tokenmaxxing 1.74.0 → 1.75.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.74.0",
+  "version": "1.75.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts, start each session on its own account, and resume a session on a fresher account when quota fills.",
   "type": "module",
   "license": "MIT",

package/src/cli/serve.ts

@@ -130,12 +130,8 @@ async function apiCall(req: Request): Promise<Response> {
   const method = (call.method ?? "").trim().toUpperCase();
   if (method === "") return json({ error: "missing method" }, 400);
   if (!call.url) return json({ error: "missing url" }, 400);
-  let target: URL;
-  try {
-    target = new URL(call.url);
-  } catch {
-    return json({ error: "invalid url" }, 400);
-  }
+  const target = URL.parse(call.url);
+  if (!target) return json({ error: "invalid url" }, 400);
   const pool = POOLS.find((p) => p.usageUrl === `${target.origin}${target.pathname}`);
   if (method !== "GET" || !pool) {
     return json({ error: `unsupported request: this hub serves ${POOLS.map((p) => `GET ${p.usageUrl}`).join(" and ")} only` }, 400);
@@ -166,16 +162,20 @@ function keyMatches(presented: string, key: string): boolean {
   return a.length === b.length && timingSafeEqual(a, b);
 }
 
-async function handle(req: Request, key: string): Promise<Response> {
-  const url = new URL(req.url);
-  if (!url.pathname.startsWith(MANAGEMENT_PREFIX)) return json({ error: "not found" }, 404);
+function unauthorized(req: Request, key: string): Response | null {
   const presented = presentedKey(req);
   if (presented === "") return json({ error: "missing management key" }, 401);
   if (!keyMatches(presented, key)) return json({ error: "invalid management key" }, 401);
-  const route = url.pathname.slice(MANAGEMENT_PREFIX.length);
-  if (route === "auth-files" && req.method === "GET") return json(authFiles(loadConfig(), Date.now()));
-  if (route === "api-call" && req.method === "POST") return apiCall(req);
-  return json({ error: "not found" }, 404);
+  return null;
+}
+
+function guarded(key: string, handler: (req: Request) => Response | Promise<Response>): (req: Request) => Response | Promise<Response> {
+  return (req) => unauthorized(req, key) ?? handler(req);
+}
+
+function notFound(req: Request, key: string): Response {
+  const url = new URL(req.url);
+  return (url.pathname.startsWith(MANAGEMENT_PREFIX) ? unauthorized(req, key) : null) ?? json({ error: "not found" }, 404);
 }
 
 function managementKey(): string {
@@ -204,7 +204,11 @@ export async function cmdServe(args: string[]): Promise<number> {
     server = Bun.serve({
       hostname: "localhost",
       port: cfg.hub.port,
-      fetch: (req) => handle(req, key),
+      routes: {
+        [`${MANAGEMENT_PREFIX}auth-files`]: { GET: guarded(key, () => json(authFiles(loadConfig(), Date.now()))) },
+        [`${MANAGEMENT_PREFIX}api-call`]: { POST: guarded(key, apiCall) },
+      },
+      fetch: (req) => notFound(req, key),
       error: (e) => {
         log("hub.error", { err: errorMessage(e) });
         return json({ error: "internal error" }, 500);

package/src/lib/claude.ts

@@ -3,7 +3,6 @@ import { join } from "node:path";
 import { z } from "zod";
 import { readItem, writeItem, deleteItem, isolatedTarget, readStore, storeTarget, claudeAiOauthOnly } from "./credstore.ts";
 import { resolveRealClaude, resolveVerifiedClaude } from "./claudebin.ts";
-import { withClaudeRefreshLock } from "./claudelock.ts";
 import { ensurePathInRc, hubActivationHint, installSupervisor, managedShellRcSkipLines, shellRcPath, timerActivationHint } from "./install.ts";
 import { withLock } from "./lock.ts";
 import { errorMessage, log } from "./log.ts";
@@ -177,7 +176,7 @@ async function login(): Promise<Harvest | null> {
     await onExit;
     restoreTermios(savedTermios);
 
-    const blobRaw = await withClaudeRefreshLock(onboardDir, () => readItem(iso));
+    const blobRaw = await readItem(iso);
     if (!blobRaw || !identityReady(cjPath)) {
       console.error(c.red("no login detected in the isolated session - nothing changed."));
       return null;

package/src/lib/paths.ts

@@ -1,4 +1,4 @@
-import { homedir } from "node:os";
+import { homedir, userInfo } from "node:os";
 import { join } from "node:path";
 import { z } from "zod";
 
@@ -123,8 +123,20 @@ export function opencodeGoAuthJsonFor(accountId: string): string {
   return join(opencodeGoStoreDirFor(accountId), "auth.json");
 }
 
+const CLAUDE_KEYCHAIN_ACCOUNT_PATTERN = /^[a-zA-Z0-9._-]+$/;
+
+function claudeKeychainAccount(): string {
+  let name: string;
+  try {
+    name = process.env.USER || userInfo().username;
+  } catch {
+    return "claude-code-user";
+  }
+  return CLAUDE_KEYCHAIN_ACCOUNT_PATTERN.test(name) ? name : "claude-code-user";
+}
+
 export const keychain = {
-  account: env("TOKENMAXXING_KEYCHAIN_ACCOUNT", process.env.USER ?? "unknown"),
+  account: optionalEnv("TOKENMAXXING_KEYCHAIN_ACCOUNT") ?? claudeKeychainAccount(),
 } as const;
 
 export function shortId(accountId: string): string {

package/src/lib/claudelock.ts

@@ -1,105 +0,0 @@
-import { mkdirSync, realpathSync, rmdirSync, statSync, utimesSync } from "node:fs";
-import { join } from "node:path";
-import { delay } from "es-toolkit";
-import { errorMessage, log } from "./log.ts";
-import { ErrnoSchema } from "./types.ts";
-
-const STALE_MS = 60_000;
-const HEARTBEAT_MS = 5_000;
-const ATTEMPTS = 5;
-const RETRY_MS = 1_000;
-
-function tryAcquire(lockDir: string): boolean {
-  try {
-    mkdirSync(lockDir);
-    return true;
-  } catch (e) {
-    if (ErrnoSchema.safeParse(e).data?.code !== "EEXIST") throw e;
-  }
-  try {
-    if (Date.now() - statSync(lockDir).mtimeMs > STALE_MS) {
-      rmdirSync(lockDir);
-      mkdirSync(lockDir);
-      return true;
-    }
-  } catch {  }
-  return false;
-}
-
-export async function withClaudeRefreshLock<T>(
-  dir: string,
-  fn: (lock: { compromised: () => boolean }) => Promise<T> | T,
-  opts: { attempts?: number; retryMs?: number; heartbeatMs?: number } = {},
-): Promise<T> {
-  const attempts = opts.attempts ?? ATTEMPTS;
-  const retryMs = opts.retryMs ?? RETRY_MS;
-  mkdirSync(dir, { recursive: true });
-  const primary = join(dir, ".oauth_refresh.lock");
-  let legacyRoot = dir;
-  try { legacyRoot = realpathSync(dir); } catch {  }
-  const legacy = `${legacyRoot}.lock`;
-
-  const held: string[] = [];
-  for (let attempt = 1; held.length === 0; attempt++) {
-    if (tryAcquire(primary)) {
-      try {
-        if (tryAcquire(legacy)) {
-          held.push(legacy, primary);
-          break;
-        }
-      } catch (e) {
-        log("claudelock.legacy_error", { err: errorMessage(e) });
-        held.push(primary);
-        break;
-      }
-      rmdirSync(primary);
-    }
-    if (attempt >= attempts) {
-      log("claudelock.contested", { attempts: attempt });
-      throw new Error(
-        "claude's credential-refresh lock is contested (a token refresh is likely mid-flight) - not touching the credential store; retry shortly",
-      );
-    }
-    await delay(retryMs + Math.random() * retryMs);
-  }
-
-  const ours = new Map<string, number>();
-  for (const d of held) ours.set(d, statSync(d).mtimeMs);
-  let compromised = false;
-  const markCompromised = () => {
-    if (!compromised) {
-      compromised = true;
-      log("claudelock.compromised", {});
-    }
-  };
-  const heartbeat = setInterval(() => {
-    const now = new Date();
-    for (const d of held) {
-      try {
-        if (statSync(d).mtimeMs !== ours.get(d)) {
-          markCompromised();
-          continue;
-        }
-        utimesSync(d, now, now);
-        ours.set(d, statSync(d).mtimeMs);
-      } catch {
-        markCompromised();
-      }
-    }
-  }, opts.heartbeatMs ?? HEARTBEAT_MS);
-
-  try {
-    const result = await fn({ compromised: () => compromised });
-    if (compromised) {
-      throw new Error("claude's credential-refresh lock was reclaimed while held (this process stalled past the 60s stale bar) - treat this critical section as failed");
-    }
-    return result;
-  } finally {
-    clearInterval(heartbeat);
-    for (const d of held) {
-      try {
-        if (statSync(d).mtimeMs === ours.get(d)) rmdirSync(d);
-      } catch {  }
-    }
-  }
-}