tokenmaxxing 1.76.0 → 1.78.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.76.0",
+  "version": "1.78.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts, start each session on its own account, and resume a session on a fresher account when quota fills.",
   "type": "module",
   "license": "MIT",

package/src/cli/doctor.ts

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync } from "node:fs";
-import { verifyRealClaude } from "../lib/claudebin.ts";
+import { CLAUDE_BIN, verifyRealBin } from "../lib/claudebin.ts";
 import { checkSettings, installedBin } from "../lib/settings.ts";
 import { checkTimerHealthy, codexStoreHookTrust, findClaudeShadowers, hubServiceHealthy, isBinDirAhead, shellRcPath, skipImperativeHub, timerActivationHint } from "../lib/install.ts";
 import { errorMessage } from "../lib/log.ts";
@@ -95,7 +95,7 @@ export async function cmdDoctor(): Promise<number> {
   const cfg = loadConfig();
   check(!!cfg.claudeBin && existsSync(cfg.claudeBin), "real claude binary resolved", "set claudeBin in config.json");
   if (cfg.claudeBin && existsSync(cfg.claudeBin)) {
-    const fail = verifyRealClaude(cfg.claudeBin);
+    const fail = verifyRealBin({ ...CLAUDE_BIN, bin: cfg.claudeBin });
     check(fail === null, "claudeBin launches the real claude", fail ?? undefined);
   }
 

package/src/entries/codexstophook.ts

@@ -2,9 +2,8 @@ import { join } from "node:path";
 import type { z } from "zod";
 import { codexPaths, optionalEnv } from "../lib/paths.ts";
 import { writeFileAtomic } from "../lib/atomic.ts";
-import { MAX_WRAP_DEPTH, WRAP_DEPTH_ENV } from "../lib/claudebin.ts";
+import { CODEX_BIN, MAX_WRAP_DEPTH, WRAP_DEPTH_ENV, resolveRealBin } from "../lib/claudebin.ts";
 import { codex, codexPickCtx } from "../lib/codex.ts";
-import { resolveRealCodex } from "../lib/codexbin.ts";
 import { compactCodexThread } from "../lib/compact.ts";
 import { evaluateAndMaybeSwap } from "../lib/decide.ts";
 import { isExhausted } from "../lib/picker.ts";
@@ -26,7 +25,7 @@ async function compactBeforeMove(input: { sessionId: string | null; now: number
   const env: Record<string, string | undefined> = { ...process.env, TOKENMAXXING_PROBE: "1", [WRAP_DEPTH_ENV]: String(MAX_WRAP_DEPTH) };
   delete env[CODEX_SUPERVISOR_ID_ENV];
   log("codexstop.compact_start", { thread: sessionId.slice(0, 8), account: live.id.slice(0, 8) });
-  await compactCodexThread({ real: resolveRealCodex(), threadId: sessionId, env });
+  await compactCodexThread({ real: resolveRealBin(CODEX_BIN), threadId: sessionId, env });
 }
 
 async function handleCodexStop(rawStdin: string): Promise<void> {

package/src/entries/codexsupervisor.ts

@@ -3,8 +3,7 @@ import { join } from "node:path";
 import { z } from "zod";
 import { codexPaths, codexPool } from "../lib/paths.ts";
 import { withLock } from "../lib/lock.ts";
-import { UNMANAGED_ENV, WRAP_DEPTH_ENV, wrapDepth } from "../lib/claudebin.ts";
-import { resolveRealCodex } from "../lib/codexbin.ts";
+import { CODEX_BIN, UNMANAGED_ENV, WRAP_DEPTH_ENV, resolveRealBin, wrapDepth } from "../lib/claudebin.ts";
 import { codexStoreUsable, ensureCodexStoreHome } from "../lib/codexauth.ts";
 import { codexPickCtx, pickCodexSeat } from "../lib/codex.ts";
 import { clearPresence, livingPresences } from "../lib/presence.ts";
@@ -74,7 +73,7 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
   const { argv } = input;
   if (loopGuardTripped("codex")) return 1;
 
-  const real = resolveRealCodex();
+  const real = resolveRealBin(CODEX_BIN);
   const childEnv = { ...process.env, [WRAP_DEPTH_ENV]: String(wrapDepth() + 1) };
 
   if (!shouldManageCodex({ argv }) || process.env[UNMANAGED_ENV]) {

package/src/entries/supervisor.ts

@@ -4,7 +4,7 @@ import type { FileSink, Subprocess } from "bun";
 import { maxBy } from "es-toolkit";
 import { z } from "zod";
 import { claudePool, paths, storeDirFor } from "../lib/paths.ts";
-import { UNMANAGED_ENV, WRAP_DEPTH_ENV, resolveRealClaude, wrapDepth } from "../lib/claudebin.ts";
+import { CLAUDE_BIN, UNMANAGED_ENV, WRAP_DEPTH_ENV, resolveRealBin, wrapDepth } from "../lib/claudebin.ts";
 import { claude, pickSeat } from "../lib/claude.ts";
 import { compactClaudeSession } from "../lib/compact.ts";
 import { evaluateAndMaybeSwap } from "../lib/decide.ts";
@@ -353,7 +353,7 @@ export async function runSupervisor(argv: string[]): Promise<number> {
   }
   let real: string;
   try {
-    real = resolveRealClaude();
+    real = resolveRealBin(CLAUDE_BIN);
   } catch (e) {
     if (!earlyStream) throw e;
     process.stdout.write(systemLine(earlySid, `tokenmaxxing: ${errorMessage(e)}`));

package/src/lib/claude.ts

@@ -2,7 +2,7 @@ import { mkdirSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { readItem, writeItem, deleteItem, isolatedTarget, readStore, storeTarget, claudeAiOauthOnly } from "./credstore.ts";
-import { resolveRealClaude, resolveVerifiedClaude } from "./claudebin.ts";
+import { CLAUDE_BIN, resolveRealBin, resolveVerifiedClaude } from "./claudebin.ts";
 import { ensurePathInRc, hubActivationHint, installSupervisor, managedShellRcSkipLines, shellRcPath, timerActivationHint } from "./install.ts";
 import { withLock } from "./lock.ts";
 import { errorMessage, log } from "./log.ts";
@@ -151,7 +151,7 @@ async function login(): Promise<Harvest | null> {
   const iso = isolatedTarget(onboardDir);
   await deleteItem(iso);
   const cjPath = join(onboardDir, ".claude.json");
-  const real = resolveRealClaude();
+  const real = resolveRealBin(CLAUDE_BIN);
 
   const savedTermios = saveTermios();
   const env = scrubCredentialEnv({ ...process.env, CLAUDE_CONFIG_DIR: onboardDir, TOKENMAXXING_PROBE: "1", TOKENMAXXING_SUPERVISED: "" });

package/src/lib/claudebin.ts

@@ -4,7 +4,7 @@ import { uniq } from "es-toolkit";
 import { z } from "zod";
 import { errorMessage } from "./log.ts";
 import { paths } from "./paths.ts";
-import { loadConfig } from "./state.ts";
+import { loadConfig, type BinKey } from "./state.ts";
 import { writeFileAtomic } from "./atomic.ts";
 
 export const WRAP_DEPTH_ENV = "TOKENMAXXING_WRAP_DEPTH";
@@ -49,75 +49,70 @@ export function pointsBackAtUs(bin: string): boolean {
   return resolved != null && binDir != null && dirname(resolved) === binDir;
 }
 
-function scanPathForClaudeCandidates(): string[] {
+function scanPathCandidates(name: string): string[] {
   const seen = new Set<string>();
   const out: string[] = [];
   for (const d of (process.env.PATH ?? "").split(":")) {
     if (!d) continue;
-    const cand = join(d, "claude");
-    try {
-      if (existsSync(cand) && statSync(cand).isFile() && !pointsBackAtUs(cand)) {
-        const key = realpathOrNull(cand) ?? cand;
-        if (!seen.has(key)) {
-          seen.add(key);
-          out.push(cand);
-        }
-      }
-    } catch {  }
+    const cand = join(d, name);
+    if (!existsSync(cand) || !statSync(cand, { throwIfNoEntry: false })?.isFile() || pointsBackAtUs(cand)) continue;
+    const key = realpathOrNull(cand) ?? cand;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(cand);
   }
   return out;
 }
 
-export function scanPathForClaude(): string | null {
-  return scanPathForClaudeCandidates()[0] ?? null;
-}
-
-export function resolveRealClaude(): string {
-  const cfg = loadConfig();
-  if (cfg.claudeBin) {
-    if (!existsSync(cfg.claudeBin)) {
-      throw new Error(`configured claudeBin does not exist: ${cfg.claudeBin} - fix config.json`);
+export function resolveRealBin(input: { name: string; key: BinKey }): string {
+  const configured = loadConfig()[input.key];
+  if (configured) {
+    if (!existsSync(configured)) {
+      throw new Error(`configured ${input.key} does not exist: ${configured} - fix config.json`);
     }
-    if (pointsBackAtUs(cfg.claudeBin)) {
+    if (pointsBackAtUs(configured)) {
       throw new Error(
-        `configured claudeBin (${cfg.claudeBin}) is tokenmaxxing's own wrapper - spawning it recurses. Point claudeBin at the real claude binary in ${paths.configJson}`,
+        `configured ${input.key} (${configured}) is tokenmaxxing's own wrapper - spawning it recurses. Point ${input.key} at the real ${input.name} binary in ${paths.configJson}`,
       );
     }
-    return cfg.claudeBin;
+    return configured;
   }
-  const scanned = scanPathForClaude();
+  const scanned = scanPathCandidates(input.name)[0];
   if (scanned) return scanned;
-  throw new Error("could not locate the real `claude` binary (set claudeBin in config.json)");
+  throw new Error(`could not locate the real \`${input.name}\` binary (set ${input.key} in config.json)`);
 }
 
-export function verifyRealClaude(bin: string): string | null {
+export function verifyRealBin(input: { bin: string; name: string; versionOk: (versionOutput: string) => boolean }): string | null {
   const env = { ...process.env, [WRAP_DEPTH_ENV]: String(MAX_WRAP_DEPTH), TOKENMAXXING_PROBE: "1" };
   let p;
   try {
-    p = Bun.spawnSync([bin, "--version"], { env, stdout: "pipe", stderr: "pipe", timeout: 15_000, killSignal: "SIGKILL" });
+    p = Bun.spawnSync([input.bin, "--version"], { env, stdout: "pipe", stderr: "pipe", timeout: 15_000, killSignal: "SIGKILL" });
   } catch (e) {
     return errorMessage(e);
   }
   const outText = p.stdout.toString().trim();
   const err = p.stderr.toString().trim();
   if (p.exitCode === 0) {
-    if (/claude/i.test(outText)) return null;
-    return `--version output does not identify claude: "${outText.slice(0, 80)}"`;
+    if (input.versionOk(outText)) return null;
+    return `--version output does not identify ${input.name}: "${outText.slice(0, 80)}"`;
   }
   if (err.includes(LOOP_DIAGNOSIS)) return "it leads back into the tokenmaxxing wrapper (recursion)";
   return `--version exited ${p.exitCode ?? "on signal/timeout"}: ${(err || outText).slice(0, 160)}`;
 }
 
+export const CLAUDE_BIN = { name: "claude", key: "claudeBin", versionOk: (out: string) => out.toLowerCase().includes("claude") } as const;
+export const CODEX_BIN = { name: "codex", key: "codexBin", versionOk: (out: string) => out.toLowerCase().includes("codex") } as const;
+
 export function resolveVerifiedClaude(): string {
   const candidates: string[] = [];
   try {
-    candidates.push(resolveRealClaude());
+    candidates.push(resolveRealBin(CLAUDE_BIN));
   } catch {  }
-  candidates.push(...scanPathForClaudeCandidates());
+  candidates.push(...scanPathCandidates(CLAUDE_BIN.name));
 
   const failures: string[] = [];
   for (const cand of uniq(candidates)) {
-    const fail = verifyRealClaude(cand);
+    const fail = verifyRealBin({ ...CLAUDE_BIN, bin: cand });
     if (fail === null) return cand;
     failures.push(`${cand}: ${fail}`);
   }

package/src/lib/codex.ts

@@ -1,9 +1,8 @@
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { writeFileAtomic } from "./atomic.ts";
-import { MAX_WRAP_DEPTH, WRAP_DEPTH_ENV } from "./claudebin.ts";
+import { CODEX_BIN, MAX_WRAP_DEPTH, WRAP_DEPTH_ENV, resolveRealBin, verifyRealBin } from "./claudebin.ts";
 import { codexIdentityOf, codexStoreUsable, deleteCodexStoreAuth, isCodexAccessExpiring, readCodexAuthAt, readCodexStoreAuth, writeCodexStoreAuth } from "./codexauth.ts";
-import { resolveRealCodex, verifyRealCodex } from "./codexbin.ts";
 import { CodexInvalidGrantError, CodexRefreshFailedError, refreshCodexAuth } from "./codexoauth.ts";
 import { seatCounts } from "./presence.ts";
 import { CodexUsageReadError, codexLimitLabel, fetchCodexUsage } from "./codexusage.ts";
@@ -113,7 +112,7 @@ async function prepareMove(target: Account): Promise<void> {
 }
 
 async function login(): Promise<Harvest | null> {
-  const real = resolveRealCodex();
+  const real = resolveRealBin(CODEX_BIN);
   const onboardDir = codexPaths.onboardDir;
   rmSync(onboardDir, { recursive: true, force: true });
   writeFileAtomic(join(onboardDir, "config.toml"), 'cli_auth_credentials_store = "file"\n');
@@ -179,8 +178,8 @@ function storePinnedAwayFromFile(): boolean {
 }
 
 function preflight(): void {
-  const real = resolveRealCodex();
-  const fail = verifyRealCodex({ bin: real });
+  const real = resolveRealBin(CODEX_BIN);
+  const fail = verifyRealBin({ ...CODEX_BIN, bin: real });
   if (fail !== null) throw new Error(`codex binary failed verification: ${real}: ${fail}`);
   pinBinOverride({ key: "codexBin", bin: real });
   if (storePinnedAwayFromFile()) {

package/src/lib/grok.ts

@@ -2,13 +2,13 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { writeFileAtomic } from "./atomic.ts";
-import { fetchGrokUsage, GrokUsageReadError } from "./grokusage.ts";
+import { fetchGrokUsage, GrokUsageReadError, type GrokUsage } from "./grokusage.ts";
 import { errorMessage } from "./log.ts";
 import { grokAuthJsonFor, grokPaths, grokPool, grokSeatFromEnv, grokStoreDirFor } from "./paths.ts";
 import type { Provider, SampleReport } from "./provider.ts";
 import { loadAccounts, type Harvest } from "./state.ts";
 import { statusOnlyProvider, type AuthEntry } from "./statusonly.ts";
-import type { Account } from "./types.ts";
+import { InstantSchema, type Account } from "./types.ts";
 import { c } from "../cli/render.ts";
 
 const GrokAuthEntrySchema = z.looseObject({
@@ -69,8 +69,7 @@ function credsIn(path: string): GrokCred[] {
     const id = entry.user_id ?? entry.principal_id ?? key;
     const token = entry.key ?? "";
     if (id === "" || token === "") continue;
-    const expiresAt = entry.expires_at != null ? Date.parse(entry.expires_at) : null;
-    out.push({ id, token, expiresAt: expiresAt != null && Number.isFinite(expiresAt) ? expiresAt : null });
+    out.push({ id, token, expiresAt: InstantSchema.safeParse(entry.expires_at).data ?? null });
   }
   return out;
 }
@@ -91,27 +90,21 @@ function bearerFor(accountId: string, now: number): { token: string; from: "stor
 async function readGrokUsage(account: Account, now: number): Promise<{ ok: true; at: number } | { ok: false; reason: string }> {
   const first = bearerFor(account.id, now);
   if (first == null) return { ok: false, reason: "no usable credential in this account's store - run `tokenmaxxing auth --grok`" };
+  let usage: GrokUsage;
   try {
-    const usage = await fetchGrokUsage({ token: first.token, at: now });
-    account.windows = usage.windows;
-    account.lastUsageAt = usage.at;
-    return { ok: true, at: usage.at };
+    usage = await fetchGrokUsage({ token: first.token, at: now });
   } catch (e) {
-    if (e instanceof GrokUsageReadError && e.status === 401 && first.from === "store") {
-      const live = liveCred(account.id);
-      if (live != null && live.token !== first.token) {
-        try {
-          const usage = await fetchGrokUsage({ token: live.token, at: now });
-          account.windows = usage.windows;
-          account.lastUsageAt = usage.at;
-          return { ok: true, at: usage.at };
-        } catch (retry) {
-          return { ok: false, reason: retry instanceof GrokUsageReadError ? retry.message : errorMessage(retry) };
-        }
-      }
+    const live = e instanceof GrokUsageReadError && e.status === 401 && first.from === "store" ? liveCred(account.id) : null;
+    if (live == null || live.token === first.token) return { ok: false, reason: errorMessage(e) };
+    try {
+      usage = await fetchGrokUsage({ token: live.token, at: now });
+    } catch (retry) {
+      return { ok: false, reason: errorMessage(retry) };
     }
-    return { ok: false, reason: e instanceof GrokUsageReadError ? e.message : errorMessage(e) };
   }
+  account.windows = usage.windows;
+  account.lastUsageAt = usage.at;
+  return { ok: true, at: usage.at };
 }
 
 async function samplePool(accounts: Account[], _liveId: string | null, now: number): Promise<Map<string, SampleReport>> {
@@ -140,7 +133,7 @@ const base = statusOnlyProvider({
   liveAuthPath: () => join(grokPaths.home, "auth.json"),
   readAuth,
   liveId: () => grokSeatFromEnv(loadAccounts(grokPool).accounts.map((a) => a.id)),
-  versionOk: (out) => out.trim().toLowerCase().includes("grok"),
+  versionOk: (out) => out.toLowerCase().includes("grok"),
   importIntro: "Opening an isolated grok login for your first pooled account - the login you already have stays as it is.",
   foundLive: (count) => `found ${count} grok login(s) in ${grokPaths.home} - pooling the first; use \`tokenmaxxing add --grok\` for the rest.`,
   installNotice: "grok pool is status-only: no supervisor or hooks installed. Use `tokenmaxxing status` to view pooled grok accounts.",

package/src/lib/grokusage.ts

@@ -2,7 +2,7 @@ import { z } from "zod";
 import { http, safeErrorDetail } from "./http.ts";
 import { errorMessage } from "./log.ts";
 import { env } from "./paths.ts";
-import { JsonTextSchema, type Window } from "./types.ts";
+import { InstantSchema, JsonTextSchema, type Window } from "./types.ts";
 
 export class GrokUsageReadError extends Error {
   status: number | null;
@@ -13,8 +13,6 @@ export class GrokUsageReadError extends Error {
   }
 }
 
-const InstantSchema = z.iso.datetime({ offset: true });
-
 const CreditsPeriodSchema = z.looseObject({
   start: InstantSchema,
   end: InstantSchema,
@@ -57,17 +55,15 @@ export async function fetchGrokUsage(input: { token: string; at: number }): Prom
   if (!parsed.success) {
     throw new GrokUsageReadError("endpoint returned an unexpected body shape (withheld)");
   }
-  const period = parsed.data.config.currentPeriod;
-  const start = Date.parse(period.start);
-  const end = Date.parse(period.end);
+  const { start, end } = parsed.data.config.currentPeriod;
   return {
     at,
     windows: [
       {
         name: null,
         usedPercentage: parsed.data.config.creditUsagePercent,
-        resetsAt: Number.isFinite(end) ? end : null,
-        windowSeconds: Number.isFinite(start) && Number.isFinite(end) && end > start ? Math.round((end - start) / 1000) : null,
+        resetsAt: end,
+        windowSeconds: end > start ? Math.round((end - start) / 1000) : null,
         sampledAt: at,
       },
     ],

package/src/lib/install.ts

@@ -6,7 +6,7 @@ import { z } from "zod";
 import { codexPaths, codexStoreDirFor, HOME, optionalEnv, paths } from "./paths.ts";
 import { writeFileAtomic } from "./atomic.ts";
 import { installedBin, installSettings, isOurHookCommand, uninstallSettings } from "./settings.ts";
-import { resolveRealClaude } from "./claudebin.ts";
+import { CLAUDE_BIN, resolveRealBin } from "./claudebin.ts";
 import { loadConfig } from "./state.ts";
 import { ErrnoSchema } from "./types.ts";
 
@@ -17,7 +17,7 @@ export function isBinDirAhead(): boolean {
   const ourIdx = dirs.indexOf(paths.binDir);
   if (ourIdx < 0) return false;
   try {
-    const realDir = dirname(resolveRealClaude());
+    const realDir = dirname(resolveRealBin(CLAUDE_BIN));
     const realIdx = dirs.indexOf(realDir);
     return realIdx < 0 || ourIdx < realIdx;
   } catch {

package/src/lib/opencodego.ts

@@ -63,7 +63,7 @@ export const opencodeGo: Provider = statusOnlyProvider({
   liveAuthPath,
   readAuth,
   liveId: () => null,
-  versionOk: (out) => out.trim() !== "",
+  versionOk: (out) => out !== "",
   importIntro: "Pooling your opencode-go API key - your existing opencode auth stays as it is.",
   foundLive: () => `found an opencode-go credential in ${liveAuthPath()} - pooling it; use \`tokenmaxxing add --opencode-go\` for more keys.`,
   installNotice: "opencode-go pool is status-only: no supervisor or hooks installed. Use `tokenmaxxing status` to view pooled keys.",

package/src/lib/state.ts

@@ -39,7 +39,9 @@ export function loadConfig(): Config {
   return cfg;
 }
 
-export function pinBinOverride(input: { key: "claudeBin" | "codexBin" | "grokBin" | "opencodeBin"; bin: string }): void {
+export type BinKey = "claudeBin" | "codexBin" | "grokBin" | "opencodeBin";
+
+export function pinBinOverride(input: { key: BinKey; bin: string }): void {
   let raw: Record<string, unknown> = {};
   if (existsSync(paths.configJson)) {
     raw = z.record(z.string(), z.unknown()).parse(JSON.parse(readFileSync(paths.configJson, "utf8")));

package/src/lib/statusonly.ts

@@ -1,8 +1,9 @@
-import { existsSync, mkdirSync, rmSync } from "node:fs";
+import { mkdirSync, rmSync } from "node:fs";
 import { join } from "node:path";
+import { resolveRealBin, verifyRealBin } from "./claudebin.ts";
 import type { PoolPaths } from "./paths.ts";
 import type { Provider, SampleReport } from "./provider.ts";
-import { loadConfig, pinBinOverride, type Harvest } from "./state.ts";
+import { pinBinOverride, type Harvest } from "./state.ts";
 import type { Account } from "./types.ts";
 import { c } from "../cli/render.ts";
 
@@ -31,23 +32,7 @@ export type StatusOnlySpec = {
 };
 
 export function statusOnlyProvider(spec: StatusOnlySpec): Provider {
-  function resolveBin(): string {
-    const configured = loadConfig()[spec.binKey];
-    if (configured) {
-      if (!existsSync(configured)) throw new Error(`configured ${spec.binKey} does not exist: ${configured} - fix config.json`);
-      return configured;
-    }
-    for (const d of (process.env.PATH ?? "").split(":")) {
-      if (!d) continue;
-      const cand = join(d, spec.binName);
-      try {
-        if (existsSync(cand)) return cand;
-      } catch {
-        continue;
-      }
-    }
-    throw new Error(`could not locate the real \`${spec.binName}\` binary (set ${spec.binKey} in config.json)`);
-  }
+  const bin = { name: spec.binName, key: spec.binKey, versionOk: spec.versionOk };
 
   async function storeUsable(a: Account): Promise<boolean> {
     try {
@@ -66,7 +51,7 @@ export function statusOnlyProvider(spec: StatusOnlySpec): Provider {
   }
 
   async function login(): Promise<Harvest | null> {
-    const real = resolveBin();
+    const real = resolveRealBin(bin);
     const onboardDir = spec.onboardDir;
     rmSync(onboardDir, { recursive: true, force: true });
     mkdirSync(onboardDir, { recursive: true });
@@ -102,11 +87,9 @@ export function statusOnlyProvider(spec: StatusOnlySpec): Provider {
   }
 
   function preflight(): void {
-    const real = resolveBin();
-    const p = Bun.spawnSync([real, "--version"], { stdout: "pipe", stderr: "pipe", timeout: 15_000 });
-    if (p.exitCode !== 0 || !spec.versionOk(p.stdout.toString())) {
-      throw new Error(`${spec.binName} binary failed verification: ${real}`);
-    }
+    const real = resolveRealBin(bin);
+    const fail = verifyRealBin({ ...bin, bin: real });
+    if (fail !== null) throw new Error(`${spec.binName} binary failed verification: ${real}: ${fail}`);
     pinBinOverride({ key: spec.binKey, bin: real });
   }
 

package/src/lib/types.ts

@@ -152,6 +152,8 @@ export const RespawnMarkerSchema = z.object({
 
 export const EpochSecondsSchema = z.number().transform((seconds) => seconds * 1000);
 
+export const InstantSchema = z.iso.datetime({ offset: true }).transform((iso) => Date.parse(iso));
+
 const StdinWindowSchema = z.looseObject({ used_percentage: z.number(), resets_at: EpochSecondsSchema.nullable().optional() });
 
 export const RateLimitsStdinSchema = z.looseObject({

package/src/lib/usage.ts

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { http } from "./http.ts";
 import { errorMessage, log } from "./log.ts";
 import { env } from "./paths.ts";
-import { EpochSecondsSchema, JsonTextSchema, RateLimitsStdinSchema, type ModelInfo, type UsageWindow, type UsageWindows, type Window } from "./types.ts";
+import { EpochSecondsSchema, InstantSchema, JsonTextSchema, RateLimitsStdinSchema, type ModelInfo, type UsageWindow, type UsageWindows, type Window } from "./types.ts";
 
 const win = (w: { used_percentage: number; resets_at?: number | null }): UsageWindow => ({
   usedPercentage: w.used_percentage,
@@ -185,7 +185,7 @@ export const OAUTH_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 const USAGE_URL = env("TOKENMAXXING_OAUTH_USAGE_URL", OAUTH_USAGE_URL);
 const USAGE_DEADLINE_MS = 10_000;
 
-const ResetsAtSchema = z.iso.datetime({ offset: true }).transform((iso) => Date.parse(iso)).nullish();
+const ResetsAtSchema = InstantSchema.nullish();
 const UsageLimitSchema = z.looseObject({ utilization: z.number(), resets_at: ResetsAtSchema });
 const UsageScopedLimitSchema = z.looseObject({
   kind: z.string(),

package/src/lib/codexbin.ts

@@ -1,55 +0,0 @@
-import { existsSync, statSync } from "node:fs";
-import { join } from "node:path";
-import { LOOP_DIAGNOSIS, MAX_WRAP_DEPTH, WRAP_DEPTH_ENV, pointsBackAtUs } from "./claudebin.ts";
-import { errorMessage } from "./log.ts";
-import { loadConfig } from "./state.ts";
-import { paths } from "./paths.ts";
-
-function scanPathForCodex(): string | null {
-  for (const d of (process.env.PATH ?? "").split(":")) {
-    if (!d) continue;
-    const cand = join(d, "codex");
-    try {
-      if (existsSync(cand) && statSync(cand).isFile() && !pointsBackAtUs(cand)) return cand;
-    } catch {
-      continue;
-    }
-  }
-  return null;
-}
-
-export function resolveRealCodex(): string {
-  const cfg = loadConfig();
-  if (cfg.codexBin) {
-    if (!existsSync(cfg.codexBin)) {
-      throw new Error(`configured codexBin does not exist: ${cfg.codexBin} - fix config.json`);
-    }
-    if (pointsBackAtUs(cfg.codexBin)) {
-      throw new Error(
-        `configured codexBin (${cfg.codexBin}) is tokenmaxxing's own wrapper - spawning it recurses. Point codexBin at the real codex binary in ${paths.configJson}`,
-      );
-    }
-    return cfg.codexBin;
-  }
-  const scanned = scanPathForCodex();
-  if (scanned) return scanned;
-  throw new Error("could not locate the real `codex` binary (set codexBin in config.json)");
-}
-
-export function verifyRealCodex(input: { bin: string }): string | null {
-  const env = { ...process.env, [WRAP_DEPTH_ENV]: String(MAX_WRAP_DEPTH), TOKENMAXXING_PROBE: "1" };
-  let p;
-  try {
-    p = Bun.spawnSync([input.bin, "--version"], { env, stdout: "pipe", stderr: "pipe", timeout: 15_000, killSignal: "SIGKILL" });
-  } catch (e) {
-    return errorMessage(e);
-  }
-  const outText = p.stdout.toString().trim();
-  const err = p.stderr.toString().trim();
-  if (p.exitCode === 0) {
-    if (outText.toLowerCase().includes("codex")) return null;
-    return `--version output does not identify codex: "${outText.slice(0, 80)}"`;
-  }
-  if (err.includes(LOOP_DIAGNOSIS)) return "it leads back into the tokenmaxxing wrapper (recursion)";
-  return `--version exited ${p.exitCode ?? "on signal/timeout"}: ${(err || outText).slice(0, 160)}`;
-}