maxpool 1.24.14 → 1.24.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.24.14",
+  "version": "1.24.16",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -777,6 +777,15 @@ async function serverWorkerCommand() {
       }, 5 * 60_000);
       secretTimer.unref?.();
     }
+    // Key rotation: a new secret version reaches the live pool within 30 min.
+    const { refreshRotatedProviders } = await import('./secret-resolver.js');
+    const rotateTimer = setInterval(async () => {
+      try {
+        const n = await refreshRotatedProviders(accountManager.accounts);
+        if (n) console.log(`[Maxpool] Key rotation: ${n} provider key(s) updated from Secret Manager`);
+      } catch { /* next tick */ }
+    }, 30 * 60_000);
+    rotateTimer.unref?.();
   }
 
   // Seed the running version immediately so the TUI header always shows it, even

package/src/secret-resolver.js

@@ -199,6 +199,28 @@ export function pendingProviders(accounts) {
   return accounts.filter(a => a.configSourced && a.type === 'provider' && a.secretName && !a.credential);
 }
 
+/**
+ * Pick up ROTATED keys. A key resolves once at startup, so a new secret version (a
+ * key swap in Secret Manager) stayed invisible until the next restart — the pool kept
+ * calling with the old key (2026-10-09: all six z.ai keys moved to the account's
+ * "zcode-api-key", which is the only key z.ai issues reset cards for). Re-reads every
+ * loaded provider's secret, bypassing the local cache, and swaps `credential` when the
+ * value changed. A failed read keeps the current key. Returns the number swapped.
+ */
+export async function refreshRotatedProviders(accounts, resolve = (names) => resolveSecrets(names, { useCache: false })) {
+  const loaded = accounts.filter(a => a.configSourced && a.type === 'provider' && a.secretName && a.credential);
+  if (!loaded.length) return 0;
+  const resolved = await resolve([...new Set(loaded.map(a => a.secretName))]);
+  let swapped = 0;
+  for (const a of loaded) {
+    const tok = resolved[a.secretName];
+    if (!tok || tok === a.credential) continue;
+    a.credential = tok;
+    swapped++;
+  }
+  return swapped;
+}
+
 export async function reresolveProviders(accounts, resolve = resolveSecrets) {
   const pending = pendingProviders(accounts);
   if (!pending.length) return 0;

package/src/server.js

@@ -1709,7 +1709,7 @@ function formatRetryDuration(seconds) {
 function computeQueueWindowMs({
   cause, stream, retryPlanCause,
   maxWaitMs, capacityMaxWaitMs, nonStreamMaxWaitMs, streamHoldMaxMs, streamClientToleranceMs,
-  isCountTokens, countTokensMaxWaitMs, networkMaxWaitMs,
+  isCountTokens, countTokensMaxWaitMs,
 }) {
   let windowMs;
   if (!stream) {
@@ -2649,9 +2649,6 @@ async function queueAndRetry(
   const streamClientToleranceMs = Number.isFinite(requestInfo.clientToleranceMs)
     ? requestInfo.clientToleranceMs
     : Math.max(0, Number(queueConfig.streamClientToleranceMs) || 0);
-  const networkMaxWaitMs = queueConfig.networkMaxWaitMs == null
-    ? 2 * 60 * 1000
-    : Math.max(0, Number(queueConfig.networkMaxWaitMs) || 0);
   const queueWindowMs = computeQueueWindowMs({
     cause,
     stream: Boolean(requestInfo.stream),
@@ -2659,7 +2656,6 @@ async function queueAndRetry(
     maxWaitMs,
     capacityMaxWaitMs,
     nonStreamMaxWaitMs,
-    networkMaxWaitMs,
     streamHoldMaxMs,
     streamClientToleranceMs,
     isCountTokens: Boolean(requestInfo.isCountTokens),