maxpool 1.5.23 → 1.5.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.23",
+  "version": "1.5.25",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -2276,6 +2276,11 @@ export class AccountManager {
     // for the bounded drain; the lease holder owns all rotation.
     if (!this.writerLease) return true;
 
+    // A dead refresh token (invalid_grant) is PERMANENT until browser re-auth —
+    // never auto-retry it. Without this the prober re-POSTs the rejected token every
+    // ~60s forever (hammering Anthropic's OAuth endpoint). Cleared on re-login.
+    if (account.refreshDead) return false;
+
     if (!force && !isTokenExpiringSoon(account.expiresAt)) return true;
 
     // Coalesce concurrent refreshes
@@ -2309,6 +2314,11 @@ export class AccountManager {
             this.markTransientFailure(accountIndex, `token_refresh_${err.status || 'network'}`, { network: !err.status });
           } else {
             this.markAuthFailed(accountIndex, err.status || 401, 'token_refresh_failed');
+            // The refresh TOKEN itself was rejected (invalid_grant) — permanent until
+            // browser re-auth. Latch so ensureTokenFresh + the prober stop retrying a
+            // dead token. Set ONLY here (a rejected refresh), never in markAuthFailed
+            // (shared with provider auth failures).
+            account.refreshDead = true;
           }
           return false;
         }
@@ -2350,6 +2360,7 @@ export class AccountManager {
     account.credential = accessToken;
     if (refreshToken) account.refreshToken = refreshToken;
     account.expiresAt = expiresAt;
+    account.refreshDead = false;  // fresh tokens from re-auth revive a dead-refresh account
     if (account.status === 'error') account.status = 'active';
     console.log(`[Maxpool] Updated tokens for account "${account.name}"`);
     this._onTokenRefresh?.(accountIndex, {
@@ -2434,6 +2445,7 @@ export class AccountManager {
       account.lastError = null;
       account.lastErrorAt = null;
       account.consecutiveFailures = 0;
+      account.refreshDead = false;
     }
     return idx;
   }
@@ -2575,6 +2587,7 @@ export class AccountManager {
         priority: a.priority,
         runtime: a.runtime,
         status: a.status,
+        refreshDead: Boolean(a.refreshDead),
         inFlight: a.inFlight,
         activeWeight: a.activeWeight,
         completedRequests: a.completedRequests,

package/src/prober.js

@@ -59,7 +59,9 @@ export class Prober {
     this._running = true;
     this._inflight = (async () => {
       try {
-        const oauth = this.am.accounts.filter(a => a.type === 'oauth' && a.credential);
+        // Skip auth-dead accounts (dead refresh token): probing them just re-POSTs
+        // the rejected token every cycle — a 400 storm. They recover only on re-auth.
+        const oauth = this.am.accounts.filter(a => a.type === 'oauth' && a.credential && !a.refreshDead);
         const providers = this.am.accounts.filter(a => a.type === 'provider' && a.credential);
         await Promise.all([
           ...oauth.map(a => this.probeOne(a)),

package/src/tui.js

@@ -402,8 +402,8 @@ export class TUI {
       };
     } else if (k === 'l') {
       this._confirm(
-        'Log in via browser?',
-        'Opens a browser to add any Claude account; you name it afterward.',
+        'Log in / re-authenticate via browser?',
+        'Opens a browser. Logging into an account that\'s already added RE-AUTHENTICATES it in place (revives a reauth/error account) — no duplicate. Otherwise a new account is added.',
         () => this._doLogin(),
       );
     } else if (k === 'n' && this.am.accounts.length > 0) {
@@ -577,8 +577,10 @@ export class TUI {
     }
   }
 
-  // Browser OAuth login: any Claude account, named afterward. Suspends the TUI
-  // around the interactive flow (browser + name prompt), then resumes.
+  // Browser OAuth login — the SAME flow re-authenticates an existing account (matched
+  // by accountUuid) or adds a new one. When the login is for an account already added,
+  // we say so, keep its name, and skip the "name this account" prompt — so it's clear
+  // it's a RE-AUTH in place (revives a dead-refresh/reauth account), not a duplicate.
   async _doLogin() {
     const wasRunning = this.running;
     if (wasRunning) this.stop();
@@ -586,14 +588,26 @@ export class TUI {
       process.stdout.write('\nOpening browser to log into Claude…\n');
       const creds = await loginOAuth();
       const profile = await fetchProfile(creds.accessToken);
-      const suggested = profile?.email
-        || `account-${this.config.accounts.filter(a => a.name.startsWith('account-')).length + 1}`;
-      const rl = createInterface({ input: process.stdin, output: process.stdout });
-      const answer = await new Promise(resolve => rl.question(`Name this account [${suggested}]: `, resolve));
-      rl.close();
-      const name = String(answer || '').trim() || suggested;
-      await this._upsertOAuthAccount({ creds, profile, name, source: 'login', verb: 'Added' });
-      process.stdout.write(`\nAdded account "${name}". Returning to maxpool…\n`);
+      const existing = this._findExistingOAuthAccount(profile);
+      let name;
+      if (existing) {
+        process.stdout.write(`\nThis Claude account is already added as "${existing.name}" — re-authenticating it in place (no duplicate).\n`);
+        name = existing.name;
+      } else {
+        const suggested = profile?.email
+          || `account-${this.config.accounts.filter(a => a.name.startsWith('account-')).length + 1}`;
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        const answer = await new Promise(resolve => rl.question(`Name this NEW account [${suggested}]: `, resolve));
+        rl.close();
+        name = String(answer || '').trim() || suggested;
+      }
+      // Message honors the ACTUAL result: if a manually-typed name collided with a
+      // different existing account, upsert updates in place → "Re-authenticated", never
+      // a false "Added new account".
+      const { updated } = await this._upsertOAuthAccount({ creds, profile, name, source: 'login' });
+      process.stdout.write(updated
+        ? `\nRe-authenticated "${name}". Returning to maxpool…\n`
+        : `\nAdded new account "${name}". Returning to maxpool…\n`);
     } catch (e) {
       process.stdout.write(`\nLogin failed: ${e.message}\n`);
     } finally {
@@ -664,9 +678,14 @@ export class TUI {
         amAcct.expiresAt = creds.expiresAt;
         amAcct.accountUuid = entry.accountUuid;
         amAcct.name = name;
+        // Fresh tokens from re-auth revive a dead-refresh account. This in-place
+        // update is the actual re-login path (the index.js reconcile sees no change
+        // and never calls updateAccountTokens), so refreshDead MUST be cleared here.
+        amAcct.refreshDead = false;
         if (amAcct.status === 'error') amAcct.status = 'active';
       }
       this._addLog(`Updated account "${name}"`);
+      return { updated: true, name };
     } else {
       this.config.accounts.push(entry);
       try {
@@ -677,9 +696,21 @@ export class TUI {
       }
       this.am.addAccount(entry);
       this._addLog(`${verb} account "${name}"`);
+      return { updated: false, name };
     }
   }
 
+  // Find an already-configured OAuth account matching a fresh browser-login profile —
+  // by accountUuid (primary), then name===email — the SAME precedence _upsertOAuthAccount
+  // dedupes on, so the login flow can honestly say "re-authenticating" vs "adding new".
+  _findExistingOAuthAccount(profile) {
+    const uuid = profile?.accountUuid || null;
+    const email = profile?.email || null;
+    let acct = uuid ? this.config.accounts.find(a => a.type === 'oauth' && a.accountUuid === uuid) : null;
+    if (!acct && email) acct = this.config.accounts.find(a => a.type === 'oauth' && a.name === email);
+    return acct || null;
+  }
+
   async _doAddKey(apiKey) {
     const key = String(apiKey || '').trim();
     if (!key) { this._addLog('No API key entered'); return; }
@@ -975,8 +1006,13 @@ export class TUI {
     if (a.enabled !== false && a.status === 'active' && this.am._isAccountWideRejected?.(a)) {
       effectiveStatus = 'blocked';
     }
+    // A dead refresh token surfaces as "reauth" (re-login needed) rather than a
+    // generic "error", so the user knows the fix. Display-only — account.status
+    // stays 'error' so routing/eligibility still exclude it.
+    if (a.enabled !== false && a.refreshDead) effectiveStatus = 'reauth';
     switch (effectiveStatus) {
       case 'active':    status = isCur ? green('active') : 'active'; break;
+      case 'reauth':    status = yellow('reauth'); break;
       case 'blocked':   status = red('blocked'); break;
       case 'probing':   status = green('probing'); break;
       case 'waiting':   status = yellow('waiting'); break;
@@ -1111,7 +1147,7 @@ export class TUI {
       case 'normal':
         return ` ${bold('a')} Accounts  ${bold('m')} Routing  ${bold('s')} Sync  ${bold('r')} Restart  ${bold('q')} Stop`;
       case 'accounts':
-        return ` ${bold('l')} Login (browser)  ${bold('k')} API key  ${bold('n')} Rename  ${bold('t')} Enable/disable  ${bold('d')} Delete  ${bold('Esc')} Back`;
+        return ` ${bold('l')} Login/re-auth (browser)  ${bold('k')} API key  ${bold('n')} Rename  ${bold('t')} Enable/disable  ${bold('d')} Delete  ${bold('Esc')} Back`;
       case 'routing':
         return ` ${bold('a')} Automatic  ${bold('p')} Manual preference  ${bold('f')} Cross-provider fallback  ${bold('Esc')} Back`;
       case 'select': {