maxpool 1.19.4 → 1.19.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.19.4",
+  "version": "1.19.5",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/server.js

@@ -592,9 +592,11 @@ async function forwardRequest(
   // transcript. Hand the client the signal it already knows how to act on — it resends
   // the turn stateless and stops threading for the session — instead of letting the
   // upstream produce an error the user sees.
+  // `kind:'none'` when the gate is off makes every branch below a no-op, so the
+  // disabled path costs one comparison and needs no further guarding.
   const threadIntent = THREAD_GATE_ENABLED ? readThreadIntent(body) : { kind: 'none' };
-  if (THREAD_GATE_ENABLED && threadOwners.shouldRefuse(requestInfo.sessionKey, account.name, threadIntent)) {
-    threadOwners.noteRefused(requestInfo.sessionKey);
+  if (threadOwners.shouldRefuse(requestInfo.sessionKey, account.name, threadIntent)) {
+    threadOwners.noteRefused(requestInfo.sessionKey, account.name);
     accountManager.releaseAccount(lease, { neutral: true });
     console.log(`[Maxpool] thread not held by "${account.name}" — asking the client to resend this turn stateless [sess ${String(requestInfo.sessionKey || '?').slice(0, 8)}]`);
     ctx.status = 400;
@@ -603,7 +605,7 @@ async function forwardRequest(
   }
   // This account is about to serve the turn, so it holds the thread from here on.
   // Recorded optimistically: if the turn fails, the next one is refused anyway.
-  if (THREAD_GATE_ENABLED) threadOwners.noteServed(requestInfo.sessionKey, account.name, threadIntent);
+  threadOwners.noteServed(requestInfo.sessionKey, account.name, threadIntent);
 
   // Build log sections
   const logSections = [];

package/src/thread-gate.js

@@ -29,7 +29,7 @@ export function readThreadIntent(body) {
       // `previous_message_id` can also ride in `diagnostics`; that alone is not a thread.
       return { kind: 'none' };
     }
-    if (t.type === 'continue') return { kind: 'continue', previousMessageId: t.previous_message_id || null };
+    if (t.type === 'continue') return { kind: 'continue' };
     if (t.type === 'create') return { kind: 'create' };
     return { kind: 'none' };
   } catch {
@@ -57,6 +57,9 @@ const MAX_SESSIONS = 500;
 // did NOT take the downgrade (a different agent id, a model switch, an older build).
 // Refusing forever would double its request volume, so stop and forward instead.
 const MAX_CONSECUTIVE_REFUSALS = 2;
+// Bucket for requests that carry no session header — keyed per account so the storm
+// bound still applies without pretending we know whose conversation it is.
+const NO_SESSION_PREFIX = '\u0000nosession:';
 
 export class ThreadOwners {
   constructor({ maxSessions = MAX_SESSIONS, maxRefusals = MAX_CONSECUTIVE_REFUSALS } = {}) {
@@ -80,27 +83,38 @@ export class ThreadOwners {
   /** Decide AFTER routing has chosen. Returns true only for a `continue` turn that the
    *  chosen account cannot serve, and only while refusals are still under the bound. */
   shouldRefuse(sessionKey, accountName, intent) {
-    if (!sessionKey || !accountName) return false;
+    if (!accountName) return false;
     if (intent?.kind !== 'continue') return false;          // `create` carries the full transcript
-    const entry = this._touch(sessionKey);
+    // A request with NO session header is invisible to ownership tracking, and measured
+    // 2026-09-11 those are the majority of traffic — 14 of 20 consecutive /v1/messages
+    // lines carried no `[sess …]`. Skipping them left threaded turns reaching GLM and
+    // failing exactly as before the gate existed. We cannot know the owner, so treat it
+    // as an unknown session (refuse, the safe direction) and bucket the refusal COUNT
+    // per account so the storm bound still applies.
+    const key = sessionKey || `${NO_SESSION_PREFIX}${accountName}`;
+    const entry = this._touch(key);
     if (entry && entry.owner === accountName) return false; // the account that holds it
     if (entry && entry.refusals >= this.maxRefusals) return false;  // bounded fail-open
     return true;
   }
 
   /** Record a refusal we are about to emit. */
-  noteRefused(sessionKey) {
-    if (!sessionKey) return;
-    const entry = this._touch(sessionKey) || { owner: null, refusals: 0 };
-    this._set(sessionKey, { owner: entry.owner, refusals: entry.refusals + 1 });
+  noteRefused(sessionKey, accountName = null) {
+    const key = sessionKey || (accountName ? `${NO_SESSION_PREFIX}${accountName}` : null);
+    if (!key) return;
+    const entry = this._touch(key) || { owner: null, refusals: 0 };
+    this._set(key, { owner: entry.owner, refusals: entry.refusals + 1 });
   }
 
   /** Record that `accountName` served a threaded turn for this session — it now holds
    *  the thread. Any refusal streak ends here. */
   noteServed(sessionKey, accountName, intent) {
-    if (!sessionKey || !accountName) return;
+    if (!accountName) return;
     if (intent?.kind !== 'create' && intent?.kind !== 'continue') return;
-    this._set(sessionKey, { owner: accountName, refusals: 0 });
+    // Without a session header there is no conversation to attribute ownership to; only
+    // clear the per-account refusal streak so a served turn re-arms the bound.
+    const key = sessionKey || `${NO_SESSION_PREFIX}${accountName}`;
+    this._set(key, { owner: sessionKey ? accountName : null, refusals: 0 });
   }
 
   get size() { return this.map.size; }

package/src/tui.js

@@ -332,7 +332,28 @@ function emptyBar(label, w = 10) {
   return `${ESC}100m${' '.repeat(lp)}${text}${' '.repeat(rp)}${RESET}`;
 }
 
-export const __tuiTest = { formatReset, quotaLabel, bar, emptyBar, strip, loadText, countdown, acctHeader, fitLine, providerLabel };
+/** Write a provider's enabled flag into the CONFIG entry `loadConfigProviders` reads.
+ *
+ *  A config-sourced provider is re-created from config on every reload
+ *  (`enabled: entry.enabled !== false`), so a runtime-only flag is undone by the next
+ *  auto-update. Measured 2026-09-11: Kimi, disabled by the owner, came back enabled
+ *  after an update because its config entry carried no `enabled` key.
+ *
+ *  Returns `{changed, previous}` so the caller can roll back if the save fails.
+ *  `changed:false` means there is no config entry — a header-derived provider, whose
+ *  runtime-only flag IS durable for it.
+ */
+export function applyProviderEnabledToConfig(config, name, enabled) {
+  const list = config?.providers;
+  if (!Array.isArray(list)) return { changed: false, previous: undefined };
+  const i = list.findIndex(p => p?.name === name);
+  if (i < 0) return { changed: false, previous: undefined };
+  const previous = list[i].enabled;
+  list[i].enabled = enabled;
+  return { changed: true, previous };
+}
+
+export const __tuiTest = { applyProviderEnabledToConfig, formatReset, quotaLabel, bar, emptyBar, strip, loadText, countdown, acctHeader, fitLine, providerLabel };
 
 function timestamp() {
   return new Date().toLocaleTimeString('en-US', { hour12: false });
@@ -359,7 +380,8 @@ export class TUI {
     this.capacityWindow = 'ses'; // capacity page window: 'ses' (5h) | 'wk' (weekly)
     // Hide disabled accounts from the table. With 8 dead/disabled accounts the live
     // ones scroll off the top; `h` collapses them to a one-line summary.
-    this.hideDisabled = false;
+    // Restored from config so an auto-update/reload does not un-hide what the user hid.
+    this.hideDisabled = this.config?.ui?.hideDisabled === true;
     this.selAction = null;   // prefer | toggle | delete
     this.selIdx = 0;
     this.inputPrompt = '';
@@ -556,6 +578,13 @@ export class TUI {
     } else if (k === 'h') {
       this.hideDisabled = !this.hideDisabled;
       this._addLog(this.hideDisabled ? 'Hiding disabled accounts' : 'Showing all accounts');
+      // Persist the view choice; a reload otherwise resets it to "show all" every time.
+      // Fully defensive: a VIEW preference must never break the toggle itself, and the
+      // TUI is constructed without a config in several tests and in early startup.
+      if (this.config) {
+        this.config.ui = { ...(this.config.ui || {}), hideDisabled: this.hideDisabled };
+        try { this.saveConfig?.(this.config)?.catch?.(() => {}); } catch { /* view-only */ }
+      }
     }
     // Enable/disable lives ONLY under [a] Accounts now (with rename/delete/login) —
     // one home for every account mutation, instead of a duplicate top-level toggle.
@@ -1540,6 +1569,22 @@ export class TUI {
       // on the next save, so it stays benched across a restart too. Re-enable it here the
       // same way whenever the user wants it back — there's no "removed forever" state.
       if (account.type === 'provider') {
+        // A CONFIG-SOURCED provider (one with a `providers:` entry) is re-created from
+        // config on every reload — `loadConfigProviders` computes `enabled: entry.enabled
+        // !== false` — so a runtime-only flag is silently undone by the next update or
+        // restart. Persist it where that read happens. Measured 2026-09-11: Kimi, disabled
+        // by the owner, came back enabled after an auto-update because its config entry
+        // had no `enabled` key. Header-derived providers (no config entry) keep the
+        // runtime-only path below, which is durable for them.
+        const applied = applyProviderEnabledToConfig(this.config, account.name, enabled);
+        if (applied.changed) {
+          try {
+            await this.saveConfig(this.config);
+          } catch (error) {
+            applyProviderEnabledToConfig(this.config, account.name, applied.previous);
+            throw error;
+          }
+        }
         this.am.setAccountEnabled(idx, enabled);
         if (!enabled && this.am.preferredAccountName === account.name) this.am.setRoutingMode?.('automatic');
         this._addLog(`${enabled ? 'Enabled' : 'Disabled'} provider "${account.name}" — ${enabled ? 'routing resumed' : 'benched (stays off across cc all + restart; re-enable here anytime)'}`);