maxpool 1.5.38 → 1.5.40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.38",
+  "version": "1.5.40",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -12,7 +12,7 @@ import { loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon, toke
 import { TUI } from './tui.js';
 import { RestartController } from './restart-controller.js';
 import { resolveAccounts } from './account-config.js';
-import { maybeCheckForUpdate, getCurrentVersion } from './updater.js';
+import { maybeCheckForUpdate, getCurrentVersion, markApplied } from './updater.js';
 import {
   runReloadBaton,
   RELOAD_SWAPPED, RELOAD_ROLLED_BACK,
@@ -702,6 +702,7 @@ async function serverWorkerCommand() {
   let tui = null;
   let server = null;
   let syncTimer = null;
+  let updateTimer = null;
   let draining = false;
   let restartController = null;
   // Set once this worker hands the terminal to a new worker during a seamless TUI
@@ -805,6 +806,7 @@ async function serverWorkerCommand() {
     if (draining) return;
     draining = true;
     if (syncTimer) clearInterval(syncTimer);
+    if (updateTimer) clearInterval(updateTimer);
     if (tui?.running) { tui.stop(); }
     console.log('\n[Maxpool] Restarting server now; queued requests will reconnect automatically.');
     server.closeAllConnections?.();
@@ -893,6 +895,7 @@ async function serverWorkerCommand() {
 
     draining = true;
     if (syncTimer) clearInterval(syncTimer);
+    if (updateTimer) clearInterval(updateTimer);
     if (tui?.running) tui.stop();
     // Best-effort final flush + settle writes (fire-and-forget; the drain timeout
     // below bounds total quit time, and write barriers protect the on-disk state).
@@ -1015,6 +1018,41 @@ async function serverWorkerCommand() {
   }, syncIntervalMs);
   syncTimer.unref();
 
+  // Periodic update re-check. The startup probe (in becomePrimary) is one-shot, but a
+  // long-lived session (days) must still be reminded of versions published AFTER it
+  // started. This timer is UNCONDITIONAL (NOT reload-guarded) so it survives a seamless
+  // `r`-reload — otherwise taking an update (which the banner tells users to do via `r`)
+  // would permanently disable all future update detection. It only refreshes
+  // versionInfo (the persistent TUI banner is the reminder, so no repeated log spam);
+  // autoUpdate progress lines still surface. unref so it never blocks a clean exit.
+  const notifyUpdate = msg => (tui?._addLog ? tui._addLog(msg) : console.log(`[Maxpool] ${msg}`));
+  // Fully-automatic apply (opt-in autoApply): mark the version attempted, THEN seamlessly
+  // reload into the freshly-installed code (sessions survive). Marking here — at the
+  // moment we act — is what makes the quarantine truthful: a boot-broken release is
+  // attempted once, then blocked until an even newer version appears (no reload loop, no
+  // stranded download). Shared by the startup one-shot AND the periodic timer.
+  const applyUpdateIfReady = r => {
+    if (r?.applicable && config?.autoApply && restartController) {
+      markApplied(r.installedVersion);
+      notifyUpdate('Applying update — seamless reload…');
+      restartController.requestRestart();
+    }
+  };
+  const updateIntervalMs = Math.max(60_000, Number(process.env.MAXPOOL_UPDATE_CHECK_INTERVAL_MS) || 6 * 60 * 60 * 1000);
+  updateTimer = setInterval(() => {
+    // ONLY the lease-holding primary self-installs — the timer is unconditional across
+    // EVERY worker (incl. a headless reload worker), so gate on hasLease here to avoid
+    // two `npm i -g` racing during a reload overlap (global-package corruption). A
+    // headless reload worker never holds the lease, so it never installs/auto-applies.
+    if (config?.updateCheck === false || !hasLease) return;
+    // announce:false — the persistent TUI banner is the passive reminder; only real
+    // actions (installing / applying) log here, so a pending update never churns the log.
+    maybeCheckForUpdate(config, notifyUpdate, info => { accountManager.versionInfo = info; }, { announce: false })
+      .then(applyUpdateIfReady)
+      .catch(() => {});
+  }, updateIntervalMs);
+  updateTimer.unref();
+
   // Become the live primary: start serving UI/logs, take the writer lease, run
   // the update check. `viaTakeover` true means we acquired the socket through the
   // baton (a reload) — freeze the update check so a reload doesn't re-probe npm
@@ -1061,8 +1099,11 @@ async function serverWorkerCommand() {
     // A reload-spawned/takeover worker must NEVER re-probe (1x not 2x traffic).
     if (!viaTakeover && !isReloadWorker) {
       if (process.env.MAXPOOL_TEST_LOG_UPDATE_CHECK === '1') console.log('[Maxpool] UPDATE_CHECK_FIRED');
-      const notify = msg => (tui?._addLog ? tui._addLog(msg) : console.log(`[Maxpool] ${msg}`));
-      maybeCheckForUpdate(config, notify, info => { accountManager.versionInfo = info; }).catch(() => {});
+      // Cold-start-behind: download AND (autoApply) self-apply via the SAME helper as the
+      // periodic path — so the version is applied, not marked-attempted-then-stranded.
+      maybeCheckForUpdate(config, notifyUpdate, info => { accountManager.versionInfo = info; })
+        .then(applyUpdateIfReady)
+        .catch(() => {});
     } else if (process.env.MAXPOOL_TEST_LOG_UPDATE_CHECK === '1') {
       console.log('[Maxpool] UPDATE_CHECK_SKIPPED (reload)');
     }
@@ -1092,6 +1133,7 @@ async function serverWorkerCommand() {
       // proceeding (not a rollback). Disarm the rollback self-heal.
       if (reloadWatchdog) { clearTimeout(reloadWatchdog); reloadWatchdog = null; }
       if (syncTimer) clearInterval(syncTimer);
+      if (updateTimer) clearInterval(updateTimer);
       // Stop accepting NEW connections; KEEP in-flight requests alive.
       server.maxpoolBeginDrain?.();
       server.close(() => {});

package/src/restart-controller.js

@@ -67,7 +67,10 @@ export class RestartController {
   }
 
   requestRestart() {
-    if (this.restarting) return;
+    // Idempotent against a restart ALREADY in progress — restarting OR pending (drain).
+    // Without the `pending` guard a second call (e.g. auto-apply firing while a manual
+    // restart is draining) would orphan the first _drainTimer and re-log.
+    if (this.restarting || this.pending) return;
     this.pauseAdmission();
     if (this.upstreamRequests.size === 0) {
       this._restart();

package/src/tui.js

@@ -1,6 +1,6 @@
 import { createInterface } from 'node:readline';
 import { fetchProfile, loginOAuth, tokenFingerprint } from './oauth.js';
-import { appendEventLog } from './event-log.js';
+import { appendEventLog, setConsoleStdoutSuppressed } from './event-log.js';
 
 // ── ANSI helpers ─────────────────────────────────────────────
 
@@ -27,9 +27,9 @@ const vw = s => strip(s).length;
 // ── Accounts-table columns ───────────────────────────────────
 // Fixed column widths shared by the header row (acctHeader) AND every data row, so
 // the header labels stay aligned with the columns they name. The Account/Provider/
-// Status/Quota start offsets (4/17/27/41) are pure functions of these widths + the
+// Status/Quota start offsets (4/21/31/45) are pure functions of these widths + the
 // 4-col row prefix, independent of the quota-bar width.
-const NAME_W = 12;         // a.name.slice(0, NAME_W).padEnd(NAME_W)
+const NAME_W = 16;         // a.name.slice(0, NAME_W).padEnd(NAME_W) — wide enough for a full email
 const PROVIDER_W = 9;      // providerLabel(a).padEnd(PROVIDER_W) — fits "Anthropic"
 const STATUS_W = 13;       // rpad(status, STATUS_W) — fits "throttled 59s"
 const ROW_PREFIX = '    '; // ' ' + sel(1) + cur(1) + ' ' — 4 cols before the name
@@ -435,11 +435,9 @@ export class TUI {
         'Reload account credentials and newly added accounts from the config file.',
         () => this._doSync(),
       );
-    } else if (k === 't' && this.am.accounts.length > 0) {
-      // Manual on/off toggle straight from the top level (also under a → Accounts).
-      // select → confirm → returns to 'normal', so this never strands the user.
-      this._startSelection('toggle');
     }
+    // Enable/disable lives ONLY under [a] Accounts now (with rename/delete/login) —
+    // one home for every account mutation, instead of a duplicate top-level toggle.
   }
 
   _keyAccounts(k) {
@@ -482,9 +480,9 @@ export class TUI {
       );
     } else if (k === 'p' && this.am.accounts.some(account => account.type !== 'provider')) {
       this._startSelection('prefer');
-    } else if (k === 'f') {
+    } else if (k === 'f' || k === 'F') {
       // Cycle the cross-provider fallback policy in place — reversible + non-destructive,
-      // so no confirm dialog (unlike restart/delete).
+      // so no confirm dialog (unlike restart/delete). Accept F too (Shift-f muscle memory).
       this._cycleCrossProviderPolicy();
     } else if (k === 'esc' || k === 'q') {
       this.mode = 'normal';
@@ -656,6 +654,12 @@ export class TUI {
   async _doLogin() {
     const wasRunning = this.running;
     if (wasRunning) this.stop();
+    // Mute the console-log MIRROR to stdout during the interactive prompt so routing
+    // logs (console.log, e.g. the glm-fallback 429 churn) don't flood over the readline
+    // "Name this account" prompt. The prompts + errors use process.stdout.write, which
+    // BYPASSES the mirror, so they stay visible. Login runs only on the terminal-owning
+    // primary (mirror baseline false), so the finally restores it to false.
+    setConsoleStdoutSuppressed(true);
     try {
       process.stdout.write('\nOpening browser to log into Claude…\n');
       const creds = await loginOAuth();
@@ -673,6 +677,9 @@ export class TUI {
         rl.close();
         name = String(answer || '').trim() || suggested;
       }
+      // Lift the mute BEFORE the upsert so its persist-confirmation (a console.log,
+      // deliberately visible during the stopped-TUI login) reaches the user.
+      setConsoleStdoutSuppressed(false);
       // Message honors the ACTUAL result: if a manually-typed name collided with a
       // different existing account, upsert updates in place → "Re-authenticated", never
       // a false "Added new account".
@@ -683,6 +690,7 @@ export class TUI {
     } catch (e) {
       process.stdout.write(`\nLogin failed: ${e.message}\n`);
     } finally {
+      setConsoleStdoutSuppressed(false);   // restore on every path (incl. the catch)
       if (wasRunning) this.start();
     }
   }
@@ -962,14 +970,34 @@ export class TUI {
     // ── Header
     const v = this.am.versionInfo;
     const verStr = v?.current ? ` ${dim('v' + v.current)}` : '';
-    // "↑ vX.Y.Z" when a newer npm version is published; nothing when on latest or
-    // the check hasn't resolved yet (so the header never falsely implies up-to-date).
-    const updStr = (v?.hasUpdate && v?.latest) ? `  ${yellow('↑ v' + v.latest)}` : '';
-    const left = bold(' Maxpool') + verStr + updStr;
+    const left = bold(' Maxpool') + verStr;
     const port = this.config.proxy?.port || 3456;
     const right = `Port ${port} ${green('▲')} `;
     lines.push(left + ' '.repeat(Math.max(1, W - vw(left) - vw(right))) + right);
     lines.push(' ' + dim('─'.repeat(W - 2)));
+    // Restart/reload in progress: admission is paused while active requests drain, then
+    // the process swaps. Without live feedback the screen looks FROZEN (identical
+    // dashboard, nothing moving) from R→Yes until the swap — the reported bug. Show an
+    // animated draining indicator. It clears when the swap completes (fresh worker
+    // renders) or a rollback resumes admission (admissionPaused → false).
+    if (this.am.admissionPaused) {
+      // Total TUI in-flight — an honest, user-meaningful "your work is finishing" count.
+      // (The reload gates its drain on UPSTREAM requests only, so this can read slightly
+      // higher than the controller's gating count; queued/idle ones reconnect, not lost.)
+      const inflight = this.active.size;
+      const detail = inflight > 0
+        ? `draining ${inflight} active request${inflight === 1 ? '' : 's'}…`
+        : 'finishing up…';
+      lines.push(` ${cyan(SPINNER[this.frame])} ${yellow('Restarting')}  ${dim(detail)}`);
+    }
+    // Update reminder: a prominent, actionable banner when a newer npm version is
+    // published — nothing when on latest or the check hasn't resolved (no permanent
+    // blank line). The persistent banner IS the reminder; a long-lived session's
+    // periodic re-check keeps it current (index.js updateTimer refreshes versionInfo).
+    if (v?.hasUpdate && v?.latest) {
+      lines.push('  ' + yellow(`↑ Update available: v${v.current} → v${v.latest}`)
+        + dim("  ·  run 'npm i -g maxpool', then press r"));
+    }
     const routing = this.am.routingMode === 'preferred'
       ? `Manual preference: ${this.am.preferredAccountName} (automatic failover)`
       : 'Automatic load balancing';
@@ -1020,11 +1048,11 @@ export class TUI {
       // misaligned second header).
       lines.push(dimUnderline(acctHeader(W)));
       const showBoth = W >= 70;
-      // 57/46 = the fixed pre-bar column span (prefix + Account + Provider + Status +
-      // gaps); grew by 1 with the Provider column (was 56/45 under the 8-wide Type col).
+      // 61/50 = the fixed pre-bar column span (prefix + Account + Provider + Status +
+      // gaps); grew by +4 with the wider 16-col Account column (was 57/46 at NAME_W 12).
       const bw = showBoth
-        ? Math.max(5, Math.min(20, Math.floor((W - 57) / 2)))
-        : Math.max(5, Math.min(20, W - 46));
+        ? Math.max(5, Math.min(20, Math.floor((W - 61) / 2)))
+        : Math.max(5, Math.min(20, W - 50));
 
       // Claude/OAuth accounts first, providers (GLM/Kimi fallback) last — a stable
       // display order over the canonical am.accounts array (which stays untouched so
@@ -1109,7 +1137,10 @@ export class TUI {
 
     // Name (bold if selected)
     const rawName = a.name.slice(0, NAME_W).padEnd(NAME_W);
-    const name = isSel ? bold(rawName) : rawName;
+    // A disabled account reads as "off" — dim the whole name. Applied as a SINGLE SGR
+    // (never dim(bold(...)) — bold()'s trailing RESET would cancel the dim mid-string),
+    // so a disabled row is never also bold-selected.
+    const name = a.enabled === false ? dim(rawName) : (isSel ? bold(rawName) : rawName);
 
     // Provider column — the real vendor (Anthropic / z.ai / Moonshot), padded to
     // PROVIDER_W so "Anthropic" (9 chars) never overflows and shifts the row (incl.
@@ -1147,7 +1178,7 @@ export class TUI {
       case 'probing':   status = green('probing'); break;
       case 'waiting':   status = yellow('waiting'); break;
       case 'paused':    status = yellow('paused'); break;
-      case 'disabled':  status = gray('disabled'); break;
+      case 'disabled':  status = red('✕ disabled'); break;
       case 'throttled': {
         // A transient auto-recovering cooldown — show the remaining time (from
         // rateLimitedUntil) so it reads as "recovering in Ns", not stuck.
@@ -1310,11 +1341,16 @@ export class TUI {
   _renderFooter() {
     switch (this.mode) {
       case 'normal':
-        return ` ${bold('a')} Accounts  ${bold('t')} On/off  ${bold('m')} Routing  ${bold('s')} Sync  ${bold('r')} Restart  ${bold('q')} Stop`;
+        return ` ${bold('a')} Accounts  ${bold('m')} Routing  ${bold('s')} Sync  ${bold('r')} Restart  ${bold('q')} Stop`;
       case 'accounts':
         return ` ${bold('l')} Login/re-auth (browser)  ${bold('k')} API key  ${bold('n')} Rename  ${bold('t')} Enable/disable  ${bold('d')} Delete  ${bold('Esc')} Back`;
-      case 'routing':
-        return ` ${bold('a')} Automatic  ${bold('p')} Manual preference  ${bold('f')} Cross-provider fallback  ${bold('Esc')} Back`;
+      case 'routing': {
+        // Show the CURRENT cross-provider policy inline so pressing f visibly changes it
+        // right here at the footer (the policy also renders in the header, far from the
+        // keypress — the "f does nothing" report).
+        const xp = this.am._crossProviderFallbackPolicy?.() || 'when-exhausted';
+        return ` ${bold('a')} Automatic  ${bold('p')} Manual preference  ${bold('f')} Cross-provider: ${cyan(xp)} ↻  ${bold('Esc')} Back`;
+      }
       case 'select': {
         const act = this.selAction === 'prefer'
           ? 'prefer'

package/src/updater.js

@@ -68,43 +68,99 @@ export async function selfUpdate({ timeoutMs = 120_000 } = {}) {
   }
 }
 
+// The version of the CODE currently EXECUTING, captured ONCE before any self-install.
+// getCurrentVersion() reads package.json FROM DISK, which `npm i -g` rewrites — so
+// after a background self-install the disk version != the running version. Every
+// "am I behind?" and loop-guard decision keys on THIS fixed value, not the disk read.
+let _bootVersion;
+// The newest version this process has already ATTEMPTED to auto-apply. The loop guard:
+// a version that installs fine but fails to BOOT rolls back to the old worker, which is
+// still running _bootVersion with its timer armed — without this it would re-detect the
+// on-disk version every check and re-apply forever (a boot-broken release → infinite
+// reload loop, ~30s of refused admission each cycle). We apply only versions strictly
+// newer than max(_bootVersion, _lastAttemptedTarget), so a rolled-back target is
+// quarantined until an even newer release appears.
+let _lastAttemptedTarget = null;
+
+/** Test-only: reset the module's version-tracking state between cases. */
+export function __resetUpdaterState() { _bootVersion = undefined; _lastAttemptedTarget = null; }
+
+/** Mark a version as ATTEMPTED-to-apply. The caller calls this at the moment it triggers
+ *  the reload — BEFORE the reload — so a rolled-back target is quarantined (advance-only).
+ *  Kept as the caller's action (not a side effect of maybeCheckForUpdate) so a caller that
+ *  ignores `applicable` can never strand a version or poison the quarantine floor. */
+export function markApplied(version) {
+  if (version && (!_lastAttemptedTarget || compareVersions(version, _lastAttemptedTarget) > 0)) {
+    _lastAttemptedTarget = version;
+  }
+}
+
 /**
- * Startup hook: check for an update and either notify (default) or self-install
- * (config.autoUpdate). Never auto-restarts a running proxy — the new version
- * applies on the next restart, so in-flight sessions are never interrupted.
- * Fire-and-forget; all failures are swallowed.
+ * Check for an update; with `config.autoUpdate` also self-install; with
+ * `config.autoApply` SIGNAL that the caller should seamlessly reload to APPLY it
+ * (returns `applicable:true` — the CALLER then markApplied()+reloads). Failures swallowed.
+ * Deps are injectable for tests.
+ *
+ * `onVersionInfo` is ALWAYS invoked with { current, latest, hasUpdate, checkedAt } —
+ * current + hasUpdate keyed on the RUNNING version (so the banner stays accurate after a
+ * background download, until the reload). `deps.announce===false` suppresses the passive
+ * "Update available" line (the periodic path — the persistent banner already shows it).
  *
- * `onVersionInfo` (optional) is ALWAYS invoked with { current, latest, hasUpdate,
- * checkedAt } — even when up-to-date, offline, or updateCheck is off — so the TUI
- * header / status can show the running version + whether an update is available.
+ * Returns { hasUpdate, applicable, installedVersion? }.
  */
-export async function maybeCheckForUpdate(config, notify, onVersionInfo) {
-  const current = await getCurrentVersion();
-  // Skip the npm round-trip when the user disabled update checks, but still report
-  // the running version so the indicator can show it.
-  const result = config?.updateCheck === false ? null : await checkForUpdate(current);
+export async function maybeCheckForUpdate(config, notify, onVersionInfo, deps = {}) {
+  const _get = deps.getCurrentVersion || getCurrentVersion;
+  const _check = deps.checkForUpdate || checkForUpdate;
+  const _self = deps.selfUpdate || selfUpdate;
+  const announce = deps.announce !== false;
+
+  if (_bootVersion === undefined) _bootVersion = await _get();
+  const current = _bootVersion;
+  const result = config?.updateCheck === false ? null : await _check(current);
+  const hasUpdate = Boolean(result?.hasUpdate);
 
   if (onVersionInfo) {
     try {
-      onVersionInfo({
-        current,
-        latest: result?.latest ?? null,
-        hasUpdate: Boolean(result?.hasUpdate),
-        checkedAt: Date.now(),
-      });
-    } catch { /* the indicator is best-effort; never break startup */ }
+      onVersionInfo({ current, latest: result?.latest ?? null, hasUpdate, checkedAt: Date.now() });
+    } catch { /* indicator is best-effort; never break startup */ }
   }
 
-  if (!result || !result.hasUpdate) return;
+  if (!hasUpdate) return { hasUpdate: false, applicable: false };
+  if (announce) notify(`Update available: ${result.current} → ${result.latest}`);
 
-  notify(`Update available: ${result.current} → ${result.latest}`);
-  if (config?.autoUpdate) {
+  if (!config?.autoUpdate) {
+    if (announce) notify(`Run 'npm i -g ${PACKAGE}' to update, or set "autoUpdate": true in your config.`);
+    return { hasUpdate: true, applicable: false };
+  }
+
+  // Skip the reinstall if the latest is ALREADY on disk (a prior check downloaded it) —
+  // otherwise every periodic check re-runs `npm i -g` + re-logs until a manual restart.
+  const onDisk = await _get();
+  if (!onDisk || compareVersions(onDisk, result.latest) < 0) {
     notify(`Auto-updating to ${result.latest}…`);
-    const r = await selfUpdate();
-    notify(r.ok
-      ? `Updated to ${result.latest}. Restart maxpool to apply (running sessions are not interrupted).`
-      : `Auto-update failed: ${r.error}. Run: npm i -g ${PACKAGE}`);
-  } else {
-    notify(`Run 'npm i -g ${PACKAGE}' to update, or set "autoUpdate": true in your config.`);
+    const r = await _self();
+    if (!r.ok) {
+      notify(`Auto-update failed: ${r.error}. Run: npm i -g ${PACKAGE}`);
+      return { hasUpdate: true, applicable: false };
+    }
+  }
+
+  const installed = await _get();
+  // Loop/quarantine guard — a version is "applicable" only if it is strictly newer than
+  // the newest we've already booted-as OR already ATTEMPTED to apply (markApplied). This
+  // function has NO side effect on that floor: the CALLER marks it when it triggers the
+  // reload, so a caller that ignores `applicable` can't strand a version or poison state.
+  const floor = (_lastAttemptedTarget && compareVersions(_lastAttemptedTarget, current) > 0)
+    ? _lastAttemptedTarget : current;
+  const advanced = Boolean(installed) && compareVersions(installed, current) > 0;
+  const applicable = advanced && compareVersions(installed, floor) > 0;
+
+  // Passive notices only. The "Applying now…" line + the reload are the caller's (it
+  // logs them exactly when it acts), so nothing here can claim an apply that didn't happen.
+  if (advanced && !applicable) {
+    if (announce) notify(`Update ${installed} already attempted — staying on ${current}; will retry only a newer release.`);
+  } else if (advanced && !config?.autoApply) {
+    if (announce) notify(`Updated to ${installed}. Restart maxpool to apply (sessions are not interrupted).`);
   }
+  return { hasUpdate: true, installedVersion: installed, applicable };
 }