tokenmaxxing 1.73.0 → 1.75.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.73.0",
+  "version": "1.75.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts, start each session on its own account, and resume a session on a fresher account when quota fills.",
   "type": "module",
   "license": "MIT",

package/src/cli/serve.ts

@@ -130,12 +130,8 @@ async function apiCall(req: Request): Promise<Response> {
   const method = (call.method ?? "").trim().toUpperCase();
   if (method === "") return json({ error: "missing method" }, 400);
   if (!call.url) return json({ error: "missing url" }, 400);
-  let target: URL;
-  try {
-    target = new URL(call.url);
-  } catch {
-    return json({ error: "invalid url" }, 400);
-  }
+  const target = URL.parse(call.url);
+  if (!target) return json({ error: "invalid url" }, 400);
   const pool = POOLS.find((p) => p.usageUrl === `${target.origin}${target.pathname}`);
   if (method !== "GET" || !pool) {
     return json({ error: `unsupported request: this hub serves ${POOLS.map((p) => `GET ${p.usageUrl}`).join(" and ")} only` }, 400);
@@ -166,16 +162,20 @@ function keyMatches(presented: string, key: string): boolean {
   return a.length === b.length && timingSafeEqual(a, b);
 }
 
-async function handle(req: Request, key: string): Promise<Response> {
-  const url = new URL(req.url);
-  if (!url.pathname.startsWith(MANAGEMENT_PREFIX)) return json({ error: "not found" }, 404);
+function unauthorized(req: Request, key: string): Response | null {
   const presented = presentedKey(req);
   if (presented === "") return json({ error: "missing management key" }, 401);
   if (!keyMatches(presented, key)) return json({ error: "invalid management key" }, 401);
-  const route = url.pathname.slice(MANAGEMENT_PREFIX.length);
-  if (route === "auth-files" && req.method === "GET") return json(authFiles(loadConfig(), Date.now()));
-  if (route === "api-call" && req.method === "POST") return apiCall(req);
-  return json({ error: "not found" }, 404);
+  return null;
+}
+
+function guarded(key: string, handler: (req: Request) => Response | Promise<Response>): (req: Request) => Response | Promise<Response> {
+  return (req) => unauthorized(req, key) ?? handler(req);
+}
+
+function notFound(req: Request, key: string): Response {
+  const url = new URL(req.url);
+  return (url.pathname.startsWith(MANAGEMENT_PREFIX) ? unauthorized(req, key) : null) ?? json({ error: "not found" }, 404);
 }
 
 function managementKey(): string {
@@ -204,7 +204,11 @@ export async function cmdServe(args: string[]): Promise<number> {
     server = Bun.serve({
       hostname: "localhost",
       port: cfg.hub.port,
-      fetch: (req) => handle(req, key),
+      routes: {
+        [`${MANAGEMENT_PREFIX}auth-files`]: { GET: guarded(key, () => json(authFiles(loadConfig(), Date.now()))) },
+        [`${MANAGEMENT_PREFIX}api-call`]: { POST: guarded(key, apiCall) },
+      },
+      fetch: (req) => notFound(req, key),
       error: (e) => {
         log("hub.error", { err: errorMessage(e) });
         return json({ error: "internal error" }, 500);

package/src/entries/codexstophook.ts

@@ -1,5 +1,4 @@
 import { join } from "node:path";
-import { mkdirSync } from "node:fs";
 import type { z } from "zod";
 import { codexPaths, optionalEnv } from "../lib/paths.ts";
 import { writeFileAtomic } from "../lib/atomic.ts";
@@ -50,7 +49,6 @@ async function handleCodexStop(rawStdin: string): Promise<void> {
     await compactBeforeMove({ sessionId, now });
     const decision = await evaluateAndMaybeSwap(codex, now);
     if (decision.swapped && decision.account) {
-      mkdirSync(codexPaths.respawnDir, { recursive: true });
       const payload: z.infer<typeof CodexRespawnMarkerSchema> = { accountId: decision.account.id, sessionId, ts: Date.now() };
       writeFileAtomic(join(codexPaths.respawnDir, supervisorId), JSON.stringify(payload));
       log("codexstop.marker", { supervisorId: supervisorId.slice(0, 8) });

package/src/lib/claude.ts

@@ -3,7 +3,6 @@ import { join } from "node:path";
 import { z } from "zod";
 import { readItem, writeItem, deleteItem, isolatedTarget, readStore, storeTarget, claudeAiOauthOnly } from "./credstore.ts";
 import { resolveRealClaude, resolveVerifiedClaude } from "./claudebin.ts";
-import { withClaudeRefreshLock } from "./claudelock.ts";
 import { ensurePathInRc, hubActivationHint, installSupervisor, managedShellRcSkipLines, shellRcPath, timerActivationHint } from "./install.ts";
 import { withLock } from "./lock.ts";
 import { errorMessage, log } from "./log.ts";
@@ -177,7 +176,7 @@ async function login(): Promise<Harvest | null> {
     await onExit;
     restoreTermios(savedTermios);
 
-    const blobRaw = await withClaudeRefreshLock(onboardDir, () => readItem(iso));
+    const blobRaw = await readItem(iso);
     if (!blobRaw || !identityReady(cjPath)) {
       console.error(c.red("no login detected in the isolated session - nothing changed."));
       return null;

package/src/lib/claudebin.ts

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { uniq } from "es-toolkit";
 import { z } from "zod";
@@ -30,7 +30,6 @@ export function wrapperEntryRateTripped(now: number): boolean {
   entries = entries.filter((t) => now - t < WRAP_RATE_WINDOW_MS);
   entries.push(now);
   try {
-    mkdirSync(paths.home, { recursive: true });
     writeFileAtomic(file, JSON.stringify({ entries }));
   } catch {  }
   return entries.length > WRAP_RATE_MAX;

package/src/lib/codex.ts

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import { existsSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { writeFileAtomic } from "./atomic.ts";
 import { MAX_WRAP_DEPTH, WRAP_DEPTH_ENV } from "./claudebin.ts";
@@ -116,7 +116,6 @@ async function login(): Promise<Harvest | null> {
   const real = resolveRealCodex();
   const onboardDir = codexPaths.onboardDir;
   rmSync(onboardDir, { recursive: true, force: true });
-  mkdirSync(onboardDir, { recursive: true });
   writeFileAtomic(join(onboardDir, "config.toml"), 'cli_auth_credentials_store = "file"\n');
 
   const savedTermios = saveTermios();

package/src/lib/codexauth.ts

@@ -32,7 +32,6 @@ export function codexStoreUsable(accountId: string): boolean {
 }
 
 export function writeCodexStoreAuth(accountId: string, auth: CodexAuthJson): void {
-  mkdirSync(codexStoreDirFor(accountId), { recursive: true });
   writeFileAtomic(codexAuthJsonFor(accountId), JSON.stringify(CodexAuthJsonSchema.parse(auth), null, 2), 0o600);
 }
 

package/src/lib/grok.ts

@@ -1,4 +1,4 @@
-import { mkdirSync, readFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { writeFileAtomic } from "./atomic.ts";
@@ -31,7 +31,6 @@ function harvestOf(id: string, key: string, entry: GrokAuthEntry): Harvest {
     tier: null,
     sample: null,
     park: async () => {
-      mkdirSync(grokStoreDirFor(id), { recursive: true });
       writeFileAtomic(grokAuthJsonFor(id), JSON.stringify({ [key]: entry }, null, 2), 0o600);
     },
   };

package/src/lib/install.ts

@@ -1,4 +1,4 @@
-import { accessSync, appendFileSync, constants, existsSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
+import { accessSync, appendFileSync, constants, existsSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
 import { userInfo } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { escape } from "es-toolkit";
@@ -89,7 +89,6 @@ exec ${JSON.stringify(bun)} --no-env-file run ${JSON.stringify(entry)} "$@"
 }
 
 export function installSupervisor(): InstallOutcome {
-  mkdirSync(paths.binDir, { recursive: true });
   const target = installedBin();
   const entry = realpathSync(Bun.main);
   if (isNixPackaged()) {
@@ -147,7 +146,6 @@ export function installCodexStopHook(): void {
       ],
     },
   };
-  mkdirSync(codexPaths.home, { recursive: true });
   writeFileAtomic(codexPaths.hooksJson, JSON.stringify(next, null, 2) + "\n");
 }
 
@@ -198,7 +196,6 @@ export function codexSupervisorLink(): string {
 }
 
 export function installCodexSupervisor(): void {
-  mkdirSync(paths.binDir, { recursive: true });
   writeFileAtomic(codexSupervisorLink(), `#!/bin/sh\nexec ${JSON.stringify(installedBin())} __supervise-codex "$@"\n`, 0o755);
   installCodexStopHook();
 }

package/src/lib/opencodego.ts

@@ -1,4 +1,4 @@
-import { mkdirSync, readFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { writeFileAtomic } from "./atomic.ts";
@@ -29,7 +29,6 @@ function harvestOf(key: string): Harvest {
     tier: "go",
     sample: null,
     park: async () => {
-      mkdirSync(opencodeGoStoreDirFor(id), { recursive: true });
       writeFileAtomic(opencodeGoAuthJsonFor(id), JSON.stringify({ "opencode-go": { type: "api", key } }, null, 2), 0o600);
     },
   };

package/src/lib/paths.ts

@@ -1,4 +1,4 @@
-import { homedir } from "node:os";
+import { homedir, userInfo } from "node:os";
 import { join } from "node:path";
 import { z } from "zod";
 
@@ -123,8 +123,20 @@ export function opencodeGoAuthJsonFor(accountId: string): string {
   return join(opencodeGoStoreDirFor(accountId), "auth.json");
 }
 
+const CLAUDE_KEYCHAIN_ACCOUNT_PATTERN = /^[a-zA-Z0-9._-]+$/;
+
+function claudeKeychainAccount(): string {
+  let name: string;
+  try {
+    name = process.env.USER || userInfo().username;
+  } catch {
+    return "claude-code-user";
+  }
+  return CLAUDE_KEYCHAIN_ACCOUNT_PATTERN.test(name) ? name : "claude-code-user";
+}
+
 export const keychain = {
-  account: env("TOKENMAXXING_KEYCHAIN_ACCOUNT", process.env.USER ?? "unknown"),
+  account: optionalEnv("TOKENMAXXING_KEYCHAIN_ACCOUNT") ?? claudeKeychainAccount(),
 } as const;
 
 export function shortId(accountId: string): string {

package/src/lib/presence.ts

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { writeFileAtomic } from "./atomic.ts";
@@ -14,7 +14,6 @@ const PresenceSchema = z.object({
 export function writePresence(input: { dir: string; id: string; accountId: string; pid: number }): void {
   const startedAt = pidStartTime(input.pid);
   if (startedAt == null) throw new Error(`could not read pid ${input.pid}'s start time (ps lstart) - refusing to write an unverifiable presence file`);
-  mkdirSync(input.dir, { recursive: true });
   writeFileAtomic(join(input.dir, input.id), JSON.stringify(PresenceSchema.parse({ accountId: input.accountId, pid: input.pid, startedAt })));
 }
 

package/src/lib/sessions.ts

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, statSync, type Dirent } from "node:fs";
+import { existsSync, readdirSync, readFileSync, realpathSync, rmSync, statSync, type Dirent } from "node:fs";
 import { basename, join, sep } from "node:path";
 import { z } from "zod";
 import { errorMessage, log } from "./log.ts";
@@ -19,7 +19,6 @@ function sessionFile(sid: string): string {
 }
 
 export function saveSessionFlags(sid: string, flags: string[], cwd: string): void {
-  mkdirSync(sessionsDir(), { recursive: true });
   writeFileAtomic(sessionFile(sid), JSON.stringify({ flags, cwd }));
 }
 
@@ -39,7 +38,6 @@ export function liveSessionId(sid: string): string {
 
 function recordLiveSession(sid: string, current: string): void {
   const session = loadSession(sid);
-  mkdirSync(sessionsDir(), { recursive: true });
   writeFileAtomic(sessionFile(sid), JSON.stringify({ flags: session?.flags ?? [], cwd: session?.cwd ?? process.cwd(), current }));
 }
 
@@ -126,7 +124,6 @@ export function adoptLiveSession(session: SupervisedSession, stdinSid: string |
 }
 
 export function writeRespawnMarker(input: { session: SupervisedSession; accountId: string; waitUntil: number; compact: boolean }): void {
-  mkdirSync(paths.respawnDir, { recursive: true });
   const payload: z.infer<typeof RespawnMarkerSchema> = {
     accountId: input.accountId,
     ts: Date.now(),

package/src/lib/claudelock.ts

@@ -1,105 +0,0 @@
-import { mkdirSync, realpathSync, rmdirSync, statSync, utimesSync } from "node:fs";
-import { join } from "node:path";
-import { delay } from "es-toolkit";
-import { errorMessage, log } from "./log.ts";
-import { ErrnoSchema } from "./types.ts";
-
-const STALE_MS = 60_000;
-const HEARTBEAT_MS = 5_000;
-const ATTEMPTS = 5;
-const RETRY_MS = 1_000;
-
-function tryAcquire(lockDir: string): boolean {
-  try {
-    mkdirSync(lockDir);
-    return true;
-  } catch (e) {
-    if (ErrnoSchema.safeParse(e).data?.code !== "EEXIST") throw e;
-  }
-  try {
-    if (Date.now() - statSync(lockDir).mtimeMs > STALE_MS) {
-      rmdirSync(lockDir);
-      mkdirSync(lockDir);
-      return true;
-    }
-  } catch {  }
-  return false;
-}
-
-export async function withClaudeRefreshLock<T>(
-  dir: string,
-  fn: (lock: { compromised: () => boolean }) => Promise<T> | T,
-  opts: { attempts?: number; retryMs?: number; heartbeatMs?: number } = {},
-): Promise<T> {
-  const attempts = opts.attempts ?? ATTEMPTS;
-  const retryMs = opts.retryMs ?? RETRY_MS;
-  mkdirSync(dir, { recursive: true });
-  const primary = join(dir, ".oauth_refresh.lock");
-  let legacyRoot = dir;
-  try { legacyRoot = realpathSync(dir); } catch {  }
-  const legacy = `${legacyRoot}.lock`;
-
-  const held: string[] = [];
-  for (let attempt = 1; held.length === 0; attempt++) {
-    if (tryAcquire(primary)) {
-      try {
-        if (tryAcquire(legacy)) {
-          held.push(legacy, primary);
-          break;
-        }
-      } catch (e) {
-        log("claudelock.legacy_error", { err: errorMessage(e) });
-        held.push(primary);
-        break;
-      }
-      rmdirSync(primary);
-    }
-    if (attempt >= attempts) {
-      log("claudelock.contested", { attempts: attempt });
-      throw new Error(
-        "claude's credential-refresh lock is contested (a token refresh is likely mid-flight) - not touching the credential store; retry shortly",
-      );
-    }
-    await delay(retryMs + Math.random() * retryMs);
-  }
-
-  const ours = new Map<string, number>();
-  for (const d of held) ours.set(d, statSync(d).mtimeMs);
-  let compromised = false;
-  const markCompromised = () => {
-    if (!compromised) {
-      compromised = true;
-      log("claudelock.compromised", {});
-    }
-  };
-  const heartbeat = setInterval(() => {
-    const now = new Date();
-    for (const d of held) {
-      try {
-        if (statSync(d).mtimeMs !== ours.get(d)) {
-          markCompromised();
-          continue;
-        }
-        utimesSync(d, now, now);
-        ours.set(d, statSync(d).mtimeMs);
-      } catch {
-        markCompromised();
-      }
-    }
-  }, opts.heartbeatMs ?? HEARTBEAT_MS);
-
-  try {
-    const result = await fn({ compromised: () => compromised });
-    if (compromised) {
-      throw new Error("claude's credential-refresh lock was reclaimed while held (this process stalled past the 60s stale bar) - treat this critical section as failed");
-    }
-    return result;
-  } finally {
-    clearInterval(heartbeat);
-    for (const d of held) {
-      try {
-        if (statSync(d).mtimeMs === ours.get(d)) rmdirSync(d);
-      } catch {  }
-    }
-  }
-}