maxpool 1.24.28 → 1.24.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.24.28",
+  "version": "1.24.30",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/prober.js

@@ -211,20 +211,44 @@ export class Prober {
     } catch { /* best-effort; never let a probe throw */ }
   }
 
-  /** Execute a z.ai card redeem decided by the policy. Logs before/after. */
+  /** Execute a z.ai card redeem decided by the policy. Logs before/after.
+   *  A FAILED redeem backs off exponentially per card (15m, 30m, 1h, cap 6h):
+   *  2026-10-22/23, a z.ai API change made every redeem fail "unavailable" and the
+   *  2-minute poll retried the same card 519 times over 16h — the exact
+   *  rapid-retry shape z.ai's usage-risk notice flagged before. A success resets
+   *  the backoff; the idempotent requestId keeps any overlapping attempt single-spend. */
   async _redeemZaiCard(account, act) {
     try {
+      const key = `${account.name}:${act.card.recordId}`;  // name, not index: index shifts on account removal
+      const now = Date.now();
+      const until = this._cardRetryUntil?.get(key);
+      if (until && until > now) return;                 // still backing off
       const q = account.quota || {};
       this.log(`[reset-card] ${account.name}: redeeming ${act.resetType} card ${act.card.recordId} (${act.reason}; ses=${q.providerSes ?? '?'} wk=${q.providerWk ?? '?'})`);
-      const r = await this._withTimeout(redeemResetCard(account.credential, act.card.recordId, act.resetType));
+      let r = await this._withTimeout(redeemResetCard(account.credential, act.card.recordId, act.resetType, { grantType: act.card.grantType, accountKey: account.name }));
+      // grantType-less listing + "unavailable" is the exact 2026-10-22 outage shape; GLOBAL
+      // is the only grantType z.ai has ever issued and a wrong one answers 400 no-spend
+      // (measured, src/zai-reset-cards.js header) — so one fallback retry is safe.
+      if (!r?.ok && !act.card.grantType && /unavailable/i.test(r?.error || '')) {
+        r = await this._withTimeout(redeemResetCard(account.credential, act.card.recordId, act.resetType, { grantType: 'GLOBAL', accountKey: account.name }));
+      }
       if (r?.ok) {
+        if (!this._cardRetryUntil) this._cardRetryUntil = new Map();
+        this._cardRetryUntil.set(key, 0);               // success clears any backoff
+        this._cardTries?.set(key, 0);                   // ...and the failure count (red-team 2026-10-23)
         this.log(`[reset-card] ${account.name}: card ${act.card.recordId} redeemed`);
         if (this.am.applyResetCards) {
           const fresh = await this._withTimeout(listResetCards(account.credential));
           if (fresh) this.am.applyResetCards(account.index, fresh);
         }
       } else {
-        this.log(`[reset-card] ${account.name}: redeem FAILED card ${act.card.recordId}: ${r?.error}`);
+        const tries = (this._cardTries?.get(key) || 0) + 1;
+        if (!this._cardTries) this._cardTries = new Map();
+        this._cardTries.set(key, tries);
+        const waitMs = Math.min(6 * 3600_000, 900_000 * 2 ** (tries - 1));
+        if (!this._cardRetryUntil) this._cardRetryUntil = new Map();
+        this._cardRetryUntil.set(key, now + waitMs);
+        this.log(`[reset-card] ${account.name}: redeem FAILED card ${act.card.recordId} (try ${tries}, next attempt in ${Math.round(waitMs / 60000)}min): ${r?.error}`);
       }
     } catch (e) { this.log(`[reset-card] ${account.name}: redeem error ${e.message}`); }
   }

package/src/zai-reset-cards.js

@@ -44,7 +44,7 @@ export function parseCardExpiry(s) {
   return Date.UTC(+m[1], +m[2] - 1, +m[3], +m[4], +m[5], +m[6]) - 8 * 3600_000;
 }
 
-/** Normalize a raw card array -> [{recordId, expiresAt, expired}], available only. */
+/** Normalize a raw card array -> [{recordId, grantType, expiresAt, expired}], available only. */
 function normalizeCards(arr, now = Date.now()) {
   const out = [];
   for (const c of (Array.isArray(arr) ? arr : [])) {
@@ -52,7 +52,7 @@ function normalizeCards(arr, now = Date.now()) {
     const recordId = Number(c.recordId);
     if (!Number.isFinite(recordId)) continue;
     const expiresAt = parseCardExpiry(c.expireTime);
-    out.push({ recordId, expiresAt, expired: expiresAt != null && expiresAt <= now });
+    out.push({ recordId, grantType: typeof c.grantType === 'string' ? c.grantType : undefined, expiresAt, expired: expiresAt != null && expiresAt <= now });
   }
   // Soonest-expiring first — that's the one to spend first.
   out.sort((a, b) => (a.expiresAt ?? Infinity) - (b.expiresAt ?? Infinity));
@@ -61,10 +61,10 @@ function normalizeCards(arr, now = Date.now()) {
 
 /** List this account's available reset cards. Zero-spend read.
  *  Returns { fiveHour: [], weekly: [] } | { error }. */
-export async function listResetCards(token, { signal } = {}) {
+export async function listResetCards(token, { signal, fetchImpl = fetch } = {}) {
   if (!token) return { error: 'no token' };
   try {
-    const res = await fetch(LIST_URL, {
+    const res = await fetchImpl(LIST_URL, {
       headers: { 'Authorization': `Bearer ${token}`, 'Accept': 'application/json' },
       signal,
     });
@@ -85,27 +85,37 @@ export async function listResetCards(token, { signal } = {}) {
 }
 
 /** Deterministic requestId for a card: retries of the SAME redeem are idempotent
- *  server-side, so a network blip mid-redeem can never double-spend. */
-function requestIdFor(recordId) {
-  const h = createHash('sha256').update(`maxpool-zai-card-${recordId}`).digest('hex').slice(0, 24);
+ *  server-side, so a network blip mid-redeem can never double-spend. The account
+ *  key scopes it too — recordIds collide across z.ai accounts (card 9 on max+1 AND
+ *  glm4, 2026-10-23); z.ai idempotency measured per-account, but scoping keeps the
+ *  two accounts' keys distinct even if that assumption ever changes (red-team).
+ *  accountKey never changes semantics for a given account, so retries stay stable. */
+function requestIdFor(recordId, accountKey = '') {
+  const h = createHash('sha256').update(`maxpool-zai-card-${accountKey}-${recordId}`).digest('hex').slice(0, 24);
   return `maxpool-${h}`;
 }
 
 /** Redeem one card. NEVER retries on the wire here (the idempotency key makes a
  *  caller-level retry safe). Returns { ok:true, recordId } | { ok:false, error, code }. */
-export async function redeemResetCard(token, recordId, resetType, { signal } = {}) {
+export async function redeemResetCard(token, recordId, resetType, { grantType, accountKey = '', signal, fetchImpl = fetch } = {}) {
   if (resetType !== 'WEEK' && resetType !== 'FIVE_HOUR') {
     return { ok: false, error: `invalid resetType ${resetType}` };
   }
   if (!Number.isFinite(recordId)) return { ok: false, error: 'invalid recordId' };
   try {
-    const res = await fetch(USE_URL, {
+    // grantType is REQUIRED (2026-10-23): z.ai started rejecting card redeems without
+    // it ("The specified reset attempt is unavailable") — their web UI sends
+    // {targetType, resetType, recordId, requestId, grantType:'GLOBAL'}. A bogus
+    // grantType answers "Unsupported coupon grant type" without spending anything.
+    const body = {
+      recordId, targetType: 'PERSONAL', resetType,
+      requestId: requestIdFor(recordId, accountKey),
+    };
+    if (grantType) body.grantType = grantType;
+    const res = await fetchImpl(USE_URL, {
       method: 'POST',
       headers: { 'Authorization': `Bearer ${token}`, 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        recordId, targetType: 'PERSONAL', resetType,
-        requestId: requestIdFor(recordId),
-      }),
+      body: JSON.stringify(body),
       signal,
     });
     const data = await res.json().catch(() => null);