maxpool 1.19.3 → 1.19.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.19.3",
+  "version": "1.19.5",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/server.js

@@ -1,4 +1,5 @@
 import http from 'node:http';
+import { ThreadOwners, readThreadIntent, threadRefusalBody } from './thread-gate.js';
 import { writeFile, mkdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { modelFamily } from './oauth.js';
@@ -586,6 +587,26 @@ async function forwardRequest(
   const method = req.method;
   const upstreamBody = rewriteBodyForAccount(body, account);
 
+  // A threaded follow-up routed to an account that does not hold the thread cannot be
+  // served by it: a different Anthropic account 404s, a provider rejects the truncated
+  // transcript. Hand the client the signal it already knows how to act on — it resends
+  // the turn stateless and stops threading for the session — instead of letting the
+  // upstream produce an error the user sees.
+  // `kind:'none'` when the gate is off makes every branch below a no-op, so the
+  // disabled path costs one comparison and needs no further guarding.
+  const threadIntent = THREAD_GATE_ENABLED ? readThreadIntent(body) : { kind: 'none' };
+  if (threadOwners.shouldRefuse(requestInfo.sessionKey, account.name, threadIntent)) {
+    threadOwners.noteRefused(requestInfo.sessionKey, account.name);
+    accountManager.releaseAccount(lease, { neutral: true });
+    console.log(`[Maxpool] thread not held by "${account.name}" — asking the client to resend this turn stateless [sess ${String(requestInfo.sessionKey || '?').slice(0, 8)}]`);
+    ctx.status = 400;
+    sendErrorResponse(res, requestInfo, 400, threadRefusalBody(account.name));
+    return;
+  }
+  // This account is about to serve the turn, so it holds the thread from here on.
+  // Recorded optimistically: if the turn fails, the next one is refused anyway.
+  threadOwners.noteServed(requestInfo.sessionKey, account.name, threadIntent);
+
   // Build log sections
   const logSections = [];
   if (logDir) {
@@ -2901,6 +2922,12 @@ function describeBodyShape(buf) {
   }
 }
 
+// THREAD GATE (2026-09-11). Runs AFTER routing has chosen, so it never influences the
+// choice — it only decides what to say to the account that was picked. See
+// src/thread-gate.js for why this replaces rebuilding the transcript.
+const threadOwners = new ThreadOwners();
+const THREAD_GATE_ENABLED = process.env.MAXPOOL_THREAD_GATE !== '0';
+
 function rewriteBodyForAccount(body, account) {
   if (!body.length || (!account.model && !account.modelMap)) return body;
 

package/src/thread-gate.js

@@ -0,0 +1,121 @@
+// Thread gate — let Claude Code fall back to stateless when maxpool routed a threaded
+// turn somewhere that cannot serve it.
+//
+// WHY (2026-09-10). Claude Code >= 2.1.265 keeps the conversation on Anthropic's servers
+// and sends only the tail plus `thread:{type:"continue", previous_message_id}`. That
+// removed the self-containment every maxpool routing capability rests on: a different
+// Anthropic account 404s ("No thread state was found"), and GLM/Kimi reject a transcript
+// that opens mid-tool-call (z.ai `[1214]`). Measured: 10 of 12 live requests carry it.
+//
+// HOW. We do NOT rebuild the transcript. The client already knows how to fall back, and
+// Anthropic built the signal for exactly this case — a proxy that cannot honour threads.
+// A 400 carrying `error.details.error_code = "thread_unsupported_request"` makes the
+// client resend that turn stateless AND stop using threads for that agent+model for the
+// rest of the session. So the client replays with the transcript it already holds; we
+// never reuse a thread reference and therefore can never serve a stale conversation.
+//
+// Routing is NOT consulted or constrained. This runs after the account has been chosen;
+// it only decides what to say to it.
+
+export const THREAD_UNSUPPORTED_CODE = 'thread_unsupported_request';
+
+/** What kind of thread intent a request body carries. Cheap: only the head of the body
+ *  is JSON-parsed, and a non-JSON body is simply 'none'. */
+export function readThreadIntent(body) {
+  try {
+    const j = JSON.parse(body.toString('utf8'));
+    const t = j?.thread;
+    if (!t || typeof t !== 'object') {
+      // `previous_message_id` can also ride in `diagnostics`; that alone is not a thread.
+      return { kind: 'none' };
+    }
+    if (t.type === 'continue') return { kind: 'continue' };
+    if (t.type === 'create') return { kind: 'create' };
+    return { kind: 'none' };
+  } catch {
+    return { kind: 'none' };
+  }
+}
+
+/** The exact body the client's classifier reads. `details.error_code` is the field it
+ *  keys on; the message is free text and is never shown to a person. */
+export function threadRefusalBody(accountName) {
+  return {
+    type: 'error',
+    error: {
+      type: 'invalid_request_error',
+      message: `maxpool routed this turn to "${accountName}", which does not hold this thread. Resend it stateless.`,
+      details: { error_code: THREAD_UNSUPPORTED_CODE },
+    },
+  };
+}
+
+// Sessions whose last threaded turn we served, and how many times we have refused them.
+// Two short strings per entry; bounded and LRU-evicted.
+const MAX_SESSIONS = 500;
+// A session that keeps sending threaded turns after being refused is one whose client
+// did NOT take the downgrade (a different agent id, a model switch, an older build).
+// Refusing forever would double its request volume, so stop and forward instead.
+const MAX_CONSECUTIVE_REFUSALS = 2;
+// Bucket for requests that carry no session header — keyed per account so the storm
+// bound still applies without pretending we know whose conversation it is.
+const NO_SESSION_PREFIX = '\u0000nosession:';
+
+export class ThreadOwners {
+  constructor({ maxSessions = MAX_SESSIONS, maxRefusals = MAX_CONSECUTIVE_REFUSALS } = {}) {
+    this.map = new Map();          // sessionKey -> { owner, refusals }
+    this.maxSessions = maxSessions;
+    this.maxRefusals = maxRefusals;
+  }
+
+  _touch(key) {
+    const v = this.map.get(key);
+    if (v !== undefined) { this.map.delete(key); this.map.set(key, v); }   // LRU bump
+    return v;
+  }
+
+  _set(key, value) {
+    this.map.delete(key);
+    this.map.set(key, value);
+    while (this.map.size > this.maxSessions) this.map.delete(this.map.keys().next().value);
+  }
+
+  /** Decide AFTER routing has chosen. Returns true only for a `continue` turn that the
+   *  chosen account cannot serve, and only while refusals are still under the bound. */
+  shouldRefuse(sessionKey, accountName, intent) {
+    if (!accountName) return false;
+    if (intent?.kind !== 'continue') return false;          // `create` carries the full transcript
+    // A request with NO session header is invisible to ownership tracking, and measured
+    // 2026-09-11 those are the majority of traffic — 14 of 20 consecutive /v1/messages
+    // lines carried no `[sess …]`. Skipping them left threaded turns reaching GLM and
+    // failing exactly as before the gate existed. We cannot know the owner, so treat it
+    // as an unknown session (refuse, the safe direction) and bucket the refusal COUNT
+    // per account so the storm bound still applies.
+    const key = sessionKey || `${NO_SESSION_PREFIX}${accountName}`;
+    const entry = this._touch(key);
+    if (entry && entry.owner === accountName) return false; // the account that holds it
+    if (entry && entry.refusals >= this.maxRefusals) return false;  // bounded fail-open
+    return true;
+  }
+
+  /** Record a refusal we are about to emit. */
+  noteRefused(sessionKey, accountName = null) {
+    const key = sessionKey || (accountName ? `${NO_SESSION_PREFIX}${accountName}` : null);
+    if (!key) return;
+    const entry = this._touch(key) || { owner: null, refusals: 0 };
+    this._set(key, { owner: entry.owner, refusals: entry.refusals + 1 });
+  }
+
+  /** Record that `accountName` served a threaded turn for this session — it now holds
+   *  the thread. Any refusal streak ends here. */
+  noteServed(sessionKey, accountName, intent) {
+    if (!accountName) return;
+    if (intent?.kind !== 'create' && intent?.kind !== 'continue') return;
+    // Without a session header there is no conversation to attribute ownership to; only
+    // clear the per-account refusal streak so a served turn re-arms the bound.
+    const key = sessionKey || `${NO_SESSION_PREFIX}${accountName}`;
+    this._set(key, { owner: sessionKey ? accountName : null, refusals: 0 });
+  }
+
+  get size() { return this.map.size; }
+}

package/src/tui.js

@@ -332,7 +332,28 @@ function emptyBar(label, w = 10) {
   return `${ESC}100m${' '.repeat(lp)}${text}${' '.repeat(rp)}${RESET}`;
 }
 
-export const __tuiTest = { formatReset, quotaLabel, bar, emptyBar, strip, loadText, countdown, acctHeader, fitLine, providerLabel };
+/** Write a provider's enabled flag into the CONFIG entry `loadConfigProviders` reads.
+ *
+ *  A config-sourced provider is re-created from config on every reload
+ *  (`enabled: entry.enabled !== false`), so a runtime-only flag is undone by the next
+ *  auto-update. Measured 2026-09-11: Kimi, disabled by the owner, came back enabled
+ *  after an update because its config entry carried no `enabled` key.
+ *
+ *  Returns `{changed, previous}` so the caller can roll back if the save fails.
+ *  `changed:false` means there is no config entry — a header-derived provider, whose
+ *  runtime-only flag IS durable for it.
+ */
+export function applyProviderEnabledToConfig(config, name, enabled) {
+  const list = config?.providers;
+  if (!Array.isArray(list)) return { changed: false, previous: undefined };
+  const i = list.findIndex(p => p?.name === name);
+  if (i < 0) return { changed: false, previous: undefined };
+  const previous = list[i].enabled;
+  list[i].enabled = enabled;
+  return { changed: true, previous };
+}
+
+export const __tuiTest = { applyProviderEnabledToConfig, formatReset, quotaLabel, bar, emptyBar, strip, loadText, countdown, acctHeader, fitLine, providerLabel };
 
 function timestamp() {
   return new Date().toLocaleTimeString('en-US', { hour12: false });
@@ -359,7 +380,8 @@ export class TUI {
     this.capacityWindow = 'ses'; // capacity page window: 'ses' (5h) | 'wk' (weekly)
     // Hide disabled accounts from the table. With 8 dead/disabled accounts the live
     // ones scroll off the top; `h` collapses them to a one-line summary.
-    this.hideDisabled = false;
+    // Restored from config so an auto-update/reload does not un-hide what the user hid.
+    this.hideDisabled = this.config?.ui?.hideDisabled === true;
     this.selAction = null;   // prefer | toggle | delete
     this.selIdx = 0;
     this.inputPrompt = '';
@@ -556,6 +578,13 @@ export class TUI {
     } else if (k === 'h') {
       this.hideDisabled = !this.hideDisabled;
       this._addLog(this.hideDisabled ? 'Hiding disabled accounts' : 'Showing all accounts');
+      // Persist the view choice; a reload otherwise resets it to "show all" every time.
+      // Fully defensive: a VIEW preference must never break the toggle itself, and the
+      // TUI is constructed without a config in several tests and in early startup.
+      if (this.config) {
+        this.config.ui = { ...(this.config.ui || {}), hideDisabled: this.hideDisabled };
+        try { this.saveConfig?.(this.config)?.catch?.(() => {}); } catch { /* view-only */ }
+      }
     }
     // Enable/disable lives ONLY under [a] Accounts now (with rename/delete/login) —
     // one home for every account mutation, instead of a duplicate top-level toggle.
@@ -1540,6 +1569,22 @@ export class TUI {
       // on the next save, so it stays benched across a restart too. Re-enable it here the
       // same way whenever the user wants it back — there's no "removed forever" state.
       if (account.type === 'provider') {
+        // A CONFIG-SOURCED provider (one with a `providers:` entry) is re-created from
+        // config on every reload — `loadConfigProviders` computes `enabled: entry.enabled
+        // !== false` — so a runtime-only flag is silently undone by the next update or
+        // restart. Persist it where that read happens. Measured 2026-09-11: Kimi, disabled
+        // by the owner, came back enabled after an auto-update because its config entry
+        // had no `enabled` key. Header-derived providers (no config entry) keep the
+        // runtime-only path below, which is durable for them.
+        const applied = applyProviderEnabledToConfig(this.config, account.name, enabled);
+        if (applied.changed) {
+          try {
+            await this.saveConfig(this.config);
+          } catch (error) {
+            applyProviderEnabledToConfig(this.config, account.name, applied.previous);
+            throw error;
+          }
+        }
         this.am.setAccountEnabled(idx, enabled);
         if (!enabled && this.am.preferredAccountName === account.name) this.am.setRoutingMode?.('automatic');
         this._addLog(`${enabled ? 'Enabled' : 'Disabled'} provider "${account.name}" — ${enabled ? 'routing resumed' : 'benched (stays off across cc all + restart; re-enable here anytime)'}`);