maxpool 1.20.4 → 1.21.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.20.4",
+  "version": "1.21.1",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -830,6 +830,9 @@ export class AccountManager {
   _isAvailable(account, options = {}) {
     if (!account) return false;
     if (!account.enabled) return false;
+    // Subscription latched gone (org-disabled 403): benched until re-subscribed. The
+    // clear path is a successful re-auth (updateAccountTokens) after re-purchasing.
+    if (account.subscriptionGone) return false;
     const now = options.now ?? Date.now();
 
     // Check rate limit expiry
@@ -3135,6 +3138,19 @@ export class AccountManager {
     // worth having; the diagnosis that motivated it was wrong.)
     q.consecutiveProbeFailures = (q.consecutiveProbeFailures || 0) + 1;
     const n = q.consecutiveProbeFailures;
+    // A SUSTAINED ORG-403 is the subscription being gone (canceled Max plan lapsing
+    // server-side — measured 2026-09-18/20: "OAuth authentication is currently not
+    // allowed for this organization" on 2solarmax@ and privacy@, both canceled Sep 16).
+    // The quota endpoint refuses before any quota question is answered, so probing is
+    // pure waste. Latch subscriptionGone (3 strikes, like the 401 rule): the prober
+    // skips the account, the TUI says why, and routing treats it as unavailable. A
+    // successful re-auth clears it (updateAccountTokens).
+    if (status === 403
+      && /not allowed for this organization|disabled.*subscription|subscription.*disabled|organization has disabled/i.test(String(message))
+      && n >= 3 && !account.subscriptionGone) {
+      account.subscriptionGone = true;
+      console.error(`[Maxpool] "${account.name}" subscription disabled at the organization (HTTP 403 x${n}) — benching it. Re-enable after re-subscribing, or remove the account (a → d).`);
+    }
     // A SUSTAINED 401 is dead credentials, not a blip. Latch refreshDead so (a) the
     // prober stops re-POSTing a rejected token every 60s forever — measured 2026-08-10:
     // 8 disabled accounts each past 20 consecutive 401s, hammering Anthropic's OAuth
@@ -3717,7 +3733,7 @@ export class AccountManager {
     // A dead refresh token (invalid_grant) is PERMANENT until browser re-auth —
     // never auto-retry it. Without this the prober re-POSTs the rejected token every
     // ~60s forever (hammering Anthropic's OAuth endpoint). Cleared on re-login.
-    if (account.refreshDead) return false;
+    if (account.refreshDead || account.subscriptionGone) return false;
 
     // A DISABLED account never spends its single-use refresh token. The prober still
     // READS its quota by design (you disable an exhausted account and still want to
@@ -3831,6 +3847,7 @@ export class AccountManager {
     if (refreshToken) account.refreshToken = refreshToken;
     account.expiresAt = expiresAt;
     account.refreshDead = false;  // fresh tokens from re-auth revive a dead-refresh account
+    account.subscriptionGone = false;  // a working re-auth means the org accepts OAuth again
     if (account.status === 'error') account.status = 'active';
     console.log(`[Maxpool] Updated tokens for account "${account.name}"`);
     this._onTokenRefresh?.(accountIndex, {

package/src/index.js

@@ -29,7 +29,7 @@ net.setDefaultAutoSelectFamilyAttemptTimeout(
 );
 import { Prober } from './prober.js';
 import { CapacityLedger } from './capacity-ledger.js';
-import { loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon, tokenFingerprint } from './oauth.js';
+import { loginOAuth, fetchProfile, refreshAccessToken, isTokenExpiringSoon, tokenFingerprint, isLoginCancelled } from './oauth.js';
 import { TUI } from './tui.js';
 import { RestartController } from './restart-controller.js';
 import { resolveAccounts } from './account-config.js';
@@ -1637,6 +1637,10 @@ async function loginOAuthCommand() {
   try {
     creds = await loginOAuth();
   } catch (err) {
+    if (isLoginCancelled(err)) {
+      console.error('Login cancelled.');
+      process.exit(0);
+    }
     console.error(`OAuth login failed: ${err.message}`);
     console.error('');
     console.error('Alternatives:');

package/src/oauth.js

@@ -520,6 +520,17 @@ export async function loginOAuth() {
  * Race the callback server promise against manual code entry from stdin.
  * The user can paste the full callback URL or just the authorization code.
  */
+// Rejection sentinel for a user-cancelled login — `err === LOGIN_CANCELLED` (or
+// isLoginCancelled(err)) distinguishes "changed my mind" from a real failure so the
+// UI can say 'cancelled' instead of 'failed' and CLI flows can exit 0 quietly.
+export const LOGIN_CANCELLED = Symbol.for('maxpool.login.cancelled');
+export function isLoginCancelled(err) { return err === LOGIN_CANCELLED; }
+
+export function isLoginCancelAnswer(answer) {
+  const t = String(answer || '').trim().toLowerCase();
+  return t === 'q' || t === 'quit' || t === 'cancel' || t === 'abort' || t === ':q';
+}
+
 function raceWithStdinCode(callbackPromise, expectedState) {
   if (!process.stdin.isTTY) return callbackPromise;
 
@@ -534,9 +545,20 @@ function raceWithStdinCode(callbackPromise, expectedState) {
       fn(val);
     };
 
-    rl.question('Paste authorization code here (or wait for browser callback): ', answer => {
+    // ESCAPE HATCH (2026-09-20). The login prompt had NO way out: a free-plan account
+    // can't complete the OAuth consent, the callback never arrives, and Ctrl+C — with
+    // no SIGINT listener on the readline — killed the whole maxpool process (measured:
+    // the owner was stuck on this exact screen and had to be told to kill the app).
+    // Now: Ctrl+C (first press) and typing q/quit/cancel/abort/:q both reject with a
+    // Cancelled sentinel the callers translate into "login cancelled", leaving the
+    // app alive. The TUI restarts itself from _doLogin's finally block.
+    const cancel = () => settle(reject, LOGIN_CANCELLED);
+    rl.on('SIGINT', cancel);
+
+    rl.question('Paste authorization code here (q or Ctrl+C to cancel): ', answer => {
       const trimmed = answer.trim();
       if (!trimmed) return; // empty input, keep waiting for callback
+      if (isLoginCancelAnswer(trimmed)) return cancel();
 
       // Try to parse as a URL with ?code= parameter
       try {

package/src/prober.js

@@ -187,6 +187,11 @@ export class Prober {
    *  than silently swallowed — a swallowed failing probe is what let a stale
    *  weekly look fresh. Never throws. */
   async probeOne(account) {
+    // Subscription latched org-disabled (account-manager recordProbeError): the quota
+    // endpoint 403s before answering anything, so probing is pure waste until the org
+    // accepts OAuth again. Skipping also stops the every-60s hammer that ran 700+ times
+    // on 2solarmax@ between 2026-09-18 and 09-20.
+    if (account.subscriptionGone) return { ok: false, status: 403 };
     try {
       await this.am.ensureTokenFresh(account.index);
       let usage = await this._withTimeout(this.probeFn(account.credential));

package/src/server.js

@@ -1054,6 +1054,16 @@ async function forwardRequest(
           try { return JSON.parse(errorBody)?.error?.message || errorBody; } catch { return errorBody; }
         })();
         console.log(`[Maxpool] ${upstreamRes.status} from "${account.name}": ${String(why).slice(0, 300)}`);
+        // ORG-DISABLED SUBSCRIPTION (2026-09-20): "OAuth authentication is currently not
+        // allowed for this organization" means the plan is GONE server-side (canceled
+        // subscription lapsed). Fail-over handles this request, but without a latch every
+        // later request would pick the account again. recordProbeError latches
+        // subscriptionGone on 3 strikes — the request path strikes once per hit, so this
+        // converges after three routed attempts and benches it exactly like the probe path.
+        if (account.type !== 'provider' && upstreamRes.status === 403
+          && /not allowed for this organization|organization has disabled/i.test(String(why))) {
+          accountManager.recordProbeError?.(account.index, String(why).slice(0, 160), 403);
+        }
         // Providers answer with a code and no field name, so record what WE sent.
         if (account.type === 'provider') {
           console.log(`[Maxpool]   request shape: ${describeBodyShape(upstreamBody || body).slice(0, 600)}`);

package/src/tui.js

@@ -1,5 +1,5 @@
 import { createInterface } from 'node:readline';
-import { fetchProfile, loginOAuth, tokenFingerprint } from './oauth.js';
+import { fetchProfile, loginOAuth, tokenFingerprint, isLoginCancelled } from './oauth.js';
 import { appendEventLog, setConsoleStdoutSuppressed } from './event-log.js';
 
 // ── ANSI helpers ─────────────────────────────────────────────
@@ -1335,7 +1335,11 @@ export class TUI {
         ? `\nRe-authenticated "${name}". Returning to maxpool…\n`
         : `\nAdded new account "${name}". Returning to maxpool…\n`);
     } catch (e) {
-      process.stdout.write(`\nLogin failed: ${e.message}\n`);
+      if (isLoginCancelled(e)) {
+        process.stdout.write('\nLogin cancelled.\n');
+      } else {
+        process.stdout.write(`\nLogin failed: ${e.message}\n`);
+      }
     } finally {
       setConsoleStdoutSuppressed(false);   // restore on every path (incl. the catch)
       if (wasRunning) this.start();
@@ -2022,6 +2026,9 @@ export class TUI {
     // broken account. Reported 2026-08-10 with all 8 disabled accounts sitting on dead
     // credentials (HTTP 401) and no way to see it.
     if (a.refreshDead) effectiveStatus = a.enabled === false ? 'disabled-reauth' : 'reauth';
+    // Subscription gone (org-disabled 403): a DISTINCT state from reauth — re-logging in
+    // will NOT fix it until the subscription is re-purchased. Says the actionable thing.
+    else if (a.subscriptionGone) effectiveStatus = 'no sub';
     switch (effectiveStatus) {
       case 'active':    status = isCur ? green('active') : 'active'; break;
       case 'reauth':    status = yellow('reauth'); break;
@@ -2033,6 +2040,7 @@ export class TUI {
       // Disabled AND needs re-login — both facts matter: it won't serve because you
       // switched it off, and it CAN'T serve until you log in again.
       case 'disabled-reauth': status = red('✕ reauth'); break;
+      case 'no sub': status = red('✕ no sub'); break;
       case 'throttled': {
         // A transient auto-recovering cooldown — show the remaining time (from
         // rateLimitedUntil) so it reads as "recovering in Ns", not stuck.
@@ -2128,7 +2136,7 @@ export class TUI {
     // "stale·probe 401" here is just the perpetual echo of the 401 that killed it.
     // Only annotate probe-staleness for LIVE accounts, where a failing probe
     // (e.g. a 429) is a real, actionable signal.
-    if (a?.refreshDead || a?.enabled === false) return '';
+    if (a?.refreshDead || a?.subscriptionGone || a?.enabled === false) return '';
     if (!this.am._quotaProbeStale?.(a)) return '';   // probe fresh (or off) → nothing to flag; interval>0 after this
     // The background probe IS stale — but only flag it if something DISPLAYED is
     // actually stale. An OAuth account's Ses/Wk bars come from unified5h/7d, which