maxpool 1.24.26 → 1.24.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.24.26",
+  "version": "1.24.28",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -327,6 +327,10 @@ const PERSISTED_QUOTA_FIELDS = [
   'providerQuotaSource', 'lastProbeOkAt',
 ];
 
+const PROVIDER_429_MIN_BENCH_SEC = 60;
+const PROVIDER_429_MAX_BENCH_SEC = 15 * 60;
+const PROVIDER_429_STREAK_FORGET_MS = 60 * 60 * 1000;
+
 function clampRetryAfterSeconds(value) {
   const n = Number(value);
   if (!Number.isFinite(n)) return 60;
@@ -845,6 +849,7 @@ export class AccountManager {
     if (outcome.success) {
       account.completedRequests++;
       account.consecutiveFailures = 0;
+      account.providerRateLimitStreak = 0;
       account.lastStatus = outcome.status || account.lastStatus;
       account.lastResponseMs = Date.now() - lease.startedAt;
       if (account.provisionalUpstreamFingerprint) {
@@ -3927,8 +3932,31 @@ export class AccountManager {
       return;
     }
 
+    // Provider "slow down" backoff (2026-10-21): z.ai answers a GLM 429 with a 3-12s
+    // hint, and honouring it re-selected the account seconds later — ~200 refusals on
+    // max+1 over 2026-10-16/17, then a z.ai usage-risk notice. Bench a provider 429
+    // for at least 60s, doubling per back-to-back 429 up to 15 min; a success resets
+    // the streak (releaseAccount). Claude accounts keep the exact retry-after.
+    // A parallel 429 landing while the account is already benched is the SAME refusal
+    // burst — it keeps the bench and does not escalate (red-team 2026-10-21: up to 50
+    // in-flight requests per account turned one burst into the 15-min cap). The streak
+    // also forgets after an hour with no refusals.
+    let benchSeconds = retryAfter;
+    if (account.type === 'provider' && (options.status || 429) === 429) {
+      const now = Date.now();
+      if (account.status === 'throttled' && account.rateLimitedUntil > now) {
+        benchSeconds = Math.max(retryAfter, Math.ceil((account.rateLimitedUntil - now) / 1000));
+      } else {
+        if (now - (account.providerRateLimitAt || 0) > PROVIDER_429_STREAK_FORGET_MS) account.providerRateLimitStreak = 0;
+        const streak = account.providerRateLimitStreak || 0;
+        benchSeconds = Math.max(retryAfter, Math.min(PROVIDER_429_MAX_BENCH_SEC, PROVIDER_429_MIN_BENCH_SEC * 2 ** streak));
+        account.providerRateLimitStreak = streak + 1;
+      }
+      account.providerRateLimitAt = now;
+    }
+
     account.status = 'throttled';
-    account.rateLimitedUntil = Date.now() + (retryAfter * 1000);
+    account.rateLimitedUntil = Date.now() + (benchSeconds * 1000);
     account.lastStatus = options.status || 429;
     account.lastError = 'rate_limited';
     account.lastErrorAt = Date.now();
@@ -3937,7 +3965,7 @@ export class AccountManager {
       account.failedRequests++;
       account.consecutiveFailures++;
     }
-    console.log(`[Maxpool] Account "${account.name}" rate limited for ${retryAfter}s`);
+    console.log(`[Maxpool] Account "${account.name}" rate limited for ${benchSeconds}s${benchSeconds > retryAfter ? ` (provider asked ${retryAfter}s; backing off)` : ''}`);
   }
 
   markAuthFailed(accountIndex, status = 403, reason = 'auth_failed') {

package/src/capacity-ledger.js

@@ -280,6 +280,7 @@ export class CapacityLedger {
       // (we only counted the tokens that flowed through maxpool, while the vendor's
       // percentage counts everything). Dropping it here made every tank read "bounded".
       ...(open.windowStartedAt != null ? { windowStartedAt: open.windowStartedAt } : {}),
+      ...(open.peakReset ? { spansRefill: true } : {}),
       resetAt,
     });
     if (rec[window].closed.length > MAX_CYCLES_PER_WINDOW) rec[window].closed.shift();
@@ -361,10 +362,19 @@ export class CapacityLedger {
       if (!open) continue;
       // PEAK: fullness only rises inside one window, so the highest reading a cycle
       // saw is its closing fullness (closeCycle prefers it over a later, lower one).
-      if (!Number.isFinite(open.peakUtilization) || m.utilization > open.peakUtilization) {
-        open.peakUtilization = Math.min(1, m.utilization);
-      }
       if (!(m.utilization < 1)) continue;
+      // A reading of 1.0 is the wall (throttled), not a fullness — the same reason
+      // estimateFromUtilization refuses u>=1 — so it never becomes the peak.
+      // A reading BELOW the peak by >=10pp means the tank was refilled under this
+      // open cycle (a redeemed reset, or a rollover whose stamp arrived late): the
+      // old peak no longer describes this window, so it is dropped rather than
+      // left to divide the new window's tokens (red-team 2026-10-13, finding 2).
+      if (Number.isFinite(open.peakUtilization) && open.peakUtilization - m.utilization >= 0.10) {
+        open.peakUtilization = m.utilization;
+        open.peakReset = true;
+      } else if (!Number.isFinite(open.peakUtilization) || m.utilization > open.peakUtilization) {
+        open.peakUtilization = m.utilization;
+      }
       const key = `${m.name}:${m.window}`;
       const prev = this._utilMarks.get(key);
       // Keep the OLDEST usable mark within this cycle: a wider span means a larger
@@ -452,6 +462,8 @@ export class CapacityLedger {
     const closed = (rec?.[window]?.closed || []).filter(c =>
       !c.disabledDuring
       && c.partialReason !== 'pre-v3-unverified'
+      && c.partialReason !== 'no-weekly-plan'
+      && !c.spansRefill
       && (c.endedAt - c.startedAt) >= floor - 1_000
       // CEILING: a cycle far longer than its window swallowed a rollover it never
       // saw — two tanks' tokens over one tank's percentage (see WINDOW_CEIL_FACTOR).
@@ -471,10 +483,12 @@ export class CapacityLedger {
     // floor rather than being thrown away — discarding left an account whose
     // every reading was contaminated with NOTHING to show. After a plan
     // downgrade the floor over-states until old cycles age out — conservative.
-    // The floor's own base uses the complete windows only — a partial cycle's
-    // tokens may end mid-window, understating a single delivery.
-    const maxDelivered = closed.filter(c => c.complete)
-      .reduce((m, c) => Math.max(m, c.tokens), 0);
+    // The floor is taken over EVERY admitted cycle, partial ones included: a
+    // partial cycle's token count is still tokens the vendor really delivered,
+    // so it is still a hard lower bound on the tank. Restricting it to complete
+    // cycles left it inert on weekly history, where nearly every cycle is partial
+    // (red-team 2026-10-13, finding 4).
+    const maxDelivered = closed.reduce((m, c) => Math.max(m, c.tokens), 0);
     const usable = closed.filter(c =>
       Number.isFinite(c.finalUtilization) && c.finalUtilization >= TANK_MIN_UTIL);
     if (!usable.length) return null;

package/src/tui.js

@@ -1254,11 +1254,12 @@ export class TUI {
         this.mode = 'input';
         // Plain-English prompt (owner 2026-10-13: "I'm not sure how does this work.
         // I want to keep the dynamic floor, but I also want to raise the basic cap").
-        // Type just a number = the dynamic cap's STARTING level (it holds the account
-        // to NN% early in each window, then rises toward ~95% as the window nears
-        // its reset, so unused capacity isn't stranded). fNN = fixed wall (no rise).
-        // 0 = no cap.
-        this.inputPrompt = `Usage cap for "${current}" — type a % like 75: the account stays free until it hits that, then unlocks gradually as the window refills (dynamic). f75 = never unlock early (fixed). 0 = remove. Now ${nowLabel}`;
+        // Type just a number = the dynamic cap's STARTING level: routing USES the
+        // account up to NN% of each window, and the allowance rises toward the
+        // switch threshold as the window nears its reset (by elapsed time —
+        // _effectiveCap), so unused capacity isn't stranded. fNN = fixed stop at NN%.
+        // 0 / off = no cap. Kept short: the typed value must stay on an 80-col line.
+        this.inputPrompt = `Cap ${current}, now ${nowLabel}. 75=use to 75%+rises near reset f75=hard 0=off`;
         this.inputBuf = '';
         this.inputSensitive = false;
         this.inputCb = value => this._doSetCap(targetIdx, String(value || '').trim());
@@ -2509,8 +2510,9 @@ export class TUI {
       const prov = gray(providerLabel(a).padEnd(PROVIDER_W));
 
       // The no-weekly plan has NO weekly window to complete — its weekly "capacity" is
-      // derived: avg session tank × 33.6 (the number of 5h windows in 7 days). Shown as
-      // ≈ to mark the derivation; N is the count of session cycles it rests on.
+      // derived: avg session tank × 33.6 (the number of 5h windows in 7 days). Shown
+      // without a marker (owner 2026-08-26: the row's text states the derivation);
+      // N is the count of session cycles it rests on.
       if (win === 'wk' && a.type === 'provider' && a.quota?.weeklyAbsent) {
         const sesTank = this.am.capacityTank?.(i, 'ses');
         const approx = sesTank && sesTank.n > 0
@@ -2645,8 +2647,23 @@ export class TUI {
               : 'delete';
         return ` ${dim('↑↓')} select  ${bold('Enter')} ${act}  ${bold('Esc')} cancel`;
       }
-      case 'input':
-        return ` ${this.inputPrompt}: ${this.inputSensitive ? '•'.repeat(this.inputBuf.length) : this.inputBuf}█`;
+      case 'input': {
+        // The typed value and the cursor are the whole point of this line — they are
+        // NEVER truncated. On a narrow terminal the PROMPT gives way instead, keeping
+        // its last words (nearest the value). Red-team 2026-10-13: the long cap
+        // prompt pushed the input off a 200-column terminal entirely.
+        const shown = this.inputSensitive ? '•'.repeat(this.inputBuf.length) : this.inputBuf;
+        const full = ` ${this.inputPrompt}: ${shown}█`;
+        const visible = full.replace(ANSI_RE, '');
+        const budget = (process.stdout.columns || 80) - 2;
+        if (visible.length <= budget) return full;
+        const keep = Math.max(0, budget - (shown.length + 2)); // ' …' + value + cursor
+        const cut = visible.length - budget;
+        const trimmed = this.inputPrompt.length > cut + 1
+          ? this.inputPrompt.slice(0, Math.max(1, keep - 1)) + '…'
+          : this.inputPrompt;
+        return ` ${trimmed}: ${shown}█`;
+      }
       case 'confirm':
         return ` ${bold(this.confirmTitle)}  ${bold('y')} Yes  ${bold('n')} No`;
       default: