Every proxy keeps its figures in its workspace, but reading them meant
opening JSON files one proxy at a time, and the /stats page starts from
zero with each restart. `stats` reads all workspaces, jails included,
and shows how much of the saving is tool definitions rather than
compression, how many calls ran past the size where /clear pays more,
and when each weekly limit runs out at the current pace.
Switching accounts moves the whole profile, which is wrong when one
account is out of limit and the other lacks its plugins and settings.
`borrow` lends one account's login into another's profile for a while.
The old helper did this and failed twice: an abort left the swap half
done, and a token refreshed in one copy broke the other. Here the
profile's own login is written to a journal before anything changes,
the lent credentials file is a link to the lender's, and `return` puts
everything back from the journal, by hand or from a systemd timer.
Profiles that jails run in are refused unless asked for, since the
login decides whose account customer data goes out under, and status
reports a borrow whose timer was lost.
The previous helper moved the private account's OAuth token into the work
profile and had to be given back afterwards. Only the credentials moved, so
plugins and settings stayed behind, and a session that exited at the wrong
moment left the swap half-done.
An account is a whole profile directory here, and switching points
CLAUDE_CONFIG_DIR at another one of them. Nothing is copied, so nothing has to
be restored, and the plugins of an account come with it. A wrapper in
~/.local/bin makes the single `claude` command follow the switch, including
for the hooks and subprocesses a shell alias would never reach.
Each account also gets a Headroom proxy of its own -- its own port, its own
workspace, its own service -- because one shared proxy would collect the work
of both accounts in one cache. The router publishes them as
<account>.headroom.localhost, gives the bare domain to whichever account is
active, and keeps resolving the per-session names the enqs-jail plugin
publishes.
Status is a report rather than two lines: the parts of this setup fail
quietly, and a proxy that is not running, a wrapper that is shadowed or two
routers on one port are all invisible from a terminal.
nvrl
Nils Pukropp