maxpool 1.5.31 → 1.5.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.31",
+  "version": "1.5.33",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -55,6 +55,18 @@ function emptyQuota() {
     // marker — a swallowed failing probe no longer silently freezes a stale tag.
     // Header-driven updates do NOT stamp this (headers can't refresh scoped/provider).
     lastProbeOkAt: null,        // ms
+    // Last background probe FAILURE — surfaced in the TUI/status so a persistently
+    // failing probe (e.g. the usage endpoint rate-limiting us) is VISIBLE instead of
+    // silently swallowed (which let a stale weekly keep looking fresh). Cleared on
+    // the next successful probe. Not persisted (transient).
+    lastProbeError: null,       // string
+    lastProbeErrorAt: null,     // ms
+    lastProbeErrorStatus: null, // http status (429, 500, …) or null
+    // Last time the DISPLAYED bars (unified5h/7d for OAuth, tokens/requests for
+    // API-key) were refreshed from a RESPONSE HEADER (updateQuota). Lets the TUI
+    // staleness marker tell "probe stale but bars fresh from live traffic" (a busy
+    // account — NOT stale) from "genuinely nothing refreshed it" (idle — stale).
+    lastHeaderQuotaAt: null,    // ms
   };
 }
 
@@ -1942,6 +1954,10 @@ export class AccountManager {
     }
 
     q.lastProbeOkAt = Date.now();
+    // A successful probe clears any recorded failure — freshness confirmed.
+    q.lastProbeError = null;
+    q.lastProbeErrorAt = null;
+    q.lastProbeErrorStatus = null;
 
     // If we just learned this account's weekly window while probing, re-evaluate
     // selection (same path as learning it from a live response).
@@ -1951,6 +1967,22 @@ export class AccountManager {
     }
   }
 
+  /**
+   * Record a background probe FAILURE for an account (called by the prober instead
+   * of swallowing the error). Surfaced in getStatus()/the TUI so a persistently
+   * failing probe is visible; the stored quota values are left untouched (they age
+   * into the staleness marker rather than being blanked — see applyUsageData's
+   * `!= null` guards, which are load-bearing for weekly routing).
+   */
+  recordProbeError(accountIndex, message, status = null) {
+    const account = this.accounts[accountIndex];
+    if (!account) return;
+    const q = account.quota;
+    q.lastProbeError = message ? String(message).slice(0, 160) : 'probe failed';
+    q.lastProbeErrorAt = Date.now();
+    q.lastProbeErrorStatus = Number.isFinite(status) ? status : null;
+  }
+
   /**
    * Update a PROVIDER account's quota from a provider usage probe
    * (fetchProviderUsage). z.ai maps to Ses/Wk token windows; Kimi has no pollable
@@ -1987,7 +2019,7 @@ export class AccountManager {
   }
 
   /**
-   * True when the background quota probe hasn't succeeded in > 2× its interval —
+   * True when the background quota probe hasn't succeeded in > 3× its interval —
    * the last-known scoped/provider values are aging with no confirmation. Returns
    * false when the probe is off (nothing to be stale against) or has never yet
    * succeeded (startup — shown as "no data", not "stale").
@@ -1997,7 +2029,10 @@ export class AccountManager {
     if (!interval || interval <= 0) return false;
     const last = account?.quota?.lastProbeOkAt;
     if (last == null) return false;
-    return (now - last) > Math.max(2 * interval, 120_000);
+    // 3× interval (min 3 min): the probe now rolls through accounts one at a time
+    // (a full sweep ~ N × interval/6), so a healthy account refreshes well inside
+    // this window — the marker only fires on a genuine multi-sweep probe failure.
+    return (now - last) > Math.max(3 * interval, 180_000);
   }
 
   /**
@@ -2088,6 +2123,15 @@ export class AccountManager {
     if (genericRemaining != null) account.quota.genericRemaining = genericRemaining;
     if (genericReset != null) account.quota.genericReset = genericReset;
 
+    // Stamp header-freshness ONLY when a real quota header actually arrived — so a
+    // header-less response never falsely marks the bars fresh. Drives the TUI's
+    // "busy account isn't stale even if its background probe is 429-throttled".
+    const gotQuotaHeader = !isNaN(u5h) || !isNaN(u7d)
+      || !isNaN(tokensLimit) || !isNaN(tokensRemaining)
+      || !isNaN(requestsLimit) || !isNaN(requestsRemaining)
+      || genericLimit != null || genericRemaining != null;
+    if (gotQuotaHeader) account.quota.lastHeaderQuotaAt = Date.now();
+
     account.usage.totalRequests++;
     account.usage.lastUsed = new Date().toISOString();
 
@@ -2598,6 +2642,9 @@ export class AccountManager {
   getStatus() {
     const now = Date.now();
     return {
+      // Running version + npm update state (set at startup by maybeCheckForUpdate).
+      // null until the check resolves; `current` is known even offline.
+      version: this.versionInfo || null,
       currentAccount: this.accounts[this.currentIndex]?.name,
       switchThreshold: this.switchThreshold,
       routing: {

package/src/index.js

@@ -6,13 +6,13 @@ import { loadOrCreateConfig, loadConfig, saveConfig, atomicConfigUpdate, getConf
 import { setEventLogPath, installConsoleMirror, setConsoleStdoutSuppressed } from './event-log.js';
 import { SleepGuard } from './sleep-guard.js';
 import { AccountManager } from './account-manager.js';
-import { createProxyServer } from './server.js';
+import { createProxyServer, REQUEST_IDLE_MAX_MS } from './server.js';
 import { Prober } from './prober.js';
 import { loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon, tokenFingerprint } from './oauth.js';
 import { TUI } from './tui.js';
 import { RestartController } from './restart-controller.js';
 import { resolveAccounts } from './account-config.js';
-import { maybeCheckForUpdate } from './updater.js';
+import { maybeCheckForUpdate, getCurrentVersion } from './updater.js';
 import {
   runReloadBaton,
   RELOAD_SWAPPED, RELOAD_ROLLED_BACK,
@@ -27,6 +27,18 @@ const SERVER_RESTART_EXIT_CODE = 75;
 // worker rolled back — self-heal admission so we don't 503 forever. > the baton
 // readiness timeout (10s) + margin.
 const RELOAD_ROLLBACK_SELFHEAL_MS = Math.max(15_000, Number(process.env.MAXPOOL_RELOAD_SELFHEAL_MS) || 30_000);
+// Seamless-reload drain cap. On a seamless reload the NEW worker already serves
+// ALL new traffic while the OLD worker only finishes its own in-flight requests,
+// so a long old-worker drain has zero request-facing cost — let a long streaming
+// response complete instead of getting cut ("Connection closed mid-response").
+// Sized ABOVE the per-request idle reaper (REQUEST_IDLE_MAX_MS, imported from
+// server.js so both sizes share ONE source of truth) so an actively-progressing
+// stream is never cut mid-flight; the reaper bounds a truly-stuck request, and
+// this flat cap is only the last-resort ceiling. Quit/Ctrl-C keeps the short
+// drainTimeoutMs (the user wants to exit now). An explicit MAXPOOL_RELOAD_DRAIN_MS
+// override is honored down to a 60s floor (a shorter drain trades stream-
+// completeness for faster reloads); leave it unset to auto-track the reaper +60s.
+const RELOAD_DRAIN_MS = Math.max(60_000, Number(process.env.MAXPOOL_RELOAD_DRAIN_MS) || (REQUEST_IDLE_MAX_MS + 60_000));
 const SERVER_WORKER_ENV = 'MAXPOOL_SERVER_WORKER';
 // Set by the supervisor when it spawns a worker for a seamless reload: that
 // worker boots HEADLESS (plain logs, no writer lease) and waits for the baton.
@@ -325,7 +337,7 @@ async function supervisorCommand() {
         // sent PRIMARY during the baton; re-assert the master-accept close.
         monitorAsActive(newWorker);
         closeMasterAccept().catch(() => {});
-        reapOldWorker(oldWorker, config);
+        reapOldWorker(oldWorker);
         return;
       }
 
@@ -415,17 +427,20 @@ async function supervisorCommand() {
 
 // Drain + reap a released worker. The worker exits itself once its bounded
 // in-flight finishes; the supervisor SIGKILLs it if it outlives the drain cap.
-function reapOldWorker(worker, config) {
+function reapOldWorker(worker) {
   if (!worker) return;
-  const drainTimeoutMs = Math.max(1000, Number(config.shutdown?.drainTimeoutMs) || 15_000);
+  // +30s grace over the worker's own RELOAD_DRAIN_MS hardCap so its clean exit(0)
+  // (fired while its streaming socket keeps the loop alive) always wins the race —
+  // SIGKILL only ever reaps a genuinely wedged worker, never cuts a live stream.
+  const cap = RELOAD_DRAIN_MS + 30_000;
   let reaped = false;
   const finish = () => { if (reaped) return; reaped = true; clearTimeout(timer); };
   const timer = setTimeout(() => {
     if (reaped) return;
-    console.error(`[Maxpool] Old worker outlived ${Math.ceil(drainTimeoutMs / 1000)}s drain cap; SIGKILL.`);
+    console.error(`[Maxpool] Old worker outlived ${Math.ceil(cap / 1000)}s reload-drain cap; SIGKILL.`);
     try { worker.child.kill('SIGKILL'); } catch { /* ignore */ }
     finish();
-  }, drainTimeoutMs);
+  }, cap);
   timer.unref?.();
   worker.child.once('exit', finish);
 }
@@ -590,9 +605,16 @@ async function serverWorkerCommand() {
   const probeSeconds = process.env.MAXPOOL_DISABLE_QUOTA_PROBE === '1' ? 0 : (config.quotaProbeSeconds || 0);
   const prober = new Prober(accountManager, { intervalMs: probeSeconds * 1000 });
   // Tell the AM the probe cadence so the TUI can flag a scoped/provider tag whose
-  // background probe has gone stale (> 2× interval since last success).
+  // background probe has gone stale (> 3× interval since last success).
   accountManager.quotaProbeIntervalMs = probeSeconds * 1000;
 
+  // Seed the running version immediately so the TUI header always shows it, even
+  // before (or without) the npm update check. The cold worker's update check below
+  // fills in latest/hasUpdate.
+  getCurrentVersion()
+    .then(v => { accountManager.versionInfo ||= { current: v, latest: null, hasUpdate: false, checkedAt: null }; })
+    .catch(() => {});
+
   // Persist refreshed tokens back to config. Defense-in-depth: the updater reads
   // the on-disk refresh token and SKIPS the rotation if a fresher writer already
   // advanced it (generation guard), so a stale write can't double-spend a token.
@@ -1040,7 +1062,7 @@ async function serverWorkerCommand() {
     if (!viaTakeover && !isReloadWorker) {
       if (process.env.MAXPOOL_TEST_LOG_UPDATE_CHECK === '1') console.log('[Maxpool] UPDATE_CHECK_FIRED');
       const notify = msg => (tui?._addLog ? tui._addLog(msg) : console.log(`[Maxpool] ${msg}`));
-      maybeCheckForUpdate(config, notify).catch(() => {});
+      maybeCheckForUpdate(config, notify, info => { accountManager.versionInfo = info; }).catch(() => {});
     } else if (process.env.MAXPOOL_TEST_LOG_UPDATE_CHECK === '1') {
       console.log('[Maxpool] UPDATE_CHECK_SKIPPED (reload)');
     }
@@ -1101,17 +1123,28 @@ async function serverWorkerCommand() {
       setConsoleStdoutSuppressed(true);
       try { process.send({ type: MSG_RELEASED }); } catch { /* ignore */ }
 
-      // Drain bounded in-flight on EXISTING access tokens (no refresh needed),
-      // then exit(0). The supervisor SIGKILLs us if we outlive its drain cap.
+      // (macOS) releaseLease() above dropped the wake-lock, but we still stream our
+      // in-flight requests for up to RELOAD_DRAIN_MS. Re-arm the guard so an idle
+      // Mac can't Maintenance-Sleep mid-drain and cut a long overnight stream (the
+      // exact case the guard exists for). It re-checks getGlobalInFlight and
+      // releases on its own once we're idle; caffeinate -w <pid> dies with us
+      // regardless. Started AFTER the stdout muzzle so its log can't paint the new
+      // worker's screen. No-op off macOS / when disabled.
+      sleepGuard.start();
+
+      // Drain bounded in-flight on EXISTING access tokens (no refresh needed), then
+      // exit(0). Cap = RELOAD_DRAIN_MS (above the idle reaper) so a long streaming
+      // response finishes instead of being cut; the supervisor SIGKILLs us only if
+      // we outlive its (slightly longer) cap.
       const waitForDrain = () => {
         if (restartController.activeRequests.size === 0) { process.exit(0); return; }
       };
       const drainPoll = setInterval(waitForDrain, 200);
       drainPoll.unref?.();
       const hardCap = setTimeout(() => {
-        console.error(`[Maxpool] Released worker drain cap reached with ${restartController.activeRequests.size} active; exiting.`);
+        console.error(`[Maxpool] Released worker reload-drain cap reached with ${restartController.activeRequests.size} active; exiting.`);
         process.exit(0);
-      }, drainTimeoutMs);
+      }, RELOAD_DRAIN_MS);
       hardCap.unref?.();
       waitForDrain();
     };

package/src/prober.js

@@ -10,7 +10,7 @@
 import { fetchUsage, fetchProviderUsage } from './oauth.js';
 
 export class Prober {
-  constructor(accountManager, { intervalMs = 0, probeFn = fetchUsage, providerProbeFn = fetchProviderUsage, timeoutMs = 10_000, log = console.log } = {}) {
+  constructor(accountManager, { intervalMs = 0, probeFn = fetchUsage, providerProbeFn = fetchProviderUsage, timeoutMs = 10_000, log = console.log, usageGapMs = null } = {}) {
     this.am = accountManager;
     this.intervalMs = intervalMs;
     this.probeFn = probeFn;
@@ -19,6 +19,14 @@ export class Prober {
     this.log = log;
     this.timer = null;
     this._running = false;
+    // De-burst pacing for the shared, per-IP-rate-limited /api/oauth/usage
+    // endpoint (see probeAll). null gap → derive from intervalMs; 0 → no pacing.
+    this._configuredUsageGapMs = usageGapMs;
+    this._usageGapMs = null;      // current adaptive gap (grows on 429, eases on OK)
+    this._lastUsageProbeAt = 0;   // ms of the last usage request across ALL accounts
+    this._stopping = false;
+    this._pendingSleep = null;    // canceller for an in-flight pacing sleep
+    this._sweepStart = 0;         // rotates the per-sweep start account (fairness)
   }
 
   start() {
@@ -46,7 +54,9 @@ export class Prober {
    *  (the baton release) can be sure no probe-driven token rotation is pending
    *  before it hands the writer lease to another worker. */
   async stop() {
+    this._stopping = true;
     if (this.timer) { clearInterval(this.timer); this.timer = null; }
+    if (this._pendingSleep) this._pendingSleep(); // abort an in-flight pacing wait
     if (this._inflight) { try { await this._inflight; } catch { /* swallow */ } }
   }
 
@@ -57,16 +67,36 @@ export class Prober {
   probeAll() {
     if (this._running) return this._inflight || Promise.resolve();
     this._running = true;
+    this._stopping = false;
     this._inflight = (async () => {
       try {
         // Skip auth-dead accounts (dead refresh token): probing them just re-POSTs
         // the rejected token every cycle — a 400 storm. They recover only on re-auth.
         const oauth = this.am.accounts.filter(a => a.type === 'oauth' && a.credential && !a.refreshDead);
         const providers = this.am.accounts.filter(a => a.type === 'provider' && a.credential);
-        await Promise.all([
-          ...oauth.map(a => this.probeOne(a)),
-          ...providers.map(a => this.probeProvider(a)),
-        ]);
+
+        // Providers read DISTINCT hosts (z.ai monitor / Kimi) — no collision — so
+        // they run concurrently. Every OAuth account, though, reads the SAME
+        // /api/oauth/usage, which is tightly rate-limited PER SOURCE IP: firing them
+        // all at once (the old Promise.all) 429'd all but ~one per cycle, so only a
+        // single account's 5h/7d refreshed each tick and the weekly looked frozen.
+        // Probe the OAuth accounts ONE AT A TIME, paced across the interval, and back
+        // off on a 429 — so the whole fleet refreshes instead of self-throttling.
+        const providerWork = Promise.all(providers.map(a => this.probeProvider(a)));
+        // Rotate the start account each sweep so no account is systematically the
+        // oldest-refreshed (the serialized sweep would otherwise always probe the
+        // last account last).
+        const start = oauth.length ? (this._sweepStart++ % oauth.length) : 0;
+        for (let i = 0; i < oauth.length; i++) {
+          if (this._stopping) break;
+          await this._paceUsage();
+          if (this._stopping) break;
+          const r = await this.probeOne(oauth[(start + i) % oauth.length]);
+          this._lastUsageProbeAt = Date.now();
+          if (r && r.status === 429) this._bumpUsageGap();
+          else if (r && r.ok) this._relaxUsageGap();
+        }
+        await providerWork.catch(() => {});
       } finally {
         this._running = false;
         this._inflight = null;
@@ -75,6 +105,54 @@ export class Prober {
     return this._inflight;
   }
 
+  /** Wait until the current usage-probe gap has elapsed since the last usage
+   *  request, so consecutive OAuth probes don't collide on the shared endpoint.
+   *  No-op when pacing is disabled (gap 0 — manual/tests). Abortable via stop(). */
+  async _paceUsage() {
+    const gap = this._usageGapMs != null ? this._usageGapMs : this._baseUsageGap();
+    if (!gap || gap <= 0) return;
+    const wait = gap - (Date.now() - (this._lastUsageProbeAt || 0));
+    if (wait > 0) await this._sleep(wait);
+  }
+
+  /** Base spacing between usage probes. Spread ~all accounts across the interval
+   *  (interval/6, clamped 6-20s) unless explicitly configured. 0 when the probe is
+   *  off / driven manually so a direct probeAll() runs with no delay. */
+  _baseUsageGap() {
+    if (this._configuredUsageGapMs != null) return this._configuredUsageGapMs;
+    if (this.intervalMs > 0) return Math.max(6000, Math.min(20_000, Math.floor(this.intervalMs / 6)));
+    return 0;
+  }
+
+  /** A usage 429 means we're probing the shared endpoint too fast — widen the gap
+   *  (×1.5, cap 120s) so the fleet stops self-throttling. */
+  _bumpUsageGap() {
+    const base = this._baseUsageGap();
+    if (base <= 0) return; // pacing disabled — nothing to back off
+    const cur = this._usageGapMs != null ? this._usageGapMs : base;
+    this._usageGapMs = Math.min(120_000, Math.round(cur * 1.5));
+  }
+
+  /** A clean probe — ease the gap back toward the base (never below it). */
+  _relaxUsageGap() {
+    const base = this._baseUsageGap();
+    if (base <= 0) { this._usageGapMs = null; return; }
+    const cur = this._usageGapMs != null ? this._usageGapMs : base;
+    this._usageGapMs = Math.max(base, Math.round(cur * 0.9));
+  }
+
+  /** Abortable sleep — stop() cancels an in-flight pacing wait so a baton release
+   *  never blocks on it. NOT unref'd: the wait is short (≤ gap), it only runs during
+   *  an active sweep, and graceful shutdown always goes through stop() which clears
+   *  it — so it can't delay exit, while staying ref'd keeps the awaited sweep alive. */
+  _sleep(ms) {
+    return new Promise(resolve => {
+      if (this._stopping) return resolve();
+      const t = setTimeout(() => { this._pendingSleep = null; resolve(); }, ms);
+      this._pendingSleep = () => { clearTimeout(t); this._pendingSleep = null; resolve(); };
+    });
+  }
+
   /** Probe one PROVIDER account. Provider tokens are static API keys (no OAuth
    *  refresh). Best-effort; never throws. */
   async probeProvider(account) {
@@ -85,6 +163,10 @@ export class Prober {
     } catch { /* best-effort; never let a probe throw */ }
   }
 
+  /** Probe one OAUTH account. Returns {ok, status} so probeAll can pace/back-off
+   *  and so a persistent failure is RECORDED (surfaced in the TUI/status) rather
+   *  than silently swallowed — a swallowed failing probe is what let a stale
+   *  weekly look fresh. Never throws. */
   async probeOne(account) {
     try {
       await this.am.ensureTokenFresh(account.index);
@@ -94,9 +176,20 @@ export class Prober {
         await this.am.ensureTokenFresh(account.index, true);
         usage = await this._withTimeout(this.probeFn(account.credential));
       }
-      if (!usage || usage.error) return; // transient — try again next cycle
-      this.am.applyUsageData(account.index, usage);
-    } catch { /* best-effort; never let a probe throw */ }
+      if (usage == null) { // timed out
+        this.am.recordProbeError?.(account.index, 'probe timed out', null);
+        return { ok: false, status: null };
+      }
+      if (usage.error) { // HTTP error (e.g. 429) or fetch failure
+        this.am.recordProbeError?.(account.index, usage.error, usage.status ?? null);
+        return { ok: false, status: usage.status ?? null };
+      }
+      this.am.applyUsageData(account.index, usage); // clears the error + stamps freshness
+      return { ok: true, status: 200 };
+    } catch (e) { // best-effort; never let a probe throw
+      this.am.recordProbeError?.(account.index, e?.message || String(e), null);
+      return { ok: false, status: null };
+    }
   }
 
   _withTimeout(promise) {

package/src/server.js

@@ -29,7 +29,8 @@ const CLIENT_DRAIN_MS = Math.max(5_000, Number(process.env.MAXPOOL_DRAIN_MS) ||
 // request can go silent (no heartbeat there): TTFB 120s + nonStreamMaxWaitMs 300s +
 // UPSTREAM_BODY_MS 300s ≈ 720s — so a slow-but-alive non-streaming request is never
 // reaped at completion. Streaming holds heartbeat, so they're safe at any ceiling.
-const REQUEST_IDLE_MAX_MS = Math.max(900_000, Number(process.env.MAXPOOL_REQUEST_IDLE_MAX_MS) || 1_200_000);
+// Exported so index.js sizes RELOAD_DRAIN_MS off the SAME value (no drift).
+export const REQUEST_IDLE_MAX_MS = Math.max(900_000, Number(process.env.MAXPOOL_REQUEST_IDLE_MAX_MS) || 1_200_000);
 
 const DEFAULT_QUEUE = {
   enabled: true,

package/src/tui.js

@@ -415,6 +415,10 @@ export class TUI {
         'Reload account credentials and newly added accounts from the config file.',
         () => this._doSync(),
       );
+    } else if (k === 't' && this.am.accounts.length > 0) {
+      // Manual on/off toggle straight from the top level (also under a → Accounts).
+      // select → confirm → returns to 'normal', so this never strands the user.
+      this._startSelection('toggle');
     }
   }
 
@@ -920,7 +924,12 @@ export class TUI {
     const lines = [];
 
     // ── Header
-    const left = bold(' Maxpool');
+    const v = this.am.versionInfo;
+    const verStr = v?.current ? ` ${dim('v' + v.current)}` : '';
+    // "↑ vX.Y.Z" when a newer npm version is published; nothing when on latest or
+    // the check hasn't resolved yet (so the header never falsely implies up-to-date).
+    const updStr = (v?.hasUpdate && v?.latest) ? `  ${yellow('↑ v' + v.latest)}` : '';
+    const left = bold(' Maxpool') + verStr + updStr;
     const port = this.config.proxy?.port || 3456;
     const right = `Port ${port} ${green('▲')} `;
     lines.push(left + ' '.repeat(Math.max(1, W - vw(left) - vw(right))) + right);
@@ -976,7 +985,7 @@ export class TUI {
       // Glossary FOOTER (expands the abbreviations the header + inline labels can't
       // spell out). Below the rows so it never breaks the header↔column alignment.
       if (W >= 88) {
-        lines.push(' ' + dim('Ses 5h · Wk 7d · Now in-flight (weight) · 15m/1h served (avg · f fails)'));
+        lines.push(' ' + dim('Legend  Ses = 5h · Wk = 7d · Now = in-flight (weight) · 15m/1h = served (avg · f = fails)'));
       }
     }
 
@@ -1146,13 +1155,48 @@ export class TUI {
     }
     if (scopedTags.length) line += `  ${scopedTags.join(' ')}`;
     // Freshness: scoped caps are refreshed ONLY by the background probe (response
-    // headers don't carry them). If the probe has gone stale (> 2× interval since
-    // last success), say so rather than imply the last-known value is current.
-    if (this.am._quotaProbeStale?.(a)) line += `  ${dim('stale')}`;
+    // headers don't carry them). If the probe has gone stale, say so — and name the
+    // cause (e.g. rate-limited) when a probe failure is on record — rather than imply
+    // the last-known value is current.
+    line += this._probeHealthNote(a);
     line += `  ${dim(loadText(this._accountLoad(a)))}`;
     return line;
   }
 
+  /** Freshness suffix for an account row. Empty when the probe is current. When
+   *  stale, names the cause from the last recorded probe failure (e.g. a 429 from
+   *  the usage endpoint) so a self-throttling probe reads as "rate-limited" rather
+   *  than an unexplained "stale". Leading spaces included so callers append raw. */
+  _probeHealthNote(a) {
+    // A dead account (reauth / disabled) already surfaces its state in the status
+    // column, and its quota reading is frozen and moot — the prober skips it, so a
+    // "stale·probe 401" here is just the perpetual echo of the 401 that killed it.
+    // Only annotate probe-staleness for LIVE accounts, where a failing probe
+    // (e.g. a 429) is a real, actionable signal.
+    if (a?.refreshDead || a?.enabled === false) return '';
+    if (!this.am._quotaProbeStale?.(a)) return '';   // probe fresh (or off) → nothing to flag; interval>0 after this
+    // The background probe IS stale — but only flag it if something DISPLAYED is
+    // actually stale. An OAuth account's Ses/Wk bars come from unified5h/7d, which
+    // response headers refresh on every served request (updateQuota → lastHeaderQuotaAt);
+    // so a BUSY oauth account with a header-fresh reading and no probe-only scoped
+    // cap is NOT stale, even if its background probe is 429-throttled. Provider bars
+    // and per-model scoped caps ARE probe-only, so for those a stale probe genuinely
+    // means stale data → keep flagging.
+    const q = a.quota || {};
+    const reserveFloor = this.am.scheduler?.weeklyReserveThreshold ?? 0.85; // mirrors _renderAcct's scoped-tag gate
+    const hasDisplayedScopedCap = Object.values(q.scopedWeekly || {}).some(
+      e => e && e.isActive !== false && e.utilization != null && e.utilization >= reserveFloor);
+    if (a.type !== 'provider' && !hasDisplayedScopedCap) {
+      const interval = this.am.quotaProbeIntervalMs; // > 0 here (else _quotaProbeStale returned false)
+      const headerFresh = q.lastHeaderQuotaAt && (Date.now() - q.lastHeaderQuotaAt) <= Math.max(3 * interval, 180_000);
+      if (headerFresh) return '';
+    }
+    const s = q.lastProbeErrorStatus;
+    if (s === 429) return `  ${yellow('stale·rate-limited')}`;
+    if (s) return `  ${yellow('stale·probe ' + s)}`;
+    return `  ${dim('stale')}`;
+  }
+
   _renderProviderAcct(sel, cur, name, type, status, a, bw = 11, showBoth = true) {
     const q = a.quota || {};
 
@@ -1166,7 +1210,7 @@ export class TUI {
     if (q.providerSes != null || q.providerWk != null) {
       sesCell = q.providerSes != null ? bar(q.providerSes, bw, q.providerSesReset) : emptyBar('—', bw);
       wkCell = q.providerWk != null ? bar(q.providerWk, bw, q.providerWkReset) : emptyBar('—', bw);
-      if (this.am._quotaProbeStale?.(a)) note = `  ${dim('stale')}`;
+      note = this._probeHealthNote(a);
     } else if (q.providerQuotaSource === 'console-only') {
       sesCell = emptyBar('n/a', bw);
       wkCell = emptyBar('n/a', bw);
@@ -1211,7 +1255,7 @@ export class TUI {
   _renderFooter() {
     switch (this.mode) {
       case 'normal':
-        return ` ${bold('a')} Accounts  ${bold('m')} Routing  ${bold('s')} Sync  ${bold('r')} Restart  ${bold('q')} Stop`;
+        return ` ${bold('a')} Accounts  ${bold('t')} On/off  ${bold('m')} Routing  ${bold('s')} Sync  ${bold('r')} Restart  ${bold('q')} Stop`;
       case 'accounts':
         return ` ${bold('l')} Login/re-auth (browser)  ${bold('k')} API key  ${bold('n')} Rename  ${bold('t')} Enable/disable  ${bold('d')} Delete  ${bold('Esc')} Back`;
       case 'routing':

package/src/updater.js

@@ -73,11 +73,28 @@ export async function selfUpdate({ timeoutMs = 120_000 } = {}) {
  * (config.autoUpdate). Never auto-restarts a running proxy — the new version
  * applies on the next restart, so in-flight sessions are never interrupted.
  * Fire-and-forget; all failures are swallowed.
+ *
+ * `onVersionInfo` (optional) is ALWAYS invoked with { current, latest, hasUpdate,
+ * checkedAt } — even when up-to-date, offline, or updateCheck is off — so the TUI
+ * header / status can show the running version + whether an update is available.
  */
-export async function maybeCheckForUpdate(config, notify) {
-  if (config?.updateCheck === false) return;
+export async function maybeCheckForUpdate(config, notify, onVersionInfo) {
   const current = await getCurrentVersion();
-  const result = await checkForUpdate(current);
+  // Skip the npm round-trip when the user disabled update checks, but still report
+  // the running version so the indicator can show it.
+  const result = config?.updateCheck === false ? null : await checkForUpdate(current);
+
+  if (onVersionInfo) {
+    try {
+      onVersionInfo({
+        current,
+        latest: result?.latest ?? null,
+        hasUpdate: Boolean(result?.hasUpdate),
+        checkedAt: Date.now(),
+      });
+    } catch { /* the indicator is best-effort; never break startup */ }
+  }
+
   if (!result || !result.hasUpdate) return;
 
   notify(`Update available: ${result.current} → ${result.latest}`);