maxpool 1.5.40 → 1.5.42

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.40",
+  "version": "1.5.42",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -103,6 +103,18 @@ const DEFAULT_SCHEDULER = {
   capPenaltyWeight: 10,            // steep penalty per unit of in-flight depth past D (throttle safety floor)
   paceCostWeight: 1.5,            // soft de-preference of accounts burning ahead of pace (was the ×6 term)
   scarcityWeight: 6,              // legacy; superseded by paceCostWeight (kept so old configs don't error)
+  // Reserve-account OVERFLOW model. A weekly-RESERVE account (util 0.85-0.95) used to
+  // sit idle behind a healthy-only first pass; now it's eligible in the first pass but
+  // ranked BELOW healthy accounts by _reserveCost (so healthy stays first-pick). Among
+  // reserve accounts the SOONEST-to-reset is cheapest (use-it-or-lose-it); the further
+  // into the band, the costlier (preserve). Critical (≥0.95)/exhausted stay hard-benched
+  // in the second pass, never softened. See _reserveCost + _selectNext's 2-pass ladder.
+  reserveFloorCost: 5,            // base overflow cost — keeps any reserve account behind an idle healthy one (~2)
+  reserveBandWeight: 8,           // ×(util-0.85)/0.10: deeper into the reserve band ⇒ costlier ⇒ consumed later
+  reserveScarcityWeight: 6,       // ×weekly _windowScarcity: reset-timing weight, ON TOP of the global paceCost, so
+                                  // a near-reset reserve account is used freely and a far-from-reset one is used last
+  reserveConcurrencyTarget: 2,    // tighter in-flight cap for reserve (capPenalty bites at inflight>2 ⇒ load fans out
+                                  // across the fleet before any single reserve account is dogpiled toward a 429)
   spreadShareWeight: 3,           // multiplies an account's share of recent fleet load (0..1)
   recoveryRampWeight: 4,          // decaying penalty applied to a just-recovered account
   recoveryRampMs: 5 * 60_000,     // how long the post-recovery ramp lasts
@@ -121,16 +133,25 @@ const DEFAULT_SCHEDULER = {
   // may be served by a provider FAMILY other than its home (Claude ↔ GLM ↔ Kimi).
   //   'never'         — strict pin: a Claude session uses Claude only; a GLM session
   //                     uses GLM only; a Kimi session uses Kimi only.
-  //   'when-exhausted'— (default) home family preferred; a Claude session falls back
-  //                     to GLM/Kimi only once all Claude accounts are unavailable
-  //                     (providers are already lower-priority fallback), and a GLM
-  //                     session may fall to Kimi once GLM is exhausted.
+  //   'when-exhausted'— home family preferred; a Claude session falls back to GLM/Kimi
+  //                     only once all Claude accounts are unavailable, and a GLM session
+  //                     may fall to Kimi once GLM is exhausted.
   //   'always'        — providers peer with Claude for a Claude/unknown session
   //                     (load-balanced, not last-resort).
+  // DEFAULT is 'never' (2026-07-24): a Claude Code session stays on Anthropic. Routing
+  // Claude→GLM/Kimi proved unreliable (the coding legs 403/429 + ignore the model id),
+  // so cross-routing OUT of Claude is OFF by default; re-enable via the TUI routing
+  // cycle or config. This governs ONLY the Claude→provider direction.
   // INVARIANT (all policies): a GLM/Kimi-origin session NEVER routes to an Anthropic
   // account — Anthropic 400s on a non-`srvtoolu_` server_tool_use id; that direction
   // is unfixable, not policy-tunable.
-  crossProviderFallbackPolicy: 'when-exhausted',
+  crossProviderFallbackPolicy: 'never',
+  // The OTHER cross direction, independent of the policy above: may a provider-origin
+  // (GLM/Kimi) session cross to the OTHER provider (GLM↔Kimi)? Default ON — both legs are
+  // lenient and accept each other's ids, and it's the reliable direction the user wants
+  // kept even while Claude→provider is 'never'. Only has effect under policy:'never' (the
+  // 'when-exhausted'/'always' paths never pinned to home). Set false for a strict home-pin.
+  providerCrossFallback: true,
 };
 const LOAD_EVENT_MAX_AGE_MS = 60 * 60 * 1000;
 const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
@@ -1429,14 +1450,16 @@ export class AccountManager {
     // Else fall through to the candidate score loop, which re-homes the session
     // onto the best healthy account via _bindSession on acquire.
 
-    // Healthy-first ladder for BOTH bound and unbound sessions. A bound session
-    // only reaches this loop once we've decided to LEAVE its account (rebalance
-    // fired / a higher-priority account is available / the bound account is down) —
-    // the sticky "stay put" path returns above without reaching here — so re-homing
-    // must prefer a genuinely-healthy account and fall back to reserve/critical only
-    // if none exists, never re-pick the idle reserve account it's leaving.
+    // Two-pass ladder for BOTH bound and unbound sessions. Pass 1 admits healthy AND
+    // reserve accounts together; the reserve accounts carry _reserveCost so a healthy
+    // account is preferred whenever one is comparably loaded — but a reserve account
+    // CAN outrank a badly-slammed healthy one (its capPenalty is unbounded), which is
+    // intended load-spread, not a regression. Pass 2 adds critical only when pass 1 is
+    // empty (the untouched hard fallback). A bound session reaches this loop only once
+    // we've decided to LEAVE its account (the sticky "stay put" path returns above); it
+    // may now re-home onto a lightly-loaded reserve account rather than a slammed
+    // healthy one — deliberate, since the whole point is to USE reserve accounts.
     const weeklyPasses = [
-      { allowWeeklyReserve: false, allowWeeklyCritical: false },
       { allowWeeklyReserve: true, allowWeeklyCritical: false },
       { allowWeeklyReserve: true, allowWeeklyCritical: true },
     ];
@@ -1699,6 +1722,15 @@ export class AccountManager {
     // are all unavailable the request HOLDS/queues (recoverable) rather than 400ing.
     if (requestInfo.hasImage && account.provider === 'kimi') return false;
 
+    // A large-context session: a provider already rejected this request with a
+    // context-length 400. The GLM/Kimi *coding* endpoints serve a fixed model capped
+    // at ~256K and IGNORE the model id (so a K3/GLM 1M PLAN doesn't lift the coding
+    // leg's ceiling). Only a 1M-context Claude account can hold it — bench the
+    // providers for this session so it routes to Claude, or HOLDS for one, instead of
+    // re-404ing on a too-small leg. Sticky per session (context only grows turn over
+    // turn), so no follow-up turn re-pays the wasted attempt.
+    if (account.type === 'provider' && this._isSessionLargeContext(requestInfo)) return false;
+
     const { incompatible, homeProvider } = this._effectiveIncompatible(requestInfo);
     const policy = this._crossProviderFallbackPolicy();
 
@@ -1706,9 +1738,13 @@ export class AccountManager {
       // The transcript can't replay to Claude (a foreign server_tool_use id, or
       // content Anthropic rejected on replay) — provider accounts ONLY, regardless
       // of policy. Providers are lenient and accept each other's ids (GLM↔Kimi is
-      // fine); 'never' pins to the detected home provider when known.
+      // fine). Under 'never' we keep the session on its home provider ONLY when
+      // providerCrossFallback is explicitly off; by default GLM↔Kimi crossing stays
+      // allowed even under 'never' (that reliable direction is governed separately
+      // from the Claude→provider policy).
       if (account.type !== 'provider') return false;
-      if (policy === 'never' && homeProvider && account.provider !== homeProvider) return false;
+      if (policy === 'never' && homeProvider && account.provider !== homeProvider
+        && this.scheduler.providerCrossFallback === false) return false;
       return true;
     }
 
@@ -1732,6 +1768,9 @@ export class AccountManager {
     if (requestInfo.anthropicIncompatible) {
       this.markSessionIncompatible(requestInfo.sessionKey, requestInfo.homeProvider);
     }
+    if (requestInfo.largeContext) {
+      this.markSessionLargeContext(requestInfo.sessionKey);
+    }
   }
 
   // Latch a session as Anthropic-incompatible (a foreign server_tool_use id, or a
@@ -1750,6 +1789,25 @@ export class AccountManager {
     });
   }
 
+  // Latch a session as large-context: a provider (the GLM/Kimi coding endpoint, fixed
+  // ~256K) rejected a request with a context-length 400 that only a 1M Claude can hold.
+  // Sticky + never-downgrades so every follow-up turn (context only grows) skips the
+  // too-small providers instead of re-paying a wasted 400. Cleared only by a new session.
+  markSessionLargeContext(sessionKey) {
+    if (!sessionKey) return;
+    const existing = this.sessionPolicies.get(sessionKey) || {};
+    if (!existing.largeContext) {
+      console.log(`[Maxpool] Session "${sessionKey}" exceeds provider context limits — pinned to Claude (GLM/Kimi benched for this session)`);
+    }
+    this.sessionPolicies.set(sessionKey, { ...existing, largeContext: true });
+  }
+
+  _isSessionLargeContext(requestInfo = {}) {
+    if (requestInfo.largeContext) return true;
+    if (!requestInfo.sessionKey) return false;
+    return Boolean(this.sessionPolicies.get(requestInfo.sessionKey)?.largeContext);
+  }
+
   // Marks a session as containing Anthropic signed thinking. This no longer bars
   // provider fallback (a lenient provider accepts an Anthropic signature) — it only
   // keeps the session's live cross-account MIGRATION on Claude (the rebalance guard),
@@ -1812,9 +1870,16 @@ export class AccountManager {
     const concurrency = inflight * this.scheduler.concurrencyWeight;
 
     // Steep soft cap past depth D — the throttle safety floor. No single
-    // account absorbs a deep concurrent burst no matter how "cheap" it looks.
+    // account absorbs a deep concurrent burst no matter how "cheap" it looks. A
+    // RESERVE account gets a tighter D (reserveConcurrencyTarget) so its capPenalty
+    // bites sooner — load fans out across the fleet before a low-quota account is
+    // dogpiled toward a 429.
+    const weeklyState = this._weeklyRawState(account);
+    const concTarget = weeklyState === 'reserve'
+      ? this.scheduler.reserveConcurrencyTarget
+      : this.scheduler.perAccountConcurrencyTarget;
     const capPenalty = this.scheduler.capPenaltyWeight
-      * Math.max(0, inflight - this.scheduler.perAccountConcurrencyTarget);
+      * Math.max(0, inflight - concTarget);
 
     // Burn-pace COST only (demoted from the old dominant scarcity×6 term): a
     // soft de-preference of accounts burning ahead of an even pace. Never a bench.
@@ -1836,6 +1901,7 @@ export class AccountManager {
     const spread = share * this.scheduler.spreadShareWeight;
 
     const ramp = this._recoveryRamp(account, now);
+    const reserveCost = this._reserveCost(account, now, weeklyState);
     const failurePenalty = account.consecutiveFailures * 5;
     // NO unknown-quota bonus. An account whose quota we cannot see must never be
     // MORE attractive than a known-healthy one — the old -0.5 nudge (safe only
@@ -1845,7 +1911,7 @@ export class AccountManager {
     // default) learns the real number within a cycle. `probing`/requalify still
     // flags a never-seen account for learning — that path is unchanged.
 
-    return concurrency + capPenalty + paceCost + scopedPace + spread + ramp + failurePenalty;
+    return concurrency + capPenalty + paceCost + scopedPace + spread + ramp + reserveCost + failurePenalty;
   }
 
   /**
@@ -1898,6 +1964,31 @@ export class AccountManager {
     return Math.max(0, used - elapsedFrac);
   }
 
+  /**
+   * Overflow cost for a weekly-RESERVE account (util 0.85-0.95). 0 for every other
+   * tier — normal/soft aren't softened, and critical/exhausted are hard-benched by the
+   * pass gate (never made cheaper here). This is what lets a reserve account be eligible
+   * in the FIRST selection pass yet still rank below healthy accounts: floor keeps it
+   * strictly behind an idle healthy pick, the band term makes deeper-into-reserve costlier
+   * (consumed later / preserved), and the reset-timing term makes the soonest-to-reset the
+   * cheapest reserve pick (use-it-or-lose-it). A slammed HEALTHY account can still score
+   * above a lightly-loaded reserve one (its capPenalty is unbounded) — that's intended
+   * load-spread, not a violation of "healthy first".
+   */
+  _reserveCost(account, now = Date.now(), weeklyState = this._weeklyRawState(account)) {
+    if (weeklyState !== 'reserve') return 0;
+    const q = account.quota;
+    const util = clamp01(q.unified7d);
+    const band = clamp01(
+      (util - this.scheduler.weeklyReserveThreshold)
+      / Math.max(1e-6, this.scheduler.weeklyCriticalThreshold - this.scheduler.weeklyReserveThreshold),
+    );
+    const pace = this._windowScarcity(q.unified7d, q.unified7dReset, WEEK_MS, now);
+    return this.scheduler.reserveFloorCost
+      + this.scheduler.reserveBandWeight * band
+      + this.scheduler.reserveScarcityWeight * pace;
+  }
+
   /**
    * Decaying penalty applied for `recoveryRampMs` after an account un-parks,
    * so a freshly-recovered account (which has ~0 recent load and may look most
@@ -2587,6 +2678,10 @@ export class AccountManager {
     account.modelMap = acctData.modelMap || account.modelMap;
     account.stripBetaHeaders = Boolean(acctData.stripBetaHeaders);
     account.runtime = true;
+    // Restore path carries an explicit enabled (persisted disable); honor it. The `cc
+    // all` header path (prepareRuntimeProviders) omits enabled, so a re-sent token
+    // NEVER silently re-enables a provider the user benched in the TUI.
+    if (acctData.enabled !== undefined) account.enabled = acctData.enabled !== false;
     if (account.status === 'error' && changed) {
       account.status = 'active';
       account.lastError = null;
@@ -2620,6 +2715,10 @@ export class AccountManager {
         model: a.model,
         modelMap: a.modelMap,
         stripBetaHeaders: a.stripBetaHeaders,
+        // Persist the user's enable/disable so a provider they benched in the TUI stays
+        // benched across a restart — without this an intentionally-disabled GLM/Kimi
+        // silently comes back enabled on the next boot (restore defaults enabled:true).
+        enabled: a.enabled,
       }));
   }
 
@@ -2797,6 +2896,7 @@ export class AccountManager {
         stickyBindings: this.sessionBindings.size,
         thinkingProtected: [...this.sessionPolicies.values()].filter(p => p.requiresAnthropicThinkingIntegrity).length,
         providerPinned: [...this.sessionPolicies.values()].filter(p => p.anthropicIncompatible).length,
+        largeContextPinned: [...this.sessionPolicies.values()].filter(p => p.largeContext).length,
       },
     };
   }

package/src/config.js

@@ -92,16 +92,22 @@ export function createDefaultConfig() {
       weeklyCriticalThreshold: 0.95,
       weeklyExhaustedThreshold: 0.985,
       // Cross-PROVIDER fallback policy for 'cc all' (profile=all): whether a session
-      // may be served by a provider family other than its home (Claude ↔ GLM ↔ Kimi).
-      //   'never'         — strict pin (Claude→Claude, GLM→GLM, Kimi→Kimi).
-      //   'when-exhausted'— (default) home family preferred; cross only once it's
-      //                     exhausted (a Claude session falls to GLM/Kimi when all
-      //                     Claude accounts are unavailable).
+      // may be served by a provider family other than its home (Claude → GLM/Kimi).
+      //   'never'         — (DEFAULT) a Claude Code session stays on Anthropic; no
+      //                     GLM/Kimi fallback. Routing Claude→providers proved unreliable
+      //                     (the coding legs 403/429 + ignore the model id), so it's OFF
+      //                     by default — re-enable here or via the TUI 'f' key.
+      //   'when-exhausted'— home family preferred; a Claude session falls to GLM/Kimi
+      //                     only once all Claude accounts are unavailable.
       //   'always'        — providers peer with Claude for a Claude/unknown session.
       // A GLM/Kimi-origin session NEVER routes to Anthropic under ANY policy — that
       // direction 400s on the non-`srvtoolu_` tool-use id and is unfixable. Toggle
       // live in the TUI (Routing sub-mode, 'f' key).
-      crossProviderFallbackPolicy: 'when-exhausted',
+      crossProviderFallbackPolicy: 'never',
+      // The OTHER cross direction (independent of the policy above): may a provider-origin
+      // (GLM/Kimi) session cross to the OTHER provider (GLM↔Kimi)? Default ON — reliable,
+      // both legs accept each other's ids. Only has effect under policy:'never'.
+      providerCrossFallback: true,
     },
     retry: {
       maxAttemptsPerRequest: 0,

package/src/index.js

@@ -966,6 +966,13 @@ async function serverWorkerCommand() {
             crossProviderFallbackPolicy: config.scheduler.crossProviderFallbackPolicy,
           };
         }
+        // Persist live-toggled automatic-update flags (the TUI 'u' Updates menu). Same
+        // reason as the policy above: without this the toggle takes effect in memory but
+        // silently reverts on the next config write / restart. Only write keys defined
+        // in-memory so a disk value is never clobbered with undefined.
+        for (const key of ['updateCheck', 'autoUpdate', 'autoApply']) {
+          if (config[key] !== undefined) diskConfig[key] = config[key];
+        }
         // Write in-memory accounts as the authoritative state, preserving
         // extra disk-only fields (e.g. importFrom) where the account still exists.
         // Use live tokens from AccountManager (not the stale config.accounts copy).
@@ -1038,18 +1045,55 @@ async function serverWorkerCommand() {
       restartController.requestRestart();
     }
   };
+  // Manual apply (the TUI 'u' → check & apply now): reload into a freshly-installed
+  // newer version REGARDLESS of autoApply — the user asked for it explicitly, so it must
+  // NOT no-op just because the AUTOMATIC path is off (that no-op is exactly the "relaunch
+  // still shows the old version" pain this menu exists to kill).
+  const applyNow = r => {
+    if (r?.applicable && restartController) {
+      markApplied(r.installedVersion);
+      notifyUpdate('Applying update — seamless reload…');
+      restartController.requestRestart();
+    }
+  };
+  // ONE in-flight latch shared by the periodic timer, the cold-start probe, AND the
+  // manual action, so two `npm i -g` can never race (global-package corruption). hasLease
+  // already blocks CROSS-worker races; this blocks same-worker timer-vs-manual overlap.
+  let updateInFlight = false;
+  const runUpdateCheck = async ({ announce, apply, forceInstall = false }) => {
+    if (updateInFlight || !hasLease || config?.updateCheck === false) return undefined;
+    updateInFlight = true;
+    try {
+      // The MANUAL action forces the install (autoUpdate:true) so pressing 'u' → 'c'
+      // actually downloads + reloads even when AUTOMATIC updates are off. Without this,
+      // maybeCheckForUpdate short-circuits before installing when config.autoUpdate is
+      // false (the default) and just tells the user to run `npm i -g` by hand — the exact
+      // quit/relaunch dance this menu exists to kill. The periodic + cold-start paths
+      // pass the real config so they still respect the user's autoUpdate choice.
+      const cfg = forceInstall ? { ...config, autoUpdate: true } : config;
+      const r = await maybeCheckForUpdate(cfg, notifyUpdate, info => { accountManager.versionInfo = info; }, { announce });
+      apply(r);
+      return r;
+    } catch { return undefined; /* update path is best-effort; never break the proxy */ }
+    finally { updateInFlight = false; }
+  };
+  // 'u' → check & apply now: force an immediate check + install + seamless reload so the
+  // user never has to quit/relaunch to pick up a release. Reports the up-to-date case too.
+  const checkForUpdatesNow = async () => {
+    if (updateInFlight) { notifyUpdate('Update check already running'); return; }
+    if (!hasLease) { notifyUpdate('Updates run on the primary worker only'); return; }
+    if (config?.updateCheck === false) { notifyUpdate('Update checks are disabled in config'); return; }
+    notifyUpdate('Checking for updates…');
+    const r = await runUpdateCheck({ announce: true, apply: applyNow, forceInstall: true });
+    if (r && !r.hasUpdate) notifyUpdate('Already on the latest version');
+  };
+  if (tui) tui.checkNow = checkForUpdatesNow;
   const updateIntervalMs = Math.max(60_000, Number(process.env.MAXPOOL_UPDATE_CHECK_INTERVAL_MS) || 6 * 60 * 60 * 1000);
   updateTimer = setInterval(() => {
-    // ONLY the lease-holding primary self-installs — the timer is unconditional across
-    // EVERY worker (incl. a headless reload worker), so gate on hasLease here to avoid
-    // two `npm i -g` racing during a reload overlap (global-package corruption). A
-    // headless reload worker never holds the lease, so it never installs/auto-applies.
-    if (config?.updateCheck === false || !hasLease) return;
     // announce:false — the persistent TUI banner is the passive reminder; only real
-    // actions (installing / applying) log here, so a pending update never churns the log.
-    maybeCheckForUpdate(config, notifyUpdate, info => { accountManager.versionInfo = info; }, { announce: false })
-      .then(applyUpdateIfReady)
-      .catch(() => {});
+    // actions (installing / applying) log. runUpdateCheck's latch + hasLease gate prevent
+    // racing installs (a headless reload worker never holds the lease, so never installs).
+    runUpdateCheck({ announce: false, apply: applyUpdateIfReady });
   }, updateIntervalMs);
   updateTimer.unref();
 
@@ -1099,11 +1143,10 @@ async function serverWorkerCommand() {
     // A reload-spawned/takeover worker must NEVER re-probe (1x not 2x traffic).
     if (!viaTakeover && !isReloadWorker) {
       if (process.env.MAXPOOL_TEST_LOG_UPDATE_CHECK === '1') console.log('[Maxpool] UPDATE_CHECK_FIRED');
-      // Cold-start-behind: download AND (autoApply) self-apply via the SAME helper as the
-      // periodic path — so the version is applied, not marked-attempted-then-stranded.
-      maybeCheckForUpdate(config, notifyUpdate, info => { accountManager.versionInfo = info; })
-        .then(applyUpdateIfReady)
-        .catch(() => {});
+      // Cold-start-behind: download AND (autoApply) self-apply via the SAME latched helper
+      // as the periodic path — so the version is applied, not marked-attempted-then-stranded,
+      // and it can't race the periodic timer's install.
+      runUpdateCheck({ announce: true, apply: applyUpdateIfReady });
     } else if (process.env.MAXPOOL_TEST_LOG_UPDATE_CHECK === '1') {
       console.log('[Maxpool] UPDATE_CHECK_SKIPPED (reload)');
     }

package/src/prober.js

@@ -70,7 +70,11 @@ export class Prober {
     this._stopping = false;
     this._inflight = (async () => {
       try {
-        // Skip auth-dead accounts (dead refresh token): probing them just re-POSTs
+        // DISABLED accounts are INTENTIONALLY still probed (no `a.enabled` filter):
+        // a user often disables an account precisely BECAUSE it's exhausted, and still
+        // wants to see its quota recover — so keep refreshing its usage for visibility
+        // even though routing skips it. Do NOT add an enabled gate here.
+        // Skip only auth-dead accounts (dead refresh token): probing them just re-POSTs
         // the rejected token every cycle — a 400 storm. They recover only on re-auth.
         const oauth = this.am.accounts.filter(a => a.type === 'oauth' && a.credential && !a.refreshDead);
         const providers = this.am.accounts.filter(a => a.type === 'provider' && a.credential);

package/src/server.js

@@ -53,6 +53,16 @@ const DEFAULT_QUEUE = {
   // resets idle-gap client timeouts; if a client uses a wall-clock total-request
   // deadline, lower this to just under it.
   streamHoldMaxMs: 7 * 24 * 60 * 60 * 1000,
+  // HARD ceiling on EVERY streaming hold (capacity/quota/throttle/concurrency alike).
+  // maxpool CANNOT keep a client alive past its own stream watchdog — Claude Code aborts
+  // "Stream idle timeout - no chunks received" after CLAUDE_STREAM_IDLE_TIMEOUT_MS of no
+  // real content EVENTS, and it drops SSE ping/comment keep-alives before the watchdog
+  // sees them (anthropic-sdk-typescript#998). So a 7-day/24h server-side hold only parks
+  // a request the client already abandoned. Bound it to the wait the user actually wants
+  // (front-loaded work waiting for a free account ≈ a few hours) so beyond that the
+  // request error-fasts with an honest retryable 429 instead of a silent multi-day park.
+  // Pair with a raised client watchdog (the cc launch sets CLAUDE_STREAM_IDLE_TIMEOUT_MS).
+  streamClientToleranceMs: Math.max(60_000, Number(process.env.MAXPOOL_STREAM_CLIENT_TOLERANCE_MS) || 3 * 60 * 60 * 1000),
   // Non-streaming requests have no SSE heartbeat to keep them alive, so a long
   // hold would die on the client timeout anyway. Cap their wait conservatively.
   nonStreamMaxWaitMs: 5 * 60 * 1000,
@@ -235,9 +245,10 @@ export function createProxyServer(accountManager, config, hooks = {}) {
         }
         requestInfo.profile = getMaxpoolProfile(req.headers);
         requestInfo.sessionKey = headerValue(req.headers, 'x-maxpool-session');
-        if (requestInfo.requiresAnthropicThinkingIntegrity && requestInfo.profile === 'all') {
-          console.log('[Maxpool] Anthropic thinking detected; provider fallback disabled for this session/request');
-        }
+        // (Removed a FALSE "provider fallback disabled for signed thinking" log here: it
+        // fired on every thinking `all` request but was untrue under the default
+        // when-exhausted/always policies — providers DO serve thinking requests — and it
+        // repeatedly misdirected diagnosis of the "Stream idle timeout" reports.)
         prepareRuntimeProviders(accountManager, req.headers);
 
         await forwardRequest(
@@ -856,9 +867,15 @@ async function forwardRequest(
       // signature it can't validate). Detect it on an Anthropic account so we can
       // self-heal onto a provider instead of surfacing the 400.
       const anthropicIncompat = account.type !== 'provider' && isAnthropicIncompatBody(errorBody);
+      // A provider (GLM ~200K / Kimi 256K context) rejecting an oversized request that
+      // only a large-context Claude (1M) can hold — e.g. "exceeded model token limit:
+      // 262144". Detect it ONLY on a provider (a Claude account's context-length 400 is
+      // terminal — nothing bigger to fall to) so we can pin the session to Claude.
+      const providerTooSmall = account.type === 'provider' && isContextLengthError(errorBody);
       const errorType = errorBody.includes('Invalid `signature` in `thinking` block')
         ? 'invalid_thinking_signature'
         : anthropicIncompat ? 'anthropic_incompatible_transcript'
+        : providerTooSmall ? 'provider_context_too_small'
         : `HTTP ${upstreamRes.status}`;
       accountManager.releaseAccount(lease, { status: upstreamRes.status, error: errorType });
 
@@ -907,6 +924,33 @@ async function forwardRequest(
         );
       }
 
+      // React-and-heal: a PROVIDER (GLM/Kimi coding endpoint, fixed ~256K context)
+      // rejected an oversized request only a 1M-context Claude can hold — e.g. Kimi's
+      // "exceeded model token limit: 262144 (requested: 643557)". The coding leg IGNORES
+      // the model id, so a K3/GLM-1M plan doesn't lift its ceiling. Latch the session
+      // large-context (so its follow-up turns skip the too-small providers) and retry
+      // EXCLUDING every provider → routes to Claude, or HOLDS for a Claude account,
+      // instead of surfacing a 400 the client just retry-loops on. Only worth it when a
+      // Claude account exists to serve it; with none, the 400 surfaces (nothing bigger).
+      const claudeAvailable = accountManager.accounts?.some(a => a.type !== 'provider' && a.enabled !== false);
+      if (providerTooSmall && requestInfo.sessionKey && claudeAvailable
+        && canRetryBufferedBody && retryCount + 1 < maxAttempts && !res.headersSent) {
+        accountManager.markSessionLargeContext?.(requestInfo.sessionKey);
+        // Bench EVERY provider: today's GLM + Kimi coding legs both cap at ~256K, so once
+        // one 400s on size the others can't hold it either. If a genuine 1M-context
+        // provider is ever added, make this exclusion context-limit-aware instead of
+        // type-wide (the _isRequestCompatible gate would need the same treatment).
+        for (const a of (accountManager.accounts || [])) {
+          if (a.type === 'provider') excludedIndexes.add(a.index);
+        }
+        console.log(`[Maxpool] Provider "${account.name}" context too small for this request; pinning session to Claude and retrying`);
+        return forwardRequest(
+          req, res, body, accountManager, upstream, retryCount + 1, hooks, reqId, ctx, logDir,
+          retryConfig, queueConfig, { ...requestInfo, largeContext: true },
+          canRetryBufferedBody, canQueueBufferedBody, excludedIndexes,
+        );
+      }
+
       ctx.status = upstreamRes.status;
       sendErrorBody(res, requestInfo, upstreamRes.status, errorBody, upstreamRes.headers);
       return;
@@ -1135,7 +1179,7 @@ function formatRetryDuration(seconds) {
  */
 function computeQueueWindowMs({
   cause, stream, retryPlanCause,
-  maxWaitMs, capacityMaxWaitMs, nonStreamMaxWaitMs, streamHoldMaxMs,
+  maxWaitMs, capacityMaxWaitMs, nonStreamMaxWaitMs, streamHoldMaxMs, streamClientToleranceMs,
   isCountTokens, countTokensMaxWaitMs,
 }) {
   let windowMs;
@@ -1147,6 +1191,12 @@ function computeQueueWindowMs({
     windowMs = streamHoldMaxMs;
   }
   if (retryPlanCause === 'concurrency_cap') windowMs = Math.min(windowMs, capacityMaxWaitMs);
+  // Bound EVERY streaming cause to the client-tolerance ceiling — the client's own
+  // watchdog kills the stream well before a 24h/7d server hold, so anything past this
+  // just parks an abandoned request. A finite reset WITHIN the ceiling still holds +
+  // resumes (via the nextRetryForRequest oracle); a reset beyond it error-fasts (a real
+  // retryable 429 at the pre-heartbeat gate) instead of hanging.
+  if (stream && streamClientToleranceMs != null) windowMs = Math.min(windowMs, streamClientToleranceMs);
   // count_tokens: cap the QUEUE wait low (bounds only the wait-for-an-account, never
   // the upstream processing once acquired) so a non-heartbeated metadata call fast-
   // fails with a retryable 429 instead of hanging past the client's idle window.
@@ -1166,9 +1216,22 @@ function unavailableMessage(accountManager, requestInfo = {}, retryAfter, willRe
     return `This session's transcript can only run on ${fam} — Claude rejects its server-tool ids/thinking on replay. No ${fam} provider is available right now.${eta} Check the x-maxpool-zai-token / x-maxpool-kimi-token headers, or resume with 'cc ${incompat.homeProvider === 'kimi' ? 'kimi' : 'glm'}'.`;
   }
 
-  const thinking = requestInfo.requiresAnthropicThinkingIntegrity
-    || accountManager._requiresAnthropicThinkingIntegrity?.(requestInfo);
-  const n = accountManager.accounts.length;
+  // A large-context session (a provider already 400'd it as too big for its ~256K leg):
+  // only a 1M-context Claude can hold it — the providers are structurally BARRED, not
+  // merely "at their limit". Say the oversized truth + the two real ways out (wait for a
+  // Claude account, or /compact), instead of the misleading "providers at limit" line.
+  if (accountManager._isSessionLargeContext?.(requestInfo)) {
+    const eta = Number.isFinite(retryAfter) && retryAfter > 0
+      ? ` A Claude account should free in ~${formatRetryDuration(retryAfter)}.` : '';
+    return `This session is too large for the GLM/Kimi fallbacks (their ~256K limit) — it needs a 1M-context Claude account, and they're all busy right now.${eta} It sends as soon as one frees; /compact shortens the session if you'd rather not wait.`;
+  }
+
+  const claudeCount = accountManager.accounts.filter(a => a.type !== 'provider').length;
+  // Only name the providers when this pool actually HAS them (`cc all`). On `cc ma`
+  // (Claude-only) there are none, so the old hardcoded "and the GLM/Kimi providers"
+  // was a lie. When present they DO serve (not barred), so they're saturated too.
+  const providersClause = accountManager.accounts.some(a => a.type === 'provider')
+    ? ' and the GLM/Kimi providers' : '';
 
   // No route is expected to recover within the queue window — i.e. every Claude
   // account is at its own 5h/weekly limit. A short "retry in Ns" would be a lie;
@@ -1177,19 +1240,24 @@ function unavailableMessage(accountManager, requestInfo = {}, retryAfter, willRe
     const eta = Number.isFinite(retryAfter) && retryAfter > 0
       ? ` Soonest reset in ~${formatRetryDuration(retryAfter)}, beyond the hold window.`
       : '';
-    const base = `No Claude account can take this request — all ${n} are at their 5h or weekly limit.${eta} Add another Claude account or wait for a quota reset.`;
-    return thinking
-      ? `${base} GLM/Kimi fallback is unavailable because this session contains Anthropic signed thinking blocks; start a fresh non-thinking session to use them.`
-      : base;
+    return `No account can take this request — all ${claudeCount} Claude accounts${providersClause} are at their limit.${eta} Add another Claude account or wait for a quota reset.`;
   }
 
-  if (thinking) {
-    return `No Claude account could accept this request. Non-Claude fallback is disabled because this session contains Anthropic signed thinking blocks. Retry in ${retryAfter}s, wait for Claude capacity, or start a fresh non-thinking session to use GLM/Kimi.`;
-  }
-  return `All ${n} accounts exhausted. Retry in ${retryAfter}s.`;
+  return `No account can take this request right now — all ${claudeCount} Claude accounts${providersClause} are momentarily at their limit. Retry in ${retryAfter}s.`;
+}
+
+// A provider (GLM/Kimi) rejecting a request whose token count exceeds its context
+// window — Kimi's coding leg ("exceeded model token limit: 262144"), GLM's, or an
+// OpenAI-style "maximum context length". Kept narrow (specific context-overflow
+// phrasings, NOT a bare "token limit" which a rate-limit body also carries) so the
+// pin-to-Claude heal only fires on a genuine size overflow, not any 400. Rate-limit
+// 429s are intercepted earlier (classifyRateLimit) and never reach this check.
+function isContextLengthError(errorBody) {
+  if (!errorBody) return false;
+  return /exceeded model token limit|maximum context length|context length exceeded|context window (?:size )?(?:exceeded|too)|prompt is too long|input is too long|reduce the length of|too many (?:input )?tokens|request too large/i.test(errorBody);
 }
 
-export const __serverTest = { unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, commitStreamGraceHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody, streamResponse, startIdleRequestReaper };
+export const __serverTest = { unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, commitStreamGraceHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody, isContextLengthError, streamResponse, startIdleRequestReaper };
 
 async function readErrorBody(upstreamRes, limitBytes = 64 * 1024) {
   if (!upstreamRes.body) return '';
@@ -1467,6 +1535,9 @@ async function queueAndRetry(
   const streamHoldMaxMs = queueConfig.streamHoldMaxMs == null
     ? 7 * 24 * 60 * 60 * 1000
     : Math.max(0, Number(queueConfig.streamHoldMaxMs) || 0);
+  const streamClientToleranceMs = queueConfig.streamClientToleranceMs == null
+    ? 3 * 60 * 60 * 1000
+    : Math.max(0, Number(queueConfig.streamClientToleranceMs) || 0);
   const queueWindowMs = computeQueueWindowMs({
     cause,
     stream: Boolean(requestInfo.stream),
@@ -1475,6 +1546,7 @@ async function queueAndRetry(
     capacityMaxWaitMs,
     nonStreamMaxWaitMs,
     streamHoldMaxMs,
+    streamClientToleranceMs,
     isCountTokens: Boolean(requestInfo.isCountTokens),
     countTokensMaxWaitMs,
   });

package/src/tui.js

@@ -27,9 +27,9 @@ const vw = s => strip(s).length;
 // ── Accounts-table columns ───────────────────────────────────
 // Fixed column widths shared by the header row (acctHeader) AND every data row, so
 // the header labels stay aligned with the columns they name. The Account/Provider/
-// Status/Quota start offsets (4/21/31/45) are pure functions of these widths + the
+// Status/Quota start offsets (4/25/35/49) are pure functions of these widths + the
 // 4-col row prefix, independent of the quota-bar width.
-const NAME_W = 16;         // a.name.slice(0, NAME_W).padEnd(NAME_W) — wide enough for a full email
+const NAME_W = 20;         // a.name.slice(0, NAME_W).padEnd(NAME_W) — fits a full email like 2solarmax@gmail.com (19)
 const PROVIDER_W = 9;      // providerLabel(a).padEnd(PROVIDER_W) — fits "Anthropic"
 const STATUS_W = 13;       // rpad(status, STATUS_W) — fits "throttled 59s"
 const ROW_PREFIX = '    '; // ' ' + sel(1) + cur(1) + ' ' — 4 cols before the name
@@ -250,6 +250,9 @@ export class TUI {
     this.syncAccounts = syncAccounts;
     this.onQuit = onQuit;
     this.onRestart = onRestart;
+    // Set by index.js after construction (a deferred closure, not a constructor literal —
+    // avoids the const TDZ on applyUpdateIfReady, which is defined after `new TUI`).
+    this.checkNow = null;
 
     this.log = [];           // completed activity entries
     this.active = new Map(); // in-flight requests
@@ -400,6 +403,7 @@ export class TUI {
       case 'normal': this._keyNormal(k); break;
       case 'accounts': this._keyAccounts(k); break;
       case 'routing': this._keyRouting(k); break;
+      case 'updates': this._keyUpdates(k); break;
       case 'select': this._keySelect(k); break;
       case 'input':  this._keyInput(k); break;
       case 'confirm': this._keyConfirm(k); break;
@@ -435,11 +439,52 @@ export class TUI {
         'Reload account credentials and newly added accounts from the config file.',
         () => this._doSync(),
       );
+    } else if (k === 'u') {
+      this.mode = 'updates';
     }
     // Enable/disable lives ONLY under [a] Accounts now (with rename/delete/login) —
     // one home for every account mutation, instead of a duplicate top-level toggle.
   }
 
+  // Automatic updates are "on" only when the whole chain is enabled: check npm →
+  // install to disk → seamlessly reload. Any one off means a release won't land hands-free.
+  _autoUpdateOn() {
+    const c = this.config || {};
+    return c.updateCheck !== false && c.autoUpdate === true && c.autoApply === true;
+  }
+
+  _keyUpdates(k) {
+    if (k === 'c') {
+      // Check & apply now — the dance-killer: pull the latest + seamless-reload in place,
+      // no quit/relaunch. index.js wires this.checkNow (applies regardless of autoApply).
+      this.mode = 'normal';
+      if (this.checkNow) this.checkNow();
+      else this._addLog('Update check unavailable on this worker');
+    } else if (k === 't') {
+      this._toggleAutoUpdate();
+    } else if (k === 'esc' || k === 'q') {
+      this.mode = 'normal';
+    }
+  }
+
+  async _toggleAutoUpdate() {
+    const turnOn = !this._autoUpdateOn();
+    // ON = the full hands-free chain; OFF = keep checking (banner still shows) but never
+    // install/reload without the user. Mutating this.config (=== the object index.js's
+    // update timer reads) takes effect live; saveConfig persists it (index.js writes these
+    // three keys) so it survives a restart.
+    this.config.updateCheck = true;
+    this.config.autoUpdate = turnOn;
+    this.config.autoApply = turnOn;
+    try {
+      await this.saveConfig(this.config);
+      this._addLog(`Automatic updates ${turnOn ? 'on' : 'off'}`);
+    } catch (error) {
+      this._addLog(`Could not save update setting: ${error.message}`);
+    }
+    this.mode = 'normal';
+  }
+
   _keyAccounts(k) {
     if (k === 'k') {
       this.mode = 'input';
@@ -586,6 +631,9 @@ export class TUI {
       .map(index => ({ account: this.am.accounts[index], index }))
       .filter(({ account }) => {
         if (action === 'prefer') return account.type !== 'provider' && account.enabled;
+        // Enable/disable also works on runtime providers (GLM/Kimi) — a session-only
+        // toggle, since they're not in config. Rename/delete stay config-account-only.
+        if (action === 'toggle') return this._configAccountIndex(account) >= 0 || account.type === 'provider';
         return this._configAccountIndex(account) >= 0;
       })
       .map(({ index }) => index);
@@ -872,7 +920,18 @@ export class TUI {
     if (!account) return;
     const configIndex = this._configAccountIndex(account);
     if (configIndex < 0) {
-      this._addLog(`Cannot ${enabled ? 'enable' : 'disable'} runtime provider "${account.name}" here`);
+      // A runtime provider (GLM/Kimi) isn't in config — it's re-created from the `cc all`
+      // request headers — but its enable/disable IS durable: the flag persists in memory
+      // across `cc all` requests (the header upsert never re-enables it) and to state.json
+      // on the next save, so it stays benched across a restart too. Re-enable it here the
+      // same way whenever the user wants it back — there's no "removed forever" state.
+      if (account.type === 'provider') {
+        this.am.setAccountEnabled(idx, enabled);
+        if (!enabled && this.am.preferredAccountName === account.name) this.am.setRoutingMode?.('automatic');
+        this._addLog(`${enabled ? 'Enabled' : 'Disabled'} provider "${account.name}" — ${enabled ? 'routing resumed' : 'benched (stays off across cc all + restart; re-enable here anytime)'}`);
+        return;
+      }
+      this._addLog(`Cannot ${enabled ? 'enable' : 'disable'} "${account.name}" here (not in config)`);
       return;
     }
     const previous = this.config.accounts[configIndex].enabled;
@@ -970,7 +1029,12 @@ export class TUI {
     // ── Header
     const v = this.am.versionInfo;
     const verStr = v?.current ? ` ${dim('v' + v.current)}` : '';
-    const left = bold(' Maxpool') + verStr;
+    // Auto-update state next to the version, so it's obvious whether a published release
+    // lands hands-free (green "auto-update on") or needs a manual 'u' (dim "off").
+    const auto = this._autoUpdateOn()
+      ? green('· auto-update on')
+      : dim('· auto-update off');
+    const left = bold(' Maxpool') + verStr + ' ' + auto;
     const port = this.config.proxy?.port || 3456;
     const right = `Port ${port} ${green('▲')} `;
     lines.push(left + ' '.repeat(Math.max(1, W - vw(left) - vw(right))) + right);
@@ -995,8 +1059,10 @@ export class TUI {
     // blank line). The persistent banner IS the reminder; a long-lived session's
     // periodic re-check keeps it current (index.js updateTimer refreshes versionInfo).
     if (v?.hasUpdate && v?.latest) {
-      lines.push('  ' + yellow(`↑ Update available: v${v.current} → v${v.latest}`)
-        + dim("  ·  run 'npm i -g maxpool', then press r"));
+      // No more "run npm i -g, then press r" — that manual dance is what the Updates menu
+      // kills. Auto-update ON: it applies itself; either way 'u' pulls + reloads in place.
+      const how = this._autoUpdateOn() ? 'applying automatically · or press u now' : 'press u to update now';
+      lines.push('  ' + yellow(`↑ Update available: v${v.current} → v${v.latest}`) + dim(`  ·  ${how}`));
     }
     const routing = this.am.routingMode === 'preferred'
       ? `Manual preference: ${this.am.preferredAccountName} (automatic failover)`
@@ -1048,11 +1114,11 @@ export class TUI {
       // misaligned second header).
       lines.push(dimUnderline(acctHeader(W)));
       const showBoth = W >= 70;
-      // 61/50 = the fixed pre-bar column span (prefix + Account + Provider + Status +
-      // gaps); grew by +4 with the wider 16-col Account column (was 57/46 at NAME_W 12).
+      // 65/54 = the fixed pre-bar column span (prefix + Account + Provider + Status +
+      // gaps); grew by +4 with the wider 20-col Account column (was 61/50 at NAME_W 16).
       const bw = showBoth
-        ? Math.max(5, Math.min(20, Math.floor((W - 61) / 2)))
-        : Math.max(5, Math.min(20, W - 50));
+        ? Math.max(5, Math.min(20, Math.floor((W - 65) / 2)))
+        : Math.max(5, Math.min(20, W - 54));
 
       // Claude/OAuth accounts first, providers (GLM/Kimi fallback) last — a stable
       // display order over the canonical am.accounts array (which stays untouched so
@@ -1341,7 +1407,11 @@ export class TUI {
   _renderFooter() {
     switch (this.mode) {
       case 'normal':
-        return ` ${bold('a')} Accounts  ${bold('m')} Routing  ${bold('s')} Sync  ${bold('r')} Restart  ${bold('q')} Stop`;
+        return ` ${bold('a')} Accounts  ${bold('m')} Routing  ${bold('s')} Sync  ${bold('u')} Updates  ${bold('r')} Restart  ${bold('q')} Stop`;
+      case 'updates': {
+        const state = this._autoUpdateOn() ? green('on') : dim('off');
+        return ` ${bold('c')} Check & apply now  ${bold('t')} Automatic updates: ${state} ↻  ${bold('Esc')} Back`;
+      }
       case 'accounts':
         return ` ${bold('l')} Login/re-auth (browser)  ${bold('k')} API key  ${bold('n')} Rename  ${bold('t')} Enable/disable  ${bold('d')} Delete  ${bold('Esc')} Back`;
       case 'routing': {