maxpool 1.19.7 → 1.20.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.19.7",
+  "version": "1.20.0",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -147,6 +147,13 @@ const DEFAULT_SCHEDULER = {
   capPenaltyWeight: 10,            // steep penalty per unit of in-flight depth past D (throttle safety floor)
   paceCostWeight: 1.5,            // soft de-preference of accounts burning ahead of pace (was the ×6 term)
   utilizationWeight: 3,           // RAW utilization cost — drives load balancing in the mid-range
+  // WEEKLY-AWARE SCORING (2026-09-16): when true, _rawUtilization also folds in the
+  // WEEKLY utilization (unified7d / providerWk), not just the 5h session. Before this,
+  // a Claude account at 89% weekly with a freshly-reset 5h window scored as CHEAP —
+  // weekly-burning accounts kept winning the lease all day (backtest: 62%→35% mean
+  // weekly burn once weekly-aware). Boolean; default ON was chosen because the
+  // pre-flag behavior is the bug this fixes.
+  weeklyAwareScoring: true,
   scarcityWeight: 6,              // legacy; superseded by paceCostWeight (kept so old configs don't error)
   // Reserve-account OVERFLOW model. A weekly-RESERVE account (util 0.85-0.95) used to
   // sit idle behind a healthy-only first pass; now it's eligible in the first pass but
@@ -2692,7 +2699,7 @@ export class AccountManager {
    *  _accountScarcity but WITHOUT the elapsed-fraction discount. This is the signal
    *  the load balancer needs: an account at 80% is more expensive than one at 10%,
    *  full stop. */
-  _rawUtilization(account) {
+  _rawUtilization(account, now = Date.now()) {
     const q = account?.quota;
     if (!q) return 0;
     // SESSION windows use raw utilization — headroom is consumed immediately and an
@@ -2708,6 +2715,24 @@ export class AccountManager {
     if (q.tokensLimit != null && q.tokensLimit > 0 && q.tokensRemaining != null) {
       util = Math.max(util, 1 - q.tokensRemaining / q.tokensLimit);
     }
+    // WEEKLY-AWARE (2026-09-16): fold the WEEKLY number in too, behind its own
+    // flag — via _windowScarcity (reset-aware), NEVER raw. v1 of this block used
+    // raw max(), which fixed the 89%-weekly-wins-all-day bug but broke the
+    // near-reset contracts that predate it: the use-it-or-lose-it pin, the
+    // preReset drain (X2/X5), and S10's flag-off parity. Pace-adjusted, a
+    // 60%-weekly account mid-window adds (0.60 − elapsedFrac) here at weight 3
+    // ON TOP of the paceCost's weight-1.5 copy — doubling the weekly steering
+    // signal (the actual fix) while capacity dying at reset stays free (the
+    // invariant the older tests pin). Unknown/absent reset → face value, same as
+    // _accountScarcity. Turn the flag off to restore session-only exactly.
+    if (this.scheduler.weeklyAwareScoring !== false) {
+      if (q.unified7d != null) {
+        util = Math.max(util, this._windowScarcity(q.unified7d, q.unified7dReset, WEEK_MS, now));
+      }
+      if (q.providerWk != null) {
+        util = Math.max(util, this._windowScarcity(q.providerWk, q.providerWkReset, WEEK_MS, now));
+      }
+    }
     return util;
   }
 

package/src/server.js

@@ -48,6 +48,12 @@ const QUEUE_KEEPALIVE = 'event: ping\ndata: {}\n\n';
 const STREAM_IDLE_MS = Math.max(30_000, Number(process.env.MAXPOOL_STREAM_IDLE_MS) || 240_000);  // max gap BETWEEN streamed chunks (reset per chunk)
 const UPSTREAM_BODY_MS = Math.max(30_000, Number(process.env.MAXPOOL_BODY_MS) || 300_000);       // non-streaming body read
 const CLIENT_DRAIN_MS = Math.max(5_000, Number(process.env.MAXPOOL_DRAIN_MS) || 60_000);         // max wait for a backpressured client to drain (half-open client → free the lease)
+// SAFEGUARD-REFUSAL REROUTE caps: how long streamResponse may hold the FIRST events
+// unsent while deciding refusal-vs-content. Both fail OPEN (release + stream verbatim)
+// so a pathological upstream can only cost a missed reroute, never a stall. Real
+// refusals resolve in the first 2-3 events (<4KB, <5s — measured on 9 captures).
+const REFUSAL_HOLD_MAX_BYTES = 64 * 1024;
+const REFUSAL_HOLD_MAX_MS = 30_000;
 // A provider 403 is (unlike a 401) almost always transient QUOTA/PLAN exhaustion — cool
 // the provider down RECOVERABLY for this window, then re-probe, instead of permanently
 // disabling it. Short (not reset-length) so a provider-pinned session's hold window
@@ -516,6 +522,14 @@ async function forwardRequest(
   ctx.account = account.name;
   hooks.onRequestRouted?.(reqId, { account: account.name });
 
+  // SAFEGUARD-REFUSAL REROUTE (2026-09-14): arm the stream-side hold only for Anthropic
+  // accounts on a streaming turn we could still fail over (nothing written yet). A
+  // provider has its own classifier and never emits this stop_reason, so holding its
+  // first events would be pure latency. See streamResponse + classifyHeldStreamPrefix.
+  requestInfo._refusalRerouteEligible = account.type !== 'provider'
+    && canRetryBufferedBody
+    && !res.headersSent;
+
   // Refresh OAuth token if needed
   const tokenReady = await accountManager.ensureTokenFresh(account.index);
   if (clientGone.signal.aborted) { releaseOnClientGone(); return; }
@@ -1370,8 +1384,7 @@ async function forwardRequest(
         logSections.push(`=== RESPONSE BODY (streamed) ===\n${streamLog.join('')}`);
         writeRequestLog(logDir, reqId, logSections);
       }
-    } else {
-      // Bound the non-streaming body read so a mid-body upstream stall can't hang
+    } else {      // Bound the non-streaming body read so a mid-body upstream stall can't hang
       // the request forever and leak the lease (same class as the streaming idle
       // guard). On timeout → UPSTREAM_BODY → the caller frees the lease.
       const bodyP = upstreamRes.arrayBuffer();
@@ -1459,6 +1472,35 @@ async function forwardRequest(
     console.error(`[Maxpool] Upstream error (account "${account.name}"):`, err.message
       + (rootCause && !String(err.message).includes(rootCause) ? ` (cause: ${rootCause})` : ''));
 
+    // SAFEGUARD-REFUSAL REROUTE (2026-09-14): streamResponse detected a
+    // stop_reason:"refusal" while still holding the first events — nothing was ever
+    // written to the client (usage is 0/0 on these; no model output exists). Every
+    // Anthropic account shares the classifier, so retrying another Anthropic account
+    // is guaranteed re-refusal: exclude ALL Anthropic accounts and re-dispatch onto a
+    // provider. If no provider is available,
+    // fall through to the normal error path — the client sees the same message it
+    // would have seen before this feature existed.
+    if (err.code === 'REFUSAL_RETRY' && canRetryBufferedBody && !res.headersSent) {
+      const category = err.refusalCategory || 'unknown';
+      const anthropicIndexes = accountManager.accounts
+        .filter(a => a.type !== 'provider')
+        .map(a => a.index);
+      anthropicIndexes.forEach(i => excludedIndexes.add(i));
+      const providerAvailable = accountManager.accounts.some(a => a.type === 'provider' && !excludedIndexes.has(a.index));
+      // No re-reroute latch: once rerouted, the turn is served by a PROVIDER, which never
+      // arms the hold (above), so it cannot refuse-and-reroute again. Mutation-tested
+      // 2026-09-14: removing a latch changed nothing on any constructible path.
+      if (providerAvailable && retryCount + 1 <= maxAttempts) {
+        console.log(`[Maxpool] Anthropic safeguard refusal (${category}) on "${account.name}" — rerouting turn to a provider account`);
+        accountManager.releaseAccount(lease, { success: true, status: 200, refusal: category });
+        return forwardRequest(
+          req, res, body, accountManager, upstream, retryCount + 1, hooks, reqId, ctx, logDir,
+          retryConfig, queueConfig, requestInfo, canRetryBufferedBody, canQueueBufferedBody, excludedIndexes,
+        );
+      }
+      console.log(`[Maxpool] Anthropic safeguard refusal (${category}) — no provider route available; surfacing error`);
+    }
+
     if (logDir) {
       logSections.push(`=== ERROR ===\n${err.stack || err.message}`);
       writeRequestLog(logDir, reqId, logSections);
@@ -1757,7 +1799,7 @@ function isContextLengthError(errorBody) {
   return /exceeded model token limit|maximum context length|context length exceeded|context window (?:size )?(?:exceeded|too)|prompt is too long|input is too long|reduce the length of|too many (?:input )?tokens|request too large/i.test(errorBody);
 }
 
-export const __serverTest = { rewriteBodyForAccount, sanitizeBlocksForProvider, reanchorOrphanedSystemMessages, unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, classifyEffortRejection, repairEffort, isCapacitySignalStatus, isStrippableThinkingBlock, stripForeignThinkingBlocks, parseRejectedBlockPath, stripRejectedBlockClass, peekRejectedBlockType, describeRejectedBlock, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, commitStreamGraceHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody, isContextLengthError, isProviderParamRejection, describeBodyShape, streamResponse, startIdleRequestReaper, normalizeModelEcho };
+export const __serverTest = { rewriteBodyForAccount, sanitizeBlocksForProvider, reanchorOrphanedSystemMessages, unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, classifyEffortRejection, repairEffort, isCapacitySignalStatus, isStrippableThinkingBlock, stripForeignThinkingBlocks, parseRejectedBlockPath, stripRejectedBlockClass, peekRejectedBlockType, describeRejectedBlock, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, commitStreamGraceHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody, isContextLengthError, isProviderParamRejection, describeBodyShape, streamResponse, startIdleRequestReaper, normalizeModelEcho, classifyHeldStreamPrefix };
 
 async function readErrorBody(upstreamRes, limitBytes = 64 * 1024) {
   if (!upstreamRes.body) return '';
@@ -3119,6 +3161,25 @@ async function streamResponse(webStream, res, status, responseHeaders, accountIn
   let modelEchoPending = true;
   let modelEchoBuffer = null;
 
+  // SAFEGUARD-REFUSAL REROUTE (2026-09-14). Anthropic's server-side classifier can
+  // terminate a turn with HTTP 200 + `stop_reason:"refusal"` + stop_details.category
+  // (reasoning_extraction / cyber / bio / frontier_llm) and usage 0/0 — no model output
+  // is produced, and the CLI renders "API Error: … safeguards flagged this message",
+  // killing the turn. Every Anthropic account shares that classifier, so account
+  // failover cannot help; only a PROVIDER hop escapes it.
+  //
+  // Because usage is 0/0 the client has seen no model text, so the turn is safely
+  // retryable — but only while nothing has been WRITTEN yet. This rides the model-echo
+  // hold above: we keep buffering until a DECISIVE event (real content → flush and
+  // stream normally; refusal → throw REFUSAL_RETRY so the caller re-dispatches on a
+  // provider). `ping` is not decisive. Fail-open on either cap, exactly as the
+  // model-echo hold does — a missed reroute is a bad turn, a stall is a dead session.
+  // Task: work/tooling/**/task-2026-09-14-maxpool-reroute-anthropic-refusals-to-provider
+  let refusalRerouting = false;
+  const refusalWatch = requestInfo?._refusalRerouteEligible === true;
+  let refusalHoldBuffer = refusalWatch ? [] : null;
+  const refusalHoldStart = Date.now();
+
   try {
     while (true) {
       // Idle guard: a half-open upstream (headers, then silence, never closes) would
@@ -3143,12 +3204,37 @@ async function streamResponse(webStream, res, status, responseHeaders, accountIn
       } finally {
         clearTimeout(idleTimer);  // single live timer at a time — no per-chunk timer accumulation
       }
-      const { done, value } = result;
+      const { done, value: chunkValue } = result;
       if (done) break;
+      let value = chunkValue;
 
       // Client disconnected — stop reading from upstream
       if (res.destroyed) break;
 
+      // SAFEGUARD-REFUSAL HOLD (see the state block above). Runs BEFORE writeHead so a
+      // rerouted turn leaves the client socket completely untouched — the caller can
+      // then re-dispatch onto a provider as if the Anthropic attempt never happened.
+      if (refusalHoldBuffer) {
+        refusalHoldBuffer.push(value);
+        const held = decoder.decode(concatUint8(refusalHoldBuffer));
+        const verdict = classifyHeldStreamPrefix(held);
+        if (verdict.decision === 'refusal') {
+          throw Object.assign(
+            new Error(`anthropic safeguard refusal (${verdict.category || 'unknown'})`),
+            { code: 'REFUSAL_RETRY', refusalCategory: verdict.category || 'unknown' },
+          );
+        }
+        if (verdict.decision === 'hold'
+            && totalLen(refusalHoldBuffer) <= REFUSAL_HOLD_MAX_BYTES
+            && Date.now() - refusalHoldStart <= REFUSAL_HOLD_MAX_MS) {
+          continue; // nothing decisive yet — keep holding, write nothing
+        }
+        // Decisive content, or either cap hit → fail open: release the held bytes as
+        // this chunk and never hold again on this stream.
+        value = concatUint8(refusalHoldBuffer);
+        refusalHoldBuffer = null;
+      }
+
       if (!committed) {
         res.writeHead(status, responseHeaders);
         committed = true;
@@ -3245,8 +3331,40 @@ async function streamResponse(webStream, res, status, responseHeaders, accountIn
     }
   } catch (err) {
     readFailed = true;
+    if (err?.code === 'REFUSAL_RETRY') refusalRerouting = true;
     throw err;
   } finally {
+    // SAFEGUARD-REFUSAL HOLD last-resort flush. A stream can end while the hold is
+    // still undecided — a `usage`-only stream (message_delta with no content blocks
+    // and no message_stop) reaches `done` having never produced a decisive event, and
+    // an upstream that DIES mid-flight throws with bytes still held. Both must still
+    // deliver and account for what arrived; only the refusal reroute discards, because
+    // that turn is being re-run on another account and its usage will be counted there.
+    // Caught by server.test.js "streaming response is not committed until first upstream
+    // chunk" and capacity-integration H4 on the first full-suite run — the held bytes
+    // were being dropped, truncating good responses and losing delivered tokens.
+    if (refusalHoldBuffer) {
+      const heldChunks = refusalHoldBuffer;
+      refusalHoldBuffer = null;
+      if (!refusalRerouting) {
+        const held = Buffer.from(concatUint8(heldChunks));
+        const heldText = held.toString('utf8');
+        // Account for delivered tokens even when the write is impossible (dead socket):
+        // capacity is about what the UPSTREAM produced, not what the client received.
+        if (streamLog) streamLog.push(heldText);
+        sseBuffer += heldText;
+        for (const ev of sseBuffer.split('\n\n')) {
+          if (ev.trim()) parseSSEEvent(ev, accountIndex, accountManager, requestInfo);
+        }
+        sseBuffer = '';
+        if (!readFailed && !res.destroyed) {
+          try {
+            if (!committed && !res.headersSent) { res.writeHead(status, responseHeaders); committed = true; }
+            res.write(held);
+          } catch { /* client already gone */ }
+        }
+      }
+    }
     // MODEL ECHO NORMALIZATION last-resort flush: the read loop can exit via done,
     // error, or client disconnect while chunks are still HELD for the rewrite.
     // Whatever the exit path, deliver the held bytes and accrue their usage — a
@@ -3323,6 +3441,37 @@ function sseEventContainsThinking(data) {
     || data?.delta?.type === 'signature_delta';
 }
 
+// SAFEGUARD-REFUSAL REROUTE — classify the held stream prefix (see streamResponse).
+// Decisive events, on the first COMPLETE SSE event boundary:
+//   - `stop_reason:"refusal"` (+ optional stop_details.category)  → { decision: 'refusal', category }
+//   - any content_block_start/content_block_delta                  → { decision: 'content' }
+//   - message_stop without a prior refusal                         → { decision: 'content' } (normal end)
+// Non-decisive: message_start, ping, partial/binary garbage → { decision: 'hold' }.
+// Works on the RAW prefix (not parsed events) so it can run per-chunk; a refusal
+// `message_delta` always lands after `message_start` and before any content, and no
+// provider-echo variant matters here because the hold is only armed on Anthropic
+// accounts (requestInfo._refusalRerouteEligible).
+function classifyHeldStreamPrefix(prefix) {
+  for (const event of prefix.split('\n\n')) {
+    const dataLine = event.split('\n').find(l => l.startsWith('data: '));
+    if (!dataLine) continue; // ping/comment — not decisive
+    let data;
+    try { data = JSON.parse(dataLine.slice(6)); } catch { continue; }
+    if (data?.delta?.stop_reason === 'refusal'
+        || (data?.type === 'message' && data?.stop_reason === 'refusal')) {
+      return { decision: 'refusal', category: data?.stop_details?.category || data?.delta?.stop_details?.category };
+    }
+    if (data?.type === 'content_block_start' || data?.type === 'content_block_delta') {
+      return { decision: 'content' };
+    }
+    if (data?.type === 'message_stop') {
+      // Terminal without refusal and without content blocks (usage-only edge) — release.
+      return { decision: 'content' };
+    }
+  }
+  return { decision: 'hold' };
+}
+
 function extractUsageFromBody(buffer, accountIndex, accountManager, requestInfo = {}) {
   try {
     const json = JSON.parse(buffer.toString());

package/src/tui.js

@@ -977,6 +977,11 @@ export class TUI {
       // mode — under balance/prefer-* the mode itself controls eligibility. Still
       // safe to set (it'll apply if you switch back to sticky).
       this._cycleProviderClaudeFallback(k === 'g' ? 'zai' : 'kimi');
+    } else if (k === 'w' || k === 'W') {
+      // WEEKLY-AWARE SCORING (2026-09-16): fold weekly utilization into the routing
+      // score, not just the 5h session. Without it, an account at 89% weekly with a
+      // fresh session window scores as cheap and keeps winning all day.
+      this._toggleWeeklyAware();
     } else if (k === 'esc' || k === 'q') {
       this.mode = 'normal';
     }
@@ -1066,6 +1071,22 @@ export class TUI {
         : `Peak cap: bench a GLM account once it passes ${Math.round(next * 100)}% of its weekly quota`);
   }
 
+  /** Toggle weekly-aware routing for the whole fleet. One scheduler flag — when OFF the
+   *  score sees only the 5h session (the pre-2026-09-16 behavior); when ON the weekly
+   *  number is folded in, so a nearly-exhausted account loses to a fresh one at ALL
+   *  hours, not just after its session window resets. */
+  async _toggleWeeklyAware() {
+    const next = this.am.scheduler.weeklyAwareScoring === false;
+    this.am.scheduler.weeklyAwareScoring = next;
+    const sched = { ...(this.config.scheduler || {}) };
+    sched.weeklyAwareScoring = next;
+    this.config.scheduler = sched;
+    await this.saveConfig(this.config);
+    this._addLog(next
+      ? 'Weekly-aware routing: ON — accounts near their weekly limit rank last, all day'
+      : 'Weekly-aware routing: OFF — score sees only the 5h session window again');
+  }
+
   async _cycleRoutingMode() {
     const modes = TUI.ROUTING_MODES;
     const cur = this.am.scheduler?.routingMode || 'sticky';
@@ -2369,7 +2390,8 @@ export class TUI {
           const now = st?.inPeak ? red(' NOW') : '';
           const dep = ps.depreference ? yellow('GLM last') : cyan('normal');
           const cap = ps.cap >= 1 ? 'off' : ps.cap === 0 ? 'never' : `${Math.round(ps.cap * 100)}%`;
-          peakPart = `  ${dim('│')} ${bold(' d ')}Peak${now}: ${dep} ${bold(' c ')}cap ${cyan(cap)}`;
+          const wk = this.am.scheduler.weeklyAwareScoring === false ? yellow('5h-only') : cyan('weekly');
+          peakPart = `  ${dim('│')} ${bold(' d ')}Peak${now}: ${dep} ${bold(' c ')}cap ${cyan(cap)} ${bold(' w ')}score:${wk}`;
         }
         return ` ${bold('f')} Routing: ${cyan(mode.label)} ↻${provPart}${peakPart}  ${bold('p')} Preference  ${bold('Esc')} Back`;
       }