tokenmaxxing 1.9.1 → 1.11.0

package/DESIGN.md

@@ -1,6 +1,6 @@
 # tokenmaxxing - design
 
-Automatic Claude Code account switching. You run `claude` exactly as always; when the active account crosses its swap threshold (**95%** of the 5h session window, **98%** of a weekly window), tokenmaxxing swaps the credential to a fresh account at a safe turn boundary and **your running session adopts it in place - no restart**. Works across many concurrent sessions at once; a fully depleted pool pauses with a countdown and auto-resumes at the soonest reset when it lands within `policy.maxWaitMs` (default 1h; further out, the session stays put rather than parking for hours).
+Automatic Claude Code account switching. You run `claude` exactly as always; when the active account crosses its swap threshold (the active rung of the 5h session ladder, **50, then 80, then 95** as the pool fills, or **98%** of a weekly window), tokenmaxxing swaps the credential to a fresh account at a safe turn boundary and **your running session adopts it in place - no restart**. Works across many concurrent sessions at once; a fully depleted pool pauses with a countdown and auto-resumes at the soonest reset when it lands within `policy.maxWaitMs` (default 1h; further out, the session stays put rather than parking for hours).
 
 > Scope: **Claude Code first (macOS + Linux, the latter since 2026-07-09).** Codex support landed in 0.13.0 (2026-07-16) with its own parallel state, decision engine, and supervisor; its verified internals live in AGENTS.md's Codex sections.
 >
@@ -12,7 +12,7 @@ Automatic Claude Code account switching. You run `claude` exactly as always; whe
 
 A **running** `claude` DOES adopt an externally swapped credential (verified live 2026-07-10, correcting this document's original claim): an ensure-fresh poll re-reads the credential store around every request, so a swap lands within ~30s on macOS (raw keychain cache) and on the next request on Linux. A plain swap therefore needs no process management at all (since 0.15.0, 2026-07-16; earlier versions respawned on every swap): the Stop hook swaps the credential and the session keeps running. What adoption cannot give you is the depleted case: when every account is at the wall the session must be PAUSED until something resets, and a live `claude` cannot pause itself.
 
-So the supervisor's job is narrow: on a depleted pool it **replaces the process at a salvageable moment** - after a turn completes, the conversation is fully written to the transcript JSONL and `claude` is idle at the prompt, so killing it there loses nothing - shows an interruptible countdown to the soonest reset, and relaunches `claude --resume <session-id>` when it passes. **Thresholds still sit below 100%: the headroom is the budget to reach a clean turn boundary (plus up to one turn of adoption lag on macOS) before the account actually hits the wall.** The session window swaps at 95 (a 5h reset is cheap to sit out) while the weekly windows drain to 98 (weekly allowance is use-it-or-lose-it).
+So the supervisor's job is narrow: on a depleted pool it **replaces the process at a salvageable moment** - after a turn completes, the conversation is fully written to the transcript JSONL and `claude` is idle at the prompt, so killing it there loses nothing - shows an interruptible countdown to the soonest reset, and relaunches `claude --resume <session-id>` when it passes. **Thresholds still sit below 100%: the headroom is the budget to reach a clean turn boundary (plus up to one turn of adoption lag on macOS) before the account actually hits the wall.** The session window climbs a ladder, 50 then 80 then 95, each rung taking over once every pooled account is past the one below (a 5h reset is cheap to sit out, so the pool drains level by level), while the weekly windows drain to 98 (weekly allowance is use-it-or-lose-it).
 
 A hook can't do the pause-and-relaunch - when `claude` exits, the shell owns the terminal. So tokenmaxxing installs a **supervisor** (aliased to `claude`) that owns the process lifecycle:
 
@@ -79,7 +79,7 @@ Each terminal ran the supervisor, so each has its own child `claude` and its own
 ---
 
 ## 5. Rotation policy
-The decision engages at `five_hour >= 50%` (policy.greedySessionFloor): from there it greedily converges on the usable account furthest behind its weekly pace, staying put whenever the current account wins or ties. The **Layer 1 screening bars** - `five_hour >= 95%` OR `seven_day >= 98%`, per org (`thresholds`) - force a switch onto a fresher account and also screen candidates. "Exhausted" is a **timestamped state** (`resets_at`), not a flag - an account is a candidate again after it resets. Optional projected threshold (`bar - policy.projectionMargin`, a fixed configured margin) so a single large turn is less likely to blow past 100% before the next Stop hook.
+The decision engages at `five_hour >= 50%` (policy.greedySessionFloor): from there it greedily converges on the usable account furthest behind its weekly pace, staying put whenever the current account wins or ties. The **Layer 1 screening bars** - `five_hour >= <active rung>` (the 5h ladder `thresholds.session`, default 50/80/95: the lowest rung some pooled account still clears, the current one included) OR `seven_day >= 98%`, per org (`thresholds`) - force a switch onto a fresher account and also screen candidates. "Exhausted" is a **timestamped state** (`resets_at`), not a flag - an account is a candidate again after it resets. Optional projected threshold (`bar - policy.projectionMargin`, a fixed configured margin) so a single large turn is less likely to blow past 100% before the next Stop hook.
 
 **Two layers - pump the last drops.** The screening bars deliberately leave headroom, so when *every* account is over them Layer 1 alone would park the pool with 2-5% of each account's quota still unspent. **Layer 2 - the wall bars** (`hardThresholds`, default `100/100`, the server's own limit) - is the fallback reached only at that point: the session **holds its seat and squeezes** while it is under the wall, else swaps onto the best still-under-wall account (the same pace-pressure ranking as every other swap - squeeze the account whose weekly quota is most about to be forfeited first), and only parks (depleted-wait) once every account has truly walled. Recovery is then measured against the wall, not the screening bar, so an account whose 5h window drops below 100 is squeezable again even while its weekly window still sits above the Layer 1 bar. The wall reading is the statusLine's own `rate_limits` feed - the same server-side figure claude's `/rate-limit-options` renders - so when an account genuinely maxes out the tee shows 100 and Layer 2 moves on; a single-turn overshoot is caught one boundary later (the periodic `check` timer, or the next Stop hook) without needing to sniff assistant text. Set `hardThresholds` equal to `thresholds` to disable Layer 2. **Layer 2 is Claude-only:** a swap on Claude is a hot, in-place credential adoption every concurrent session follows automatically, whereas a running Codex refuses another account's credential (restart is the switch), so a last-drop-swap there would strand any sibling still on the walled account - Codex instead keeps riding its current account to the wall (its existing all-exhausted stay-put already squeezes it).
 

package/README.md

@@ -33,12 +33,11 @@ tokenmaxxing init
 nix-darwin:
 
 ```nix
-# flake inputs: tokenmaxxing.url = "github:anaclumos/tokenmaxxing";
+inputs.tokenmaxxing.url = "github:anaclumos/tokenmaxxing";
 modules = [
   inputs.tokenmaxxing.darwinModules.withOverlay
   { programs.tokenmaxxing.enable = true; }
 ];
-# then: tokenmaxxing init
 ```
 
 Home Manager:
@@ -47,9 +46,10 @@ Home Manager:
 imports = [ inputs.tokenmaxxing.homeManagerModules.default ];
 programs.tokenmaxxing.enable = true;
 programs.tokenmaxxing.package = inputs.tokenmaxxing.packages.${pkgs.system}.default;
-# then: tokenmaxxing init
 ```
 
+With either module, run `tokenmaxxing init` afterwards.
+
 `init` imports the account you're already on, installs the `claude` supervisor + five `settings.json` entries (the tokenmaxxing statusLine, a subagentStatusLine, a Stop hook, a StopFailure hook, a SessionStart hook), and adds the supervisor's bin dir to PATH in your shell rc (idempotent; it must sit ahead of the real `claude` to intercept it). Restart your shell, then add more accounts and go:
 
 ```sh
@@ -76,15 +76,16 @@ claude                  # use claude as always
 | `tokenmaxxing doctor` | verify the supervisor + settings entries survived |
 | `tokenmaxxing rename [--codex] <sel> <label>` / `rm [--codex] <sel>` | manage the pool (`--codex` targets the codex pool: one email can hold both a claude and a codex account) |
 | `tokenmaxxing uninstall` | remove supervisor + settings entries (accounts/credentials kept) |
+| `--json` | machine-readable output: one JSON document on stdout for `status`, `ls`, `config`, `doctor`, `check`, `switch`, `rename`, `rm`, `uninstall`, and one per tick for `watch` (`ok` mirrors the exit code, failures add `error`) |
 
 ## How switching decides
 
-Switching engages (configurable) once the active account's 5-hour session window is **50% used** - from there, every evaluation greedily converges on the usable account **furthest behind its own weekly pace**, and does nothing when the current account already wins. Independent of that, crossing a hard screening bar - **95%** session or **98%** weekly - always forces a switch. The bars also screen candidates on any of:
+Switching engages (configurable) once the active account's 5-hour session window is **50% used** - from there, every evaluation greedily converges on the usable account **furthest behind its own weekly pace**, and does nothing when the current account already wins. Independent of that, crossing a screening bar always forces a switch: the session bar is the active rung of a ladder (**50**, then **80**, then **95**, each rung taking over once every pooled account is past the one below) and the weekly bar is **98%**. The bars also screen candidates on any of:
 
 - **Session** (5-hour) or **week (all models)** - the aggregate windows, fed free/push-based by the statusLine.
 - **Per-model weekly cap** - the most capable model (Fable) has its own tighter weekly limit that binds *before* the aggregate (per-model caps currently exist only for Sonnet and Fable, and Sonnet's is generous). tokenmaxxing reads it from `claude -p '/usage'` (free, 0 tokens, TTL-cached) whenever the active model is one of `policy.switchModels`, so a Fable session switches on the Fable cap while a Sonnet session rides the aggregate.
 
-The bars' headroom is deliberate: it's the budget to reach a clean turn boundary (plus up to one turn of adoption lag on macOS) before the wall. The session bar sits lower (95) because a 5-hour reset is cheap to sit out; weekly quota is use-it-or-lose-it, so it drains closer to the wall (98). The greedy engagement floor sits far below both: weekly allowance is forfeited at each account's fixed reset, so once half a session window justifies the swap, quota is best burned on whichever account has the most at risk.
+The bars' headroom is deliberate: it's the budget to reach a clean turn boundary (plus up to one turn of adoption lag on macOS) before the wall. The session ladder tops out lower (95) because a 5-hour reset is cheap to sit out, and its lower rungs keep the pool draining level by level; weekly quota is use-it-or-lose-it, so it drains closer to the wall (98). The greedy engagement floor sits far below both: weekly allowance is forfeited at each account's fixed reset, so once half a session window justifies the swap, quota is best burned on whichever account has the most at risk.
 
 The **target** is chosen greedily off each account's cached windows: among usable accounts (every window under its bar, or past its reset), the one **furthest behind its own weekly pace** - highest remaining% divided by time to its weekly reset - because unused weekly allowance is forfeited at the fixed per-account reset. Cached resets are absolute UTC epochs, so a stale snapshot still resolves correctly: a weekly reset that has passed extrapolates forward in 7-day steps, and a session window past its reset counts as empty. Both `tokenmaxxing switch` and the automatic path rank the current account too and do nothing when it already wins, so they are idempotent - evaluating periodically converges on the right account.
 
@@ -94,7 +95,7 @@ The **target** is chosen greedily off each account's cached windows: among usabl
 
 ```json
 {
-  "thresholds": { "session": 95, "weekly": 98 },
+  "thresholds": { "session": [50, 80, 95], "weekly": 98 },
   "policy": {
     "projectionMargin": 0,
     "greedySessionFloor": 50,
@@ -104,7 +105,7 @@ The **target** is chosen greedily off each account's cached windows: among usabl
 }
 ```
 
-`projectionMargin` is a fixed safety margin subtracted from each threshold bar (effective bar = threshold - margin), so a large turn is less likely to blow past a bar between checks; `greedySessionFloor` is the session-used % at which the greedy convergence engages; `switchModels` names the models whose per-model cap triggers a switch; `usagePollTtlMs` is how long a `/usage` per-model poll stays fresh; `maxWaitMs` bounds the depleted-pool countdown - a soonest reset further out than this does not pause the session (no respawn marker is written and the session simply keeps hitting its limit until an account recovers).
+`thresholds.session` is a ladder: the bar is the lowest rung some pooled account still clears, so a seat past 50 hands off while a sibling is under 50, and the bar climbs to 80 and then 95 as the whole pool fills; `projectionMargin` is a fixed safety margin subtracted from each threshold bar (effective bar = threshold - margin), so a large turn is less likely to blow past a bar between checks; `greedySessionFloor` is the session-used % at which the greedy convergence engages; `switchModels` names the models whose per-model cap triggers a switch; `usagePollTtlMs` is how long a `/usage` per-model poll stays fresh; `maxWaitMs` bounds the depleted-pool countdown - a soonest reset further out than this does not pause the session (no respawn marker is written and the session simply keeps hitting its limit until an account recovers).
 
 State lives entirely in `~/.config/tokenmaxxing/`. Per-account credentials follow the platform's Claude Code store: the login keychain on macOS (`tokenmaxxing-cred-<uuid8>` items, never plaintext on disk), 0600 files under `~/.config/tokenmaxxing/creds/` on Linux (the same plaintext model claude itself uses for `~/.claude/.credentials.json`).
 
@@ -116,19 +117,20 @@ For agents you build on the [Claude Agent SDK](https://docs.claude.com/en/api/ag
 import { query } from "@anthropic-ai/claude-agent-sdk";
 import { ensureBestAccount, pooledOptions, stopHookCheck } from "tokenmaxxing";
 
-await ensureBestAccount(); // run the switch decision before the spawn (swaps once it engages - see below)
+await ensureBestAccount();
 
 for await (const message of query({
   prompt: "...",
   options: {
-    ...pooledOptions(), // pinned real claude + scrubbed env -> the pooled live credential
-    hooks: { Stop: [{ hooks: [stopHookCheck] }] }, // re-decide at every turn boundary
+    ...pooledOptions(),
+    hooks: { Stop: [{ hooks: [stopHookCheck] }] },
   },
 })) {
-  // capture the session id from the init message if you want `resume` across swaps
 }
 ```
 
+The loop body receives the message stream; keep the session id from the init message if you want `resume` across swaps.
+
 The SDK reads credentials when it spawns the claude subprocess and has no statusLine, so none of the CLI-side supervisor machinery applies; the integration is boundary-driven instead. `ensureBestAccount()` runs the exact greedy decision the CLI hooks and timer run (screening bars, pace-pressure target, post-swap cooldown - all shared code); like them, it deliberately does nothing until the decision engages (the active session past `policy.greedySessionFloor`, or a bar crossed), so a fresh account rides instead of churning. `pooledOptions()` pins `pathToClaudeCodeExecutable` to the real claude binary and supplies a full replacement `env` with every ambient credential override (`ANTHROPIC_API_KEY`, `CLAUDE_CODE_OAUTH_TOKEN`, ...) scrubbed, so the subprocess resolves the pool's live credential and nothing else. The pooled surface requires the default Claude Code credential store: it fails fast if `CLAUDE_CONFIG_DIR` or `CLAUDE_SECURESTORAGE_CONFIG_DIR` is set in your app's environment, because a swap would write the live credential where those point while the spawned subprocess reads the default store. `stopHookCheck` re-runs the decision at turn boundaries; a swap it lands takes effect on the next subprocess spawn (it never yanks a mid-query token). If your app loads user settings (see the SDK's `settingSources`), the Stop hook `tokenmaxxing init` installed may already fire in SDK sessions too - `stopHookCheck` makes the check explicit and works when settings are restricted.
 
 This is for pooling **your own** subscription accounts in agents you run yourself - the same personal-use posture as the CLI. Anthropic does not allow third-party products to offer claude.ai login or rate limits, including agents built on the Agent SDK; don't ship this surface to third parties.

package/agent-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "tokenmaxxing",
-  "version": "1.9.1",
+  "version": "1.11.0",
   "description": "Pool Claude Code and Codex logins, switch on pace pressure, and expose safe ops tools to agent clients.",
   "author": {
     "name": "anaclumos",

package/agent-plugin/skills/pool-status/SKILL.md

@@ -10,7 +10,7 @@ description: Read the Claude and Codex account pool safely (list, usage bars, wa
 - `pool_ls` for labels, active marker, needs-reauth
 - `pool_status` for 5h / weekly / per-model bars (free `/usage` path)
 
-If MCP is unavailable, run `tokenmaxxing ls` or `tokenmaxxing status` (alias `xx`). Never add `--force`.
+If MCP is unavailable, run `tokenmaxxing ls --json` or `tokenmaxxing status --json` (alias `xx`) and parse the document. Never add `--force`.
 
 ## Hard stops
 
@@ -22,6 +22,6 @@ If MCP is unavailable, run `tokenmaxxing ls` or `tokenmaxxing status` (alias `xx
 
 - Active Claude usage often comes from the statusLine tee; parked accounts are probed in isolation.
 - `watch` re-renders status on an interval and never force-pings.
-- Hermetic agents: set `TOKENMAXXING_HOME` to a throwaway directory.
+- Hermetic agents: set `TOKENMAXXING_HOME` to a throwaway directory. That isolates state files only: `init`, `uninstall`, and the codex hook install still write settings.json, codex `hooks.json`, the shell rc, and the timer unit under `HOME`, so never run them from an agent.
 
 See [references/commands.md](references/commands.md).

package/agent-plugin/skills/pool-status/references/commands.md

@@ -4,5 +4,6 @@
 - `tokenmaxxing status --force`: DENIED for agents without explicit user approval. Meters every account.
 - `tokenmaxxing ls`: compact list.
 - `tokenmaxxing watch [seconds]`: live re-render (default 120), never `--force`.
+- `--json` on any of these: one JSON document on stdout (`ok` mirrors the exit code); parse it instead of scraping the bars. `watch --json` prints one document per tick and never exits on its own.
 
 Docs: `docs/content/docs/commands.mdx`.

package/agent-plugin/skills/safe-contribution/SKILL.md

@@ -1,15 +1,14 @@
 ---
 name: safe-contribution
-description: Safely change and ship tokenmaxxing (tests, PR window, Mac vs Linux skew, public-repo hygiene). Use when editing this repo, opening PRs, or verifying decision-path changes.
+description: Safely change and ship tokenmaxxing (verification without a test suite, PR window, Mac vs Linux skew, public-repo hygiene). Use when editing this repo, opening PRs, or verifying decision-path changes.
 ---
 
 # Safe contribution
 
 ## Verify
 
-- Default suite: `bun test`.
-- After decision-path changes, also run `bun test/e2e/swap-concurrency.ts` by hand (not part of `bun test`).
-- Hermetic CLI: `TOKENMAXXING_HOME=/tmp/xx-test bun run src/main.ts ...`.
+- The repo carries no test code and no comments (owner ruling 2026-09-02). Never add tests, a test script, or comments.
+- Verify with `bun run typecheck`, then hermetic CLI runs: `TOKENMAXXING_HOME=/tmp/xx-test bun run src/main.ts ...` (for decision-path changes, write accounts.json, usage.json, config.json, and a claude.json under that root and run `check`; point `TOKENMAXXING_KEYCHAIN_SERVICE` and `TOKENMAXXING_KEYCHAIN_ACCOUNT` at throwaway names and `TOKENMAXXING_CLAUDE_JSON` at that claude.json, because the CLI resolves claude.json from HOME, not from `TOKENMAXXING_HOME`).
 - Ask before any run that meters real quota (`status --force`, live-pool inference). Free `/usage` / plain status is fine.
 
 ## Ship

package/agent-plugin/skills/sdk-pairing/SKILL.md

@@ -19,10 +19,11 @@ for await (const message of query({
     hooks: { Stop: [{ hooks: [stopHookCheck] }] },
   },
 })) {
-  // capture session id from init for resume across swaps
 }
 ```
 
+The loop body receives the message stream; keep the session id from the init message for `resume` across swaps.
+
 ## Rules
 
 - Call `ensureBestAccount()` before each `query()` spawn (no mid-query hot-swap).

package/agent-plugin/skills/switching-policy/SKILL.md

@@ -7,11 +7,11 @@ description: Explain and apply tokenmaxxing switch policy (greedy vs hard path,
 
 ## Vocabulary
 
-- **Engaged**: session used >= `policy.greedySessionFloor` (default 50) or any hard/screening bar crossed.
+- **Engaged**: session used >= `policy.greedySessionFloor` (default 50) or any screening bar crossed.
 - **GREEDY path**: engaged but under every bar. Rank all accounts by pace pressure; keep seat on best-or-tie (`currentWins`); else swap to strictly better. Never depleted-waits or pre-parks.
 - **HARD path**: a screening bar crossed. Swap to best usable target; if none, Layer 2 wall logic (Claude only).
 - **Pace pressure**: remaining weekly percent / time to weekly reset (highest first). Not most-remaining.
-- **Effective bars**: `effectiveBars(cfg)` = thresholds minus `policy.projectionMargin`. Trigger and screening must share these bars or swaps ping-pong.
+- **Effective bars**: `effectiveBars(cfg, pool)` = the active rung of the 5h ladder (`thresholds.session`, default 50/80/95: the lowest rung some pooled account, the current one included, still clears) and the weekly bar, each minus `policy.projectionMargin`. Trigger and screening must share these bars or swaps ping-pong. Codex reads `terminalBars(cfg)`, the top rung only. The check cadence is capped one band per rung climbed.
 
 ## Layer 2 (Claude only)
 

package/agent-plugin/skills/switching-policy/references/policy.md

@@ -1,7 +1,7 @@
 # Policy sources
 
 - `docs/content/docs/switching.mdx`
-- `src/lib/decide.ts`, `src/lib/picker.ts` (inline rationale)
+- `src/lib/decide.ts`, `src/lib/picker.ts`
 - `.memory/switch-policy-pace-pressure.md`
 
-Default screening bars: session 95, weekly 98. Wall defaults 100. Cooldown 45s on the automatic path after a swap.
+Default screening bars: session ladder [50, 80, 95] with the active rung resolved per pool, weekly 98. Wall defaults 100. Cooldown 45s on the automatic path after a swap. Check cadence ceiling per rung: 300s, 180s, 120s, then the 60s floor.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.9.1",
+  "version": "1.11.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",
@@ -32,9 +32,8 @@
   ],
   "scripts": {
     "dev": "bun run src/main.ts",
-    "test": "bun test",
     "typecheck": "tsc --noEmit",
-    "prepublishOnly": "bun run typecheck && bun run test",
+    "prepublishOnly": "bun run typecheck",
     "nix:bun": "bunx bun2nix@2.1.2 -o bun.nix"
   },
   "devDependencies": {

package/src/cli/check.ts

@@ -2,15 +2,16 @@ import { CHECK_DELAY_FLOOR_MS, checkDelayMs, evaluateAndMaybeSwap } from "../lib
 import { readOAuthAccount } from "../lib/claudejson.ts";
 import { log } from "../lib/log.ts";
 import { loadConfig, loadNextCheckDueAt, saveNextCheckDueAt } from "../lib/state.ts";
-import { c, fmtReset } from "./render.ts";
+import { c, emitError, emitJson, fmtReset } from "./render.ts";
 
 const TICK_SLACK_MS = CHECK_DELAY_FLOOR_MS / 2;
 
-export async function cmdCheck(args: string[] = []): Promise<number> {
+export async function cmdCheck(args: string[] = [], json = false): Promise<number> {
   const now = Date.now();
   const dueAt = args.includes("--if-due") ? loadNextCheckDueAt(now) : null;
   if (dueAt != null && now + TICK_SLACK_MS < dueAt) {
-    console.log(c.dim(`not due (${Math.ceil((dueAt - now) / 1000)}s)`));
+    if (json) emitJson({ ok: true, due: false, nextCheckAt: dueAt });
+    else console.log(c.dim(`not due (${Math.ceil((dueAt - now) / 1000)}s)`));
     return 0;
   }
   let d;
@@ -19,11 +20,23 @@ export async function cmdCheck(args: string[] = []): Promise<number> {
   } catch (e) {
     const detail = e instanceof Error ? e.message : String(e);
     log("check.error", { err: detail });
-    console.error(c.red(`check failed: ${detail}`));
+    emitError({ json, message: `check failed: ${detail}` });
     return 1;
   }
   const delayMs = checkDelayMs({ cfg: loadConfig(), org: readOAuthAccount()?.organizationUuid ?? null, now, decision: d });
   saveNextCheckDueAt({ dueAt: now + delayMs, ts: now });
+  if (json) {
+    emitJson({
+      ok: true,
+      due: true,
+      swapped: d.swapped,
+      account: d.account?.label ?? null,
+      reason: d.reason,
+      waitUntil: d.waitUntil ?? null,
+      nextCheckAt: now + delayMs,
+    });
+    return 0;
+  }
   const next = c.dim(`next in ${Math.round(delayMs / 1000)}s`);
   if (d.swapped && d.account) {
     console.log(`${c.green("↻")} switched to ${c.bold(d.account.label)} ${next}`);

package/src/cli/codexrm.ts

@@ -5,32 +5,33 @@ import { deleteParkedCodexAuth } from "../lib/codexauth.ts";
 import { liveCodexAccountId } from "../lib/codexsample.ts";
 import { presentCodexAccountIds } from "../lib/codexpresence.ts";
 import { findCodexAccount } from "./rename.ts";
-import { c } from "./render.ts";
+import { c, emitError, emitJson, plain } from "./render.ts";
 
-export async function cmdCodexRm(selector?: string): Promise<number> {
+export async function cmdCodexRm(selector?: string, json = false): Promise<number> {
   if (!selector) {
-    console.error("usage: tokenmaxxing rm --codex <email|label|id>");
+    emitError({ json, message: "usage: tokenmaxxing rm --codex <email|label|id>", paint: plain });
     return 2;
   }
   return withLock(codexPaths.lockFile, async () => {
     const index = loadCodexAccounts();
     const account = findCodexAccount(index.accounts, selector);
     if (!account) {
-      console.error(c.red(`no codex account matches "${selector}"`));
+      emitError({ json, message: `no codex account matches "${selector}"` });
       return 1;
     }
     if (liveCodexAccountId() === account.accountId) {
-      console.error(c.red(`${account.label} is the LIVE codex account - run \`tokenmaxxing switch --codex\` to move off it first.`));
+      emitError({ json, message: `${account.label} is the LIVE codex account - run \`tokenmaxxing switch --codex\` to move off it first.` });
       return 1;
     }
     if (presentCodexAccountIds().has(account.accountId)) {
-      console.error(c.red(`${account.label} is running in a live codex session - close that session before removing it.`));
+      emitError({ json, message: `${account.label} is running in a live codex session - close that session before removing it.` });
       return 1;
     }
     deleteParkedCodexAuth({ credFile: account.credFile });
     index.accounts = index.accounts.filter((x) => x.accountId !== account.accountId);
     saveCodexAccounts({ index });
-    console.log(`removed codex account ${c.bold(account.label)} from the pool (${index.accounts.length} left)`);
+    if (json) emitJson({ ok: true, pool: "codex", removed: account.label, remaining: index.accounts.length });
+    else console.log(`removed codex account ${c.bold(account.label)} from the pool (${index.accounts.length} left)`);
     return 0;
   });
 }

package/src/cli/codexswitch.ts

@@ -7,18 +7,30 @@ import { performCodexSwap } from "../lib/codexswap.ts";
 import { CodexInvalidGrantError } from "../lib/codexoauth.ts";
 import { liveCodexAccountId } from "../lib/codexsample.ts";
 import { presentCodexAccountIds, targetableCodexAccounts } from "../lib/codexpresence.ts";
-import { effectiveBars } from "../lib/picker.ts";
-import { c } from "./render.ts";
+import { terminalBars } from "../lib/picker.ts";
+import { c, emitError, emitJson } from "./render.ts";
 
-export async function cmdCodexSwitch(sel?: string): Promise<number> {
+export async function cmdCodexSwitch(sel?: string, json = false): Promise<number> {
+  const deadGrants: string[] = [];
+  const withDeadGrants = (report: Record<string, unknown>) => (deadGrants.length > 0 ? { ...report, deadGrants } : report);
+  const emit = (text: string, report: Record<string, unknown>): void => {
+    if (json) emitJson({ ok: true, ...withDeadGrants(report) });
+    else console.log(text);
+  };
+  const fail = (message: string, opts: { paint?: (s: string) => string; notes?: string[]; extra?: Record<string, unknown> } = {}): number => {
+    emitError({ json, message, paint: opts.paint, notes: opts.notes, extra: withDeadGrants(opts.extra ?? {}) });
+    return 1;
+  };
+  const deadGrantMessage = (label: string) => `${label}'s refresh token is dead - re-add it with \`tokenmaxxing add --codex\``;
   const cfg = loadConfig();
-  const bars = effectiveBars(cfg);
+  const bars = terminalBars(cfg);
   const now = Date.now();
 
   return withLock(codexPaths.lockFile, async () => {
     const index = loadCodexAccounts();
     if (index.accounts.length === 0) {
-      console.log(c.dim("no codex accounts yet - run `tokenmaxxing init --codex`"));
+      if (json) emitJson({ ok: false, error: "no codex accounts yet - run `tokenmaxxing init --codex`" });
+      else console.log(c.dim("no codex accounts yet - run `tokenmaxxing init --codex`"));
       return 1;
     }
     const currentId = liveCodexAccountId();
@@ -28,32 +40,35 @@ export async function cmdCodexSwitch(sel?: string): Promise<number> {
         (account) => account.label === sel || account.email === sel || account.accountId.startsWith(sel),
       );
       if (!target) {
-        console.error(c.red(`no codex account matches "${sel}"`));
-        for (const account of index.accounts) console.error(c.dim(`  ${account.label} (${account.accountId.slice(0, 8)})`));
-        return 1;
+        return fail(`no codex account matches "${sel}"`, {
+          notes: index.accounts.map((account) => `  ${account.label} (${account.accountId.slice(0, 8)})`),
+          extra: { accounts: index.accounts.map((account) => account.label) },
+        });
       }
       if (target.accountId === currentId) {
-        console.log(`already on ${c.bold(target.label)}`);
+        emit(`already on ${c.bold(target.label)}`, { switched: false, account: target.label, reason: "already-on" });
         return 0;
       }
       if (presentCodexAccountIds().has(target.accountId)) {
-        console.error(c.red(`${target.label} is running in a live codex session - swapping onto it would break that session's credential`));
-        return 1;
+        return fail(`${target.label} is running in a live codex session - swapping onto it would break that session's credential`);
       }
       if (target.needsReauth) {
-        console.error(c.red(`${target.label} needs re-auth - run \`codex login\` in an isolated home and \`tokenmaxxing add --codex\``));
-        return 1;
+        return fail(`${target.label} needs re-auth - run \`codex login\` in an isolated home and \`tokenmaxxing add --codex\``);
       }
       try {
         await performCodexSwap({ target });
       } catch (e) {
         if (e instanceof CodexInvalidGrantError) {
-          console.error(c.red(`${target.label}'s refresh token is dead - re-add it with \`tokenmaxxing add --codex\``));
-          return 1;
+          deadGrants.push(target.label);
+          return fail(deadGrantMessage(target.label));
         }
         throw e;
       }
-      console.log(`${c.green("✓")} switched codex to ${c.bold(target.label)} (takes effect on the next codex start)`);
+      emit(`${c.green("✓")} switched codex to ${c.bold(target.label)} (takes effect on the next codex start)`, {
+        switched: true,
+        account: target.label,
+        reason: "selected",
+      });
       return 0;
     }
 
@@ -62,21 +77,36 @@ export async function cmdCodexSwitch(sel?: string): Promise<number> {
       const candidates = targetableCodexAccounts({ accounts: current.accounts, activeAccountId: currentId });
       const active = candidates.find((account) => account.accountId === currentId) ?? null;
       if (codexCurrentWins({ active, accounts: candidates, thresholds: bars, now })) {
-        console.log(`already on the best codex account: ${c.bold(active?.label ?? "?")}`);
+        emit(`already on the best codex account: ${c.bold(active?.label ?? "?")}`, {
+          switched: false,
+          account: active?.label ?? null,
+          reason: "current-wins",
+        });
         return 0;
       }
       const best = pickBestCodex({ accounts: candidates, thresholds: bars, now, currentAccountId: currentId });
       if (!best) {
-        console.log(c.yellow("no usable codex switch target (all at their bars, unmeasured, or needing reauth)"));
+        const message = "no usable codex switch target (all at their bars, unmeasured, or needing reauth)";
+        const reauthNeeded = current.accounts.filter((account) => account.needsReauth).map((account) => account.label);
+        if (json) return fail(message, { extra: { reauthNeeded } });
+        console.log(c.yellow(message));
         return 1;
       }
       try {
         await performCodexSwap({ target: best });
       } catch (e) {
-        if (e instanceof CodexInvalidGrantError) continue;
+        if (e instanceof CodexInvalidGrantError) {
+          deadGrants.push(best.label);
+          if (!json) console.error(c.red(deadGrantMessage(best.label)));
+          continue;
+        }
         throw e;
       }
-      console.log(`${c.green("✓")} switched codex to ${c.bold(best.label)} (takes effect on the next codex start)`);
+      emit(`${c.green("✓")} switched codex to ${c.bold(best.label)} (takes effect on the next codex start)`, {
+        switched: true,
+        account: best.label,
+        reason: "best",
+      });
       return 0;
     }
   });