maxpool 1.18.0 → 1.19.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.18.0",
+  "version": "1.19.1",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -170,16 +170,18 @@ const DEFAULT_SCHEDULER = {
   // account sat at ~17% of fleet traffic (measured 2026-08-25) while four Claude
   // accounts ran at weekly 1.0.
   //
-  // The discount is a MULTIPLIER on those two terms only — never a flat bonus. A flat
-  // bonus would drive an idle account's total NEGATIVE (idle floor is concurrency×2 = 2),
-  // below the entire band structure that reserveFloorCost:5 / criticalPressureCost:21
-  // assume is non-negative. A multiplier in [0,1] cannot: it only ever REMOVES cost that
-  // is already there, so the total stays ≥ the concurrency floor and every safety term
-  // (concurrency, capPenalty, reserve, critical, ramp, failures) is untouched.
-  //
-  // It also DECAYS: at session util 0 the discount is full, and it is gone by
-  // fastRefillFadeUtil — so as the fast window fills, the account converges back to
-  // normal pricing and the fleet re-balances smoothly instead of flapping at a cliff.
+  // The discount is a MULTIPLIER on the BALANCING terms — never a flat bonus. A flat
+  // bonus would drive an idle account's total NEGATIVE, below the entire band structure
+  // that reserveFloorCost:5 / criticalPressureCost:21 assume is non-negative. A
+  // multiplier in [0,1] cannot: it only ever REMOVES cost that is already there.
+  // Term set as of 2026-08-29 (v1.19.0): utilization + pace (original, 2026-08-25),
+  // spread (v1.18.0), and the in-flight terms — linear concurrency + capPenalty
+  // (v1.19.0). The in-flight extension exists because live requests run 18-27s at
+  // weight 10-50, making in-flight the marginal price of traffic: measured
+  // 2026-08-28, spread-only left the unlimited account at parity (0.24x share),
+  // defeating the owner's approved outcome. Reserve/critical/ramp/failure costs stay
+  // undiscounted, as do the hard gates (safetyMaxActivePerAccount, usage cap,
+  // cooldowns) — those are the anti-dogpile backstops, not price signals.
   fastRefillDiscount: 0.6,        // 0 = off (full cost), 0.6 = discount up to 60% of the two balancing terms
   fastRefillFadeUtil: 0.65,       // discount reaches 0 at this session utilization (weeklySoftThreshold)
   recoveryRampWeight: 4,          // decaying penalty applied to a just-recovered account
@@ -2542,11 +2544,20 @@ export class AccountManager {
     const now = ctx?.now ?? Date.now();
     const reqWeight = Math.max(1, requestInfo.weight || 1);
     const inflight = account.activeWeight + reqWeight;
+    const refillMult = this._fastRefillMultiplier(account);
 
     // DOMINANT term: in-flight concurrency. Short-term throttling is driven by
     // how many requests pile on one account, so least-loaded-first spread is
     // the primary objective.
-    const concurrency = inflight * this.scheduler.concurrencyWeight;
+    // FAST-REFILL (2026-08-29 extension): in the LIVE regime this term (plus the
+    // capPenalty below) is what actually sets the equilibrium share — requests
+    // run 18-27s at weight 10-50, so in-flight dwarfs every balancing term.
+    // Measured 2026-08-28 post-v1.18.0: a spread-only discount left the
+    // unlimited account at parity (12 of 56 GLM switches, share 0.24x). The
+    // linear term is BALANCING (it shares load), so it carries the discount;
+    // the steep past-D floor, the hard request gate, cooldowns and failure
+    // backoff are the anti-dogpile machinery and are handled below.
+    const concurrency = inflight * this.scheduler.concurrencyWeight * refillMult;
 
     // Steep soft cap past depth D — the throttle safety floor. No single
     // account absorbs a deep concurrent burst no matter how "cheap" it looks. A
@@ -2560,15 +2571,21 @@ export class AccountManager {
     const concTarget = (weeklyState === 'reserve' || (weeklyState === 'critical' && criticalUnlock))
       ? this.scheduler.reserveConcurrencyTarget
       : this.scheduler.perAccountConcurrencyTarget;
+    // FAST-REFILL (2026-08-29): carries the discount for the same reason as the
+    // linear term — at live weights every account sits past D, so the marginal
+    // in-flight price IS capPenalty; discounting one without the other changes
+    // nothing. The floor stays STEEP in absolute terms (≥ capPenaltyWeight*mult
+    // per unit, still >2x the largest balancing term at the max discount) and
+    // the hard per-account request gate (safetyMaxActivePerAccount), cooldowns
+    // and failurePenalty remain undiscounted backstops.
     const capPenalty = this.scheduler.capPenaltyWeight
-      * Math.max(0, inflight - concTarget);
+      * Math.max(0, inflight - concTarget) * refillMult;
 
     // Burn-pace COST only (demoted from the old dominant scarcity×6 term): a
     // soft de-preference of accounts burning ahead of an even pace. Never a bench.
-    // FAST-REFILL DISCOUNT: applied to the pace and utilization terms (and only
-    // those) for an account whose only cap is a fast-refilling session window —
-    // see the DEFAULT_SCHEDULER block for the full rationale.
-    const refillMult = this._fastRefillMultiplier(account);
+    // FAST-REFILL DISCOUNT: applied to the pace and utilization terms for an
+    // account whose only cap is a fast-refilling session window — see the
+    // DEFAULT_SCHEDULER block for the full rationale (refillMult computed above).
     const paceCost = this._accountScarcity(account, now) * this.scheduler.paceCostWeight * refillMult;
 
     // RAW utilization cost — direct, not pace-adjusted. The pace cost above discounts
@@ -2601,9 +2618,8 @@ export class AccountManager {
     // unused every 5h. Discounted, the equilibrium share of a weeklyAbsent account is
     // ~mult/(1-disc*(1-share)) of a sibling's — at the default 0.6 discount roughly
     // 2.3x early in its window, fading to parity at the same ses 0.65 the multiplier
-    // already uses. Same safety invariants as the other discounted terms: a
-    // multiplier of 1 makes it byte-identical to pre-2026-08-25 behaviour, and it is
-    // never applied to concurrency/capPenalty/reserve/critical.
+    // already uses. A multiplier of 1 makes every discounted term byte-identical to
+    // pre-2026-08-25 behaviour; reserve/critical/ramp/failure are never discounted.
     const spread = share * this.scheduler.spreadShareWeight * refillMult;
 
     const ramp = this._recoveryRamp(account, now);

package/src/server.js

@@ -2856,6 +2856,21 @@ function startIdleRequestReaper(res, reqId, idleMs, { now = Date.now, setInterva
   return timer;
 }
 
+
+function concatUint8(chunks) {
+  let n = 0;
+  for (const c of chunks) n += c.length;
+  const out = new Uint8Array(n);
+  let o = 0;
+  for (const c of chunks) { out.set(c, o); o += c.length; }
+  return out;
+}
+function totalLen(chunks) {
+  let n = 0;
+  for (const c of chunks) n += c.length;
+  return n;
+}
+
 async function streamResponse(webStream, res, status, responseHeaders, accountIndex, accountManager, streamLog, requestInfo = {}, idleMs = STREAM_IDLE_MS) {
   const reader = webStream.getReader();
   const decoder = new TextDecoder();
@@ -2880,6 +2895,10 @@ async function streamResponse(webStream, res, status, responseHeaders, accountIn
   const onClose = () => { reader.cancel().catch(() => {}); };
   res.once('close', onClose);
 
+  // MODEL ECHO NORMALIZATION state (rationale at the write site).
+  let modelEchoPending = true;
+  let modelEchoBuffer = null;
+
   try {
     while (true) {
       // Idle guard: a half-open upstream (headers, then silence, never closes) would
@@ -2915,10 +2934,44 @@ async function streamResponse(webStream, res, status, responseHeaders, accountIn
         committed = true;
       }
 
+      // MODEL ECHO NORMALIZATION (2026-08-31): provider upstreams echo their own model
+      // id ("glm-5.3", kimi-*) in message_start, and Claude Code persists that id into
+      // the session transcript — on resume the id fails model-family resolution and the
+      // session prints "Session model ... could not be restored (not a model this
+      // version of Claude Code recognizes)" (278 sessions affected, measured).
+      // Rewrite the model field back to the CLIENT'S requested model (requestInfo.model,
+      // captured before the per-account rewrite) inside the first complete SSE event
+      // carrying a "model" key; afterwards chunks pass through untouched. ReadableStream
+      // chunks are Uint8Array — Buffer.concat/toString would yield comma-joined byte
+      // numbers (caught by the normalization tests), so hold an array of chunks and
+      // concat with decoder-safe helpers.
+      let out = value;
+      if (requestInfo?.model && modelEchoPending) {
+        modelEchoBuffer = modelEchoBuffer ? [...modelEchoBuffer, value] : [value];
+        const s = decoder.decode(concatUint8(modelEchoBuffer));
+        if (s.includes('"model"') && s.includes('\n\n')) {
+          const normalized = s.replace(
+            /("model":")[^"]+(")/,
+            `$1${requestInfo.model.replace(/["\\]/g, '\\$&')}$2`,
+          );
+          out = Buffer.from(normalized, 'utf8');
+          modelEchoBuffer = null;
+          modelEchoPending = false;
+        } else if (totalLen(modelEchoBuffer) > 64 * 1024) {
+          // Pathological upstream: 64KB with no complete model-bearing event. Flush
+          // verbatim — the warning is the worst outcome of a missed rewrite.
+          out = Buffer.from(concatUint8(modelEchoBuffer));
+          modelEchoBuffer = null;
+          modelEchoPending = false;
+        } else {
+          continue; // hold until the model-bearing event is complete
+        }
+      }
+
       // Forward chunk immediately
-      const ok = res.write(value);
+      const ok = res.write(out);
 
-      const text = decoder.decode(value, { stream: true });
+      const text = decoder.decode(out, { stream: true });
 
       // Capture for logging
       if (streamLog) streamLog.push(text);
@@ -2974,6 +3027,25 @@ async function streamResponse(webStream, res, status, responseHeaders, accountIn
     readFailed = true;
     throw err;
   } finally {
+    // MODEL ECHO NORMALIZATION last-resort flush: the read loop can exit via done,
+    // error, or client disconnect while chunks are still HELD for the rewrite.
+    // Whatever the exit path, deliver the held bytes and accrue their usage — a
+    // mid-flight death must not swallow delivered tokens (H4) nor truncate the
+    // body (empty '' responses, C1).
+    if (modelEchoBuffer) {
+      const held = Buffer.from(concatUint8(modelEchoBuffer));
+      modelEchoBuffer = null;
+      try {
+        if (!readFailed && !res.destroyed) res.write(held);
+      } catch { /* client already gone */ }
+      const heldText = held.toString('utf8');
+      if (streamLog) streamLog.push(heldText);
+      sseBuffer += heldText;
+      for (const ev of sseBuffer.split('\n\n')) {
+        if (ev.trim()) parseSSEEvent(ev, accountIndex, accountManager, requestInfo);
+      }
+      sseBuffer = '';
+    }
     res.off('close', onClose);
     // Cancel upstream reader to stop consuming data nobody needs
     reader.cancel().catch(() => {});