maxpool 1.24.27 → 1.24.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.24.27",
+  "version": "1.24.29",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -327,6 +327,10 @@ const PERSISTED_QUOTA_FIELDS = [
   'providerQuotaSource', 'lastProbeOkAt',
 ];
 
+const PROVIDER_429_MIN_BENCH_SEC = 60;
+const PROVIDER_429_MAX_BENCH_SEC = 15 * 60;
+const PROVIDER_429_STREAK_FORGET_MS = 60 * 60 * 1000;
+
 function clampRetryAfterSeconds(value) {
   const n = Number(value);
   if (!Number.isFinite(n)) return 60;
@@ -845,6 +849,7 @@ export class AccountManager {
     if (outcome.success) {
       account.completedRequests++;
       account.consecutiveFailures = 0;
+      account.providerRateLimitStreak = 0;
       account.lastStatus = outcome.status || account.lastStatus;
       account.lastResponseMs = Date.now() - lease.startedAt;
       if (account.provisionalUpstreamFingerprint) {
@@ -3927,8 +3932,31 @@ export class AccountManager {
       return;
     }
 
+    // Provider "slow down" backoff (2026-10-21): z.ai answers a GLM 429 with a 3-12s
+    // hint, and honouring it re-selected the account seconds later — ~200 refusals on
+    // max+1 over 2026-10-16/17, then a z.ai usage-risk notice. Bench a provider 429
+    // for at least 60s, doubling per back-to-back 429 up to 15 min; a success resets
+    // the streak (releaseAccount). Claude accounts keep the exact retry-after.
+    // A parallel 429 landing while the account is already benched is the SAME refusal
+    // burst — it keeps the bench and does not escalate (red-team 2026-10-21: up to 50
+    // in-flight requests per account turned one burst into the 15-min cap). The streak
+    // also forgets after an hour with no refusals.
+    let benchSeconds = retryAfter;
+    if (account.type === 'provider' && (options.status || 429) === 429) {
+      const now = Date.now();
+      if (account.status === 'throttled' && account.rateLimitedUntil > now) {
+        benchSeconds = Math.max(retryAfter, Math.ceil((account.rateLimitedUntil - now) / 1000));
+      } else {
+        if (now - (account.providerRateLimitAt || 0) > PROVIDER_429_STREAK_FORGET_MS) account.providerRateLimitStreak = 0;
+        const streak = account.providerRateLimitStreak || 0;
+        benchSeconds = Math.max(retryAfter, Math.min(PROVIDER_429_MAX_BENCH_SEC, PROVIDER_429_MIN_BENCH_SEC * 2 ** streak));
+        account.providerRateLimitStreak = streak + 1;
+      }
+      account.providerRateLimitAt = now;
+    }
+
     account.status = 'throttled';
-    account.rateLimitedUntil = Date.now() + (retryAfter * 1000);
+    account.rateLimitedUntil = Date.now() + (benchSeconds * 1000);
     account.lastStatus = options.status || 429;
     account.lastError = 'rate_limited';
     account.lastErrorAt = Date.now();
@@ -3937,7 +3965,7 @@ export class AccountManager {
       account.failedRequests++;
       account.consecutiveFailures++;
     }
-    console.log(`[Maxpool] Account "${account.name}" rate limited for ${retryAfter}s`);
+    console.log(`[Maxpool] Account "${account.name}" rate limited for ${benchSeconds}s${benchSeconds > retryAfter ? ` (provider asked ${retryAfter}s; backing off)` : ''}`);
   }
 
   markAuthFailed(accountIndex, status = 403, reason = 'auth_failed') {

package/src/prober.js

@@ -211,20 +211,37 @@ export class Prober {
     } catch { /* best-effort; never let a probe throw */ }
   }
 
-  /** Execute a z.ai card redeem decided by the policy. Logs before/after. */
+  /** Execute a z.ai card redeem decided by the policy. Logs before/after.
+   *  A FAILED redeem backs off exponentially per card (15m, 30m, 1h, cap 6h):
+   *  2026-10-22/23, a z.ai API change made every redeem fail "unavailable" and the
+   *  2-minute poll retried the same card 519 times over 16h — the exact
+   *  rapid-retry shape z.ai's usage-risk notice flagged before. A success resets
+   *  the backoff; the idempotent requestId keeps any overlapping attempt single-spend. */
   async _redeemZaiCard(account, act) {
     try {
+      const key = `${account.index}:${act.card.recordId}`;
+      const now = Date.now();
+      const until = this._cardRetryUntil?.get(key);
+      if (until && until > now) return;                 // still backing off
       const q = account.quota || {};
       this.log(`[reset-card] ${account.name}: redeeming ${act.resetType} card ${act.card.recordId} (${act.reason}; ses=${q.providerSes ?? '?'} wk=${q.providerWk ?? '?'})`);
-      const r = await this._withTimeout(redeemResetCard(account.credential, act.card.recordId, act.resetType));
+      const r = await this._withTimeout(redeemResetCard(account.credential, act.card.recordId, act.resetType, { grantType: act.card.grantType }));
       if (r?.ok) {
+        if (!this._cardRetryUntil) this._cardRetryUntil = new Map();
+        this._cardRetryUntil.set(key, 0);               // success clears any backoff
         this.log(`[reset-card] ${account.name}: card ${act.card.recordId} redeemed`);
         if (this.am.applyResetCards) {
           const fresh = await this._withTimeout(listResetCards(account.credential));
           if (fresh) this.am.applyResetCards(account.index, fresh);
         }
       } else {
-        this.log(`[reset-card] ${account.name}: redeem FAILED card ${act.card.recordId}: ${r?.error}`);
+        const tries = (this._cardTries?.get(key) || 0) + 1;
+        if (!this._cardTries) this._cardTries = new Map();
+        this._cardTries.set(key, tries);
+        const waitMs = Math.min(6 * 3600_000, 900_000 * 2 ** (tries - 1));
+        if (!this._cardRetryUntil) this._cardRetryUntil = new Map();
+        this._cardRetryUntil.set(key, now + waitMs);
+        this.log(`[reset-card] ${account.name}: redeem FAILED card ${act.card.recordId} (try ${tries}, next attempt in ${Math.round(waitMs / 60000)}min): ${r?.error}`);
       }
     } catch (e) { this.log(`[reset-card] ${account.name}: redeem error ${e.message}`); }
   }

package/src/zai-reset-cards.js

@@ -44,7 +44,7 @@ export function parseCardExpiry(s) {
   return Date.UTC(+m[1], +m[2] - 1, +m[3], +m[4], +m[5], +m[6]) - 8 * 3600_000;
 }
 
-/** Normalize a raw card array -> [{recordId, expiresAt, expired}], available only. */
+/** Normalize a raw card array -> [{recordId, grantType, expiresAt, expired}], available only. */
 function normalizeCards(arr, now = Date.now()) {
   const out = [];
   for (const c of (Array.isArray(arr) ? arr : [])) {
@@ -52,7 +52,7 @@ function normalizeCards(arr, now = Date.now()) {
     const recordId = Number(c.recordId);
     if (!Number.isFinite(recordId)) continue;
     const expiresAt = parseCardExpiry(c.expireTime);
-    out.push({ recordId, expiresAt, expired: expiresAt != null && expiresAt <= now });
+    out.push({ recordId, grantType: typeof c.grantType === 'string' ? c.grantType : undefined, expiresAt, expired: expiresAt != null && expiresAt <= now });
   }
   // Soonest-expiring first — that's the one to spend first.
   out.sort((a, b) => (a.expiresAt ?? Infinity) - (b.expiresAt ?? Infinity));
@@ -61,10 +61,10 @@ function normalizeCards(arr, now = Date.now()) {
 
 /** List this account's available reset cards. Zero-spend read.
  *  Returns { fiveHour: [], weekly: [] } | { error }. */
-export async function listResetCards(token, { signal } = {}) {
+export async function listResetCards(token, { signal, fetchImpl = fetch } = {}) {
   if (!token) return { error: 'no token' };
   try {
-    const res = await fetch(LIST_URL, {
+    const res = await fetchImpl(LIST_URL, {
       headers: { 'Authorization': `Bearer ${token}`, 'Accept': 'application/json' },
       signal,
     });
@@ -93,19 +93,25 @@ function requestIdFor(recordId) {
 
 /** Redeem one card. NEVER retries on the wire here (the idempotency key makes a
  *  caller-level retry safe). Returns { ok:true, recordId } | { ok:false, error, code }. */
-export async function redeemResetCard(token, recordId, resetType, { signal } = {}) {
+export async function redeemResetCard(token, recordId, resetType, { grantType, signal, fetchImpl = fetch } = {}) {
   if (resetType !== 'WEEK' && resetType !== 'FIVE_HOUR') {
     return { ok: false, error: `invalid resetType ${resetType}` };
   }
   if (!Number.isFinite(recordId)) return { ok: false, error: 'invalid recordId' };
   try {
-    const res = await fetch(USE_URL, {
+    // grantType is REQUIRED (2026-10-23): z.ai started rejecting card redeems without
+    // it ("The specified reset attempt is unavailable") — their web UI sends
+    // {targetType, resetType, recordId, requestId, grantType:'GLOBAL'}. A bogus
+    // grantType answers "Unsupported coupon grant type" without spending anything.
+    const body = {
+      recordId, targetType: 'PERSONAL', resetType,
+      requestId: requestIdFor(recordId),
+    };
+    if (grantType) body.grantType = grantType;
+    const res = await fetchImpl(USE_URL, {
       method: 'POST',
       headers: { 'Authorization': `Bearer ${token}`, 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        recordId, targetType: 'PERSONAL', resetType,
-        requestId: requestIdFor(recordId),
-      }),
+      body: JSON.stringify(body),
       signal,
     });
     const data = await res.json().catch(() => null);