maxpool 1.19.5 → 1.19.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.19.5",
+  "version": "1.19.7",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/server.js

@@ -1,5 +1,5 @@
 import http from 'node:http';
-import { ThreadOwners, readThreadIntent, threadRefusalBody } from './thread-gate.js';
+import { ThreadOwners, readThreadIntent, threadRefusalBody, isThreadlessAccount } from './thread-gate.js';
 import { writeFile, mkdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { modelFamily } from './oauth.js';
@@ -595,7 +595,7 @@ async function forwardRequest(
   // `kind:'none'` when the gate is off makes every branch below a no-op, so the
   // disabled path costs one comparison and needs no further guarding.
   const threadIntent = THREAD_GATE_ENABLED ? readThreadIntent(body) : { kind: 'none' };
-  if (threadOwners.shouldRefuse(requestInfo.sessionKey, account.name, threadIntent)) {
+  if (threadOwners.shouldRefuse(requestInfo.sessionKey, account.name, threadIntent, isThreadlessAccount(account))) {
     threadOwners.noteRefused(requestInfo.sessionKey, account.name);
     accountManager.releaseAccount(lease, { neutral: true });
     console.log(`[Maxpool] thread not held by "${account.name}" — asking the client to resend this turn stateless [sess ${String(requestInfo.sessionKey || '?').slice(0, 8)}]`);
@@ -1043,6 +1043,27 @@ async function forwardRequest(
         // Providers answer with a code and no field name, so record what WE sent.
         if (account.type === 'provider') {
           console.log(`[Maxpool]   request shape: ${describeBodyShape(upstreamBody || body).slice(0, 600)}`);
+          // OPT-IN BODY CAPTURE. The shape line is content-free by design, which is right
+          // for a log that runs always — but it cannot diagnose a rejection that lives in
+          // the message CONTENT. Measured 2026-09-11: every top-level field of a failing
+          // [1210] body, and the full combination of them, returned 200 OK when replayed;
+          // the cause is inside the 940-message transcript and invisible from a summary.
+          // Writes the WHOLE request (the user's transcript) so it is OFF unless a human
+          // sets the directory, and stops after a handful of samples.
+          if (PROVIDER_4XX_CAPTURE_DIR && _provider4xxCaptured < PROVIDER_4XX_CAPTURE_MAX) {
+            _provider4xxCaptured += 1;
+            const n = _provider4xxCaptured;
+            (async () => {
+              try {
+                await mkdir(PROVIDER_4XX_CAPTURE_DIR, { recursive: true });
+                const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+                await writeFile(join(PROVIDER_4XX_CAPTURE_DIR, `${stamp}-${account.provider || 'provider'}-${n}.json`),
+                  JSON.stringify({ status: upstreamRes.status, error: errorBody.slice(0, 2000),
+                    account: account.name, body: (upstreamBody || body).toString('utf8') }), 'utf-8');
+                console.log(`[Maxpool]   captured failing body ${n}/${PROVIDER_4XX_CAPTURE_MAX} -> ${PROVIDER_4XX_CAPTURE_DIR}`);
+              } catch (e) { console.log(`[Maxpool]   capture failed: ${e?.message || e}`); }
+            })();
+          }
         }
       }
       const errorType = errorBody.includes('Invalid `signature` in `thinking` block')
@@ -1719,6 +1740,13 @@ function unavailableMessage(accountManager, requestInfo = {}, retryAfter, willRe
  *  Matched by CODE, never by prose: an error whose message names its field (Anthropic's
  *  own 400s do) is a real client fault and keeps its own clear message.
  */
+// Opt-in capture of a failing provider request, for the class of rejection that lives in
+// message CONTENT and is therefore invisible to the content-free shape line. Writes the
+// user's transcript, so it stays OFF unless a human names a directory.
+const PROVIDER_4XX_CAPTURE_DIR = process.env.MAXPOOL_CAPTURE_PROVIDER_4XX || '';
+const PROVIDER_4XX_CAPTURE_MAX = Number(process.env.MAXPOOL_CAPTURE_PROVIDER_4XX_MAX || 3);
+let _provider4xxCaptured = 0;
+
 function isProviderParamRejection(errorBody) {
   if (!errorBody) return false;
   return /\[1210\]|"code"\s*:\s*"?1210"?/.test(errorBody);
@@ -1729,7 +1757,7 @@ function isContextLengthError(errorBody) {
   return /exceeded model token limit|maximum context length|context length exceeded|context window (?:size )?(?:exceeded|too)|prompt is too long|input is too long|reduce the length of|too many (?:input )?tokens|request too large/i.test(errorBody);
 }
 
-export const __serverTest = { reanchorOrphanedSystemMessages, unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, classifyEffortRejection, repairEffort, isCapacitySignalStatus, isStrippableThinkingBlock, stripForeignThinkingBlocks, parseRejectedBlockPath, stripRejectedBlockClass, peekRejectedBlockType, describeRejectedBlock, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, commitStreamGraceHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody, isContextLengthError, isProviderParamRejection, describeBodyShape, streamResponse, startIdleRequestReaper, normalizeModelEcho };
+export const __serverTest = { rewriteBodyForAccount, sanitizeBlocksForProvider, reanchorOrphanedSystemMessages, unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, classifyEffortRejection, repairEffort, isCapacitySignalStatus, isStrippableThinkingBlock, stripForeignThinkingBlocks, parseRejectedBlockPath, stripRejectedBlockClass, peekRejectedBlockType, describeRejectedBlock, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, commitStreamGraceHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody, isContextLengthError, isProviderParamRejection, describeBodyShape, streamResponse, startIdleRequestReaper, normalizeModelEcho };
 
 async function readErrorBody(upstreamRes, limitBytes = 64 * 1024) {
   if (!upstreamRes.body) return '';
@@ -2929,18 +2957,54 @@ const threadOwners = new ThreadOwners();
 const THREAD_GATE_ENABLED = process.env.MAXPOOL_THREAD_GATE !== '0';
 
 function rewriteBodyForAccount(body, account) {
-  if (!body.length || (!account.model && !account.modelMap)) return body;
+  const needsProviderSanitize = account.type === 'provider';
+  if (!body.length || (!account.model && !account.modelMap && !needsProviderSanitize)) return body;
 
   try {
     const json = JSON.parse(body.toString());
     if (!json || typeof json !== 'object' || !json.model) return body;
-    json.model = mappedModel(json.model, account);
+    if (account.model || account.modelMap) json.model = mappedModel(json.model, account);
+    if (needsProviderSanitize) sanitizeBlocksForProvider(json);
     return Buffer.from(JSON.stringify(json));
   } catch {
     return body;
   }
 }
 
+// Content-block types Anthropic's own client emits that a provider's validator rejects
+// outright, taking the WHOLE request with it. Measured 2026-09-13 against z.ai: a body
+// carrying one `tool_reference` block (Claude Code writes these into `tool_result` when
+// ToolSearch loads a deferred tool) returns `[1210] Invalid API parameter` — the entire
+// 5.5MB transcript refused over 12 blocks. Counterfactual on the owner's real failing
+// session: identical body with ONLY these blocks rewritten to text returned 200 OK.
+//
+// It is not a size or token limit — z.ai has a distinct code for that (`[1261] Prompt
+// too long`), and a 34KB body with the block fails while 5.5MB without it passes.
+//
+// We rewrite rather than drop: the block carries a tool NAME the conversation refers to,
+// so replacing it with the equivalent sentence keeps the transcript truthful. Anthropic
+// accounts are untouched — they understand the block natively.
+const PROVIDER_UNSUPPORTED_BLOCKS = new Set(['tool_reference']);
+
+function sanitizeBlocksForProvider(json) {
+  const messages = json?.messages;
+  if (!Array.isArray(messages)) return;
+  for (const message of messages) {
+    const content = message?.content;
+    if (!Array.isArray(content)) continue;
+    for (const block of content) {
+      // The blocks live INSIDE tool_result content, not at the message top level.
+      if (!block || typeof block !== 'object' || !Array.isArray(block.content)) continue;
+      for (let i = 0; i < block.content.length; i++) {
+        const inner = block.content[i];
+        if (!inner || typeof inner !== 'object') continue;
+        if (!PROVIDER_UNSUPPORTED_BLOCKS.has(inner.type)) continue;
+        block.content[i] = { type: 'text', text: `Tool loaded: ${inner.tool_name || 'unknown'}` };
+      }
+    }
+  }
+}
+
 function mappedModel(originalModel, account) {
   if (account.model) return account.model;
   const map = account.modelMap || {};

package/src/thread-gate.js

@@ -19,6 +19,13 @@
 
 export const THREAD_UNSUPPORTED_CODE = 'thread_unsupported_request';
 
+/** Whether an account is a non-Anthropic provider (GLM/Kimi) that can never hold an
+ *  Anthropic-side thread. The ONE place this is decided, so the call site and the
+ *  tests cannot disagree about it. */
+export function isThreadlessAccount(account) {
+  return account?.type === 'provider';
+}
+
 /** What kind of thread intent a request body carries. Cheap: only the head of the body
  *  is JSON-parsed, and a non-JSON body is simply 'none'. */
 export function readThreadIntent(body) {
@@ -81,10 +88,25 @@ export class ThreadOwners {
   }
 
   /** Decide AFTER routing has chosen. Returns true only for a `continue` turn that the
-   *  chosen account cannot serve, and only while refusals are still under the bound. */
-  shouldRefuse(sessionKey, accountName, intent) {
+   *  chosen account cannot serve, and only while refusals are still under the bound.
+   *
+   *  2026-09-13: `isProvider` (GLM/Kimi) short-circuits to refuse — measured, not
+   *  guessed: 118 of 118 provider-routed continues 400'd, the client never downgrades
+   *  on a plain provider 400 (its downgrade trigger is exactly the code this gate
+   *  returns), and when a slice tail is standalone-valid the provider ANSWERS it from
+   *  a ~2-message orphan context (the "amnesia" bug: 2,844 effective input tokens
+   *  where the prior turn had 478,596). Ownership tracking is meaningless for
+   *  providers — they can never hold an Anthropic-side thread — so every provider
+   *  continue is refused unconditionally: no owner record, no bound. The bound
+   *  existed to stop storms when a client ignores refusals, but the classifier that
+   *  acts on them ships in every continue-capable build (>= 2.1.265), and one
+   *  refusal ends the session's slicing for good; a no-session-header storm is
+   *  bounded by that same downgrade. Anthropic accounts keep the owner logic below —
+   *  a same-account chain preserves the vendor's thread saving (64% of turns). */
+  shouldRefuse(sessionKey, accountName, intent, isProvider = false) {
     if (!accountName) return false;
     if (intent?.kind !== 'continue') return false;          // `create` carries the full transcript
+    if (isProvider) return true;                            // can never serve an Anthropic thread
     // A request with NO session header is invisible to ownership tracking, and measured
     // 2026-09-11 those are the majority of traffic — 14 of 20 consecutive /v1/messages
     // lines carried no `[sess …]`. Skipping them left threaded turns reaching GLM and