maxpool 1.5.64 → 1.5.66

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.64",
+  "version": "1.5.66",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -50,6 +50,10 @@ function emptyQuota() {
     // { fable:{utilization,resetAt,severity,isActive}, opus:{...}, sonnet:{...} }.
     scopedWeekly: {},
     unifiedStatus: null,   // allowed | allowed_warning | rejected
+    // TRUE when a SUCCESSFUL probe reported no weekly cap for this account — i.e.
+    // "this plan has no weekly limit", NOT "we couldn't read one". Without it both
+    // states render as an empty bar and a healthy account reads as broken.
+    weeklyAbsent: false,
     resetsAt: null,
     // Provider (z.ai / Kimi) quota — kept SEPARATE from unified* so a provider
     // reading never leaks into the OAuth quota gates (_isAvailable / _weeklyRawState
@@ -1396,6 +1400,41 @@ export class AccountManager {
     return { cause: 'unavailable', retryAt: null, queueable: false };
   }
 
+  /**
+   * Why is every Claude account unavailable RIGHT NOW? Counts the per-account causes
+   * the retry oracle already computes, so the 429 can name the real one.
+   *
+   * "All N accounts are at their limit" was wrong whenever the true cause was a short
+   * NETWORK cooldown (5s each, applied on a connection drop): the user reads a quota
+   * problem, waits, and considers adding accounts — when the fleet is actually fine and
+   * recovers in seconds. Returns { total, quota, transient, network, dominant }.
+   */
+  unavailabilityCensus(model = null) {
+    const QUOTA = new Set(['exhausted', 'weekly_exhausted', 'session_limit', 'token_limit', 'request_limit', 'rate_limited']);
+    const TRANSIENT = new Set(['cooldown', 'upstream_failure', 'concurrency_cap', 'weekly_critical']);
+    const c = { total: 0, quota: 0, transient: 0, network: 0, disabled: 0, error: 0, other: 0 };
+    for (const a of this.accounts) {
+      if (a.type === 'provider') continue;
+      c.total++;
+      const cause = this._retryInfo(a, model)?.cause || 'unavailable';
+      if (cause === 'disabled') c.disabled++;
+      else if (cause === 'error') c.error++;
+      else if (QUOTA.has(cause)) c.quota++;
+      else if (TRANSIENT.has(cause)) {
+        c.transient++;
+        // A cooldown whose window matches the NETWORK cooldown is a connectivity blip,
+        // not congestion — the distinction the user's report was about.
+        if (cause === 'cooldown' && a.cooldownUntil
+          && (a.cooldownUntil - Date.now()) <= this.scheduler.networkCooldownMs) c.network++;
+      } else c.other++;
+    }
+    const eligible = c.total - c.disabled - c.error;
+    c.dominant = eligible <= 0 ? 'none'
+      : c.quota >= Math.max(1, Math.ceil(eligible / 2)) ? 'quota'
+        : c.transient > 0 ? 'transient' : 'other';
+    return c;
+  }
+
   // The soonest active short-term (non-weekly) blocker for an account, or null if
   // none is active. Ordered most-specific-first; each entry is a {cause, retryAt,
   // queueable} the retry oracle can hold on. Kept separate from the weekly state
@@ -2212,6 +2251,11 @@ export class AccountManager {
       if (usage.sevenDay.utilization != null) q.unified7d = clamp01(usage.sevenDay.utilization);
       if (usage.sevenDay.resetAt != null) q.unified7dReset = usage.sevenDay.resetAt;
     }
+    // Only a SUCCESSFUL probe carrying the flag speaks to this. A header-driven update
+    // can't see the limits[] array, and a FAILED read knows nothing about the account's
+    // caps — either one claiming "uncapped" would mislabel a capped account as having no
+    // weekly limit, which is the exact wrong direction (it reads as free capacity).
+    if (!usage.error && usage.weeklyAbsent !== undefined) q.weeklyAbsent = Boolean(usage.weeklyAbsent);
     // Per-model weekly sub-limits (Fable, Opus, ...). Replace wholesale with the
     // fresh probe set so a family that dropped out of the response doesn't linger
     // stale; expiry on reset is a backstop for the between-probe window. EXCEPTION:
@@ -2320,11 +2364,16 @@ export class AccountManager {
     if (usage.wk) {
       if (usage.wk.utilization != null) q.providerWk = clamp01(usage.wk.utilization);
       if (usage.wk.resetAt != null) q.providerWkReset = usage.wk.resetAt;
+      q.weeklyAbsent = false;
     } else {
       // Weekly window absent from this plan/response — clear so a stale weekly
-      // reading doesn't linger after a plan/window change.
+      // reading doesn't linger after a plan/window change. A SUCCESSFUL poll that
+      // carries no weekly is positive knowledge that the plan has none: measured
+      // 2026-08-06, z.ai `max` returns exactly one TOKENS_LIMIT (unit 3 = the 5h
+      // session) and no unit-6 weekly, so GLM's blank Wk is correct, not a gap.
       q.providerWk = null;
       q.providerWkReset = null;
+      q.weeklyAbsent = true;
     }
     q.lastProbeOkAt = Date.now();
   }
@@ -2773,6 +2822,8 @@ export class AccountManager {
       modelMap: acctData.modelMap || null,
       stripBetaHeaders: Boolean(acctData.stripBetaHeaders),
       runtime: Boolean(acctData.runtime),
+      configSourced: Boolean(acctData.configSourced),
+      secretName: acctData.secretName || null,
       enabled: acctData.enabled !== false,
       refreshToken: acctData.refreshToken || null,
       expiresAt: acctData.expiresAt || null,
@@ -2827,6 +2878,8 @@ export class AccountManager {
     account.modelMap = acctData.modelMap || account.modelMap;
     account.stripBetaHeaders = Boolean(acctData.stripBetaHeaders);
     account.runtime = true;
+    if (acctData.configSourced !== undefined) account.configSourced = acctData.configSourced;
+    if (acctData.secretName !== undefined) account.secretName = acctData.secretName;
     // Restore path carries an explicit enabled (persisted disable); honor it. The `cc
     // all` header path (prepareRuntimeProviders) omits enabled, so a re-sent token
     // NEVER silently re-enables a provider the user benched in the TUI.
@@ -2851,7 +2904,7 @@ export class AccountManager {
    */
   exportRuntimeProviders() {
     return this.accounts
-      .filter(a => a.runtime && a.type === 'provider' && a.credential)
+      .filter(a => a.runtime && a.type === 'provider' && a.credential && !a.configSourced)
       .map(a => ({
         name: a.name,
         type: a.type,
@@ -2877,6 +2930,10 @@ export class AccountManager {
    * live `cc all` request refreshes the token before routing (prepareRuntimeProviders
    * runs ahead of account selection), so a stale restored token never serves a
    * request. Idempotent — upsertRuntimeAccount matches by name.
+   *
+   * Config-sourced providers (resolved from GCP Secret Manager at startup) are
+   * EXCLUDED — their source of truth is config + GCP, not state.json, so persisting
+   * their token to disk would duplicate the secret and survive a GCP deletion.
    */
   restoreRuntimeProviders(list) {
     if (!Array.isArray(list)) return;
@@ -2886,6 +2943,69 @@ export class AccountManager {
     }
   }
 
+  /**
+   * Load config-sourced provider accounts — resolved from GCP Secret Manager at
+   * startup, NOT from per-request headers. Each config entry is { name, provider,
+   * secretName, upstream?, priority?, modelMap? }. The secret is resolved by the
+   * caller (index.js) and passed as `token`; if null the provider is created but
+   * marked error so the TUI shows WHY it's broken.
+   *
+   * These are marked configSourced so they're excluded from state.json persistence
+   * (their source of truth is config + GCP, not disk) and so the header path can
+   * dedup against them (same token → skip creating a duplicate runtime provider).
+   */
+  loadConfigProviders(entries) {
+    if (!Array.isArray(entries)) return;
+    // Remove existing config-sourced providers that are no longer in the config
+    // (handles a config edit that removes an entry).
+    const wantedNames = new Set(entries.map(e => e.name).filter(Boolean));
+    for (const a of this.accounts) {
+      if (a.configSourced && !wantedNames.has(a.name)) {
+        const idx = this.accounts.indexOf(a);
+        if (idx >= 0 && this.accounts[idx].inFlight === 0) this.removeAccount(idx);
+      }
+    }
+    for (const entry of entries) {
+      if (!entry || !entry.name || !entry.provider) continue;
+      this.upsertRuntimeAccount({
+        name: entry.name,
+        type: 'provider',
+        provider: entry.provider,
+        authToken: entry.token || null,
+        upstream: entry.upstream || (entry.provider === 'kimi'
+          ? 'https://api.kimi.com/coding'
+          : 'https://api.z.ai/api/anthropic'),
+        authHeader: 'authorization',
+        profiles: ['all'],
+        priority: Number.isFinite(entry.priority) ? entry.priority : 10,
+        modelMap: entry.modelMap,
+        model: entry.model,
+        stripBetaHeaders: true,
+        configSourced: true,
+      });
+      if (!entry.token) {
+        const a = this.accounts.find(a => a.name === entry.name);
+        if (a) { a.status = 'error'; a.lastError = 'secret-unresolved'; }
+      }
+    }
+  }
+
+  /**
+   * Return the config-sourced provider definitions (name + provider + secretName)
+   * for the TUI and for config serialization. Tokens are NEVER included.
+   */
+  configProviderDefs() {
+    return this.accounts
+      .filter(a => a.configSourced && a.type === 'provider')
+      .map(a => ({
+        name: a.name,
+        provider: a.provider,
+        secretName: a.secretName || null,
+        upstream: a.upstream,
+        priority: a.priority,
+      }));
+  }
+
   /**
    * Remove an account by index.
    */

package/src/config.js

@@ -154,6 +154,11 @@ export function createDefaultConfig() {
       heartbeatMs: 10_000,
     },
     accounts: [],
+    // Config-sourced provider accounts (GLM/Kimi). Each entry references a GCP
+    // Secret Manager secret by NAME — the key is resolved at startup and held in
+    // memory only. See src/secret-resolver.js.
+    //   [{ name, provider:'zai'|'kimi', secretName, upstream?, priority? }]
+    providers: [],
   };
 }
 

package/src/index.js

@@ -593,6 +593,40 @@ async function serverWorkerCommand() {
   // self-healing window as an abrupt SIGKILL. A cold restart reads the clean-shutdown
   // final flush and restores fully (the reported zero-request case).
   if (savedState?.runtimeProviders) accountManager.restoreRuntimeProviders(savedState.runtimeProviders);
+
+  // ── config-sourced providers (GCP Secret Manager) ──────────────────────────
+  // Provider keys (GLM, Kimi) defined in the config's `providers` section, each
+  // referencing a GCP Secret Manager secret by NAME — the key is resolved at
+  // startup and held in memory only, never written to config or state.json.
+  // Team members add a provider by storing the key in GCP, then pointing maxpool
+  // at the secret name via the TUI. Deleting the GCP secret disables the provider
+  // on the next restart — no key to hunt down in config files.
+  if (Array.isArray(config.providers) && config.providers.length > 0) {
+    try {
+      const { resolveSecrets } = await import('./secret-resolver.js');
+      // Split: GCP-sourced (secretName) vs direct (apiKey). Both produce a token
+      // the same way — the resolution path is the only difference.
+      const gcpEntries = config.providers.filter(p => p.secretName);
+      const directEntries = config.providers.filter(p => p.apiKey && !p.secretName);
+      const secretNames = gcpEntries.map(p => p.secretName);
+      const resolved = await resolveSecrets(secretNames);
+      const entries = config.providers.map(p => ({
+        ...p,
+        token: p.secretName ? (resolved[p.secretName] || null) : (p.apiKey || null),
+      }));
+      accountManager.loadConfigProviders(entries);
+      const ok = entries.filter(e => e.token).length;
+      const fail = entries.length - ok;
+      console.log(`[Maxpool] Config providers: ${ok} active${fail ? `, ${fail} unresolved` : ''}`);
+      for (const p of config.providers) {
+        const a = accountManager.accounts.find(a => a.name === p.name);
+        if (a && p.secretName) a.secretName = p.secretName;
+      }
+    } catch (err) {
+      console.error(`[Maxpool] Config provider resolution failed: ${err.message}`);
+    }
+  }
+
   // Track the state-file generation we last observed so a stale flush is refused.
   let stateGeneration = Number(savedState?._generation) || 0;
 

package/src/oauth.js

@@ -267,10 +267,18 @@ export async function fetchUsage(accessToken) {
       }
     }
 
+    const sevenDay = limitsWeeklyAll || normalizeUsageBucket(data?.seven_day);
     return {
       fiveHour: limitsSession || normalizeUsageBucket(data?.five_hour),
-      sevenDay: limitsWeeklyAll || normalizeUsageBucket(data?.seven_day),
+      sevenDay,
       scopedWeekly,
+      // A SUCCESSFUL read that carries no weekly bucket is positive knowledge: this
+      // account HAS no weekly cap, as opposed to "we haven't managed to read one yet".
+      // Both render as a blank bar otherwise, so a perfectly healthy account looks
+      // broken. Measured 2026-08-06: privacy@gomokka.com returns limits=[session,
+      // weekly_scoped(inactive)] and `seven_day: null`, while every other account
+      // returns a `weekly_all` — it is genuinely uncapped, not unread.
+      weeklyAbsent: sevenDay == null || sevenDay.utilization == null,
     };
   } catch (err) {
     return { error: err.message || String(err), status: null };

package/src/secret-resolver.js

@@ -0,0 +1,49 @@
+/**
+ * Resolve a GCP Secret Manager secret name to its plaintext value.
+ *
+ * Uses `gcloud secrets versions access` — the same path load-secrets.sh uses.
+ * The key is resolved ONCE at startup (or when a provider is added via the TUI)
+ * and held in maxpool's process memory, never written to disk or logs.
+ *
+ * Returns null on any failure (missing secret, no gcloud, auth error) so a
+ * broken provider degrades to "disabled" instead of crashing the proxy.
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+
+const DEFAULT_PROJECT = 'mokka-business-automations';
+
+export async function resolveSecret(secretName, { project = DEFAULT_PROJECT, timeoutMs = 45_000 } = {}) {
+  if (!secretName || typeof secretName !== 'string') return null;
+  try {
+    const { stdout } = await execFileAsync(
+      'gcloud',
+      ['secrets', 'versions', 'access', 'latest', '--secret', secretName, '--project', project],
+      { timeout: timeoutMs, maxBuffer: 1024 * 1024 },
+    );
+    const value = stdout.trim();
+    return value || null;
+  } catch {
+    // Missing secret, no gcloud, auth expired, no network — all degrade to null.
+    // The TUI shows the provider as "error: secret-unresolved" so the operator
+    // knows which secret failed, not just that "the provider is broken".
+    return null;
+  }
+}
+
+/**
+ * Resolve multiple secrets in parallel. Returns { name → value } for the ones
+ * that resolved; failed ones are simply absent (caller treats absence as
+ * "provider can't activate"). Parallel because N secrets at ~500ms each
+ * serialized would add seconds to startup.
+ */
+export async function resolveSecrets(secretNames, opts = {}) {
+  const unique = [...new Set(secretNames.filter(Boolean))];
+  if (!unique.length) return {};
+  const entries = await Promise.all(
+    unique.map(async name => [name, await resolveSecret(name, opts)]),
+  );
+  return Object.fromEntries(entries.filter(([, v]) => v != null));
+}

package/src/server.js

@@ -1562,6 +1562,20 @@ function unavailableMessage(accountManager, requestInfo = {}, retryAfter, willRe
   // MINUTES (not momentary), and raw seconds are unreadable. Scale the wording to the
   // actual wait and render it in human units, the way every other branch already does.
   const waitLong = Number.isFinite(retryAfter) && retryAfter >= 120;
+
+  // "at their limit" is a QUOTA claim. When the accounts are actually in short network
+  // cooldowns (a connectivity blip drops every in-flight connection and cools each
+  // account for ~5s), that claim sends the user to check quota and add accounts while
+  // the fleet is healthy and recovers in seconds. Name the real cause.
+  const census = accountManager.unavailabilityCensus?.(requestInfo.model);
+  if (census && census.dominant === 'transient') {
+    const netly = census.network > 0;
+    const what = netly
+      ? `${census.network} of ${census.total} Claude accounts are in a brief reconnect cooldown`
+      : `all ${census.total} Claude accounts are momentarily busy`;
+    return `No account can take this request right now — ${what}, not out of quota. Retry in ~${formatRetryDuration(retryAfter)}; it clears on its own.${providersBarredHint}`;
+  }
+
   return `No account can take this request right now — all ${claudeCount} Claude accounts${providersClause} are ${waitLong ? 'at their limit' : 'momentarily at their limit'}. Retry in ~${formatRetryDuration(retryAfter)}.${providersBarredHint}`;
 }
 
@@ -2559,8 +2573,18 @@ function getMaxpoolProfile(headers) {
 function prepareRuntimeProviders(accountManager, headers) {
   if (getMaxpoolProfile(headers) !== 'all') return;
 
+  // Config-sourced providers already exist (resolved from GCP at startup). A `cc all`
+  // session sends the SAME token as a header → dedup by token so we don't create a
+  // duplicate provider for every request. The config provider wins (it persists, has
+  // the right name, and carries quota state from earlier requests).
+  const configTokens = new Set(
+    (accountManager.accounts || [])
+      .filter(a => a.configSourced && a.credential)
+      .map(a => a.credential),
+  );
+
   const zaiToken = headerValue(headers, 'x-maxpool-zai-token');
-  if (zaiToken) {
+  if (zaiToken && !configTokens.has(zaiToken)) {
     const opus = headerValue(headers, 'x-maxpool-zai-opus-model') || headerValue(headers, 'x-maxpool-zai-model') || 'glm-5.2';
     const sonnet = headerValue(headers, 'x-maxpool-zai-sonnet-model') || headerValue(headers, 'x-maxpool-zai-model') || opus;
     const haiku = headerValue(headers, 'x-maxpool-zai-haiku-model') || 'glm-5.1';
@@ -2579,7 +2603,7 @@ function prepareRuntimeProviders(accountManager, headers) {
   }
 
   const kimiToken = headerValue(headers, 'x-maxpool-kimi-token');
-  if (kimiToken) {
+  if (kimiToken && !configTokens.has(kimiToken)) {
     // Fallback only — `cc all` always sends x-maxpool-kimi-model from the llm_config SSOT,
     // so this is what a bare/older client gets. Kept current deliberately: it read
     // 'kimi-k2.7' while the fleet had moved to k3.

package/src/tui.js

@@ -405,6 +405,7 @@ export class TUI {
       case 'accounts': this._keyAccounts(k); break;
       case 'routing': this._keyRouting(k); break;
       case 'updates': this._keyUpdates(k); break;
+      case 'providers': this._keyProviders(k); break;
       case 'select': this._keySelect(k); break;
       case 'input':  this._keyInput(k); break;
       case 'confirm': this._keyConfirm(k); break;
@@ -442,6 +443,8 @@ export class TUI {
       );
     } else if (k === 'u') {
       this.mode = 'updates';
+    } else if (k === 'p') {
+      this.mode = 'providers';
     }
     // Enable/disable lives ONLY under [a] Accounts now (with rename/delete/login) —
     // one home for every account mutation, instead of a duplicate top-level toggle.
@@ -582,6 +585,140 @@ export class TUI {
     }
   }
 
+  _keyProviders(k) {
+    if (k === 'a') {
+      this._providerAddStep('name');
+    } else if (k === 'd') {
+      this._startProviderSelection('delete');
+    } else if (k === 't') {
+      this._startProviderSelection('toggle');
+    } else if (k === 'esc' || k === 'q') {
+      this.mode = 'normal';
+    }
+  }
+
+  // Multi-step input for adding a provider. Steps: name → type → secret name.
+  _providerAddStep(step, prev) {
+    if (step === 'name') {
+      this.mode = 'input';
+      this.inputPrompt = 'Provider display name (e.g. glm-ahmed)';
+      this.inputBuf = '';
+      this.inputSensitive = false;
+      this.inputCb = value => {
+        const name = String(value || '').trim();
+        if (!name) { this.mode = 'providers'; return; }
+        if (this.am.accounts.some(a => a.name === name)) {
+          this._addLog(`Account "${name}" already exists`); this.mode = 'providers'; return;
+        }
+        this._providerAddStep('type', { name });
+      };
+    } else if (step === 'type') {
+      this.mode = 'input';
+      this.inputPrompt = `Type for ${prev.name} (zai or kimi)`;
+      this.inputBuf = 'zai';
+      this.inputSensitive = false;
+      this.inputCb = value => {
+        const provider = String(value || '').trim().toLowerCase();
+        if (provider !== 'zai' && provider !== 'kimi') { this._addLog('Type must be zai or kimi'); this.mode = 'providers'; return; }
+        this._providerAddStep('secret', { ...prev, provider });
+      };
+    } else if (step === 'secret') {
+      this.mode = 'input';
+      this.inputPrompt = `${prev.name}: GCP secret name OR paste API key directly`;
+      this.inputBuf = '';
+      this.inputSensitive = false;
+      this.inputCb = async value => {
+        const input = String(value || '').trim();
+        if (!input) { this.mode = 'providers'; return; }
+        // Heuristic: a GCP secret name is uppercase/dashes/underscores and short.
+        // An API key is long and contains dots/mixed-case/alphanumeric.
+        const looksLikeSecretName = /^[A-Z][A-Z0-9_-]{2,60}$/.test(input) && !input.includes('.');
+        if (looksLikeSecretName) {
+          await this._doAddProvider({ ...prev, secretName: input });
+        } else {
+          // Direct key paste — store in config (0600, same protection as OAuth tokens).
+          await this._doAddProvider({ ...prev, apiKey: input });
+        }
+      };
+    }
+  }
+
+  async _doAddProvider({ name, provider, secretName, apiKey }) {
+    this.mode = 'providers';
+    const isDirect = !secretName && apiKey;
+    if (secretName) this._addLog(`Resolving secret "${secretName}" from GCP…`);
+    else this._addLog(`Adding "${name}" with direct API key…`);
+    this.render();
+    try {
+      let token = null;
+      if (secretName) {
+        const { resolveSecret } = await import('../secret-resolver.js');
+        token = await resolveSecret(secretName);
+        if (!token) {
+          this._addLog(`✗ Secret "${secretName}" not found in GCP — create it first: gcloud secrets create ${secretName} --data-file=-`);
+          return;
+        }
+      } else {
+        token = apiKey;
+      }
+      // Add to config (persistence) and activate immediately.
+      const { atomicConfigUpdate } = await import('../config.js');
+      await atomicConfigUpdate(cfg => {
+        if (!Array.isArray(cfg.providers)) cfg.providers = [];
+        const entry = { name, provider };
+        if (secretName) entry.secretName = secretName;
+        else entry.apiKey = apiKey;
+        cfg.providers.push(entry);
+      });
+      // Activate in the running process.
+      this.am.loadConfigProviders([{ name, provider, secretName, token }]);
+      const a = this.am.accounts.find(a => a.name === name);
+      if (a && secretName) a.secretName = secretName;
+      this._addLog(`✓ Added "${name}" (${provider})${secretName ? ` — GCP secret "${secretName}"` : ' — direct key'}`);
+    } catch (err) {
+      this._addLog(`✗ Failed to add provider: ${err.message}`);
+    }
+  }
+
+  _startProviderSelection(action) {
+    const providers = this.am.accounts.filter(a => a.type === 'provider');
+    if (!providers.length) { this._addLog('No providers to manage'); return; }
+    this._selOptions = providers.map(a => a.index);
+    this._selLabels = providers.map(a => {
+      const enabled = a.enabled !== false;
+      const tag = a.configSourced ? ' (GCP)' : ' (header)';
+      const secret = a.secretName ? ` [${a.secretName}]` : '';
+      return `${a.name}${tag}${secret}${enabled ? '' : ' ✕'}`;
+    });
+    this.selAction = action;
+    this.mode = 'select';
+  }
+
+  _renderProviders(buf, width) {
+    const providers = this.am.accounts.filter(a => a.type === 'provider');
+    buf.push(`${bold('Providers (GLM / Kimi)')}  ${dim('— managed via GCP Secret Manager')}`);
+    buf.push('');
+    if (!providers.length) {
+      buf.push(dim('  No providers configured.'));
+      buf.push('');
+      buf.push(dim('  Press ') + bold('a') + dim(' to add one. You\'ll need:'));
+      buf.push(dim('    1. An API key from z.ai (GLM) or Moonshot (Kimi)'));
+      buf.push(dim('    2. The key stored in GCP: ') + 'gcloud secrets create <name> --data-file=-');
+      buf.push(dim('    3. The GCP secret name (e.g. RESTRICTED_MAXPOOL_ZAI_NEW)'));
+      return;
+    }
+    for (const a of providers) {
+      const enabled = a.enabled !== false;
+      const tag = a.configSourced ? dim(' (GCP)') : dim(' (header)');
+      const secret = a.secretName ? dim(` [${a.secretName}]`) : '';
+      const status = a.status === 'error' ? red(a.lastError || 'error')
+        : enabled ? green('active') : red('✕');
+      const q = a.quota;
+      const ses = q?.providerSes != null ? ` Ses ${Math.round(q.providerSes * 100)}%` : '';
+      buf.push(`  ${enabled ? '' : dim('')} ${bold(a.name)} ${a.provider}${tag}${secret} ${status}${ses}`);
+    }
+  }
+
   _keyRouting(k) {
     if (k === 'a') {
       this._confirm(
@@ -641,6 +778,51 @@ export class TUI {
   }
 
   _keySelect(k) {
+    // Provider selection (from the providers screen) uses its own option list.
+    if (this._selOptions && (this.selAction === 'delete' || this.selAction === 'toggle')
+      && this.mode === 'select' && this.am.accounts[this._selOptions[0]]?.type === 'provider') {
+      const opts = this._selOptions;
+      const position = Math.max(0, opts.indexOf(this.selIdx));
+      if (k === 'up' || k === 'k') this.selIdx = opts[Math.max(0, position - 1)] ?? this.selIdx;
+      else if (k === 'down' || k === 'j') this.selIdx = opts[Math.min(opts.length - 1, position + 1)] ?? this.selIdx;
+      else if (k === 'enter') {
+        const account = this.am.accounts[this.selIdx];
+        if (!account) { this.mode = 'providers'; return; }
+        if (this.selAction === 'toggle') {
+          const enable = !account.enabled;
+          this._confirm(
+            `${enable ? 'Enable' : 'Disable'} "${account.name}"?`,
+            enable ? 'Allow this provider to receive requests again.' : 'Stop routing to it. Active requests continue.',
+            () => { this._doToggle(this.selIdx, enable); this.mode = 'providers'; },
+          );
+        } else if (this.selAction === 'delete') {
+          this._confirm(
+            `Delete provider "${account.name}"?`,
+            account.configSourced
+              ? 'Removes it from config and GCP reference. The GCP secret itself stays — delete it separately if needed.'
+              : 'Removes the runtime provider. It returns on the next request that sends its token.',
+            async () => {
+              if (account.configSourced) {
+                try {
+                  const { atomicConfigUpdate } = await import('../config.js');
+                  await atomicConfigUpdate(cfg => {
+                    if (Array.isArray(cfg.providers)) {
+                      cfg.providers = cfg.providers.filter(p => p.name !== account.name);
+                    }
+                  });
+                } catch (err) { this._addLog(`Config update failed: ${err.message}`); }
+              }
+              this.am.removeAccount(this.selIdx);
+              this._addLog(`Deleted provider "${account.name}"`);
+              this.mode = 'providers';
+            },
+          );
+        }
+      }
+      else if (k === 'esc' || k === 'q') { this.mode = 'providers'; }
+      return;
+    }
+
     const selectable = this._selectableIndexes(this.selAction);
     const position = Math.max(0, selectable.indexOf(this.selIdx));
     if (k === 'up' || k === 'k') this.selIdx = selectable[Math.max(0, position - 1)] ?? this.selIdx;
@@ -1283,6 +1465,13 @@ export class TUI {
     // Pad to fill
     while (lines.length < H - footerH) lines.push('');
 
+    // Providers panel — shown when the user is on the providers screen
+    if (this.mode === 'providers' || this.mode === 'select') {
+      const pLines = [];
+      this._renderProviders(pLines, W);
+      lines.push(...pLines);
+    }
+
     // ── Footer
     lines.push(' ' + dim('─'.repeat(W - 2)));
     if (this.mode === 'confirm') lines.push(` ${this.confirmDetail}`);
@@ -1405,7 +1594,12 @@ export class TUI {
 
     let line = ` ${sel}${cur} ${name} ${type} ${status} ${l1} ${bar(r1, bw, t1)}`;
     if (showBoth) {
-      line += `  ${l2} ${bar(r2, bw, t2)}`;
+      // "no weekly cap on this plan" is a DIFFERENT state from "not read yet", and
+      // both render as an empty bar. Say which, so a healthy uncapped account
+      // (privacy@gomokka.com, measured 2026-08-06) doesn't read as broken.
+      line += (r2 == null && q.weeklyAbsent)
+        ? `  ${l2} ${emptyBar('none', bw)}`
+        : `  ${l2} ${bar(r2, bw, t2)}`;
     }
     const weekly = weeklyPolicyText(this.am, a);
     if (weekly) line += `  ${weekly}`;
@@ -1481,7 +1675,10 @@ export class TUI {
     let sesCell, wkCell, note = '';
     if (q.providerSes != null || q.providerWk != null) {
       sesCell = q.providerSes != null ? bar(q.providerSes, bw, q.providerSesReset) : emptyBar('—', bw);
-      wkCell = q.providerWk != null ? bar(q.providerWk, bw, q.providerWkReset) : emptyBar('—', bw);
+      // z.ai's `max` plan genuinely has NO weekly token window (measured 2026-08-06:
+      // one TOKENS_LIMIT, unit 3 = 5h). "none" says that; "—" read as a broken probe.
+      wkCell = q.providerWk != null ? bar(q.providerWk, bw, q.providerWkReset)
+        : emptyBar(q.weeklyAbsent ? 'none' : '—', bw);
       note = this._probeHealthNote(a);
     } else if (q.providerQuotaSource === 'console-only') {
       sesCell = emptyBar('n/a', bw);
@@ -1527,13 +1724,15 @@ export class TUI {
   _renderFooter() {
     switch (this.mode) {
       case 'normal':
-        return ` ${bold('a')} Accounts  ${bold('m')} Routing  ${bold('s')} Sync  ${bold('u')} Updates  ${bold('r')} Restart  ${bold('q')} Stop`;
+        return ` ${bold('a')} Accounts  ${bold('p')} Providers  ${bold('m')} Routing  ${bold('s')} Sync  ${bold('u')} Updates  ${bold('r')} Restart  ${bold('q')} Stop`;
       case 'updates': {
         const state = this._autoUpdateOn() ? green('on') : dim('off');
         return ` ${bold('c')} Check & apply now  ${bold('t')} Automatic updates: ${state} ↻  ${bold('Esc')} Back`;
       }
       case 'accounts':
         return ` ${bold('l')} Login/re-auth (browser)  ${bold('k')} API key  ${bold('n')} Rename  ${bold('t')} Enable/disable  ${bold('d')} Delete  ${bold('Esc')} Back`;
+      case 'providers':
+        return ` ${bold('a')} Add provider  ${bold('d')} Delete  ${bold('t')} Enable/disable  ${bold('Esc')} Back`;
       case 'routing': {
         // Show the CURRENT cross-provider policy inline so pressing f visibly changes it
         // right here at the footer (the policy also renders in the header, far from the