maxpool 1.1.0 → 1.3.0

package/README.md

@@ -58,13 +58,6 @@ maxpool server
 maxpool run
 ```
 
-You can also import existing Claude Code credentials instead of logging in:
-
-```bash
-claude /login           # Log into an account in Claude Code
-maxpool import       # Import its credentials
-```
-
 ## Recommended setup
 
 The cleanest way to use maxpool day-to-day: **keep your normal `claude` login untouched, and add a separate alias that routes through the pool.** Then plain `claude` still uses your default single account, and `ccmax` (call it whatever you like) spreads work across all your accounts.
@@ -121,20 +114,7 @@ Uses the same OAuth flow as Claude Code. Auto-detects the account email and subs
 
 You can add accounts while the server is running — press **s** in the TUI to sync immediately, or wait for automatic sync.
 
-### Import from Claude Code
-
-If you already have Claude Code set up, you can import its credentials directly:
-
-```bash
-claude /login           # Log into an account in Claude Code
-maxpool import       # Import its credentials
-```
-
-Re-importing the same account updates its credentials. You can also import from a custom path:
-
-```bash
-maxpool import --from /path/to/credentials.json
-```
+> **Note on adding accounts:** OAuth login adds whatever account you're currently signed into at claude.ai — there's no account picker. To add a *different* account, sign into that account at claude.ai first (or use a logged-out / incognito browser window), then run `maxpool login`. (Importing the Claude Code CLI's own local login was removed — it shares a single-use credential the CLI keeps rotating, which broke the pooled copy. Use browser login so maxpool holds its own independent grant.)
 
 ### API Key
 
@@ -175,8 +155,7 @@ The Accounts menu (`a`) lets you add and manage accounts without leaving the TUI
 
 | Key | Action |
 |-----|--------|
-| `i` | Import the account you're currently logged into Claude Code as |
-| `l` | Log in via browser — add *any* account, then name it |
+| `l` | Log in via browser — add an account, then name it |
 | `k` | Add an Anthropic API key account |
 | `n` | Rename the selected account |
 | `t` | Enable or disable the selected account |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-config.js

@@ -1,24 +1,14 @@
-import { importCredentials } from './oauth.js';
-
 export async function resolveAccounts(config) {
   const accounts = [];
   for (const acct of config.accounts) {
     if (acct.type === 'oauth') {
-      if (acct.importFrom) {
-        try {
-          const creds = await importCredentials(acct.importFrom);
-          accounts.push({ ...acct, ...creds });
-          console.log(`Imported "${acct.name}" from ${acct.importFrom}`);
-        } catch (err) {
-          console.error(`Failed to import "${acct.name}": ${err.message}`);
-          // Fall back to a previously-stored token rather than dropping the
-          // account entirely when the import source is unreadable.
-          if (acct.accessToken) accounts.push(acct);
-        }
-      } else if (acct.accessToken) {
+      // Legacy import-sourced accounts keep their stored token (the file/Keychain
+      // re-import was removed — it snapshotted a credential other clients rotate,
+      // which bricked accounts). Re-add via `maxpool login` for an independent grant.
+      if (acct.accessToken) {
         accounts.push(acct);
       } else {
-        console.error(`No token for "${acct.name}", skipping`);
+        console.error(`No token for "${acct.name}", skipping — re-add it with: maxpool login`);
       }
     } else if (acct.type === 'apikey' && acct.apiKey) {
       accounts.push(acct);

package/src/account-manager.js

@@ -1,5 +1,14 @@
 import { refreshAccessToken, isTokenExpiringSoon } from './oauth.js';
 
+// Bounded re-poll hold for an account blocked ONLY by a transient, self-clearing
+// condition whose exact recovery time is unknown: (a) a weekly-critical account
+// (last-resort usable, no learned reset), or (b) an otherwise-healthy account at
+// its in-flight / global concurrency cap (a sibling completing frees a slot in
+// seconds). Both are recoverable by definition, so they must HOLD finite and let
+// waitForAvailableRoute's poll loop re-check real availability — never collapse to
+// an Infinity session-kill / error-fast.
+const BOUNDED_REPOLL_HOLD_MS = 60_000;
+
 function emptyQuota() {
   return {
     // Standard API rate limits (API key accounts)
@@ -34,14 +43,20 @@ const DEFAULT_SCHEDULER = {
   weeklyCriticalThreshold: 0.95,
   weeklyExhaustedThreshold: 0.985,
   weeklyBurnDebtWeight: 0.6,
-  // Routing-cost tuning (lower cost = preferred). Quota scarcity is the primary
-  // signal; recent-load spread breaks ties between equally-scarce accounts so
-  // sequential traffic rotates instead of funnelling onto one account.
-  scarcityWeight: 6,          // multiplies quota scarcity (pace overage, 0..~1)
-  spreadShareWeight: 3,       // multiplies an account's share of recent fleet load (0..1)
-  recoveryRampWeight: 4,      // decaying penalty applied to a just-recovered account
-  recoveryRampMs: 5 * 60_000, // how long the post-recovery ramp lasts
-  spreadWindowMs: 15 * 60_000,// rolling window used to measure recent per-account load
+  // Routing-cost tuning (lower cost = preferred). The goal is to AVOID
+  // short-term (rate/concurrency) throttling by spreading load across healthy
+  // accounts. So in-flight concurrency is the DOMINANT term, with a steep
+  // per-account soft cap; burn-pace is only a soft de-preference (never a
+  // bench); quota "use-it-or-lose-it" is intentionally a minor signal here.
+  concurrencyWeight: 2,            // multiplies in-flight load (activeWeight+reqWeight) — dominant
+  perAccountConcurrencyTarget: 3,  // D: soft per-account in-flight target; past it, capPenalty bites
+  capPenaltyWeight: 10,            // steep penalty per unit of in-flight depth past D (throttle safety floor)
+  paceCostWeight: 1.5,            // soft de-preference of accounts burning ahead of pace (was the ×6 term)
+  scarcityWeight: 6,              // legacy; superseded by paceCostWeight (kept so old configs don't error)
+  spreadShareWeight: 3,           // multiplies an account's share of recent fleet load (0..1)
+  recoveryRampWeight: 4,          // decaying penalty applied to a just-recovered account
+  recoveryRampMs: 5 * 60_000,     // how long the post-recovery ramp lasts
+  spreadWindowMs: 15 * 60_000,    // rolling window used to measure recent per-account load
 };
 const LOAD_EVENT_MAX_AGE_MS = 60 * 60 * 1000;
 const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
@@ -198,6 +213,8 @@ export class AccountManager {
     let soonestTemporary = Infinity;
     let temporaryCause = null;
     let soonestWeekly = Infinity;
+    let soonestBoundedHold = Infinity;    // recoverable-transient accounts (weekly-critical last-resort, or concurrency-capped): always a bounded re-poll (known short-term resets route through soonestTemporary instead)
+    let boundedHoldCause = null;
     let weeklyUnknownReset = 0; // weekly-exhausted accounts whose reset time we don't know yet
     let matchingRoutes = 0;
     const reasons = {};
@@ -228,7 +245,7 @@ export class AccountManager {
 
       const retry = this._retryInfo(account);
       note(retry.cause);
-      if (retry.cause === 'weekly_critical' && this._isAvailable(account, { allowWeeklyReserve: true, allowWeeklyCritical: true })) {
+      if (retry.weeklyCritical && this._isAvailable(account, { allowWeeklyReserve: true, allowWeeklyCritical: true })) {
         return {
           available: true,
           retryAfterMs: 0,
@@ -238,11 +255,27 @@ export class AccountManager {
         };
       }
       if (retry.queueable && retry.retryAt) {
+        // A known, soon short-term reset (5h cap / rate-limit / cooldown) — even on
+        // a weekly-critical account, this is the REAL near-term recovery time, so
+        // it holds here with the true cause rather than the distant weekly reset.
         const ms = retry.retryAt - Date.now();
         if (ms < soonestTemporary) {
           soonestTemporary = ms;
           temporaryCause = retry.cause;
         }
+      } else if (retry.weeklyCritical || retry.transientCap) {
+        // A recoverable-transient block with no queueable short-term reset — a
+        // weekly-critical account (last-resort usable) or an otherwise-healthy
+        // account at its concurrency cap. _retryInfo always reaches here with
+        // retryAt:null (a KNOWN short-term reset is queueable and routes through
+        // soonestTemporary above), so the hold is a bounded re-poll. Recoverable by
+        // definition — hold finite, never collapse to Infinity and KILL the session.
+        soonestBoundedHold = Math.min(soonestBoundedHold, BOUNDED_REPOLL_HOLD_MS);
+        // Label precedence: an account that is BOTH weekly-critical and short-term
+        // capped is fundamentally weekly_critical; concurrency_cap only labels the
+        // hold when no weekly-critical account contributed it.
+        if (retry.weeklyCritical) boundedHoldCause = 'weekly_critical';
+        else if (!boundedHoldCause) boundedHoldCause = 'concurrency_cap';
       } else if (retry.cause === 'weekly_exhausted' && retry.retryAt) {
         const ms = retry.retryAt - Date.now();
         if (ms < soonestWeekly) soonestWeekly = ms;
@@ -254,21 +287,24 @@ export class AccountManager {
       }
     }
 
-    if (Number.isFinite(soonestTemporary)) {
+    // Min-merge ALL THREE recovery buckets and emit the cause of the SOONEST one.
+    // A weekly-critical account is last-resort usable and frees when its
+    // short-term blocker clears (often ~minutes); a weekly-exhausted account is
+    // unusable until its full 7d reset. Picking any one bucket ahead of the others
+    // (the old temporary-then-weekly-then-critical order) could mask a sibling's
+    // sooner recovery behind a far reset — error-fasting a holdable request and
+    // emitting a misleading multi-day Retry-After.
+    const recoveries = [
+      { ms: soonestTemporary, cause: temporaryCause || 'temporary_unavailable' },
+      { ms: soonestWeekly, cause: 'weekly_exhausted' },
+      { ms: soonestBoundedHold, cause: boundedHoldCause || 'weekly_critical' },
+    ].filter(r => Number.isFinite(r.ms));
+    if (recoveries.length) {
+      const best = recoveries.reduce((a, b) => (b.ms < a.ms ? b : a));
       return {
         available: false,
-        retryAfterMs: Math.max(0, soonestTemporary),
-        cause: temporaryCause || 'temporary_unavailable',
-        reasons,
-        matchingRoutes,
-      };
-    }
-
-    if (Number.isFinite(soonestWeekly)) {
-      return {
-        available: false,
-        retryAfterMs: Math.max(0, soonestWeekly),
-        cause: 'weekly_exhausted',
+        retryAfterMs: Math.max(0, best.ms),
+        cause: best.cause,
         reasons,
         matchingRoutes,
       };
@@ -454,7 +490,10 @@ export class AccountManager {
     if (this.getGlobalInFlight() >= this.scheduler.safetyMaxGlobalActive) return false;
     if (account.status === 'exhausted' || account.status === 'error') return false;
     if (this._isSessionQuotaUnavailable(account)) return false;
-    const weeklyState = this._weeklyState(account);
+    // Gate on RAW weekly usage, not pace-adjusted: an account with real
+    // headroom (e.g. 69% used, resets in days) must stay in the healthy-spread
+    // pool even if it's burning fast. Pace is a soft SCORE cost, never a bench.
+    const weeklyState = this._weeklyRawState(account);
     if (weeklyState === 'exhausted') return false;
     if (weeklyState === 'critical' && !options.allowWeeklyCritical) return false;
     if (weeklyState === 'reserve' && !options.allowWeeklyReserve) return false;
@@ -610,9 +649,42 @@ export class AccountManager {
   // Register a waiter. Returns the ticket, or null if a backpressure limit
   // (maxConcurrentQueued / maxQueuedBytes) would be exceeded — the caller then
   // rejects the request with a "queue full" error instead of holding it.
+  // Evict any waiting ticket(s) for a session key, releasing their slot + bytes.
+  // A client timeout-retry opens a fresh request for the same session; this lets
+  // the retry SUPERSEDE its own ghost instead of leaving a dead ticket occupying
+  // a queue slot for up to the hold ceiling (the steady-state ghost-leak DoS).
+  _evictQueuedSession(sessionKey) {
+    if (!sessionKey) return;
+    const q = this.queueState;
+    for (let i = q.waiting.length - 1; i >= 0; i--) {
+      const t = q.waiting[i];
+      if (t.sessionKey !== sessionKey) continue;
+      // Only supersede a GHOST — a prior hold whose client connection is already
+      // gone (a timeout-retry of the SAME logical request). NEVER evict a LIVE
+      // concurrent sibling: a single Claude Code process fires concurrent
+      // requests under ONE session id (the main stream + the haiku title/summary
+      // call + parallel subagents), and evicting a live one orphans it for days.
+      // Catch a half-dead EPIPE ghost too: after a client RST the ServerResponse
+      // may not have flipped destroyed/writableEnded yet (it's noticed on the next
+      // write), but its underlying socket is already destroyed. A LIVE sibling has a
+      // live socket (socket.destroyed===false), so this never evicts one. (Mock-live
+      // res objects leave socket undefined → not dead.) Uses socket.destroyed only —
+      // a stable terminal signal — not the transient res.writable.
+      const dead = !t.res || t.res.destroyed || t.res.writableEnded
+        || t.res.socket?.destroyed === true;
+      if (!dead) continue;
+      if (t.requestInfo) t.requestInfo.queueTicket = null; // let its waiter exit fast
+      t.dead = true;
+      q.bytes = Math.max(0, q.bytes - (t.bytes || 0));
+      q.waiting.splice(i, 1);
+    }
+  }
+
   registerQueuedRequest(requestInfo = {}, opts = {}) {
     if (requestInfo.queueTicket) return requestInfo.queueTicket;
     this._reapStaleQueueHead();
+    const sessionKey = opts.sessionKey || requestInfo.sessionKey || null;
+    this._evictQueuedSession(sessionKey); // a retry supersedes its own DEAD prior hold
     const bytes = Math.max(0, Number(opts.bytes) || 0);
     const { maxConcurrentQueued, maxQueuedBytes } = opts;
     if (maxConcurrentQueued != null && this.queueState.waiting.length >= maxConcurrentQueued) return null;
@@ -623,10 +695,18 @@ export class AccountManager {
       queuedAt: Date.now(),
       bytes,
       deadlineAt: opts.deadlineAt || null,
+      sessionKey,
+      res: opts.res || null,
+      requestInfo,
     };
     this.queueState.waiting.push(ticket);
     this.queueState.bytes += bytes;
     requestInfo.queueTicket = ticket;
+    // Re-queuing CONSUMES any prior admission: a request that was admitted
+    // (ticket cleared, queueAdmitted=true) but then failed to acquire the freed
+    // slot (lost the race) must re-enter the FIFO as a fair waiter, NOT keep
+    // bypassing the fairness gate forever and starve everyone behind it.
+    requestInfo.queueAdmitted = false;
     return ticket;
   }
 
@@ -773,22 +853,80 @@ export class AccountManager {
   }
 
   _isNearQuota(account) {
+    // RAW weekly state (not pace): a raw-healthy account with real headroom is
+    // never treated as near-quota just because it's burning fast. Pace stays a
+    // soft cost in _scoreAccount only.
     return this._isSessionQuotaUnavailable(account)
-      || ['reserve', 'critical', 'exhausted'].includes(this._weeklyState(account));
+      || ['reserve', 'critical', 'exhausted'].includes(this._weeklyRawState(account));
   }
 
   _retryInfo(account) {
     const now = Date.now();
     const q = account.quota || {};
-    const weeklyState = this._weeklyState(account);
-    if (weeklyState === 'critical') {
-      return { cause: 'weekly_critical', retryAt: q.unified7dReset || null, queueable: false };
-    }
+
+    // TERMINAL (non-recoverable) states FIRST — before any weekly/short-term
+    // bucket. An auth-dead / disabled / exhausted-status account is NOT
+    // recoverable-by-definition: it must error-fast (retryAt:null, no weeklyCritical
+    // tag → Infinity → 429), and a stale critical/exhausted QUOTA reading must never
+    // shadow that into a finite hold that spins the session for up to 7 days.
+    if (!account.enabled) return { cause: 'disabled', retryAt: null, queueable: false };
+    if (account.status === 'error') return { cause: 'error', retryAt: null, queueable: false };
+    if (account.status === 'exhausted') return { cause: 'exhausted', retryAt: null, queueable: false };
+
+    // RAW weekly state, so the retry oracle agrees with _isAvailable's raw gate.
+    // (Pace must NOT classify a raw-healthy account as weekly_critical here, or
+    // the queue keys on a far-future reset instead of the account's real
+    // short-term availability — the session-kill bug.)
+    const weeklyState = this._weeklyRawState(account);
+
+    // Short-term blockers (rate-limit / cooldown / upstream / 5h session cap /
+    // token-request-provider limits) clear on their OWN schedule — usually FAR
+    // sooner than a 7d weekly reset. Compute them up front so a weekly-critical
+    // account reports its REAL near-term recovery, not the distant weekly reset.
+    const shortTerm = this._shortTermRetry(account, now, q);
 
     if (weeklyState === 'exhausted') {
+      // Hard block: only a weekly reset unblocks it — a sooner short-term clear
+      // does not help — so key the hold on the weekly reset.
       return { cause: 'weekly_exhausted', retryAt: q.unified7dReset || null, queueable: false };
     }
 
+    if (weeklyState === 'critical') {
+      // Last-resort USABLE: the account becomes selectable (as last resort) the
+      // moment its short-term blocker clears — NOT at the far weekly reset. So
+      // report the SOONER real blocker (the 5h cap / rate-limit), not unified7dReset.
+      // Tag weeklyCritical so the oracle ALWAYS holds (finite) on it: a critical
+      // account is recoverable by definition and must never collapse to an
+      // Infinity session-kill, even when no reset time is known.
+      if (shortTerm) return { ...shortTerm, weeklyCritical: true };
+      // No short-term blocker → the only thing keeping it out of the last-resort
+      // pool is a TRANSIENT cap (in-flight/concurrency, admission pause), which
+      // clears in seconds when a sibling completes — NOT the 7d weekly reset. Hold
+      // a bounded re-poll (retryAt:null → BOUNDED_REPOLL_HOLD_MS), never the far
+      // weekly reset, so a non-stream request isn't error-fasted for ~7d.
+      return { cause: 'weekly_critical', retryAt: null, queueable: false, weeklyCritical: true };
+    }
+
+    // Healthy / soft / reserve weekly: the ordinary short-term blocker, if any.
+    if (shortTerm) return shortTerm;
+
+    // Otherwise-healthy but at the in-flight / global concurrency cap — a TRANSIENT,
+    // self-clearing block (a sibling completing frees a slot in seconds). HOLD a
+    // bounded re-poll rather than error-fasting (Infinity): the symmetric case to a
+    // concurrency-capped weekly-critical account, which already holds finite above.
+    if (account.inFlight >= this.scheduler.safetyMaxActivePerAccount
+        || this.getGlobalInFlight() >= this.scheduler.safetyMaxGlobalActive) {
+      return { cause: 'concurrency_cap', retryAt: null, queueable: false, transientCap: true };
+    }
+
+    return { cause: 'unavailable', retryAt: null, queueable: false };
+  }
+
+  // The soonest active short-term (non-weekly) blocker for an account, or null if
+  // none is active. Ordered most-specific-first; each entry is a {cause, retryAt,
+  // queueable} the retry oracle can hold on. Kept separate from the weekly state
+  // so weekly-critical accounts surface their real near-term recovery time.
+  _shortTermRetry(account, now, q) {
     if (account.status === 'throttled' && account.rateLimitedUntil && now < account.rateLimitedUntil) {
       return { cause: 'rate_limited', retryAt: account.rateLimitedUntil, queueable: true };
     }
@@ -825,10 +963,7 @@ export class AccountManager {
       return { cause: 'provider_limit', retryAt: q.genericReset || null, queueable: Boolean(q.genericReset) };
     }
 
-    if (!account.enabled) return { cause: 'disabled', retryAt: null, queueable: false };
-    if (account.status === 'error') return { cause: 'error', retryAt: null, queueable: false };
-    if (account.status === 'exhausted') return { cause: 'exhausted', retryAt: null, queueable: false };
-    return { cause: 'unavailable', retryAt: null, queueable: false };
+    return null;
   }
 
   _selectNext(requestInfo = {}, excludedIndexes = new Set()) {
@@ -1125,8 +1260,21 @@ export class AccountManager {
   _scoreAccount(account, requestInfo = {}, ctx = null) {
     const now = ctx?.now ?? Date.now();
     const reqWeight = Math.max(1, requestInfo.weight || 1);
-    const concurrency = account.activeWeight + reqWeight;
-    const scarcity = this._accountScarcity(account, now) * this.scheduler.scarcityWeight;
+    const inflight = account.activeWeight + reqWeight;
+
+    // DOMINANT term: in-flight concurrency. Short-term throttling is driven by
+    // how many requests pile on one account, so least-loaded-first spread is
+    // the primary objective.
+    const concurrency = inflight * this.scheduler.concurrencyWeight;
+
+    // Steep soft cap past depth D — the throttle safety floor. No single
+    // account absorbs a deep concurrent burst no matter how "cheap" it looks.
+    const capPenalty = this.scheduler.capPenaltyWeight
+      * Math.max(0, inflight - this.scheduler.perAccountConcurrencyTarget);
+
+    // Burn-pace COST only (demoted from the old dominant scarcity×6 term): a
+    // soft de-preference of accounts burning ahead of an even pace. Never a bench.
+    const paceCost = this._accountScarcity(account, now) * this.scheduler.paceCostWeight;
 
     const fleetRecentWeight = ctx?.fleetRecentWeight ?? 0;
     const recentWeight = this._loadSummary(account, this.scheduler.spreadWindowMs, now).weight;
@@ -1139,7 +1287,7 @@ export class AccountManager {
     // probed and learned (matches the legacy unknown-quota exploration nudge).
     const explorationBonus = account.quota.unified7dReset == null ? -0.5 : 0;
 
-    return concurrency + scarcity + spread + ramp + failurePenalty + explorationBonus;
+    return concurrency + capPenalty + paceCost + spread + ramp + failurePenalty + explorationBonus;
   }
 
   /**
@@ -1352,7 +1500,7 @@ export class AccountManager {
         : account.quota.tokensLimit
           ? ((1 - account.quota.tokensRemaining / account.quota.tokensLimit) * 100).toFixed(1)
           : '?';
-      const reason = this._isSessionQuotaUnavailable(account) ? 'session quota' : `weekly ${this._weeklyState(account)}`;
+      const reason = this._isSessionQuotaUnavailable(account) ? 'session quota' : `weekly ${this._weeklyRawState(account)}`;
       const logKey = `${reason}:${pct}`;
       if (account.lastQuotaLogKey !== logKey) {
         account.lastQuotaLogKey = logKey;
@@ -1466,7 +1614,7 @@ export class AccountManager {
       if (incident.accounts.has(account.index)) continue;
       if (account.status === 'exhausted' || account.status === 'error') continue;
       if (this._isSessionQuotaUnavailable(account)) continue;
-      if (this._weeklyState(account) === 'exhausted') continue;
+      if (this._weeklyRawState(account) === 'exhausted') continue;
       return false;
     }
     return true;

package/src/config.js

@@ -87,10 +87,16 @@ export function createDefaultConfig() {
     // account's REAL reset time, so a generous bound never spins pointlessly).
     queue: {
       enabled: true,
-      maxWaitMs: 24 * 60 * 60 * 1000,    // hard ceiling for any hold
+      maxWaitMs: 24 * 60 * 60 * 1000,    // hard ceiling for non-streaming/capacity holds; streaming uses streamHoldMaxMs
       autoMaxWaitMs: null,               // 5h/session-cap hold (null = maxWaitMs)
       capacityMaxWaitMs: 15 * 60 * 1000, // upstream 529/overload — stays short, never governed by the others
-      weeklyMaxWaitMs: 24 * 60 * 60 * 1000, // weekly (7d) cap hold; was 0 (fail-fast) — that killed sessions on weekly cap
+      weeklyMaxWaitMs: 24 * 60 * 60 * 1000, // legacy bound; streaming holds use streamHoldMaxMs
+      // Streaming hold ceiling: how long a streaming session is held ALIVE on the
+      // heartbeat waiting for any account to free up. 7d so a session is never
+      // killed while a real reset is on the way; only permanent failures (all
+      // accounts logged out / no eligible route) error fast. Lower if your client
+      // uses a wall-clock total-request timeout the heartbeat can't reset.
+      streamHoldMaxMs: 7 * 24 * 60 * 60 * 1000,
       nonStreamMaxWaitMs: 5 * 60 * 1000, // non-streaming requests have no keepalive; cap their wait
       maxConcurrentQueued: 64,           // backpressure: max requests held at once
       maxQueuedBytes: 1024 * 1024 * 1024, // backpressure: max aggregate buffered body bytes (1 GiB)

package/src/index.js

@@ -6,7 +6,7 @@ import { loadOrCreateConfig, loadConfig, saveConfig, atomicConfigUpdate, getConf
 import { AccountManager } from './account-manager.js';
 import { createProxyServer } from './server.js';
 import { Prober } from './prober.js';
-import { importCredentials, loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon } from './oauth.js';
+import { loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon } from './oauth.js';
 import { TUI } from './tui.js';
 import { RestartController } from './restart-controller.js';
 import { resolveAccounts } from './account-config.js';
@@ -24,10 +24,6 @@ switch (command) {
   case 'run':
     await runCommand();
     break;
-  case 'import':
-    await importCommand();
-    process.exit(0);
-    break;
   case 'login':
     await loginCommand();
     process.exit(0);
@@ -124,7 +120,6 @@ async function serverWorkerCommand() {
   if (config.accounts.length === 0) {
     console.error('No accounts configured.\n');
     console.error('Add an account first:');
-    console.error('  maxpool import           Import from Claude Code');
     console.error('  maxpool login            OAuth login via browser');
     console.error('  maxpool login --api      Add an API key');
     process.exit(1);
@@ -399,47 +394,6 @@ function logPlainServerStart({ host, port, accounts, threshold, config }) {
   console.log('');
 }
 
-// ── import ──────────────────────────────────────────────────
-
-async function importCommand() {
-  const config = await loadOrCreateConfig();
-
-  let name = argValue('--name');
-  const jsonStr = argValue('--json');
-
-  let creds;
-  if (jsonStr) {
-    // Accept raw JSON: --json '{"claudeAiOauth":{"accessToken":"...","refreshToken":"...","expiresAt":...}}'
-    // or flat: --json '{"accessToken":"...","refreshToken":"...","expiresAt":...}'
-    try {
-      const raw = JSON.parse(jsonStr);
-      const data = raw.claudeAiOauth || raw;
-      if (!data.accessToken) {
-        console.error('JSON must contain "accessToken" (directly or under "claudeAiOauth")');
-        process.exit(1);
-      }
-      creds = {
-        accessToken: data.accessToken,
-        refreshToken: data.refreshToken,
-        expiresAt: data.expiresAt,
-      };
-    } catch (err) {
-      console.error(`Failed to parse --json: ${err.message}`);
-      process.exit(1);
-    }
-  } else {
-    const fromPath = argValue('--from') || '~/.claude/.credentials.json';
-    try {
-      creds = await importCredentials(fromPath);
-    } catch (err) {
-      console.error(`Failed to import from ${fromPath}: ${err.message}`);
-      process.exit(1);
-    }
-  }
-
-  await upsertOAuthAccount(config, name, creds, 'import');
-}
-
 // ── login ───────────────────────────────────────────────────
 
 async function loginCommand() {
@@ -505,6 +459,9 @@ async function loginOAuthCommand() {
   let name = argValue('--name');
 
   console.log('Starting OAuth login...');
+  console.log('Note: this adds whatever account you are currently signed into at claude.ai —');
+  console.log('there is no account picker. To add a DIFFERENT account, sign into THAT account at');
+  console.log('claude.ai first (or use a logged-out / incognito browser window), then continue.');
   let creds;
   try {
     creds = await loginOAuth();
@@ -512,7 +469,6 @@ async function loginOAuthCommand() {
     console.error(`OAuth login failed: ${err.message}`);
     console.error('');
     console.error('Alternatives:');
-    console.error('  maxpool import        Import from existing Claude Code credentials');
     console.error('  maxpool login --api   Add an API key instead');
     process.exit(1);
   }
@@ -636,7 +592,7 @@ async function accountsCommand() {
 
   if (config.accounts.length === 0) {
     console.log('No accounts configured.');
-    console.log('Add one with: maxpool import, maxpool login, or maxpool login --api');
+    console.log('Add one with: maxpool login (browser) or maxpool login --api');
     return;
   }
 
@@ -847,8 +803,7 @@ Usage: maxpool [command] [options]
 
 Commands:
   server              Start the proxy server (default)
-  import              Import credentials from Claude Code
-  login               OAuth login via browser
+  login               OAuth login via browser (adds the account you're signed into at claude.ai)
   login --api         Add an API key account
   env [--with-key]    Print env vars to use with Claude
   run [-- args...]    Run Claude Code through the proxy
@@ -860,10 +815,7 @@ Commands:
   help                Show this help
 
 Options:
-  --name NAME         Set account name (import/login)
-  --from PATH         Credentials path (import, default: ~/.claude/.credentials.json)
-  --json JSON         Import from inline JSON (import), e.g.:
-                      --json '{"accessToken":"...","refreshToken":"...","expiresAt":1234}'
+  --name NAME         Set account name (login)
   --log-to DIR        Log full requests/responses to DIR (server, one file per request)
   --with-key          Include proxy API key in maxpool env output
 
@@ -957,14 +909,7 @@ async function syncAccountsFromDisk(diskConfig, memConfig, accountManager) {
 
     // Existing account — resolve fresh credentials from disk
     let freshCred = null;
-    if (diskAcct.type === 'oauth' && diskAcct.importFrom) {
-      try {
-        const creds = await importCredentials(diskAcct.importFrom);
-        freshCred = { accessToken: creds.accessToken, refreshToken: creds.refreshToken, expiresAt: creds.expiresAt };
-      } catch (err) {
-        console.error(`[Maxpool] Re-import failed for "${diskAcct.name}": ${err.message}`);
-      }
-    } else if (diskAcct.type === 'oauth' && diskAcct.accessToken) {
+    if (diskAcct.type === 'oauth' && diskAcct.accessToken) {
       freshCred = { accessToken: diskAcct.accessToken, refreshToken: diskAcct.refreshToken, expiresAt: diskAcct.expiresAt };
     } else if (diskAcct.type === 'apikey' && diskAcct.apiKey) {
       freshCred = { apiKey: diskAcct.apiKey };

package/src/oauth.js

@@ -1,74 +1,8 @@
-import { readFile } from 'node:fs/promises';
-import { homedir, userInfo } from 'node:os';
 import { randomBytes, createHash } from 'node:crypto';
-import { exec, execFile } from 'node:child_process';
-import { promisify } from 'node:util';
+import { exec } from 'node:child_process';
 import { createInterface } from 'node:readline';
 import http from 'node:http';
 
-const execFileAsync = promisify(execFile);
-
-const KEYCHAIN_SERVICE = 'Claude Code-credentials';
-
-/**
- * Read Claude Code credentials from the macOS Keychain.
- * Claude Code (recent versions, macOS) stores OAuth creds in the login
- * Keychain under service "Claude Code-credentials", account = the OS
- * username — NOT in ~/.claude/.credentials.json. Returns the parsed
- * credential object (unwrapped from "claudeAiOauth"), or null if absent.
- */
-async function readMacKeychainCredentials() {
-  if (process.platform !== 'darwin') return null;
-  const account = userInfo().username;
-  try {
-    const { stdout } = await execFileAsync('security', [
-      'find-generic-password', '-s', KEYCHAIN_SERVICE, '-a', account, '-w',
-    ]);
-    const raw = JSON.parse(stdout.trim());
-    return raw.claudeAiOauth || raw;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Import OAuth credentials from a Claude Code credentials file, falling back
- * to the macOS Keychain when the file is absent (the default on macOS).
- */
-export async function importCredentials(filePath = '~/.claude/.credentials.json') {
-  const resolvedPath = filePath.replace(/^~/, homedir());
-
-  let data;
-  try {
-    const raw = JSON.parse(await readFile(resolvedPath, 'utf-8'));
-    // Claude Code stores credentials nested under "claudeAiOauth"
-    data = raw.claudeAiOauth || raw;
-  } catch (fileErr) {
-    // No file → try the macOS Keychain (where Claude Code now stores creds).
-    data = await readMacKeychainCredentials();
-    if (!data) {
-      throw new Error(
-        process.platform === 'darwin'
-          ? `No credentials at ${resolvedPath} and none in the macOS Keychain ` +
-            `("${KEYCHAIN_SERVICE}"). Is Claude Code logged in on this machine? ` +
-            `Run 'claude' once to log in, or paste a token with 'maxpool import --json ...'.`
-          : `Could not read credentials from ${resolvedPath}: ${fileErr.message}`,
-      );
-    }
-  }
-
-  if (!data.accessToken) {
-    throw new Error('Imported credentials have no accessToken');
-  }
-  return {
-    accessToken: data.accessToken,
-    refreshToken: data.refreshToken,
-    expiresAt: data.expiresAt,
-    subscriptionType: data.subscriptionType,
-    rateLimitTier: data.rateLimitTier,
-  };
-}
-
 const PROFILE_URL = 'https://api.anthropic.com/api/oauth/profile';
 const DEFAULT_TOKEN_ENDPOINT = 'https://platform.claude.com/v1/oauth/token';
 const DEFAULT_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';

package/src/server.js

@@ -19,12 +19,17 @@ const DEFAULT_QUEUE = {
   maxWaitMs: 24 * 60 * 60 * 1000,
   autoMaxWaitMs: null,
   capacityMaxWaitMs: 15 * 60 * 1000,
-  // Weekly (7d) cap hold. A generous bound is SAFE because the early-exit
-  // gates on the REAL reset time (unified7dReset - now): it only waits when a
-  // reset genuinely lands inside the window, and errors honestly otherwise.
-  // 0 here was the bug — it fail-fast-killed sessions the instant every
-  // account hit its weekly cap, instead of waiting for the soonest reset.
-  weeklyMaxWaitMs: 24 * 60 * 60 * 1000,
+  weeklyMaxWaitMs: 24 * 60 * 60 * 1000, // legacy bound; streaming holds use streamHoldMaxMs
+  // STREAMING hold ceiling: how long a streaming request may be HELD ALIVE on
+  // the SSE heartbeat waiting for any account to free up. Defaults to 7d (the
+  // max weekly window) so a session is never killed while a real reset is on the
+  // way — it resumes the instant any account frees. The hold is gated by the
+  // nextRetryForRequest oracle: it ONLY holds when ≥1 eligible route has a finite
+  // reset within this ceiling; permanent failures (all accounts logged out / no
+  // eligible route / reset unknown) error fast instead of hanging. The heartbeat
+  // resets idle-gap client timeouts; if a client uses a wall-clock total-request
+  // deadline, lower this to just under it.
+  streamHoldMaxMs: 7 * 24 * 60 * 60 * 1000,
   // Non-streaming requests have no SSE heartbeat to keep them alive, so a long
   // hold would die on the client timeout anyway. Cap their wait conservatively.
   nonStreamMaxWaitMs: 5 * 60 * 1000,
@@ -282,13 +287,44 @@ async function forwardRequest(
     return;
   }
 
+  // The admission (if this was a resumed queued request) has now been CONSUMED —
+  // it got its account. Clear queueAdmitted so any subsequent internal failover
+  // recursion (excludedIndexes path) re-enters the fairness gate as a normal
+  // waiter instead of preferentially jumping ahead of the FIFO for the rest of
+  // this request's failover chain.
+  requestInfo.queueAdmitted = false;
+
+  // Abort the upstream fetch and release the lease if the CLIENT disconnects during
+  // the pre-response window (token refresh + connect + waiting for the upstream's
+  // first byte). Without this, a client that drops mid-flight leaves account.inFlight
+  // pinned until the fetch resolves on its own (~undici body timeout), benching
+  // scarce capacity — acute for the hold feature, which targets already-scarce
+  // accounts. The listener is removed once the response arrives; mid-stream
+  // disconnects are handled by streamResponse's res.destroyed checks.
+  const clientGone = new AbortController();
+  const onClientClose = () => clientGone.abort();
+  res.once('close', onClientClose);
+  const releaseOnClientGone = () => {
+    res.off('close', onClientClose);
+    accountManager.releaseAccount(lease);
+    clearQueueHeartbeat(requestInfo);
+    accountManager.removeQueuedRequest?.(requestInfo);
+  };
+
   // Track which account handles this request
   ctx.account = account.name;
   hooks.onRequestRouted?.(reqId, { account: account.name });
 
   // Refresh OAuth token if needed
   const tokenReady = await accountManager.ensureTokenFresh(account.index);
+  if (clientGone.signal.aborted) { releaseOnClientGone(); return; }
   if (!tokenReady) {
+    // Token refresh failed (not a client disconnect). This frame is leaving via
+    // recursion / queue / error WITHOUT reaching the post-fetch off() — drop the
+    // 'close' listener now so it doesn't accumulate one-per-failover-hop on `res`
+    // (MaxListenersExceededWarning + leak); the recursive/resumed frame registers
+    // its own.
+    res.off('close', onClientClose);
     accountManager.releaseAccount(lease);
     excludedIndexes.add(account.index);
     if (
@@ -376,7 +412,11 @@ async function forwardRequest(
       headers,
       body: ['GET', 'HEAD'].includes(method) ? undefined : upstreamBody,
       redirect: 'manual',
+      signal: clientGone.signal,
     });
+    // Response arrived — the pre-response leak window is over. Stop guarding for
+    // client-disconnect via abort (streamResponse handles mid-stream disconnects).
+    res.off('close', onClientClose);
 
     // Extract rate limit headers
     const rateLimitHeaders = {};
@@ -749,7 +789,20 @@ async function forwardRequest(
       if (requestInfo.queueHeartbeatActive) {
         clearQueueHeartbeat(requestInfo);
         if (!res.destroyed && !res.writableEnded) {
-          res.write(`data: ${buf.toString()}\n\n`);
+          // We already committed `200 text/event-stream` (the queue heartbeat), but
+          // the resumed upstream returned a NON-streaming body. Writing the raw JSON
+          // as a lone `data:` line corrupts the client's SSE parser (no message_start
+          // envelope, no message_stop). Frame it as a proper SSE error event so the
+          // client fails cleanly instead of hanging/mis-parsing. (Rare: an upstream
+          // honoring stream:true never lands here; reachable on a fallback upstream
+          // quirk.)
+          res.write(`event: error\ndata: ${JSON.stringify({
+            type: 'error',
+            error: {
+              type: 'api_error',
+              message: `Upstream returned a non-streaming ${upstreamRes.status} response for a streaming request`,
+            },
+          })}\n\n`);
           res.end();
         }
       } else {
@@ -758,6 +811,14 @@ async function forwardRequest(
       }
     }
   } catch (err) {
+    res.off('close', onClientClose);
+    // Client disconnected mid-flight → we aborted the upstream fetch. Release the
+    // lease (free the scarce account) and STOP: no retry (the client is gone), no
+    // write (the socket is dead).
+    if (clientGone.signal.aborted) {
+      releaseOnClientGone();
+      return;
+    }
     console.error(`[Maxpool] Upstream error (account "${account.name}"):`, err.message);
 
     if (logDir) {
@@ -869,7 +930,7 @@ function unavailableMessage(accountManager, requestInfo = {}, retryAfter, willRe
   return `All ${n} accounts exhausted. Retry in ${retryAfter}s.`;
 }
 
-export const __serverTest = { unavailableMessage, isRetriableUpstreamStatus, headerValue, getMaxpoolProfile };
+export const __serverTest = { unavailableMessage, isRetriableUpstreamStatus, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat };
 
 async function readErrorBody(upstreamRes, limitBytes = 64 * 1024) {
   if (!upstreamRes.body) return '';
@@ -1084,7 +1145,6 @@ async function queueAndRetry(
   const capacityMaxWaitMs = queueConfig.capacityMaxWaitMs == null
     ? autoMaxWaitMs
     : Math.max(0, Number(queueConfig.capacityMaxWaitMs) || 0);
-  const weeklyMaxWaitMs = Math.max(0, Number(queueConfig.weeklyMaxWaitMs) || 0);
   const nonStreamMaxWaitMs = queueConfig.nonStreamMaxWaitMs == null
     ? 5 * 60_000
     : Math.max(0, Number(queueConfig.nonStreamMaxWaitMs) || 0);
@@ -1106,20 +1166,46 @@ async function queueAndRetry(
     return finishQueuedStreamIfNeeded(res, requestInfo, honestMessage);
   }
 
-  // Pick the wait window. Capacity (upstream 529/overload) MUST stay on its own
-  // short cap even when it coincides with weekly exhaustion — never let a
-  // transient overload inherit the long weekly bound.
-  let queueWindowMs = cause === 'capacity'
-    ? Math.min(maxWaitMs, capacityMaxWaitMs)
-    : retryPlan.cause === 'weekly_exhausted'
-      ? Math.min(maxWaitMs, weeklyMaxWaitMs)
-      : Math.min(maxWaitMs, autoMaxWaitMs);
-  // Non-streaming requests have no SSE heartbeat, so a long hold would die on
-  // the client timeout. Cap them so we never promise a wait we can't deliver.
+  const streamHoldMaxMs = queueConfig.streamHoldMaxMs == null
+    ? 7 * 24 * 60 * 60 * 1000
+    : Math.max(0, Number(queueConfig.streamHoldMaxMs) || 0);
+  // Pick the hold ceiling:
+  //   capacity (upstream 529/overload) → its own short cap, never a long hold
+  //   non-streaming (no heartbeat)      → short cap (would die on client timeout)
+  //   streaming                         → up to streamHoldMaxMs (7d), kept alive
+  //                                       by the heartbeat
+  let queueWindowMs;
+  if (cause === 'capacity') {
+    queueWindowMs = Math.min(maxWaitMs, capacityMaxWaitMs);
+  } else if (!requestInfo.stream) {
+    queueWindowMs = nonStreamMaxWaitMs;
+  } else {
+    queueWindowMs = streamHoldMaxMs;
+  }
+  // A non-streaming request has no heartbeat regardless of cause, so it must
+  // never outlast nonStreamMaxWaitMs even under capacity (it would occupy a
+  // slot 3x its documented cap with nothing to reap it).
   if (!requestInfo.stream) queueWindowMs = Math.min(queueWindowMs, nonStreamMaxWaitMs);
 
+  // A pure concurrency-cap block (every account healthy but all in-flight/global
+  // slots busy — NOT a quota/rate-limit reset) is a LOCAL capacity transient. Bound
+  // it by the short capacity window, never the multi-day streaming hold: a slot
+  // frees as active requests finish (seconds–minutes), and if the fleet stays
+  // saturated past the window the request sheds load (error-fast) instead of
+  // spinning a queue slot for up to streamHoldMaxMs (7d) — the soft-deadlock guard.
+  if (retryPlan.cause === 'concurrency_cap') {
+    queueWindowMs = Math.min(queueWindowMs, capacityMaxWaitMs);
+  }
+
   if (queueWindowMs <= 0) return finishQueuedStreamIfNeeded(res, requestInfo, honestMessage);
 
+  // HOLD-vs-ERROR oracle (from nextRetryForRequest): HOLD only when a TEMPORARY
+  // cause has a finite real reset within the ceiling. ERROR FAST for permanent /
+  // unsatisfiable cases — nextRetryForRequest returns retryAfterMs === Infinity
+  // for no_eligible_route, weekly_reset_unknown, and "all matching routes are
+  // terminal (disabled / error / auth-dead)". This is what stops an indefinite
+  // hold from silently hanging every session when something is actually broken
+  // (all accounts logged out, the only healthy account removed, etc.).
   const retryAfterMs = retryPlan.retryAfterMs;
   if (!Number.isFinite(retryAfterMs) || retryAfterMs > queueWindowMs) {
     return finishQueuedStreamIfNeeded(res, requestInfo, honestMessage);
@@ -1129,6 +1215,8 @@ async function queueAndRetry(
   const ticket = accountManager.registerQueuedRequest?.(requestInfo, {
     bytes: body?.length || 0,
     deadlineAt: requestInfo.queueStartedAt + queueWindowMs,
+    sessionKey: requestInfo.sessionKey,
+    res, // liveness check for ghost-only eviction
     maxConcurrentQueued: queueConfig.maxConcurrentQueued,
     maxQueuedBytes: queueConfig.maxQueuedBytes,
   });
@@ -1148,7 +1236,7 @@ async function queueAndRetry(
   ctx.account = '(queued)';
   hooks.onRequestRouted?.(reqId, { account: '(queued)' });
   console.log(`[Maxpool] ${reason}; queueing request for up to ${Math.ceil(remaining / 1000)}s (cause: ${cause}, retry: ${retryPlan.cause})`);
-  ensureQueueHeartbeat(res, requestInfo, queueConfig);
+  ensureQueueHeartbeat(res, requestInfo, queueConfig, accountManager);
 
   const available = await waitForAvailableRoute(req, res, accountManager, requestInfo, queueConfig, remaining);
   if (!available) {
@@ -1157,13 +1245,23 @@ async function queueAndRetry(
     return finishQueuedStreamIfNeeded(res, requestInfo, honestMessage);
   }
 
+  // NOTE: the heartbeat is deliberately NOT cleared here. It must stay alive
+  // through the resumed forward's CONNECTION + failover attempts: if the freed
+  // account 529s/throttles on the first resumed request (before any upstream
+  // bytes), forwardRequest re-enters queueAndRetry — whose guard at the top
+  // (`res.headersSent && !queueHeartbeatActive`) would otherwise BAIL on the
+  // committed stream and DROP the held session. Keeping the heartbeat active lets
+  // it re-hold. The heartbeat is instead stopped the instant real upstream bytes
+  // start flowing, inside streamResponse — that prevents the Bug A interleave
+  // (': maxpool queued' comments injected between real SSE events) without losing
+  // re-holdability on a post-resume failover.
   return forwardRequest(
     req, res, body, accountManager, upstream, 0, hooks, reqId, ctx, logDir,
     retryConfig, queueConfig, requestInfo, canRetryBufferedBody, canQueueBufferedBody, new Set(),
-  ).then(() => true).finally(() => clearQueueHeartbeat(requestInfo));
+  ).then(() => true);
 }
 
-function ensureQueueHeartbeat(res, requestInfo, queueConfig) {
+function ensureQueueHeartbeat(res, requestInfo, queueConfig, accountManager) {
   if (!requestInfo.stream || requestInfo.queueHeartbeatActive || res.headersSent) return;
   const heartbeatMs = Math.max(1000, Number(queueConfig.heartbeatMs) || 10_000);
   res.writeHead(200, {
@@ -1175,12 +1273,21 @@ function ensureQueueHeartbeat(res, requestInfo, queueConfig) {
   res.flushHeaders?.();
   res.write(': maxpool queued\n\n');
   requestInfo.queueHeartbeatActive = true;
+  // The heartbeat is the liveness probe: if the client is gone (socket
+  // destroyed/ended, or the write throws EPIPE/ERR_STREAM_DESTROYED), release
+  // the queue slot + bytes IMMEDIATELY rather than letting a dead ticket occupy
+  // the queue until its (up to 7d) deadline — the ghost-leak guard.
+  const reapDead = () => {
+    clearQueueHeartbeat(requestInfo);
+    accountManager?.removeQueuedRequest?.(requestInfo);
+  };
   requestInfo.queueHeartbeatTimer = setInterval(() => {
-    if (res.destroyed || res.writableEnded) {
-      clearQueueHeartbeat(requestInfo);
-      return;
+    if (res.destroyed || res.writableEnded) { reapDead(); return; }
+    try {
+      res.write(': maxpool queued\n\n');
+    } catch {
+      reapDead();
     }
-    res.write(': maxpool queued\n\n');
   }, heartbeatMs);
   requestInfo.queueHeartbeatTimer.unref?.();
 }
@@ -1220,6 +1327,14 @@ async function waitForAvailableRoute(req, res, accountManager, requestInfo, queu
         && accountManager.canAdmitQueuedRequest?.(requestInfo) !== false
       ) return true;
 
+      // Re-classify each tick: if no eligible route can EVER recover (every
+      // matching account went terminal/auth-dead, the only healthy account was
+      // removed, or the reset is unknown → retryAfterMs Infinity), stop holding
+      // and error fast instead of spinning to the 7d ceiling. Hold is valid only
+      // while ≥1 eligible route has a finite, known reset.
+      const plan = accountManager.nextRetryForRequest?.(requestInfo, new Set());
+      if (plan && plan.cause !== 'available' && !Number.isFinite(plan.retryAfterMs)) return false;
+
       const remaining = maxWaitMs - (Date.now() - startedAt);
       // Jitter the poll so a synchronized weekly-reset event doesn't re-align
       // every waiter's poll into the same instant (thundering scan).
@@ -1384,6 +1499,14 @@ async function streamResponse(webStream, res, status, responseHeaders, accountIn
   let committed = res.headersSent;
   let readFailed = false;
 
+  // We're now committed to streaming a real upstream response body onto this
+  // response — there is no more failover for this forward. Stop the queue
+  // heartbeat (if this was a resumed held stream) BEFORE the first real byte, so
+  // the setInterval can't inject ': maxpool queued' comments between live SSE
+  // events (Bug A). It is deliberately NOT cleared earlier (on resume), so a
+  // pre-byte failover can still re-hold the session via queueAndRetry.
+  clearQueueHeartbeat(requestInfo);
+
   try {
     while (true) {
       const { done, value } = await reader.read();

package/src/tui.js

@@ -1,5 +1,5 @@
 import { createInterface } from 'node:readline';
-import { importCredentials, fetchProfile, loginOAuth } from './oauth.js';
+import { fetchProfile, loginOAuth } from './oauth.js';
 
 // ── ANSI helpers ─────────────────────────────────────────────
 
@@ -351,13 +351,7 @@ export class TUI {
   }
 
   _keyAccounts(k) {
-    if (k === 'i') {
-      this._confirm(
-        'Import current Claude login?',
-        'Add or update the account currently logged into Claude Code.',
-        () => this._doImport(),
-      );
-    } else if (k === 'k') {
+    if (k === 'k') {
       this.mode = 'input';
       this.inputPrompt = 'Anthropic API key';
       this.inputBuf = '';
@@ -533,26 +527,6 @@ export class TUI {
     }
   }
 
-  async _doImport() {
-    try {
-      this._addLog('Importing credentials...');
-      const creds = await importCredentials(); // file, then macOS Keychain fallback
-      const profile = await fetchProfile(creds.accessToken);
-      if (!profile || profile.error) {
-        this._addLog(`Warning: could not fetch profile — ${profile?.error || 'no token'}`);
-      }
-      let name;
-      if (profile?.email) {
-        name = profile.email;
-        const tier = profile.hasClaudeMax ? 'Max' : profile.hasClaudePro ? 'Pro' : null;
-        if (tier) this._addLog(`Detected Claude ${tier}: ${name}`);
-      }
-      await this._upsertOAuthAccount({ creds, profile, name, source: 'import', verb: 'Imported' });
-    } catch (e) {
-      this._addLog(`Import failed: ${e.message}`);
-    }
-  }
-
   // Browser OAuth login: any Claude account, named afterward. Suspends the TUI
   // around the interactive flow (browser + name prompt), then resumes.
   async _doLogin() {
@@ -1008,7 +982,7 @@ export class TUI {
       case 'normal':
         return ` ${bold('a')} Accounts  ${bold('m')} Routing  ${bold('s')} Sync  ${bold('r')} Restart  ${bold('q')} Stop`;
       case 'accounts':
-        return ` ${bold('i')} Import  ${bold('l')} Login (browser)  ${bold('k')} API key  ${bold('n')} Rename  ${bold('t')} Enable/disable  ${bold('d')} Delete  ${bold('Esc')} Back`;
+        return ` ${bold('l')} Login (browser)  ${bold('k')} API key  ${bold('n')} Rename  ${bold('t')} Enable/disable  ${bold('d')} Delete  ${bold('Esc')} Back`;
       case 'routing':
         return ` ${bold('a')} Automatic  ${bold('p')} Manual preference  ${bold('Esc')} Back`;
       case 'select': {