@rikcodes/teamclaude 1.1.20-rik.4 → 1.1.20-rik.6

package/README.md

@@ -1,7 +1,7 @@
 # TeamClaude
 
 > **Fork notice (rikbrown).** This fork adds two features on top of
-> [KarpelesLab/teamclaude](https://github.com/KarpelesLab/teamclaude), currently based on upstream 1.1.19:
+> [KarpelesLab/teamclaude](https://github.com/KarpelesLab/teamclaude), currently based on upstream 1.1.20:
 >
 > - **[OpenAI models via a Codex sidecar](docs/openai.md)** (`sidecars` + `customModels`, opt-in):
 >   route `gpt-*` requests through a supervised local translating proxy to a ChatGPT subscription,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rikcodes/teamclaude",
-  "version": "1.1.20-rik.4",
+  "version": "1.1.20-rik.6",
   "description": "Multi-account proxy for Claude Code and Codex: pools Claude Max, ChatGPT/Codex, API-key and third-party backend accounts, and rotates on quota",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -221,6 +221,13 @@ function makeAccount(acct, index) {
     // Fields to drop from request bodies for this account (third-party upstreams
     // that reject e.g. `context_management`). See server.js stripBodyFields.
     stripRequestFields: acct.stripRequestFields || null,
+    // Whether this upstream keeps Anthropic message-thread state. Off for a
+    // third-party backend, which would otherwise be handed a bare delta. See
+    // server.js refusesThreadContinue.
+    messageThreads: acct.messageThreads === true,
+    // Whether the operator has already been told this upstream keeps no thread
+    // state, so the line is printed once rather than per refusal.
+    threadRefusalReported: false,
     // Per-account response-headers deadline (ms); null means the fleet default
     // in upstream-fetch.js. See normalizeHeadersTimeoutMs.
     headersTimeoutMs: normalizeHeadersTimeoutMs(acct.headersTimeoutMs),
@@ -355,6 +362,10 @@ export class AccountManager {
     // it. Each such switch arms the ramp below, so steady interleaved traffic
     // holds both accounts at the ramp floor while nothing has failed over.
     this.routeCursors = new Map();
+    /** Rotation for requests that carry no session id; separate from the shared
+     *  cursor so turning it never moves a running session's account.
+     *  @type {number} */
+    this._untaggedCursor = 0;
     // One cursor per provider. `currentIndex` is a single slot, and a request
     // only another provider can serve would otherwise drag it across: a Codex
     // request moved it onto a Codex account and the next Anthropic request moved
@@ -688,7 +699,7 @@ export class AccountManager {
     if (!account?.entitlementDeniedUntil) return false;
     if (now < account.entitlementDeniedUntil) return true;
     account.entitlementDeniedUntil = null;
-    console.log(`[TeamClaude] Account "${account.name}" entitlement cooldown expired, marking available`);
+    console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" entitlement cooldown expired, marking available`);
     return false;
   }
 
@@ -851,6 +862,12 @@ export class AccountManager {
         if (acc) return acc;
       }
     }
+    // An untagged request has no session to pin, so the walk below rests every
+    // one of them on the current account. Spread them too, on their own cursor.
+    if (!sessionId && this.distributeSessions && !this._pinnedAccountForModel(model, advisorModel)) {
+      const acc = this._selectUntagged(exclude, model, advisorModel);
+      if (acc) return acc;
+    }
     if (advisorModel) {
       const account = this._select(exclude, model, advisorModel, false);
       if (account) return account;
@@ -944,6 +961,41 @@ export class AccountManager {
    * eligible account. Returns null if nothing is eligible, so the caller falls
    * back to the normal quota-driven walk. Does NOT record the pin — that happens
    * on the actual route (recordSession), so retries/failover re-pin naturally. */
+  /**
+   * Round-robin for requests that carry no session id.
+   *
+   * The Codex CLI tags `POST /responses` with `session-id` but not its catalog
+   * fetch, and Claude Code tags `/v1/messages` but not its telemetry. Those
+   * untagged requests have nothing to pin, so the walk below rests all of them
+   * on the current account: measured against a five-account Codex pool with
+   * distribution on, every session's `GET /models` landed on one account, 16
+   * requests against 1 apiece for its siblings.
+   *
+   * `_pickLeastLoaded` does not spread them. An untagged request never reaches
+   * `recordSession`, so it adds no session count, and a serial caller's
+   * in-flight is back to zero by the time the next one arrives — the tiebreak
+   * chain is level every time and answers with the same account. Hence a cursor
+   * of its own.
+   *
+   * That cursor is its own on purpose: `_setCurrent` is what sessions riding
+   * the shared one follow, and moving it from a catalog fetch would hand a
+   * running conversation to another account mid-flight and throw away the
+   * prompt cache it built there. An untagged request picks where it goes and
+   * changes nothing for anyone else.
+   *
+   * @param {Set<number>|null} exclude
+   * @param {string|null} model
+   * @param {string|null} advisorModel
+   * @returns {Record<string, any>|null}
+   */
+  _selectUntagged(exclude, model, advisorModel) {
+    const candidates = this._bandedCandidates(exclude, model, advisorModel);
+    if (candidates.length === 0) return null;
+    const cursor = this._untaggedCursor;
+    this._untaggedCursor = cursor + 1;
+    return candidates[cursor % candidates.length];
+  }
+
   _selectForSession(sessionId, exclude, model, advisorModel) {
     // The pin is per governing bucket, and this request is bound by the
     // EXECUTOR's: one request goes to one account, so the executor's affinity is
@@ -1680,7 +1732,7 @@ export class AccountManager {
       account.status = 'active';
       account.rateLimitedUntil = null;
       account.throttledAt = null;
-      console.log(`[TeamClaude] Account "${account.name}" rate limit expired, marking active`);
+      console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" rate limit expired, marking active`);
     }
 
     if (account.status === 'exhausted') return 'exhausted';
@@ -2177,6 +2229,12 @@ export class AccountManager {
    * `_isAvailable` excludes accounts at or above the switch threshold. Shared by
    * both selection loops so they cannot disagree on the candidate set.
    */
+  /**
+   * @param {Set<number>|null} [exclude]
+   * @param {string|null} [model]
+   * @param {string|null} [advisorModel]
+   * @returns {Array<Record<string, any>>}
+   */
   _bandedCandidates(exclude = null, model = null, advisorModel = null) {
     return this._topPressureBand(
       this.accounts.filter(a => !exclude?.has(a.index) && this._isAvailable(a, model, advisorModel)),
@@ -2547,7 +2605,7 @@ export class AccountManager {
     const now = Date.now();
     if (now < (this._rolloverHeldLogAt.get(key) || 0)) return;
     this._rolloverHeldLogAt.set(key, now + 60_000);
-    console.log(`[TeamClaude] Account "${account.name}" rolled over its ${window} window ${this._heldRolloverReason(reason)}`);
+    console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" rolled over its ${window} window ${this._heldRolloverReason(reason)}`);
   }
 
   /**
@@ -2798,7 +2856,7 @@ export class AccountManager {
 
     // Clear expired unified quotas
     if (q.unified5h != null && q.unified5hReset && now >= q.unified5hReset) {
-      console.log(`[TeamClaude] Account "${account.name}" session quota reset`);
+      console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" session quota reset`);
       // Recorded on the account, not just returned. _clearExpiredQuotas is
       // reached from two directions — refreshExpiredQuotas on the request path,
       // which runs the session-reset switch rule, and _isNearQuota via
@@ -2818,7 +2876,7 @@ export class AccountManager {
       session = true;
     }
     if (q.unified7d != null && q.unified7dReset && now >= q.unified7dReset) {
-      console.log(`[TeamClaude] Account "${account.name}" weekly quota reset`);
+      console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" weekly quota reset`);
       q.unified7d = null;
       q.unified7dReset = null;
       q.unifiedStatus = null;
@@ -2862,7 +2920,7 @@ export class AccountManager {
       // so a reading is never discarded before it has had a window to prove out.
       if (!q[seenField]) { q[seenField] = now; continue; }
       if (now < q[seenField] + this.familyStaleMs) continue;
-      console.log(`[TeamClaude] Account "${account.name}" ${label} weekly reading is stale — revalidating on the next ${label} request`);
+      console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" ${label} weekly reading is stale — revalidating on the next ${label} request`);
       q[key] = null;
       q[`${key}Reset`] = null;
       q[seenField] = null;
@@ -3297,7 +3355,7 @@ export class AccountManager {
     if (account.probing && account.quota.unified7dReset != null) {
       account.probing = false;
       account.requalify = true;
-      console.log(`[TeamClaude] Learned weekly quota for "${account.name}", re-evaluating selection`);
+      console.log(`[TeamClaude] Learned weekly quota for "${safeLine(account.name, 64)}", re-evaluating selection`);
     }
 
     this._observeBurnRate(account, observed);
@@ -3307,7 +3365,7 @@ export class AccountManager {
 
     if (this._isNearQuota(account)) {
       const pct = account.quota.unified7d != null ? Math.round(account.quota.unified7d * 100) : null;
-      console.log(`[TeamClaude] "${account.name}" near weekly quota${pct == null ? '' : ` (${pct}%)`}`);
+      console.log(`[TeamClaude] "${safeLine(account.name, 64)}" near weekly quota${pct == null ? '' : ` (${pct}%)`}`);
     }
   }
 
@@ -3364,7 +3422,7 @@ export class AccountManager {
     if (account.probing && account.quota.unified7dReset != null) {
       account.probing = false;
       account.requalify = true;
-      console.log(`[TeamClaude] Learned weekly quota for "${account.name}", re-evaluating selection`);
+      console.log(`[TeamClaude] Learned weekly quota for "${safeLine(account.name, 64)}", re-evaluating selection`);
     }
 
     // `unified-status` is upstream's verdict on THIS response. A family-cap 429
@@ -3452,7 +3510,7 @@ export class AccountManager {
         : account.quota.tokensLimit
           ? ((1 - account.quota.tokensRemaining / account.quota.tokensLimit) * 100).toFixed(1)
           : '?';
-      console.log(`[TeamClaude] Account "${account.name}" at ${pct}% usage — will switch on next request`);
+      console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" at ${pct}% usage — will switch on next request`);
     }
   }
 
@@ -3545,7 +3603,7 @@ export class AccountManager {
       // drop the dead-token guard too — otherwise the account would come back
       // active but never attempt a refresh (see ensureTokenFresh).
       account._deadRefreshToken = null;
-      console.log(`[TeamClaude] Account "${account.name}" re-enabled — clearing error state`);
+      console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" re-enabled — clearing error state`);
     }
   }
 
@@ -3610,7 +3668,7 @@ export class AccountManager {
       }
       // Worth a line: the account was refusing this family and is not any more.
       if (wasSpent && !(q[key] != null && q[key] >= this.thresholdFor(key))) {
-        console.log(`[TeamClaude] Account "${account.name}" ${label} weekly quota confirmed available by probe`);
+        console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" ${label} weekly quota confirmed available by probe`);
       }
     }
     // Families beyond the two with dedicated fields. Replaced wholesale rather
@@ -3634,11 +3692,11 @@ export class AccountManager {
       const was = q.spend;
       q.spend = { ...usage.spend };
       if (q.spend.enabled && !was?.enabled) {
-        console.log(`[TeamClaude] Account "${account.name}" can bill real money past its plan limits (extra usage is enabled upstream)`);
+        console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" can bill real money past its plan limits (extra usage is enabled upstream)`);
       }
       const spentNow = (q.spend.usedMinor || 0) > 0;
       if (spentNow && !((was?.usedMinor || 0) > 0)) {
-        console.log(`[TeamClaude] Account "${account.name}" has started spending real money: ${formatMoney(q.spend)}`);
+        console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" has started spending real money: ${formatMoney(q.spend)}`);
       }
     }
 
@@ -3717,7 +3775,7 @@ export class AccountManager {
     // after throttleProbeFloorMs from here, so a probe that 429s again pushes
     // the next probe out by a full floor rather than hammering upstream.
     account.throttledAt = Date.now();
-    console.log(`[TeamClaude] Account "${account.name}" rate limited for ${retryAfterSeconds}s`);
+    console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" rate limited for ${retryAfterSeconds}s`);
   }
 
   /**
@@ -3731,7 +3789,7 @@ export class AccountManager {
     account.status = 'active';
     account.rateLimitedUntil = null;
     account.throttledAt = null;
-    console.log(`[TeamClaude] Account "${account.name}" revalidated — rate limit no longer applies, back in rotation`);
+    console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" revalidated — rate limit no longer applies, back in rotation`);
   }
 
   /**
@@ -3768,7 +3826,7 @@ export class AccountManager {
     if (account._deadRefreshToken && account._deadRefreshToken === account.refreshToken) {
       if (account.status !== 'error') {
         account.status = 'error';
-        console.error(`[TeamClaude] Account "${account.name}" still holds a rejected refresh token — run: teamclaude login`);
+        console.error(`[TeamClaude] Account "${safeLine(account.name, 64)}" still holds a rejected refresh token — run: teamclaude login`);
       }
       return;
     }
@@ -3794,7 +3852,7 @@ export class AccountManager {
     if (account._refreshPromise) return account._refreshPromise;
 
     account._refreshPromise = (async () => {
-      console.log(`[TeamClaude] Refreshing token for account "${account.name}"...`);
+      console.log(`[TeamClaude] Refreshing token for account "${safeLine(account.name, 64)}"...`);
       // The token we SEND, captured before the await. A config reload or
       // `teamclaude import` (updateAccountTokens) can install newer tokens while
       // the grant is in flight; reading `account.refreshToken` afterwards would
@@ -3811,7 +3869,7 @@ export class AccountManager {
           ? this._codexRefreshFn(sent)
           : this._refreshFn(sent));
         if (account.refreshToken !== sent) {
-          console.log(`[TeamClaude] Discarding refresh result for account "${account.name}" — its tokens were replaced while the refresh was in flight`);
+          console.log(`[TeamClaude] Discarding refresh result for account "${safeLine(account.name, 64)}" — its tokens were replaced while the refresh was in flight`);
           return;
         }
         account.credential = newTokens.accessToken;
@@ -3819,10 +3877,10 @@ export class AccountManager {
         account.expiresAt = newTokens.expiresAt;
         account._lastRefreshAt = Date.now();
         account._deadRefreshToken = null; // this token works; clear any stale guard
-        console.log(`[TeamClaude] Token refreshed for account "${account.name}"`);
+        console.log(`[TeamClaude] Token refreshed for account "${safeLine(account.name, 64)}"`);
         this._onTokenRefresh?.(accountIndex, newTokens);
       } catch (err) {
-        console.error(`[TeamClaude] Token refresh failed for "${account.name}": ${err.message}`);
+        console.error(`[TeamClaude] Token refresh failed for "${safeLine(account.name, 64)}": ${err.message}`);
         // Reserve 'error' (which drops the account from rotation until re-login)
         // for a GENUINE auth rejection: the refresh token itself is no longer
         // valid — revoked, or invalidated by an account/plan migration. A
@@ -3838,11 +3896,11 @@ export class AccountManager {
           // a token imported mid-refresh stays untouched and gets its own try.
           account._deadRefreshToken = sent;
           if (account.refreshToken !== sent) {
-            console.log(`[TeamClaude] Account "${account.name}" received new tokens while its old refresh token was being rejected — keeping the new ones`);
+            console.log(`[TeamClaude] Account "${safeLine(account.name, 64)}" received new tokens while its old refresh token was being rejected — keeping the new ones`);
             return;
           }
           account.status = 'error';
-          console.error(`[TeamClaude] Account "${account.name}" needs re-login (refresh token rejected) — run: teamclaude login`);
+          console.error(`[TeamClaude] Account "${safeLine(account.name, 64)}" needs re-login (refresh token rejected) — run: teamclaude login`);
         }
       } finally {
         account._refreshPromise = null;
@@ -3872,7 +3930,7 @@ export class AccountManager {
     if (refreshToken) account.refreshToken = refreshToken;
     account.expiresAt = expiresAt;
     if (account.status === 'error') account.status = 'active';
-    console.log(`[TeamClaude] Updated tokens for account "${account.name}"`);
+    console.log(`[TeamClaude] Updated tokens for account "${safeLine(account.name, 64)}"`);
     this._onTokenRefresh?.(accountIndex, {
       accessToken,
       refreshToken: account.refreshToken,

package/src/codex-quota.js

@@ -67,6 +67,12 @@ function collectFamilies(headers) {
   return families;
 }
 
+/**
+ * One window reading: utilization as a 0-1 fraction, reset as ms epoch or null.
+ *
+ * @typedef {{utilization: number, resetAt: number|null}} QuotaWindow
+ */
+
 /**
  * Turn one family's windows into `{ fiveHour, weekly }` readings, keyed by the
  * window's own duration rather than its primary/secondary position.
@@ -74,8 +80,12 @@ function collectFamilies(headers) {
  * A window with no `window-minutes`, a zero duration, or an unparseable
  * utilization is dropped: a zeroed window is how this API says "not
  * applicable", and treating that as 0% used would look like full headroom.
+ *
+ * @param {Record<string, {usedPercent?: number, windowMinutes?: number, resetAt?: number}>} windows
+ * @returns {{fiveHour?: QuotaWindow, weekly?: QuotaWindow}}
  */
 function classify(windows) {
+  /** @type {{fiveHour?: QuotaWindow, weekly?: QuotaWindow}} */
   const out = {};
   for (const w of Object.values(windows)) {
     const minutes = Number(w.windowMinutes);
@@ -122,12 +132,19 @@ export function parseCodexQuota(headers) {
     if (account.weekly.resetAt) quota.unified7dReset = account.weekly.resetAt;
   }
 
-  // Model-scoped families. Their 5-hour window is not modelled separately —
-  // the manager scopes eligibility by weekly family buckets — so only the
-  // weekly reading is carried, alongside the name upstream gave it.
+  // Model-scoped families. Their weekly reading is the family bucket, carried
+  // alongside the name upstream gave it. Their 5-hour one is picked up below:
+  // on a subscription it is the only 5h this API ever states.
+  /** @type {QuotaWindow|null} */
+  let scopedFiveHour = null;
   for (const fam of families.values()) {
     if (!fam.slug) continue;
     const scoped = classify(fam.windows);
+    // Tightest wins, so the reading is taken before the weekly guard below
+    // drops a family that states a 5h window and no weekly one.
+    if (scoped.fiveHour && (!scopedFiveHour || scoped.fiveHour.utilization > scopedFiveHour.utilization)) {
+      scopedFiveHour = scoped.fiveHour;
+    }
     if (!scoped.weekly) continue;
     (quota.modelBuckets ??= []).push({
       slug: fam.slug,
@@ -137,6 +154,21 @@ export function parseCodexQuota(headers) {
     });
   }
 
+  // A subscription's account-wide family states no 5-hour window at all: it
+  // puts the 7-day one in `primary` and zeroes `secondary`, which classify()
+  // drops, correctly, because a zero-length window is how this API says "not
+  // applicable". The only 5h it states sits in a named family, and upstream
+  // returns the same one whatever model was asked for — it is the account's
+  // session window wearing a model's name. So fill the shared bucket from it
+  // when the account-wide family left it empty, and never overwrite a reading
+  // the account-wide family did give: a family bucket barring models it does
+  // not meter would be the one-way ratchet the weekly buckets take such care
+  // to avoid.
+  if (quota.unified5h == null && scopedFiveHour) {
+    quota.unified5h = scopedFiveHour.utilization;
+    if (scopedFiveHour.resetAt) quota.unified5hReset = scopedFiveHour.resetAt;
+  }
+
   return quota;
 }
 

package/src/codex-usage.js

@@ -34,6 +34,40 @@ function classify(rateLimit) {
   return { fiveHour, sevenDay };
 }
 
+/**
+ * Name each extra limit from the entry itself.
+ *
+ * A live subscription sends `additional_rate_limits` as a LIST whose entries
+ * name themselves (`metered_feature`, `limit_name`); older readings used an
+ * object keyed by the feature. `Object.entries` over a list hands back array
+ * indices, so every bucket was filed as "0" and "1" — two accounts' Spark
+ * limits collided under one meaningless key, and the header path's name for
+ * the same bucket stacked beside it rather than replacing it.
+ *
+ * `metered_feature` is that header name with a `codex_` prefix (`codex_bengalfox`
+ * here is `x-codex-bengalfox-*` there), so stripping it makes the two paths
+ * agree on one key per bucket.
+ *
+ * @param {any} additional
+ * @returns {Array<{slug: string, name: string, rateLimit: any}>}
+ */
+function additionalLimits(additional) {
+  if (Array.isArray(additional)) {
+    const out = [];
+    for (const entry of additional) {
+      if (!entry || typeof entry !== 'object') continue;
+      const feature = typeof entry.metered_feature === 'string' ? entry.metered_feature.replace(/^codex_/, '') : '';
+      const label = typeof entry.limit_name === 'string' ? entry.limit_name : '';
+      const slug = feature || label;
+      if (!slug) continue;
+      out.push({ slug, name: label || slug, rateLimit: entry.rate_limit || entry });
+    }
+    return out;
+  }
+  return Object.entries(additional || {})
+    .map(([key, value]) => ({ slug: key, name: key, rateLimit: value?.rate_limit || value }));
+}
+
 /**
  * Convert the private `/wham/usage` response into TeamClaude quota fields.
  *
@@ -43,19 +77,36 @@ export function normalizeCodexUsagePayload(data) {
   const rateLimit = data?.rate_limit || data?.rate_limits;
   const shared = classify(rateLimit);
   const modelBuckets = [];
-  for (const [name, value] of Object.entries(data?.additional_rate_limits || {})) {
-    const reading = classify(value?.rate_limit || value);
+  /** @type {{utilization: number, resetAt: number|null, seconds: number}|null} */
+  let extraFiveHour = null;
+  for (const { slug, name, rateLimit: extra } of additionalLimits(data?.additional_rate_limits)) {
+    const reading = classify(extra);
+    // Taken before the weekly guard below, so an extra limit stating a 5-hour
+    // window and no weekly one contributes its reading instead of being
+    // dropped whole. Tightest wins when several state one.
+    if (reading.fiveHour && (!extraFiveHour || reading.fiveHour.utilization > extraFiveHour.utilization)) {
+      extraFiveHour = reading.fiveHour;
+    }
     if (reading.sevenDay) {
       modelBuckets.push({
-        slug: name,
+        slug,
         name,
         utilization: reading.sevenDay.utilization,
         resetAt: reading.sevenDay.resetAt,
       });
     }
   }
+
+  // The shared `rate_limit` on a subscription states a 7-day window and a null
+  // secondary, so it yields no 5-hour reading; the only one the payload states
+  // sits in an extra limit. Fall back to that so the probe learns a session
+  // window at all, and never let it replace a shared reading: an extra limit
+  // meters the models it names, and one barring the rest would be the one-way
+  // ratchet the weekly buckets are written to avoid.
+  const fiveHour = shared.fiveHour || extraFiveHour;
+
   return {
-    fiveHour: shared.fiveHour && { utilization: shared.fiveHour.utilization, resetAt: shared.fiveHour.resetAt },
+    fiveHour: fiveHour && { utilization: fiveHour.utilization, resetAt: fiveHour.resetAt },
     sevenDay: shared.sevenDay && { utilization: shared.sevenDay.utilization, resetAt: shared.sevenDay.resetAt },
     modelBuckets,
     planType: data?.plan_type || null,

package/src/index.js

@@ -35,7 +35,7 @@ import { TUI } from './tui.js';
 import { SessionTitles } from './session-titles.js';
 import { RemoteControl, createAttachSession } from './tui-remote.js';
 import { SxManager } from './sx.js';
-import { autoUpdate, checkForUpdate, currentVersion, runUpdate, installKind, PKG_NAME } from './updater.js';
+import { autoUpdate, checkForUpdate, currentVersion, resolveVersionLabel, runUpdate, installKind, updateAvailableFromCache, PKG_NAME } from './updater.js';
 import { renderStatus, formatPercent } from './status-renderer.js';
 import { sanitizeText } from './safe-text.js';
 import { ClientUsageTracker, UsageDimensionTracker } from './client-usage.js';
@@ -382,6 +382,11 @@ async function serverCommand() {
   // disk while this process keeps running the old code, and status must report
   // what is running, not what is installed.
   const serverVersion = currentVersion();
+  // What the header names this build, and whether the last recorded check saw
+  // something newer. A checkout gets no update marker: autoUpdate refuses to
+  // npm-install over one, so offering it would advertise a declined action.
+  const { label: versionLabel, git: fromGit } = await resolveVersionLabel();
+  const updateAvailable = !fromGit && await updateAvailableFromCache({ current: serverVersion });
 
   // sx.org proxy (IP-based-429 workaround). Dormant unless an API key is set in
   // config.sx.apiKey; when set we provision a proxy and route upstream through it.
@@ -485,7 +490,7 @@ async function serverCommand() {
 
   if (useTUI) {
     tui = new TUI({
-      accountManager, config, sx, activityLogPath, sessionTitles, version: serverVersion,
+      accountManager, config, sx, activityLogPath, sessionTitles, versionLabel, updateAvailable,
       saveConfig: () => atomicConfigUpdate(async diskConfig => {
         diskConfig.accounts = mergeAccountsForSave(
           config.accounts, accountManager.accounts, diskConfig.accounts, removedAccountIds(config),
@@ -585,6 +590,8 @@ async function serverCommand() {
     usageDimensions: dimensionUsage.export(),
     server: {
       version: serverVersion,
+      versionLabel,
+      updateAvailable,
       startedAt: new Date(serverStartedAt).toISOString(),
       uptimeSeconds: Math.round((Date.now() - serverStartedAt) / 1000),
       port,

package/src/mitm.js

@@ -129,6 +129,11 @@ export function hostMode(host, config) {
   // Explicitly never intercepted, even though it sits under a provider's domain
   // — checked before anything else so no later rule can claim it.
   if (isNeverIntercepted(host)) return 'tunnel';
+  // In terminal-only mode the MITM must never terminate ChatGPT Desktop's
+  // connection. Terminal Codex uses the explicit /backend-api/codex base URL;
+  // this host-level bypass keeps Desktop's native auth and feature endpoints
+  // outside TeamClaude entirely.
+  if (config?.proxy?.terminalOnly === true && host === 'chatgpt.com') return 'tunnel';
   if (host === upstreamHostOf(config)) return 'rewrite';
   // A second provider's host, and only when an account actually uses that
   // provider. MITM is the mode that works without the client cooperating — a

package/src/provider.js

@@ -57,6 +57,9 @@ export const DEFAULT_PROVIDER = 'anthropic';
  * The provider an account belongs to. Accounts written before providers
  * existed have no `provider` field and are Anthropic, so the default keeps
  * every existing config working untouched.
+ *
+ * @param {Record<string, any>|null|undefined} account
+ * @returns {keyof typeof PROVIDERS}
  */
 export function providerOf(account) {
   const id = account?.provider;
@@ -247,6 +250,8 @@ export function rewritesBody(account) {
  *  program spells it differently. A loopback upstream says the same thing
  *  directly, and says it for a hand-started process too. A remote third-party
  *  backend (DeepSeek, GLM) keeps a public host and is not caught.
+ *
+ * @param {any} account
  */
 export function isLocalUpstream(account) {
   if (!account?.upstream) return false;

package/src/server.js

@@ -12,7 +12,7 @@ import { parseRequestModel, parseAdvisorModel } from './account-manager.js';
 import { TopLevelFieldFinder, modelGlobMatches } from './model.js';
 import { BodyWriter, truncationNote } from './request-log.js';
 import { upstreamFetch, upstreamPoolStatus } from './upstream-fetch.js';
-import { applyAuthHeaders, upstreamFor, rewritesBody, providerForPath, providerOf, isSubscriptionAccount, holdsConnection, DEFAULT_PROVIDER } from './provider.js';
+import { applyAuthHeaders, upstreamFor, rewritesBody, providerForPath, providerOf, isSubscriptionAccount, holdsConnection, DEFAULT_PROVIDER, PROVIDERS } from './provider.js';
 import { tunnelTls } from './sx.js';
 import { createEgressGuard } from './egress-guard.js';
 import { safeLine } from './safe-text.js';
@@ -1111,7 +1111,7 @@ export function createProxyRequestListener({ accountManager, upstream, logDir =
         // socket itself on a dead stream, so a clientGone check at this point
         // would reclassify the worst failure as "the user left".
         accountManager.endSession(sessionId,
-          !isCompletionPath(req.url) ? null : (ctx.delivered ? true : (ctx.abandoned ? null : false)));
+          !isCompletionPath(classificationPath(req.url)) ? null : (ctx.delivered ? true : (ctx.abandoned ? null : false)));
         // Cleared BEFORE the hook, because the hook can throw: leaving the entry
         // marked open would send the outer catch to call that same throwing hook
         // a second time for one request.
@@ -1216,7 +1216,9 @@ function isCompletionPath(url) {
 // a stale streak, and one the proxy refuses to send at all (egress unpinned)
 // must still count as getting nothing.
 function recordEarlyOutcome(accountManager, sessionId, url, usable) {
-  if (sessionId && isCompletionPath(url)) accountManager.recordOutcome(sessionId, usable);
+  // On the classification path, like every other decision here: `\v1\messages`
+  // goes out as `/v1/messages` and is a completion for the streak too (#377).
+  if (sessionId && isCompletionPath(classificationPath(url))) accountManager.recordOutcome(sessionId, usable);
 }
 
 /**
@@ -2160,6 +2162,38 @@ export async function forwardRequest(req, res, body, accountManager, upstream, r
   const upstreamUrl = `${upstreamFor(account, upstream)}${req.url}`;
   const method = req.method;
 
+  // An upstream that keeps no thread state would receive only this turn's delta
+  // and answer it as the whole conversation. Refusing makes the client resend
+  // the full history (see refusesThreadContinue). Placed before admit() so the
+  // early return holds no concurrency slot, and after recordSession so the
+  // resend that follows lands on this same account and reuses its cache.
+  if (refusesThreadContinue(body, account, req.url) && !res.headersSent && !clientGone(res)) {
+    ctx.status = 400;
+    ctx.delivered = true;   // a 4xx IS an answer — see answeredStatus
+    // Said once per account: the client stops sending threads for that model
+    // after the first refusal, so a line per refusal would be a line per model,
+    // not per turn — and an operator watching tokens rise needs to find this.
+    // The flag lives on the account so a reload clears it with the setting it
+    // reports on (see syncAccountsFromDisk).
+    if (!account.threadRefusalReported) {
+      account.threadRefusalReported = true;
+      console.error(`[TeamClaude] ${safeLine(account.name, 64)}: refusing message-thread continues (this upstream keeps no thread state; set "messageThreads": true if it does)`);
+    }
+    res.writeHead(400, { 'Content-Type': 'application/json', 'x-should-retry': 'false' });
+    res.end(JSON.stringify({
+      type: 'error',
+      error: {
+        type: 'invalid_request_error',
+        message: 'thread: this upstream does not keep thread state; resend the conversation',
+        // Read by the client as "stop threading this model for the session"
+        // rather than "retry this one turn", which is the difference between
+        // one refusal and one per turn.
+        details: { error_code: 'thread_unsupported_request' },
+      },
+    }));
+    return;
+  }
+
   // Every rewrite below runs inside rewriteRequestBody (exported for tests);
   // Content-Length is refreshed below because the body can shrink.
   let sendBody = rewriteRequestBody(body, account, req.url, req.headers['content-type']);
@@ -2969,6 +3003,78 @@ export function rewriteRequestBody(body, account, url, contentType) {
   return sendBody;
 }
 
+// A continue must carry both of these exact JSON substrings, so a Buffer scan
+// skips the parse for any body missing either. Necessary, not sufficient: a
+// create whose message text is the word "continue" carries both as well and
+// gets parsed for nothing. The parse below is what decides.
+const THREAD_MARKER = Buffer.from('"thread"');
+const CONTINUE_MARKER = Buffer.from('"continue"');
+
+/**
+ * Whether an `upstream` names Anthropic itself — a region pin or a mirror rather
+ * than a different backend. Those reach the real thread store, so refusing their
+ * continues would be overhead the operator has to discover and opt out of by
+ * hand. The HOST decides: a third-party API serving the Anthropic shape does it
+ * under its own host, usually with a path prefix.
+ *
+ * @param {unknown} upstream
+ */
+function pointsAtAnthropic(upstream) {
+  try {
+    return new URL(String(upstream)).hostname === new URL(PROVIDERS.anthropic.upstream).hostname;
+  } catch {
+    return false; // unparseable is not evidence of a thread store
+  }
+}
+
+/**
+ * Whether a request must be refused instead of forwarded, because it continues
+ * an Anthropic message thread on an upstream that keeps no thread state.
+ *
+ * Claude Code stores the conversation on Anthropic's side once a thread exists:
+ * the first /v1/messages body carries thread:{type:"create"} with the whole
+ * messages array, later ones thread:{type:"continue"} with only the new delta.
+ * A third-party upstream ignores the unknown field and answers the delta alone,
+ * so from the second turn on the model no longer sees the conversation — with
+ * no error anywhere. Anthropic itself answers 400 when a thread cannot be
+ * continued, and the client reacts by resending the whole conversation, so
+ * refusing here is what puts the upstream back on a complete one.
+ *
+ * The body carries `details.error_code: "thread_unsupported_request"`, which the
+ * client reads as "this model keeps no thread state": it resends the turn in
+ * full and then drops the `thread` field entirely for the rest of the session,
+ * so the refusals are counted per agent and model rather than per turn, and cost
+ * no tokens. A relay that does reach Anthropic keeps working threads and opts
+ * out with `messageThreads: true`.
+ *
+ * Exported for tests.
+ *
+ * @param {Buffer|null|undefined} body fully-buffered request body
+ * @param {Record<string, any>|null|undefined} account the account about to serve it
+ * @param {string|undefined} url req.url
+ * @returns {boolean}
+ */
+export function refusesThreadContinue(body, account, url) {
+  if (!account?.upstream || !rewritesBody(account)) return false;
+  if (account.messageThreads) return false;
+  if (!Buffer.isBuffer(body) || body.length === 0) return false;
+  // Only a completion continues a thread. count_tokens carries a body of the
+  // same shape, and a refusal there is unrecoverable — there is no conversation
+  // to resend for a token count. Classified on the folded, once-decoded path
+  // like every other refusal here: `\v1\messages` is what this process itself
+  // will send as `/v1/messages`, so the test has to read it the same way.
+  if (!isCompletionPath(classificationPath(url))) return false;
+  if (!body.includes(THREAD_MARKER) || !body.includes(CONTINUE_MARKER)) return false;
+  // Last of the cheap gates because it parses two URLs: by here the request is
+  // already known to be a completion whose body could carry a continue.
+  if (pointsAtAnthropic(account.upstream)) return false;
+  try {
+    return JSON.parse(body.toString('utf8'))?.thread?.type === 'continue';
+  } catch {
+    return false; // not JSON we can reason about — never break it
+  }
+}
+
 // Remove top-level fields from a JSON request body (see stripRequestFields).
 // Returns the original buffer when nothing changed or the body isn't JSON, so
 // non-messages endpoints pass through untouched. Exported for tests.

package/src/sync-accounts.js

@@ -1,5 +1,6 @@
 import { importCredentials } from './oauth.js';
 import { sameIdentity } from './identity.js';
+import { safeLine } from './safe-text.js';
 import { ensureAccountIds } from './account-id.js';
 import { normalizeHeadersTimeoutMs } from './account-manager.js';
 
@@ -102,8 +103,20 @@ export async function syncAccountsFromDisk(diskConfig, memConfig, accountManager
     // disk edit must land here to take effect on reload. `|| null` mirrors the
     // constructor's normalization, letting a removal on disk revert the account
     // to the fleet default instead of sticking on the old value.
+    // Re-arm the one-shot operator line whenever either input it reports on
+    // changes — the setting, or the upstream it was reported for. An operator
+    // who takes `messageThreads` back off, or who moves the account to a
+    // different backend, needs to be told again that continues are refused;
+    // otherwise their only signal stays silent. Read before the assignments
+    // below, which are what it compares against.
+    if (mgr.upstream !== (diskAcct.upstream || null)
+      || mgr.messageThreads !== (diskAcct.messageThreads === true)) mgr.threadRefusalReported = false;
     mgr.upstream = diskAcct.upstream || null;
     mgr.modelMap = diskAcct.modelMap || null;
+    // Read per request like the two above (server.js rewriteRequestBody), and
+    // missing from this sync until #374: an edit waited for a restart.
+    mgr.stripRequestFields = diskAcct.stripRequestFields || null;
+    mgr.messageThreads = diskAcct.messageThreads === true;
     // Same per-request read (`account.headersTimeoutMs` in forwardRequest);
     // same normalization as the constructor, so a removed or invalid disk value
     // reverts to the fleet default.
@@ -117,6 +130,8 @@ export async function syncAccountsFromDisk(diskConfig, memConfig, accountManager
     if (cfgAcct) {
       if (diskAcct.upstream) cfgAcct.upstream = diskAcct.upstream; else delete cfgAcct.upstream;
       if (diskAcct.modelMap) cfgAcct.modelMap = diskAcct.modelMap; else delete cfgAcct.modelMap;
+      if (diskAcct.stripRequestFields) cfgAcct.stripRequestFields = diskAcct.stripRequestFields; else delete cfgAcct.stripRequestFields;
+      if (diskAcct.messageThreads === true) cfgAcct.messageThreads = true; else delete cfgAcct.messageThreads;
       if (diskAcct.maxUsage != null) cfgAcct.maxUsage = diskAcct.maxUsage; else delete cfgAcct.maxUsage;
       if (diskAcct.headersTimeoutMs != null) cfgAcct.headersTimeoutMs = diskAcct.headersTimeoutMs; else delete cfgAcct.headersTimeoutMs;
     }
@@ -132,7 +147,7 @@ export async function syncAccountsFromDisk(diskConfig, memConfig, accountManager
         const creds = await importCredentials(diskAcct.importFrom);
         freshCred = { accessToken: creds.accessToken, refreshToken: creds.refreshToken, expiresAt: creds.expiresAt };
       } catch (/** @type {any} */ err) {
-        console.error(`[TeamClaude] Re-import failed for "${diskAcct.name}": ${err.message}`);
+        console.error(`[TeamClaude] Re-import failed for "${safeLine(diskAcct.name, 64)}": ${err.message}`);
       }
     } else if (diskAcct.type === 'oauth' && diskAcct.accessToken) {
       freshCred = { accessToken: diskAcct.accessToken, refreshToken: diskAcct.refreshToken, expiresAt: diskAcct.expiresAt };
@@ -151,12 +166,12 @@ export async function syncAccountsFromDisk(diskConfig, memConfig, accountManager
         freshCred.expiresAt < mgr.expiresAt;
       if (changed && !diskIsStaler) {
         accountManager.updateAccountTokens(mgr.index, freshCred);
-        console.log(`[TeamClaude] Refreshed credentials for "${mgr.name}"`);
+        console.log(`[TeamClaude] Refreshed credentials for "${safeLine(mgr.name, 64)}"`);
       }
     } else if (freshCred.apiKey && mgr.credential !== freshCred.apiKey) {
       mgr.credential = freshCred.apiKey;
       if (mgr.status === 'error') mgr.status = 'active';
-      console.log(`[TeamClaude] Updated API key for "${mgr.name}"`);
+      console.log(`[TeamClaude] Updated API key for "${safeLine(mgr.name, 64)}"`);
     }
   }
   return added;

package/src/tui-remote.js

@@ -25,6 +25,7 @@ const text = (value, max, fallback = '') => {
   return safeLine(value, max) || fallback;
 };
 const NAME_MAX = 64;
+const LABEL_MAX = 32;
 
 // Addresses that reach this machine. A server bound to one of these exempts
 // loopback clients from the proxy-key gate, which changes what a 401 can mean.
@@ -198,6 +199,10 @@ export class RemoteAccountManager {
     this.connected = false;   // false ⇒ the view is a stale snapshot
     this.lastError = null;
     this.status = null;
+    // Empty until the first poll, so the header shows no version rather than
+    // this process's own — in attach mode that would name the wrong machine.
+    this.versionLabel = '';
+    this.updateAvailable = false;
   }
 
   /** Per-bucket threshold lookup, mirroring AccountManager.thresholdFor so the
@@ -271,6 +276,10 @@ export class RemoteAccountManager {
           eligible: !!a?.eligible,
         })),
     }));
+    // A server too old to send versionLabel still sends version; one older than
+    // both leaves the label empty and the header simply omits it.
+    this.versionLabel = text(status?.server?.versionLabel ?? status?.server?.version, LABEL_MAX);
+    this.updateAvailable = !!status?.server?.updateAvailable;
     // Conduit lines read this. Clamped like every other remote field: the
     // payload is a server's word, not ours, and it reaches a rendered line.
     this.sidecars = (Array.isArray(status?.sidecars) ? status.sidecars : []).map(sc => ({

package/src/tui.js

@@ -9,6 +9,7 @@ import {
   oauthIdentityFields,
 } from './identity.js';
 import { configIndexFor, managerAccountFor, markAccountRemoved } from './account-pairing.js';
+import { PROVIDERS, providerOf } from './provider.js';
 import { mintAccountId } from './account-id.js';
 import { formatPercent } from './status-renderer.js';
 import { resolveMaxUsage } from './model.js';
@@ -212,6 +213,11 @@ const BAR_MAX = 20;
 // terminal lays the table out exactly as it did before the column could grow.
 const NAME_MIN = 12;
 
+// Clear space the centred version label needs on each side before it is drawn
+// at all. Below that it reads as a collision with the title or the port block,
+// so the whole label is dropped rather than squeezed.
+const HEAD_GAP = 2;
+
 // Which pair of bars a row draws: the subscription buckets (Ses/Wk, plus the
 // S7/F7 family bars) when any unified reading exists, else the metered Tok/Req
 // pair an API-key account reports. The account row budget is drawn per
@@ -418,10 +424,10 @@ export class TUI {
     // Names the activity column against the session id the client sent. Absent
     // or disabled leaves every row showing the short id.
     sessionTitles = null,
-    // Shown faint beside the title. Null in attach mode, where the dashboard is
-    // built before the first poll and the server's version is not yet known,
-    // and in tests — both render the title alone rather than a stray `null`.
-    version = null }) {
+    // How the header names this build, and whether a newer release is known.
+    // In attach mode the account manager carries the server's own answer and
+    // these are unused; the empty defaults keep the label hidden until it does.
+    versionLabel = '', updateAvailable = false }) {
     this.am = accountManager;
     this.remote = remote;
     this.applySwitch = applySwitch;
@@ -438,7 +444,8 @@ export class TUI {
     this._readProfile = readProfile;
     this._activityStream = null;
     this.sessionTitles = sessionTitles;
-    /** @type {string|null} */ this.version = version;
+    this.versionLabel = versionLabel;
+    this.updateAvailable = updateAvailable;
 
     this.log = [];           // completed activity entries
     this.active = new Map(); // in-flight requests
@@ -494,6 +501,18 @@ export class TUI {
   start() {
     this.running = true;
     this._openActivityLog();
+    // Node puts a TTY stdout in BLOCKING mode, so every paint is a synchronous
+    // write(2) that returns only when the terminal has drained the pty. That
+    // makes the proxy's event loop hostage to its own display: when the
+    // terminal emulator pauses — an Electron pane busy elsewhere, a window
+    // occluded, the machine dozing — the write sits in the kernel and nothing
+    // else runs: no upstream bytes relayed, no request completed, no log line.
+    // Measured live: stalls of 5-29s, the main thread in write() under
+    // StreamBase::WriteString, with sessions "waiting for API response" and
+    // nothing to see anywhere because the thing that would show it is the
+    // thing blocked. Non-blocking here, and the paint below drops a frame
+    // when the terminal is behind instead of waiting for it.
+    this._setStdoutBlocking(false);
     process.stdout.write(`${ESC}?1049h${ESC}?25l`);
     process.stdin.setRawMode(true);
     process.stdin.resume();
@@ -550,6 +569,12 @@ export class TUI {
     if (this._activityStream) { this._activityStream.end(); this._activityStream = null; }
     process.stdin.removeListener('data', this._dataHandler);
     process.stdout.removeListener('resize', this._resizeHandler);
+    if (this._drainHandler) { process.stdout.removeListener('drain', this._drainHandler); this._drainHandler = null; }
+    // Blocking again for the exit sequence: a non-blocking write can still be
+    // queued when the process exits, and a terminal left on the alternate
+    // screen with no cursor is the one state an operator cannot recover
+    // without knowing the escape by heart.
+    this._setStdoutBlocking(true);
     process.stdout.write(`${ESC}?25h${ESC}?1049l`);
     try { process.stdin.setRawMode(false); } catch {}
     process.stdin.pause();
@@ -1361,11 +1386,36 @@ export class TUI {
   _paint(buf, force) {
     const stale = Date.now() - (this._lastPaintAt || 0) >= FORCE_REPAINT_MS;
     if (!force && !stale && buf === this._lastFrame) return;
+    // The terminal has not taken the previous frame yet. Painting anyway would
+    // only queue another full screen behind it — the operator sees the newest
+    // frame either way, so the one in between is worth nothing. Drop it, and
+    // paint what is current once the terminal catches up.
+    if (process.stdout.writableNeedDrain) {
+      this._pendingPaint = true;
+      if (!this._drainHandler) {
+        this._drainHandler = () => {
+          this._drainHandler = null;
+          if (this._pendingPaint && this.running) { this._pendingPaint = false; this.render({ force: true }); }
+        };
+        process.stdout.once('drain', this._drainHandler);
+      }
+      return;
+    }
+    this._pendingPaint = false;
     this._lastFrame = buf;
     this._lastPaintAt = Date.now();
     process.stdout.write(buf);
   }
 
+  /** Flip stdout between blocking and non-blocking. A handle without the
+   *  method (a pipe in tests, a file) needs neither, and a failure to flip is
+   *  worth no more than the old behaviour it leaves in place.
+   *  @param {boolean} blocking */
+  _setStdoutBlocking(blocking) {
+    // `_handle` is Node-internal and untyped; the optional chain is the guard.
+    try { /** @type {any} */ (process.stdout)._handle?.setBlocking?.(blocking); } catch {}
+  }
+
   _render(force = false) {
     // Reset the display the instant a quota window (e.g. 5-hour session) expires,
     // instead of waiting for the next request to clear it.
@@ -1381,7 +1431,7 @@ export class TUI {
     const lines = [];
 
     // ── Header
-    const left = bold(' RikClaude Harness') + (this.version ? dim(` ${this.version}`) : '');
+    const left = bold(' RikClaude Harness');
     const port = this.config.proxy?.port || 3456;
     const sess = this.am.sessionStats();
     const sessStr = (sess.active || sess.known)
@@ -1393,7 +1443,26 @@ export class TUI {
     // mode): what is on screen is the last snapshot, not the current state.
     const live = this.am.connected === false ? red('▼') : green('▲');
     const right = `${sessStr}Port ${port} ${live} `;
-    lines.push(left + ' '.repeat(Math.max(1, W - vw(left) - vw(right))) + right);
+    // In attach mode the dashboard names the server's build, not this process's,
+    // so the account manager's answer wins. It arrives sanitized (applyStatus)
+    // and starts empty, which keeps the label hidden until the first poll rather
+    // than briefly showing the local checkout's version as if it were the
+    // server's. A local AccountManager has neither property.
+    const label = this.am.versionLabel ?? this.versionLabel;
+    const upd = this.am.updateAvailable ?? this.updateAvailable;
+    const mid = label ? dim(label) + (upd ? ` ${green('▲')}` : '') : '';
+    const lw = vw(left), rw = vw(right), mw = vw(mid);
+    // Centred on the line, not in the gap between the two blocks, so the label
+    // holds still as the session segment comes and goes.
+    const start = Math.floor((W - mw) / 2);
+    // Load-bearing, not cosmetic: both padding runs below would be negative
+    // without it, and ' '.repeat(-1) throws. Satisfying it also means the mid
+    // branch can never produce the over-wide line the other branch can, so the
+    // two are not interchangeable.
+    const midFits = mw > 0 && start - lw >= HEAD_GAP && (W - rw) - (start + mw) >= HEAD_GAP;
+    lines.push(midFits
+      ? left + ' '.repeat(start - lw) + mid + ' '.repeat(W - rw - start - mw) + right
+      : left + ' '.repeat(Math.max(1, W - lw - rw)) + right);
     lines.push(' ' + dim('─'.repeat(W - 2)));
 
     const footerH = 2;
@@ -1592,13 +1661,13 @@ export class TUI {
    */
   _displayOrder() {
     return this.am.accounts
-      .map((_, i) => i)
+      .map((/** @type {any} */ _, /** @type {number} */ i) => i)
       .filter(i => !isLocalUpstream(this.am.accounts[i]));
   }
 
   /** Manager indices of the local backends, in config order. */
   _conduitOrder() {
-    return this.am.accounts.map((_, i) => i).filter(i => isLocalUpstream(this.am.accounts[i]));
+    return this.am.accounts.map((/** @type {any} */ _, /** @type {number} */ i) => i).filter(i => isLocalUpstream(this.am.accounts[i]));
   }
 
   /** One line per local backend: what it is, where it sends, and whether it can
@@ -1687,8 +1756,18 @@ export class TUI {
     const rawName = rpad(truncate(a.name, nameW), nameW);
     const name = isSel ? bold(rawName) : rawName;
 
-    // Type
-    const type = gray(a.type.padEnd(7));
+    // Type — or the provider, once the pool serves more than one.
+    //
+    // One person's ChatGPT and Claude subscriptions are usually the same email, so a
+    // mixed pool lists that address twice and the name column cannot tell the two rows
+    // apart. `oauth` repeated down every row is what the column says instead, which the
+    // operator already knew. Width follows the labels actually present, so nothing is
+    // truncated and a single-provider pool keeps the column it has today.
+    /** @type {Set<keyof typeof PROVIDERS>} */
+    const pooled = new Set(this.am.accounts.map(providerOf));
+    const mixed = pooled.size > 1;
+    const typeW = mixed ? Math.max(...[...pooled].map(id => PROVIDERS[id].label.length)) : 7;
+    const type = gray((mixed ? PROVIDERS[providerOf(a)].label : a.type).padEnd(typeW));
 
     // Status — a disabled account is shown as such regardless of its quota state.
     let status;

package/src/updater.js

@@ -15,11 +15,18 @@ import { existsSync, readFileSync } from 'node:fs';
 import { readFile, writeFile } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 import { dirname, join, resolve } from 'node:path';
+import { promisify } from 'node:util';
 import { getConfigPath } from './config.js';
+import { safeLine } from './safe-text.js';
 
 export const PKG_NAME = '@rikcodes/teamclaude'; // fork: self-updates track this scope, never upstream's
 const REGISTRY = 'https://registry.npmjs.org';
 const DAY_MS = 24 * 60 * 60 * 1000;
+// Wide enough for `v1.2.3-rc.1+build`, narrow enough that a tag cannot be the
+// reason a fixed-width caller has no room left.
+const LABEL_MAX = 32;
+
+const pexec = promisify(execFile);
 
 /** Package root = one directory above this file's src/ directory. */
 function packageRoot() {
@@ -35,6 +42,37 @@ export function currentVersion(root = packageRoot()) {
   }
 }
 
+/**
+ * How the running copy identifies itself, for display: the exact tag when the
+ * checkout sits on one, else the short sha, else the shipped package.json
+ * version, else the literal `local`. `git` reports a checkout — npm cannot
+ * update one, so nothing should offer to.
+ *
+ * The git calls are pinned to the package root. `teamclaude server` is started
+ * from the operator's own project directory, and resolving against the process
+ * cwd would report that repository's sha as this package's version.
+ *
+ * @param {Object} [opts]
+ * @param {string} [opts.root]
+ * @param {(file: string, args: string[], options: { cwd: string, encoding: 'utf8', timeout: number }) => Promise<{ stdout: string }>} [opts.exec]
+ * @returns {Promise<{ label: string, git: boolean }>}
+ */
+export async function resolveVersionLabel({ root = packageRoot(), exec = pexec } = {}) {
+  const git = existsSync(join(root, '.git'));
+  if (git) {
+    /** @type {{ cwd: string, encoding: 'utf8', timeout: number }} */
+    const opts = { cwd: root, encoding: 'utf8', timeout: 2000 };
+    const probes = [['describe', '--tags', '--exact-match', 'HEAD'], ['rev-parse', '--short', 'HEAD']];
+    for (const args of probes) {
+      try {
+        const label = safeLine((await exec('git', args, opts)).stdout, LABEL_MAX);
+        if (label) return { label, git };
+      } catch { /* not on a tag, a shallow or broken checkout, or no git binary */ }
+    }
+  }
+  return { label: safeLine(currentVersion(root) || 'local', LABEL_MAX), git };
+}
+
 /** Numeric compare of x.y.z, then the pre-release tail. >0 if a is newer.
  *  The tail matters here: this fork versions releases as X.Y.Z-rik.N on the
  *  same upstream base, so ignoring it would make every -rik.N publish compare
@@ -157,6 +195,22 @@ export async function checkForUpdate({
   return { current, latest, updateAvailable: compareVersions(latest, current) > 0 };
 }
 
+/**
+ * Whether the last recorded check saw a newer release. Cache only — never the
+ * registry — so a caller on a render or status path costs nothing. Like
+ * `checkForUpdate`, the cached `latest` is used regardless of its age.
+ *
+ * @param {Object} [opts]
+ * @param {string|null} [opts.current]
+ * @param {string} [opts.cachePath]
+ * @returns {Promise<boolean>}
+ */
+export async function updateAvailableFromCache({ current = currentVersion(), cachePath = defaultCacheFile() } = {}) {
+  if (!current) return false;
+  const { latest } = await readCache(cachePath);
+  return !!latest && compareVersions(latest, current) > 0;
+}
+
 /**
  * Whether `v` is a plain release version, the only shape we ever pass to npm.
  *