEX_HOME to set, reserved until <pid> exits; exit 1 = none usable, fall back to the ambient login
   ${c.cyan("tokenmaxxing serve")}      serve the CLIProxyAPI-compatible usage API on http://localhost:<hub.port> (default 8317) so a dashboard such as T3 Code's "Add a CLIProxyAPI hub" shows every pooled Claude and Codex account's quota; the management key is the contents of hub-key in the state directory
   ${c.cyan("tokenmaxxing uninstall")} [--yes]  print the targets, then remove supervisor + settings entries (refused without ${c.cyan("--yes")} when HOME is the login home)
-  ${c.cyan("tokenmaxxing setup-token")} [--print | rm <label|uuid>]  Cursor Cloud only: mint one \`claude setup-token\` per pooled account (browser sign-in each) and print the TOKENMAXXING_TOKENS secret value; ${c.cyan("--print")} prints the stored set, ${c.cyan("rm")} drops one
-  ${c.cyan("tokenmaxxing cursor init")} [dir]  write the Claude relay subagent (.cursor/agents/claude.md) and .cursor/environment.json into a repo
-  ${c.cyan("tokenmaxxing cloud run")} [--session <id>] [--max-turns <n>] "<prompt>"  on a Cursor Cloud VM: run claude -p on a setup token from TOKENMAXXING_TOKENS, rotate to the next token on a usage limit
 
   ${c.cyan("--json")}                  print one JSON document on stdout instead of text (status, config, check); every document carries ${c.bold("ok")}, failures add ${c.bold("error")}
 
@@ -162,18 +156,7 @@ async function main(): Promise<number> {
       }
       return cmdSeat(args[1], args.slice(2));
     }
-    case "setup-token": return cmdSetupToken(args.slice(1));
     case "serve": return cmdServe(args.slice(1));
-    case "cursor": {
-      if (args[1] === "init") return cmdCursorInit(args.slice(2));
-      emitError({ message: "usage: tokenmaxxing cursor init [dir]" });
-      return 2;
-    }
-    case "cloud": {
-      if (args[1] === "run") return cmdCloudRun(args.slice(2));
-      emitError({ message: 'usage: tokenmaxxing cloud run [--session <id>] [--max-turns <n>] "<prompt>"' });
-      return 2;
-    }
     case "uninstall": {
       if (args.length > 1) {
         emitError({ message: `unknown uninstall option: ${args[1]} (uninstall takes only ${YES_FLAG})` });

package/src/cli/cloudrun.ts

@@ -1,100 +0,0 @@
-import { parseArgs } from "node:util";
-import { withLock } from "../lib/lock.ts";
-import { errorMessage } from "../lib/log.ts";
-import { paths } from "../lib/paths.ts";
-import {
-  limitWallUntil,
-  loadCloudSessions,
-  loadCloudWalled,
-  newReservationKey,
-  pickToken,
-  readCloudTokens,
-  saveCloudSessions,
-  saveCloudWalled,
-  spawnCloudClaude,
-  transcriptBytes,
-} from "../lib/cloud.ts";
-import { c, emitError, fmtReset } from "./render.ts";
-
-const USAGE = "usage: tokenmaxxing cloud run [--session <id>] [--max-turns <n>] \"<prompt>\" (the prompt is also read from stdin)";
-
-function parseFlags(args: string[]): { session: string | null; maxTurns: number | null; prompt: string | null } | { error: string } {
-  let parsed;
-  try {
-    parsed = parseArgs({ args, options: { session: { type: "string" }, "max-turns": { type: "string" } }, allowPositionals: true });
-  } catch (e) {
-    return { error: errorMessage(e) };
-  }
-  const { session, "max-turns": rawTurns } = parsed.values;
-  if (session === "") return { error: "--session needs a session id" };
-  const maxTurns = rawTurns == null ? null : Number(rawTurns);
-  if (maxTurns != null && (!Number.isInteger(maxTurns) || maxTurns < 1)) return { error: `--max-turns needs a positive whole number, got: ${rawTurns}` };
-  return { session: session ?? null, maxTurns, prompt: parsed.positionals.length > 0 ? parsed.positionals.join(" ") : null };
-}
-
-export async function cmdCloudRun(args: string[]): Promise<number> {
-  const flags = parseFlags(args);
-  if ("error" in flags) {
-    emitError({ message: `${flags.error} - ${USAGE}` });
-    return 2;
-  }
-  const prompt = flags.prompt ?? (process.stdin.isTTY ? null : await Bun.stdin.text());
-  if (prompt == null || prompt.trim() === "") {
-    emitError({ message: USAGE });
-    return 2;
-  }
-  const tokens = readCloudTokens();
-  let sessionId = flags.session;
-  while (true) {
-    const reservation = newReservationKey();
-    const pick = await withLock(paths.cloudLockFile, () => {
-      const sessions = loadCloudSessions();
-      const picked = pickToken({ tokens, sessions, walled: loadCloudWalled(), sessionId, now: Date.now() });
-      if (picked.ok) saveCloudSessions({ ...sessions, [reservation]: picked.token.label });
-      return picked;
-    });
-    if (!pick.ok) {
-      emitError({ message: `every token is at its limit - earliest ${fmtReset(pick.earliestReset)}` });
-      return 1;
-    }
-    const label = pick.token.label;
-    console.error(c.dim(`cloud run: ${label}${sessionId ? ` (resuming ${sessionId})` : ""}`));
-    const transcriptBefore = transcriptBytes(sessionId);
-    let spawned: Awaited<ReturnType<typeof spawnCloudClaude>>;
-    try {
-      spawned = await spawnCloudClaude({ token: pick.token.token, prompt, resume: sessionId, maxTurns: flags.maxTurns });
-    } catch (e) {
-      await withLock(paths.cloudLockFile, () => {
-        const sessions = loadCloudSessions();
-        delete sessions[reservation];
-        saveCloudSessions(sessions);
-      });
-      throw e;
-    }
-    const { exitCode, result } = spawned;
-    sessionId = result.session_id;
-    const failed = result.is_error || result.subtype !== "success";
-    const until = failed ? limitWallUntil({ sessionId: result.session_id, sinceBytes: transcriptBefore, now: Date.now() }) : null;
-    await withLock(paths.cloudLockFile, () => {
-      const sessions = loadCloudSessions();
-      delete sessions[reservation];
-      saveCloudSessions({ ...sessions, [result.session_id]: label });
-      if (until != null) saveCloudWalled({ ...loadCloudWalled(), [label]: until });
-    });
-    if (failed) {
-      if (until != null) {
-        console.error(c.yellow(`cloud run: ${label} hit its limit (${fmtReset(until)}) - resuming the session on the next token`));
-        continue;
-      }
-      const errors = result.subtype === "success" ? [result.result] : result.errors;
-      emitError({
-        message: `claude exited ${exitCode ?? "on signal"} (${result.subtype}): ${errors.join("; ")}`,
-        notes: [`session ${result.session_id}`],
-      });
-      return 1;
-    }
-    console.log(result.result);
-    console.log(`session ${result.session_id}`);
-    return 0;
-  }
-}

package/src/cli/cursorinit.ts

@@ -1,77 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
-import { z } from "zod";
-import { writeFileAtomic } from "../lib/atomic.ts";
-import { c, emitError } from "./render.ts";
-
-export const CLOUD_INSTALL_LINE =
-  'curl -fsSL https://bun.sh/install | bash && curl -fsSL https://claude.ai/install.sh | bash && "$HOME/.bun/bin/bun" add -g tokenmaxxing && test -x "$HOME/.bun/bin/bun" && test -x "$HOME/.local/bin/claude" && test -e "$HOME/.bun/bin/tokenmaxxing"';
-
-export const CLOUD_RUN_COMMAND = 'TOKENMAXXING_CLAUDE_BIN="$HOME/.local/bin/claude" "$HOME/.bun/bin/bun" "$HOME/.bun/bin/tokenmaxxing" cloud run';
-
-export const RELAY_AGENT = `---
-name: claude
-description: Runs a task in Claude Code on the owner's subscription accounts. Use proactively for substantial implementation, debugging, or research work that should not consume the parent's context.
-model: inherit
-readonly: false
----
-
-You are a thin forwarding wrapper around Claude Code.
-
-Your only job is to forward the task to the runner and return its output. Do not do anything else.
-
-Rules:
-
-- Use exactly one shell call. Pass the task on stdin through a quoted heredoc. Pick the delimiter fresh for every call as \`TASK_\` followed by eight random letters and digits, and check that no line of the task equals it; a quoted heredoc ends only on a line that matches the delimiter exactly, so the task text can never become shell commands.
-
-\`\`\`sh
-${CLOUD_RUN_COMMAND} <<'TASK_k3v9qx2m'
-<task>
-TASK_k3v9qx2m
-\`\`\`
-
-- When the task continues earlier Claude Code work, add \`--session <id>\` after \`cloud run\` with the session id from the previous output.
-- Preserve the task text as given. Do not inspect the repository, read files, run other commands, or summarize.
-- Return the command's stdout exactly as-is, including the trailing \`session <id>\` line.
-- If the command fails, return its stderr as-is.
-`;
-
-const ENVIRONMENT_JSON = JSON.stringify({ install: CLOUD_INSTALL_LINE }, null, 2) + "\n";
-const ExistingEnvironmentSchema = z.looseObject({ user: z.string().optional() });
-
-const REPO_FILE_MODE = 0o644;
-const USAGE = "usage: tokenmaxxing cursor init [dir]";
-
-export function cmdCursorInit(args: string[]): number {
-  if (args.length > 1) {
-    emitError({ message: USAGE });
-    return 2;
-  }
-  const dir = resolve(args[0] ?? ".");
-  if (!existsSync(dir)) {
-    emitError({ message: `no such directory: ${dir}` });
-    return 1;
-  }
-  const agentFile = join(dir, ".cursor", "agents", "claude.md");
-  const environmentFile = join(dir, ".cursor", "environment.json");
-  const existing = existsSync(environmentFile) ? ExistingEnvironmentSchema.parse(Bun.JSONC.parse(readFileSync(environmentFile, "utf8"))) : null;
-  const agent = existsSync(agentFile) && readFileSync(agentFile, "utf8") === RELAY_AGENT ? "unchanged" : "written";
-  if (agent === "written") writeFileAtomic(agentFile, RELAY_AGENT, REPO_FILE_MODE);
-  const environment = existing == null ? "written" : "exists";
-  const warnings: string[] = [];
-  if (existing == null) {
-    writeFileAtomic(environmentFile, ENVIRONMENT_JSON, REPO_FILE_MODE);
-  } else if (existing.user === "root" || existing.user === "0") {
-    warnings.push(".cursor/environment.json sets user to root; Claude Code refuses --dangerously-skip-permissions under root, so every relay call fails until user is a non-root account");
-  }
-  console.log(`${c.green("✓")} .cursor/agents/claude.md ${agent}`);
-  if (environment === "written") {
-    console.log(`${c.green("✓")} .cursor/environment.json written`);
-  } else {
-    console.log(c.yellow("⚠ .cursor/environment.json exists - left untouched; add this to its install command:"));
-    console.log(`  ${CLOUD_INSTALL_LINE}`);
-  }
-  for (const warning of warnings) console.log(c.yellow(`⚠ ${warning}`));
-  console.log(c.dim("next: commit both files, add the TOKENMAXXING_TOKENS user-scoped Runtime Secret at cursor.com/dashboard/cloud-agents, and start a cloud agent on the repo"));
-  return 0;
-}

package/src/cli/setuptoken.ts

@@ -1,147 +0,0 @@
-import { mkdirSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { resolveRealClaude } from "../lib/claudebin.ts";
-import { withLock } from "../lib/lock.ts";
-import { claudePool, paths, shortId } from "../lib/paths.ts";
-import { loadAccounts } from "../lib/state.ts";
-import { scrubCredentialEnv } from "../lib/usage.ts";
-import { CURSOR_SECRET_VALUE_CAP_BYTES, cursorSecretValue, loadSetupTokens, saveSetupTokens, type SetupToken } from "../lib/setuptokens.ts";
-import type { Account } from "../lib/types.ts";
-import { c, emitError } from "./render.ts";
-
-const TOKEN_BEGIN_MARKER = "Your OAuth token (valid for";
-const TOKEN_END_MARKER = "Store this token securely";
-const USAGE = "usage: tokenmaxxing setup-token [--print] | tokenmaxxing setup-token rm <label|uuid>";
-
-export function extractSetupToken(output: string): string | null {
-  const lines = Bun.stripANSI(output).split("\n").map((line) => line.trim());
-  const end = lines.findLastIndex((line) => line.includes(TOKEN_END_MARKER));
-  if (end < 0) return null;
-  const begin = lines.slice(0, end).findLastIndex((line) => line.includes(TOKEN_BEGIN_MARKER));
-  if (begin < 0) return null;
-  const token = lines.slice(begin + 1, end).join("");
-  return token === "" ? null : token;
-}
-
-async function mint(input: { real: string; item: string }): Promise<string | null> {
-  const configDir = join(paths.setupTokenDir, input.item);
-  rmSync(configDir, { recursive: true, force: true });
-  mkdirSync(configDir, { recursive: true });
-  const env = scrubCredentialEnv({ ...process.env, CLAUDE_CONFIG_DIR: configDir });
-  const child = Bun.spawn([input.real, "setup-token"], { env, stdin: "inherit", stdout: "pipe", stderr: "inherit" });
-  const decoder = new TextDecoder();
-  let captured = "";
-  for await (const chunk of child.stdout) {
-    process.stdout.write(chunk);
-    captured += decoder.decode(chunk, { stream: true });
-  }
-  await child.exited;
-  rmSync(configDir, { recursive: true, force: true });
-  if (child.exitCode !== 0) {
-    console.error(c.red(`claude setup-token exited ${child.exitCode ?? "on signal"} - nothing stored`));
-    return null;
-  }
-  const captureToken = extractSetupToken(captured);
-  if (captureToken) return captureToken;
-  const pasted = prompt("the token line was not captured from the output above - paste the token here:")?.trim() ?? "";
-  if (pasted === "") {
-    console.error(c.red("no token pasted - nothing stored"));
-    return null;
-  }
-  return pasted;
-}
-
-function currentTokens(tokens: SetupToken[], accounts: Account[]): { label: string; token: string }[] {
-  return accounts.flatMap((a) => {
-    const stored = tokens.find((t) => t.accountUuid === a.id);
-    return stored ? [{ label: a.label, token: stored.token }] : [];
-  });
-}
-
-async function rmToken(selector: string): Promise<number> {
-  const outcome = await withLock(claudePool.lockFile, async (): Promise<{ error: string } | { kept: SetupToken[] }> => {
-    const store = loadSetupTokens();
-    const accounts = loadAccounts(claudePool).accounts;
-    const pooled = accounts.find((a) => a.label === selector);
-    const orphan = (t: SetupToken) => !accounts.some((a) => a.id === t.accountUuid);
-    const targets = store.tokens.filter((t) =>
-      t.accountUuid === selector || (pooled ? t.accountUuid === pooled.id : t.label === selector && orphan(t)),
-    );
-    if (targets.length === 0) return { error: `no setup token stored for "${selector}"` };
-    if (targets.length > 1) return { error: `"${selector}" matches ${targets.length} stored tokens (${targets.map((t) => `${t.label} ${t.accountUuid}`).join(", ")}) - nothing removed` };
-    const kept = store.tokens.filter((t) => t !== targets[0]);
-    saveSetupTokens({ ...store, tokens: kept });
-    return { kept };
-  });
-  if ("error" in outcome) {
-    emitError({ message: outcome.error });
-    return 1;
-  }
-  console.log(`removed the setup token for ${selector} (local only: Claude Code documents no revocation for setup tokens)`);
-  return 0;
-}
-
-export async function cmdSetupToken(args: string[]): Promise<number> {
-  const [sub, label] = args;
-  if (sub === "rm" && label !== undefined && args.length === 2) return rmToken(label);
-  const print = sub === "--print" && args.length === 1;
-  if (args.length > 0 && !print) {
-    emitError({ message: USAGE });
-    return 2;
-  }
-  let store = loadSetupTokens();
-  let idx = loadAccounts(claudePool);
-  if (!print) {
-    if (idx.accounts.length === 0) {
-      emitError({ message: "no accounts in the pool - run `tokenmaxxing init` first" });
-      return 1;
-    }
-    const real = resolveRealClaude();
-    const missing = idx.accounts.filter((a) => !store.tokens.some((t) => t.accountUuid === a.id));
-    if (missing.length === 0) console.log(c.dim("every pooled account already has a stored setup token (`setup-token rm <label>` drops one so it can be re-minted)"));
-    for (const a of missing) {
-      console.log();
-      console.log(`${c.bold(a.label)} - sign into this account in the browser (${a.email ?? a.label})`);
-      const token = await mint({ real, item: shortId(a.id) });
-      if (!token) return 1;
-      const stored = await withLock(claudePool.lockFile, async () => {
-        if (!loadAccounts(claudePool).accounts.some((x) => x.id === a.id)) return false;
-        const fresh = loadSetupTokens();
-        const tokens = fresh.tokens.filter((t) => t.accountUuid !== a.id);
-        saveSetupTokens({ ...fresh, tokens: [...tokens, { accountUuid: a.id, label: a.label, token, mintedAt: Date.now() }] });
-        return true;
-      });
-      if (!stored) {
-        console.log(c.yellow(`${a.label} left the pool during the login - token discarded`));
-        continue;
-      }
-      console.log(`${c.green("✓")} stored the setup token for ${c.bold(a.label)} ${c.dim("(ownership not verified: an inference-only token cannot read the profile endpoint, so the label is the sign-in you chose)")}`);
-    }
-    store = loadSetupTokens();
-    idx = loadAccounts(claudePool);
-  }
-  if (store.tokens.length === 0) {
-    emitError({ message: "no setup tokens stored - run `tokenmaxxing setup-token` to mint them" });
-    return 1;
-  }
-  const tokens = currentTokens(store.tokens, idx.accounts);
-  const orphaned = store.tokens
-    .filter((t) => !idx.accounts.some((a) => a.id === t.accountUuid))
-    .map((t) => ({ label: t.label, accountUuid: t.accountUuid }));
-  if (tokens.length === 0) {
-    emitError({ message: "no stored setup token belongs to a pooled account - run `tokenmaxxing setup-token` to mint them" });
-    return 1;
-  }
-  const secret = cursorSecretValue(tokens);
-  const bytes = Buffer.byteLength(secret);
-  console.log();
-  if (orphaned.length > 0) {
-    console.log(c.dim(`left out of the secret (no longer in the pool): ${orphaned.map((t) => `${t.label} (${t.accountUuid})`).join(", ")}; \`setup-token rm <label|uuid>\` drops one`));
-  }
-  console.log(`${c.bold("TOKENMAXXING_TOKENS")} ${c.dim("(user-scoped Runtime Secret at cursor.com/dashboard/cloud-agents)")}`);
-  console.log(secret);
-  if (bytes > CURSOR_SECRET_VALUE_CAP_BYTES) {
-    console.log(c.yellow(`⚠ ${bytes} bytes: over the ${CURSOR_SECRET_VALUE_CAP_BYTES}-byte value cap Cursor documents for API-created environment variables`));
-  }
-  return 0;
-}

package/src/lib/cloud.ts

@@ -1,172 +0,0 @@
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
-import { join } from "node:path";
-import { minBy } from "es-toolkit";
-import { z } from "zod";
-import { paths } from "./paths.ts";
-import { writeFileAtomic } from "./atomic.ts";
-import { UNMANAGED_ENV, resolveRealClaude } from "./claudebin.ts";
-import { pidExists } from "./proc.ts";
-import { CloudTokensSchema, type CloudToken } from "./setuptokens.ts";
-import { parseErrorBody, readTranscriptTail, scrubCredentialEnv } from "./usage.ts";
-
-export const TOKENS_ENV = "TOKENMAXXING_TOKENS";
-export const FALLBACK_WALL_MS = 5 * 3_600_000;
-const RESERVATION_PREFIX = "pending:";
-
-export function readCloudTokens(): CloudToken[] {
-  const raw = process.env[TOKENS_ENV];
-  if (raw == null || raw === "") {
-    throw new Error(`${TOKENS_ENV} is not set - add it as a user-scoped Runtime Secret with the value \`tokenmaxxing setup-token --print\` prints`);
-  }
-  let json: unknown;
-  try {
-    json = JSON.parse(raw);
-  } catch {
-    throw new Error(`${TOKENS_ENV} is not valid JSON`);
-  }
-  const parsed = CloudTokensSchema.safeParse(json);
-  if (!parsed.success) throw new Error(`${TOKENS_ENV} must be a non-empty JSON array of {label, token} objects`);
-  const labels = parsed.data.map((t) => t.label);
-  if (new Set(labels).size !== labels.length) throw new Error(`${TOKENS_ENV} carries a duplicate label`);
-  const reserved = labels.find((label) => label in {});
-  if (reserved != null) throw new Error(`${TOKENS_ENV} carries the label "${reserved}", which is a reserved object property name`);
-  return parsed.data;
-}
-
-const SessionsSchema = z.record(z.string(), z.string());
-const WalledSchema = z.record(z.string(), z.number());
-
-function loadState<T>(file: string, schema: z.ZodType<T>, empty: T): T {
-  if (!existsSync(file)) return empty;
-  let json: unknown;
-  try {
-    json = JSON.parse(readFileSync(file, "utf8"));
-  } catch {
-    throw new Error(`${file} is corrupt (unparsable JSON) - repair or remove the file`);
-  }
-  return schema.parse(json);
-}
-
-export function loadCloudSessions(): Record<string, string> {
-  const sessions = loadState(paths.cloudSessionsJson, SessionsSchema, {});
-  for (const key of Object.keys(sessions)) {
-    if (!key.startsWith(RESERVATION_PREFIX)) continue;
-    const pid = Number(key.slice(RESERVATION_PREFIX.length).split(":")[0]);
-    if (!Number.isInteger(pid) || !pidExists(pid)) delete sessions[key];
-  }
-  return sessions;
-}
-
-export function saveCloudSessions(sessions: Record<string, string>): void {
-  writeFileAtomic(paths.cloudSessionsJson, JSON.stringify(SessionsSchema.parse(sessions), null, 2) + "\n");
-}
-
-export function newReservationKey(): string {
-  return `${RESERVATION_PREFIX}${process.pid}:${crypto.randomUUID().slice(0, 8)}`;
-}
-
-export function loadCloudWalled(): Record<string, number> {
-  return loadState(paths.cloudWalledJson, WalledSchema, {});
-}
-
-export function saveCloudWalled(walled: Record<string, number>): void {
-  writeFileAtomic(paths.cloudWalledJson, JSON.stringify(WalledSchema.parse(walled), null, 2) + "\n");
-}
-
-export type Pick = { ok: true; token: CloudToken } | { ok: false; earliestReset: number };
-
-export function pickToken(input: {
-  tokens: CloudToken[];
-  sessions: Record<string, string>;
-  walled: Record<string, number>;
-  sessionId: string | null;
-  now: number;
-}): Pick {
-  const walled = new Map(Object.entries(input.walled));
-  const sessions = new Map(Object.entries(input.sessions));
-  const open = (label: string) => (walled.get(label) ?? 0) <= input.now;
-  if (input.sessionId != null) {
-    const pinned = sessions.get(input.sessionId);
-    const token = input.tokens.find((t) => t.label === pinned);
-    if (token && open(token.label)) return { ok: true, token };
-  }
-  const candidates = input.tokens.filter((t) => open(t.label));
-  if (candidates.length === 0) {
-    return { ok: false, earliestReset: Math.min(...input.tokens.map((t) => walled.get(t.label) ?? input.now)) };
-  }
-  const load = new Map<string, number>();
-  for (const label of sessions.values()) load.set(label, (load.get(label) ?? 0) + 1);
-  return { ok: true, token: minBy(candidates, (t) => load.get(t.label) ?? 0) ?? candidates[0]! };
-}
-
-const ResultBase = {
-  type: z.literal("result"),
-  session_id: z.string(),
-  is_error: z.boolean(),
-  num_turns: z.number(),
-  total_cost_usd: z.number(),
-};
-const CloudResultSchema = z.discriminatedUnion("subtype", [
-  z.looseObject({ ...ResultBase, subtype: z.literal("success"), result: z.string(), api_error_status: z.number().nullish() }),
-  z.looseObject({
-    ...ResultBase,
-    subtype: z.enum(["error_max_turns", "error_during_execution", "error_max_budget_usd", "error_max_structured_output_retries"]),
-    errors: z.array(z.string()),
-  }),
-]);
-export type CloudResult = z.infer<typeof CloudResultSchema>;
-
-export async function spawnCloudClaude(input: {
-  token: string;
-  prompt: string;
-  resume: string | null;
-  maxTurns: number | null;
-}): Promise<{ exitCode: number | null; result: CloudResult }> {
-  const args = [
-    "-p", "--output-format", "json", "--dangerously-skip-permissions",
-    ...(input.resume ? ["--resume", input.resume] : []),
-    ...(input.maxTurns != null ? ["--max-turns", String(input.maxTurns)] : []),
-    "--", input.prompt,
-  ];
-  const env: Record<string, string> = { ...scrubCredentialEnv({ ...process.env, [UNMANAGED_ENV]: "1" }), CLAUDE_CODE_OAUTH_TOKEN: input.token };
-  delete env[TOKENS_ENV];
-  const child = Bun.spawn([resolveRealClaude(), ...args], { env, stdin: "ignore", stdout: "pipe", stderr: "inherit" });
-  const stdout = await new Response(child.stdout).text();
-  await child.exited;
-  let json: unknown;
-  try {
-    json = JSON.parse(stdout);
-  } catch {
-    throw new Error(`claude exited ${child.exitCode ?? "on signal"} without a JSON result: ${stdout.trim().slice(0, 200)}`);
-  }
-  const parsed = CloudResultSchema.safeParse(json);
-  if (!parsed.success) {
-    throw new Error(`claude exited ${child.exitCode ?? "on signal"} with a result that does not match the documented result message: ${stdout.trim().slice(0, 200)}`);
-  }
-  return { exitCode: child.exitCode, result: parsed.data };
-}
-
-export function cloudTranscriptPath(sessionId: string): string | null {
-  const projects = join(paths.claudeDir, "projects");
-  if (!existsSync(projects)) return null;
-  for (const dir of readdirSync(projects)) {
-    const candidate = join(projects, dir, `${sessionId}.jsonl`);
-    if (existsSync(candidate)) return candidate;
-  }
-  return null;
-}
-
-export function transcriptBytes(sessionId: string | null): number {
-  const transcript = sessionId ? cloudTranscriptPath(sessionId) : null;
-  return transcript ? statSync(transcript).size : 0;
-}
-
-export function limitWallUntil(input: { sessionId: string; sinceBytes: number; now: number }): number | null {
-  const transcript = cloudTranscriptPath(input.sessionId);
-  const rows = transcript ? readTranscriptTail(transcript, statSync(transcript).size - input.sinceBytes + 1) : [];
-  const row = rows.findLast((r) => r.isApiErrorMessage === true);
-  if (!row || row.error !== "rate_limit" || row.apiErrorIsTransient === true) return null;
-  if ((row.quotaLimits?.rateLimitType ?? "") === "" && parseErrorBody(row.errorDetails)?.error?.type !== "rate_limit_error") return null;
-  const resetsAt = row.quotaLimits?.resetsAt ?? null;
-  return resetsAt != null && resetsAt > input.now ? resetsAt : input.now + FALLBACK_WALL_MS;
-}

package/src/lib/setuptokens.ts

@@ -1,40 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { z } from "zod";
-import { paths } from "./paths.ts";
-import { writeFileAtomic } from "./atomic.ts";
-
-export const CURSOR_SECRET_VALUE_CAP_BYTES = 4096;
-export const SETUP_TOKEN_STALE_MS = 335 * 86_400_000;
-
-const SetupTokenSchema = z.object({ accountUuid: z.string().min(1), label: z.string().min(1), token: z.string().min(1), mintedAt: z.number() });
-export type SetupToken = z.infer<typeof SetupTokenSchema>;
-
-const SetupTokensFileSchema = z.object({ version: z.literal(1), tokens: z.array(SetupTokenSchema).default([]) });
-export type SetupTokensFile = z.infer<typeof SetupTokensFileSchema>;
-
-export const CloudTokenSchema = z.object({ label: z.string().min(1), token: z.string().min(1) });
-export type CloudToken = z.infer<typeof CloudTokenSchema>;
-export const CloudTokensSchema = z.array(CloudTokenSchema).min(1);
-
-export function loadSetupTokens(): SetupTokensFile {
-  if (!existsSync(paths.setupTokensJson)) return { version: 1, tokens: [] };
-  let json: unknown;
-  try {
-    json = JSON.parse(readFileSync(paths.setupTokensJson, "utf8"));
-  } catch {
-    throw new Error(`${paths.setupTokensJson} is corrupt (unparsable JSON) - refusing to treat a damaged token store as empty; repair or remove the file`);
-  }
-  const parsed = SetupTokensFileSchema.safeParse(json);
-  if (!parsed.success) {
-    throw new Error(`${paths.setupTokensJson} does not match the setup-token schema - repair or remove the file`);
-  }
-  return parsed.data;
-}
-
-export function saveSetupTokens(file: SetupTokensFile): void {
-  writeFileAtomic(paths.setupTokensJson, JSON.stringify(SetupTokensFileSchema.parse(file), null, 2) + "\n");
-}
-
-export function cursorSecretValue(tokens: CloudToken[]): string {
-  return JSON.stringify(CloudTokensSchema.parse(tokens));
-}