maxpool 1.5.0 → 1.5.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -250,7 +250,36 @@ export class AccountManager {
 
     for (const account of this.accounts) {
       if (excludedIndexes.has(account.index)) continue;
-      if (!this._matchesRequest(account, profile, requestInfo)) {
+      const matches = this._matchesRequest(account, profile, requestInfo);
+
+      // A signed-thinking request behind the TRANSIENT FIFO queue-fairness gate
+      // (a queue already exists and this newcomer hasn't registered a ticket yet
+      // — the `!requestInfo.queueTicket` clause in _matchesRequest) must still be
+      // CONSIDERED for retry timing, not skipped. Such a request has NO fallback:
+      // providers are barred (signed thinking), so dropping the account here — and
+      // losing its REAL cooldown / rate-limit / 5h reset — collapses the oracle to
+      // Infinity and KILLS the session. Two reproduced kills (2026-06-27): a queue
+      // forms, then either (a) healthy accounts sit idle behind it, or (b) a
+      // network blip has cooled EVERY account, and the thinking newcomer dies with
+      // the false "all N are at their 5h or weekly limit". The gate lifts the
+      // instant the request registers a ticket, so bypass it for retry timing here.
+      // Still respected: admissionPaused (restart/shutdown shed → stays terminal),
+      // upstream-throttle (handled by the early return above), and structural
+      // profile / provider-thinking compatibility. Scoped to THINKING on purpose: a
+      // non-thinking newcomer can fall back to a provider or be cheaply retried, so
+      // the gate keeps shedding it as backpressure (never grow the queue past its
+      // cap under a pure-concurrency burst).
+      const fairnessOnlyBlock = !matches
+        && this._requiresAnthropicThinkingIntegrity(requestInfo)
+        && account.type !== 'provider'
+        && this._isRequestCompatible(account, profile, requestInfo)
+        && !this.admissionPaused
+        && !this._isUpstreamThrottleBlocking()
+        && this.queueState.waiting.length > 0
+        && !requestInfo.queueTicket
+        && !requestInfo.queueAdmitted;
+
+      if (!matches && !fairnessOnlyBlock) {
         if (account.type === 'provider' && this._requiresAnthropicThinkingIntegrity(requestInfo)) {
           note('provider_fallback_disabled_signed_thinking');
         }
@@ -258,7 +287,16 @@ export class AccountManager {
       }
 
       matchingRoutes++;
-      if (this._isAvailable(account, { allowWeeklyReserve: true })) {
+
+      // NEVER claim available:0 for a fairness-gated account — _selectNext still
+      // refuses it (the gate), so an available verdict would desync the oracle from
+      // selection and spin the caller. A healthy gated account holds a bounded
+      // re-poll (queued_behind_fairness); a transiently-blocked one (cooldown /
+      // rate-limit / 5h cap) falls through so its REAL short-term reset drives a
+      // finite hold. It must NEVER contribute the WEEKLY reset (days) — that is the
+      // multi-day-hang the bounded path fences off; see the !fairnessOnlyBlock
+      // guards on the weekly branches below.
+      if (!fairnessOnlyBlock && this._isAvailable(account, { allowWeeklyReserve: true })) {
         return {
           available: true,
           retryAfterMs: 0,
@@ -267,10 +305,15 @@ export class AccountManager {
           matchingRoutes,
         };
       }
+      if (fairnessOnlyBlock && this._isAvailable(account, { allowWeeklyReserve: true, allowWeeklyCritical: true })) {
+        soonestBoundedHold = Math.min(soonestBoundedHold, BOUNDED_REPOLL_HOLD_MS);
+        if (!boundedHoldCause) boundedHoldCause = 'queued_behind_fairness';
+        continue;
+      }
 
       const retry = this._retryInfo(account);
       note(retry.cause);
-      if (retry.weeklyCritical && this._isAvailable(account, { allowWeeklyReserve: true, allowWeeklyCritical: true })) {
+      if (!fairnessOnlyBlock && retry.weeklyCritical && this._isAvailable(account, { allowWeeklyReserve: true, allowWeeklyCritical: true })) {
         return {
           available: true,
           retryAfterMs: 0,
@@ -301,10 +344,15 @@ export class AccountManager {
         // hold when no weekly-critical account contributed it.
         if (retry.weeklyCritical) boundedHoldCause = 'weekly_critical';
         else if (!boundedHoldCause) boundedHoldCause = 'concurrency_cap';
-      } else if (retry.cause === 'weekly_exhausted' && retry.retryAt) {
+      } else if (!fairnessOnlyBlock && retry.cause === 'weekly_exhausted' && retry.retryAt) {
+        // A fairness-gated account NEVER contributes the weekly reset: holding a
+        // thinking session for days behind the queue is the over-correction we
+        // avoid (a weekly-exhausted gated fleet stays terminal → honest error,
+        // matching the no-newcomer-vs-queue distinction). Only its short-term reset
+        // (above) or the bounded hold may fire.
         const ms = retry.retryAt - Date.now();
         if (ms < soonestWeekly) soonestWeekly = ms;
-      } else if (retry.cause === 'weekly_exhausted' && !retry.retryAt) {
+      } else if (!fairnessOnlyBlock && retry.cause === 'weekly_exhausted' && !retry.retryAt) {
         // Weekly-capped but we haven't learned the reset time (cold start /
         // probe failure). We cannot estimate a wait — flag it so the caller
         // emits an honest "reset time unknown" error instead of waiting forever.

package/src/server.js

@@ -1158,7 +1158,18 @@ async function queueAndRetry(
     }
     return false;
   }
-  if (cause === 'network' || cause === 'proxy') return false;
+  // A 'proxy' (non-transient upstream) error fails fast. A 'network' error (the
+  // upstream fetch threw — ECONNRESET / ETIMEDOUT / a VPN or internet blip) is the
+  // MOST transient failure there is, and must NOT kill a live session: when the
+  // request is a STREAMING, replayable one (heartbeat keeps it alive, buffered body
+  // can be re-sent) and ≥1 account will recover on a finite schedule, hold it and
+  // resume when connectivity returns — exactly the "a network drop shouldn't break
+  // my session" goal (2026-06-27). The hold-vs-error gate below still error-fasts if
+  // nextRetryForRequest reports no finite recovery (all accounts genuinely gone), so
+  // a real outage doesn't spin. A non-streaming network failure (no keepalive) still
+  // fails fast — it would die on the client's own timeout anyway.
+  if (cause === 'proxy') return false;
+  if (cause === 'network' && (!requestInfo.stream || !canQueueBufferedBody)) return false;
 
   const maxWaitMs = Math.max(0, Number(queueConfig.maxWaitMs) || 0);
   const autoMaxWaitMs = queueConfig.autoMaxWaitMs == null
@@ -1176,11 +1187,16 @@ async function queueAndRetry(
   };
 
   // Honest, cause-/thinking-aware message used for every give-up path below.
-  const honestMessage = unavailableMessage(
-    accountManager, requestInfo,
-    Math.ceil((Number.isFinite(retryPlan.retryAfterMs) ? retryPlan.retryAfterMs : 0) / 1000),
-    false,
-  );
+  // A 'network'-cause hold that ultimately gives up means connectivity never came
+  // back within the window — say THAT (check your internet), not the misleading
+  // "all accounts at their quota limit" (the accounts are fine; the network isn't).
+  const honestMessage = cause === 'network'
+    ? 'Could not connect to Claude (network error) and connectivity did not return in time. Check your internet connection and try again. This is not an account quota issue.'
+    : unavailableMessage(
+      accountManager, requestInfo,
+      Math.ceil((Number.isFinite(retryPlan.retryAfterMs) ? retryPlan.retryAfterMs : 0) / 1000),
+      false,
+    );
 
   // Weekly-capped but the reset time is unknown (cold start / probe failure):
   // we can't estimate a wait, so don't pretend to — error honestly now.