tokenmaxxing 1.82.0 → 1.83.0

package/DESIGN.md

@@ -30,7 +30,7 @@ It is a process manager only - spawn with inherited stdio (stdin through a relay
 - A `claude` **supervisor** on your PATH ahead of the real binary (`~/.config/tokenmaxxing/bin/claude`) - you invoke it identically; a `claude` shell function or alias would shadow it, and `doctor` warns about one.
 - Five `~/.claude/settings.json` entries (merged - other settings keys are preserved, but the `statusLine` slot is taken over): the tokenmaxxing `statusLine` renderer (native since 2026-07-11; it also tees usage), a `subagentStatusLine` (per-subagent rows in the agents panel), a `Stop` hook, a `StopFailure` hook, a `SessionStart` hook.
 - **`~/.config/tokenmaxxing/`** - the single home for config and state:
-  - `config.json` - SPARSE overrides only (thresholds.session/weekly, claudeBin/codexBin/grokBin/opencodeBin pins, policy.*); defaults apply at read time, `xx config` prints the path and the effective values, and edits happen in an editor.
+  - `config.json` - SPARSE overrides only (thresholds.session/weekly, claudeBin/codexBin/grokBin/opencodeBin/piBin pins, policy.*); defaults apply at read time, `xx config` prints the path and the effective values, and edits happen in an editor.
   - `accounts.json` - non-secret index `{id, label, email, tier, addedAt, windows, lastUsageAt, lastProbeAt, probeFails, storeFails, usageRetryAt, enforcedUntil, needsReauth, oauthAccount}` (each cached window carries its name, duration, reset, and sample time; the same shape serves the Codex pool as `codex-accounts.json`). Neither index names an active account: the schema is `{version, accounts}`, and an older file that still carries `activeId` loads and drops the key on the next save.
   - `stores/<uuid8>/` - one Claude Code credential store per pooled account (see below).
   - `codex-stores/<uuid8>/` - one Codex credential store per pooled account: its `auth.json`, with everything else symlinked to the shared `~/.codex` so sessions, history, and config stay shared and `codex resume` works across stores.
@@ -38,7 +38,8 @@ It is a process manager only - spawn with inherited stdio (stdin through a relay
   - `live/<session-id>` - PID-validated presence per supervised session, naming its account; placement counts them.
   - `respawn/<session-id>` - per-session respawn markers (the hook→supervisor signal): the target account, the session to resume, a `waitUntil`, a `compact` flag, the `origin` (the hook or the seat watch that wrote it), and the launch time the marker was written for.
   - `wait-queue.json` - the depleted-pool wait claims (`{sessionId, accountId, at, waitUntil}`), so at most four sessions wait on one account; a session that arrives when every account already has four waiters takes the soonest reset anyway.
-  - `bin/claude` and `bin/codex` - the supervisors, beside the `tokenmaxxing` and `xx` entry points.
+  - `bin/claude` and `bin/codex` - the supervisors, beside the `tokenmaxxing` and `xx` entry points; `bin/pi` after `init --pi`.
+  - `pi-stores/claude/<uuid8>/` and `pi-stores/codex/<uuid8>/` - one pi store per pooled account that has a pi login: the account's own pi grant in `auth.json`, everything else symlinked to the shared `~/.pi/agent` ([pi support](docs/content/docs/pi.mdx)).
   - `sessions/<sid>.json`, `onboard/`, `hub-key`, `update.json`, `spawnrate.json`, `tokenmaxxing.log`, the codex `codex-onboard/`, `codex-respawn/`, and `codex-live/`, and the `grok-*` and `opencode-go-*` state of the status-only pools: the full table is in [State directory layout](docs/content/docs/state-directory.mdx).
 - Per-account **credential stores** follow the platform's Claude Code store: macOS = a login-keychain item keyed by the store path (never plaintext on disk); Linux = a 0600 `.credentials.json` inside the 0700 store directory (the same plaintext model claude itself uses - its Linux build has no keyring path at all, binary-verified 2.1.205). One `credstore` facade dispatches on a `{kind: keychain|file}` target; call sites never branch on platform. tokenmaxxing writes a store once, at onboarding; Claude Code's own refresh is the only writer afterwards.
 

package/README.md

@@ -65,9 +65,11 @@ claude                  # use claude as always; each session gets its own accoun
 |---|---|
 | `tokenmaxxing init` | verify and pin the real `claude`, log the first account in (isolated) + install supervisor, hooks, PATH line, check timer, and hub service |
 | `tokenmaxxing init --codex` | same for codex: log in the first account (isolated), install codex supervisor + Stop hook |
+| `tokenmaxxing init --pi` | verify and pin the real `pi` and install the `pi` supervisor, which runs pi sessions on pooled Claude and ChatGPT accounts that have a pi login |
 | `tokenmaxxing init --grok` / `init --opencode-go` | pool the first grok login or opencode-go key, status-only: no supervisor, no switching |
 | `tokenmaxxing add [--codex \| --grok \| --opencode-go]` | register an additional account in that pool (isolated login, harvested once into its own store) |
 | `tokenmaxxing auth [--codex \| --grok \| --opencode-go] [sel \| --all]` | reauthenticate a pooled account in place: bare lists the pool (emails shown) and asks which; a selector targets one account and tells you the email to sign in with; `--all` walks every account that is flagged or has no usable credential in its store, one by one |
+| `tokenmaxxing auth --pi [--codex] [sel \| --all]` | log a pooled Claude account (or a codex account with `--codex`) into pi, isolated, and keep that login as the account's pi credential after an identity check; `--all` walks every account without a pi login |
 | `tokenmaxxing status [--cached]` | every pool: accounts with 5h / weekly / per-model usage bars, live session counts, exhausted-until-reset; `--cached` renders the stored figures without sampling |
 | `tokenmaxxing config` | the config path and the effective values; edit the file in an editor, a bad value fails the next load with the field name |
 | `tokenmaxxing check` | fold fresh tees, sample up to three stale accounts, and self-update a Bun global install once a day; the periodic timer runs this every tick |
@@ -110,7 +112,7 @@ See [How switching decides](docs/content/docs/switching.mdx) for the policy and
 }
 ```
 
-`thresholds.session` and `thresholds.weekly` are the two bars, one number each (an array `thresholds.session`, the former ladder, fails config loading with a message naming the field); `projectionMargin` is a fixed safety margin subtracted from the session bar only (default 3), so a large turn is less likely to blow past the 5-hour bar between checks; the weekly bar takes no margin because one turn cannot overshoot a week; `switchModels` names the models whose per-model cap triggers a move; `usagePollTtlMs` is how long a usage sample stays fresh, for a seat's own sample and for the accounts each check tick samples; `maxWaitMs` bounds the depleted-pool countdown - a reset further out than this does not pause the session (no respawn marker is written and the session simply keeps hitting its limit until an account recovers); `checkIntervalMs` is the periodic check tick (default 60s), which `init` writes into the timer - re-run `tokenmaxxing init` after changing it so the timer unit picks up the new tick. `claudeBin`, `codexBin`, `grokBin`, and `opencodeBin` pin the real binaries; `init` writes them, and `TOKENMAXXING_CLAUDE_BIN`, `TOKENMAXXING_CODEX_BIN`, `TOKENMAXXING_GROK_BIN`, and `TOKENMAXXING_OPENCODE_BIN` override them for one process, except that `init` pins the binary it resolved into `config.json`.
+`thresholds.session` and `thresholds.weekly` are the two bars, one number each (an array `thresholds.session`, the former ladder, fails config loading with a message naming the field); `projectionMargin` is a fixed safety margin subtracted from the session bar only (default 3), so a large turn is less likely to blow past the 5-hour bar between checks; the weekly bar takes no margin because one turn cannot overshoot a week; `switchModels` names the models whose per-model cap triggers a move; `usagePollTtlMs` is how long a usage sample stays fresh, for a seat's own sample and for the accounts each check tick samples; `maxWaitMs` bounds the depleted-pool countdown - a reset further out than this does not pause the session (no respawn marker is written and the session simply keeps hitting its limit until an account recovers); `checkIntervalMs` is the periodic check tick (default 60s), which `init` writes into the timer - re-run `tokenmaxxing init` after changing it so the timer unit picks up the new tick. `claudeBin`, `codexBin`, `grokBin`, `opencodeBin`, and `piBin` pin the real binaries; `init` writes them, and `TOKENMAXXING_CLAUDE_BIN`, `TOKENMAXXING_CODEX_BIN`, `TOKENMAXXING_GROK_BIN`, `TOKENMAXXING_OPENCODE_BIN`, and `TOKENMAXXING_PI_BIN` override them for one process, except that `init` pins the binary it resolved into `config.json`.
 
 State lives in `~/.config/tokenmaxxing/`; outside it the install touches Claude Code's `settings.json`, codex's `hooks.json`, the timer and usage hub units, and your shell rc. Each account's credential store is `stores/<uuid8>/`, which Claude Code reads and refreshes as its own: on macOS the credential is a login-keychain item keyed by the store path (never plaintext on disk), on Linux a 0600 `.credentials.json` inside the store (the same plaintext model claude itself uses for `~/.claude/.credentials.json`).
 
@@ -128,6 +130,19 @@ Codex mechanics differ from Claude Code in one hard way: a running codex process
 
 Two codex-specific facts worth knowing: codex does not run hooks it has not been told to trust, so after `init --codex` you must open codex once and trust the tokenmaxxing Stop hook via `/hooks` (auto-switching is inert until then); and each codex session runs on its own store, so no live `auth.json` is ever shared: tokenmaxxing refreshes a parked account's token only when it reads usage for it, never one a session is running on, and a move is a restart at an idle turn boundary. `init --codex` refuses a `~/.codex/config.toml` that pins `cli_auth_credentials_store` away from `file`.
 
+## pi support
+
+The [pi](https://pi.dev) coding agent runs on the same two pools when it signs in with a Claude subscription (`anthropic`) or a ChatGPT subscription (`openai-codex`):
+
+```sh
+tokenmaxxing init --pi                # install the pi supervisor
+tokenmaxxing auth --pi --all          # log each pooled Claude account into pi once
+tokenmaxxing auth --pi --codex --all  # same for the pooled codex accounts
+pi                                    # use pi as always
+```
+
+pi keeps its own credential and refreshes it itself, so each pooled account gets a pi login of its own (a separate grant, never a copy) in `pi-stores/`, with everything else linked to the shared `~/.pi/agent`. The `pi` supervisor picks the pool from `--provider`, the `--model` prefix, or pi's `defaultProvider`, starts the session on a pooled account through `PI_CODING_AGENT_DIR`, watches that account every ten seconds, and at a bar relaunches `pi --session-id <id>` on a fresher account. Details and limits in [pi support](docs/content/docs/pi.mdx).
+
 ## Honest limitations
 
 - **A move restarts the process.** The session resumes the same transcript under the new account and continues on its own from a first prompt the supervisor submits, but the process restarts, which ends every background Bash task, Monitor, and Workflow run the session started (the first prompt asks Claude to relaunch what the task still needs); a bar-triggered move compacts the conversation on the old account first, so the first turn on the new account uploads the summary (the full context when the compaction does not land), while a move after a refusal re-uploads the full context once (prompt cache is org-scoped).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.82.0",
+  "version": "1.83.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts, start each session on its own account, and resume a session on a fresher account when quota fills.",
   "type": "module",
   "license": "MIT",

package/src/cli/auth.ts

@@ -1,5 +1,9 @@
 import { partition } from "es-toolkit";
 import { withLock } from "../lib/lock.ts";
+import { log } from "../lib/log.ts";
+import type { PiPool } from "../lib/paths.ts";
+import { piLogin, piLoginStep } from "../lib/pi.ts";
+import { piStoreUsable, writePiStore } from "../lib/piauth.ts";
 import type { Provider } from "../lib/provider.ts";
 import { loadAccounts, saveAccounts, upsertAccount } from "../lib/state.ts";
 import { findAccount } from "./rename.ts";
@@ -7,7 +11,7 @@ import { usageNote } from "./add.ts";
 import { c, count } from "./render.ts";
 import type { Account, AccountsIndex } from "../lib/types.ts";
 
-const AUTH_USAGE = "usage: tokenmaxxing auth [--codex | --grok | --opencode-go] [<email|label|id> | --all]";
+const AUTH_USAGE = "usage: tokenmaxxing auth [--codex | --grok | --opencode-go] [<email|label|id> | --all]\n       tokenmaxxing auth --pi [--codex] [<email|label|id> | --all]";
 
 export type AuthPlan = { kind: "usage" } | { kind: "error"; message: string } | { kind: "pick" } | { kind: "targets"; ids: string[] };
 
@@ -33,13 +37,11 @@ export function pickerOrder(accounts: Account[], needsAuth: Set<string>): Accoun
   return [...flagged, ...healthy];
 }
 
-function askWhichAccount(idx: AccountsIndex, needsAuth: Set<string>): Account | null {
-  const ordered = pickerOrder(idx.accounts, needsAuth);
-  console.log("which account do you want to reauthenticate?");
+function askWhichAccount(input: { idx: AccountsIndex; needsAuth: Set<string>; question: string; flags: (a: Account) => string[] }): Account | null {
+  const ordered = pickerOrder(input.idx.accounts, input.needsAuth);
+  console.log(input.question);
   for (const [i, a] of ordered.entries()) {
-    const flags: string[] = [];
-    if (a.needsReauth) flags.push(c.red("needs-reauth"));
-    else if (needsAuth.has(a.id)) flags.push(c.red("no-credential"));
+    const flags = input.flags(a);
     const labelNote = a.email != null && a.label !== a.email ? ` (${a.label})` : "";
     const tag = flags.length ? ` ${flags.join(" ")}` : "";
     console.log(`  ${i + 1}. ${c.bold(a.email ?? a.label)}${labelNote}${tag}`);
@@ -94,11 +96,48 @@ async function reauthOne(p: Provider, target: Account): Promise<boolean> {
   return true;
 }
 
-export async function cmdAuth(p: Provider, argv: string[]): Promise<number> {
+async function piLoginOne(p: Provider, pool: PiPool, target: Account): Promise<boolean> {
+  console.log(c.cyan(`Logging ${c.bold(target.label)} into pi - sign in as  ${c.bold(target.email ?? target.label)}.`));
+  console.log(c.dim(piLoginStep(pool)));
+  console.log();
+
+  const login = await piLogin(pool);
+  if (!login) return false;
+
+  if (login.id !== target.id) {
+    const pooled = loadAccounts(p.pool).accounts.some((a) => a.id === login.id);
+    const hint = pooled
+      ? `run \`tokenmaxxing auth --pi${p.flag}\` for that account separately`
+      : `a pi login attaches to an account already in the pool; pool that account first with \`tokenmaxxing add${p.flag}\``;
+    console.error(
+      c.red(
+        `that login is ${c.bold(login.email ?? login.id.slice(0, 8))}, but ${target.label} is ${c.bold(target.email ?? target.id.slice(0, 8))} - nothing changed. To log that account into pi, ${hint}.`,
+      ),
+    );
+    return false;
+  }
+
+  const written = await withLock(p.pool.lockFile, () => {
+    if (!loadAccounts(p.pool).accounts.some((a) => a.id === target.id)) {
+      console.error(c.red(`${target.label} was removed from the pool while the login was open - nothing written`));
+      return false;
+    }
+    writePiStore(pool, target.id, login.cred);
+    return true;
+  });
+  if (!written) return false;
+  log("pi.login", { pool, account: target.id.slice(0, 8) });
+
+  console.log(`${c.green("✓")} logged ${c.bold(target.email ?? target.label)} into pi`);
+  return true;
+}
+
+export async function cmdAuth(p: Provider, argv: string[], pi: PiPool | null): Promise<number> {
   const idx = loadAccounts(p.pool);
   const needsAuth = new Set<string>();
   for (const a of idx.accounts) {
-    if (a.needsReauth === true || !(await p.storeUsable(a))) needsAuth.add(a.id);
+    const usable = pi ? piStoreUsable(pi, a.id) : a.needsReauth !== true && (await p.storeUsable(a));
+    if (!usable) needsAuth.add(a.id);
   }
   const plan = planAuth({ p, accounts: idx.accounts, argv, needsAuth });
   if (plan.kind === "usage") {
@@ -112,7 +151,16 @@ export async function cmdAuth(p: Provider, argv: string[]): Promise<number> {
 
   const targets: Account[] = [];
   if (plan.kind === "pick") {
-    const picked = askWhichAccount(idx, needsAuth);
+    const picked = askWhichAccount(
+      pi
+        ? { idx, needsAuth, question: "which account do you want to log into pi?", flags: (a) => (needsAuth.has(a.id) ? [c.red("no-pi-login")] : []) }
+        : {
+            idx,
+            needsAuth,
+            question: "which account do you want to reauthenticate?",
+            flags: (a) => (a.needsReauth ? [c.red("needs-reauth")] : needsAuth.has(a.id) ? [c.red("no-credential")] : []),
+          },
+    );
     if (!picked) return 1;
     targets.push(picked);
   } else {
@@ -121,7 +169,7 @@ export async function cmdAuth(p: Provider, argv: string[]): Promise<number> {
       if (account) targets.push(account);
     }
     if (targets.length === 0) {
-      console.log(`${c.green("✓")} every account has a usable credential`);
+      console.log(`${c.green("✓")} ${pi ? "every account has a pi login" : "every account has a usable credential"}`);
       return 0;
     }
   }
@@ -130,12 +178,12 @@ export async function cmdAuth(p: Provider, argv: string[]): Promise<number> {
   for (const [i, target] of targets.entries()) {
     console.log();
     if (targets.length > 1) console.log(c.bold(`[${i + 1}/${targets.length}]`));
-    if (await reauthOne(p, target)) ok += 1;
+    if (await (pi ? piLoginOne(p, pi, target) : reauthOne(p, target))) ok += 1;
   }
 
   if (targets.length > 1) {
     console.log();
-    console.log(`reauthed ${count({ n: ok, noun: "account" })} of ${targets.length}`);
+    console.log(`${pi ? "logged into pi" : "reauthed"} ${count({ n: ok, noun: "account" })} of ${targets.length}`);
   }
   return ok === targets.length ? 0 : 1;
 }

package/src/cli/doctor.ts

@@ -1,12 +1,13 @@
 import { existsSync, readFileSync } from "node:fs";
-import { CLAUDE_BIN, verifyRealBin } from "../lib/claudebin.ts";
+import { CLAUDE_BIN, PI_BIN, verifyRealBin } from "../lib/claudebin.ts";
 import { checkSettings, installedBin } from "../lib/settings.ts";
-import { activationHint, CHECK_JOB, codexStoreHookTrust, findClaudeShadowers, HUB_JOB, isBinDirAhead, jobHealthy, shellRcPath } from "../lib/install.ts";
+import { activationHint, CHECK_JOB, codexStoreHookTrust, findClaudeShadowers, HUB_JOB, isBinDirAhead, jobHealthy, piSupervisorLink, shellRcPath } from "../lib/install.ts";
+import { readPiStore } from "../lib/piauth.ts";
 import { errorMessage } from "../lib/log.ts";
 import { claudePool, codexPool, paths } from "../lib/paths.ts";
 import { loadAccounts, loadConfig } from "../lib/state.ts";
 import { readStore } from "../lib/credstore.ts";
-import { codexIdentityOf, readCodexStoreAuth } from "../lib/codexauth.ts";
+import { chatgptAccountIdOf, codexIdentityOf, readCodexStoreAuth } from "../lib/codexauth.ts";
 import { isAccessTokenExpiring, isDeadCredential, fetchTokenIdentity, describeIdentity } from "../lib/oauth.ts";
 import { c } from "./render.ts";
 
@@ -99,6 +100,44 @@ export async function cmdDoctor(): Promise<number> {
     check(fail === null, "claudeBin launches the real claude", fail ?? undefined);
   }
 
+  if (existsSync(piSupervisorLink())) {
+    check(!!cfg.piBin && existsSync(cfg.piBin), "real pi binary resolved", "run `tokenmaxxing init --pi`");
+    if (cfg.piBin && existsSync(cfg.piBin)) {
+      const fail = verifyRealBin({ ...PI_BIN, bin: cfg.piBin });
+      check(fail === null, "piBin launches the real pi", fail ?? undefined);
+      check(isBinDirAhead(PI_BIN), `${paths.binDir} is ahead of the real pi on PATH`, `export PATH="${paths.binDir}:$PATH"`);
+    }
+    for (const [pool, poolPaths, flag] of [["claude", claudePool, ""], ["codex", codexPool, " --codex"]] as const) {
+      for (const a of loadAccounts(poolPaths).accounts) {
+        let cred;
+        try {
+          cred = readPiStore(pool, a.id);
+        } catch (e) {
+          check(false, `pi login readable for ${a.label}`, errorMessage(e).slice(0, 100));
+          continue;
+        }
+        if (!cred) {
+          note(`${a.label} (${pool}) has no pi login - pi sessions skip it (run \`tokenmaxxing auth --pi${flag} ${a.label}\`)`);
+          continue;
+        }
+        if (pool === "codex") {
+          check(chatgptAccountIdOf({ jwt: cred.access }) === a.id, `pi login identity matches ${a.label} (codex)`, `run \`tokenmaxxing auth --pi --codex ${a.label}\``);
+          continue;
+        }
+        if (cred.expires <= Date.now()) {
+          note(`${a.label} pi login identity unverifiable (access token expired; pi refreshes it in its next session)`);
+          continue;
+        }
+        try {
+          const identity = await fetchTokenIdentity(cred.access);
+          check(identity.accountUuid === a.id, `pi login identity matches ${a.label}`, `token belongs to ${describeIdentity(identity)} - run \`tokenmaxxing auth --pi ${a.label}\``);
+        } catch (e) {
+          check(false, `pi login identity matches ${a.label}`, errorMessage(e).slice(0, 100));
+        }
+      }
+    }
+  }
+
   const rc = shellRcPath();
   if (rc && existsSync(rc)) {
     for (const s of findClaudeShadowers(readFileSync(rc, "utf8"))) {

package/src/cli/init.ts

@@ -1,6 +1,8 @@
 import { mkdirSync } from "node:fs";
 import { withLock } from "../lib/lock.ts";
-import { paths } from "../lib/paths.ts";
+import { claudePool, codexPool, paths } from "../lib/paths.ts";
+import { piInstall, piPreflight } from "../lib/pi.ts";
+import { piStoreUsable } from "../lib/piauth.ts";
 import type { Provider } from "../lib/provider.ts";
 import { loadAccounts, loadConfig, saveAccounts, upsertAccount } from "../lib/state.ts";
 import { c, count } from "./render.ts";
@@ -18,6 +20,25 @@ export function printUsage(p: Provider): void {
   console.log(`    ${c.cyan("xx help")}            everything else`);
 }
 
+export function cmdInitPi(): number {
+  mkdirSync(paths.home, { recursive: true });
+  loadConfig();
+  piPreflight();
+  piInstall();
+  console.log();
+  for (const [pool, poolPaths, flag] of [["claude", claudePool, ""], ["codex", codexPool, " --codex"]] as const) {
+    const accounts = loadAccounts(poolPaths).accounts;
+    if (accounts.length === 0) {
+      console.log(`  ${pool} pool: empty - ${c.cyan(`xx init${flag}`)} pools the first account`);
+      continue;
+    }
+    const ready = accounts.filter((a) => piStoreUsable(pool, a.id)).length;
+    console.log(`  ${pool} pool: ${ready} of ${count({ n: accounts.length, noun: "account" })} logged into pi - ${c.cyan(`xx auth --pi${flag} --all`)} logs in the rest`);
+  }
+  console.log(`  then run ${c.cyan("pi")} as always: a session on an ${c.bold("anthropic")} or ${c.bold("openai-codex")} model starts on a pooled account and moves near quota`);
+  return 0;
+}
+
 export async function cmdInit(p: Provider): Promise<number> {
   mkdirSync(paths.home, { recursive: true });
   loadConfig();