maxpool 1.24.5 → 1.24.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.24.5",
+  "version": "1.24.7",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -748,6 +748,27 @@ async function serverWorkerCommand() {
   // background probe has gone stale (> 3× interval since last success).
   accountManager.quotaProbeIntervalMs = probeSeconds * 1000;
 
+  // SECRET RE-RESOLVE LOOP (2026-10-05). Provider keys resolve ONCE at startup; a
+  // transient gcloud/ADC failure at that moment benched all four z.ai providers as
+  // "secret-unresolved" permanently (measured 2026-10-05 20:18 startup: cache had
+  // been rewritten without the RESTRICTED_* entries, the gcloud path failed, and
+  // nothing retried — every GLM request 429'd "no_eligible_route" until restart).
+  // Re-attempt unresolved providers every 5 min until they resolve; a resolved
+  // provider is never touched again.
+  {
+    const { pendingProviders, reresolveProviders } = await import('./secret-resolver.js');
+    if (pendingProviders(accountManager.accounts).length) {
+      const secretTimer = setInterval(async () => {
+        if (!pendingProviders(accountManager.accounts).length) { clearInterval(secretTimer); return; }
+        try {
+          const fixed = await reresolveProviders(accountManager.accounts);
+          if (fixed) console.log(`[Maxpool] Secret re-resolve: ${fixed} provider(s) recovered`);
+        } catch { /* next tick */ }
+      }, 5 * 60_000);
+      secretTimer.unref?.();
+    }
+  }
+
   // Seed the running version immediately so the TUI header always shows it, even
   // before (or without) the npm update check. The cold worker's update check below
   // fills in latest/hasUpdate.

package/src/prober.js

@@ -13,8 +13,12 @@ import { listResetGrants, claimResetGrant } from './claude-reset-grants.js';
 import { decideZai, decideClaude } from './reset-policy.js';
 
 export class Prober {
-  constructor(accountManager, { intervalMs = 0, probeFn = fetchUsage, providerProbeFn = fetchProviderUsage, timeoutMs = 10_000, log = console.log, usageGapMs = null } = {}) {
+  constructor(accountManager, { intervalMs = 0, probeFn = fetchUsage, providerProbeFn = fetchProviderUsage, grantsFn = listResetGrants, timeoutMs = 10_000, log = console.log, usageGapMs = null } = {}) {
     this.am = accountManager;
+    // Injectable like probeFn: the default hits api.anthropic.com, so a harness that
+    // doesn't stub it makes a REAL network call per oauth sweep (a test then passes
+    // or fails on internet latency — prober-sweep-liveness, 2026-10-06).
+    this.grantsFn = grantsFn;
     this.intervalMs = intervalMs;
     this.probeFn = probeFn;
     this.providerProbeFn = providerProbeFn;
@@ -247,7 +251,7 @@ export class Prober {
       // OWNER GATE as z.ai cards: a DISABLED account is never listed or claimed.
       try {
         if (account.enabled !== false && account.credential && this.am.applyResetGrants) {
-          const listing = await this._withTimeout(listResetGrants(account.credential));
+          const listing = await this._withTimeout(this.grantsFn(account.credential));
           if (listing) {
             this.am.applyResetGrants(account.index, listing);
             const act = decideClaude(account, listing);

package/src/secret-resolver.js

@@ -107,3 +107,30 @@ export async function resolveSecrets(secretNames, opts = {}) {
   }
   return out;
 }
+
+/**
+ * Re-resolve config-sourced providers whose key never loaded. Accounts carry their
+ * key in `credential` (upsertRuntimeAccount maps authToken -> credential); the first
+ * version of this loop (v1.24.6) tested and wrote `authToken`, a field accounts never
+ * hold — so every provider looked unresolved forever, its status was reset to
+ * 'unknown' every 5 min, and a genuinely-unresolved one was never actually repaired.
+ * Returns the number of providers recovered.
+ */
+export function pendingProviders(accounts) {
+  return accounts.filter(a => a.configSourced && a.type === 'provider' && a.secretName && !a.credential);
+}
+
+export async function reresolveProviders(accounts, resolve = resolveSecrets) {
+  const pending = pendingProviders(accounts);
+  if (!pending.length) return 0;
+  const resolved = await resolve(pending.map(a => a.secretName));
+  let fixed = 0;
+  for (const a of pending) {
+    const tok = resolved[a.secretName];
+    if (!tok) continue;
+    a.credential = tok;
+    if (a.status === 'error' && a.lastError === 'secret-unresolved') { a.status = 'active'; a.lastError = null; }
+    fixed++;
+  }
+  return fixed;
+}