maxpool 1.19.4 → 1.19.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.19.4",
+  "version": "1.19.6",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/server.js

@@ -1,5 +1,5 @@
 import http from 'node:http';
-import { ThreadOwners, readThreadIntent, threadRefusalBody } from './thread-gate.js';
+import { ThreadOwners, readThreadIntent, threadRefusalBody, isThreadlessAccount } from './thread-gate.js';
 import { writeFile, mkdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { modelFamily } from './oauth.js';
@@ -592,9 +592,11 @@ async function forwardRequest(
   // transcript. Hand the client the signal it already knows how to act on — it resends
   // the turn stateless and stops threading for the session — instead of letting the
   // upstream produce an error the user sees.
+  // `kind:'none'` when the gate is off makes every branch below a no-op, so the
+  // disabled path costs one comparison and needs no further guarding.
   const threadIntent = THREAD_GATE_ENABLED ? readThreadIntent(body) : { kind: 'none' };
-  if (THREAD_GATE_ENABLED && threadOwners.shouldRefuse(requestInfo.sessionKey, account.name, threadIntent)) {
-    threadOwners.noteRefused(requestInfo.sessionKey);
+  if (threadOwners.shouldRefuse(requestInfo.sessionKey, account.name, threadIntent, isThreadlessAccount(account))) {
+    threadOwners.noteRefused(requestInfo.sessionKey, account.name);
     accountManager.releaseAccount(lease, { neutral: true });
     console.log(`[Maxpool] thread not held by "${account.name}" — asking the client to resend this turn stateless [sess ${String(requestInfo.sessionKey || '?').slice(0, 8)}]`);
     ctx.status = 400;
@@ -603,7 +605,7 @@ async function forwardRequest(
   }
   // This account is about to serve the turn, so it holds the thread from here on.
   // Recorded optimistically: if the turn fails, the next one is refused anyway.
-  if (THREAD_GATE_ENABLED) threadOwners.noteServed(requestInfo.sessionKey, account.name, threadIntent);
+  threadOwners.noteServed(requestInfo.sessionKey, account.name, threadIntent);
 
   // Build log sections
   const logSections = [];
@@ -1041,6 +1043,27 @@ async function forwardRequest(
         // Providers answer with a code and no field name, so record what WE sent.
         if (account.type === 'provider') {
           console.log(`[Maxpool]   request shape: ${describeBodyShape(upstreamBody || body).slice(0, 600)}`);
+          // OPT-IN BODY CAPTURE. The shape line is content-free by design, which is right
+          // for a log that runs always — but it cannot diagnose a rejection that lives in
+          // the message CONTENT. Measured 2026-09-11: every top-level field of a failing
+          // [1210] body, and the full combination of them, returned 200 OK when replayed;
+          // the cause is inside the 940-message transcript and invisible from a summary.
+          // Writes the WHOLE request (the user's transcript) so it is OFF unless a human
+          // sets the directory, and stops after a handful of samples.
+          if (PROVIDER_4XX_CAPTURE_DIR && _provider4xxCaptured < PROVIDER_4XX_CAPTURE_MAX) {
+            _provider4xxCaptured += 1;
+            const n = _provider4xxCaptured;
+            (async () => {
+              try {
+                await mkdir(PROVIDER_4XX_CAPTURE_DIR, { recursive: true });
+                const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+                await writeFile(join(PROVIDER_4XX_CAPTURE_DIR, `${stamp}-${account.provider || 'provider'}-${n}.json`),
+                  JSON.stringify({ status: upstreamRes.status, error: errorBody.slice(0, 2000),
+                    account: account.name, body: (upstreamBody || body).toString('utf8') }), 'utf-8');
+                console.log(`[Maxpool]   captured failing body ${n}/${PROVIDER_4XX_CAPTURE_MAX} -> ${PROVIDER_4XX_CAPTURE_DIR}`);
+              } catch (e) { console.log(`[Maxpool]   capture failed: ${e?.message || e}`); }
+            })();
+          }
         }
       }
       const errorType = errorBody.includes('Invalid `signature` in `thinking` block')
@@ -1717,6 +1740,13 @@ function unavailableMessage(accountManager, requestInfo = {}, retryAfter, willRe
  *  Matched by CODE, never by prose: an error whose message names its field (Anthropic's
  *  own 400s do) is a real client fault and keeps its own clear message.
  */
+// Opt-in capture of a failing provider request, for the class of rejection that lives in
+// message CONTENT and is therefore invisible to the content-free shape line. Writes the
+// user's transcript, so it stays OFF unless a human names a directory.
+const PROVIDER_4XX_CAPTURE_DIR = process.env.MAXPOOL_CAPTURE_PROVIDER_4XX || '';
+const PROVIDER_4XX_CAPTURE_MAX = Number(process.env.MAXPOOL_CAPTURE_PROVIDER_4XX_MAX || 3);
+let _provider4xxCaptured = 0;
+
 function isProviderParamRejection(errorBody) {
   if (!errorBody) return false;
   return /\[1210\]|"code"\s*:\s*"?1210"?/.test(errorBody);

package/src/thread-gate.js

@@ -19,6 +19,13 @@
 
 export const THREAD_UNSUPPORTED_CODE = 'thread_unsupported_request';
 
+/** Whether an account is a non-Anthropic provider (GLM/Kimi) that can never hold an
+ *  Anthropic-side thread. The ONE place this is decided, so the call site and the
+ *  tests cannot disagree about it. */
+export function isThreadlessAccount(account) {
+  return account?.type === 'provider';
+}
+
 /** What kind of thread intent a request body carries. Cheap: only the head of the body
  *  is JSON-parsed, and a non-JSON body is simply 'none'. */
 export function readThreadIntent(body) {
@@ -29,7 +36,7 @@ export function readThreadIntent(body) {
       // `previous_message_id` can also ride in `diagnostics`; that alone is not a thread.
       return { kind: 'none' };
     }
-    if (t.type === 'continue') return { kind: 'continue', previousMessageId: t.previous_message_id || null };
+    if (t.type === 'continue') return { kind: 'continue' };
     if (t.type === 'create') return { kind: 'create' };
     return { kind: 'none' };
   } catch {
@@ -57,6 +64,9 @@ const MAX_SESSIONS = 500;
 // did NOT take the downgrade (a different agent id, a model switch, an older build).
 // Refusing forever would double its request volume, so stop and forward instead.
 const MAX_CONSECUTIVE_REFUSALS = 2;
+// Bucket for requests that carry no session header — keyed per account so the storm
+// bound still applies without pretending we know whose conversation it is.
+const NO_SESSION_PREFIX = '\u0000nosession:';
 
 export class ThreadOwners {
   constructor({ maxSessions = MAX_SESSIONS, maxRefusals = MAX_CONSECUTIVE_REFUSALS } = {}) {
@@ -78,29 +88,55 @@ export class ThreadOwners {
   }
 
   /** Decide AFTER routing has chosen. Returns true only for a `continue` turn that the
-   *  chosen account cannot serve, and only while refusals are still under the bound. */
-  shouldRefuse(sessionKey, accountName, intent) {
-    if (!sessionKey || !accountName) return false;
+   *  chosen account cannot serve, and only while refusals are still under the bound.
+   *
+   *  2026-09-13: `isProvider` (GLM/Kimi) short-circuits to refuse — measured, not
+   *  guessed: 118 of 118 provider-routed continues 400'd, the client never downgrades
+   *  on a plain provider 400 (its downgrade trigger is exactly the code this gate
+   *  returns), and when a slice tail is standalone-valid the provider ANSWERS it from
+   *  a ~2-message orphan context (the "amnesia" bug: 2,844 effective input tokens
+   *  where the prior turn had 478,596). Ownership tracking is meaningless for
+   *  providers — they can never hold an Anthropic-side thread — so every provider
+   *  continue is refused unconditionally: no owner record, no bound. The bound
+   *  existed to stop storms when a client ignores refusals, but the classifier that
+   *  acts on them ships in every continue-capable build (>= 2.1.265), and one
+   *  refusal ends the session's slicing for good; a no-session-header storm is
+   *  bounded by that same downgrade. Anthropic accounts keep the owner logic below —
+   *  a same-account chain preserves the vendor's thread saving (64% of turns). */
+  shouldRefuse(sessionKey, accountName, intent, isProvider = false) {
+    if (!accountName) return false;
     if (intent?.kind !== 'continue') return false;          // `create` carries the full transcript
-    const entry = this._touch(sessionKey);
+    if (isProvider) return true;                            // can never serve an Anthropic thread
+    // A request with NO session header is invisible to ownership tracking, and measured
+    // 2026-09-11 those are the majority of traffic — 14 of 20 consecutive /v1/messages
+    // lines carried no `[sess …]`. Skipping them left threaded turns reaching GLM and
+    // failing exactly as before the gate existed. We cannot know the owner, so treat it
+    // as an unknown session (refuse, the safe direction) and bucket the refusal COUNT
+    // per account so the storm bound still applies.
+    const key = sessionKey || `${NO_SESSION_PREFIX}${accountName}`;
+    const entry = this._touch(key);
     if (entry && entry.owner === accountName) return false; // the account that holds it
     if (entry && entry.refusals >= this.maxRefusals) return false;  // bounded fail-open
     return true;
   }
 
   /** Record a refusal we are about to emit. */
-  noteRefused(sessionKey) {
-    if (!sessionKey) return;
-    const entry = this._touch(sessionKey) || { owner: null, refusals: 0 };
-    this._set(sessionKey, { owner: entry.owner, refusals: entry.refusals + 1 });
+  noteRefused(sessionKey, accountName = null) {
+    const key = sessionKey || (accountName ? `${NO_SESSION_PREFIX}${accountName}` : null);
+    if (!key) return;
+    const entry = this._touch(key) || { owner: null, refusals: 0 };
+    this._set(key, { owner: entry.owner, refusals: entry.refusals + 1 });
   }
 
   /** Record that `accountName` served a threaded turn for this session — it now holds
    *  the thread. Any refusal streak ends here. */
   noteServed(sessionKey, accountName, intent) {
-    if (!sessionKey || !accountName) return;
+    if (!accountName) return;
     if (intent?.kind !== 'create' && intent?.kind !== 'continue') return;
-    this._set(sessionKey, { owner: accountName, refusals: 0 });
+    // Without a session header there is no conversation to attribute ownership to; only
+    // clear the per-account refusal streak so a served turn re-arms the bound.
+    const key = sessionKey || `${NO_SESSION_PREFIX}${accountName}`;
+    this._set(key, { owner: sessionKey ? accountName : null, refusals: 0 });
   }
 
   get size() { return this.map.size; }

package/src/tui.js

@@ -332,7 +332,28 @@ function emptyBar(label, w = 10) {
   return `${ESC}100m${' '.repeat(lp)}${text}${' '.repeat(rp)}${RESET}`;
 }
 
-export const __tuiTest = { formatReset, quotaLabel, bar, emptyBar, strip, loadText, countdown, acctHeader, fitLine, providerLabel };
+/** Write a provider's enabled flag into the CONFIG entry `loadConfigProviders` reads.
+ *
+ *  A config-sourced provider is re-created from config on every reload
+ *  (`enabled: entry.enabled !== false`), so a runtime-only flag is undone by the next
+ *  auto-update. Measured 2026-09-11: Kimi, disabled by the owner, came back enabled
+ *  after an update because its config entry carried no `enabled` key.
+ *
+ *  Returns `{changed, previous}` so the caller can roll back if the save fails.
+ *  `changed:false` means there is no config entry — a header-derived provider, whose
+ *  runtime-only flag IS durable for it.
+ */
+export function applyProviderEnabledToConfig(config, name, enabled) {
+  const list = config?.providers;
+  if (!Array.isArray(list)) return { changed: false, previous: undefined };
+  const i = list.findIndex(p => p?.name === name);
+  if (i < 0) return { changed: false, previous: undefined };
+  const previous = list[i].enabled;
+  list[i].enabled = enabled;
+  return { changed: true, previous };
+}
+
+export const __tuiTest = { applyProviderEnabledToConfig, formatReset, quotaLabel, bar, emptyBar, strip, loadText, countdown, acctHeader, fitLine, providerLabel };
 
 function timestamp() {
   return new Date().toLocaleTimeString('en-US', { hour12: false });
@@ -359,7 +380,8 @@ export class TUI {
     this.capacityWindow = 'ses'; // capacity page window: 'ses' (5h) | 'wk' (weekly)
     // Hide disabled accounts from the table. With 8 dead/disabled accounts the live
     // ones scroll off the top; `h` collapses them to a one-line summary.
-    this.hideDisabled = false;
+    // Restored from config so an auto-update/reload does not un-hide what the user hid.
+    this.hideDisabled = this.config?.ui?.hideDisabled === true;
     this.selAction = null;   // prefer | toggle | delete
     this.selIdx = 0;
     this.inputPrompt = '';
@@ -556,6 +578,13 @@ export class TUI {
     } else if (k === 'h') {
       this.hideDisabled = !this.hideDisabled;
       this._addLog(this.hideDisabled ? 'Hiding disabled accounts' : 'Showing all accounts');
+      // Persist the view choice; a reload otherwise resets it to "show all" every time.
+      // Fully defensive: a VIEW preference must never break the toggle itself, and the
+      // TUI is constructed without a config in several tests and in early startup.
+      if (this.config) {
+        this.config.ui = { ...(this.config.ui || {}), hideDisabled: this.hideDisabled };
+        try { this.saveConfig?.(this.config)?.catch?.(() => {}); } catch { /* view-only */ }
+      }
     }
     // Enable/disable lives ONLY under [a] Accounts now (with rename/delete/login) —
     // one home for every account mutation, instead of a duplicate top-level toggle.
@@ -1540,6 +1569,22 @@ export class TUI {
       // on the next save, so it stays benched across a restart too. Re-enable it here the
       // same way whenever the user wants it back — there's no "removed forever" state.
       if (account.type === 'provider') {
+        // A CONFIG-SOURCED provider (one with a `providers:` entry) is re-created from
+        // config on every reload — `loadConfigProviders` computes `enabled: entry.enabled
+        // !== false` — so a runtime-only flag is silently undone by the next update or
+        // restart. Persist it where that read happens. Measured 2026-09-11: Kimi, disabled
+        // by the owner, came back enabled after an auto-update because its config entry
+        // had no `enabled` key. Header-derived providers (no config entry) keep the
+        // runtime-only path below, which is durable for them.
+        const applied = applyProviderEnabledToConfig(this.config, account.name, enabled);
+        if (applied.changed) {
+          try {
+            await this.saveConfig(this.config);
+          } catch (error) {
+            applyProviderEnabledToConfig(this.config, account.name, applied.previous);
+            throw error;
+          }
+        }
         this.am.setAccountEnabled(idx, enabled);
         if (!enabled && this.am.preferredAccountName === account.name) this.am.setRoutingMode?.('automatic');
         this._addLog(`${enabled ? 'Enabled' : 'Disabled'} provider "${account.name}" — ${enabled ? 'routing resumed' : 'benched (stays off across cc all + restart; re-enable here anytime)'}`);