tokenmaxxing 1.7.0 → 1.9.0

package/src/entries/statusline.ts

@@ -1,22 +1,3 @@
-// Native statusLine. Reads Claude's statusLine stdin, tees the rate-limit data
-// to usage.json (write-on-change, O(ms)), then renders ONE line:
-//   worktree name (linked worktrees only), model name painted by context fill
-//   (effort in parens), +added/-removed, then quota as COLOR (user decisions
-//   2026-07-18): each window is its time-to-reset painted on a continuous
-//   green->yellow->red ramp by used% - "◆ 𝒇 2h 1d  ◇ 2d  ◇ full" - the
-//   active account's windows after a green ◆ (per-model by bare initial
-//   first, fable as 𝒇, other families uppercased; "𝒇?" unpainted when the
-//   cap applies but is unmeasured, then session/5h, then week), then EVERY
-//   parked account's week after its own cyan ◇ (red ✗ if needs-reauth),
-//   sorted by earliest upcoming reset (needs-reauth last). A window with no
-//   upcoming reset renders "0" (empty again); measured usage with an unknown
-//   reset clock renders a painted "?". With color disabled the numeric format
-//   returns ("2h5" = resets in 2h, 5 used; "ctx 42"): without color a drained
-//   window must not look fresh. Blocks are joined by TWO spaces, tokens
-//   within a block by one. Per-model resets are omitted (they match the
-//   weekly reset).
-// Must NEVER break the status line: render what parses, skip what doesn't.
-
 import { sortBy } from "es-toolkit";
 import { z } from "zod";
 import { readOAuthAccount } from "../lib/claudejson.ts";
@@ -36,27 +17,16 @@ import {
   type UsageWindow,
 } from "../lib/types.ts";
 
-/** A session that hasn't adopted a fresh swap yet (<=30s keychain cache) pushes
- *  the OLD account's windows while ~/.claude.json already names the NEW org.
- *  Suppress the tee for this long after a swap so that mislabel never lands. */
 const ADOPTION_GRACE_MS = 45_000;
 
 const RenderCtxSchema = z.object({
   accounts: AccountsIndexSchema,
-  /** active account's per-model weekly windows ({} unless fresh for the live org). */
   perModel: z.record(z.string(), UsageWindowSchema),
-  /** families (lowercased) whose per-model weekly cap gates a switch. */
   switchModels: z.array(z.string()),
-  /** linked-worktree basename, null in a main checkout. */
   worktree: z.string().nullable(),
-  /** the LIVE login's org from claude.json, the seat's identity - the
-   *  activeAccountUuid label drifts after a manual /login (the same rule as
-   *  decide.ts's seatOf; closing-review catch: the label-keyed split rendered
-   *  the live account twice and hid the stale-labeled one). */
   liveOrg: z.string().nullable(),
   now: z.number(),
   color: z.boolean(),
-  /** terminal advertises 24-bit color (COLORTERM); false steps the ramp to the 256-color cube. */
   truecolor: z.boolean(),
 });
 export type RenderCtx = z.infer<typeof RenderCtxSchema>;
@@ -67,22 +37,17 @@ export async function readStdin(): Promise<string> {
   return Buffer.concat(chunks).toString("utf8");
 }
 
-/** Pure renderer: statusLine stdin + tokenmaxxing state → the emitted line. */
 export function renderStatusline(stdinObj: unknown, ctx: RenderCtx): string {
   const col = makeColors(ctx.color);
   const paint = makeUsagePaint({ enabled: ctx.color, truecolor: ctx.truecolor });
-  // Used quota in a window; one whose reset has passed is empty again.
   const used = (w: UsageWindow) => (w.resetsAt != null && w.resetsAt <= ctx.now ? 0 : w.usedPercentage);
   const reset = (epochMs: number | null) => fmtResetShort(epochMs, ctx.now);
 
   const parsed = StatusLineStdinSchema.safeParse(stdinObj);
   const d = parsed.success ? parsed.data : null;
 
-  // ---- info block: worktree, model, ctx, diff
   const info: string[] = [];
   if (ctx.worktree != null) info.push(ctx.worktree);
-  // The model name carries the context-fill color (user rule 2026-07-18, no
-  // ctx token); colorless mode keeps the numeric ctx token instead.
   const modelName = d?.model?.display_name ?? d?.model?.id;
   const ctxUsed = d?.context_window?.used_percentage;
   if (modelName) {
@@ -93,26 +58,17 @@ export function renderStatusline(stdinObj: unknown, ctx: RenderCtx): string {
   if (!ctx.color && ctxUsed != null) info.push(`ctx ${Math.round(ctxUsed)}`);
   const added = d?.cost?.total_lines_added ?? 0;
   const removed = d?.cost?.total_lines_removed ?? 0;
-  // -removed stays unpainted: red means quota alarm and nothing else.
   if (added > 0 || removed > 0) info.push(`${col.green(`+${added}`)}/-${removed}`);
 
-  // ---- active account block
-  // A window token: color carries the used%, the text is the reset countdown
-  // (or the bare per-model initial - per-model resets are omitted). "0" = no
-  // upcoming reset (the window is empty again); a painted "?" = measured usage
-  // whose reset clock is unknown. Colorless mode glues the number back on.
   const seg = (label: string, w: UsageWindow, resetAt: number | null) => {
     const u = used(w);
     if (!ctx.color) return `${label}${reset(resetAt)}${Math.round(u)}`;
     const body = label !== "" ? label : reset(resetAt);
     return col.bold(paint(u)(body !== "" ? body : u > 0 ? "?" : "0"));
   };
-  // Per-model initial: fable renders 𝒇 (user rule 2026-07-18), family-matched
-  // as always; other families keep their uppercased first letter.
   const initial = (name: string) => (familyTokens(name).includes("fable") ? "𝒇" : name.slice(0, 1).toUpperCase());
   const wins = parseStatusLineStdin(stdinObj);
   const windows: string[] = [];
-  // A capacity-constrained model whose cap is unmeasured must not look safe.
   const family = matchedFamily(parseStatusLineModel(stdinObj), ctx.switchModels);
   if (family && !Object.keys(ctx.perModel).some((k) => familyTokens(k).includes(family))) {
     windows.push(`${initial(family)}?`);
@@ -122,7 +78,6 @@ export function renderStatusline(stdinObj: unknown, ctx: RenderCtx): string {
     windows.push(seg("", wins.fiveHour, wins.fiveHour.resetsAt));
     windows.push(seg("", wins.sevenDay, wins.sevenDay.resetsAt));
   }
-  // The seat: live-org first, stored label fallback (unknown live identity).
   const seatUuid =
     (ctx.liveOrg != null ? ctx.accounts.accounts.find((a) => a.organizationUuid === ctx.liveOrg)?.accountUuid : undefined) ??
     ctx.accounts.activeAccountUuid;
@@ -133,13 +88,10 @@ export function renderStatusline(stdinObj: unknown, ctx: RenderCtx): string {
         ? `${col.green("◆")} ?`
         : "";
 
-  // ---- parked accounts, earliest upcoming reset first (needs-reauth last)
   const parked = sortBy(
     ctx.accounts.accounts.filter((a) => a.accountUuid !== seatUuid),
     [(a) => (a.needsReauth ? 1 : 0), (a) => earliestReset(a, ctx.now)],
   );
-  // Every parked account renders its own marker (user rule 2026-07-18: the
-  // old counted collapse "◇ 3 full" hid the pool size and read as confusing).
   const poolSeg = (a: Account): string => {
     const marker = a.needsReauth ? col.red("✗") : col.cyan("◇");
     const week = a.lastUsage?.sevenDay;
@@ -148,7 +100,6 @@ export function renderStatusline(stdinObj: unknown, ctx: RenderCtx): string {
     if (Math.round(weekUsed) <= 0) return `${marker} ${paint(0)("full")}`;
 
     const parts: string[] = [];
-    // A per-model weekly cap with more used than the aggregate is the binding constraint - surface it.
     for (const [name, w] of Object.entries(a.lastPerModel ?? {})) {
       if (used(w) > weekUsed) parts.push(seg(initial(name), w, null));
     }
@@ -166,25 +117,11 @@ export async function runStatusline(): Promise<number> {
   try {
     obj = JSON.parse(raw);
   } catch {
-    // malformed stdin - render from state alone
   }
   const now = Date.now();
 
-  // The stdin payload's own org label: those rate_limits and that
-  // organizationUuid ride the SAME API response, so the label can never lie
-  // about whose windows these are. claude.json's org is only the fallback -
-  // it flips at the swap while a session that has made no post-swap request
-  // keeps rendering the OLD account's windows indefinitely, and the 45s
-  // ADOPTION_GRACE_MS bounds nothing for such a session (closing-review
-  // catch: a stale-window tee labeled with the new org could hard-swap a
-  // healthy account and stamp foreign usage into it). The render below uses
-  // the same preference so the active ◆ seat matches the windows painted
-  // beside it (PR #36 review catch). Trusted ONLY when the payload's windows
-  // parsed too: an org label without windows would re-label state the payload
-  // did not carry (second-round catch).
   let stdinOrg: string | null = null;
 
-  // tee usage for the Stop hook / status - best effort, never blocks rendering.
   let org: string | null = null;
   try {
     org = readOAuthAccount()?.organizationUuid ?? null;
@@ -197,7 +134,6 @@ export async function runStatusline(): Promise<number> {
       writeUsage(state);
     }
   } catch {
-    // skip the tee, still render below
   }
 
   let line: string;
@@ -219,8 +155,6 @@ export async function runStatusline(): Promise<number> {
     };
     line = renderStatusline(obj, ctx);
   } catch (e) {
-    // Corrupt local state (the loaders throw on it) must stay VISIBLE: render
-    // the failure as the statusline itself, never abort into a blank line.
     line = `tokenmaxxing: ${e instanceof Error ? e.message : String(e)}`;
   }
   process.stdout.write(line + "\n");

package/src/entries/stopfailurehook.ts

@@ -0,0 +1,93 @@
+import { join } from "node:path";
+import { z } from "zod";
+import { paths } from "../lib/paths.ts";
+import { writeFileAtomic } from "../lib/atomic.ts";
+import { readOAuthAccount } from "../lib/claudejson.ts";
+import { enforcedWindowMs, evaluateAndMaybeSwap, postSwapProof, recordEnforcedLimit } from "../lib/decide.ts";
+import { loadConfig, loadLastSwapAt } from "../lib/state.ts";
+import { classifyEnforcedLimit, findEnforcedRow, parseErrorBody, readTranscriptTail } from "../lib/usage.ts";
+import { RespawnMarkerSchema, type EnforcedLimit } from "../lib/types.ts";
+import { log } from "../lib/log.ts";
+
+export const RETRIGGER_PROMPT = "Continue where the previous turn left off; it was interrupted by a usage limit and tokenmaxxing switched accounts.";
+
+const StopFailureStdin = z.looseObject({
+  session_id: z.uuid().optional().catch(undefined),
+  transcript_path: z.string().optional().catch(undefined),
+  error: z.string().optional().catch(undefined),
+  agent_id: z.string().optional().catch(undefined),
+  last_assistant_message: z.string().optional().catch(undefined),
+});
+
+const LaunchedAtSchema = z.coerce.number().finite().optional().catch(undefined);
+
+async function readStdin(): Promise<string> {
+  const chunks: Uint8Array[] = [];
+  for await (const c of Bun.stdin.stream()) chunks.push(c);
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+export async function runStopFailureHook(): Promise<number> {
+  if (process.env.TOKENMAXXING_PROBE) return 0;
+
+  const org = readOAuthAccount()?.organizationUuid ?? null;
+  const now = Date.now();
+  const raw = await readStdin();
+  const parsed = StopFailureStdin.safeParse((() => { try { return JSON.parse(raw); } catch { return {}; } })());
+  const stdin = parsed.success ? parsed.data : {};
+  if (stdin.error !== undefined && stdin.error !== "rate_limit") return 0;
+
+  const stdinSid = stdin.session_id;
+  const pinnedSid = process.env.TOKENMAXXING_SESSION_ID;
+  const launchedAt = LaunchedAtSchema.parse(process.env.TOKENMAXXING_LAUNCHED_AT) ?? null;
+  const mainLoop = stdin.agent_id === undefined;
+  const canPause = process.env.TOKENMAXXING_SUPERVISED === "1" && pinnedSid != null && mainLoop;
+
+  try {
+    const cfg = loadConfig();
+    const found = stdin.transcript_path
+      ? findEnforcedRow({ rows: readTranscriptTail(stdin.transcript_path), lastAssistantMessage: stdin.last_assistant_message, now })
+      : null;
+    const limit = found ? classifyEnforcedLimit(found.row, cfg.policy.switchModels) : null;
+
+    let enforced: EnforcedLimit | null = null;
+    if (limit && found && org) {
+      if (postSwapProof({ swapAt: loadLastSwapAt(), launchedAt, errorAt: found.errorAt, now })) {
+        const stamp = await recordEnforcedLimit({ limit, org, now });
+        log("stopfailure.enforced", { kind: limit.kind, family: limit.kind === "model" ? limit.family : undefined, outcome: stamp.outcome, resetsAt: stamp.resetsAt, subagent: !mainLoop });
+        if (stamp.outcome !== "org-moved") {
+          enforced = { org, family: limit.kind === "model" ? limit.family : null, resetsAt: stamp.resetsAt, windowMs: enforcedWindowMs(limit) };
+        }
+      } else {
+        log("stopfailure.unproven", { kind: limit.kind });
+      }
+    } else {
+      log("stopfailure.unclassified", {
+        row: found != null,
+        type: found?.row.quotaLimits?.rateLimitType,
+        transient: found?.row.apiErrorIsTransient,
+        body: found ? parseErrorBody(found.row.errorDetails)?.error?.type : undefined,
+      });
+    }
+
+    const decision = await evaluateAndMaybeSwap(now, canPause && enforced != null, enforced);
+    if (enforced && canPause && pinnedSid && decision.account && (decision.swapped || decision.waitUntil !== undefined)) {
+      const marker = join(paths.respawnDir, pinnedSid);
+      const payload = RespawnMarkerSchema.parse({
+        account: decision.account.label,
+        ts: Date.now(),
+        waitUntil: decision.waitUntil ?? now,
+        sessionId: stdinSid ?? pinnedSid,
+        prompt: RETRIGGER_PROMPT,
+        ...(launchedAt != null ? { launchedAt } : {}),
+      });
+      writeFileAtomic(marker, JSON.stringify(payload));
+      log("stopfailure.marker", { session: (stdinSid ?? pinnedSid).slice(0, 8), account: decision.account.accountUuid.slice(0, 8), waitUntil: payload.waitUntil });
+    } else {
+      log("stopfailure.decision", { reason: decision.reason, swapped: decision.swapped, account: decision.account?.accountUuid.slice(0, 8), waitUntil: decision.waitUntil });
+    }
+  } catch (e) {
+    log("stopfailure.error", { err: e instanceof Error ? e.message : String(e) });
+  }
+  return 0;
+}

package/src/entries/stophook.ts

@@ -1,11 +1,3 @@
-// Stop hook. Fires when claude finishes a turn (transcript already committed).
-// A plain swap needs no respawn: the running session adopts the swapped
-// credential on its own (<=30s on macOS, next request on Linux). Only a
-// depleted-pool wait - when running under the supervisor - drops a respawn
-// marker keyed by this session id: the supervisor SIGTERMs its child at this
-// clean boundary, counts down to the reset, then relaunches `--resume`. We
-// never kill claude ourselves.
-
 import { join } from "node:path";
 import { z } from "zod";
 import { paths } from "../lib/paths.ts";
@@ -14,10 +6,6 @@ import { evaluateAndMaybeSwap } from "../lib/decide.ts";
 import { RespawnMarkerSchema } from "../lib/types.ts";
 import { log } from "../lib/log.ts";
 
-// session_id must be a real transcript UUID: a malformed value would ride the
-// respawn marker into `--resume <garbage>`, which claude treats as a picker
-// search term (PR #36 review catch); non-UUID input drops to undefined and the
-// marker falls back to the pinned sid.
 const StopStdin = z.looseObject({ session_id: z.uuid().optional().catch(undefined) });
 
 async function readStdin(): Promise<string> {
@@ -27,35 +15,27 @@ async function readStdin(): Promise<string> {
 }
 
 export async function runStopHook(): Promise<number> {
-  // recursion guard - our own `-p '/usage'` probe re-enters hooks.
   if (process.env.TOKENMAXXING_PROBE) return 0;
 
   const raw = await readStdin();
   const parsed = StopStdin.safeParse((() => { try { return JSON.parse(raw); } catch { return {}; } })());
-  // TWO session ids with different jobs (closing-review HIGH catch): the
-  // PINNED id (env, set once by the supervisor) names the marker file the
-  // supervisor actually watches and survives /clear; the STDIN id names the
-  // CURRENT transcript to resume and drifts to a new value after /clear.
-  // Keying the file by the stdin id orphaned every post-/clear marker.
   const stdinSid = parsed.success ? parsed.data.session_id : undefined;
   const pinnedSid = process.env.TOKENMAXXING_SESSION_ID;
 
   try {
-    // Anticipatory depleted swaps are only sane when the respawn marker below
-    // will actually pause the session until the reset.
     const canPause = process.env.TOKENMAXXING_SUPERVISED === "1" && pinnedSid != null;
     const decision = await evaluateAndMaybeSwap(Date.now(), canPause);
     if (decision.account && (decision.swapped || decision.waitUntil !== undefined)) {
       log(decision.swapped ? "stop.swapped" : "stop.wait", { account: decision.account.accountUuid.slice(0, 8), waitUntil: decision.waitUntil });
-      // Respawn only for a depleted-pool wait: pausing until the reset requires
-      // killing the child. A plain swap leaves the session running to adopt.
       if (decision.waitUntil !== undefined && canPause && pinnedSid) {
         const marker = join(paths.respawnDir, pinnedSid);
+        const launchedAt = z.coerce.number().finite().optional().catch(undefined).parse(process.env.TOKENMAXXING_LAUNCHED_AT);
         const payload = RespawnMarkerSchema.parse({
           account: decision.account.label,
           ts: Date.now(),
           waitUntil: decision.waitUntil,
           sessionId: stdinSid ?? pinnedSid,
+          ...(launchedAt != null ? { launchedAt } : {}),
         });
         writeFileAtomic(marker, JSON.stringify(payload));
         log("stop.marker", { session: (stdinSid ?? pinnedSid).slice(0, 8) });
@@ -64,5 +44,5 @@ export async function runStopHook(): Promise<number> {
   } catch (e) {
     log("stop.error", { err: e instanceof Error ? e.message : String(e) });
   }
-  return 0; // never block the stop
+  return 0;
 }

package/src/entries/subagentstatusline.ts

@@ -1,16 +1,3 @@
-// Renders claude's subagentStatusLine: one {id, content} JSON line per active
-// subagent task, so the agents panel shows each subagent's model, effort, and
-// ctx fill the way the main statusline shows the session's (user ask
-// 2026-07-18). This per-row panel surface is the only place subagent info can
-// appear: the main statusLine command never learns which subagent the UI is
-// viewing (verified against the 2.1.214 bundle). Row shape mirrors the main
-// info block, info first so claude's end-truncation eats the label instead:
-//   "fable (high)  <task label>" - the family name painted by the task's
-//   context fill (colorless mode keeps a numeric ctx token).
-// A task we emit nothing for keeps claude's default row (emitting empty
-// content would HIDE it). Must NEVER break the panel: render what parses,
-// skip what doesn't.
-
 import { z } from "zod";
 import { makeColors, makeUsagePaint } from "../cli/render.ts";
 import { readStdin } from "./statusline.ts";
@@ -19,14 +6,11 @@ import { SubagentStatusLineStdinSchema } from "../lib/types.ts";
 const RowCtxSchema = z.object({ color: z.boolean(), truecolor: z.boolean() });
 export type RowCtx = z.infer<typeof RowCtxSchema>;
 
-/** "claude-fable-5" -> "fable" (lowercase family, matching the chart-label
- *  convention); an id without the claude- prefix passes through whole. */
 function modelFamily(id: string): string {
   const [head, family] = id.split("-");
   return head === "claude" && family ? family : id;
 }
 
-/** Pure renderer: subagentStatusLine stdin -> {id, content} JSON lines. */
 export function renderSubagentRows(stdinObj: unknown, ctx: RowCtx): string[] {
   const parsed = SubagentStatusLineStdinSchema.safeParse(stdinObj);
   if (!parsed.success) return [];
@@ -41,8 +25,6 @@ export function renderSubagentRows(stdinObj: unknown, ctx: RowCtx): string[] {
         ? Math.round((t.tokenCount / t.contextWindowSize) * 100)
         : null;
     const info: string[] = [];
-    // The model name carries the task's context-fill color (same rule as the
-    // main line); colorless mode keeps the numeric ctx token instead.
     if (t.model != null) {
       const family = modelFamily(t.model);
       const body = pct != null ? col.bold(paint(pct)(family)) : col.bold(family);
@@ -66,7 +48,6 @@ export async function runSubagentStatusline(): Promise<number> {
   try {
     obj = JSON.parse(raw);
   } catch {
-    // malformed stdin - emit nothing, claude keeps its default rows
   }
   const colorterm = z.string().optional().parse(process.env.COLORTERM);
   const rows = renderSubagentRows(obj, {