vibemaxxing 0.2.0__tar.gz

vibemaxxing-0.2.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,39 @@
+name: Bug report
+description: Something does not work the way the README says it does
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Never paste a token**, a `~/.vibemaxxing/accounts/*.json` file, or an
+        unredacted `~/.claude.json`. Output printed by `vibe` is scrubbed and is safe
+        to paste; the files it reads are not.
+
+        Found a security issue? Do not file it here. See
+        [SECURITY.md](https://github.com/jskarbecki/vibemaxxing/blob/main/SECURITY.md).
+  - type: input
+    id: command
+    attributes:
+      label: The exact command you ran
+      placeholder: vibe switch work
+    validations:
+      required: true
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened, and what you expected instead
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Output of `vibe --version`
+    validations:
+      required: true
+  - type: input
+    id: os
+    attributes:
+      label: OS and Python version
+      placeholder: macOS 15.5, Python 3.13
+    validations:
+      required: true

vibemaxxing-0.2.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/jskarbecki/vibemaxxing/security/advisories/new
+    about: Report privately. Never in a public issue.

vibemaxxing-0.2.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,22 @@
+name: Feature request
+description: Suggest something it should do
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        `docs/CONTRACT.md` is the frozen design and explains why several obvious-looking
+        things are deliberately absent. Worth a skim before you write.
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem you hit
+      description: What you were trying to do when you wanted this.
+    validations:
+      required: true
+  - type: textarea
+    id: idea
+    attributes:
+      label: What you would like it to do
+    validations:
+      required: true

vibemaxxing-0.2.0/.github/pull_request_template.md

@@ -0,0 +1,15 @@
+## What changed, and why
+
+<!-- Readable without opening the diff. -->
+
+## Checks
+
+<!-- CI runs this; paste what it printed, or say which parts you skipped and why. -->
+
+```
+uv sync --locked && uv run ruff check . && uv run ruff format --check . && uv run mypy src && uv run pytest -q
+```
+
+- [ ] I read `docs/CONTRACT.md` for the area I touched
+- [ ] Behaviour a doc describes changed, and I updated that doc here
+- [ ] No new runtime dependency (or I opened an issue first)

vibemaxxing-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,52 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  check:
+    name: ${{ matrix.os }} · py${{ matrix.python }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        # macOS is the first-class platform; Linux must pass. Windows is
+        # unsupported in v1 and has no job, deliberately.
+        os: [macos-latest, ubuntu-latest]
+        python: ['3.11', '3.13']
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          python-version: ${{ matrix.python }}
+
+      # The five clauses of the check command in docs/CONTRACT.md, in order and
+      # unchanged. CI has no credentials; every test runs offline.
+      - run: uv sync --locked
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run mypy src
+      - run: uv run pytest -q
+
+  gitleaks:
+    name: gitleaks
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # scan the whole history, not just the tip
+
+      - name: Scan history for secrets
+        run: |
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz gitleaks
+          ./gitleaks git . --config .gitleaks.toml --redact --no-banner --exit-code 1
+        env:
+          GITLEAKS_VERSION: 8.30.1

vibemaxxing-0.2.0/.github/workflows/publish.yml

@@ -0,0 +1,54 @@
+name: Publish
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  testpypi:
+    name: TestPyPI
+    runs-on: ubuntu-latest
+    environment: testpypi
+    permissions:
+      # An explicit permissions block sets every unlisted scope to `none`, so
+      # contents: read has to be named or actions/checkout cannot read a private
+      # repo -- which is exactly how the first v0.0.1 publish failed.
+      contents: read
+      id-token: write  # trusted publishing; no API token is stored anywhere
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          python-version: '3.11'
+
+      - run: uv build
+
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+  pypi:
+    name: PyPI
+    runs-on: ubuntu-latest
+    # Real PyPI only for a full release, never a prerelease. Nothing reached it
+    # before v0.1.0 by design: the pipeline was proven on TestPyPI first.
+    if: github.event.release.prerelease == false
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          python-version: '3.11'
+
+      - run: uv build
+
+      - uses: pypa/gh-action-pypi-publish@release/v1

vibemaxxing-0.2.0/.gitignore

@@ -0,0 +1,12 @@
+__pycache__/
+*.py[cod]
+.venv/
+dist/
+build/
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.coverage
+.claude/
+.playwright-mcp/

vibemaxxing-0.2.0/.gitleaks.toml

@@ -0,0 +1,17 @@
+# Default rules plus one narrow exception. Never a path-scoped exclusion of
+# tests/: that is exactly where the sentinel tokens live and where a real leak
+# would show. The exception is the literal string and nothing else.
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = """
+`default_claude_max_20x` is the rateLimitTier string a live /api/oauth/usage
+credential carries. It is a plan-tier name, not a credential, and the test that
+asserts it is the one proving parse_blob reads the field at all. gitleaks'
+generic-api-key rule fires on its entropy (3.57). Allowlisted by the exact
+matched text, with no path clause -- a path clause suppressed unrelated
+high-entropy strings in the same file, which was verified and rejected.
+"""
+regexTarget = "match"
+regexes = ['''rate_limit_tier == "default_claude_max_20x"''']

vibemaxxing-0.2.0/.impeccable/config.json

@@ -0,0 +1,17 @@
+{
+  "detector": {
+    "ignoreRules": [],
+    "ignoreFiles": [],
+    "ignoreValues": [
+      {
+        "rule": "layout-transition",
+        "value": "*",
+        "files": [
+          "src/vibemaxxing/index.html"
+        ],
+        "createdAt": "2026-09-16T10:34:54.667Z",
+        "reason": "docs/CONTRACT.md s11 pins 'transition: width 240ms cubic-bezier(0.23, 1, 0.32, 1)' as the page's only motion; tests/test_web.py asserts exactly one occurrence. Leaf span in a fixed-height track, repaints once per 60s poll. scaleX would distort the 2px border-radius."
+      }
+    ]
+  }
+}

vibemaxxing-0.2.0/CHANGELOG.md

@@ -0,0 +1,46 @@
+# Changelog
+
+Notable changes per release. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
+versions follow [semantic versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.2.0] - 2026-09-16
+
+### Added
+
+- `vibe help`: a command that explains what each command is for and when to use it.
+  Before it existed, `vibe help` answered `invalid choice: 'help'` and then listed the
+  commands it had just refused to explain.
+- The web dashboard shows **the week ahead** beside the account ledger: one lane per
+  account, a marker where that account's weekly limit resets, seven days from right now.
+  Times render in the reader's own timezone, and day boundaries are local midnights, so
+  the grid does not drift across a DST change.
+- Every account's plan (`max 20x`, `pro`) is shown in the dashboard's ledger.
+- A top-level `resets` array in the `--json` envelope, listing each account's weekly
+  rollover soonest first. Documented in `docs/CONTRACT.md` §10.
+
+### Fixed
+
+- **Login failed at the token exchange with HTTP 403.** Cloudflare fronts all three
+  allowed hosts and answers urllib's default `Python-urllib/3.x` user agent with
+  `error code: 1010` before the request reaches the API. Every request now names a real
+  user agent.
+- **Login failed at the Authorize click with "Invalid request format".** The PKCE
+  `state` was 22 characters; the authorize endpoint accepts the consent page but rejects
+  the submission below 43. The failure only surfaced at the last step, which is what made
+  it look like a redirect problem.
+- **`vibe switch` changed the credential but not the account.** Claude Code caches the
+  profile in `~/.claude.json` under `oauthAccount` and trusts it for 24 h, so it ran on
+  the new token while still showing the previous account's email, org and limits. The
+  switch now repoints that object and drops `profileFetchedAt`, which makes Claude Code
+  refetch the rest itself. No priming needed on a machine that has never run it.
+
+## [0.1.0] - 2026-09-15
+
+First release. Multi-account store, OAuth login with PKCE, credential switching through
+the macOS Keychain or `~/.claude/.credentials.json`, `vibe run` for per-command accounts,
+a Textual dashboard, a loopback web dashboard, and a documented `--json` envelope.
+
+Published to TestPyPI only, to prove the release pipeline.
+
+[0.2.0]: https://github.com/jskarbecki/vibemaxxing/compare/v0.1.0...v0.2.0
+[0.1.0]: https://github.com/jskarbecki/vibemaxxing/releases/tag/v0.1.0

vibemaxxing-0.2.0/CONTRIBUTING.md

@@ -0,0 +1,58 @@
+# Contributing
+
+Thanks for looking. Issues and pull requests are both welcome.
+
+## Setup
+
+```
+git clone https://github.com/jskarbecki/vibemaxxing
+cd vibemaxxing
+uv sync
+```
+
+## The one command
+
+CI runs exactly this, in this order. Run it before you open a pull request:
+
+```
+uv sync --locked && uv run ruff check . && uv run ruff format --check . && uv run mypy src && uv run pytest -q
+```
+
+Every test runs offline. There are no credentials in CI and none are needed: the HTTP
+client and the keychain are both injectable ports, and the suite passes fakes.
+
+## Before you write
+
+Read [`docs/CONTRACT.md`](docs/CONTRACT.md). It is the frozen design, and it is the
+authority on any question of intent — not preference, and not this file. It explains why
+things that look odd are the way they are, which will save you writing a patch that gets
+turned down for a reason nobody wrote down anywhere else.
+
+A few rules from it that catch people out:
+
+- **A token value lives only inside a `Secret`.** `.reveal()` may be called in exactly
+  five places, listed in §5. A sixth fails the leak test.
+- **The `--json` envelope is a contract.** `vibe list --json` and `GET /api/usage` emit
+  the same bytes because they call the same builder. Adding a key means updating §10.
+- **No new dependencies** without asking first. The runtime set is `textual` and the
+  standard library, deliberately — §1.
+- **`mypy --strict`, and no silencing.** No `Any`, no `type: ignore` to get a build
+  green.
+
+## Pull requests
+
+Small and focused beats large and comprehensive. Say what changed and why in the
+description; if the change touches behaviour a doc describes, update that doc in the same
+pull request.
+
+If you are unsure whether something is wanted, open an issue first and ask. That is
+cheaper for both of us than a rejected branch.
+
+## Reporting a bug
+
+Include your OS, your Python version, `vibe --version`, and the exact command you ran.
+**Never paste a token, a `~/.vibemaxxing/accounts/*.json` file, or an unredacted
+`~/.claude.json`.** Output from `vibe` is scrubbed before it is printed, so pasting what
+it showed you is safe; pasting the files it reads is not.
+
+Security issues go to [`SECURITY.md`](SECURITY.md) instead, not to the issue tracker.

vibemaxxing-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jan Skarbecki
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

vibemaxxing-0.2.0/PKG-INFO

@@ -0,0 +1,188 @@
+Metadata-Version: 2.5
+Name: vibemaxxing
+Version: 0.2.0
+Summary: Manage several Claude Code accounts and see pooled plan usage across all of them
+Project-URL: Homepage, https://github.com/jskarbecki/vibemaxxing
+Project-URL: Repository, https://github.com/jskarbecki/vibemaxxing
+Project-URL: Issues, https://github.com/jskarbecki/vibemaxxing/issues
+Author-email: Jan Skarbecki <jan@intra-ai.de>
+License: MIT
+License-File: LICENSE
+Keywords: account-switcher,claude,claude-code,cli,oauth,tui
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Utilities
+Requires-Python: >=3.11
+Requires-Dist: textual<8.3,>=8.2.8
+Description-Content-Type: text/markdown
+
+# vibemaxxing
+
+Run several Claude Code accounts from one machine, switch between them in a second, and
+see all their plan limits in one place.
+
+If you have more than one Claude subscription, you already know the problem: the only way
+to change account is `/logout`, `/login`, browser, paste. And nothing anywhere tells you
+how much weekly headroom you have left across all of them.
+
+```
+vibe switch work
+```
+
+![The dashboard: every account's limits on the left, the week ahead on the right](https://raw.githubusercontent.com/jskarbecki/vibemaxxing/main/docs/media/dashboard.png)
+
+## Install
+
+```
+uv tool install vibemaxxing     # or: pipx install vibemaxxing
+```
+
+macOS and Linux. Python 3.11+. Two commands, same program: `vibe` and `vibemaxxing`.
+
+## Start
+
+```
+vibe add                  # store the account you are already logged in to
+vibe add side             # log a second one in, in the browser
+vibe list                 # see both, and what is left on them
+vibe switch side          # Claude Code is now that account
+```
+
+`vibe add` with no name takes the login already in Claude Code, no browser and no
+network. That is the fastest way in: one command and you have your first account stored.
+
+## Every day
+
+```
+vibe                          open the dashboard in the terminal
+vibe usage web                open it in a browser at http://127.0.0.1:8787
+vibe list                     every account, its limits, the pooled total
+vibe switch <name>            change the active account
+vibe run <name> -- <cmd>      run one command as one account
+vibe remove <name>            forget an account
+vibe alias <old> <new>        rename one
+vibe help                     what each command is for
+```
+
+### switch, or run?
+
+`vibe switch work` changes the account **globally**, the same as logging out and back in.
+Claude Code sessions already running keep the old one until they restart.
+
+`vibe run work -- claude` pins **one command** to one account and leaves everything else
+alone. Two terminals can hold two different accounts at once:
+
+```
+vibe run work -- claude          # this window is "work"
+vibe run side -- claude          # that window is "side"
+```
+
+### See what is left
+
+```
+$ vibe list
+* work      you@example.com   max 20x
+    Session                   34%
+    Weekly · all models       61%
+    Weekly · Fable            12%
+
+  side      side@example.com  max
+    Session                    2%
+    Weekly · all models        9%
+
+pool  1.36 account-weeks across 2 accounts
+```
+
+**account-weeks** is the pooled number: one account with a fresh weekly limit is `1.00`.
+Two accounts each 50% spent is also `1.00`. It answers "how much Claude do I have left in
+total", which no single account's percentage can.
+
+The web dashboard adds the week ahead: one lane per account, a marker where that
+account's weekly limit resets, in your own timezone. So you can see whether a reset lands
+before your work does.
+
+### Scripting
+
+`--json` works on every command and prints one documented envelope, the same bytes the
+dashboard serves at `/api/usage`:
+
+```
+vibe list --json | jq '.pool.remaining_account_weeks'
+vibe list --json | jq -r '.resets[] | "\(.alias) \(.at)"'
+```
+
+The schema is frozen in [`docs/CONTRACT.md`](docs/CONTRACT.md) §10.
+
+## How it works
+
+It swaps **credentials**, plus the one line of config that names them. One `~/.claude`
+history and one MCP config, shared by every account, exactly as if you had logged in and
+out by hand. On macOS the active credential is Claude Code's own Keychain item; on Linux
+it is `~/.claude/.credentials.json`.
+
+`vibe switch` also repoints `oauthAccount` in `~/.claude.json` and clears its
+`profileFetchedAt`, because Claude Code caches that profile for 24 h and would otherwise
+run on the new token while still showing the old account's email, org and limits. It
+refetches the rest itself on the next start, so a fresh machine needs no setup beyond
+`vibe add` and `vibe switch`.
+
+Tokens refresh on demand about five minutes before expiry, behind a consume gate: a
+refresh rotates the refresh token, so the successor is written to disk **before** the
+predecessor is treated as spent. A crash mid-refresh leaves a recoverable successor
+rather than a dead account.
+
+It talks to three hosts and no others — `claude.ai`, `platform.claude.com`,
+`api.anthropic.com` — and refuses to contact anything else, redirects included. No
+version pings, no analytics, no telemetry. The web dashboard binds `127.0.0.1`, and
+`--host` with anything else is a hard error.
+
+## Known limitations
+
+Real and deliberate. None of these is a bug report.
+
+**Your tokens sit in plaintext JSON at rest.** `~/.vibemaxxing/accounts/*.json`, mode
+`0600`, directories `0700`. Anyone who can read your files can read your tokens — which
+is equally true of `~/.claude` itself.
+
+**The macOS Keychain write puts the credential in `argv`.** `vibe switch` shells out to
+`/usr/bin/security add-generic-password -w <blob>`, and macOS shows any local user a
+process's full argv through `ps`. For the length of one `exec`, the credential is
+readable cross-uid. The alternatives were measured and are worse: `security -i` silently
+truncates at ~4005 bytes and stores the truncated value, and the Security framework
+refuses to read Claude Code's item from a process outside its ACL, which would put an
+authorization prompt in front of every switch. Multi-user macOS is out of scope for v1.
+
+**`vibe run` cannot refresh its own token.** It sets `CLAUDE_CODE_OAUTH_TOKEN` for the
+child only, which is what lets two shells hold two accounts, but a session outliving that
+access token needs a re-run. Every grandchild inherits the variable.
+
+**Switching does not reach a running session.** `vibe switch` makes no attempt to signal
+a live Claude Code process. Restart it, or use `vibe run`.
+
+**Windows is unsupported.** It says so rather than half-working.
+
+## Uninstall
+
+```
+uv tool uninstall vibemaxxing
+rm -rf ~/.vibemaxxing
+```
+
+That is everything it creates. Your Claude Code login is untouched; whichever account was
+active stays active.
+
+## Contributing
+
+Issues and pull requests welcome. [`CONTRIBUTING.md`](CONTRIBUTING.md) has the setup and
+the one command CI runs. [`docs/CONTRACT.md`](docs/CONTRACT.md) is the frozen design and
+the authority on any question of intent.
+
+MIT licensed. Not affiliated with Anthropic.