maxpool 1.5.39 → 1.5.40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.39",
+  "version": "1.5.40",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -12,7 +12,7 @@ import { loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon, toke
 import { TUI } from './tui.js';
 import { RestartController } from './restart-controller.js';
 import { resolveAccounts } from './account-config.js';
-import { maybeCheckForUpdate, getCurrentVersion } from './updater.js';
+import { maybeCheckForUpdate, getCurrentVersion, markApplied } from './updater.js';
 import {
   runReloadBaton,
   RELOAD_SWAPPED, RELOAD_ROLLED_BACK,
@@ -1025,11 +1025,31 @@ async function serverWorkerCommand() {
   // would permanently disable all future update detection. It only refreshes
   // versionInfo (the persistent TUI banner is the reminder, so no repeated log spam);
   // autoUpdate progress lines still surface. unref so it never blocks a clean exit.
+  const notifyUpdate = msg => (tui?._addLog ? tui._addLog(msg) : console.log(`[Maxpool] ${msg}`));
+  // Fully-automatic apply (opt-in autoApply): mark the version attempted, THEN seamlessly
+  // reload into the freshly-installed code (sessions survive). Marking here — at the
+  // moment we act — is what makes the quarantine truthful: a boot-broken release is
+  // attempted once, then blocked until an even newer version appears (no reload loop, no
+  // stranded download). Shared by the startup one-shot AND the periodic timer.
+  const applyUpdateIfReady = r => {
+    if (r?.applicable && config?.autoApply && restartController) {
+      markApplied(r.installedVersion);
+      notifyUpdate('Applying update — seamless reload…');
+      restartController.requestRestart();
+    }
+  };
   const updateIntervalMs = Math.max(60_000, Number(process.env.MAXPOOL_UPDATE_CHECK_INTERVAL_MS) || 6 * 60 * 60 * 1000);
   updateTimer = setInterval(() => {
-    if (config?.updateCheck === false) return;
-    const autoNotify = msg => { if (config?.autoUpdate) (tui?._addLog ? tui._addLog(msg) : console.log(`[Maxpool] ${msg}`)); };
-    maybeCheckForUpdate(config, autoNotify, info => { accountManager.versionInfo = info; }).catch(() => {});
+    // ONLY the lease-holding primary self-installs — the timer is unconditional across
+    // EVERY worker (incl. a headless reload worker), so gate on hasLease here to avoid
+    // two `npm i -g` racing during a reload overlap (global-package corruption). A
+    // headless reload worker never holds the lease, so it never installs/auto-applies.
+    if (config?.updateCheck === false || !hasLease) return;
+    // announce:false — the persistent TUI banner is the passive reminder; only real
+    // actions (installing / applying) log here, so a pending update never churns the log.
+    maybeCheckForUpdate(config, notifyUpdate, info => { accountManager.versionInfo = info; }, { announce: false })
+      .then(applyUpdateIfReady)
+      .catch(() => {});
   }, updateIntervalMs);
   updateTimer.unref();
 
@@ -1079,8 +1099,11 @@ async function serverWorkerCommand() {
     // A reload-spawned/takeover worker must NEVER re-probe (1x not 2x traffic).
     if (!viaTakeover && !isReloadWorker) {
       if (process.env.MAXPOOL_TEST_LOG_UPDATE_CHECK === '1') console.log('[Maxpool] UPDATE_CHECK_FIRED');
-      const notify = msg => (tui?._addLog ? tui._addLog(msg) : console.log(`[Maxpool] ${msg}`));
-      maybeCheckForUpdate(config, notify, info => { accountManager.versionInfo = info; }).catch(() => {});
+      // Cold-start-behind: download AND (autoApply) self-apply via the SAME helper as the
+      // periodic path — so the version is applied, not marked-attempted-then-stranded.
+      maybeCheckForUpdate(config, notifyUpdate, info => { accountManager.versionInfo = info; })
+        .then(applyUpdateIfReady)
+        .catch(() => {});
     } else if (process.env.MAXPOOL_TEST_LOG_UPDATE_CHECK === '1') {
       console.log('[Maxpool] UPDATE_CHECK_SKIPPED (reload)');
     }

package/src/restart-controller.js

@@ -67,7 +67,10 @@ export class RestartController {
   }
 
   requestRestart() {
-    if (this.restarting) return;
+    // Idempotent against a restart ALREADY in progress — restarting OR pending (drain).
+    // Without the `pending` guard a second call (e.g. auto-apply firing while a manual
+    // restart is draining) would orphan the first _drainTimer and re-log.
+    if (this.restarting || this.pending) return;
     this.pauseAdmission();
     if (this.upstreamRequests.size === 0) {
       this._restart();

package/src/updater.js

@@ -68,43 +68,99 @@ export async function selfUpdate({ timeoutMs = 120_000 } = {}) {
   }
 }
 
+// The version of the CODE currently EXECUTING, captured ONCE before any self-install.
+// getCurrentVersion() reads package.json FROM DISK, which `npm i -g` rewrites — so
+// after a background self-install the disk version != the running version. Every
+// "am I behind?" and loop-guard decision keys on THIS fixed value, not the disk read.
+let _bootVersion;
+// The newest version this process has already ATTEMPTED to auto-apply. The loop guard:
+// a version that installs fine but fails to BOOT rolls back to the old worker, which is
+// still running _bootVersion with its timer armed — without this it would re-detect the
+// on-disk version every check and re-apply forever (a boot-broken release → infinite
+// reload loop, ~30s of refused admission each cycle). We apply only versions strictly
+// newer than max(_bootVersion, _lastAttemptedTarget), so a rolled-back target is
+// quarantined until an even newer release appears.
+let _lastAttemptedTarget = null;
+
+/** Test-only: reset the module's version-tracking state between cases. */
+export function __resetUpdaterState() { _bootVersion = undefined; _lastAttemptedTarget = null; }
+
+/** Mark a version as ATTEMPTED-to-apply. The caller calls this at the moment it triggers
+ *  the reload — BEFORE the reload — so a rolled-back target is quarantined (advance-only).
+ *  Kept as the caller's action (not a side effect of maybeCheckForUpdate) so a caller that
+ *  ignores `applicable` can never strand a version or poison the quarantine floor. */
+export function markApplied(version) {
+  if (version && (!_lastAttemptedTarget || compareVersions(version, _lastAttemptedTarget) > 0)) {
+    _lastAttemptedTarget = version;
+  }
+}
+
 /**
- * Startup hook: check for an update and either notify (default) or self-install
- * (config.autoUpdate). Never auto-restarts a running proxy — the new version
- * applies on the next restart, so in-flight sessions are never interrupted.
- * Fire-and-forget; all failures are swallowed.
+ * Check for an update; with `config.autoUpdate` also self-install; with
+ * `config.autoApply` SIGNAL that the caller should seamlessly reload to APPLY it
+ * (returns `applicable:true` — the CALLER then markApplied()+reloads). Failures swallowed.
+ * Deps are injectable for tests.
+ *
+ * `onVersionInfo` is ALWAYS invoked with { current, latest, hasUpdate, checkedAt } —
+ * current + hasUpdate keyed on the RUNNING version (so the banner stays accurate after a
+ * background download, until the reload). `deps.announce===false` suppresses the passive
+ * "Update available" line (the periodic path — the persistent banner already shows it).
  *
- * `onVersionInfo` (optional) is ALWAYS invoked with { current, latest, hasUpdate,
- * checkedAt } — even when up-to-date, offline, or updateCheck is off — so the TUI
- * header / status can show the running version + whether an update is available.
+ * Returns { hasUpdate, applicable, installedVersion? }.
  */
-export async function maybeCheckForUpdate(config, notify, onVersionInfo) {
-  const current = await getCurrentVersion();
-  // Skip the npm round-trip when the user disabled update checks, but still report
-  // the running version so the indicator can show it.
-  const result = config?.updateCheck === false ? null : await checkForUpdate(current);
+export async function maybeCheckForUpdate(config, notify, onVersionInfo, deps = {}) {
+  const _get = deps.getCurrentVersion || getCurrentVersion;
+  const _check = deps.checkForUpdate || checkForUpdate;
+  const _self = deps.selfUpdate || selfUpdate;
+  const announce = deps.announce !== false;
+
+  if (_bootVersion === undefined) _bootVersion = await _get();
+  const current = _bootVersion;
+  const result = config?.updateCheck === false ? null : await _check(current);
+  const hasUpdate = Boolean(result?.hasUpdate);
 
   if (onVersionInfo) {
     try {
-      onVersionInfo({
-        current,
-        latest: result?.latest ?? null,
-        hasUpdate: Boolean(result?.hasUpdate),
-        checkedAt: Date.now(),
-      });
-    } catch { /* the indicator is best-effort; never break startup */ }
+      onVersionInfo({ current, latest: result?.latest ?? null, hasUpdate, checkedAt: Date.now() });
+    } catch { /* indicator is best-effort; never break startup */ }
   }
 
-  if (!result || !result.hasUpdate) return;
+  if (!hasUpdate) return { hasUpdate: false, applicable: false };
+  if (announce) notify(`Update available: ${result.current} → ${result.latest}`);
 
-  notify(`Update available: ${result.current} → ${result.latest}`);
-  if (config?.autoUpdate) {
+  if (!config?.autoUpdate) {
+    if (announce) notify(`Run 'npm i -g ${PACKAGE}' to update, or set "autoUpdate": true in your config.`);
+    return { hasUpdate: true, applicable: false };
+  }
+
+  // Skip the reinstall if the latest is ALREADY on disk (a prior check downloaded it) —
+  // otherwise every periodic check re-runs `npm i -g` + re-logs until a manual restart.
+  const onDisk = await _get();
+  if (!onDisk || compareVersions(onDisk, result.latest) < 0) {
     notify(`Auto-updating to ${result.latest}…`);
-    const r = await selfUpdate();
-    notify(r.ok
-      ? `Updated to ${result.latest}. Restart maxpool to apply (running sessions are not interrupted).`
-      : `Auto-update failed: ${r.error}. Run: npm i -g ${PACKAGE}`);
-  } else {
-    notify(`Run 'npm i -g ${PACKAGE}' to update, or set "autoUpdate": true in your config.`);
+    const r = await _self();
+    if (!r.ok) {
+      notify(`Auto-update failed: ${r.error}. Run: npm i -g ${PACKAGE}`);
+      return { hasUpdate: true, applicable: false };
+    }
+  }
+
+  const installed = await _get();
+  // Loop/quarantine guard — a version is "applicable" only if it is strictly newer than
+  // the newest we've already booted-as OR already ATTEMPTED to apply (markApplied). This
+  // function has NO side effect on that floor: the CALLER marks it when it triggers the
+  // reload, so a caller that ignores `applicable` can't strand a version or poison state.
+  const floor = (_lastAttemptedTarget && compareVersions(_lastAttemptedTarget, current) > 0)
+    ? _lastAttemptedTarget : current;
+  const advanced = Boolean(installed) && compareVersions(installed, current) > 0;
+  const applicable = advanced && compareVersions(installed, floor) > 0;
+
+  // Passive notices only. The "Applying now…" line + the reload are the caller's (it
+  // logs them exactly when it acts), so nothing here can claim an apply that didn't happen.
+  if (advanced && !applicable) {
+    if (announce) notify(`Update ${installed} already attempted — staying on ${current}; will retry only a newer release.`);
+  } else if (advanced && !config?.autoApply) {
+    if (announce) notify(`Updated to ${installed}. Restart maxpool to apply (sessions are not interrupted).`);
   }
+  return { hasUpdate: true, installedVersion: installed, applicable };
 }