v0.1.1 — macOS fixed

v0.1.1 — macOS fixed, smarter rotation

If v0.1.0 was broken for you on macOS, this release is the fix. Update: git pull (or re-clone) — no other steps.

macOS Keychain support (the big one)

• Recent Claude Code on macOS stores its OAuth token in the login Keychain, not ~/.claude/.credentials.json — v0.1.0 couldn't read it, so every Mac Claude account was held as credentials missing. headroom now reads the Keychain item directly (approve the security prompt once — Always Allow). One normal claude login on your Mac just works.
• Connect guard: on macOS all Claude logins share ONE Keychain item — a second claude login overwrites the first (this is what caused the REFUSED … already connected loop some users hit). headroom connect now refuses that second login up front, before it can break your existing slot, and explains the platform limit: one Claude account per Mac. Extra Claude accounts belong on a Linux host; Codex accounts are fully isolated everywhere, including macOS.

Codex tracking robustness

• The Codex app-server reports rate-limit windows by their real duration and omits windows that aren't a current constraint; v0.1.0 assumed a fixed primary=5h/secondary=weekly shape and dropped the whole reading when it didn't hold. Windows are now bucketed by actual duration — Codex readings stay live through resets.

Reserve routing

• New routing.reserve_percent (the setup wizard asks): skip any account with less than N% headroom left so sessions start fresh instead of hitting a wall mid-task. Default 0 keeps use-to-the-limit behaviour.

Docs

• README: multi-machine FAQ (usage is read per-account provider-side; reads are token-safe and never log out your other sessions), reserve section, corrected macOS quickstart note.
• KNOWN-LIMITS: accurate macOS Keychain section (CLAUDE_CONFIG_DIR does not relocate credentials on macOS — only Linux/Windows).

59 tests green. Thanks to @hanamizuki and the DM bug reporter for the macOS reports. 🙏