maxpool 1.5.78 → 1.5.80

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.78",
+  "version": "1.5.80",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -111,6 +111,7 @@ const DEFAULT_SCHEDULER = {
   perAccountConcurrencyTarget: 3,  // D: soft per-account in-flight target; past it, capPenalty bites
   capPenaltyWeight: 10,            // steep penalty per unit of in-flight depth past D (throttle safety floor)
   paceCostWeight: 1.5,            // soft de-preference of accounts burning ahead of pace (was the ×6 term)
+  utilizationWeight: 3,           // RAW utilization cost — drives load balancing in the mid-range
   scarcityWeight: 6,              // legacy; superseded by paceCostWeight (kept so old configs don't error)
   // Reserve-account OVERFLOW model. A weekly-RESERVE account (util 0.85-0.95) used to
   // sit idle behind a healthy-only first pass; now it's eligible in the first pass but
@@ -140,22 +141,30 @@ const DEFAULT_SCHEDULER = {
   crossAccountThinkingMigration: true,
   // Cross-PROVIDER fallback policy for 'cc all' (profile=all), i.e. whether a session
   // may be served by a provider FAMILY other than its home (Claude ↔ GLM ↔ Kimi).
-  //   'never'         — (DEFAULT) a Claude session never spills onto a provider. NOTE:
-  //                     this governs the Claude→provider direction ONLY — it is NOT a
-  //                     same-family pin (a provider-origin session still reaches Claude).
-  //   'when-exhausted'— home family preferred; a Claude session falls back to GLM/Kimi
-  //                     only once all Claude accounts are unavailable, and a GLM session
-  //                     may fall to Kimi once GLM is exhausted.
-  //   'always'        — providers peer with Claude for a Claude/unknown session
-  //                     (load-balanced, not last-resort).
-  // DEFAULT is 'never' (2026-07-24): a Claude Code session stays on Anthropic. Routing
-  // Claude→GLM/Kimi proved unreliable (the coding legs 403/429 + ignore the model id),
-  // so cross-routing OUT of Claude is OFF by default; re-enable via the TUI routing
-  // cycle or config. This governs ONLY the Claude→provider direction.
-  // INVARIANT (all policies): a GLM/Kimi-origin session NEVER routes to an Anthropic
-  // account — Anthropic 400s on a non-`srvtoolu_` server_tool_use id; that direction
-  // is unfixable, not policy-tunable.
+  //
+  // SUPERSEDED by `routingMode` below — kept for backward-compat migration only. An
+  // old config carrying `crossProviderFallbackPolicy` but no `routingMode` is upgraded
+  // at boot: 'always' → 'balance', 'when-exhausted'/'never' → 'prefer-claude'. The
+  // per-provider `providers[<key>].claudeFallback` field still controls the same thing
+  // for its one provider under the legacy modes.
   crossProviderFallbackPolicy: 'never',
+  // ROUTING MODE — the single knob that governs how sessions are distributed across
+  // the account pool. Replaces the hidden per-session binding that made 'always' not
+  // actually balance. Reported 2026-08-10: with cross-provider 'always' set, 20
+  // long-lived sessions that happened to start on the same Anthropic account hammered
+  // it at 82% while two GLM accounts at 2%/9% sat idle — because 'always' only governed
+  // the FIRST request; after that the session was pinned to one account.
+  //
+  //   'balance'         — score EVERY request across the full pool. No session binding.
+  //                       Accounts drain evenly. The behaviour 'always' should always
+  //                       have been.
+  //   'prefer-claude'   — score every request, but Anthropic accounts outrank providers
+  //                       unless they are all loaded/exhausted.
+  //   'prefer-zai'      — GLM accounts preferred; Claude/Kimi fill overflow.
+  //   'prefer-kimi'     — Kimi preferred; Claude/GLM fill overflow.
+  //   'sticky'          — the old behaviour, made explicit. Sessions stay on the account
+  //                       they first land on until it goes hot, then rebalance.
+  routingMode: 'sticky',
   // The OTHER cross direction, independent of the policy above: may a provider-origin
   // (GLM/Kimi) session cross to the OTHER provider (GLM↔Kimi)? Default ON — both legs are
   // lenient and accept each other's ids, and it's the reliable direction the user wants
@@ -244,6 +253,20 @@ function parseResetHeader(value) {
 export class AccountManager {
   constructor(accounts, switchThreshold = 0.90, schedulerOptions = {}, dependencies = {}) {
     this.scheduler = { ...DEFAULT_SCHEDULER, ...schedulerOptions };
+    // Migrate the legacy single-value policy to the new mode if the caller (config)
+    // set `crossProviderFallbackPolicy` but not `routingMode`. The per-provider
+    // `providers[<key>].claudeFallback` still works under the prefer-* modes.
+    // IMPORTANT: when schedulerOptions is empty (no explicit crossProviderFallbackPolicy),
+    // the DEFAULT_SCHEDULER value 'never' triggers migration. But the old behaviour
+    // under 'never' WAS sticky pinning — so the default must map to 'sticky', not
+    // 'prefer-claude'. Only an EXPLICIT 'always' in the caller's config changes the mode.
+    if (!schedulerOptions.routingMode) {
+      const leg = schedulerOptions.crossProviderFallbackPolicy;
+      if (leg === 'always') this.scheduler.routingMode = 'balance';
+      else if (leg === 'when-exhausted') this.scheduler.routingMode = 'prefer-claude';
+      // 'never' or unset → sticky (the historical default: sessions pin to one account)
+      else this.scheduler.routingMode = 'sticky';
+    }
     this._refreshAccessToken = dependencies.refreshAccessToken || refreshAccessToken;
     this.accounts = accounts.map((acct, index) => ({
       index,
@@ -1230,7 +1253,29 @@ export class AccountManager {
    *  score loop), so a healthy bound account never ping-pongs. */
   _isBoundAccountHot(account) {
     return this._isSessionQuotaUnavailable(account)
-      || ['reserve', 'critical', 'exhausted'].includes(this._weeklyPaceState(account));
+      || ['reserve', 'critical', 'exhausted'].includes(this._weeklyPaceState(account))
+      // SESSION-window pressure counts too. _isSessionQuotaUnavailable only fires at
+      // switchThreshold (0.90), and the weekly bands don't see the 5h window at all —
+      // so an account at 82% of a 5h window was "not hot" and every bound session
+      // stayed on it while idle accounts sat at 2%. Measured 2026-08-10: Anthropic at
+      // Ses 82% / Wk 66% hammered flat-out beside two GLM accounts at 2% and 9%.
+      // Uses the SOFT band (0.65), not reserve (0.85): the point is to shed load while
+      // there is still headroom, not at the cliff edge. _shouldRebalanceBoundSession
+      // still requires a clearly-cheaper, strictly-healthier target, so a hot account
+      // with no better alternative keeps its sessions — this only opens the question.
+      || this._sessionWindowUsage(account) >= this.scheduler.weeklySoftThreshold;
+  }
+
+  /** Fraction of the SESSION (5h) window consumed, across both quota shapes.
+   *  Anthropic reports unified5h; a provider reports providerSes. Returns 0 when
+   *  unknown — an unreadable window must never make an account look hot. */
+  _sessionWindowUsage(account) {
+    const q = account?.quota;
+    if (!q) return 0;
+    const vals = [];
+    if (q.unified5h != null) vals.push(clamp01(q.unified5h));
+    if (q.providerSes != null) vals.push(clamp01(q.providerSes));
+    return vals.length ? Math.max(...vals) : 0;
   }
 
   /** Decide whether a bound session should leave its (hot) account THIS request.
@@ -1334,6 +1379,18 @@ export class AccountManager {
     // candidate loop lands on the least-loaded healthy account, spreading the move.
     if ((WEEKLY_TIER[this._weeklyRawState(bound)] ?? 0) >= WEEKLY_TIER.reserve) return true;
 
+    // Same absolute escape for the SESSION window. The tier test below compares WEEKLY
+    // tiers, so a bound account burning down its 5h window can never satisfy it while
+    // its weekly is merely soft — which is exactly how an account at Ses 82% kept every
+    // session while idle accounts sat at 2%. Requires a MATERIALLY cheaper target so
+    // this can't churn between two similarly-loaded accounts.
+    // No score margin here, for the reason the weekly escape documents directly above:
+    // boundScore*0.5 on an IDLE near-cap account sits below every candidate's minimum
+    // score, so the margin is unsatisfiable and pins the session to the account it is
+    // meant to relieve. The candidate loop has already kept only RAW-healthy targets,
+    // and preserving the last of a 5h window beats concurrency spread.
+    if (this._sessionWindowUsage(bound) >= this.scheduler.weeklyReserveThreshold) return true;
+
     // Otherwise the trigger was PACE-only on a RAW-healthy account — a fast-burner
     // that still has real absolute headroom (RAW soft but pace reserve/critical,
     // e.g. 79% used resetting in ~3.5d). Keep the conservative gate so it isn't
@@ -1531,7 +1588,15 @@ export class AccountManager {
         return preferred;
       }
     }
-    const bound = this._boundAccount(requestInfo.sessionKey, profile, excludedIndexes, requestInfo);
+    // Session binding only applies in 'sticky' mode. Every other mode scores each
+    // request independently — the whole point of 'balance' is that 20 sessions that
+    // happened to start on the same account do NOT keep hammering it while others
+    // idle. Warmup-pull still works under the non-sticky modes because it keys on
+    // `_isWarming`, not on a binding.
+    const isStickyMode = this.scheduler.routingMode === 'sticky';
+    const bound = isStickyMode
+      ? this._boundAccount(requestInfo.sessionKey, profile, excludedIndexes, requestInfo)
+      : null;
     if (bound) {
       // Warmup-pull: onboard a freshly-ADDED account (added mid-session, no reload)
       // by DIRECTLY re-homing this migration-safe session onto the warming account,
@@ -1787,18 +1852,52 @@ export class AccountManager {
   // (10/20) → fallback-only. A foreign session is provider-only regardless.
   _effectivePriority(account, requestInfo = {}) {
     const base = Number.isFinite(account.priority) ? account.priority : 0;
+    const mode = this.scheduler.routingMode;
+    const incompatible = this._effectiveIncompatible(requestInfo).incompatible;
+    // An incompatible session is pinned to its provider family — no mode overrides that.
+    if (incompatible) {
+      const isHome = account.type === 'provider'
+        && (mode === 'prefer-zai' ? account.provider === 'zai'
+          : mode === 'prefer-kimi' ? account.provider === 'kimi' : true);
+      return isHome ? 0 : base;
+    }
+    // Balance: every account peers at priority 0. Accounts are ranked by score alone.
+    if (mode === 'balance') return 0;
+    // Prefer-* modes: the preferred family sits at 0, everything else at its base
+    // priority (10 for GLM, 20 for Kimi). So the preferred family is chosen first and
+    // the others only when every preferred account is unavailable (the score loop's
+    // pass-1 admits reserve accounts, so a loaded preferred account DOES give way).
+    if (mode === 'prefer-claude') {
+      return account.type === 'provider' ? base : 0;
+    }
+    if (mode === 'prefer-zai') {
+      return account.provider === 'zai' ? 0 : base;
+    }
+    if (mode === 'prefer-kimi') {
+      return account.provider === 'kimi' ? 0 : base;
+    }
+    // Sticky: legacy behaviour — the 'always' policy promoted providers to 0.
     if (account.type === 'provider'
-        && this._claudeFallbackFor(account.provider) === 'always'
-        && !this._effectiveIncompatible(requestInfo).incompatible) {
+        && this._claudeFallbackFor(account.provider) === 'always') {
       return 0;
     }
     return base;
   }
 
+  setProviderRoutingMode(mode) {
+    if (!['balance', 'prefer-claude', 'prefer-zai', 'prefer-kimi', 'sticky'].includes(mode)) return false;
+    this.scheduler.routingMode = mode;
+    console.log(`[Maxpool] Routing mode set to "${mode}"`);
+    return true;
+  }
+
+  // Legacy shim — the TUI routing screen still cycles this. Maps to the new mode.
   setCrossProviderFallbackPolicy(policy) {
     if (!['never', 'when-exhausted', 'always'].includes(policy)) return false;
     this.scheduler.crossProviderFallbackPolicy = policy;
-    console.log(`[Maxpool] Cross-provider fallback policy set to "${policy}"`);
+    // Map to the new mode so the binding/priority logic agrees.
+    this.scheduler.routingMode = policy === 'always' ? 'balance' : policy === 'when-exhausted' ? 'prefer-claude' : 'sticky';
+    console.log(`[Maxpool] Cross-provider fallback policy set to "${policy}" (routing mode: ${this.scheduler.routingMode})`);
     return true;
   }
 
@@ -1872,15 +1971,20 @@ export class AccountManager {
 
     // Compatible session — includes Kimi and GLM-without-server-tools, whose regular
     // tool_use ids pass Anthropic's loose validation, AND ordinary Claude sessions.
-    // Claude is eligible + preferred (priority 0). Provider fallback is the SAFE
-    // direction (lenient providers accept Anthropic ids/signatures) and is
-    // policy-gated ONLY: 'never' keeps a Claude session on Claude; 'when-exhausted'
-    // lets providers serve as a priority-fallback; 'always' peers them
-    // (_effectivePriority). Signed thinking no longer bars providers here — but its
-    // live MIGRATION stays Claude-only (see the rebalance guard).
-    // PER-PROVIDER Claude→provider gate (GLM and Kimi steer independently). Unset ⇒
-    // inherits the legacy global policy, so behavior is unchanged on upgrade.
-    if (account.type === 'provider' && this._claudeFallbackFor(account.provider) === 'never') return false;
+    // Under the new routing modes, providers are eligible whenever the mode allows
+    // them to peer (balance + prefer-{zai,kimi}) or serve as fallback
+    // (prefer-claude + sticky). The legacy per-provider `claudeFallback: 'never'`
+    // gate only applies under 'sticky' — the old behaviour it was written for.
+    if (account.type === 'provider') {
+      const mode = this.scheduler.routingMode;
+      // Balance and prefer-{zai,kimi}: providers are always eligible (scored, not gated).
+      if (mode === 'balance' || mode === 'prefer-zai' || mode === 'prefer-kimi') return true;
+      // Prefer-claude: providers serve as overflow. Still eligible — priority handles the
+      // preference; an available Claude account always wins on priority.
+      if (mode === 'prefer-claude') return true;
+      // Sticky: the legacy per-provider gate applies — this is the mode it was written for.
+      if (this._claudeFallbackFor(account.provider) === 'never') return false;
+    }
     return true;
   }
 
@@ -2057,6 +2161,14 @@ export class AccountManager {
     // soft de-preference of accounts burning ahead of an even pace. Never a bench.
     const paceCost = this._accountScarcity(account, now) * this.scheduler.paceCostWeight;
 
+    // RAW utilization cost — direct, not pace-adjusted. The pace cost above discounts
+    // by how far into the window you are, so an account at 80% with 2h left is only
+    // "slightly ahead of pace" → tiny cost. That's right for avoiding premature
+    // benching, but wrong for load balancing: an account at 80% should be clearly less
+    // attractive than one at 10% even if both are "on pace". Measured 2026-08-10: cc at
+    // 80% scored 52.30 vs glm at 10% at 52.15 — a 0.15 gap drowned by round-robin.
+    const utilizationCost = this._rawUtilization(account) * this.scheduler.utilizationWeight;
+
     // Per-model weekly de-preference: an account whose scoped weekly for THIS
     // request's model (e.g. Fable) is high-but-not-exhausted is a poor pick for
     // that model — shed its load toward healthier accounts BEFORE the hard bench
@@ -2083,7 +2195,7 @@ export class AccountManager {
     // default) learns the real number within a cycle. `probing`/requalify still
     // flags a never-seen account for learning — that path is unchanged.
 
-    return concurrency + capPenalty + paceCost + scopedPace + spread + ramp + reserveCost + failurePenalty;
+    return concurrency + capPenalty + paceCost + utilizationCost + scopedPace + spread + ramp + reserveCost + failurePenalty;
   }
 
   /**
@@ -2137,6 +2249,29 @@ export class AccountManager {
     return scarcity;
   }
 
+  /** RAW utilization (0..1) — not pace-adjusted. Reads the same fields as
+   *  _accountScarcity but WITHOUT the elapsed-fraction discount. This is the signal
+   *  the load balancer needs: an account at 80% is more expensive than one at 10%,
+   *  full stop. */
+  _rawUtilization(account) {
+    const q = account?.quota;
+    if (!q) return 0;
+    // SESSION windows use raw utilization — headroom is consumed immediately and an
+    // 80%-used 5h window is genuinely more expensive than a 10%-used one right now.
+    let util = 0;
+    if (q.unified5h != null) util = Math.max(util, clamp01(q.unified5h));
+    if (q.providerSes != null) util = Math.max(util, clamp01(q.providerSes));
+    // WEEKLY windows use PACE-ADJUSTED utilization (via _windowScarcity), not raw —
+    // a 79% account resetting in 2h has plenty of headroom and should be cheap to
+    // spend (the use-it-or-lose-it principle). Using raw weekly would break that.
+    // The pace cost already carries this signal; here we add only the session signal
+    // the pace cost was too weak to express.
+    if (q.tokensLimit != null && q.tokensLimit > 0 && q.tokensRemaining != null) {
+      util = Math.max(util, 1 - q.tokensRemaining / q.tokensLimit);
+    }
+    return util;
+  }
+
   _windowScarcity(util, resetMs, windowLen, now = Date.now()) {
     const used = clamp01(util);
     if (!resetMs || resetMs <= now) return used; // unknown / just-reset → face value

package/src/tui.js

@@ -408,7 +408,6 @@ export class TUI {
       case 'accounts': this._keyAccounts(k); break;
       case 'routing': this._keyRouting(k); break;
       case 'updates': this._keyUpdates(k); break;
-      case 'providers': this._keyProviders(k); break;
       case 'addtype': this._keyAddType(k); break;
       case 'select': this._keySelect(k); break;
       case 'input':  this._keyInput(k); break;
@@ -447,8 +446,6 @@ export class TUI {
       );
     } else if (k === 'u') {
       this.mode = 'updates';
-    } else if (k === 'p') {
-      this.mode = 'providers';
     } else if (k === 'h') {
       this.hideDisabled = !this.hideDisabled;
       this._addLog(this.hideDisabled ? 'Hiding disabled accounts' : 'Showing all accounts');
@@ -592,10 +589,10 @@ export class TUI {
   // Four account types, two credential sources. Every path lands here so there is
   // exactly ONE thing to learn: press `a`, pick a type, supply a credential.
   static ADD_TYPES = [
-    { key: '1', id: 'anthropic-oauth', label: 'Anthropic subscription (browser login)' },
-    { key: '2', id: 'anthropic-key',   label: 'Anthropic API key' },
-    { key: '3', id: 'zai',             label: 'GLM / z.ai API key' },
-    { key: '4', id: 'kimi',            label: 'Kimi / Moonshot API key' },
+    { key: '1', id: 'anthropic-oauth', label: 'Anthropic subscription', hint: 'log in with a browser (Max / Pro plan)' },
+    { key: '2', id: 'anthropic-key',   label: 'Anthropic API key',      hint: 'pay-per-token key from console.anthropic.com' },
+    { key: '3', id: 'zai',             label: 'GLM (z.ai) API key',     hint: '' },
+    { key: '4', id: 'kimi',            label: 'Kimi (Moonshot) API key', hint: '' },
   ];
 
   _keyAddType(k) {
@@ -660,15 +657,23 @@ export class TUI {
   }
 
   _renderAddType(buf) {
-    buf.push(`${bold('Add an account')}  ${dim('— pick a type')}`);
+    buf.push(`${bold('Add an account')}   ${dim('pick what you have')}`);
     buf.push('');
     for (const t of TUI.ADD_TYPES) {
-      buf.push(`   ${bold(t.key)}  ${t.label}`);
+      buf.push(`   ${bold(t.key)}  ${t.label.padEnd(26)}${dim(t.hint || '')}`);
     }
     buf.push('');
-    buf.push(dim('   API keys: paste the key, OR type a GCP Secret Manager name'));
-    buf.push(dim('   (e.g. RESTRICTED_MAX_MAXPOOL_ZAI_PLUS1) to keep it out of your config.'));
-    buf.push(dim('   GCP needs: gcloud auth application-default login'));
+    buf.push(dim('   Fixing an account that says "reauth"? Pick 1 and log in as that account.'));
+    buf.push(dim('   It repairs the existing row, it does not add a second one.'));
+    buf.push('');
+    // Kept verbatim from the deleted Providers panel — the only place that explained
+    // BOTH credential sources and the gcloud command a non-owner needs.
+    buf.push(dim('   For 2-4, two ways to supply the key:'));
+    buf.push(dim('     A) Paste it — stored in your config (0600). No cloud setup.'));
+    buf.push(dim('     B) Type a GCP Secret Manager name — the key never touches disk.'));
+    buf.push(dim('        Store it:  ') + 'gcloud secrets create MY_KEY --data-file=-');
+    buf.push(dim('        Maxpool reads it as YOU:  ') + 'gcloud auth application-default login');
+    buf.push(dim('        Delete the secret and the account stops working everywhere.'));
   }
 
   // Derive a human-readable account name from a GCP secret name.
@@ -683,17 +688,6 @@ export class TUI {
     return user ? `${provLabel} ${user}` : `${provLabel} primary`;
   }
 
-  _keyProviders(k) {
-    if (k === 'a') {
-      this._providerAddStep('type');
-    } else if (k === 'd') {
-      this._startProviderSelection('delete');
-    } else if (k === 't') {
-      this._startProviderSelection('toggle');
-    } else if (k === 'esc' || k === 'q') {
-      this.mode = 'normal';
-    }
-  }
 
   // Multi-step input for adding a provider. Steps: type → secret/key → name.
   // Name LAST so it can be pre-filled from the secret (RESTRICTED_AL_MAXPOOL_ZAI →
@@ -707,17 +701,17 @@ export class TUI {
       this.inputSensitive = false;
       this.inputCb = value => {
         const provider = String(value || '').trim().toLowerCase();
-        if (provider !== 'zai' && provider !== 'kimi') { this._addLog('Type must be zai or kimi'); this.mode = 'providers'; return; }
+        if (provider !== 'zai' && provider !== 'kimi') { this._addLog('Type must be zai or kimi'); this.mode = 'accounts'; return; }
         this._providerAddStep('secret', { ...prev, provider });
       };
     } else if (step === 'secret') {
       this.mode = 'input';
-      this.inputPrompt = `${prev.name}: GCP secret name OR paste API key directly`;
+      this.inputPrompt = `${prev.provider === 'kimi' ? 'Kimi' : 'GLM'} key — paste it, or type a GCP secret name`;
       this.inputBuf = '';
       this.inputSensitive = false;
       this.inputCb = async value => {
         const input = String(value || '').trim();
-        if (!input) { this.mode = 'providers'; return; }
+        if (!input) { this.mode = 'accounts'; return; }
         // Heuristic: a GCP secret name is uppercase/dashes/underscores and short.
         // An API key is long and contains dots/mixed-case/alphanumeric.
         const looksLikeSecretName = /^[A-Z][A-Z0-9_-]{2,60}$/.test(input) && !input.includes('.');
@@ -735,7 +729,7 @@ export class TUI {
       this.inputCb = async value => {
         const name = String(value || '').trim() || TUI.deriveProviderName(prev.provider, prev.secretName || '');
         if (this.am.accounts.some(a => a.name === name)) {
-          this._addLog(`Account "${name}" already exists`); this.mode = 'providers'; return;
+          this._addLog(`Account "${name}" already exists`); this.mode = 'accounts'; return;
         }
         await this._doAddProvider({ ...prev, name });
       };
@@ -743,7 +737,7 @@ export class TUI {
   }
 
   async _doAddProvider({ name, provider, secretName, apiKey }) {
-    this.mode = 'providers';
+    this.mode = 'accounts';
     if (secretName) this._addLog(`Resolving secret "${secretName}" from GCP…`);
     else this._addLog(`Adding "${name}" with direct API key…`);
     this.render();
@@ -778,50 +772,7 @@ export class TUI {
     }
   }
 
-  _startProviderSelection(action) {
-    const providers = this.am.accounts.filter(a => a.type === 'provider');
-    if (!providers.length) { this._addLog('No providers to manage'); return; }
-    this._selOptions = providers.map(a => a.index);
-    this._selLabels = providers.map(a => {
-      const enabled = a.enabled !== false;
-      const tag = a.configSourced ? ' (GCP)' : ' (header)';
-      const secret = a.secretName ? ` [${a.secretName}]` : '';
-      return `${a.name}${tag}${secret}${enabled ? '' : ' ✕'}`;
-    });
-    this.selAction = action;
-    this.mode = 'select';
-  }
 
-  _renderProviders(buf, _width) {
-    const providers = this.am.accounts.filter(a => a.type === 'provider');
-    buf.push(`${bold('Providers (GLM / Kimi)')}  ${dim('— managed via GCP Secret Manager')}`);
-    buf.push('');
-    if (!providers.length) {
-      buf.push(dim('  No providers configured.'));
-      buf.push('');
-      buf.push(dim('  Press ') + bold('a') + dim(' to add one. Two ways to supply the key:'));
-      buf.push('');
-      buf.push(dim('   A) Paste the API key directly — stored in your config (0600).'));
-      buf.push(dim('      Simplest; works with no cloud setup.'));
-      buf.push('');
-      buf.push(dim('   B) Point at a GCP Secret Manager name — the key never touches disk.'));
-      buf.push(dim('      Store it:  ') + 'gcloud secrets create MY_KEY --data-file=-');
-      buf.push(dim('      Maxpool resolves it via YOUR gcloud login:'));
-      buf.push(dim('                 ') + 'gcloud auth application-default login');
-      buf.push(dim('      Delete the secret and the provider stops working everywhere.'));
-      return;
-    }
-    for (const a of providers) {
-      const enabled = a.enabled !== false;
-      const tag = a.configSourced ? dim(' (GCP)') : dim(' (header)');
-      const secret = a.secretName ? dim(` [${a.secretName}]`) : '';
-      const status = a.status === 'error' ? red(a.lastError || 'error')
-        : enabled ? green('active') : red('✕');
-      const q = a.quota;
-      const ses = q?.providerSes != null ? ` Ses ${Math.round(q.providerSes * 100)}%` : '';
-      buf.push(`  ${enabled ? '' : dim('')} ${bold(a.name)} ${a.provider}${tag}${secret} ${status}${ses}`);
-    }
-  }
 
   _keyRouting(k) {
     if (k === 'a') {
@@ -882,51 +833,6 @@ export class TUI {
   }
 
   _keySelect(k) {
-    // Provider selection (from the providers screen) uses its own option list.
-    if (this._selOptions && (this.selAction === 'delete' || this.selAction === 'toggle')
-      && this.mode === 'select' && this.am.accounts[this._selOptions[0]]?.type === 'provider') {
-      const opts = this._selOptions;
-      const position = Math.max(0, opts.indexOf(this.selIdx));
-      if (k === 'up' || k === 'k') this.selIdx = opts[Math.max(0, position - 1)] ?? this.selIdx;
-      else if (k === 'down' || k === 'j') this.selIdx = opts[Math.min(opts.length - 1, position + 1)] ?? this.selIdx;
-      else if (k === 'enter') {
-        const account = this.am.accounts[this.selIdx];
-        if (!account) { this.mode = 'providers'; return; }
-        if (this.selAction === 'toggle') {
-          const enable = !account.enabled;
-          this._confirm(
-            `${enable ? 'Enable' : 'Disable'} "${account.name}"?`,
-            enable ? 'Allow this provider to receive requests again.' : 'Stop routing to it. Active requests continue.',
-            () => { this._doToggle(this.selIdx, enable); this.mode = 'providers'; },
-          );
-        } else if (this.selAction === 'delete') {
-          this._confirm(
-            `Delete provider "${account.name}"?`,
-            account.configSourced
-              ? 'Removes it from config and GCP reference. The GCP secret itself stays — delete it separately if needed.'
-              : 'Removes the runtime provider. It returns on the next request that sends its token.',
-            async () => {
-              if (account.configSourced) {
-                try {
-                  const { atomicConfigUpdate } = await import('../config.js');
-                  await atomicConfigUpdate(cfg => {
-                    if (Array.isArray(cfg.providers)) {
-                      cfg.providers = cfg.providers.filter(p => p.name !== account.name);
-                    }
-                  });
-                } catch (err) { this._addLog(`Config update failed: ${err.message}`); }
-              }
-              this.am.removeAccount(this.selIdx);
-              this._addLog(`Deleted provider "${account.name}"`);
-              this.mode = 'providers';
-            },
-          );
-        }
-      }
-      else if (k === 'esc' || k === 'q') { this.mode = 'providers'; }
-      return;
-    }
-
     const selectable = this._selectableIndexes(this.selAction);
     const position = Math.max(0, selectable.indexOf(this.selIdx));
     if (k === 'up' || k === 'k') this.selIdx = selectable[Math.max(0, position - 1)] ?? this.selIdx;
@@ -961,9 +867,14 @@ export class TUI {
           () => this._doToggle(this.selIdx, enable),
         );
       } else if (this.selAction === 'delete') {
+        // A GCP-backed row: say what deleting does NOT do, so nobody thinks the key
+        // is gone from the cloud.
+        const secret = account.secretName
+          ? ` The GCP secret "${account.secretName}" is left alone — delete it separately if you want the key gone.`
+          : '';
         this._confirm(
           `Delete "${account.name}"?`,
-          'Permanently remove it from Maxpool config. Deletion is blocked while it has active requests.',
+          `Permanently remove it from Maxpool config. Deletion is blocked while it has active requests.${secret}`,
           () => this._doDelete(this.selIdx),
         );
       } else if (this.selAction === 'rename') {
@@ -1013,10 +924,16 @@ export class TUI {
       .map(index => ({ account: this.am.accounts[index], index }))
       .filter(({ account }) => {
         if (action === 'prefer') return account.type !== 'provider' && account.enabled;
-        // Enable/disable also works on runtime providers (GLM/Kimi) — a session-only
-        // toggle, since they're not in config. Rename/delete stay config-account-only.
-        if (action === 'toggle') return this._configAccountIndex(account) >= 0 || account.type === 'provider';
-        return this._configAccountIndex(account) >= 0;
+        // Enable/disable works on EVERY row — including a session-created provider,
+        // where it is the DURABLE action (exportRuntimeProviders persists `enabled`,
+        // and the header path never re-enables a row the user benched).
+        if (action === 'toggle') return true;
+        // Rename/delete need a config entry to act on. That now includes config
+        // PROVIDERS (via _isConfigBacked), which the old accounts-only lookup excluded.
+        // A SESSION row is still barred: renaming it forks a duplicate (upsertRuntime
+        // Account matches by NAME, so the next header request recreates the original
+        // and the same key lands on two accounts), and deleting it undoes itself.
+        return this._isConfigBacked(account);
       })
       .map(({ index }) => index);
   }
@@ -1133,16 +1050,24 @@ export class TUI {
     if (this.am.accounts.some((a, i) => i !== idx && a.name === newName)) {
       this._addLog(`An account named "${newName}" already exists`); return;
     }
-    const cfgIdx = this._configAccountIndex(account);
-    if (cfgIdx < 0) { this._addLog(`Cannot rename "${account.name}" (not in config)`); return; }
+    const loc = this._configLocation(account);
+    if (!loc) {
+      // Renaming a SESSION row forks it: upsertRuntimeAccount matches by NAME, so the
+      // next `cc all` request recreates the original and the same key ends up on two
+      // accounts — double-counted quota and routing weight.
+      this._addLog(`Cannot rename "${account.name}" — it comes from a running cc session, not your config`);
+      return;
+    }
+    const cfgIdx = loc.index;
+    const cfgArray = loc.array;
     const old = account.name;
-    const prev = this.config.accounts[cfgIdx].name;
-    this.config.accounts[cfgIdx].name = newName;
+    const prev = this.config[cfgArray][cfgIdx].name;
+    this.config[cfgArray][cfgIdx].name = newName;
     if (this.config.routing?.preferredAccount === old) this.config.routing.preferredAccount = newName;
     try {
       await this.saveConfig(this.config);
     } catch (error) {
-      this.config.accounts[cfgIdx].name = prev;
+      this.config[cfgArray][cfgIdx].name = prev;
       throw error;
     }
     account.name = newName; // update the running account manager
@@ -1297,6 +1222,30 @@ export class TUI {
     return this.config.accounts.findIndex(candidate => candidate.name === account.name);
   }
 
+  /** Where does this account live in config — `accounts` or `providers`?
+   *  A config PROVIDER (GLM/Kimi from config.providers) is just as durable as an OAuth
+   *  account, but _configAccountIndex only ever searched config.accounts, so providers
+   *  reported -1 and were excluded from rename/delete. With the Providers screen gone,
+   *  that would strand them in config forever. Returns { array, index } or null. */
+  _configLocation(account) {
+    if (!account) return null;
+    const accIdx = this._configAccountIndex(account);
+    if (accIdx >= 0) return { array: 'accounts', index: accIdx };
+    const provs = this.config.providers;
+    if (Array.isArray(provs)) {
+      const pIdx = provs.findIndex(p => p.name === account.name);
+      if (pIdx >= 0) return { array: 'providers', index: pIdx };
+    }
+    return null;
+  }
+
+  /** True when this row can be permanently removed/renamed — i.e. it is backed by a
+   *  config entry. A SESSION row (created from `cc all` headers, not in config) is not:
+   *  deleting it is a lie because the next request recreates it. */
+  _isConfigBacked(account) {
+    return this._configLocation(account) !== null;
+  }
+
   async _doToggle(idx, enabled) {
     const account = this.am.accounts[idx];
     if (!account) return;
@@ -1342,11 +1291,16 @@ export class TUI {
       this._addLog(`Cannot delete "${name}" while ${account.inFlight} request(s) are active; disable it and retry when idle`);
       return;
     }
-    const configIndex = this._configAccountIndex(account);
-    if (configIndex < 0) {
-      this._addLog(`Cannot permanently delete runtime provider "${name}" from the TUI`);
+    const loc = this._configLocation(account);
+    if (!loc) {
+      // A SESSION row: a running `cc all` is handing maxpool this key, so deleting it
+      // would be undone by the next request. Disabling IS durable here — the header
+      // path never re-enables a benched row — so point the user at the action that works.
+      this._addLog(`"${name}" comes from a running cc session, so deleting it would not stick — press t to switch it off instead (that survives restarts)`);
       return;
     }
+    const configIndex = loc.index;
+    const configArray = loc.array;
     const wasEnabled = account.enabled;
     this.am.setAccountEnabled(idx, false);
     if (account.inFlight > 0) {
@@ -1355,7 +1309,7 @@ export class TUI {
       return;
     }
 
-    const [removedConfig] = this.config.accounts.splice(configIndex, 1);
+    const [removedConfig] = this.config[configArray].splice(configIndex, 1);
     const previousRouting = this.config.routing;
     if (this.config.routing?.preferredAccount === name) {
       this.config.routing = { mode: 'automatic', preferredAccount: null };
@@ -1363,13 +1317,13 @@ export class TUI {
     try {
       await this.saveConfig(this.config);
     } catch (error) {
-      this.config.accounts.splice(configIndex, 0, removedConfig);
+      this.config[configArray].splice(configIndex, 0, removedConfig);
       this.config.routing = previousRouting;
       this.am.setAccountEnabled(idx, wasEnabled);
       throw error;
     }
     if (!this.am.removeAccount(idx)) {
-      this.config.accounts.splice(configIndex, 0, removedConfig);
+      this.config[configArray].splice(configIndex, 0, removedConfig);
       this.config.routing = previousRouting;
       this.am.setAccountEnabled(idx, wasEnabled);
       await this.saveConfig(this.config);
@@ -1565,11 +1519,6 @@ export class TUI {
     // to be pushed after the pad-to-full-height loop, so every line fell past the
     // bottom edge and the screen rendered only its header (reported 2026-08-10:
     // "when I click on providers I just see the title — how is that helpful?").
-    if (this.mode === 'providers') {
-      const pLines = [];
-      this._renderProviders(pLines, W);
-      lines.push('', ...pLines);
-    }
     if (this.mode === 'addtype') {
       const aLines = [];
       this._renderAddType(aLines);
@@ -1849,7 +1798,7 @@ export class TUI {
   _renderFooter() {
     switch (this.mode) {
       case 'normal':
-        return ` ${bold('a')} Accounts  ${bold('p')} Providers  ${bold('m')} Routing  ${bold('h')} Hide disabled  ${bold('s')} Sync  ${bold('u')} Updates  ${bold('r')} Restart  ${bold('q')} Stop`;
+        return ` ${bold('a')} Accounts  ${bold('m')} Routing  ${bold('h')} Hide disabled  ${dim('│')}  ${bold('u')} Updates  ${bold('r')} Restart  ${bold('q')} Stop server`;
       case 'updates': {
         const state = this._autoUpdateOn() ? green('on') : dim('off');
         return ` ${bold('c')} Check & apply now  ${bold('t')} Automatic updates: ${state} ↻  ${bold('Esc')} Back`;
@@ -1858,8 +1807,6 @@ export class TUI {
         return ` ${bold('a')} Add account  ${bold('l')} Re-auth (browser)  ${bold('n')} Rename  ${bold('t')} Enable/disable  ${bold('d')} Delete  ${bold('Esc')} Back`;
       case 'addtype':
         return ` ${bold('1')}-${bold('4')} pick a type  ${bold('Esc')} Back`;
-      case 'providers':
-        return ` ${bold('a')} Add provider  ${bold('d')} Delete  ${bold('t')} Enable/disable  ${bold('Esc')} Back`;
       case 'routing': {
         // Show the CURRENT cross-provider policy inline so pressing f visibly changes it
         // right here at the footer (the policy also renders in the header, far from the