maxpool 1.5.39 → 1.5.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.39",
+  "version": "1.5.41",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -1699,6 +1699,15 @@ export class AccountManager {
     // are all unavailable the request HOLDS/queues (recoverable) rather than 400ing.
     if (requestInfo.hasImage && account.provider === 'kimi') return false;
 
+    // A large-context session: a provider already rejected this request with a
+    // context-length 400. The GLM/Kimi *coding* endpoints serve a fixed model capped
+    // at ~256K and IGNORE the model id (so a K3/GLM 1M PLAN doesn't lift the coding
+    // leg's ceiling). Only a 1M-context Claude account can hold it — bench the
+    // providers for this session so it routes to Claude, or HOLDS for one, instead of
+    // re-404ing on a too-small leg. Sticky per session (context only grows turn over
+    // turn), so no follow-up turn re-pays the wasted attempt.
+    if (account.type === 'provider' && this._isSessionLargeContext(requestInfo)) return false;
+
     const { incompatible, homeProvider } = this._effectiveIncompatible(requestInfo);
     const policy = this._crossProviderFallbackPolicy();
 
@@ -1732,6 +1741,9 @@ export class AccountManager {
     if (requestInfo.anthropicIncompatible) {
       this.markSessionIncompatible(requestInfo.sessionKey, requestInfo.homeProvider);
     }
+    if (requestInfo.largeContext) {
+      this.markSessionLargeContext(requestInfo.sessionKey);
+    }
   }
 
   // Latch a session as Anthropic-incompatible (a foreign server_tool_use id, or a
@@ -1750,6 +1762,25 @@ export class AccountManager {
     });
   }
 
+  // Latch a session as large-context: a provider (the GLM/Kimi coding endpoint, fixed
+  // ~256K) rejected a request with a context-length 400 that only a 1M Claude can hold.
+  // Sticky + never-downgrades so every follow-up turn (context only grows) skips the
+  // too-small providers instead of re-paying a wasted 400. Cleared only by a new session.
+  markSessionLargeContext(sessionKey) {
+    if (!sessionKey) return;
+    const existing = this.sessionPolicies.get(sessionKey) || {};
+    if (!existing.largeContext) {
+      console.log(`[Maxpool] Session "${sessionKey}" exceeds provider context limits — pinned to Claude (GLM/Kimi benched for this session)`);
+    }
+    this.sessionPolicies.set(sessionKey, { ...existing, largeContext: true });
+  }
+
+  _isSessionLargeContext(requestInfo = {}) {
+    if (requestInfo.largeContext) return true;
+    if (!requestInfo.sessionKey) return false;
+    return Boolean(this.sessionPolicies.get(requestInfo.sessionKey)?.largeContext);
+  }
+
   // Marks a session as containing Anthropic signed thinking. This no longer bars
   // provider fallback (a lenient provider accepts an Anthropic signature) — it only
   // keeps the session's live cross-account MIGRATION on Claude (the rebalance guard),
@@ -2587,6 +2618,10 @@ export class AccountManager {
     account.modelMap = acctData.modelMap || account.modelMap;
     account.stripBetaHeaders = Boolean(acctData.stripBetaHeaders);
     account.runtime = true;
+    // Restore path carries an explicit enabled (persisted disable); honor it. The `cc
+    // all` header path (prepareRuntimeProviders) omits enabled, so a re-sent token
+    // NEVER silently re-enables a provider the user benched in the TUI.
+    if (acctData.enabled !== undefined) account.enabled = acctData.enabled !== false;
     if (account.status === 'error' && changed) {
       account.status = 'active';
       account.lastError = null;
@@ -2620,6 +2655,10 @@ export class AccountManager {
         model: a.model,
         modelMap: a.modelMap,
         stripBetaHeaders: a.stripBetaHeaders,
+        // Persist the user's enable/disable so a provider they benched in the TUI stays
+        // benched across a restart — without this an intentionally-disabled GLM/Kimi
+        // silently comes back enabled on the next boot (restore defaults enabled:true).
+        enabled: a.enabled,
       }));
   }
 
@@ -2797,6 +2836,7 @@ export class AccountManager {
         stickyBindings: this.sessionBindings.size,
         thinkingProtected: [...this.sessionPolicies.values()].filter(p => p.requiresAnthropicThinkingIntegrity).length,
         providerPinned: [...this.sessionPolicies.values()].filter(p => p.anthropicIncompatible).length,
+        largeContextPinned: [...this.sessionPolicies.values()].filter(p => p.largeContext).length,
       },
     };
   }

package/src/index.js

@@ -12,7 +12,7 @@ import { loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon, toke
 import { TUI } from './tui.js';
 import { RestartController } from './restart-controller.js';
 import { resolveAccounts } from './account-config.js';
-import { maybeCheckForUpdate, getCurrentVersion } from './updater.js';
+import { maybeCheckForUpdate, getCurrentVersion, markApplied } from './updater.js';
 import {
   runReloadBaton,
   RELOAD_SWAPPED, RELOAD_ROLLED_BACK,
@@ -1025,11 +1025,31 @@ async function serverWorkerCommand() {
   // would permanently disable all future update detection. It only refreshes
   // versionInfo (the persistent TUI banner is the reminder, so no repeated log spam);
   // autoUpdate progress lines still surface. unref so it never blocks a clean exit.
+  const notifyUpdate = msg => (tui?._addLog ? tui._addLog(msg) : console.log(`[Maxpool] ${msg}`));
+  // Fully-automatic apply (opt-in autoApply): mark the version attempted, THEN seamlessly
+  // reload into the freshly-installed code (sessions survive). Marking here — at the
+  // moment we act — is what makes the quarantine truthful: a boot-broken release is
+  // attempted once, then blocked until an even newer version appears (no reload loop, no
+  // stranded download). Shared by the startup one-shot AND the periodic timer.
+  const applyUpdateIfReady = r => {
+    if (r?.applicable && config?.autoApply && restartController) {
+      markApplied(r.installedVersion);
+      notifyUpdate('Applying update — seamless reload…');
+      restartController.requestRestart();
+    }
+  };
   const updateIntervalMs = Math.max(60_000, Number(process.env.MAXPOOL_UPDATE_CHECK_INTERVAL_MS) || 6 * 60 * 60 * 1000);
   updateTimer = setInterval(() => {
-    if (config?.updateCheck === false) return;
-    const autoNotify = msg => { if (config?.autoUpdate) (tui?._addLog ? tui._addLog(msg) : console.log(`[Maxpool] ${msg}`)); };
-    maybeCheckForUpdate(config, autoNotify, info => { accountManager.versionInfo = info; }).catch(() => {});
+    // ONLY the lease-holding primary self-installs — the timer is unconditional across
+    // EVERY worker (incl. a headless reload worker), so gate on hasLease here to avoid
+    // two `npm i -g` racing during a reload overlap (global-package corruption). A
+    // headless reload worker never holds the lease, so it never installs/auto-applies.
+    if (config?.updateCheck === false || !hasLease) return;
+    // announce:false — the persistent TUI banner is the passive reminder; only real
+    // actions (installing / applying) log here, so a pending update never churns the log.
+    maybeCheckForUpdate(config, notifyUpdate, info => { accountManager.versionInfo = info; }, { announce: false })
+      .then(applyUpdateIfReady)
+      .catch(() => {});
   }, updateIntervalMs);
   updateTimer.unref();
 
@@ -1079,8 +1099,11 @@ async function serverWorkerCommand() {
     // A reload-spawned/takeover worker must NEVER re-probe (1x not 2x traffic).
     if (!viaTakeover && !isReloadWorker) {
       if (process.env.MAXPOOL_TEST_LOG_UPDATE_CHECK === '1') console.log('[Maxpool] UPDATE_CHECK_FIRED');
-      const notify = msg => (tui?._addLog ? tui._addLog(msg) : console.log(`[Maxpool] ${msg}`));
-      maybeCheckForUpdate(config, notify, info => { accountManager.versionInfo = info; }).catch(() => {});
+      // Cold-start-behind: download AND (autoApply) self-apply via the SAME helper as the
+      // periodic path — so the version is applied, not marked-attempted-then-stranded.
+      maybeCheckForUpdate(config, notifyUpdate, info => { accountManager.versionInfo = info; })
+        .then(applyUpdateIfReady)
+        .catch(() => {});
     } else if (process.env.MAXPOOL_TEST_LOG_UPDATE_CHECK === '1') {
       console.log('[Maxpool] UPDATE_CHECK_SKIPPED (reload)');
     }

package/src/prober.js

@@ -70,7 +70,11 @@ export class Prober {
     this._stopping = false;
     this._inflight = (async () => {
       try {
-        // Skip auth-dead accounts (dead refresh token): probing them just re-POSTs
+        // DISABLED accounts are INTENTIONALLY still probed (no `a.enabled` filter):
+        // a user often disables an account precisely BECAUSE it's exhausted, and still
+        // wants to see its quota recover — so keep refreshing its usage for visibility
+        // even though routing skips it. Do NOT add an enabled gate here.
+        // Skip only auth-dead accounts (dead refresh token): probing them just re-POSTs
         // the rejected token every cycle — a 400 storm. They recover only on re-auth.
         const oauth = this.am.accounts.filter(a => a.type === 'oauth' && a.credential && !a.refreshDead);
         const providers = this.am.accounts.filter(a => a.type === 'provider' && a.credential);

package/src/restart-controller.js

@@ -67,7 +67,10 @@ export class RestartController {
   }
 
   requestRestart() {
-    if (this.restarting) return;
+    // Idempotent against a restart ALREADY in progress — restarting OR pending (drain).
+    // Without the `pending` guard a second call (e.g. auto-apply firing while a manual
+    // restart is draining) would orphan the first _drainTimer and re-log.
+    if (this.restarting || this.pending) return;
     this.pauseAdmission();
     if (this.upstreamRequests.size === 0) {
       this._restart();

package/src/server.js

@@ -53,6 +53,16 @@ const DEFAULT_QUEUE = {
   // resets idle-gap client timeouts; if a client uses a wall-clock total-request
   // deadline, lower this to just under it.
   streamHoldMaxMs: 7 * 24 * 60 * 60 * 1000,
+  // HARD ceiling on EVERY streaming hold (capacity/quota/throttle/concurrency alike).
+  // maxpool CANNOT keep a client alive past its own stream watchdog — Claude Code aborts
+  // "Stream idle timeout - no chunks received" after CLAUDE_STREAM_IDLE_TIMEOUT_MS of no
+  // real content EVENTS, and it drops SSE ping/comment keep-alives before the watchdog
+  // sees them (anthropic-sdk-typescript#998). So a 7-day/24h server-side hold only parks
+  // a request the client already abandoned. Bound it to the wait the user actually wants
+  // (front-loaded work waiting for a free account ≈ a few hours) so beyond that the
+  // request error-fasts with an honest retryable 429 instead of a silent multi-day park.
+  // Pair with a raised client watchdog (the cc launch sets CLAUDE_STREAM_IDLE_TIMEOUT_MS).
+  streamClientToleranceMs: Math.max(60_000, Number(process.env.MAXPOOL_STREAM_CLIENT_TOLERANCE_MS) || 3 * 60 * 60 * 1000),
   // Non-streaming requests have no SSE heartbeat to keep them alive, so a long
   // hold would die on the client timeout anyway. Cap their wait conservatively.
   nonStreamMaxWaitMs: 5 * 60 * 1000,
@@ -235,9 +245,10 @@ export function createProxyServer(accountManager, config, hooks = {}) {
         }
         requestInfo.profile = getMaxpoolProfile(req.headers);
         requestInfo.sessionKey = headerValue(req.headers, 'x-maxpool-session');
-        if (requestInfo.requiresAnthropicThinkingIntegrity && requestInfo.profile === 'all') {
-          console.log('[Maxpool] Anthropic thinking detected; provider fallback disabled for this session/request');
-        }
+        // (Removed a FALSE "provider fallback disabled for signed thinking" log here: it
+        // fired on every thinking `all` request but was untrue under the default
+        // when-exhausted/always policies — providers DO serve thinking requests — and it
+        // repeatedly misdirected diagnosis of the "Stream idle timeout" reports.)
         prepareRuntimeProviders(accountManager, req.headers);
 
         await forwardRequest(
@@ -856,9 +867,15 @@ async function forwardRequest(
       // signature it can't validate). Detect it on an Anthropic account so we can
       // self-heal onto a provider instead of surfacing the 400.
       const anthropicIncompat = account.type !== 'provider' && isAnthropicIncompatBody(errorBody);
+      // A provider (GLM ~200K / Kimi 256K context) rejecting an oversized request that
+      // only a large-context Claude (1M) can hold — e.g. "exceeded model token limit:
+      // 262144". Detect it ONLY on a provider (a Claude account's context-length 400 is
+      // terminal — nothing bigger to fall to) so we can pin the session to Claude.
+      const providerTooSmall = account.type === 'provider' && isContextLengthError(errorBody);
       const errorType = errorBody.includes('Invalid `signature` in `thinking` block')
         ? 'invalid_thinking_signature'
         : anthropicIncompat ? 'anthropic_incompatible_transcript'
+        : providerTooSmall ? 'provider_context_too_small'
         : `HTTP ${upstreamRes.status}`;
       accountManager.releaseAccount(lease, { status: upstreamRes.status, error: errorType });
 
@@ -907,6 +924,33 @@ async function forwardRequest(
         );
       }
 
+      // React-and-heal: a PROVIDER (GLM/Kimi coding endpoint, fixed ~256K context)
+      // rejected an oversized request only a 1M-context Claude can hold — e.g. Kimi's
+      // "exceeded model token limit: 262144 (requested: 643557)". The coding leg IGNORES
+      // the model id, so a K3/GLM-1M plan doesn't lift its ceiling. Latch the session
+      // large-context (so its follow-up turns skip the too-small providers) and retry
+      // EXCLUDING every provider → routes to Claude, or HOLDS for a Claude account,
+      // instead of surfacing a 400 the client just retry-loops on. Only worth it when a
+      // Claude account exists to serve it; with none, the 400 surfaces (nothing bigger).
+      const claudeAvailable = accountManager.accounts?.some(a => a.type !== 'provider' && a.enabled !== false);
+      if (providerTooSmall && requestInfo.sessionKey && claudeAvailable
+        && canRetryBufferedBody && retryCount + 1 < maxAttempts && !res.headersSent) {
+        accountManager.markSessionLargeContext?.(requestInfo.sessionKey);
+        // Bench EVERY provider: today's GLM + Kimi coding legs both cap at ~256K, so once
+        // one 400s on size the others can't hold it either. If a genuine 1M-context
+        // provider is ever added, make this exclusion context-limit-aware instead of
+        // type-wide (the _isRequestCompatible gate would need the same treatment).
+        for (const a of (accountManager.accounts || [])) {
+          if (a.type === 'provider') excludedIndexes.add(a.index);
+        }
+        console.log(`[Maxpool] Provider "${account.name}" context too small for this request; pinning session to Claude and retrying`);
+        return forwardRequest(
+          req, res, body, accountManager, upstream, retryCount + 1, hooks, reqId, ctx, logDir,
+          retryConfig, queueConfig, { ...requestInfo, largeContext: true },
+          canRetryBufferedBody, canQueueBufferedBody, excludedIndexes,
+        );
+      }
+
       ctx.status = upstreamRes.status;
       sendErrorBody(res, requestInfo, upstreamRes.status, errorBody, upstreamRes.headers);
       return;
@@ -1135,7 +1179,7 @@ function formatRetryDuration(seconds) {
  */
 function computeQueueWindowMs({
   cause, stream, retryPlanCause,
-  maxWaitMs, capacityMaxWaitMs, nonStreamMaxWaitMs, streamHoldMaxMs,
+  maxWaitMs, capacityMaxWaitMs, nonStreamMaxWaitMs, streamHoldMaxMs, streamClientToleranceMs,
   isCountTokens, countTokensMaxWaitMs,
 }) {
   let windowMs;
@@ -1147,6 +1191,12 @@ function computeQueueWindowMs({
     windowMs = streamHoldMaxMs;
   }
   if (retryPlanCause === 'concurrency_cap') windowMs = Math.min(windowMs, capacityMaxWaitMs);
+  // Bound EVERY streaming cause to the client-tolerance ceiling — the client's own
+  // watchdog kills the stream well before a 24h/7d server hold, so anything past this
+  // just parks an abandoned request. A finite reset WITHIN the ceiling still holds +
+  // resumes (via the nextRetryForRequest oracle); a reset beyond it error-fasts (a real
+  // retryable 429 at the pre-heartbeat gate) instead of hanging.
+  if (stream && streamClientToleranceMs != null) windowMs = Math.min(windowMs, streamClientToleranceMs);
   // count_tokens: cap the QUEUE wait low (bounds only the wait-for-an-account, never
   // the upstream processing once acquired) so a non-heartbeated metadata call fast-
   // fails with a retryable 429 instead of hanging past the client's idle window.
@@ -1166,9 +1216,22 @@ function unavailableMessage(accountManager, requestInfo = {}, retryAfter, willRe
     return `This session's transcript can only run on ${fam} — Claude rejects its server-tool ids/thinking on replay. No ${fam} provider is available right now.${eta} Check the x-maxpool-zai-token / x-maxpool-kimi-token headers, or resume with 'cc ${incompat.homeProvider === 'kimi' ? 'kimi' : 'glm'}'.`;
   }
 
-  const thinking = requestInfo.requiresAnthropicThinkingIntegrity
-    || accountManager._requiresAnthropicThinkingIntegrity?.(requestInfo);
-  const n = accountManager.accounts.length;
+  // A large-context session (a provider already 400'd it as too big for its ~256K leg):
+  // only a 1M-context Claude can hold it — the providers are structurally BARRED, not
+  // merely "at their limit". Say the oversized truth + the two real ways out (wait for a
+  // Claude account, or /compact), instead of the misleading "providers at limit" line.
+  if (accountManager._isSessionLargeContext?.(requestInfo)) {
+    const eta = Number.isFinite(retryAfter) && retryAfter > 0
+      ? ` A Claude account should free in ~${formatRetryDuration(retryAfter)}.` : '';
+    return `This session is too large for the GLM/Kimi fallbacks (their ~256K limit) — it needs a 1M-context Claude account, and they're all busy right now.${eta} It sends as soon as one frees; /compact shortens the session if you'd rather not wait.`;
+  }
+
+  const claudeCount = accountManager.accounts.filter(a => a.type !== 'provider').length;
+  // Only name the providers when this pool actually HAS them (`cc all`). On `cc ma`
+  // (Claude-only) there are none, so the old hardcoded "and the GLM/Kimi providers"
+  // was a lie. When present they DO serve (not barred), so they're saturated too.
+  const providersClause = accountManager.accounts.some(a => a.type === 'provider')
+    ? ' and the GLM/Kimi providers' : '';
 
   // No route is expected to recover within the queue window — i.e. every Claude
   // account is at its own 5h/weekly limit. A short "retry in Ns" would be a lie;
@@ -1177,19 +1240,24 @@ function unavailableMessage(accountManager, requestInfo = {}, retryAfter, willRe
     const eta = Number.isFinite(retryAfter) && retryAfter > 0
       ? ` Soonest reset in ~${formatRetryDuration(retryAfter)}, beyond the hold window.`
       : '';
-    const base = `No Claude account can take this request — all ${n} are at their 5h or weekly limit.${eta} Add another Claude account or wait for a quota reset.`;
-    return thinking
-      ? `${base} GLM/Kimi fallback is unavailable because this session contains Anthropic signed thinking blocks; start a fresh non-thinking session to use them.`
-      : base;
+    return `No account can take this request — all ${claudeCount} Claude accounts${providersClause} are at their limit.${eta} Add another Claude account or wait for a quota reset.`;
   }
 
-  if (thinking) {
-    return `No Claude account could accept this request. Non-Claude fallback is disabled because this session contains Anthropic signed thinking blocks. Retry in ${retryAfter}s, wait for Claude capacity, or start a fresh non-thinking session to use GLM/Kimi.`;
-  }
-  return `All ${n} accounts exhausted. Retry in ${retryAfter}s.`;
+  return `No account can take this request right now — all ${claudeCount} Claude accounts${providersClause} are momentarily at their limit. Retry in ${retryAfter}s.`;
+}
+
+// A provider (GLM/Kimi) rejecting a request whose token count exceeds its context
+// window — Kimi's coding leg ("exceeded model token limit: 262144"), GLM's, or an
+// OpenAI-style "maximum context length". Kept narrow (specific context-overflow
+// phrasings, NOT a bare "token limit" which a rate-limit body also carries) so the
+// pin-to-Claude heal only fires on a genuine size overflow, not any 400. Rate-limit
+// 429s are intercepted earlier (classifyRateLimit) and never reach this check.
+function isContextLengthError(errorBody) {
+  if (!errorBody) return false;
+  return /exceeded model token limit|maximum context length|context length exceeded|context window (?:size )?(?:exceeded|too)|prompt is too long|input is too long|reduce the length of|too many (?:input )?tokens|request too large/i.test(errorBody);
 }
 
-export const __serverTest = { unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, commitStreamGraceHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody, streamResponse, startIdleRequestReaper };
+export const __serverTest = { unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, commitStreamGraceHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody, isContextLengthError, streamResponse, startIdleRequestReaper };
 
 async function readErrorBody(upstreamRes, limitBytes = 64 * 1024) {
   if (!upstreamRes.body) return '';
@@ -1467,6 +1535,9 @@ async function queueAndRetry(
   const streamHoldMaxMs = queueConfig.streamHoldMaxMs == null
     ? 7 * 24 * 60 * 60 * 1000
     : Math.max(0, Number(queueConfig.streamHoldMaxMs) || 0);
+  const streamClientToleranceMs = queueConfig.streamClientToleranceMs == null
+    ? 3 * 60 * 60 * 1000
+    : Math.max(0, Number(queueConfig.streamClientToleranceMs) || 0);
   const queueWindowMs = computeQueueWindowMs({
     cause,
     stream: Boolean(requestInfo.stream),
@@ -1475,6 +1546,7 @@ async function queueAndRetry(
     capacityMaxWaitMs,
     nonStreamMaxWaitMs,
     streamHoldMaxMs,
+    streamClientToleranceMs,
     isCountTokens: Boolean(requestInfo.isCountTokens),
     countTokensMaxWaitMs,
   });

package/src/tui.js

@@ -586,6 +586,9 @@ export class TUI {
       .map(index => ({ account: this.am.accounts[index], index }))
       .filter(({ account }) => {
         if (action === 'prefer') return account.type !== 'provider' && account.enabled;
+        // Enable/disable also works on runtime providers (GLM/Kimi) — a session-only
+        // toggle, since they're not in config. Rename/delete stay config-account-only.
+        if (action === 'toggle') return this._configAccountIndex(account) >= 0 || account.type === 'provider';
         return this._configAccountIndex(account) >= 0;
       })
       .map(({ index }) => index);
@@ -872,7 +875,18 @@ export class TUI {
     if (!account) return;
     const configIndex = this._configAccountIndex(account);
     if (configIndex < 0) {
-      this._addLog(`Cannot ${enabled ? 'enable' : 'disable'} runtime provider "${account.name}" here`);
+      // A runtime provider (GLM/Kimi) isn't in config — it's re-created from the `cc all`
+      // request headers — but its enable/disable IS durable: the flag persists in memory
+      // across `cc all` requests (the header upsert never re-enables it) and to state.json
+      // on the next save, so it stays benched across a restart too. Re-enable it here the
+      // same way whenever the user wants it back — there's no "removed forever" state.
+      if (account.type === 'provider') {
+        this.am.setAccountEnabled(idx, enabled);
+        if (!enabled && this.am.preferredAccountName === account.name) this.am.setRoutingMode?.('automatic');
+        this._addLog(`${enabled ? 'Enabled' : 'Disabled'} provider "${account.name}" — ${enabled ? 'routing resumed' : 'benched (stays off across cc all + restart; re-enable here anytime)'}`);
+        return;
+      }
+      this._addLog(`Cannot ${enabled ? 'enable' : 'disable'} "${account.name}" here (not in config)`);
       return;
     }
     const previous = this.config.accounts[configIndex].enabled;

package/src/updater.js

@@ -68,43 +68,99 @@ export async function selfUpdate({ timeoutMs = 120_000 } = {}) {
   }
 }
 
+// The version of the CODE currently EXECUTING, captured ONCE before any self-install.
+// getCurrentVersion() reads package.json FROM DISK, which `npm i -g` rewrites — so
+// after a background self-install the disk version != the running version. Every
+// "am I behind?" and loop-guard decision keys on THIS fixed value, not the disk read.
+let _bootVersion;
+// The newest version this process has already ATTEMPTED to auto-apply. The loop guard:
+// a version that installs fine but fails to BOOT rolls back to the old worker, which is
+// still running _bootVersion with its timer armed — without this it would re-detect the
+// on-disk version every check and re-apply forever (a boot-broken release → infinite
+// reload loop, ~30s of refused admission each cycle). We apply only versions strictly
+// newer than max(_bootVersion, _lastAttemptedTarget), so a rolled-back target is
+// quarantined until an even newer release appears.
+let _lastAttemptedTarget = null;
+
+/** Test-only: reset the module's version-tracking state between cases. */
+export function __resetUpdaterState() { _bootVersion = undefined; _lastAttemptedTarget = null; }
+
+/** Mark a version as ATTEMPTED-to-apply. The caller calls this at the moment it triggers
+ *  the reload — BEFORE the reload — so a rolled-back target is quarantined (advance-only).
+ *  Kept as the caller's action (not a side effect of maybeCheckForUpdate) so a caller that
+ *  ignores `applicable` can never strand a version or poison the quarantine floor. */
+export function markApplied(version) {
+  if (version && (!_lastAttemptedTarget || compareVersions(version, _lastAttemptedTarget) > 0)) {
+    _lastAttemptedTarget = version;
+  }
+}
+
 /**
- * Startup hook: check for an update and either notify (default) or self-install
- * (config.autoUpdate). Never auto-restarts a running proxy — the new version
- * applies on the next restart, so in-flight sessions are never interrupted.
- * Fire-and-forget; all failures are swallowed.
+ * Check for an update; with `config.autoUpdate` also self-install; with
+ * `config.autoApply` SIGNAL that the caller should seamlessly reload to APPLY it
+ * (returns `applicable:true` — the CALLER then markApplied()+reloads). Failures swallowed.
+ * Deps are injectable for tests.
+ *
+ * `onVersionInfo` is ALWAYS invoked with { current, latest, hasUpdate, checkedAt } —
+ * current + hasUpdate keyed on the RUNNING version (so the banner stays accurate after a
+ * background download, until the reload). `deps.announce===false` suppresses the passive
+ * "Update available" line (the periodic path — the persistent banner already shows it).
  *
- * `onVersionInfo` (optional) is ALWAYS invoked with { current, latest, hasUpdate,
- * checkedAt } — even when up-to-date, offline, or updateCheck is off — so the TUI
- * header / status can show the running version + whether an update is available.
+ * Returns { hasUpdate, applicable, installedVersion? }.
  */
-export async function maybeCheckForUpdate(config, notify, onVersionInfo) {
-  const current = await getCurrentVersion();
-  // Skip the npm round-trip when the user disabled update checks, but still report
-  // the running version so the indicator can show it.
-  const result = config?.updateCheck === false ? null : await checkForUpdate(current);
+export async function maybeCheckForUpdate(config, notify, onVersionInfo, deps = {}) {
+  const _get = deps.getCurrentVersion || getCurrentVersion;
+  const _check = deps.checkForUpdate || checkForUpdate;
+  const _self = deps.selfUpdate || selfUpdate;
+  const announce = deps.announce !== false;
+
+  if (_bootVersion === undefined) _bootVersion = await _get();
+  const current = _bootVersion;
+  const result = config?.updateCheck === false ? null : await _check(current);
+  const hasUpdate = Boolean(result?.hasUpdate);
 
   if (onVersionInfo) {
     try {
-      onVersionInfo({
-        current,
-        latest: result?.latest ?? null,
-        hasUpdate: Boolean(result?.hasUpdate),
-        checkedAt: Date.now(),
-      });
-    } catch { /* the indicator is best-effort; never break startup */ }
+      onVersionInfo({ current, latest: result?.latest ?? null, hasUpdate, checkedAt: Date.now() });
+    } catch { /* indicator is best-effort; never break startup */ }
   }
 
-  if (!result || !result.hasUpdate) return;
+  if (!hasUpdate) return { hasUpdate: false, applicable: false };
+  if (announce) notify(`Update available: ${result.current} → ${result.latest}`);
 
-  notify(`Update available: ${result.current} → ${result.latest}`);
-  if (config?.autoUpdate) {
+  if (!config?.autoUpdate) {
+    if (announce) notify(`Run 'npm i -g ${PACKAGE}' to update, or set "autoUpdate": true in your config.`);
+    return { hasUpdate: true, applicable: false };
+  }
+
+  // Skip the reinstall if the latest is ALREADY on disk (a prior check downloaded it) —
+  // otherwise every periodic check re-runs `npm i -g` + re-logs until a manual restart.
+  const onDisk = await _get();
+  if (!onDisk || compareVersions(onDisk, result.latest) < 0) {
     notify(`Auto-updating to ${result.latest}…`);
-    const r = await selfUpdate();
-    notify(r.ok
-      ? `Updated to ${result.latest}. Restart maxpool to apply (running sessions are not interrupted).`
-      : `Auto-update failed: ${r.error}. Run: npm i -g ${PACKAGE}`);
-  } else {
-    notify(`Run 'npm i -g ${PACKAGE}' to update, or set "autoUpdate": true in your config.`);
+    const r = await _self();
+    if (!r.ok) {
+      notify(`Auto-update failed: ${r.error}. Run: npm i -g ${PACKAGE}`);
+      return { hasUpdate: true, applicable: false };
+    }
+  }
+
+  const installed = await _get();
+  // Loop/quarantine guard — a version is "applicable" only if it is strictly newer than
+  // the newest we've already booted-as OR already ATTEMPTED to apply (markApplied). This
+  // function has NO side effect on that floor: the CALLER marks it when it triggers the
+  // reload, so a caller that ignores `applicable` can't strand a version or poison state.
+  const floor = (_lastAttemptedTarget && compareVersions(_lastAttemptedTarget, current) > 0)
+    ? _lastAttemptedTarget : current;
+  const advanced = Boolean(installed) && compareVersions(installed, current) > 0;
+  const applicable = advanced && compareVersions(installed, floor) > 0;
+
+  // Passive notices only. The "Applying now…" line + the reload are the caller's (it
+  // logs them exactly when it acts), so nothing here can claim an apply that didn't happen.
+  if (advanced && !applicable) {
+    if (announce) notify(`Update ${installed} already attempted — staying on ${current}; will retry only a newer release.`);
+  } else if (advanced && !config?.autoApply) {
+    if (announce) notify(`Updated to ${installed}. Restart maxpool to apply (sessions are not interrupted).`);
   }
+  return { hasUpdate: true, installedVersion: installed, applicable };
 }