tokenmaxxing 1.8.0 → 1.9.1

package/src/lib/codexsample.ts

@@ -1,13 +1,3 @@
-// Per-account codex usage sampling for status/ls. The ACTIVE account (the live
-// auth.json's own identity, never the possibly-drifted label) samples through
-// the LIVE blob: its parked copy goes stale as the running codex rotates
-// tokens, and refreshing a superseded parked refresh token would trip the
-// server's reuse punishment and kill the grant family. Parked accounts sample
-// through their parked blobs (their owners are not running, so rotation on
-// refresh is safe) and every rotation is persisted back immediately.
-//
-// Caller holds the codex flock: refresh writes must not interleave with a swap.
-
 import { codexIdentityOf, isCodexAccessExpiring, readLiveCodexAuth, readParkedCodexAuth, writeLiveCodexAuth, writeParkedCodexAuth } from "./codexauth.ts";
 import { CodexInvalidGrantError, CodexRefreshFailedError, refreshCodexAuth } from "./codexoauth.ts";
 import { CodexUsageReadError, fetchCodexUsage } from "./codexusage.ts";
@@ -21,7 +11,6 @@ const CodexSampleOutcomeSchema = z.union([
 ]);
 export type CodexSampleOutcome = z.infer<typeof CodexSampleOutcomeSchema>;
 
-/** The live credential's own account id, or null when absent/unreadable. */
 export function liveCodexAccountId(): string | null {
   const live = readLiveCodexAuth();
   if (!live) return null;
@@ -35,16 +24,6 @@ export async function sampleCodexAccount(input: { account: CodexAccount; liveAcc
     let auth = isLive ? readLiveCodexAuth() : readParkedCodexAuth({ credFile: account.credFile });
     if (!auth) return { ok: false, reason: isLive ? "live auth.json vanished" : "no parked credential", deadGrant: false };
     if (isCodexAccessExpiring({ auth, now })) {
-      // NEVER refresh a PRESENT account's token, live or parked. A parked
-      // blob whose account is RUNNING in another supervised session is
-      // superseded by that session's live rotations, and the LIVE blob's
-      // running session can be mid-turn refreshing the same rotating token
-      // concurrently (both actors share the 300s margin): either way the
-      // loser of the race is reuse-punished into a dead grant family
-      // (closing-review catch; the idle-turn-boundary safety argument covers
-      // only the invoking session's own account). Parked reports a miss; live
-      // fetches on the unrotated token, still valid within the margin, and
-      // degrades to an honest miss once it expires.
       const running = presentCodexAccountIds().has(account.accountId);
       if (running && !isLive) {
         return { ok: false, reason: "running in a live codex session (parked token refresh unsafe)", deadGrant: false };
@@ -58,8 +37,6 @@ export async function sampleCodexAccount(input: { account: CodexAccount; liveAcc
     const usage = await fetchCodexUsage({ auth });
     return { ok: true, usage };
   } catch (e) {
-    // Only the EXPECTED operational failures become a sample miss; parse and
-    // filesystem errors keep propagating (they are drift or bugs to surface).
     if (e instanceof CodexInvalidGrantError) {
       return { ok: false, reason: e.message, deadGrant: true };
     }

package/src/lib/codexstate.ts

@@ -1,10 +1,3 @@
-// codex-accounts.json + codex-lastswap.json persistence. Parallel to the
-// claude files in state.ts, deliberately a separate file pair: claude and
-// codex accounts have different shapes and swap independently, so neither
-// index can clobber the other. Absent files are the empty state; a file that
-// exists but fails to parse THROWS (a fabricated empty pool would silently
-// orphan parked credentials).
-
 import { existsSync, readFileSync } from "node:fs";
 import { writeFileAtomic } from "./atomic.ts";
 import { codexPaths } from "./paths.ts";

package/src/lib/codexswap.ts

@@ -1,19 +1,3 @@
-// The codex account-switch sequence. Runs under tokenmaxxing's codex flock
-// (held by the caller). Codex itself has NO cross-process lock on auth.json
-// (verified rust-v0.144.5: refresh serialization is an in-process semaphore),
-// so this flock only serializes tokenmaxxing actors; a RUNNING codex can still
-// refresh-write the live file concurrently. The sequence therefore keeps the
-// harvest-install window as short as possible, and the Stop-hook trigger fires
-// only at an idle turn boundary where the running codex has just finished
-// using (and refreshing, if needed) its token.
-//
-//   refresh target's parked blob (network, validates the grant, rotates)
-//   harvest live auth.json verbatim under its OWN identity (labels drift,
-//     the id_token cannot lie; an unknown live identity refuses the swap)
-//   install the refreshed target as the whole live auth.json
-//   persist the rotation into the target's parked blob
-//   commit activeAccountId in the same critical section
-
 import { codexIdentityOf, readLiveCodexAuth, readParkedCodexAuth, writeLiveCodexAuth, writeParkedCodexAuth } from "./codexauth.ts";
 import { CodexInvalidGrantError, refreshCodexAuth } from "./codexoauth.ts";
 import { loadCodexAccounts, saveCodexAccounts, saveCodexLastSwapAt } from "./codexstate.ts";
@@ -27,18 +11,10 @@ export async function performCodexSwap(input: { target: CodexAccount }): Promise
   const parked = readParkedCodexAuth({ credFile: target.credFile });
   if (!parked) throw new Error(`no parked codex credential for ${target.label}`);
 
-  // Resolve the live credential's owner BEFORE touching the network: a refused
-  // swap must refuse with the target's parked token still valid. The refresh
-  // rotates it server-side, and codex punishes reuse of the superseded one, so
-  // rotating first and then throwing would kill the target's grant family
-  // (adversarial review catch, 2026-07-16).
   const live = readLiveCodexAuth();
   let liveOwner = null;
   if (live) {
     const liveIdentity = codexIdentityOf({ auth: live });
-    // Backstop against a drifted caller: installing the LIVE account over
-    // itself would refresh its superseded parked token (reuse punishment kills
-    // the grant family) and rotate the token out from under a running session.
     if (liveIdentity.accountId === target.accountId) {
       throw new Error(
         `${target.label} is already the live codex credential - refusing to swap an account onto itself`,
@@ -72,17 +48,9 @@ export async function performCodexSwap(input: { target: CodexAccount }): Promise
     }
     throw e;
   }
-  // The rotation exists server-side from this instant: persist it before ANY
-  // later step can fail, or a crash strands the parked file on the superseded
-  // (reuse-punished) refresh token.
   writeParkedCodexAuth({ credFile: target.credFile, auth: fresh });
 
   if (live && liveOwner) {
-    // Last-moment re-read: a running codex (the Apps surface) can rotate the
-    // live token outside our flock between the identity resolution above and
-    // this harvest, and parking the earlier snapshot would strand the newest
-    // rotation of a reuse-punished grant family. A mid-swap identity change
-    // refuses rather than harvesting under a stale owner.
     const liveNow = readLiveCodexAuth();
     if (!liveNow || codexIdentityOf({ auth: liveNow }).accountId !== liveOwner.accountId) {
       throw new Error("live codex credential changed mid-swap - refusing to harvest under a stale identity; retry");

package/src/lib/codexusage.ts

@@ -1,15 +1,3 @@
-// The free codex usage read (user decision 2026-07-16: the direct GET, the same
-// HTTP call the codex CLI makes for its own /status). One authed GET returns
-// BOTH the token's true identity (account_id/email/plan: the codex analog of
-// the claude roles endpoint) and every rate-limit window. No inference runs and
-// no session window starts.
-//
-// Response shape pinned against a live read 2026-07-16: windows carry
-// used_percent + reset_at (epoch SECONDS) + limit_window_seconds, the weekly
-// window is PRIMARY on plans whose 5h window was removed (July 2026), and
-// per-model caps arrive as additional_rate_limits[] rows keyed by limit_name.
-// Classification is therefore duration-driven, never position-driven.
-
 import { z } from "zod";
 import { http, safeErrorDetail } from "./http.ts";
 import { CodexUsageSchema, type CodexAuthJson, type CodexUsage, type CodexWindow } from "./types.ts";
@@ -19,9 +7,6 @@ import { familyTokens } from "./usage.ts";
 const EnvOverrideSchema = z.string().min(1).optional().catch(undefined);
 const USAGE_URL = EnvOverrideSchema.parse(process.env.TOKENMAXXING_CODEX_USAGE_URL) ?? "https://chatgpt.com/backend-api/wham/usage";
 
-/** The usage read could not complete (endpoint unreachable, HTTP failure,
- *  drifted body): an operational miss to fall back on cached figures for,
- *  NOT a bug to swallow. */
 export class CodexUsageReadError extends Error {
   constructor(detail: string) {
     super(`codex usage read failed: ${detail}`);
@@ -63,11 +48,6 @@ function toWindows(rateLimit: z.infer<typeof WireRateLimitSchema> | null | undef
   return out;
 }
 
-/**
- * One free usage read for the credential in `auth`. Throws on HTTP failure
- * (401 included: the caller decides whether to refresh and retry); error
- * text carries only a response-body snippet, never request headers.
- */
 export async function fetchCodexUsage(input: { auth: CodexAuthJson }): Promise<CodexUsage> {
   const { auth } = input;
   const identity = codexIdentityOf({ auth });
@@ -115,26 +95,21 @@ export async function fetchCodexUsage(input: { auth: CodexAuthJson }): Promise<C
   });
 }
 
-/** Quota-chart label for an additional_rate_limits row: the model family,
- *  lowercase ("GPT-5.3-Codex-Spark" -> "spark"). Wire names are versioned, so
- *  the label is derived structurally (last non-numeric token), never by exact
- *  string (user rule 2026-07-17: chart names are lowercase, e.g. "spark"). */
+const LIMIT_LABEL_ABBREVIATIONS = new Map([["reserve", "rsrv"]]);
+
 export function codexLimitLabel(input: { limitName: string }): string {
   const tokens = familyTokens(input.limitName).filter((t) => Number.isNaN(Number(t)));
-  return tokens.at(-1) ?? input.limitName.trim().toLowerCase();
+  const label = tokens.at(-1) ?? input.limitName.trim().toLowerCase();
+  return LIMIT_LABEL_ABBREVIATIONS.get(label) ?? label;
 }
 
 const SESSION_WINDOW_MAX_S = 6 * 3600;
 
-/** A window's screening bar: short windows (5h-class) screen at the session
- *  bar, everything else (weekly aggregates and per-model caps) at the weekly
- *  bar. An unknown duration is treated as weekly: the strictest reading. */
 export function isSessionWindow(input: { window: CodexWindow }): boolean {
   const seconds = input.window.windowSeconds;
   return seconds != null && seconds <= SESSION_WINDOW_MAX_S;
 }
 
-/** The account's weekly aggregate window: the longest-duration aggregate row. */
 export function weeklyWindowOf(input: { aggregate: CodexWindow[] }): CodexWindow | null {
   let best: CodexWindow | null = null;
   for (const window of input.aggregate) {

package/src/lib/credstore.ts

@@ -1,12 +1,3 @@
-// Platform credential store - ONE backend per platform, selected when a target
-// is constructed:
-//   darwin : login-keychain generic-password via security(1)  (keychain.ts)
-//   linux  : plaintext files, matching claude's own Linux store
-//            (live = <configDir>/.credentials.json, mode 0600; verified 2.1.205:
-//            the Linux build has no keyring path at all)
-// Parked backups live in the keychain (darwin) or ~/.config/tokenmaxxing/creds
-// (linux). Call sites never branch on platform - they pass targets around.
-
 import { mkdirSync, readFileSync, unlinkSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { z } from "zod";
@@ -29,7 +20,6 @@ function isEnoent(e: unknown): boolean {
   return e instanceof Error && "code" in e && e.code === "ENOENT";
 }
 
-/** Read a target's credential blob. Returns null if it does not exist. */
 export async function readItem(t: CredTarget): Promise<string | null> {
   if (t.kind === "keychain") return kc.readItem(t);
   try {
@@ -40,14 +30,12 @@ export async function readItem(t: CredTarget): Promise<string | null> {
   }
 }
 
-/** Create-or-update a target with `secret` as its blob. Throws on failure. */
 export async function writeItem(t: CredTarget, secret: string): Promise<void> {
   if (t.kind === "keychain") return kc.writeItem(t, secret);
   mkdirSync(dirname(t.path), { recursive: true, mode: 0o700 });
   writeFileAtomic(t.path, secret, 0o600);
 }
 
-/** Delete a target. Returns true if it existed and was removed. */
 export async function deleteItem(t: CredTarget): Promise<boolean> {
   if (t.kind === "keychain") return kc.deleteItem(t);
   try {
@@ -59,42 +47,30 @@ export async function deleteItem(t: CredTarget): Promise<boolean> {
   }
 }
 
-/** The live default credential claude reads (`Claude Code-credentials` / $USER
- *  on darwin, `<credDir()>/.credentials.json` on linux). */
 export function liveTarget(): CredTarget {
   return darwin
     ? { kind: "keychain", service: kcNames.service, account: kcNames.account }
     : { kind: "file", path: join(credDir(), ".credentials.json") };
 }
 
-/** A parked account's backup (`tokenmaxxing-cred-<uuid8>` item / .json file). */
 export function parkedTarget(itemName: string): CredTarget {
   return darwin
     ? { kind: "keychain", service: itemName, account: kcNames.account }
     : { kind: "file", path: join(paths.credsDir, `${itemName}.json`) };
 }
 
-/** The credential claude uses under CLAUDE_CONFIG_DIR=`configDirRaw`: a
- *  hash-namespaced keychain service on darwin, the file inside the dir on linux.
- *  The dir string must be byte-stable on darwin (hash is over the RAW string). */
 export function isolatedTarget(configDirRaw: string): CredTarget {
   return darwin
     ? { kind: "keychain", service: namespacedCredService(configDirRaw), account: kcNames.account }
     : { kind: "file", path: join(configDirRaw, ".credentials.json") };
 }
 
-/** Reduce a full credential blob to just `{claudeAiOauth}` - what parked items
- *  store (small → always the ps-safe keychain write path on darwin). */
 export function claudeAiOauthOnly(fullBlobRaw: string): string {
   const b = CredentialBlobSchema.parse(JSON.parse(fullBlobRaw));
   return JSON.stringify({ claudeAiOauth: b.claudeAiOauth });
 }
 
-/** Merge a fresh `claudeAiOauth` into the CURRENT live blob, preserving every
- *  sibling key (MCP OAuth state, etc.). Returns the full blob string to install. */
 export function mergeIntoLive(currentLiveRaw: string | null, freshClaudeAiOauth: unknown): string {
-  // null-check, not falsiness: an EXISTING-but-empty blob is corruption and
-  // must surface (JSON.parse throws), never be silently replaced as "missing".
   const base = currentLiveRaw == null ? {} : BlobRecordSchema.parse(JSON.parse(currentLiveRaw));
   base["claudeAiOauth"] = freshClaudeAiOauth;
   return JSON.stringify(base);