llmpilot

your Claude accounts, on autopilot — a multi-account companion for Claude Code on macOS.

brew install alicicek/tap/llmpilot        # the CLI + daemon
brew install --cask alicicek/tap/llmpilot # the menu bar app

Signed & notarized by Apple (Developer ID, Team 6UUS5FCSJ3) — installs with no Gatekeeper warning. Zero telemetry. Your account tokens never leave your Mac — the cache holds only usage percentages and reset timestamps, and account traffic goes only to Anthropic. Beyond that the app reaches the network only for Sparkle updates (GitHub) and, in official builds, the licensing worker (prices and licence checks); buying Pro opens Stripe's hosted checkout in your browser. Open source, MIT.

One daemon watches every account's real usage, switches to the account with headroom before you hit a wall, and starts your 5-hour windows on schedule. Five thin surfaces over one brain: a native menu bar app, a native cockpit window, a statusline, a CLI, and the autopilot itself.

Built for people who run more than one Claude Max plan and are tired of the /login dance, guessing which account has room left, and waking up to windows that never opened.

Core is free forever, MIT-licensed. The autopilot is Pro — a 4-day free trial, then one charge of £9.99 / $12.99, not a subscription.

What it does

• See every account at a glance. Live usage for all your accounts — 5-hour, weekly, and per-model buckets — read straight from Anthropic's usage endpoint with an honest "as of" timestamp. When a login goes stale, the dashboard shows the last-known numbers marked stale, never old numbers in live colors.
• Switch before the wall. When the account you're on runs low, llmpilot switches you to one with headroom and tells you after — switch first, notify second. Credential writes are lock-first and backed up, so a switch never corrupts a login.
• Start windows on time. Schedule a fresh 5-hour window to open at a set time on a chosen account, so your overnight or early-morning capacity isn't wasted. It only starts a window; it never advances one you're already in.
• Bring every sign-in into the fleet. llmpilot init registers the accounts already signed in on your Mac. A sign-in living in its own folder (CLAUDE_CONFIG_DIR) can be adopted as a watched account, or moved into the fleet — backed up first, then made switchable — from the cockpit or the menu bar. You can also add a new account from inside the app: it runs Claude Code's own sign-in, and adding an account never switches Claude Code.
• Diagnose it honestly. llmpilot doctor checks the fleet — duplicate sign-ins, frozen logins, the refresh budget, unproven migrations, the install — and names what is wrong, what it could not check, and the one thing that fixes each finding. The check only looks; it never writes. (In the app, its "Claude Code is not showing your runway" note carries an Install statusline button — see below.)
• Keep a CI token. llmpilot token add/list/copy/remove stores long-lived headless tokens (the claude setup-token kind) in your Keychain. The only way a token leaves it is an explicit token copy to the clipboard.
• Read it anywhere. The same live state renders in the menu bar, the native cockpit window, a Claude Code statusline, and llmpilot status. On a CLI-only install with no app, llmpilot open puts the same cockpit in your browser instead.
• Put your limits in the terminal. Install the statusline from the app (Settings → Terminal statusline → Install statusline) or with llmpilot statusline install; arrange it by dragging segment chips in Settings → Statusline → Customize statusline. If Claude Code already runs another tool's statusline, nothing is written to Claude Code's settings until you choose Keep both or Replace it, and a replaced line is saved so it can be put back. See docs/statusline.md.

How it works

llmpilot is one Go binary. The daemon polls each account's usage — every 3 minutes in steady state, never more than 28 requests per account per rolling hour, backing off on rate limits — caches percentages and reset times locally, and drives the autopilot. The menu bar, cockpit, and CLI read that one daemon over a loopback socket; the statusline reads the snapshots the daemon writes — asking the daemon for burn-rate history when it's up — inside its 50 ms render budget. Nothing is duplicated, nothing disagrees.

llmpilot never runs a background token-refresh loop. It refreshes a login only when something needs it: about 10 minutes before a switch (yours or the autopilot's), or when the autopilot revives a stale account. Refreshes are capped at 2 attempts per account per rolling 24 hours, and one rate-limit answer from the token endpoint pauses all refreshes for 24 hours. A login that goes stale anyway is shown stale — last-known numbers, marked — until a switch, a revive, or a re-login proves it live again.

以上为 README 的开头部分。其余内容请阅读原文。 查看完整 README ↗