maxpool 1.5.14 → 1.5.16

package/README.md

@@ -192,7 +192,11 @@ The proxy also understands an optional internal header profile:
 
 Provider fallback credentials can be supplied per Claude Code process with `ANTHROPIC_CUSTOM_HEADERS`. Maxpool strips all `x-maxpool-*` headers before forwarding upstream.
 
-`x-maxpool-session: <id>` enables session affinity. With this header, the first request for a Claude Code process is routed by the adaptive load balancer, then later requests from the same process keep using that home account while it remains available. If the home account is rate-limited, exhausted, in cooldown, or removed, the session temporarily uses another eligible route. When the home account becomes available again, the session returns to it. For the `all` profile, fallback priority still wins: a session that had to use GLM or Kimi can move back to Claude when a Claude account becomes available again.
+`x-maxpool-session: <id>` enables session affinity. With this header, the first request for a Claude Code process is routed by the adaptive load balancer, then later requests from the same process keep using that home account while it remains available. If the home account is rate-limited, exhausted, in cooldown, or removed, the session temporarily uses another eligible route. When the home account becomes available again, the session returns to it. For the `all` profile, a Claude session that had to spill onto GLM/Kimi moves back to Claude once a Claude account frees up — **as long as it produced no provider-format tool calls while there**.
+
+**Cross-provider fallback + compatibility (`all` profile).** Claude, GLM (z.ai), and Kimi (Moonshot) interoperate for ordinary sessions — a regular tool-use id (`call_`/`tool_`) passes Anthropic's loose validation, so a Kimi or GLM session runs fine on Claude and a Claude session spills onto GLM/Kimi when Claude is unavailable. `scheduler.crossProviderFallbackPolicy` controls it, cyclable live in the TUI Routing menu (`m` → `f`): `never` = strict same-family (Claude→Claude, GLM→GLM, Kimi→Kimi), `when-exhausted` (default) = cross only once the home family is exhausted, `always` = providers peer with Claude.
+
+The one hard incompatibility Maxpool guards is a **`server_tool_use` id** that isn't `srvtoolu_` — Anthropic 400s that on replay (e.g. a `cc glm` session that used a server tool, resumed under `cc all`). Maxpool predicts that case ahead (pins the session to GLM/Kimi) and, for anything it can't predict (a rejected thinking signature), **self-heals**: the 400 is pre-stream, so Maxpool latches the session provider-only and transparently retries on GLM/Kimi — the client never sees the error. (Note: Claude Code may warn a resumed `glm-*` model "could not be restored" and fall back to `claude-opus-4-8`; that's a client-side message — routing is unaffected.)
 
 Provider rows do not use Claude Max session/week bars unless the provider returns compatible quota headers. For GLM/Kimi, Maxpool always tracks operational telemetry (`Act`, `OK`, `Fail`, `Last`) and also parses common `x-ratelimit-*` / `ratelimit-*` headers if present.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.14",
+  "version": "1.5.16",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -83,6 +83,20 @@ const DEFAULT_SCHEDULER = {
   // makes this safe even if Anthropic ever account-binds signatures — a rejected
   // replay self-heals to the issuer instead of poisoning the session.
   crossAccountThinkingMigration: true,
+  // Cross-PROVIDER fallback policy for 'cc all' (profile=all), i.e. whether a session
+  // may be served by a provider FAMILY other than its home (Claude ↔ GLM ↔ Kimi).
+  //   'never'         — strict pin: a Claude session uses Claude only; a GLM session
+  //                     uses GLM only; a Kimi session uses Kimi only.
+  //   'when-exhausted'— (default) home family preferred; a Claude session falls back
+  //                     to GLM/Kimi only once all Claude accounts are unavailable
+  //                     (providers are already lower-priority fallback), and a GLM
+  //                     session may fall to Kimi once GLM is exhausted.
+  //   'always'        — providers peer with Claude for a Claude/unknown session
+  //                     (load-balanced, not last-resort).
+  // INVARIANT (all policies): a GLM/Kimi-origin session NEVER routes to an Anthropic
+  // account — Anthropic 400s on a non-`srvtoolu_` server_tool_use id; that direction
+  // is unfixable, not policy-tunable.
+  crossProviderFallbackPolicy: 'when-exhausted',
 };
 const LOAD_EVENT_MAX_AGE_MS = 60 * 60 * 1000;
 const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
@@ -1020,12 +1034,16 @@ export class AccountManager {
   _migrationSafeForRequest(requestInfo = {}) {
     // Fail closed on any body we couldn't fully scan (non-JSON / parse error).
     if (requestInfo.bodyThinkingScanned !== true) return false;
+    // An Anthropic-incompatible (provider-pinned) session's only possible cross is
+    // GLM↔Kimi, whose mismatched thinking formats risk a reasoning-loop — keep it on
+    // its bound provider rather than rebalancing.
+    if (this._effectiveIncompatible(requestInfo).incompatible) return false;
     // A signed-thinking request is migration-safe when cross-account thinking
     // migration is enabled: the signature is content/model integrity, not account-
-    // bound, and the rebalance candidate filter (_matchesRequest → _isRequestCompatible)
-    // already bars providers for thinking, so every eligible target is a Claude
-    // account. When the flag is off, keep the conservative bar (never migrate signed
-    // thinking) until the revert-to-issuer fail-safe lands (#16).
+    // bound. The rebalance candidate loop (_shouldRebalanceBoundSession) additionally
+    // skips PROVIDER targets for a signed-thinking request, so every migration target
+    // stays a Claude account (a signed block isn't shuttled to a provider mid-session).
+    // When the flag is off, keep the conservative bar (never migrate signed thinking).
     if (requestInfo.requiresAnthropicThinkingIntegrity === true) {
       return this.scheduler.crossAccountThinkingMigration === true;
     }
@@ -1066,6 +1084,10 @@ export class AccountManager {
     for (const account of this.accounts) {
       if (account.index === bound.index) continue;
       if (excludedIndexes.has(account.index)) continue;
+      // Keep a signed-thinking session's live migration on Claude accounts only —
+      // don't shuttle an Anthropic-signed block onto a provider mid-session even
+      // though _isRequestCompatible now allows providers for thinking under policy.
+      if (requestInfo.requiresAnthropicThinkingIntegrity === true && account.type === 'provider') continue;
       if (!this._matchesRequest(account, profile, requestInfo)) continue;
       // Genuinely-healthy alternatives only (normal/soft/unknown weekly + model headroom).
       if (!this._isAvailable(account, { allowWeeklyReserve: false, allowWeeklyCritical: false, model: requestInfo.model })) continue;
@@ -1266,7 +1288,7 @@ export class AccountManager {
         if (!this._matchesRequest(account, profile, requestInfo)) continue;
         if (!this._isAvailable(account, { ...weeklyOptions, model: requestInfo.model })) continue;
 
-        const priority = Number.isFinite(account.priority) ? account.priority : 0;
+        const priority = this._effectivePriority(account, requestInfo);
         const score = this._scoreAccount(account, requestInfo, scoringCtx);
         if (priority < bestPriority || (priority === bestPriority && score < bestScore)) {
           bestPriority = priority;
@@ -1461,23 +1483,108 @@ export class AccountManager {
     return true;
   }
 
+  _crossProviderFallbackPolicy() {
+    const p = this.scheduler.crossProviderFallbackPolicy;
+    return (p === 'never' || p === 'always') ? p : 'when-exhausted';
+  }
+
+  // Selection priority with the 'always' cross-provider policy applied: a provider
+  // account peers with oauth (priority 0) for an Anthropic/unknown session so a
+  // Claude session load-balances across Claude+GLM+Kimi rather than using providers
+  // only as last-resort. 'never'/'when-exhausted' keep the provider's own priority
+  // (10/20) → fallback-only. A foreign session is provider-only regardless.
+  _effectivePriority(account, requestInfo = {}) {
+    const base = Number.isFinite(account.priority) ? account.priority : 0;
+    if (account.type === 'provider'
+        && this._crossProviderFallbackPolicy() === 'always'
+        && !this._effectiveIncompatible(requestInfo).incompatible) {
+      return 0;
+    }
+    return base;
+  }
+
+  setCrossProviderFallbackPolicy(policy) {
+    if (!['never', 'when-exhausted', 'always'].includes(policy)) return false;
+    this.scheduler.crossProviderFallbackPolicy = policy;
+    console.log(`[Maxpool] Cross-provider fallback policy set to "${policy}"`);
+    return true;
+  }
+
+  // Effective Anthropic-incompatibility for a request: the request's own transcript
+  // verdict, OR a sticky latch on the session — set once a foreign server_tool_use
+  // id is seen, or once Anthropic REJECTED the transcript on replay (react-and-heal
+  // in server.js). Never downgrades, so a later no-tool follow-up turn stays
+  // provider-pinned. Both the selector AND the retry oracle read this so they never
+  // disagree. homeProvider is a SOFT hint (first foreign id shape) for 'never' only.
+  _effectiveIncompatible(requestInfo = {}) {
+    const sticky = requestInfo.sessionKey ? this.sessionPolicies.get(requestInfo.sessionKey) : null;
+    return {
+      incompatible: Boolean(requestInfo.anthropicIncompatible || sticky?.anthropicIncompatible),
+      homeProvider: requestInfo.homeProvider || sticky?.homeProvider || null,
+    };
+  }
+
   _isRequestCompatible(account, profile, requestInfo = {}) {
     if (!this._matchesProfile(account, profile)) return false;
-    if (account.type === 'provider' && this._requiresAnthropicThinkingIntegrity(requestInfo)) return false;
+
+    const { incompatible, homeProvider } = this._effectiveIncompatible(requestInfo);
+    const policy = this._crossProviderFallbackPolicy();
+
+    if (incompatible) {
+      // The transcript can't replay to Claude (a foreign server_tool_use id, or
+      // content Anthropic rejected on replay) — provider accounts ONLY, regardless
+      // of policy. Providers are lenient and accept each other's ids (GLM↔Kimi is
+      // fine); 'never' pins to the detected home provider when known.
+      if (account.type !== 'provider') return false;
+      if (policy === 'never' && homeProvider && account.provider !== homeProvider) return false;
+      return true;
+    }
+
+    // Compatible session — includes Kimi and GLM-without-server-tools, whose regular
+    // tool_use ids pass Anthropic's loose validation, AND ordinary Claude sessions.
+    // Claude is eligible + preferred (priority 0). Provider fallback is the SAFE
+    // direction (lenient providers accept Anthropic ids/signatures) and is
+    // policy-gated ONLY: 'never' keeps a Claude session on Claude; 'when-exhausted'
+    // lets providers serve as a priority-fallback; 'always' peers them
+    // (_effectivePriority). Signed thinking no longer bars providers here — but its
+    // live MIGRATION stays Claude-only (see the rebalance guard).
+    if (account.type === 'provider' && policy === 'never') return false;
     return true;
   }
 
   _noteRequestPolicy(requestInfo = {}) {
-    if (!requestInfo.sessionKey || !requestInfo.requiresAnthropicThinkingIntegrity) return;
-    this.markSessionThinkingProtected(requestInfo.sessionKey, requestInfo.model);
+    if (!requestInfo.sessionKey) return;
+    if (requestInfo.requiresAnthropicThinkingIntegrity) {
+      this.markSessionThinkingProtected(requestInfo.sessionKey, requestInfo.model);
+    }
+    if (requestInfo.anthropicIncompatible) {
+      this.markSessionIncompatible(requestInfo.sessionKey, requestInfo.homeProvider);
+    }
   }
 
-  markSessionThinkingProtected(sessionKey, model = null) {
+  // Latch a session as Anthropic-incompatible (a foreign server_tool_use id, or a
+  // transcript Anthropic rejected on replay). Sticky + never-downgrades so the
+  // session stays provider-pinned across later follow-up turns.
+  markSessionIncompatible(sessionKey, homeProvider = null) {
     if (!sessionKey) return;
     const existing = this.sessionPolicies.get(sessionKey) || {};
-    if (!existing.requiresAnthropicThinkingIntegrity) {
-      console.log(`[Maxpool] Session "${sessionKey}" contains Anthropic signed thinking; provider fallback disabled`);
+    if (!existing.anthropicIncompatible) {
+      console.log(`[Maxpool] Session "${sessionKey}" is Anthropic-incompatible (${homeProvider || 'provider'} transcript) — pinned to GLM/Kimi`);
     }
+    this.sessionPolicies.set(sessionKey, {
+      ...existing,
+      anthropicIncompatible: true,
+      homeProvider: existing.homeProvider || homeProvider || null,
+    });
+  }
+
+  // Marks a session as containing Anthropic signed thinking. This no longer bars
+  // provider fallback (a lenient provider accepts an Anthropic signature) — it only
+  // keeps the session's live cross-account MIGRATION on Claude (the rebalance guard),
+  // so a signed block isn't needlessly shuttled to a provider mid-session.
+  markSessionThinkingProtected(sessionKey, model = null) {
+    if (!sessionKey) return;
+    const existing = this.sessionPolicies.get(sessionKey) || {};
     this.sessionPolicies.set(sessionKey, {
       ...existing,
       requiresAnthropicThinkingIntegrity: true,
@@ -2236,6 +2343,7 @@ export class AccountManager {
       routing: {
         mode: this.routingMode,
         preferredAccount: this.preferredAccountName,
+        crossProviderFallbackPolicy: this._crossProviderFallbackPolicy(),
       },
       accounts: this.accounts.map(a => ({
         name: a.name,
@@ -2305,6 +2413,7 @@ export class AccountManager {
       sessions: {
         stickyBindings: this.sessionBindings.size,
         thinkingProtected: [...this.sessionPolicies.values()].filter(p => p.requiresAnthropicThinkingIntegrity).length,
+        providerPinned: [...this.sessionPolicies.values()].filter(p => p.anthropicIncompatible).length,
       },
     };
   }

package/src/config.js

@@ -91,6 +91,17 @@ export function createDefaultConfig() {
       weeklyReserveThreshold: 0.85,
       weeklyCriticalThreshold: 0.95,
       weeklyExhaustedThreshold: 0.985,
+      // Cross-PROVIDER fallback policy for 'cc all' (profile=all): whether a session
+      // may be served by a provider family other than its home (Claude ↔ GLM ↔ Kimi).
+      //   'never'         — strict pin (Claude→Claude, GLM→GLM, Kimi→Kimi).
+      //   'when-exhausted'— (default) home family preferred; cross only once it's
+      //                     exhausted (a Claude session falls to GLM/Kimi when all
+      //                     Claude accounts are unavailable).
+      //   'always'        — providers peer with Claude for a Claude/unknown session.
+      // A GLM/Kimi-origin session NEVER routes to Anthropic under ANY policy — that
+      // direction 400s on the non-`srvtoolu_` tool-use id and is unfixable. Toggle
+      // live in the TUI (Routing sub-mode, 'f' key).
+      crossProviderFallbackPolicy: 'when-exhausted',
     },
     retry: {
       maxAttemptsPerRequest: 0,

package/src/index.js

@@ -850,6 +850,16 @@ async function serverWorkerCommand() {
           mode: config.routing?.mode || 'automatic',
           preferredAccount: config.routing?.preferredAccount || null,
         };
+        // Persist live-toggled scheduler policy (e.g. the cross-provider fallback
+        // policy cycled with the TUI 'f' key). Without this, the toggle takes effect
+        // in memory but silently reverts on the next config write / restart. Merge
+        // onto the existing disk scheduler block so other scheduler keys survive.
+        if (config.scheduler?.crossProviderFallbackPolicy) {
+          diskConfig.scheduler = {
+            ...diskConfig.scheduler,
+            crossProviderFallbackPolicy: config.scheduler.crossProviderFallbackPolicy,
+          };
+        }
         // Write in-memory accounts as the authoritative state, preserving
         // extra disk-only fields (e.g. importFrom) where the account still exists.
         // Use live tokens from AccountManager (not the stale config.accounts copy).

package/src/server.js

@@ -736,8 +736,14 @@ async function forwardRequest(
 
     if (upstreamRes.status >= 400 && upstreamRes.status < 500) {
       const errorBody = await readErrorBody(upstreamRes);
+      // A transcript a lenient provider (GLM/Kimi) produced can be rejected by
+      // Anthropic on replay (a non-srvtoolu_ server_tool_use id, or a thinking
+      // signature it can't validate). Detect it on an Anthropic account so we can
+      // self-heal onto a provider instead of surfacing the 400.
+      const anthropicIncompat = account.type !== 'provider' && isAnthropicIncompatBody(errorBody);
       const errorType = errorBody.includes('Invalid `signature` in `thinking` block')
         ? 'invalid_thinking_signature'
+        : anthropicIncompat ? 'anthropic_incompatible_transcript'
         : `HTTP ${upstreamRes.status}`;
       accountManager.releaseAccount(lease, { status: upstreamRes.status, error: errorType });
 
@@ -768,6 +774,24 @@ async function forwardRequest(
         }
       }
 
+      // React-and-heal: this transcript can't run on Claude (foreign server_tool_use
+      // id / thinking Anthropic can't validate). The 400 is pre-stream and the body
+      // is buffered, so latch the session Anthropic-incompatible (sticky → once per
+      // session) and retry PROVIDER-only, rather than surfacing the 400. Only worth
+      // it when a provider can actually serve it (profile=all with a GLM/Kimi token).
+      const providerAvailable = accountManager.accounts?.some(a => a.type === 'provider' && a.enabled !== false);
+      if (anthropicIncompat && requestInfo.sessionKey && providerAvailable
+        && canRetryBufferedBody && retryCount + 1 < maxAttempts && !res.headersSent) {
+        accountManager.markSessionIncompatible?.(requestInfo.sessionKey, requestInfo.homeProvider);
+        excludedIndexes.add(account.index);
+        console.log(`[Maxpool] Anthropic rejected this transcript (server_tool_use/thinking); pinning session to GLM/Kimi and retrying`);
+        return forwardRequest(
+          req, res, body, accountManager, upstream, retryCount + 1, hooks, reqId, ctx, logDir,
+          retryConfig, queueConfig, { ...requestInfo, anthropicIncompatible: true },
+          canRetryBufferedBody, canQueueBufferedBody, excludedIndexes,
+        );
+      }
+
       ctx.status = upstreamRes.status;
       sendErrorBody(res, requestInfo, upstreamRes.status, errorBody, upstreamRes.headers);
       return;
@@ -987,6 +1011,17 @@ function computeQueueWindowMs({
 }
 
 function unavailableMessage(accountManager, requestInfo = {}, retryAfter, willRecoverSoon = true) {
+  const incompat = accountManager._effectiveIncompatible?.(requestInfo) || { incompatible: false, homeProvider: null };
+
+  // An Anthropic-incompatible session is pinned to provider accounts — Anthropic
+  // 400s on its server_tool_use id / foreign thinking. "All Claude at limit" would
+  // be the wrong story (Claude is irrelevant to it); say what actually blocks it.
+  if (incompat.incompatible) {
+    const fam = incompat.homeProvider === 'zai' ? 'GLM' : incompat.homeProvider === 'kimi' ? 'Kimi' : 'GLM/Kimi';
+    const eta = Number.isFinite(retryAfter) && retryAfter > 0 ? ` Retry in ${retryAfter}s.` : '';
+    return `This session's transcript can only run on GLM/Kimi — Claude rejects its server-tool ids/thinking on replay. No GLM/Kimi provider is available right now.${eta} Check the x-maxpool-zai-token / x-maxpool-kimi-token headers, or resume with 'cc ${incompat.homeProvider === 'kimi' ? 'kimi' : 'glm'}'.`;
+  }
+
   const thinking = requestInfo.requiresAnthropicThinkingIntegrity
     || accountManager._requiresAnthropicThinkingIntegrity?.(requestInfo);
   const n = accountManager.accounts.length;
@@ -1010,7 +1045,7 @@ function unavailableMessage(accountManager, requestInfo = {}, retryAfter, willRe
   return `All ${n} accounts exhausted. Retry in ${retryAfter}s.`;
 }
 
-export const __serverTest = { unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, describeRequest, classifyRateLimit };
+export const __serverTest = { unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody };
 
 async function readErrorBody(upstreamRes, limitBytes = 64 * 1024) {
   if (!upstreamRes.body) return '';
@@ -1478,6 +1513,13 @@ function describeRequest(req, body) {
     // rebalancing); an unparsed body leaves this false → treated as NOT safe
     // (fail-closed) so we never replay a signed thinking block to a new account.
     info.bodyThinkingScanned = true;
+    // Whether the resumed transcript can replay to a Claude account. A session with
+    // a foreign server_tool_use id CANNOT (Anthropic 400s) → routing pins it to
+    // providers. Everything else stays Claude-eligible (Kimi/GLM without server-tools
+    // replay fine); a rare rejected-thinking 400 self-heals via react-and-heal.
+    const origin = detectTranscriptOrigin(json);
+    if (origin.anthropicIncompatible) info.anthropicIncompatible = true;
+    if (origin.homeProvider) info.homeProvider = origin.homeProvider;
   } catch {
     // Non-JSON requests are rare; body size still gives a useful load signal.
   }
@@ -1491,6 +1533,65 @@ function requiresAnthropicThinkingIntegrity(json) {
   return containsThinkingBlock(json.messages);
 }
 
+// Anthropic tool-use ids: client tool_use is 'toolu_…', server_tool_use is 'srvtoolu_…'
+// (the latter is REQUIRED — Anthropic 400s on replay of any other shape). GLM (z.ai)
+// emits OpenAI-style 'call_…'; Kimi (moonshot) emits 'tool_…'. Allowlist, not denylist:
+// anything NOT matching this is treated as foreign (fail-closed classification).
+const ANTHROPIC_TOOL_ID = /^(toolu|srvtoolu)_/;
+
+// Decide whether a resumed transcript can replay to an Anthropic (Claude) account,
+// from the tool-use id shapes in its `messages`. Returns { anthropicIncompatible,
+// homeProvider }.
+//   anthropicIncompatible = the transcript has a `server_tool_use` id NOT matching
+//     ^srvtoolu_ — the ONE DETERMINISTIC incompatibility (Anthropic 400s on replay,
+//     the reported bug). Anthropic validates a client `tool_use.id` LOOSELY
+//     (^[a-zA-Z0-9_-]+$), so GLM `call_…` / Kimi `tool_…` client ids PASS and a
+//     Kimi/GLM session without server-tools is FINE on Claude — we do NOT predict
+//     those (a rejected thinking signature, if it ever happens, self-heals via the
+//     4xx react-and-heal in forwardRequest). server_tool_use is rare (GLM ~15%,
+//     Kimi 0%), so most sessions are compatible.
+//   homeProvider = the first foreign tool-use id shape (call_→zai, tool_→kimi), a
+//     SOFT hint for the 'never' same-family preference only; ambiguous/none → null.
+// The request MODEL is not used — Claude Code rewrites it to opus on resume.
+function detectTranscriptOrigin(json) {
+  if (!json || typeof json !== 'object') return { anthropicIncompatible: false, homeProvider: null };
+  let incompatible = false;
+  let homeProvider = null;
+  const fam = id => id.startsWith('call_') ? 'zai' : id.startsWith('tool_') ? 'kimi' : null;
+  const noteForeign = id => { if (!homeProvider) homeProvider = fam(id); };
+  const visit = value => {
+    if (incompatible) return; // server_tool_use is decisive — stop
+    if (Array.isArray(value)) { for (const v of value) { visit(v); if (incompatible) return; } return; }
+    if (!value || typeof value !== 'object') return;
+    const t = value.type;
+    if (t === 'server_tool_use' && typeof value.id === 'string' && !ANTHROPIC_TOOL_ID.test(value.id)) {
+      incompatible = true; noteForeign(value.id); return;
+    }
+    if (t === 'tool_use' && typeof value.id === 'string' && !ANTHROPIC_TOOL_ID.test(value.id)) noteForeign(value.id);
+    if (t === 'tool_result' && typeof value.tool_use_id === 'string' && !ANTHROPIC_TOOL_ID.test(value.tool_use_id)) noteForeign(value.tool_use_id);
+    if (value.content) visit(value.content);
+    if (value.messages) visit(value.messages);
+  };
+  visit(json.messages);
+  return { anthropicIncompatible: incompatible, homeProvider };
+}
+
+// Does this upstream 4xx error body indicate the transcript is un-replayable to
+// Anthropic (a lenient GLM/Kimi provider produced content Anthropic rejects on
+// replay)? Matches the three known shapes: a non-srvtoolu_ server_tool_use id, or a
+// thinking-block signature Anthropic can't validate (invalid OR missing). Used to
+// self-heal onto a provider instead of surfacing the 400.
+function isAnthropicIncompatBody(body) {
+  if (!body) return false;
+  // The deterministic server-tool-id 400, the known invalid-signature error, or a
+  // thinking-block signature VALIDATION error (missing/invalid) — the last gated on
+  // a validation verb so a user message merely echoing "thinking"/"signature" can't
+  // false-latch the session provider-pinned for life.
+  return /srvtoolu_|server_tool_use/.test(body)
+    || /invalid `signature` in `thinking`/i.test(body)
+    || (/thinking/.test(body) && /signature/.test(body) && /(should match|required|invalid|expected|must )/i.test(body));
+}
+
 function containsThinkingBlock(value) {
   if (!value) return false;
   if (Array.isArray(value)) return value.some(containsThinkingBlock);

package/src/tui.js

@@ -415,11 +415,25 @@ export class TUI {
       );
     } else if (k === 'p' && this.am.accounts.some(account => account.type !== 'provider')) {
       this._startSelection('prefer');
+    } else if (k === 'f') {
+      // Cycle the cross-provider fallback policy in place — reversible + non-destructive,
+      // so no confirm dialog (unlike restart/delete).
+      this._cycleCrossProviderPolicy();
     } else if (k === 'esc' || k === 'q') {
       this.mode = 'normal';
     }
   }
 
+  async _cycleCrossProviderPolicy() {
+    const order = ['never', 'when-exhausted', 'always'];
+    const cur = this.am._crossProviderFallbackPolicy();
+    const next = order[(order.indexOf(cur) + 1) % order.length];
+    this.am.setCrossProviderFallbackPolicy(next);
+    this.config.scheduler = { ...(this.config.scheduler || {}), crossProviderFallbackPolicy: next };
+    await this.saveConfig(this.config);
+    this._addLog(`Cross-provider fallback: ${next}`);
+  }
+
   _keySelect(k) {
     const selectable = this._selectableIndexes(this.selAction);
     const position = Math.max(0, selectable.indexOf(this.selIdx));
@@ -820,7 +834,17 @@ export class TUI {
     const routing = this.am.routingMode === 'preferred'
       ? `Manual preference: ${this.am.preferredAccountName} (automatic failover)`
       : 'Automatic load balancing';
-    lines.push(` Routing  ${cyan(routing)}`);
+    // Cross-provider fallback policy — only meaningful when GLM/Kimi providers are in
+    // the pool (profile=all). never=strict pin (yellow), when-exhausted=default (cyan),
+    // always=peer (green).
+    const hasProviders = this.am.accounts.some(a => a.type === 'provider');
+    let xpText = '';
+    if (hasProviders) {
+      const p = this.am._crossProviderFallbackPolicy?.() || 'when-exhausted';
+      const pc = p === 'never' ? yellow(p) : p === 'always' ? green(p) : cyan(p);
+      xpText = `  ${dim('·')}  ${dim('Cross-provider:')} ${pc}`;
+    }
+    lines.push(` Routing  ${cyan(routing)}${xpText}`);
     const queuedCount = this.am.queueState?.waiting?.length || 0;
     if (this.am._isUpstreamThrottleBlocking?.() || queuedCount) {
       const throttle = this.am.upstreamThrottle;
@@ -840,6 +864,11 @@ export class TUI {
       lines.push(yellow('  No accounts configured. Press [a] to add one.'));
     } else {
       lines.push('');
+      // Column legend — the per-row numbers are otherwise cryptic. Ses/Wk are the
+      // two quota bars; Now is live concurrency; 15m/1h are recent throughput.
+      if (W >= 88) {
+        lines.push(' ' + dim('Ses/Wk = 5h/7d quota (used% · resets-in) · Now = in-flight (weight) · 15m/1h = requests served (avg latency · Nf=fails)'));
+      }
       const showBoth = W >= 70;
       const bw = showBoth
         ? Math.max(5, Math.min(20, Math.floor((W - 56) / 2)))
@@ -1034,7 +1063,7 @@ export class TUI {
       case 'accounts':
         return ` ${bold('l')} Login (browser)  ${bold('k')} API key  ${bold('n')} Rename  ${bold('t')} Enable/disable  ${bold('d')} Delete  ${bold('Esc')} Back`;
       case 'routing':
-        return ` ${bold('a')} Automatic  ${bold('p')} Manual preference  ${bold('Esc')} Back`;
+        return ` ${bold('a')} Automatic  ${bold('p')} Manual preference  ${bold('f')} Cross-provider fallback  ${bold('Esc')} Back`;
       case 'select': {
         const act = this.selAction === 'prefer'
           ? 'prefer'