maxpool 1.20.4 → 1.21.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.20.4",
+  "version": "1.21.0",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -830,6 +830,9 @@ export class AccountManager {
   _isAvailable(account, options = {}) {
     if (!account) return false;
     if (!account.enabled) return false;
+    // Subscription latched gone (org-disabled 403): benched until re-subscribed. The
+    // clear path is a successful re-auth (updateAccountTokens) after re-purchasing.
+    if (account.subscriptionGone) return false;
     const now = options.now ?? Date.now();
 
     // Check rate limit expiry
@@ -3135,6 +3138,19 @@ export class AccountManager {
     // worth having; the diagnosis that motivated it was wrong.)
     q.consecutiveProbeFailures = (q.consecutiveProbeFailures || 0) + 1;
     const n = q.consecutiveProbeFailures;
+    // A SUSTAINED ORG-403 is the subscription being gone (canceled Max plan lapsing
+    // server-side — measured 2026-09-18/20: "OAuth authentication is currently not
+    // allowed for this organization" on 2solarmax@ and privacy@, both canceled Sep 16).
+    // The quota endpoint refuses before any quota question is answered, so probing is
+    // pure waste. Latch subscriptionGone (3 strikes, like the 401 rule): the prober
+    // skips the account, the TUI says why, and routing treats it as unavailable. A
+    // successful re-auth clears it (updateAccountTokens).
+    if (status === 403
+      && /not allowed for this organization|disabled.*subscription|subscription.*disabled|organization has disabled/i.test(String(message))
+      && n >= 3 && !account.subscriptionGone) {
+      account.subscriptionGone = true;
+      console.error(`[Maxpool] "${account.name}" subscription disabled at the organization (HTTP 403 x${n}) — benching it. Re-enable after re-subscribing, or remove the account (a → d).`);
+    }
     // A SUSTAINED 401 is dead credentials, not a blip. Latch refreshDead so (a) the
     // prober stops re-POSTing a rejected token every 60s forever — measured 2026-08-10:
     // 8 disabled accounts each past 20 consecutive 401s, hammering Anthropic's OAuth
@@ -3717,7 +3733,7 @@ export class AccountManager {
     // A dead refresh token (invalid_grant) is PERMANENT until browser re-auth —
     // never auto-retry it. Without this the prober re-POSTs the rejected token every
     // ~60s forever (hammering Anthropic's OAuth endpoint). Cleared on re-login.
-    if (account.refreshDead) return false;
+    if (account.refreshDead || account.subscriptionGone) return false;
 
     // A DISABLED account never spends its single-use refresh token. The prober still
     // READS its quota by design (you disable an exhausted account and still want to
@@ -3831,6 +3847,7 @@ export class AccountManager {
     if (refreshToken) account.refreshToken = refreshToken;
     account.expiresAt = expiresAt;
     account.refreshDead = false;  // fresh tokens from re-auth revive a dead-refresh account
+    account.subscriptionGone = false;  // a working re-auth means the org accepts OAuth again
     if (account.status === 'error') account.status = 'active';
     console.log(`[Maxpool] Updated tokens for account "${account.name}"`);
     this._onTokenRefresh?.(accountIndex, {

package/src/prober.js

@@ -187,6 +187,11 @@ export class Prober {
    *  than silently swallowed — a swallowed failing probe is what let a stale
    *  weekly look fresh. Never throws. */
   async probeOne(account) {
+    // Subscription latched org-disabled (account-manager recordProbeError): the quota
+    // endpoint 403s before answering anything, so probing is pure waste until the org
+    // accepts OAuth again. Skipping also stops the every-60s hammer that ran 700+ times
+    // on 2solarmax@ between 2026-09-18 and 09-20.
+    if (account.subscriptionGone) return { ok: false, status: 403 };
     try {
       await this.am.ensureTokenFresh(account.index);
       let usage = await this._withTimeout(this.probeFn(account.credential));

package/src/server.js

@@ -1054,6 +1054,16 @@ async function forwardRequest(
           try { return JSON.parse(errorBody)?.error?.message || errorBody; } catch { return errorBody; }
         })();
         console.log(`[Maxpool] ${upstreamRes.status} from "${account.name}": ${String(why).slice(0, 300)}`);
+        // ORG-DISABLED SUBSCRIPTION (2026-09-20): "OAuth authentication is currently not
+        // allowed for this organization" means the plan is GONE server-side (canceled
+        // subscription lapsed). Fail-over handles this request, but without a latch every
+        // later request would pick the account again. recordProbeError latches
+        // subscriptionGone on 3 strikes — the request path strikes once per hit, so this
+        // converges after three routed attempts and benches it exactly like the probe path.
+        if (account.type !== 'provider' && upstreamRes.status === 403
+          && /not allowed for this organization|organization has disabled/i.test(String(why))) {
+          accountManager.recordProbeError?.(account.index, String(why).slice(0, 160), 403);
+        }
         // Providers answer with a code and no field name, so record what WE sent.
         if (account.type === 'provider') {
           console.log(`[Maxpool]   request shape: ${describeBodyShape(upstreamBody || body).slice(0, 600)}`);

package/src/tui.js

@@ -2022,6 +2022,9 @@ export class TUI {
     // broken account. Reported 2026-08-10 with all 8 disabled accounts sitting on dead
     // credentials (HTTP 401) and no way to see it.
     if (a.refreshDead) effectiveStatus = a.enabled === false ? 'disabled-reauth' : 'reauth';
+    // Subscription gone (org-disabled 403): a DISTINCT state from reauth — re-logging in
+    // will NOT fix it until the subscription is re-purchased. Says the actionable thing.
+    else if (a.subscriptionGone) effectiveStatus = 'no sub';
     switch (effectiveStatus) {
       case 'active':    status = isCur ? green('active') : 'active'; break;
       case 'reauth':    status = yellow('reauth'); break;
@@ -2033,6 +2036,7 @@ export class TUI {
       // Disabled AND needs re-login — both facts matter: it won't serve because you
       // switched it off, and it CAN'T serve until you log in again.
       case 'disabled-reauth': status = red('✕ reauth'); break;
+      case 'no sub': status = red('✕ no sub'); break;
       case 'throttled': {
         // A transient auto-recovering cooldown — show the remaining time (from
         // rateLimitedUntil) so it reads as "recovering in Ns", not stuck.
@@ -2128,7 +2132,7 @@ export class TUI {
     // "stale·probe 401" here is just the perpetual echo of the 401 that killed it.
     // Only annotate probe-staleness for LIVE accounts, where a failing probe
     // (e.g. a 429) is a real, actionable signal.
-    if (a?.refreshDead || a?.enabled === false) return '';
+    if (a?.refreshDead || a?.subscriptionGone || a?.enabled === false) return '';
     if (!this.am._quotaProbeStale?.(a)) return '';   // probe fresh (or off) → nothing to flag; interval>0 after this
     // The background probe IS stale — but only flag it if something DISPLAYED is
     // actually stale. An OAuth account's Ses/Wk bars come from unified5h/7d, which