maxpool 1.5.20 → 1.5.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.20",
+  "version": "1.5.22",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -2438,6 +2438,47 @@ export class AccountManager {
     return idx;
   }
 
+  /**
+   * Serialize runtime (client-supplied) PROVIDER accounts so they survive a
+   * restart. They're created lazily from `cc all` request headers
+   * (prepareRuntimeProviders), NOT from config — so without persistence a cold boot
+   * / reload shows only the config OAuth accounts until the next `cc all` request
+   * re-sends the tokens. Persisted to state.json (0600, same protection as the
+   * OAuth-token-bearing config) alongside quota.
+   */
+  exportRuntimeProviders() {
+    return this.accounts
+      .filter(a => a.runtime && a.type === 'provider' && a.credential)
+      .map(a => ({
+        name: a.name,
+        type: a.type,
+        provider: a.provider,
+        authToken: a.credential,
+        upstream: a.upstream,
+        authHeader: a.authHeader,
+        profiles: a.profiles,
+        priority: a.priority,
+        model: a.model,
+        modelMap: a.modelMap,
+        stripBetaHeaders: a.stripBetaHeaders,
+      }));
+  }
+
+  /**
+   * Restore persisted runtime providers on boot, via the SAME upsert the header
+   * path uses (so a restored provider is byte-identical to a header-created one). A
+   * live `cc all` request refreshes the token before routing (prepareRuntimeProviders
+   * runs ahead of account selection), so a stale restored token never serves a
+   * request. Idempotent — upsertRuntimeAccount matches by name.
+   */
+  restoreRuntimeProviders(list) {
+    if (!Array.isArray(list)) return;
+    for (const p of list) {
+      if (!p || !p.name || !(p.authToken || p.credential)) continue;
+      this.upsertRuntimeAccount({ ...p, authToken: p.authToken || p.credential });
+    }
+  }
+
   /**
    * Remove an account by index.
    */

package/src/index.js

@@ -528,6 +528,15 @@ async function serverWorkerCommand() {
   // lease holder); a cold/direct worker reads the on-disk state file.
   const savedState = await loadState();
   if (savedState?.quota) accountManager.restoreQuotaState(savedState.quota);
+  // Runtime fallback providers (glm-fallback/kimi-fallback) are created lazily from
+  // `cc all` request headers, not config — so without restoring them here a restart
+  // shows only the config OAuth accounts until the next `cc all` request re-sends the
+  // tokens. NOTE: a SEAMLESS reload worker reads state at spawn (before the outgoing
+  // worker's final flush), so a provider created <60s before that reload (not yet
+  // interval-flushed) is missed until the next `cc all` request — the same
+  // self-healing window as an abrupt SIGKILL. A cold restart reads the clean-shutdown
+  // final flush and restores fully (the reported zero-request case).
+  if (savedState?.runtimeProviders) accountManager.restoreRuntimeProviders(savedState.runtimeProviders);
   // Track the state-file generation we last observed so a stale flush is refused.
   let stateGeneration = Number(savedState?._generation) || 0;
 
@@ -550,7 +559,15 @@ async function serverWorkerCommand() {
     // flush REFUSED (dropping the final quota snapshot). The guard only exists to
     // serialize CROSS-worker writes; the final flush is provably intra-worker.
     const expectedGeneration = force ? null : stateGeneration;
-    return saveState({ quota: accountManager.exportQuotaState() }, { expectedGeneration })
+    return saveState(
+      {
+        quota: accountManager.exportQuotaState(),
+        // Runtime providers so glm-fallback/kimi-fallback survive a restart (they're
+        // header-derived, not in config). Empty [] when none — harmless.
+        runtimeProviders: accountManager.exportRuntimeProviders(),
+      },
+      { expectedGeneration },
+    )
       .then(written => { if (written != null) stateGeneration = written; })
       .catch(() => {});
   };

package/src/tui.js

@@ -183,7 +183,18 @@ function bar(ratio, w = 10, resetTs) {
   return out;
 }
 
-export const __tuiTest = { formatReset, quotaLabel, bar, strip, loadText, countdown };
+// A gray placeholder the EXACT visible width of a bar(), for a quota that's absent
+// or unpollable (label "—" / "n/a" / "probing"). Mirrors bar()'s no-data branch so
+// provider rows stay column-aligned with OAuth rows.
+function emptyBar(label, w = 10) {
+  const text = String(label).slice(0, w);
+  const pad = Math.max(0, w - text.length);
+  const lp = Math.floor(pad / 2);
+  const rp = pad - lp;
+  return `${ESC}100m${' '.repeat(lp)}${text}${' '.repeat(rp)}${RESET}`;
+}
+
+export const __tuiTest = { formatReset, quotaLabel, bar, emptyBar, strip, loadText, countdown };
 
 function timestamp() {
   return new Date().toLocaleTimeString('en-US', { hour12: false });
@@ -940,8 +951,10 @@ export class TUI {
     const rawName = a.name.slice(0, 12).padEnd(12);
     const name = isSel ? bold(rawName) : rawName;
 
-    // Type
-    const type = gray(a.type.padEnd(7));
+    // Type — pad to 8 so "provider" (8 chars) doesn't overflow a 7-wide column and
+    // shift the whole provider row (incl. its quota bars) 1 char out of alignment
+    // with the "oauth"/"apikey" rows.
+    const type = gray(a.type.padEnd(8));
 
     // Status
     let status;
@@ -1039,35 +1052,44 @@ export class TUI {
   }
 
   _renderProviderAcct(sel, cur, name, type, status, a, bw = 11, showBoth = true) {
-    const completed = a.completedRequests || 0;
-    const failed = a.failedRequests || 0;
-    const active = a.inFlight || 0;
-    const last = a.lastStatus ? `${statusColor(a.lastStatus)} ${formatMs(a.lastResponseMs)}` : '-';
     const q = a.quota || {};
 
-    // Quota segment. z.ai has a pollable monitor endpoint → real Ses/Wk token bars,
-    // same rendering as OAuth accounts. Kimi (Moonshot coding key) has NO pollable
-    // quota (web console only) → an honest label, never a fake bar. Fields are the
-    // SEPARATE provider* set, so a provider reading never leaks into an OAuth bar.
-    let quotaSeg = '';
+    // Ses/Wk bars in the SAME columns as OAuth rows (right after status) so the
+    // whole table's bars line up. z.ai exposes a 5-hour token window (Ses) and —
+    // when its monitor endpoint includes it — a weekly (Wk, intermittently absent →
+    // "—"). Kimi's coding key has NO pollable quota (web console only) → "n/a" both
+    // + a "console-only" note; not-yet-probed → "probing". Fields are the SEPARATE
+    // provider* set, so a provider reading never leaks into an OAuth bar.
+    let sesCell, wkCell, note = '';
     if (q.providerSes != null || q.providerWk != null) {
-      quotaSeg = `  Ses ${bar(q.providerSes, bw, q.providerSesReset)}`;
-      if (showBoth && q.providerWk != null) quotaSeg += `  Wk ${bar(q.providerWk, bw, q.providerWkReset)}`;
-      if (this.am._quotaProbeStale?.(a)) quotaSeg += `  ${dim('stale')}`;
+      sesCell = q.providerSes != null ? bar(q.providerSes, bw, q.providerSesReset) : emptyBar('—', bw);
+      wkCell = q.providerWk != null ? bar(q.providerWk, bw, q.providerWkReset) : emptyBar('—', bw);
+      if (this.am._quotaProbeStale?.(a)) note = `  ${dim('stale')}`;
     } else if (q.providerQuotaSource === 'console-only') {
-      quotaSeg = `  ${dim('Quota console-only')}`;
-    } else if (q.providerQuotaSource === 'zai') {
-      quotaSeg = `  ${dim('Ses/Wk probing')}`;
+      sesCell = emptyBar('n/a', bw);
+      wkCell = emptyBar('n/a', bw);
+      note = `  ${dim('console-only')}`;
+    } else {
+      sesCell = emptyBar('probing', bw);
+      wkCell = emptyBar('probing', bw);
     }
 
-    let limit = '';
+    let line = ` ${sel}${cur} ${name} ${type} ${status} Ses ${sesCell}`;
+    if (showBoth) line += `  Wk  ${wkCell}`;
+    line += note;
+    // Same recent-load columns as OAuth (providers track inFlight + load events),
+    // plus a compact Last <status> <ms> — the one signal that matters for a
+    // rarely-hit fallback (loadText reads 0r when idle).
+    line += `  ${dim(loadText(this._accountLoad(a)))}`;
+    if (a.lastStatus) line += `  ${dim('Last')} ${statusColor(a.lastStatus)} ${dim(formatMs(a.lastResponseMs))}`;
+    // Header-derived generic rate-limit (distinct from the monitor-endpoint quota),
+    // if the provider upstream returns x-ratelimit-* headers — only when present.
     if (q.genericLimit != null && q.genericRemaining != null) {
-      const used = q.genericLimit - q.genericRemaining;
       const reset = formatReset(q.genericReset);
-      limit = `  Lim ${used}/${q.genericLimit}${reset ? ` ${reset}` : ''}`;
+      line += `  ${dim(`Lim ${q.genericLimit - q.genericRemaining}/${q.genericLimit}${reset ? ' ' + reset : ''}`)}`;
     }
-    const err = a.lastError ? `  Err ${String(a.lastError).slice(0, 18)}` : '';
-    return ` ${sel}${cur} ${name} ${type} ${status} Act ${String(active).padStart(2)}  OK ${String(completed).padStart(3)}  Fail ${String(failed).padStart(2)}  Last ${last}${quotaSeg}  ${dim(loadText(this._accountLoad(a)))}${limit}${err}`;
+    if (a.lastError) line += `  ${red('Err ' + String(a.lastError).slice(0, 18))}`;
+    return line;
   }
 
   _accountLoad(account) {