maxpool 1.22.1 → 1.22.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.22.1",
+  "version": "1.22.3",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -1445,10 +1445,11 @@ export class AccountManager {
    *
    * The ceiling is switchThreshold and never 1.0, deliberately: the owner asked for a
    * cap that "always preserves some meaningful room for usage of those accounts outside
-   * of MaxPool". A fully-ramped dynamic account therefore behaves exactly like an
-   * UNCAPPED one — never more aggressively — so this mechanism can only ever make an
-   * account MORE available than the fixed cap it replaces (pinned by T3c). That
-   * one-directionality is why it is not a live-session control surface.
+   * of MaxPool". NOTE the invariant is the WEAKER one: never LESS available than the
+   * FIXED CAP it replaces (pinned by T3c) — NOT "identical to an uncapped account".
+   * Above the ceiling the cap still hard-benches ('capped', ahead of the upstreamAllows
+   * carve-out) where the uncapped twin would read 'reserve' and stay routable. That is
+   * the reservation doing its job at the margin, not a parity bug.
    *
    * Fails CLOSED in every uncertain case (no stamp, unusable duration): an unknown
    * window position returns the floor, never an opened-up cap.
@@ -1946,7 +1947,13 @@ export class AccountManager {
     }
 
     if (q.unified5h != null && q.unified5h >= bench) {
-      return { cause: 'session_limit', retryAt: q.unified5hReset || null, queueable: Boolean(q.unified5hReset) };
+      // DYNAMIC CAP twin of the weekly arm's _capUnbenchAt: a rising session cap
+      // unbenches at its own ramp crossing, often hours before the 5h reset. Without
+      // this, util 0.55 over a floor 0.50 that has just rolled tells the client to wait
+      // ~5h when the cap releases it at ~2.8h (architect finding 2026-09-24).
+      const crossing = this._capUnbenchAt(account, q.unified5h, 'ses', now);
+      const retryAt = crossing ?? (q.unified5hReset || null);
+      return { cause: 'session_limit', retryAt, queueable: Boolean(retryAt) };
     }
 
     if (q.tokensLimit != null && q.tokensRemaining != null && q.tokensLimit > 0) {
@@ -4202,10 +4209,6 @@ export class AccountManager {
         // the restart AND the next `cc all` header re-send (the upsert guard).
         capUtilization: a.capUtilization ?? null,
         capMode: a.capMode ?? null,
-        capEffective: a.capUtilization == null ? null : {
-          ses: this._effectiveCap(a, 'ses'),
-          wk: this._effectiveCap(a, 'wk'),
-        },
       }));
   }
 
@@ -4420,10 +4423,6 @@ export class AccountManager {
         priority: a.priority,
         capUtilization: a.capUtilization ?? null,
         capMode: a.capMode ?? null,
-        capEffective: a.capUtilization == null ? null : {
-          ses: this._effectiveCap(a, 'ses'),
-          wk: this._effectiveCap(a, 'wk'),
-        },
         runtime: a.runtime,
         status: a.status,
         refreshDead: Boolean(a.refreshDead),

package/src/index.js

@@ -2113,14 +2113,25 @@ async function syncAccountsFromDisk(diskConfig, memConfig, accountManager) {
     // this a config-edit cap is stale until the next full reload).
     const diskCap = Number.isFinite(diskAcct.capUtilization) && diskAcct.capUtilization > 0 && diskAcct.capUtilization < 1
       ? diskAcct.capUtilization : null;
-    // The MODE rides along with the cap: a hand-edited config that adds/changes a cap
+    // The MODE and the two per-account OVERRIDES ride along with the cap: a hand
+    // edit to any of them must not sit stale until a restart (the staleness class
+    // this whole block exists to fix). a hand-edited config that adds/changes a cap
     // without naming a mode gets the dynamic default, exactly as a fresh load would —
     // otherwise a hot edit would silently produce a capped account with no mode, whose
     // effective cap is the floor forever (a fixed cap wearing the new feature's name).
+    // Same validation as boot (_capMode): a typo'd capMode must not fail open in
+    // silence on the hot path either — the boot path logs, so this does too.
+    if (diskCap != null && diskAcct.capMode != null && diskAcct.capMode !== 'fixed' && diskAcct.capMode !== 'dynamic') {
+      console.log(`[Maxpool] Ignoring unknown capMode ${JSON.stringify(diskAcct.capMode)} for "${mgr.name}" on hot sync — expected "fixed" or "dynamic"; using dynamic`);
+    }
     const diskMode = diskCap == null ? null : (diskAcct.capMode === 'fixed' ? 'fixed' : 'dynamic');
     if (mgr.capUtilization !== diskCap || mgr.capMode !== diskMode) {
       mgr.capUtilization = diskCap;
       mgr.capMode = diskMode;
+      const dCeil = Number.isFinite(diskAcct.capCeiling) && diskAcct.capCeiling > 0 && diskAcct.capCeiling < 1 ? diskAcct.capCeiling : null;
+      const dRamp = Number.isFinite(diskAcct.capRampStart) && diskAcct.capRampStart >= 0 && diskAcct.capRampStart < 1 ? diskAcct.capRampStart : null;
+      mgr.capCeiling = dCeil;
+      mgr.capRampStart = dRamp;
       console.log(`[Maxpool] Usage cap for "${mgr.name}" ${diskCap ? `set to ${Math.round(diskCap * 100)}% (${diskMode})` : 'removed'} from config`);
     }
     memConfig.accounts[memIdx] = { ...memConfig.accounts[memIdx], ...diskAcct };

package/src/server.js

@@ -1193,6 +1193,39 @@ async function forwardRequest(
       // the API's own stated rule, so no failover is needed and the user never sees the
       // 400. One-shot per request via its own flag so a second ordering 400 (a rule we
       // have not modeled) still surfaces honestly instead of looping.
+      // THE REPAIR'S OWN REJECTION (2026-09-25): some accounts' validators 400 the
+      // output_config FIELD ITSELF ("Extra inputs are not permitted") even though the
+      // ordering rule's own error text names it as the accepted form — a gradual
+      // rollout on Anthropic's side (max@dubner.io and mk@gomokka rejected it same-day
+      // while max@gomokka.com accepted the identical repaired body). When that happens,
+      // fall back to position-preserving re-anchoring instead of surfacing the 400.
+      const isDirectiveFormRejection = account.type !== 'provider'
+        && upstreamRes.status === 400
+        && /output_config[^:]*: *Extra inputs are not permitted/i.test(errorBody);
+      if (isDirectiveFormRejection && requestInfo.orderingRepaired && !requestInfo.orderingFallback && canRepairBody) {
+        // Rewrite every directive-only system (the repair's own output) as a PLAIN
+        // assistant turn carrying the directives text — ordinary history, accepted by
+        // every validator, nothing dropped. A system ENDING the array stays legal
+        // everywhere, so it is left alone.
+        const json = JSON.parse(body.toString('utf8'));
+        let folded = 0;
+        json.messages = (json.messages ?? []).map((m, i, arr) => {
+          if (m?.role !== 'system' || !('output_config' in m)) return m;
+          if (i === arr.length - 1) return m;   // end-of-array system is legal universally
+          folded++;
+          const text = String(m.output_config?.directives ?? '');
+          return { role: 'assistant', content: text ? [{ type: 'text', text }] : [{ type: 'text', text: '(system directive)' }] };
+        });
+        if (folded > 0) {
+          const fixedBody = Buffer.from(JSON.stringify(json));
+          console.log(`[Maxpool] Account rejects the directive-only form — folded ${folded} system directive(s) into plain turns`);
+          return forwardRequest(
+            req, res, fixedBody, accountManager, upstream, retryCount + 1, hooks, reqId, ctx, logDir,
+            retryConfig, queueConfig, { ...requestInfo, orderingFallback: true, repairCount: repairCount + 1 },
+            fixedBody.length <= retryConfig.maxRetryBufferBytes, canQueueBufferedBody, excludedIndexes,
+          );
+        }
+      }
       if (isOrderingRejection && !requestInfo.orderingRepaired && canRepairBody) {
         const coord = /messages\.(\d+)/.exec(errorBody);
         const { messages: fixedMessages, converted } = directiveOnlySystemMessages(
@@ -2144,9 +2177,16 @@ function directiveOnlySystemMessages(messages, coordIndex = -1) {
   };
   const out = messages.map((m, i) => {
     if (coordIndex >= 0 ? i !== coordIndex : !violates(i)) return m;
-    const text = (Array.isArray(m.content) ? m.content : [])
-      .map(b => (typeof b?.text === 'string' ? b.text : ''))
-      .filter(Boolean).join('\n');
+    // Content arrives BOTH ways: array-of-blocks (compaction boundaries) and a plain
+    // STRING (injected reminders — the common CLI shape). Reading only the array form
+    // silently DISCARDED every string system message's text: the directive went out
+    // empty AND some accounts 400 the emptied shape (measured 2026-09-25: directives ""
+    // -> "messages.6.output_config: Extra inputs are not permitted").
+    const text = typeof m.content === 'string'
+      ? m.content
+      : (Array.isArray(m.content) ? m.content : [])
+          .map(b => (typeof b?.text === 'string' ? b.text : ''))
+          .filter(Boolean).join('\n');
     converted++;
     // output_config shape per the API's own 400 text: directive-only system.
     return { role: 'system', content: [], output_config: { directives: text } };