maxpool 1.5.4 → 1.5.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.4",
+  "version": "1.5.6",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/config.js

@@ -28,6 +28,16 @@ export function getStatePath() {
   return cfg.endsWith('.json') ? cfg.replace(/\.json$/, '.state.json') : cfg + '.state';
 }
 
+/**
+ * Path to the persistent event log (a sibling of the config). Default-on; holds a
+ * rotating record of routing / network errors / cooldowns / reloads so incidents
+ * are investigable after the in-memory TUI feed has scrolled away.
+ */
+export function getLogPath() {
+  const cfg = getConfigPath();
+  return cfg.endsWith('.json') ? cfg.replace(/\.json$/, '.log') : cfg + '.log';
+}
+
 export function createDefaultConfig() {
   return {
     proxy: {
@@ -36,6 +46,10 @@ export function createDefaultConfig() {
       apiKey: 'mp-' + randomBytes(24).toString('base64url'),
     },
     upstream: 'https://api.anthropic.com',
+    // (macOS) Keep the system awake while requests are in flight so long overnight
+    // streams survive Maintenance Sleep; the Mac sleeps normally when idle. Set false
+    // to disable. AC power only; the display still sleeps (screen stays dark).
+    preventSleep: true,
     // On startup, check npm for a newer maxpool and notify. Set false to disable.
     updateCheck: true,
     // When true, a newer version is installed automatically (npm i -g maxpool@latest)

package/src/event-log.js

@@ -0,0 +1,122 @@
+// Persistent, rotating, low-overhead event log so incidents are investigable
+// after the fact (the TUI activity feed is in-memory only and scrolls away). It
+// mirrors the existing `[Maxpool] …` console stream — routing, network errors,
+// cooldowns, token refreshes, reloads, upstream-throttle — to a file that
+// survives the terminal. Logging must NEVER throw into the proxy path, so every
+// write is fire-and-forget and all errors are swallowed.
+
+import { appendFile, stat, rename, chmod } from 'node:fs/promises';
+
+const MAX_BYTES = 5 * 1024 * 1024;   // rotate at ~5 MB (one .1 backup kept)
+const ROTATE_CHECK_MS = 2000;        // rotation-owner size-check cadence
+// Cap each line below the platform PIPE_BUF (512 B on macOS) so concurrent
+// O_APPEND writes from coexisting processes during a reload stay atomic (never
+// interleave). 24-char ISO timestamp + space + body + newline must fit.
+const MAX_BODY = 480;
+const MAX_QUEUED = 10_000;            // bound the in-flight queue if the disk stalls
+
+let logPath = null;
+let manageRotation = false;           // SINGLE owner rotates (supervisor, or the lone unsupervised worker)
+let rotationTimer = null;
+let writeChain = Promise.resolve();
+let queued = 0;
+let dropped = 0;
+let origConsole = null;
+
+export function setEventLogPath(path, { manageRotation: owns = false } = {}) {
+  logPath = path || null;
+  manageRotation = Boolean(owns);
+  if (rotationTimer) { clearInterval(rotationTimer); rotationTimer = null; }
+  if (logPath) {
+    // 0600 even on a pre-existing file (appendFile's mode only applies on create).
+    chmod(logPath, 0o600).catch(() => {});
+    if (manageRotation) {
+      rotationTimer = setInterval(() => { rotateIfNeeded().catch(() => {}); }, ROTATE_CHECK_MS);
+      rotationTimer.unref?.();
+    }
+  }
+}
+
+/**
+ * Redact obvious secrets BEFORE anything reaches disk. We only ever log summaries
+ * (account names, statuses, error classes) — never raw tokens/headers/bodies — but
+ * this is defense-in-depth so a future log line that happens to include a token
+ * can't leak through the persisted file.
+ */
+export function redactSecrets(s) {
+  return String(s)
+    .replace(/sk-ant-[A-Za-z0-9._-]+/g, 'sk-ant-[redacted]')
+    .replace(/Bearer\s+[A-Za-z0-9._-]+/gi, 'Bearer [redacted]')
+    .replace(/(["']?(?:access|refresh)_?token["']?\s*[:=]\s*["']?)[A-Za-z0-9._-]{8,}/gi, '$1[redacted]')
+    .replace(/(["']?api[_-]?key["']?\s*[:=]\s*["']?)[A-Za-z0-9._-]{8,}/gi, '$1[redacted]');
+}
+
+export function appendEventLog(msg) {
+  if (!logPath || msg == null) return;
+  if (queued >= MAX_QUEUED) { dropped++; return; } // disk stalled — drop, don't grow memory unbounded
+  queued++;
+  writeChain = writeChain.then(() => writeLine(msg)).catch(() => {}).finally(() => { queued--; });
+}
+
+// Truncate to at most maxBytes UTF-8 bytes (not chars) without splitting a
+// multibyte codepoint, so the final line stays under PIPE_BUF for atomic O_APPEND.
+function capBytes(s, maxBytes) {
+  if (Buffer.byteLength(s) <= maxBytes) return s;
+  let str = Buffer.from(s).subarray(0, maxBytes - 3).toString('utf8'); // room for '…' (3 B)
+  if (str.endsWith('�')) str = str.slice(0, -1); // drop a partial trailing codepoint
+  return str + '…';
+}
+
+async function writeLine(rawMsg) {
+  const path = logPath;
+  if (!path) return;
+  try {
+    // The drop sentinel is its OWN append so neither write exceeds PIPE_BUF.
+    if (dropped > 0) {
+      const n = dropped; dropped = 0;
+      await appendFile(path, `${new Date().toISOString()} [event-log] dropped ${n} line(s) (disk stalled)\n`, { mode: 0o600 });
+    }
+    // Redaction + formatting on the DRAINED async chain, off the request hot path.
+    let body = redactSecrets(String(rawMsg)).replace(/\s*\n\s*/g, ' ');
+    body = capBytes(body, MAX_BODY);
+    await appendFile(path, `${new Date().toISOString()} ${body}\n`, { mode: 0o600 });
+  } catch { /* logging must never throw into the proxy */ }
+}
+
+// Rotation is run by a SINGLE owner's timer (never inside writeLine), so two
+// coexisting processes during a reload can't both rename and clobber each other's
+// archive. Appends are O_APPEND to the path, so a rename mid-stream just means the
+// next append re-creates the live file — no lost current lines.
+export async function rotateIfNeeded() {
+  const path = logPath;
+  if (!path) return;
+  const st = await stat(path).catch(() => null);
+  if (st && st.size > MAX_BYTES) await rename(path, `${path}.1`).catch(() => {});
+}
+
+/**
+ * Tee console.log/console.error to the event log while preserving their normal
+ * output (stdout in plain mode; the TUI separately re-points console at its ring
+ * buffer, whose _addLog also calls appendEventLog, so TUI-mode lines persist too).
+ */
+export function installConsoleMirror() {
+  if (origConsole) return; // idempotent
+  origConsole = { log: console.log.bind(console), error: console.error.bind(console) };
+  for (const method of ['log', 'error']) {
+    const orig = origConsole[method];
+    console[method] = (...args) => {
+      try { appendEventLog(args.map(a => (typeof a === 'string' ? a : String(a))).join(' ')); } catch { /* never */ }
+      orig(...args);
+    };
+  }
+}
+
+/** Test-only barrier: resolves once every queued append has settled. */
+export const flushEventLog = () => writeChain;
+
+/** Test-only: restore console + reset all module state so tests don't bleed. */
+export function __resetEventLogForTest() {
+  if (origConsole) { console.log = origConsole.log; console.error = origConsole.error; origConsole = null; }
+  if (rotationTimer) { clearInterval(rotationTimer); rotationTimer = null; }
+  logPath = null; manageRotation = false; writeChain = Promise.resolve(); queued = 0; dropped = 0;
+}

package/src/index.js

@@ -2,7 +2,9 @@
 
 import { spawn, spawnSync } from 'node:child_process';
 import { createInterface } from 'node:readline';
-import { loadOrCreateConfig, loadConfig, saveConfig, atomicConfigUpdate, getConfigPath, loadState, saveState, getStatePath, readGeneration, flushConfigWrites, flushStateWrites } from './config.js';
+import { loadOrCreateConfig, loadConfig, saveConfig, atomicConfigUpdate, getConfigPath, loadState, saveState, getStatePath, getLogPath, readGeneration, flushConfigWrites, flushStateWrites } from './config.js';
+import { setEventLogPath, installConsoleMirror } from './event-log.js';
+import { SleepGuard } from './sleep-guard.js';
 import { AccountManager } from './account-manager.js';
 import { createProxyServer } from './server.js';
 import { Prober } from './prober.js';
@@ -35,6 +37,17 @@ function isInteractiveTerminal() {
   return Boolean(process.stdout.isTTY) || process.env.MAXPOOL_FORCE_TTY === '1';
 }
 
+// Wire up the persistent event log (default-on; disable with `eventLog: false` in
+// config). Sets the path + tees console.log/error to disk so routing, network
+// errors, cooldowns and reloads survive the in-memory TUI feed for later triage.
+function initEventLog(config, { manageRotation = false } = {}) {
+  if (config?.eventLog === false) return;
+  try {
+    setEventLogPath(getLogPath(), { manageRotation });
+    installConsoleMirror();
+  } catch { /* logging must never block startup */ }
+}
+
 // Which reload path an in-process reload request takes. Interactive (a live TUI)
 // reloads via a FULL cold restart so the fresh worker re-renders the TUI — a
 // seamless reload worker boots headless and would strand the user in raw logs.
@@ -127,6 +140,7 @@ async function serverCommand() {
 async function supervisorCommand() {
   const { createServer } = await import('node:net');
   const config = await loadOrCreateConfig();
+  initEventLog(config, { manageRotation: true }); // supervisor is the single rotation owner
   const port = config.proxy.port;
   const host = config.proxy.host || '127.0.0.1';
 
@@ -433,6 +447,8 @@ function delay(ms) {
 
 async function serverWorkerCommand() {
   const config = await loadOrCreateConfig();
+  // The lone unsupervised worker owns rotation; under a supervisor, the supervisor does.
+  initEventLog(config, { manageRotation: typeof process.send !== 'function' });
 
   // --log-to <dir>
   const logTo = argValue('--log-to');
@@ -454,6 +470,14 @@ async function serverWorkerCommand() {
 
   const threshold = config.switchThreshold || 0.90;
   const accountManager = new AccountManager(accounts, threshold, config.scheduler || {});
+  // (macOS) Keep the system awake ONLY while there is work in flight or queued, so a
+  // long overnight streaming request survives Maintenance Sleep; the Mac sleeps
+  // normally when idle. Disable via `preventSleep: false` in config.
+  const sleepGuard = new SleepGuard({
+    enabled: config.preventSleep !== false && process.platform === 'darwin' && process.env.MAXPOOL_DISABLE_SLEEP_GUARD !== '1',
+    getWorkPending: () => accountManager.getGlobalInFlight() > 0 || accountManager.queueState.waiting.length > 0,
+    log: msg => console.log(`[Maxpool] ${msg}`),
+  });
   accountManager.setRoutingMode(
     config.routing?.mode,
     config.routing?.preferredAccount,
@@ -641,6 +665,7 @@ async function serverWorkerCommand() {
       quotaSaveInterval.unref?.();
     }
     prober.start();
+    sleepGuard.start(); // (macOS) keep the system awake while serving, so long streams survive Maintenance Sleep
   };
   // Stop scheduling writes and flip the lease. Returns a promise that settles
   // once any in-flight prober cycle has finished (so no probe-driven token
@@ -651,6 +676,7 @@ async function serverWorkerCommand() {
     hasLease = false;
     if (quotaSaveInterval) { clearInterval(quotaSaveInterval); quotaSaveInterval = null; }
     accountManager.setWriterLease(false);
+    sleepGuard.stop(); // release the wake — only the active lease-holder keeps the Mac awake
     await prober.stop(); // awaits any in-flight probe cycle (B1)
   };
 

package/src/server.js

@@ -874,6 +874,9 @@ async function forwardRequest(
       );
       if (queued) return;
       ctx.status = 503;
+      // Record the user-facing failure explicitly so it's greppable in the event
+      // log (the in-memory TUI feed scrolls away). `err` is the last network error.
+      console.error(`[Maxpool] Returned connection_unavailable (503) after network errors on all routes (last: "${account.name}" — ${err.code || err.message})`);
       sendErrorResponse(res, requestInfo, 503, {
         type: 'error',
         error: {

package/src/sleep-guard.js

@@ -0,0 +1,77 @@
+// Conditional sleep guard (macOS): while maxpool has work in flight, prevent the
+// SYSTEM from sleeping so long-lived streaming requests survive overnight
+// Maintenance Sleep (which powers down the network stack and kills the
+// connection → "terminated"). When idle, it releases so the Mac sleeps normally.
+//
+// Uses the built-in `caffeinate -s` (prevent SYSTEM sleep only — the DISPLAY still
+// sleeps, so the screen stays dark) with `-w <pid>` so caffeinate auto-exits if the
+// worker dies (never a zombie keeping the Mac awake forever). `-s` is AC-power only
+// by design. Complete no-op off macOS or when disabled (e.g. the test suite).
+
+import { spawn as realSpawn } from 'node:child_process';
+
+const POLL_MS = 5_000;      // re-check the in-flight signal (idle-sleep timers are minutes)
+const GRACE_MS = 60_000;    // stay awake this long after the last request, to bridge gaps
+
+export class SleepGuard {
+  constructor({ getWorkPending, log = () => {}, spawn = realSpawn, enabled, pollMs = POLL_MS, graceMs = GRACE_MS } = {}) {
+    this.getWorkPending = getWorkPending;   // () => boolean: true while there's active/queued work
+    this.log = log;
+    this._spawn = spawn;
+    this.enabled = enabled ?? (process.platform === 'darwin' && process.env.MAXPOOL_DISABLE_SLEEP_GUARD !== '1');
+    this.pollMs = pollMs;
+    this.graceMs = graceMs;
+    this.child = null;
+    this.pollTimer = null;
+    this.graceTimer = null;
+  }
+
+  start() {
+    if (!this.enabled || this.pollTimer) return;
+    this.pollTimer = setInterval(() => this._tick(), this.pollMs);
+    this.pollTimer.unref?.();
+    this._tick(); // engage immediately if there's already work
+  }
+
+  _tick() {
+    let pending = false;
+    try { pending = Boolean(this.getWorkPending?.()); } catch { pending = false; }
+    if (pending) {
+      if (this.graceTimer) { clearTimeout(this.graceTimer); this.graceTimer = null; }
+      this._ensureAwake();
+    } else if (this.child && !this.graceTimer) {
+      // Idle: hold the wake for a grace period, then release (bridges brief gaps
+      // between back-to-back requests so we never drop it mid-conversation).
+      this.graceTimer = setTimeout(() => { this.graceTimer = null; this._allowSleep(); }, this.graceMs);
+      this.graceTimer.unref?.();
+    }
+  }
+
+  _ensureAwake() {
+    if (!this.enabled || this.child) return;
+    try {
+      const c = this._spawn('/usr/bin/caffeinate', ['-s', '-w', String(process.pid)], { stdio: 'ignore' });
+      this.child = c;
+      // Only clear the ref if it's still THIS child (a stale exit can't null a newer one).
+      // caffeinate missing/unspawnable → disable so we don't re-spawn every poll forever.
+      c.once('error', () => { if (this.child === c) this.child = null; this.enabled = false; });
+      c.once('exit', () => { if (this.child === c) this.child = null; });
+      // Honest: -s keeps the SYSTEM awake ON AC ONLY (a no-op on battery); the display
+      // still sleeps so the screen stays dark.
+      this.log('Keeping the system awake while busy (caffeinate -s; AC power only, display still sleeps)');
+    } catch { this.child = null; this.enabled = false; }
+  }
+
+  _allowSleep() {
+    if (!this.child) return;
+    try { this.child.kill('SIGTERM'); } catch { /* already gone */ }
+    this.child = null;
+    this.log('Idle — allowing normal system sleep again');
+  }
+
+  stop() {
+    if (this.pollTimer) { clearInterval(this.pollTimer); this.pollTimer = null; }
+    if (this.graceTimer) { clearTimeout(this.graceTimer); this.graceTimer = null; }
+    this._allowSleep();
+  }
+}

package/src/tui.js

@@ -1,5 +1,6 @@
 import { createInterface } from 'node:readline';
 import { fetchProfile, loginOAuth } from './oauth.js';
+import { appendEventLog } from './event-log.js';
 
 // ── ANSI helpers ─────────────────────────────────────────────
 
@@ -284,6 +285,9 @@ export class TUI {
 
   _addLog(msg) {
     msg = msg.replace(/^\[Maxpool\]\s*/, '');
+    // Persist too — in TUI mode console is re-pointed here, bypassing the console
+    // mirror, so this is where TUI-mode lines reach the on-disk event log.
+    appendEventLog(msg);
     this.log.unshift({ t: timestamp(), msg });
     if (this.log.length > 200) this.log.length = 200;
     if (this.running) this.render();