maxpool 1.5.75 → 1.5.76

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.75",
+  "version": "1.5.76",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -2370,6 +2370,18 @@ export class AccountManager {
     // worth having; the diagnosis that motivated it was wrong.)
     q.consecutiveProbeFailures = (q.consecutiveProbeFailures || 0) + 1;
     const n = q.consecutiveProbeFailures;
+    // A SUSTAINED 401 is dead credentials, not a blip. Latch refreshDead so (a) the
+    // prober stops re-POSTing a rejected token every 60s forever — measured 2026-08-10:
+    // 8 disabled accounts each past 20 consecutive 401s, hammering Anthropic's OAuth
+    // endpoint for nothing — and (b) the TUI can SHOW that the account needs re-login
+    // instead of leaving the user to guess. Cleared on a successful re-auth
+    // (updateAccountTokens) exactly like a refresh-path invalid_grant.
+    // Three strikes, not one: a single 401 can be a transient edge/token-rotation race.
+    if (status === 401 && n >= 3 && !account.refreshDead) {
+      account.refreshDead = true;
+      console.error(`[Maxpool] "${account.name}" credentials rejected ${n}x (HTTP 401) — marking it needs re-login. `
+        + 'Re-authenticate via the TUI (a → l). Probing stops until then.');
+    }
     // Once, at a threshold that cannot be a blip, then every 100th so it stays visible
     // without walling the log.
     if (n === PROBE_FAILURE_ALERT_AT || (n > PROBE_FAILURE_ALERT_AT && n % 100 === 0)) {

package/src/tui.js

@@ -1557,7 +1557,12 @@ export class TUI {
     // A dead refresh token surfaces as "reauth" (re-login needed) rather than a
     // generic "error", so the user knows the fix. Display-only — account.status
     // stays 'error' so routing/eligibility still exclude it.
-    if (a.enabled !== false && a.refreshDead) effectiveStatus = 'reauth';
+    // A DISABLED account still shows its auth state. Suppressing it meant disabling an
+    // account hid the fact that it needs re-login: the row read "✕ disabled" whether the
+    // credentials were fine or long dead, so re-enabling it later silently produced a
+    // broken account. Reported 2026-08-10 with all 8 disabled accounts sitting on dead
+    // credentials (HTTP 401) and no way to see it.
+    if (a.refreshDead) effectiveStatus = a.enabled === false ? 'disabled-reauth' : 'reauth';
     switch (effectiveStatus) {
       case 'active':    status = isCur ? green('active') : 'active'; break;
       case 'reauth':    status = yellow('reauth'); break;
@@ -1566,6 +1571,9 @@ export class TUI {
       case 'waiting':   status = yellow('waiting'); break;
       case 'paused':    status = yellow('paused'); break;
       case 'disabled':  status = red('✕ disabled'); break;
+      // Disabled AND needs re-login — both facts matter: it won't serve because you
+      // switched it off, and it CAN'T serve until you log in again.
+      case 'disabled-reauth': status = red('✕ reauth'); break;
       case 'throttled': {
         // A transient auto-recovering cooldown — show the remaining time (from
         // rateLimitedUntil) so it reads as "recovering in Ns", not stuck.