maxpool 1.5.68 → 1.5.70

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.68",
+  "version": "1.5.70",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",
@@ -41,6 +41,7 @@
     "node": ">=20.3.0"
   },
   "devDependencies": {
+    "eslint": "^9.39.5",
     "git-cliff": "2.13.1"
   }
 }

package/src/account-manager.js

@@ -1165,6 +1165,10 @@ export class AccountManager {
       if (used >= this.switchThreshold) return true;
     }
 
+    // Provider (z.ai/Kimi) session quota — the 5h token window. Without this a
+    // provider at 95% of its 5h cap reads as fully available.
+    if (q.providerSes != null && q.providerSes >= this.switchThreshold) return true;
+
     return false;
   }
 
@@ -2110,6 +2114,15 @@ export class AccountManager {
     if (q.requestsLimit != null && q.requestsRemaining != null && q.requestsLimit > 0) {
       scarcity = Math.max(scarcity, 1 - q.requestsRemaining / q.requestsLimit);
     }
+    // Provider (z.ai/Kimi) quota — same scoring axis as Anthropic's windows. Without
+    // this, a GLM account at 80% of its 5h session scored the same as one at 5%,
+    // so the scheduler dogpiled the near-cap account until z.ai 429'd it.
+    if (q.providerSes != null) {
+      scarcity = Math.max(scarcity, this._windowScarcity(q.providerSes, q.providerSesReset, FIVE_HOUR_MS, now));
+    }
+    if (q.providerWk != null) {
+      scarcity = Math.max(scarcity, this._windowScarcity(q.providerWk, q.providerWkReset, WEEK_MS, now));
+    }
     return scarcity;
   }
 
@@ -2190,6 +2203,22 @@ export class AccountManager {
     const q = account.quota;
     this._clearExpiredQuotas(account);
     if (this._isAccountWideRejected(account)) return 'exhausted';
+
+    // Provider accounts (GLM/Kimi) carry their quota in providerSes/providerWk, NOT
+    // unified7d — those fields are Anthropic-only. Without this, a provider at 83%
+    // weekly (Kimi measured 2026-08-08) reads as 'unknown' = healthy, so the scheduler
+    // keeps piling onto it instead of spreading load. The same thresholds apply.
+    if (account.type === 'provider') {
+      const sesUsed = q.providerSes != null ? clamp01(q.providerSes) : null;
+      const wkUsed = q.providerWk != null ? clamp01(q.providerWk) : null;
+      const used = Math.max(sesUsed ?? 0, wkUsed ?? 0);
+      if (used >= this.scheduler.weeklyExhaustedThreshold) return 'exhausted';
+      if (used >= this.scheduler.weeklyCriticalThreshold) return 'critical';
+      if (used >= this.scheduler.weeklyReserveThreshold) return 'reserve';
+      if (used >= this.scheduler.weeklySoftThreshold) return 'soft';
+      return 'normal';
+    }
+
     if (q.unified7d == null) return 'unknown';
 
     const used = clamp01(q.unified7d);
@@ -2212,6 +2241,8 @@ export class AccountManager {
   }
 
   _weeklyPaceState(account) {
+    // Provider quota lives in separate fields — see _weeklyRawState.
+    if (account.type === 'provider') return this._weeklyRawState(account);
     if (account.quota.unified7d == null) return 'unknown';
     const effective = this._effectiveWeeklyUsage(account);
     if (effective >= this.scheduler.weeklyExhaustedThreshold) return 'exhausted';
@@ -2970,7 +3001,10 @@ export class AccountManager {
     // Remove existing config-sourced providers that are no longer in the config
     // (handles a config edit that removes an entry).
     const wantedNames = new Set(entries.map(e => e.name).filter(Boolean));
-    for (const a of this.accounts) {
+    // Iterate a COPY: removeAccount splices this.accounts, and splicing the array
+    // being iterated makes the loop skip the element after each removal — so
+    // dropping 2 of 3 config providers left one phantom behind.
+    for (const a of [...this.accounts]) {
       if (a.configSourced && !wantedNames.has(a.name)) {
         const idx = this.accounts.indexOf(a);
         if (idx >= 0 && this.accounts[idx].inFlight === 0) this.removeAccount(idx);

package/src/index.js

@@ -37,6 +37,7 @@ import {
   RELOAD_SWAPPED, RELOAD_ROLLED_BACK,
   MSG_LISTEN, MSG_RELEASE, MSG_TAKEOVER, MSG_PROBE_READY,
   MSG_RELOAD_REQUEST, MSG_READY, MSG_FAILED, MSG_RELEASED, MSG_PRIMARY, MSG_ROLLED_BACK,
+  MSG_TTY_REASSERT,
 } from './reload-protocol.js';
 
 const args = process.argv.slice(2);
@@ -370,7 +371,14 @@ async function supervisorCommand() {
         // sent PRIMARY during the baton; re-assert the master-accept close.
         monitorAsActive(newWorker);
         closeMasterAccept().catch(() => {});
-        reapOldWorker(oldWorker);
+        // Tell the new primary to re-assert raw mode ONCE the old worker has actually
+        // exited — its exit resets the shared terminal out from under the new worker
+        // (see MSG_TTY_REASSERT). Driven off the real exit event, never a timer: with
+        // in-flight streams the old worker can linger, so a timed guess would leave the
+        // terminal working for a while and then die mid-session.
+        reapOldWorker(oldWorker, () => {
+          try { newWorker.send({ type: MSG_TTY_REASSERT }); } catch { /* worker gone */ }
+        });
         return;
       }
 
@@ -460,14 +468,21 @@ async function supervisorCommand() {
 
 // Drain + reap a released worker. The worker exits itself once its bounded
 // in-flight finishes; the supervisor SIGKILLs it if it outlives the drain cap.
-function reapOldWorker(worker) {
+function reapOldWorker(worker, onExited = () => {}) {
   if (!worker) return;
   // +30s grace over the worker's own RELOAD_DRAIN_MS hardCap so its clean exit(0)
   // (fired while its streaming socket keeps the loop alive) always wins the race —
   // SIGKILL only ever reaps a genuinely wedged worker, never cuts a live stream.
   const cap = RELOAD_DRAIN_MS + 30_000;
   let reaped = false;
-  const finish = () => { if (reaped) return; reaped = true; clearTimeout(timer); };
+  // `onExited` fires on BOTH paths (clean exit and SIGKILL): the terminal is clobbered
+  // by the exit itself, however that exit came about.
+  const finish = () => {
+    if (reaped) return;
+    reaped = true;
+    clearTimeout(timer);
+    try { onExited(); } catch { /* never let the callback break reaping */ }
+  };
   const timer = setTimeout(() => {
     if (reaped) return;
     console.error(`[Maxpool] Old worker outlived ${Math.ceil(cap / 1000)}s reload-drain cap; SIGKILL.`);
@@ -613,9 +628,7 @@ async function serverWorkerCommand() {
       const { resolveSecrets } = await import('./secret-resolver.js');
       // Split: GCP-sourced (secretName) vs direct (apiKey). Both produce a token
       // the same way — the resolution path is the only difference.
-      const gcpEntries = config.providers.filter(p => p.secretName);
-      const directEntries = config.providers.filter(p => p.apiKey && !p.secretName);
-      const secretNames = gcpEntries.map(p => p.secretName);
+      const secretNames = config.providers.filter(p => p.secretName).map(p => p.secretName);
       const resolved = await resolveSecrets(secretNames);
       const entries = config.providers.map(p => ({
         ...p,
@@ -1389,6 +1402,29 @@ async function serverWorkerCommand() {
           // sends MSG_PRIMARY (the baton waits on it).
           await listenOnHandle(handle);
           await becomePrimary({ viaTakeover: true });
+        } else if (msg?.type === MSG_TTY_REASSERT) {
+          // The old worker has now EXITED, and its exit reset the shared terminal out
+          // of raw mode (libuv's uv_tty_reset_mode on process exit). Reclaim it.
+          //
+          // The toggle OFF then ON is load-bearing: Node short-circuits setRawMode(true)
+          // when it believes isRaw is already true — and it does believe that, because
+          // the clobber happened in ANOTHER process and left our flag untouched. A bare
+          // setRawMode(true) here is a silent no-op (verified on a real pty 2026-08-07).
+          if (process.stdin.isTTY) {
+            try {
+              process.stdin.setRawMode(false);
+              process.stdin.setRawMode(true);
+              process.stdin.resume();
+            } catch { /* terminal gone — nothing to reclaim */ }
+          }
+          // Re-assert the screen state too: the dying worker's alt-screen exit and
+          // cursor-show can land after ours.
+          if (tui?.running && process.stdout.isTTY) {
+            try {
+              process.stdout.write('\x1b[?1049h\x1b[?25l');
+              tui.render();
+            } catch { /* ignore */ }
+          }
         } else if (msg?.type === MSG_ROLLED_BACK) {
           // Why the swap failed decides whether a cold restart is safe (see the watchdog).
           lastRollbackReason = msg.reason || null;

package/src/oauth.js

@@ -289,13 +289,22 @@ export async function fetchUsage(accessToken) {
 // (account.upstream is the Anthropic-compat endpoint). Zero-spend read.
 const ZAI_QUOTA_URL = 'https://api.z.ai/api/monitor/usage/quota/limit';
 
-/** Classify one z.ai `limits[]` entry into a Ses (5h) or Wk (weekly) TOKEN window.
- *  Only `TOKENS_LIMIT` maps to the quota bars; `TIME_LIMIT` is a tool-call cap
- *  (web-search/reader counts) and is intentionally ignored. `unit` is z.ai's
- *  window enum (3 = 5-hour session, 6 = weekly); we fall back to reset-distance
- *  when the code is unfamiliar so a new plan tier still classifies sanely. */
+// z.ai reports a plan's consumption cap under DIFFERENT type names depending on the
+// plan: `TOKENS_LIMIT` on older coding plans, `CREDIT_LIMIT` on newer ones. Both are
+// the same thing for our purposes — "how much of your allowance is used" — and both
+// carry the same `percentage` + `nextResetTime` + `unit` fields. Accepting only
+// TOKENS_LIMIT left every CREDIT_LIMIT account with no quota reading at all, so the
+// TUI showed "probing" forever even though the poll succeeded (measured 2026-08-07 on
+// a newly-provisioned `max` plan returning CREDIT_LIMIT unit 3 + unit 6).
+const ZAI_CONSUMPTION_TYPES = new Set(['TOKENS_LIMIT', 'CREDIT_LIMIT']);
+
+/** Classify one z.ai `limits[]` entry into a Ses (5h) or Wk (weekly) consumption
+ *  window. `TIME_LIMIT` is a tool-call cap (web-search/reader counts) and is
+ *  intentionally ignored. `unit` is z.ai's window enum (3 = 5-hour session,
+ *  6 = weekly); we fall back to reset-distance when the code is unfamiliar so a new
+ *  plan tier still classifies sanely. */
 export function classifyZaiLimit(l, now = Date.now()) {
-  if (!l || l.type !== 'TOKENS_LIMIT') return null;
+  if (!l || !ZAI_CONSUMPTION_TYPES.has(l.type)) return null;
   const reset = Number(l.nextResetTime);
   const resetAt = Number.isFinite(reset) && reset > 0 ? reset : null;
   const pct = typeof l.percentage === 'number' ? l.percentage : parseFloat(l.percentage);
@@ -303,7 +312,13 @@ export function classifyZaiLimit(l, now = Date.now()) {
   let bucket;
   if (l.unit === 3) bucket = 'ses';
   else if (l.unit === 6) bucket = 'wk';
-  else if (resetAt) bucket = (resetAt - now) <= 12 * 60 * 60 * 1000 ? 'ses' : 'wk';
+  else if (l.type === 'CREDIT_LIMIT') {
+    // The reset-distance fallback is NOT extended to CREDIT_LIMIT. `unit: 5` is what
+    // z.ai uses for the monthly TOOL-call cap; if it ever renames that cap to
+    // CREDIT_LIMIT the fallback would render a web-search allowance as the weekly
+    // model-quota bar. Only the two window enums we have actually observed count.
+    return null;
+  } else if (resetAt) bucket = (resetAt - now) <= 12 * 60 * 60 * 1000 ? 'ses' : 'wk';
   else bucket = 'ses';
   return { bucket, utilization, resetAt };
 }
@@ -406,11 +421,22 @@ export async function fetchProviderUsage(account) {
     }
     const now = Date.now();
     let ses = null, wk = null;
+    // Two entries can land in the SAME bucket (e.g. a plan reporting both a
+    // TOKENS_LIMIT and a CREDIT_LIMIT for its 5h window). Keep the HIGHER utilization:
+    // last-wins was silently optimistic — 95% followed by 4% reported 4%, i.e. an
+    // account at its cap rendered as nearly empty.
+    const keepWorse = (cur, next) => {
+      if (!cur) return next;
+      if (next.utilization == null) return cur;
+      if (cur.utilization == null) return next;
+      return next.utilization > cur.utilization ? next : cur;
+    };
     for (const l of (Array.isArray(data.data.limits) ? data.data.limits : [])) {
       const c = classifyZaiLimit(l, now);
       if (!c) continue;
-      if (c.bucket === 'ses') ses = { utilization: c.utilization, resetAt: c.resetAt };
-      else if (c.bucket === 'wk') wk = { utilization: c.utilization, resetAt: c.resetAt };
+      const entry = { utilization: c.utilization, resetAt: c.resetAt };
+      if (c.bucket === 'ses') ses = keepWorse(ses, entry);
+      else if (c.bucket === 'wk') wk = keepWorse(wk, entry);
     }
     return { ses, wk, level: data.data.level || null, source: 'zai' };
   } catch (err) {

package/src/prober.js

@@ -176,9 +176,18 @@ export class Prober {
       await this.am.ensureTokenFresh(account.index);
       let usage = await this._withTimeout(this.probeFn(account.credential));
       if (usage?.status === 401) {
-        // Token rejected — force a refresh and retry once.
-        await this.am.ensureTokenFresh(account.index, true);
-        usage = await this._withTimeout(this.probeFn(account.credential));
+        // Token rejected — force a refresh and retry once. NOT for a DISABLED account:
+        // `force` deliberately overrides the no-rotate guard in ensureTokenFresh (it
+        // exists for user-initiated re-auth), so forcing here would rotate the very
+        // single-use token that guard protects. Worse, it is GUARANTEED to fire for a
+        // disabled account: blocking the proactive refresh means the token always
+        // expires, which always 401s — moving the rotation from the controlled
+        // pre-expiry path into this error path. Accept the 401 and record it; the
+        // account refreshes normally the moment it is re-enabled.
+        if (account.enabled !== false) {
+          await this.am.ensureTokenFresh(account.index, true);
+          usage = await this._withTimeout(this.probeFn(account.credential));
+        }
       }
       if (usage == null) { // timed out
         this.am.recordProbeError?.(account.index, 'probe timed out', null);

package/src/reload-protocol.js

@@ -126,3 +126,11 @@ export async function runReloadBaton({
   log('reload: cutover complete; new worker is primary');
   return RELOAD_SWAPPED;
 }
+
+// Sent to the NEW primary worker once the OLD worker has actually exited. Node calls
+// libuv's uv_tty_reset_mode() on process exit, which restores the termios the dying
+// process saved when IT first enabled raw mode — clobbering the live worker's terminal
+// back to canonical (cooked) mode. `process.stdin.isRaw` still reads true, so nothing
+// in-process can detect it; the TUI keeps rendering while the kernel line-buffers, so
+// every keystroke (r / q / p) is swallowed. Measured on a real pty 2026-08-07.
+export const MSG_TTY_REASSERT = 'tty-reassert';

package/src/tui.js

@@ -599,7 +599,7 @@ export class TUI {
 
   _keyProviders(k) {
     if (k === 'a') {
-      this._providerAddStep('name');
+      this._providerAddStep('type');
     } else if (k === 'd') {
       this._startProviderSelection('delete');
     } else if (k === 't') {
@@ -609,35 +609,22 @@ export class TUI {
     }
   }
 
-  // Multi-step input for adding a provider. Steps: name → type → secret name.
-  _providerAddStep(step, prev) {
-    if (step === 'name') {
+  // Multi-step input for adding a provider. Steps: type → secret/key → name.
+  // Name LAST so it can be pre-filled from the secret (RESTRICTED_AL_MAXPOOL_ZAI →
+  // "glm al") instead of asking the user to invent one before they've said which
+  // account it is.
+  _providerAddStep(step, prev = {}) {
+    if (step === 'type') {
       this.mode = 'input';
-      this.inputPrompt = 'Provider display name (e.g. glm-ahmed)';
-      this.inputBuf = '';
-      this.inputSensitive = false;
-      this.inputCb = value => {
-        const name = String(value || '').trim();
-        if (!name) { this.mode = 'providers'; return; }
-        if (this.am.accounts.some(a => a.name === name)) {
-          this._addLog(`Account "${name}" already exists`); this.mode = 'providers'; return;
-        }
-        this._providerAddStep('type', { name });
-      };
-    } else if (step === 'type') {
-      this.mode = 'input';
-      this.inputPrompt = `Type for ${prev.name} (zai or kimi)`;
+      this.inputPrompt = 'Provider type (zai or kimi)';
       this.inputBuf = 'zai';
       this.inputSensitive = false;
       this.inputCb = value => {
         const provider = String(value || '').trim().toLowerCase();
         if (provider !== 'zai' && provider !== 'kimi') { this._addLog('Type must be zai or kimi'); this.mode = 'providers'; return; }
-        // Suggest a name derived from the provider type
-        const suggested = provider === 'kimi' ? 'kimi' : 'glm';
-        this._providerAddStep('secret', { ...prev, provider, suggestedName: suggested });
+        this._providerAddStep('secret', { ...prev, provider });
       };
     } else if (step === 'secret') {
-      const suggested = TUI.deriveProviderName(prev.provider, '');
       this.mode = 'input';
       this.inputPrompt = `${prev.name}: GCP secret name OR paste API key directly`;
       this.inputBuf = '';
@@ -648,19 +635,29 @@ export class TUI {
         // Heuristic: a GCP secret name is uppercase/dashes/underscores and short.
         // An API key is long and contains dots/mixed-case/alphanumeric.
         const looksLikeSecretName = /^[A-Z][A-Z0-9_-]{2,60}$/.test(input) && !input.includes('.');
-        if (looksLikeSecretName) {
-          await this._doAddProvider({ ...prev, secretName: input });
-        } else {
-          // Direct key paste — store in config (0600, same protection as OAuth tokens).
-          await this._doAddProvider({ ...prev, apiKey: input });
+        const keyed = looksLikeSecretName ? { secretName: input } : { apiKey: input };
+        // The name step is LAST so it can offer a default derived from the secret —
+        // `RESTRICTED_AL_MAXPOOL_ZAI` → `glm al`. Pre-filled and editable: press Enter
+        // to accept, or type over it.
+        this._providerAddStep('name', { ...prev, ...keyed });
+      };
+    } else if (step === 'name') {
+      this.mode = 'input';
+      this.inputPrompt = 'Name for this provider (Enter to accept)';
+      this.inputBuf = TUI.deriveProviderName(prev.provider, prev.secretName || '');
+      this.inputSensitive = false;
+      this.inputCb = async value => {
+        const name = String(value || '').trim() || TUI.deriveProviderName(prev.provider, prev.secretName || '');
+        if (this.am.accounts.some(a => a.name === name)) {
+          this._addLog(`Account "${name}" already exists`); this.mode = 'providers'; return;
         }
+        await this._doAddProvider({ ...prev, name });
       };
     }
   }
 
   async _doAddProvider({ name, provider, secretName, apiKey }) {
     this.mode = 'providers';
-    const isDirect = !secretName && apiKey;
     if (secretName) this._addLog(`Resolving secret "${secretName}" from GCP…`);
     else this._addLog(`Adding "${name}" with direct API key…`);
     this.render();
@@ -709,7 +706,7 @@ export class TUI {
     this.mode = 'select';
   }
 
-  _renderProviders(buf, width) {
+  _renderProviders(buf, _width) {
     const providers = this.am.accounts.filter(a => a.type === 'provider');
     buf.push(`${bold('Providers (GLM / Kimi)')}  ${dim('— managed via GCP Secret Manager')}`);
     buf.push('');