maxpool 1.0.0 → 1.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/config.js

@@ -36,6 +36,12 @@ export function createDefaultConfig() {
       apiKey: 'mp-' + randomBytes(24).toString('base64url'),
     },
     upstream: 'https://api.anthropic.com',
+    // Per-account "stop using this account" gate, applied to BOTH the 5h
+    // session window and the 7d weekly window (whichever utilization is
+    // higher). 0.90 = stop routing to an account once it crosses 90% of a
+    // window, leaving a 10% safety margin so it is never hard-limited (429).
+    // Raise toward 0.97 to squeeze more out of accounts before rotating
+    // (less margin, slightly higher 429 risk); lower to rotate more eagerly.
     switchThreshold: 0.90,
     quotaProbeSeconds: 0, // background quota probe; 0 = off (opt-in)
     routing: {
@@ -48,11 +54,28 @@ export function createDefaultConfig() {
       safetyMaxGlobalActive: 150,
       cooldownMs: 30_000,
       maxCooldownMs: 15 * 60_000,
+      // Weekly (7d) quota tiers — how aggressively to de-prioritise an account
+      // as its weekly usage climbs. Each is a fraction (0..1) of the weekly
+      // limit. Below soft = full speed; soft..reserve = mild penalty;
+      // reserve..critical = heavy penalty; above exhausted = effectively
+      // parked until the weekly window resets. Tune to trade burst capacity
+      // against weekly-limit safety.
+      weeklySoftThreshold: 0.65,
+      weeklyReserveThreshold: 0.85,
+      weeklyCriticalThreshold: 0.95,
+      weeklyExhaustedThreshold: 0.985,
     },
     retry: {
       maxAttemptsPerRequest: 0,
       maxRetryBufferBytes: 10 * 1024 * 1024,
     },
+    // On quit (q / Ctrl-C / SIGTERM): stop accepting new requests, give
+    // in-flight requests up to drainTimeoutMs to finish, then force-exit.
+    // A second signal forces an immediate exit. Kept short so quit works
+    // under a continuous request flood instead of hanging.
+    shutdown: {
+      drainTimeoutMs: 15_000,
+    },
     queue: {
       enabled: true,
       maxWaitMs: 24 * 60 * 60 * 1000,

package/src/index.js

@@ -193,7 +193,11 @@ async function serverWorkerCommand() {
   let syncTimer = null;
   let draining = false;
   let restartController = null;
-  const drainTimeoutMs = Math.max(1000, Number(config.shutdown?.drainTimeoutMs) || 10 * 60_000);
+  // Quit drains in-flight requests, then force-exits. Kept short so a single
+  // 'q' / Ctrl-C / SIGTERM actually quits under a continuous request flood
+  // (where there are always active requests) instead of waiting indefinitely.
+  // A second signal forces an immediate exit. Override via config.shutdown.drainTimeoutMs.
+  const drainTimeoutMs = Math.max(1000, Number(config.shutdown?.drainTimeoutMs) || 15_000);
   const hooks = {
     onRequestStart: (id, info) => {
       const accepted = restartController.requestStarted(id);
@@ -242,7 +246,7 @@ async function serverWorkerCommand() {
     if (tui?.running) tui.stop();
 
     console.log(`\n[Maxpool] Draining shutdown (${reason}).`);
-    console.log(`[Maxpool] Stopped accepting new requests; waiting for ${restartController.activeRequests.size} active request(s). Press Ctrl-C again to force.`);
+    console.log(`[Maxpool] Stopped accepting new requests; waiting up to ${Math.ceil(drainTimeoutMs / 1000)}s for ${restartController.activeRequests.size} active request(s), then forcing exit. Press Ctrl-C again to force now.`);
 
     let done = false;
     let reportTimer = null;

package/src/oauth.js

@@ -1,19 +1,65 @@
 import { readFile } from 'node:fs/promises';
-import { homedir } from 'node:os';
+import { homedir, userInfo } from 'node:os';
 import { randomBytes, createHash } from 'node:crypto';
-import { exec } from 'node:child_process';
+import { exec, execFile } from 'node:child_process';
+import { promisify } from 'node:util';
 import { createInterface } from 'node:readline';
 import http from 'node:http';
 
+const execFileAsync = promisify(execFile);
+
+const KEYCHAIN_SERVICE = 'Claude Code-credentials';
+
 /**
- * Import OAuth credentials from a Claude Code credentials file.
+ * Read Claude Code credentials from the macOS Keychain.
+ * Claude Code (recent versions, macOS) stores OAuth creds in the login
+ * Keychain under service "Claude Code-credentials", account = the OS
+ * username — NOT in ~/.claude/.credentials.json. Returns the parsed
+ * credential object (unwrapped from "claudeAiOauth"), or null if absent.
  */
-export async function importCredentials(filePath) {
+async function readMacKeychainCredentials() {
+  if (process.platform !== 'darwin') return null;
+  const account = userInfo().username;
+  try {
+    const { stdout } = await execFileAsync('security', [
+      'find-generic-password', '-s', KEYCHAIN_SERVICE, '-a', account, '-w',
+    ]);
+    const raw = JSON.parse(stdout.trim());
+    return raw.claudeAiOauth || raw;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Import OAuth credentials from a Claude Code credentials file, falling back
+ * to the macOS Keychain when the file is absent (the default on macOS).
+ */
+export async function importCredentials(filePath = '~/.claude/.credentials.json') {
   const resolvedPath = filePath.replace(/^~/, homedir());
-  const raw = JSON.parse(await readFile(resolvedPath, 'utf-8'));
 
-  // Claude Code stores credentials nested under "claudeAiOauth"
-  const data = raw.claudeAiOauth || raw;
+  let data;
+  try {
+    const raw = JSON.parse(await readFile(resolvedPath, 'utf-8'));
+    // Claude Code stores credentials nested under "claudeAiOauth"
+    data = raw.claudeAiOauth || raw;
+  } catch (fileErr) {
+    // No file → try the macOS Keychain (where Claude Code now stores creds).
+    data = await readMacKeychainCredentials();
+    if (!data) {
+      throw new Error(
+        process.platform === 'darwin'
+          ? `No credentials at ${resolvedPath} and none in the macOS Keychain ` +
+            `("${KEYCHAIN_SERVICE}"). Is Claude Code logged in on this machine? ` +
+            `Run 'claude' once to log in, or paste a token with 'maxpool import --json ...'.`
+          : `Could not read credentials from ${resolvedPath}: ${fileErr.message}`,
+      );
+    }
+  }
+
+  if (!data.accessToken) {
+    throw new Error('Imported credentials have no accessToken');
+  }
   return {
     accessToken: data.accessToken,
     refreshToken: data.refreshToken,