maxpool 1.24.29 → 1.24.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.24.29",
+  "version": "1.24.30",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/prober.js

@@ -219,16 +219,23 @@ export class Prober {
    *  the backoff; the idempotent requestId keeps any overlapping attempt single-spend. */
   async _redeemZaiCard(account, act) {
     try {
-      const key = `${account.index}:${act.card.recordId}`;
+      const key = `${account.name}:${act.card.recordId}`;  // name, not index: index shifts on account removal
       const now = Date.now();
       const until = this._cardRetryUntil?.get(key);
       if (until && until > now) return;                 // still backing off
       const q = account.quota || {};
       this.log(`[reset-card] ${account.name}: redeeming ${act.resetType} card ${act.card.recordId} (${act.reason}; ses=${q.providerSes ?? '?'} wk=${q.providerWk ?? '?'})`);
-      const r = await this._withTimeout(redeemResetCard(account.credential, act.card.recordId, act.resetType, { grantType: act.card.grantType }));
+      let r = await this._withTimeout(redeemResetCard(account.credential, act.card.recordId, act.resetType, { grantType: act.card.grantType, accountKey: account.name }));
+      // grantType-less listing + "unavailable" is the exact 2026-10-22 outage shape; GLOBAL
+      // is the only grantType z.ai has ever issued and a wrong one answers 400 no-spend
+      // (measured, src/zai-reset-cards.js header) — so one fallback retry is safe.
+      if (!r?.ok && !act.card.grantType && /unavailable/i.test(r?.error || '')) {
+        r = await this._withTimeout(redeemResetCard(account.credential, act.card.recordId, act.resetType, { grantType: 'GLOBAL', accountKey: account.name }));
+      }
       if (r?.ok) {
         if (!this._cardRetryUntil) this._cardRetryUntil = new Map();
         this._cardRetryUntil.set(key, 0);               // success clears any backoff
+        this._cardTries?.set(key, 0);                   // ...and the failure count (red-team 2026-10-23)
         this.log(`[reset-card] ${account.name}: card ${act.card.recordId} redeemed`);
         if (this.am.applyResetCards) {
           const fresh = await this._withTimeout(listResetCards(account.credential));

package/src/zai-reset-cards.js

@@ -85,15 +85,19 @@ export async function listResetCards(token, { signal, fetchImpl = fetch } = {})
 }
 
 /** Deterministic requestId for a card: retries of the SAME redeem are idempotent
- *  server-side, so a network blip mid-redeem can never double-spend. */
-function requestIdFor(recordId) {
-  const h = createHash('sha256').update(`maxpool-zai-card-${recordId}`).digest('hex').slice(0, 24);
+ *  server-side, so a network blip mid-redeem can never double-spend. The account
+ *  key scopes it too — recordIds collide across z.ai accounts (card 9 on max+1 AND
+ *  glm4, 2026-10-23); z.ai idempotency measured per-account, but scoping keeps the
+ *  two accounts' keys distinct even if that assumption ever changes (red-team).
+ *  accountKey never changes semantics for a given account, so retries stay stable. */
+function requestIdFor(recordId, accountKey = '') {
+  const h = createHash('sha256').update(`maxpool-zai-card-${accountKey}-${recordId}`).digest('hex').slice(0, 24);
   return `maxpool-${h}`;
 }
 
 /** Redeem one card. NEVER retries on the wire here (the idempotency key makes a
  *  caller-level retry safe). Returns { ok:true, recordId } | { ok:false, error, code }. */
-export async function redeemResetCard(token, recordId, resetType, { grantType, signal, fetchImpl = fetch } = {}) {
+export async function redeemResetCard(token, recordId, resetType, { grantType, accountKey = '', signal, fetchImpl = fetch } = {}) {
   if (resetType !== 'WEEK' && resetType !== 'FIVE_HOUR') {
     return { ok: false, error: `invalid resetType ${resetType}` };
   }
@@ -105,7 +109,7 @@ export async function redeemResetCard(token, recordId, resetType, { grantType, s
     // grantType answers "Unsupported coupon grant type" without spending anything.
     const body = {
       recordId, targetType: 'PERSONAL', resetType,
-      requestId: requestIdFor(recordId),
+      requestId: requestIdFor(recordId, accountKey),
     };
     if (grantType) body.grantType = grantType;
     const res = await fetchImpl(USE_URL, {