maxpool 1.5.26 → 1.5.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.26",
+  "version": "1.5.28",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/event-log.js

@@ -99,6 +99,19 @@ export async function rotateIfNeeded() {
  * output (stdout in plain mode; the TUI separately re-points console at its ring
  * buffer, whose _addLog also calls appendEventLog, so TUI-mode lines persist too).
  */
+let stdoutSuppressed = false;
+
+/**
+ * Suppress the console mirror's STDOUT passthrough (the event-log append still
+ * runs). Used during a seamless TUI reload so a worker that doesn't currently own
+ * the terminal — the new worker before its takeover, or the old worker draining
+ * after it handed the TTY off — can't paint plain log lines over the live TUI of
+ * the worker that DOES own it. Per-process (each worker has its own module state),
+ * so it never affects the other worker. Read live inside the mirror, so lifting it
+ * takes effect immediately even for a console wrapper captured earlier.
+ */
+export function setConsoleStdoutSuppressed(v) { stdoutSuppressed = !!v; }
+
 export function installConsoleMirror() {
   if (origConsole) return; // idempotent
   origConsole = { log: console.log.bind(console), error: console.error.bind(console) };
@@ -106,7 +119,7 @@ export function installConsoleMirror() {
     const orig = origConsole[method];
     console[method] = (...args) => {
       try { appendEventLog(args.map(a => (typeof a === 'string' ? a : String(a))).join(' ')); } catch { /* never */ }
-      orig(...args);
+      if (!stdoutSuppressed) orig(...args);
     };
   }
 }
@@ -118,5 +131,5 @@ export const flushEventLog = () => writeChain;
 export function __resetEventLogForTest() {
   if (origConsole) { console.log = origConsole.log; console.error = origConsole.error; origConsole = null; }
   if (rotationTimer) { clearInterval(rotationTimer); rotationTimer = null; }
-  logPath = null; manageRotation = false; writeChain = Promise.resolve(); queued = 0; dropped = 0;
+  logPath = null; manageRotation = false; writeChain = Promise.resolve(); queued = 0; dropped = 0; stdoutSuppressed = false;
 }

package/src/index.js

@@ -3,7 +3,7 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { createInterface } from 'node:readline';
 import { loadOrCreateConfig, loadConfig, saveConfig, atomicConfigUpdate, getConfigPath, loadState, saveState, getStatePath, getLogPath, readGeneration, flushConfigWrites, flushStateWrites } from './config.js';
-import { setEventLogPath, installConsoleMirror } from './event-log.js';
+import { setEventLogPath, installConsoleMirror, setConsoleStdoutSuppressed } from './event-log.js';
 import { SleepGuard } from './sleep-guard.js';
 import { AccountManager } from './account-manager.js';
 import { createProxyServer } from './server.js';
@@ -48,12 +48,16 @@ function initEventLog(config, { manageRotation = false } = {}) {
   } catch { /* logging must never block startup */ }
 }
 
-// Which reload path an in-process reload request takes. Interactive (a live TUI)
-// reloads via a FULL cold restart so the fresh worker re-renders the TUI — a
-// seamless reload worker boots headless and would strand the user in raw logs.
-// Headless/service keeps the zero-downtime baton (nothing visual to lose).
-function reloadStrategy({ supervised, useTUI }) {
-  return supervised && !useTUI ? 'seamless' : 'cold-restart';
+// Which reload path an in-process reload request takes. ALL supervised reloads —
+// TUI and headless alike — use the zero-downtime baton so the listening socket
+// never closes (no ECONNREFUSED for the ~5 other sessions routing through us). A
+// TUI reload additionally hands the terminal off worker→worker (the new worker
+// re-renders the TUI at takeover; the old worker's terminalHandedOff guard stops
+// it clobbering the shared TTY on exit). Only an UNsupervised process cold-restarts.
+// The user escape hatch MAXPOOL_TUI_COLD_RESTART=1 forces the old cold path (see
+// requestReload) if the TTY handoff ever misbehaves on their terminal.
+function reloadStrategy({ supervised }) {
+  return supervised ? 'seamless' : 'cold-restart';
 }
 
 switch (command) {
@@ -657,20 +661,36 @@ async function serverWorkerCommand() {
 
   const port = config.proxy.port;
   const host = config.proxy.host || '127.0.0.1';
-  // A headless reload worker NEVER drives the TUI (single-owner terminal); it
-  // takes the TUI only on baton takeover. Cold/direct workers use it if on a TTY.
-  const useTUI = process.stdout.isTTY && process.stdin.isTTY && !isReloadWorker;
+  // A reload worker constructs a TUI when on a TTY but only START()s it on baton
+  // takeover (becomePrimary) — single-owner terminal, enforced by the baton order
+  // (old worker's tui.stop() precedes MSG_RELEASED precedes the new worker's
+  // MSG_TAKEOVER→tui.start()). It boots headless-silent until then (stdout muzzled
+  // just below), so its boot logs can't paint over the old worker's live TUI.
+  const useTUI = process.stdout.isTTY && process.stdin.isTTY;
+
+  // A reload worker with a TUI must not write plain logs to the shared terminal
+  // (still owned by the old worker's TUI) while booting toward takeover; suppress
+  // stdout (event-log append still runs). Lifted in becomePrimary at takeover.
+  if (isReloadWorker && useTUI) setConsoleStdoutSuppressed(true);
 
   let tui = null;
   let server = null;
   let syncTimer = null;
   let draining = false;
   let restartController = null;
+  // Set once this worker hands the terminal to a new worker during a seamless TUI
+  // reload; makes this (now non-owner) worker's exit-path restoreTerminal a NO-OP
+  // so it can't flip the shared TTY's raw-mode/alt-screen back and clobber the new
+  // worker's live TUI. Only the current terminal owner (or the supervisor) restores.
+  let terminalHandedOff = false;
 
   // Best-effort terminal restore on ANY abnormal exit path (uncaughtException,
   // a bare process.exit, a crash) so the user's shell is never left in raw mode
   // or the alt-screen. Idempotent and safe even when no TUI was running.
   const restoreTerminal = () => {
+    // Handed the TTY to a new worker (seamless TUI reload) → the new worker owns
+    // it now; restoring here would clobber its live TUI. No-op.
+    if (terminalHandedOff) return;
     try {
       if (tui?.running) { tui.stop(); return; }
       if (process.stdout.isTTY) process.stdout.write('\x1b[?25h\x1b[?1049l');
@@ -783,12 +803,14 @@ async function serverWorkerCommand() {
   // (not supervised, no IPC), fall back to the abrupt restart.
   const requestReload = () => {
     if (draining) return;
-    // Interactive (live TUI) → full cold restart so the fresh worker re-renders the
-    // TUI; headless/service → zero-downtime seamless baton (nothing visual to lose).
-    // Test-only: force the interactive cold-restart path headless (a pty can't be
-    // allocated in-suite), so the exit-75 respawn is exercised without a real TUI.
-    const forceCold = process.env.MAXPOOL_TEST_FORCE_COLD_RESTART === '1';
-    if (!forceCold && reloadStrategy({ supervised, useTUI }) === 'seamless') {
+    // Supervised → zero-downtime seamless baton (socket never closes; TUI hands the
+    // terminal off worker→worker). Unsupervised → cold restart.
+    // Escape hatches force the cold path: MAXPOOL_TEST_FORCE_COLD_RESTART (in-suite,
+    // no pty) and the USER-facing MAXPOOL_TUI_COLD_RESTART=1 (revert to the old
+    // brief-ECONNREFUSED cold restart if the seamless TTY handoff ever misbehaves).
+    const forceCold = process.env.MAXPOOL_TEST_FORCE_COLD_RESTART === '1'
+      || process.env.MAXPOOL_TUI_COLD_RESTART === '1';
+    if (!forceCold && reloadStrategy({ supervised }) === 'seamless') {
       try {
         process.send({ type: MSG_RELOAD_REQUEST });
         return;
@@ -954,6 +976,10 @@ async function serverWorkerCommand() {
   // baton (a reload) — freeze the update check so a reload doesn't re-probe npm
   // (only a cold supervisor start self-updates).
   const becomePrimary = async ({ viaTakeover }) => {
+    // We're taking the terminal now (or are the cold-start primary). Lift the
+    // reload-worker boot muzzle so the TUI's first render + any plain-mode fallback
+    // logs reach stdout. (No-op for a worker that never suppressed.)
+    setConsoleStdoutSuppressed(false);
     if (tui) {
       if (tui.start()) {
         console.log(`Listening on ${host}:${port} with ${accounts.length} account(s)`);
@@ -1041,6 +1067,13 @@ async function serverWorkerCommand() {
       await flushStateWrites();
 
       if (tui?.running) tui.stop(); // restore terminal before the new worker takes it
+      // The terminal is now HANDED OFF: the incoming worker will take the TTY at
+      // MSG_TAKEOVER. Arm the guard UNCONDITIONALLY (even if the TUI was already
+      // stopped) so this worker's later exit(0) restoreTerminal can't clobber the
+      // new worker's TUI. Also muzzle our own remaining drain-time logs (in-flight
+      // requests completing) so they don't paint the new worker's alt-screen.
+      terminalHandedOff = true;
+      setConsoleStdoutSuppressed(true);
       try { process.send({ type: MSG_RELEASED }); } catch { /* ignore */ }
 
       // Drain bounded in-flight on EXISTING access tokens (no refresh needed),
@@ -1569,6 +1602,11 @@ Options:
   --log-to DIR        Log full requests/responses to DIR (server, one file per request)
   --with-key          Include proxy API key in maxpool env output
 
+Env:
+  MAXPOOL_TUI_COLD_RESTART=1   Reload (r) via a full cold restart instead of the
+                               zero-downtime seamless handoff — a fallback if the
+                               terminal ever misbehaves after a reload.
+
 Config: ${getConfigPath()}
 `);
 }

package/src/server.js

@@ -24,6 +24,7 @@ const DEFAULT_RETRY = {
 const UPSTREAM_TTFB_MS = Math.max(5_000, Number(process.env.MAXPOOL_TTFB_MS) || 120_000);        // headers must arrive within this
 const STREAM_IDLE_MS = Math.max(30_000, Number(process.env.MAXPOOL_STREAM_IDLE_MS) || 300_000);  // max gap BETWEEN streamed chunks (reset per chunk)
 const UPSTREAM_BODY_MS = Math.max(30_000, Number(process.env.MAXPOOL_BODY_MS) || 300_000);       // non-streaming body read
+const CLIENT_DRAIN_MS = Math.max(5_000, Number(process.env.MAXPOOL_DRAIN_MS) || 60_000);         // max wait for a backpressured client to drain (half-open client → free the lease)
 
 const DEFAULT_QUEUE = {
   enabled: true,
@@ -167,32 +168,40 @@ export function createProxyServer(accountManager, config, hooks = {}) {
         return;
       }
 
-      // Buffer request body (needed for retry on 429)
-      const bodyChunks = [];
-      for await (const chunk of req) {
-        bodyChunks.push(chunk);
-      }
-      const body = Buffer.concat(bodyChunks);
-      const retryConfig = { ...DEFAULT_RETRY, ...(config.retry || {}) };
-      const queueConfig = { ...DEFAULT_QUEUE, ...(config.queue || {}) };
-      const canRetryBufferedBody = body.length <= retryConfig.maxRetryBufferBytes;
-      const requestInfo = describeRequest(req, body);
-      const maxQueuedBodyBytes = queueConfig.maxQueuedBodyBytes == null
-        ? Infinity
-        : Math.max(0, Number(queueConfig.maxQueuedBodyBytes) || 0);
-      const canQueueBufferedBody = body.length <= maxQueuedBodyBytes;
-      if (!canQueueBufferedBody) {
-        requestInfo.queueBlockedReason = `request body ${body.length} bytes exceeds queue.maxQueuedBodyBytes ${maxQueuedBodyBytes}`;
-      }
-      requestInfo.profile = getMaxpoolProfile(req.headers);
-      requestInfo.sessionKey = headerValue(req.headers, 'x-maxpool-session');
-      if (requestInfo.requiresAnthropicThinkingIntegrity && requestInfo.profile === 'all') {
-        console.log('[Maxpool] Anthropic thinking detected; provider fallback disabled for this session/request');
-      }
-      prepareRuntimeProviders(accountManager, req.headers);
-
+      // The request is now TRACKED (onRequestStart accepted → tui.active +
+      // restartController.activeRequests both hold it). EVERYTHING that can throw —
+      // including body buffering — must run inside the try whose finally fires
+      // onRequestEnd, or a client that dies mid-body-read throws to the OUTER catch
+      // and leaks the active entry AND the restart drain counter (hangs a reload's
+      // drain). requestInfo starts as {} so the error path never dereferences an
+      // undefined (a body-read throw lands before describeRequest runs).
       const ctx = { account: null, status: null };
+      let requestInfo = {};
       try {
+        // Buffer request body (needed for retry on 429)
+        const bodyChunks = [];
+        for await (const chunk of req) {
+          bodyChunks.push(chunk);
+        }
+        const body = Buffer.concat(bodyChunks);
+        const retryConfig = { ...DEFAULT_RETRY, ...(config.retry || {}) };
+        const queueConfig = { ...DEFAULT_QUEUE, ...(config.queue || {}) };
+        const canRetryBufferedBody = body.length <= retryConfig.maxRetryBufferBytes;
+        requestInfo = describeRequest(req, body);
+        const maxQueuedBodyBytes = queueConfig.maxQueuedBodyBytes == null
+          ? Infinity
+          : Math.max(0, Number(queueConfig.maxQueuedBodyBytes) || 0);
+        const canQueueBufferedBody = body.length <= maxQueuedBodyBytes;
+        if (!canQueueBufferedBody) {
+          requestInfo.queueBlockedReason = `request body ${body.length} bytes exceeds queue.maxQueuedBodyBytes ${maxQueuedBodyBytes}`;
+        }
+        requestInfo.profile = getMaxpoolProfile(req.headers);
+        requestInfo.sessionKey = headerValue(req.headers, 'x-maxpool-session');
+        if (requestInfo.requiresAnthropicThinkingIntegrity && requestInfo.profile === 'all') {
+          console.log('[Maxpool] Anthropic thinking detected; provider fallback disabled for this session/request');
+        }
+        prepareRuntimeProviders(accountManager, req.headers);
+
         await forwardRequest(
           req, res, body, accountManager, upstream, 0, hooks, reqId, ctx, logDir,
           retryConfig, queueConfig, requestInfo, canRetryBufferedBody, canQueueBufferedBody, new Set(),
@@ -200,10 +209,14 @@ export function createProxyServer(accountManager, config, hooks = {}) {
       } catch (err) {
         ctx.status = ctx.status || 502;
         console.error('[Maxpool] Unhandled error:', err);
-        sendErrorResponse(res, requestInfo, 502, {
-          type: 'error',
-          error: { type: 'proxy_error', message: 'Internal proxy error' },
-        });
+        // Only attempt an error body if the socket is still writable — a client
+        // that aborted during body-read leaves res destroyed; writing then throws.
+        if (!res.destroyed && !res.writableEnded && !res.headersSent) {
+          sendErrorResponse(res, requestInfo, 502, {
+            type: 'error',
+            error: { type: 'proxy_error', message: 'Internal proxy error' },
+          });
+        }
       } finally {
         hooks.onRequestEnd?.(reqId, {
           method: req.method, path: req.url,
@@ -1822,14 +1835,37 @@ async function streamResponse(webStream, res, status, responseHeaders, accountIn
         parseSSEEvent(event, accountIndex, accountManager, requestInfo);
       }
 
-      // Handle backpressure — also bail out if client disconnects,
-      // because 'drain' will never fire on a destroyed socket
+      // Handle backpressure — bail out if the client disconnects OR goes silently
+      // half-open. A vanished peer (laptop sleep / Wi-Fi drop / lost TCP FIN) leaves
+      // the send buffer full so this branch is entered, but sends no FIN ('close'
+      // never fires) and never ACKs ('drain' never fires) — so a bare await here
+      // hangs FOREVER, pinning the account lease and never firing onRequestEnd (the
+      // phantom-"N active" leak). Bound it: if the client can't drain a small SSE
+      // chunk within CLIENT_DRAIN_MS it's gone → break (same disposition as a
+      // destroyed socket: the finally runs reader.cancel()+res.end(), the lease
+      // frees with success:true, onRequestEnd fires). A legit slow client drains
+      // each episode well within this window; the timer is per-episode, never summed.
       if (!ok) {
-        await new Promise(resolve => {
-          res.once('drain', resolve);
-          res.once('close', resolve);
+        let drainTimer, onDrain, onClose2;
+        const settled = new Promise(resolve => {
+          onDrain = () => resolve(true);
+          onClose2 = () => resolve(true);
+          res.once('drain', onDrain);
+          res.once('close', onClose2);
+          // Bound the wait by the drain cap, but never longer than this stream's
+          // idle bound (keeps it injectable for tests; prod = min(300s, 60s) = 60s).
+          drainTimer = setTimeout(() => resolve(false), Math.min(idleMs, CLIENT_DRAIN_MS));
+          drainTimer.unref?.();
         });
-        if (res.destroyed) break;
+        let drained;
+        try {
+          drained = await settled;
+        } finally {
+          clearTimeout(drainTimer);
+          res.off('drain', onDrain);
+          res.off('close', onClose2);
+        }
+        if (!drained || res.destroyed) break; // client gone/stalled → stop, clean up in finally
       }
     }
 

package/src/tui.js

@@ -18,11 +18,38 @@ const yellow = s => fg(33, s);
 const red = s => fg(31, s);
 const cyan = s => fg(36, s);
 const gray = s => fg(90, s);
+const dimUnderline = s => `${ESC}2;4m${s}${RESET}`;
 
 const ANSI_RE = /\x1b\[[0-9;]*m/g;
 const strip = s => s.replace(ANSI_RE, '');
 const vw = s => strip(s).length;
 
+// ── Accounts-table columns ───────────────────────────────────
+// Fixed column widths shared by the header row (acctHeader) AND every data row, so
+// the header labels stay aligned with the columns they name. The Account/Type/
+// Status/Quota start offsets (4/17/26/40) are pure functions of these widths + the
+// 4-col row prefix, independent of the quota-bar width.
+const NAME_W = 12;         // a.name.slice(0, NAME_W).padEnd(NAME_W)
+const TYPE_W = 8;          // a.type.padEnd(TYPE_W) — fits "provider"
+const STATUS_W = 13;       // rpad(status, STATUS_W) — fits "throttled 59s"
+const ROW_PREFIX = '    '; // ' ' + sel(1) + cur(1) + ' ' — 4 cols before the name
+
+/**
+ * Aligned column header for the accounts table. Names the three columns that carry
+ * NO inline label (Account / Type / Status) plus a group label over the two quota
+ * bars (Quota). The per-bar naming (Ses/Wk for OAuth, Tok/Req for API keys) and the
+ * load fields (Now/15m/1h) stay inline per row — they're row-type-dependent and
+ * begin at a variable offset — so the header stops after the Quota group label.
+ */
+function acctHeader(W) {
+  const quota = W >= 88 ? 'Quota (used% · resets-in)' : 'Quota';
+  return ROW_PREFIX
+    + 'Account'.padEnd(NAME_W) + ' '
+    + 'Type'.padEnd(TYPE_W) + ' '
+    + 'Status'.padEnd(STATUS_W) + ' '
+    + quota;
+}
+
 function rpad(s, w) {
   const gap = w - vw(s);
   return gap > 0 ? s + ' '.repeat(gap) : s;
@@ -194,7 +221,7 @@ function emptyBar(label, w = 10) {
   return `${ESC}100m${' '.repeat(lp)}${text}${' '.repeat(rp)}${RESET}`;
 }
 
-export const __tuiTest = { formatReset, quotaLabel, bar, emptyBar, strip, loadText, countdown };
+export const __tuiTest = { formatReset, quotaLabel, bar, emptyBar, strip, loadText, countdown, acctHeader, fitLine };
 
 function timestamp() {
   return new Date().toLocaleTimeString('en-US', { hour12: false });
@@ -663,12 +690,14 @@ export class TUI {
       const previous = this.config.accounts[idx];
       entry.enabled = previous.enabled;
       this.config.accounts[idx] = entry;
-      try {
-        await this.saveConfig(this.config);
-      } catch (error) {
-        this.config.accounts[idx] = previous;
-        throw error;
-      }
+      // Update the AccountManager to the FRESH tokens BEFORE persisting. The
+      // saveConfig writer (index.js) derives the ON-DISK tokens from the
+      // AccountManager, not from config.accounts — so persisting first writes the
+      // STALE pre-re-auth token (typically the dead one we're re-authing away from)
+      // to disk. The account then works in memory but boots DEAD on the next restart
+      // (a just-re-authed token rejected as invalid_grant). A later refresh does NOT
+      // heal disk (persistTokenRefresh's generation guard skips a disk token that
+      // != _refreshedFrom), so disk must be made correct right here.
       const amAcct = this.am.accounts.find(account =>
         (entry.accountUuid && account.accountUuid === entry.accountUuid) || account.name === name
       );
@@ -684,6 +713,17 @@ export class TUI {
         amAcct.refreshDead = false;
         if (amAcct.status === 'error') amAcct.status = 'active';
       }
+      try {
+        await this.saveConfig(this.config);
+      } catch (error) {
+        // Persist failed (e.g. disk full). The browser re-auth genuinely SUCCEEDED,
+        // so KEEP the AccountManager on the fresh tokens — reverting it to the dead
+        // token would brick a working in-memory account. Roll back only the
+        // config.accounts mirror and surface the error; disk self-heals on the next
+        // saveConfig (the AM-derived writer re-writes the fresh token).
+        this.config.accounts[idx] = previous;
+        throw error;
+      }
       this._addLog(`Updated account "${name}"`);
       return { updated: true, name };
     } else {
@@ -906,10 +946,13 @@ export class TUI {
       lines.push(yellow('  No accounts configured. Press [a] to add one.'));
     } else {
       lines.push('');
-      // Column legend — the per-row numbers are otherwise cryptic. Ses/Wk are the
-      // two quota bars; Now is live concurrency; 15m/1h are recent throughput.
+      // Aligned column header (dim + underline so it reads as chrome, not data). It
+      // labels the fixed columns that have no inline label; the Ses/Wk/Tok/Req and
+      // Now/15m/1h labels stay inline per row. A short glossary below expands the
+      // abbreviations the header + inline labels can't spell out.
+      lines.push(dimUnderline(acctHeader(W)));
       if (W >= 88) {
-        lines.push(' ' + dim('Ses/Wk = 5h/7d quota (used% · resets-in) · Now = in-flight (weight) · 15m/1h = requests served (avg latency · Nf=fails)'));
+        lines.push(' ' + dim('Ses 5h · Wk 7d · Now in-flight (weight) · 15m/1h served (avg · f fails)'));
       }
       const showBoth = W >= 70;
       const bw = showBoth
@@ -979,13 +1022,13 @@ export class TUI {
     const cur = isCur ? green('►') : ' ';
 
     // Name (bold if selected)
-    const rawName = a.name.slice(0, 12).padEnd(12);
+    const rawName = a.name.slice(0, NAME_W).padEnd(NAME_W);
     const name = isSel ? bold(rawName) : rawName;
 
     // Type — pad to 8 so "provider" (8 chars) doesn't overflow a 7-wide column and
     // shift the whole provider row (incl. its quota bars) 1 char out of alignment
     // with the "oauth"/"apikey" rows.
-    const type = gray(a.type.padEnd(8));
+    const type = gray(a.type.padEnd(TYPE_W));
 
     // Status
     let status;
@@ -1030,7 +1073,7 @@ export class TUI {
       default:          status = a.status || 'ready';
     }
     // Widened from 10 to fit "throttled 59s" so the quota bars stay column-aligned.
-    status = rpad(status, 13);
+    status = rpad(status, STATUS_W);
 
     if (a.type === 'provider') {
       return this._renderProviderAcct(sel, cur, name, type, status, a, bw, showBoth);