maxpool 1.24.31 → 1.24.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.24.31",
+  "version": "1.24.33",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -1,4 +1,5 @@
 import { refreshAccessToken, isTokenExpiringSoon, modelFamily, tokenFingerprint } from './oauth.js';
+import { hourFloor } from './outside-usage.js';
 import { CapacityLedger, TANK_MIN_UTIL } from './capacity-ledger.js';
 
 // Nominal window length per kind — mirrors capacity-ledger's WINDOW_MS (kept here as a
@@ -464,6 +465,7 @@ export class AccountManager {
       else this.scheduler.routingMode = 'sticky';
     }
     this._refreshAccessToken = dependencies.refreshAccessToken || refreshAccessToken;
+    this.poolUpSince = Date.now();
     this.accounts = accounts.map((acct, index) => ({
       index,
       name: acct.name,
@@ -785,6 +787,19 @@ export class AccountManager {
     }));
   }
 
+  /** OUTSIDE-USAGE (2026-10-27): count every request the pool sends on a provider
+   *  account, per UTC hour — the pool half of the outside-usage comparison. The
+   *  map is bounded (last 25 hours) and in-memory only. */
+  notePoolSend(account, at = Date.now()) {
+    if (!account || account.type !== 'provider') return;
+    account.poolHourly ||= new Map();
+    const h = hourFloor(at);
+    account.poolHourly.set(h, (account.poolHourly.get(h) || 0) + 1);
+    if (account.poolHourly.size > 25) {
+      for (const k of [...account.poolHourly.keys()].sort().slice(0, account.poolHourly.size - 25)) account.poolHourly.delete(k);
+    }
+  }
+
   acquireAccount(requestInfo = {}, excludedIndexes = new Set()) {
     this._noteRequestPolicy(requestInfo);
     // Capture the session's prior account BEFORE selection, so the caller can tell
@@ -806,6 +821,7 @@ export class AccountManager {
     account.inFlight++;
     account.activeWeight += weight;
     account.lastUsedAt = Date.now();
+    this.notePoolSend(account);
     // Non-null only when this acquire moved the session off its prior account.
     const migratedFromName = (prevCurrentName && account.name !== prevCurrentName) ? prevCurrentName : null;
     return { account, weight, startedAt: Date.now(), upstreamThrottleProbe, migratedFromName };
@@ -4499,7 +4515,12 @@ export class AccountManager {
     return this.accounts.map(a => {
       const quota = {};
       for (const f of PERSISTED_QUOTA_FIELDS) quota[f] = a.quota[f];
-      return { accountUuid: a.accountUuid, name: a.name, quota };
+      const out = { accountUuid: a.accountUuid, name: a.name, quota };
+      // OUTSIDE-USAGE flag survives restart (red-team R1.2): a restart is exactly
+      // when a leak's cards are most at risk — remediation rotates keys and
+      // restarts the pool, and the in-memory flag would vanish mid-remediation.
+      if (a.outsideUsage?.outside) out.outsideUsage = { ...a.outsideUsage };
+      return out;
     });
   }
 
@@ -4533,6 +4554,12 @@ export class AccountManager {
       }
       // We already know this account's weekly window, so it isn't "probing".
       if (account.quota.unified7dReset != null) account.probing = false;
+      // OUTSIDE-USAGE restored: keep holding R7 and force the next sweep to
+      // re-verify immediately (fresh poolHourly can only re-prove the leak).
+      if (match.outsideUsage?.outside) {
+        account.outsideUsage = { ...match.outsideUsage, stale: true };
+        account._outsideCheckedAt = 0;
+      }
     }
   }
 
@@ -4592,6 +4619,7 @@ export class AccountManager {
           ? new Date(Math.max(a.cooldownUntil || 0, a.provisionalUpstreamUntil || 0)).toISOString()
           : null,
         quota: { ...a.quota },
+        outsideUsage: a.outsideUsage ? { ...a.outsideUsage } : null,
         weekly: {
           state: this._weeklyState(a),
           rawState: this._weeklyRawState(a),

package/src/outside-usage.js

@@ -0,0 +1,88 @@
+// OUTSIDE-USAGE DETECTOR (2026-10-27).
+//
+// The pool knows every request IT sends per account; z.ai counts EVERY request
+// against the account, including ones sent by anyone else holding the same API
+// key. From 2026-08-10 to 2026-10-26 an outside holder of max+1's key burned its
+// weekly quota and all three reset cards (final week: 45,155 z.ai calls vs 1,682
+// pool sends) and nothing in the pool could see it — the owner spotted it by
+// accident. This module compares, per account, z.ai's hourly call counts (monitor
+// API, zero-spend) with the pool's own hourly sends, over the complete hours the
+// pool has been running, and flags when the outside share dominates.
+//
+// Why REQUESTS per HOUR, not tokens per day: the pool's token ledger excludes
+// cached input that z.ai bills, so even a clean account reads ~200x apart on
+// tokens (measured: glm1 3.43B z.ai vs 15.6M ledger). Request counts on a clean
+// account agree to ~1.1x (glm1, 2026-10-23..27). Counting only hours the pool was
+// up means a restart or an update cutover can never manufacture a false alarm.
+//
+// z.ai's monitor labels hours in UTC+8 ("2026-10-24 12:00" = 04:00Z).
+//
+// Operating limits (red-team 2026-10-27, accepted):
+// - ONE pool per key. A second maxpool sending on the same key IS outside traffic
+//   to this one and would trip the flag on both — share keys by giving each
+//   person their own account (the registry rule), not by running two pools.
+// - z.ai only. Kimi exposes no per-hour call monitor; its keys are single-holder.
+// - Detection, not prevention: a leak under 3x the pool's own volume, or one that
+//   started before the pool booted and has not yet produced 50 calls in complete
+//   hours since, is not flagged. The key-literal guard test and per-person keys
+//   are the prevention.
+// - Failure is fail-SAFE: an unreadable/malformed monitor reply never clears a
+//   flag (it marks the reading stale, R7 keeps holding, the next sweep retries);
+//   the flag persists across restarts. Only a well-formed reading clears it.
+
+export const OUTSIDE_FACTOR = 3;          // z.ai > 3x pool over the window = outside traffic
+export const OUTSIDE_MIN_CALLS = 50;      // below this the window is noise
+export const OUTSIDE_WINDOW_HOURS = 24;   // compare at most the last 24 complete hours
+export const OUTSIDE_CHECK_MS = 60 * 60_000; // re-check each account hourly
+const HOUR = 3600_000;
+const ZAI_TZ_OFFSET_MS = 8 * HOUR;
+
+export const hourFloor = (ms) => Math.floor(ms / HOUR) * HOUR;
+
+/** A z.ai model-usage payload we can trust: parallel non-empty arrays. A
+ *  malformed/partial payload is treated as a FAILED read (never as "zero calls"),
+ *  while a well-formed all-zero payload is real data — that is what lets a flag
+ *  clear after the key is rotated and the outside traffic stops. */
+export function isUsableZaiUsage(data) {
+  const xs = data?.x_time, cs = data?.modelCallCount;
+  return Array.isArray(xs) && Array.isArray(cs) && xs.length > 0 && xs.length === cs.length;
+}
+
+/** z.ai model-usage `data` ({x_time:["YYYY-MM-DD HH:mm"...], modelCallCount:[...]})
+ *  → Map(utcHourStartMs → calls). Unparseable rows are skipped. */
+export function zaiHourlyCalls(data) {
+  const out = new Map();
+  const xs = data?.x_time, cs = data?.modelCallCount;
+  if (!Array.isArray(xs) || !Array.isArray(cs)) return out;
+  for (let i = 0; i < xs.length; i++) {
+    const m = /^(\d{4})-(\d{2})-(\d{2}) (\d{2}):(\d{2})$/.exec(String(xs[i]));
+    if (!m) continue;
+    const labelAsUtc = Date.UTC(+m[1], +m[2] - 1, +m[3], +m[4], +m[5]);
+    // Floor to the hour: z.ai labels are hour-aligned today, but folding a finer
+    // bucket (":30", a summary row) into its hour is correct either way, while
+    // keying on the raw label would silently DROP it (hourFloor lookups miss) and
+    // read a leaking account as 0.
+    const utc = Math.floor((labelAsUtc - ZAI_TZ_OFFSET_MS) / HOUR) * HOUR;
+    const c = Number(cs[i]) || 0;
+    out.set(utc, (out.get(utc) || 0) + c);
+  }
+  return out;
+}
+
+/** Compare z.ai's and the pool's hourly counts over the complete hours in
+ *  [max(poolUpSince ceiled to the next hour, now - window), floor(now)).
+ *  Returns {hours, zaiCalls, poolCalls, outside, from, to}; hours=0 when no
+ *  complete hour is comparable yet (then outside is always false). */
+export function compareOutsideUsage(zaiHours, poolHours, { now, poolUpSince, factor = OUTSIDE_FACTOR, minCalls = OUTSIDE_MIN_CALLS, windowHours = OUTSIDE_WINDOW_HOURS } = {}) {
+  const to = hourFloor(now);
+  const upFrom = Math.ceil(poolUpSince / HOUR) * HOUR;   // first hour the pool saw in full
+  const from = Math.max(upFrom, to - windowHours * HOUR);
+  let zaiCalls = 0, poolCalls = 0, hours = 0;
+  for (let h = from; h < to; h += HOUR) {
+    hours++;
+    zaiCalls += zaiHours?.get(h) || 0;
+    poolCalls += poolHours?.get(h) || 0;
+  }
+  const outside = hours > 0 && zaiCalls >= minCalls && zaiCalls > poolCalls * factor;
+  return { hours, zaiCalls, poolCalls, outside, from, to };
+}

package/src/prober.js

@@ -8,16 +8,17 @@
 // This is the one sanctioned active-upstream feature; the proxy is otherwise passive.
 
 import { fetchUsage, fetchProviderUsage } from './oauth.js';
-import { listResetCards, redeemResetCard } from './zai-reset-cards.js';
+import { listResetCards, redeemResetCard, fetchZaiModelUsage } from './zai-reset-cards.js';
 import { listResetGrants, claimResetGrant } from './claude-reset-grants.js';
 import { decideZai, decideClaude } from './reset-policy.js';
+import { zaiHourlyCalls, compareOutsideUsage, isUsableZaiUsage, OUTSIDE_CHECK_MS } from './outside-usage.js';
 
 // How often a subscription-latched account is rechecked (one probe + at most one
 // token refresh per window — cheap, and bounded so a truly canceled plan isn't hammered).
 export const SUB_RECHECK_MS = 30 * 60_000;
 
 export class Prober {
-  constructor(accountManager, { intervalMs = 0, probeFn = fetchUsage, providerProbeFn = fetchProviderUsage, grantsFn = listResetGrants, timeoutMs = 10_000, log = console.log, usageGapMs = null } = {}) {
+  constructor(accountManager, { intervalMs = 0, probeFn = fetchUsage, providerProbeFn = fetchProviderUsage, grantsFn = listResetGrants, timeoutMs = 10_000, log = console.log, usageGapMs = null, zaiUsageFn = fetchZaiModelUsage, cardsFn = listResetCards, now = Date.now } = {}) {
     this.am = accountManager;
     // Injectable like probeFn: the default hits api.anthropic.com, so a harness that
     // doesn't stub it makes a REAL network call per oauth sweep (a test then passes
@@ -38,6 +39,9 @@ export class Prober {
     this._stopping = false;
     this._pendingSleep = null;    // canceller for an in-flight pacing sleep
     this._sweepStart = 0;         // rotates the per-sweep start account (fairness)
+    this.zaiUsageFn = zaiUsageFn; // z.ai hourly model-usage fetch (outside-usage detector)
+    this.cardsFn = cardsFn;       // reset-card listing, injectable like the others
+    this._now = now;              // clock (tests inject; defaults to the real one)
   }
 
   start() {
@@ -190,6 +194,7 @@ export class Prober {
       const usage = await this._withTimeout(this.providerProbeFn(account));
       if (!usage) return; // timed out — try again next cycle
       this.am.applyProviderUsage(account.index, usage);
+      await this._checkOutsideUsage(account);
       // Reset cards piggyback on the same poll cycle (z.ai only; zero-spend read).
       // Failures are swallowed on purpose: cards are an enhancement, never a probe
       // health signal — a card-list 401 must not turn the quota bars stale.
@@ -199,7 +204,7 @@ export class Prober {
       if (account.enabled !== false && account.credential) {
         if (account.provider === 'zai' && this.am.applyResetCards) {
           try {
-            const cards = await this._withTimeout(listResetCards(account.credential));
+            const cards = await this._withTimeout(this.cardsFn(account.credential));
             if (cards) {
               this.am.applyResetCards(account.index, cards);
               const act = decideZai(account, cards);
@@ -211,6 +216,40 @@ export class Prober {
     } catch { /* best-effort; never let a probe throw */ }
   }
 
+  /** OUTSIDE-USAGE DETECTOR (2026-10-27), hourly per account: fetch z.ai's own
+   *  hourly model-call counts for the account and compare with what the pool sent
+   *  in the same complete hours. A divergent account (key used by someone else —
+   *  measured 2026-08-10→10-26: 45,155 outside calls on max+1) is recorded on the
+   *  account (reset-card policy R7 refuses to feed it) and logged ONCE per
+   *  transition, never per sweep. Disabled accounts are never checked: someone
+   *  else legitimately using the key is WHY the account is benched. */
+  async _checkOutsideUsage(account, now = this._now()) {
+    try {
+      if (account.provider !== 'zai' || !account.credential || account.enabled === false) return;
+      const last = account._outsideCheckedAt || 0;
+      if (now - last < OUTSIDE_CHECK_MS) return;
+      const data = await this._withTimeout(this.zaiUsageFn(account.credential, { now }));
+      if (!isUsableZaiUsage(data)) {
+        // FAILED or malformed read. Never downgrade a true flag on missing data (red-team R1.1:
+        // one 5xx un-protected a known leak and the SAME sweep redeemed a card into
+        // it). Keep the reading, mark it stale (R7 still holds), and RETRY next
+        // sweep — the hourly slot is only consumed by a successful read.
+        const prev = account.outsideUsage;
+        if (prev) account.outsideUsage = { ...prev, stale: true, checkedAt: now };
+        return;
+      }
+      account._outsideCheckedAt = now;          // stamp AFTER success (R1.5)
+      const zai = zaiHourlyCalls(data);
+      const res = compareOutsideUsage(zai, account.poolHourly, { now, poolUpSince: this.am.poolUpSince });
+      const prev = account.outsideUsage;
+      const wasOutside = Boolean(prev?.outside);
+      account.outsideUsage = { ...res, checkedAt: now };
+      if (res.outside && !wasOutside) {
+        this.log(`[outside-usage] ${account.name}: z.ai counted ${res.zaiCalls} calls in the last ${res.hours}h but the pool sent ${res.poolCalls} — someone else holds this key; reset cards held`);
+      }
+    } catch { /* detector is best-effort; never block the probe */ }
+  }
+
   /** Execute a z.ai card redeem decided by the policy. Logs before/after.
    *  A FAILED redeem backs off exponentially per card (15m, 30m, 1h, cap 6h):
    *  2026-10-22/23, a z.ai API change made every redeem fail "unavailable" and the

package/src/reset-policy.js

@@ -58,6 +58,7 @@ function msLeft(t, now) { return t == null ? Infinity : t - now; }
 export function decideZai(account, cards, now = Date.now()) {
   if (account?.enabled === false) return null;               // R0
   if (!cards || cards.error) return null;
+  if (account?.outsideUsage?.outside) return null;          // R7: key used by someone else — a card would feed the leak
   const q = account.quota || {};
   const ses = q.providerSes ?? null;
   const wk = q.weeklyAbsent ? null : (q.providerWk ?? null);
@@ -71,6 +72,7 @@ export function decideZai(account, cards, now = Date.now()) {
 
   const weeklyCard = weeklyCards[0] || null;
   const sesCard = sesCards[0] || null;
+  let weeklyHeld = false; // R6: weekly card HELD for the free refill (5h branch may still fire)
 
   // --- weekly card: clears BOTH windows (z.ai docs; measured: glm1 100%->0% both)
   if (weeklyCard) {
@@ -81,20 +83,24 @@ export function decideZai(account, cards, now = Date.now()) {
     if (atWall || dying) {
       // R6: a wall redeem waits when the FREE weekly refill is imminent and the
       // account isn't critically full (dying-value redeems stay exempt above).
+      // A HELD weekly card is spendable-redundant, not absent: the 5h branch below
+      // may still fire (red-team: holding must not starve a 5h wall — the 5h card
+      // sits redundant behind the free refill anyway, so spending it is pure gain).
       if (atWall && !dying && q.providerWkReset != null
           && msLeft(q.providerWkReset, now) < POLICY.freeRefillWaitMs
           && wkUtil < POLICY.freeRefillImmediate) {
-        return null; // hold — the free refill lands before the card would matter
+        weeklyHeld = true;   // fall through — do NOT return; the 5h branch checks this
+      } else {
+        return { kind: 'card', card: weeklyCard, resetType: 'WEEK',
+                 reason: atWall ? 'weekly at wall' : 'dying value' };
       }
-      return { kind: 'card', card: weeklyCard, resetType: 'WEEK',
-               reason: atWall ? 'weekly at wall' : 'dying value' };
     }
   }
 
   // --- 5h card: clears only the session window
   if (sesCard) {
     const atWall = sesUtil != null && sesUtil >= POLICY.wallSes
-      && (weeklyCard == null);   // R4: a weekly card can do this job AND more
+      && (weeklyCard == null || weeklyHeld);   // R4: a weekly card can do this job AND more — except when R6 HELD it for the free refill
     const dying = msLeft(sesCard.expiresAt, now) < POLICY.dyingWindowMs
       && (sesUtil ?? 0) >= POLICY.dyingMinUtilSes;
     if (atWall || dying) {

package/src/tui.js

@@ -2388,6 +2388,10 @@ export class TUI {
       wkCell = q.providerWk != null ? bar(q.providerWk, bw, q.providerWkReset)
         : emptyBar(q.weeklyAbsent ? 'none' : '—', bw);
       note = this._probeHealthNote(a);
+      // OUTSIDE-USAGE tag (2026-10-27): someone else is spending this account's quota
+      // with the same key. Red and first, because it explains every other symptom on
+      // the row (wall hit too fast, cards vanishing) and the fix is a key rotation.
+      if (a.outsideUsage?.outside) note += `  ${red(`key used outside pool ×${Math.max(1, Math.round(a.outsideUsage.zaiCalls / Math.max(1, a.outsideUsage.poolCalls)))}`)}`;
       // PEAK row tag (SC9): mirrors the router's own predicates — hard-barred = off,
       // tier 2 = over cap, tier 1 = peak (or "cap n/a" when the weekly is unreadable,
       // so the soft cap is inert). The label can never disagree with routing because

package/src/zai-reset-cards.js

@@ -131,3 +131,27 @@ export async function redeemResetCard(token, recordId, resetType, { grantType, a
     return { ok: false, error: err.message || String(err) };
   }
 }
+
+// z.ai's own hourly per-account model-call counts (zero-spend monitor read). The
+// labels are UTC+8 ("YYYY-MM-DD HH:mm"); outside-usage.js converts. Consumed by
+// the outside-usage detector (2026-10-27) — never by routing.
+const MODEL_USAGE_URL = 'https://api.z.ai/api/monitor/usage/model-usage';
+const zaiStamp = (ms) => new Date(ms + 8 * 3600_000).toISOString().slice(0, 19).replace('T', ' ');
+
+/** Fetch the last `hours` (default 26) of z.ai hourly model-call counts for a key.
+ *  Returns the raw `data` ({x_time, modelCallCount, ...}) or null on any failure. */
+export async function fetchZaiModelUsage(token, { hours = 26, now = Date.now(), signal, fetchImpl = fetch } = {}) {
+  if (!token) return null;
+  try {
+    const q = new URLSearchParams({ startTime: zaiStamp(now - hours * 3600_000), endTime: zaiStamp(now) });
+    const res = await fetchImpl(`${MODEL_USAGE_URL}?${q}`, {
+      headers: { 'Authorization': `Bearer ${token}`, 'Accept': 'application/json', 'Accept-Language': 'en-US' },
+      signal,
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data?.code === 200 && data?.data ? data.data : null;
+  } catch {
+    return null;
+  }
+}