maxpool 1.5.15 → 1.5.16

package/README.md

@@ -194,7 +194,9 @@ Provider fallback credentials can be supplied per Claude Code process with `ANTH
 
 `x-maxpool-session: <id>` enables session affinity. With this header, the first request for a Claude Code process is routed by the adaptive load balancer, then later requests from the same process keep using that home account while it remains available. If the home account is rate-limited, exhausted, in cooldown, or removed, the session temporarily uses another eligible route. When the home account becomes available again, the session returns to it. For the `all` profile, a Claude session that had to spill onto GLM/Kimi moves back to Claude once a Claude account frees up — **as long as it produced no provider-format tool calls while there**.
 
-**Cross-provider session pinning (`all` profile).** Maxpool classifies each session's home provider from its transcript: Anthropic tool-use ids are `toolu_`/`srvtoolu_`, GLM (z.ai) emits `call_`, Kimi (Moonshot) emits `tool_`. A session whose replayed history contains any non-Anthropic tool-use id (e.g. resuming a `cc glm` session under `cc all`) is **pinned to GLM/Kimi** and never routed to a Claude account — Anthropic rejects a non-`srvtoolu_` `server_tool_use.id` with a 400, so that direction is a hard incompatibility, not a preference. The reverse (a Claude session spilling onto GLM/Kimi) is safe. This is governed by `scheduler.crossProviderFallbackPolicy` (`never` | `when-exhausted` (default) | `always`), cyclable live in the TUI Routing menu (`m` → `f`): `never` = strict same-family pin, `when-exhausted` = cross only once the home family is exhausted, `always` = providers peer with Claude for a Claude session. A GLM/Kimi-origin session is never sent to Claude under any policy. (Note: Claude Code itself may warn that a resumed `glm-*` model "could not be restored" and fall back to `claude-opus-4-8`; that is a client-side session-store message — Maxpool still routes the session to GLM/Kimi correctly by its transcript.)
+**Cross-provider fallback + compatibility (`all` profile).** Claude, GLM (z.ai), and Kimi (Moonshot) interoperate for ordinary sessions — a regular tool-use id (`call_`/`tool_`) passes Anthropic's loose validation, so a Kimi or GLM session runs fine on Claude and a Claude session spills onto GLM/Kimi when Claude is unavailable. `scheduler.crossProviderFallbackPolicy` controls it, cyclable live in the TUI Routing menu (`m` → `f`): `never` = strict same-family (Claude→Claude, GLM→GLM, Kimi→Kimi), `when-exhausted` (default) = cross only once the home family is exhausted, `always` = providers peer with Claude.
+
+The one hard incompatibility Maxpool guards is a **`server_tool_use` id** that isn't `srvtoolu_` — Anthropic 400s that on replay (e.g. a `cc glm` session that used a server tool, resumed under `cc all`). Maxpool predicts that case ahead (pins the session to GLM/Kimi) and, for anything it can't predict (a rejected thinking signature), **self-heals**: the 400 is pre-stream, so Maxpool latches the session provider-only and transparently retries on GLM/Kimi — the client never sees the error. (Note: Claude Code may warn a resumed `glm-*` model "could not be restored" and fall back to `claude-opus-4-8`; that's a client-side message — routing is unaffected.)
 
 Provider rows do not use Claude Max session/week bars unless the provider returns compatible quota headers. For GLM/Kimi, Maxpool always tracks operational telemetry (`Act`, `OK`, `Fail`, `Last`) and also parses common `x-ratelimit-*` / `ratelimit-*` headers if present.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.15",
+  "version": "1.5.16",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -1034,16 +1034,16 @@ export class AccountManager {
   _migrationSafeForRequest(requestInfo = {}) {
     // Fail closed on any body we couldn't fully scan (non-JSON / parse error).
     if (requestInfo.bodyThinkingScanned !== true) return false;
-    // A foreign (GLM/Kimi) session is provider-pinned; the only cross it could make
-    // is GLM↔Kimi, whose mismatched thinking formats risk a reasoning-loop — keep it
-    // on its bound provider rather than rebalancing.
-    if (this._effectiveOrigin(requestInfo).class === 'foreign') return false;
+    // An Anthropic-incompatible (provider-pinned) session's only possible cross is
+    // GLM↔Kimi, whose mismatched thinking formats risk a reasoning-loop — keep it on
+    // its bound provider rather than rebalancing.
+    if (this._effectiveIncompatible(requestInfo).incompatible) return false;
     // A signed-thinking request is migration-safe when cross-account thinking
     // migration is enabled: the signature is content/model integrity, not account-
-    // bound, and the rebalance candidate filter (_matchesRequest → _isRequestCompatible)
-    // already bars providers for thinking, so every eligible target is a Claude
-    // account. When the flag is off, keep the conservative bar (never migrate signed
-    // thinking) until the revert-to-issuer fail-safe lands (#16).
+    // bound. The rebalance candidate loop (_shouldRebalanceBoundSession) additionally
+    // skips PROVIDER targets for a signed-thinking request, so every migration target
+    // stays a Claude account (a signed block isn't shuttled to a provider mid-session).
+    // When the flag is off, keep the conservative bar (never migrate signed thinking).
     if (requestInfo.requiresAnthropicThinkingIntegrity === true) {
       return this.scheduler.crossAccountThinkingMigration === true;
     }
@@ -1084,6 +1084,10 @@ export class AccountManager {
     for (const account of this.accounts) {
       if (account.index === bound.index) continue;
       if (excludedIndexes.has(account.index)) continue;
+      // Keep a signed-thinking session's live migration on Claude accounts only —
+      // don't shuttle an Anthropic-signed block onto a provider mid-session even
+      // though _isRequestCompatible now allows providers for thinking under policy.
+      if (requestInfo.requiresAnthropicThinkingIntegrity === true && account.type === 'provider') continue;
       if (!this._matchesRequest(account, profile, requestInfo)) continue;
       // Genuinely-healthy alternatives only (normal/soft/unknown weekly + model headroom).
       if (!this._isAvailable(account, { allowWeeklyReserve: false, allowWeeklyCritical: false, model: requestInfo.model })) continue;
@@ -1493,7 +1497,7 @@ export class AccountManager {
     const base = Number.isFinite(account.priority) ? account.priority : 0;
     if (account.type === 'provider'
         && this._crossProviderFallbackPolicy() === 'always'
-        && this._effectiveOrigin(requestInfo).class !== 'foreign') {
+        && !this._effectiveIncompatible(requestInfo).incompatible) {
       return 0;
     }
     return base;
@@ -1506,53 +1510,45 @@ export class AccountManager {
     return true;
   }
 
-  // Effective home-provider origin for a request: the request's own transcript
-  // classification, OR a sticky 'foreign' latch on the session (which never
-  // downgrades — once a GLM/Kimi tool-use id is seen, later no-tool follow-up turns
-  // of that session stay provider-pinned). Both the selector AND the retry oracle
-  // read this so they never disagree (foreign-barred here == foreign-barred there).
-  _effectiveOrigin(requestInfo = {}) {
+  // Effective Anthropic-incompatibility for a request: the request's own transcript
+  // verdict, OR a sticky latch on the session — set once a foreign server_tool_use
+  // id is seen, or once Anthropic REJECTED the transcript on replay (react-and-heal
+  // in server.js). Never downgrades, so a later no-tool follow-up turn stays
+  // provider-pinned. Both the selector AND the retry oracle read this so they never
+  // disagree. homeProvider is a SOFT hint (first foreign id shape) for 'never' only.
+  _effectiveIncompatible(requestInfo = {}) {
     const sticky = requestInfo.sessionKey ? this.sessionPolicies.get(requestInfo.sessionKey) : null;
-    if (sticky?.originClass === 'foreign') {
-      return { class: 'foreign', provider: sticky.originProvider || requestInfo.originProvider || null };
-    }
-    if (requestInfo.originClass === 'foreign') {
-      return { class: 'foreign', provider: requestInfo.originProvider || null };
-    }
     return {
-      class: requestInfo.originClass || sticky?.originClass || null,
-      provider: requestInfo.originProvider || sticky?.originProvider || null,
+      incompatible: Boolean(requestInfo.anthropicIncompatible || sticky?.anthropicIncompatible),
+      homeProvider: requestInfo.homeProvider || sticky?.homeProvider || null,
     };
   }
 
   _isRequestCompatible(account, profile, requestInfo = {}) {
     if (!this._matchesProfile(account, profile)) return false;
 
-    const origin = this._effectiveOrigin(requestInfo);
+    const { incompatible, homeProvider } = this._effectiveIncompatible(requestInfo);
+    const policy = this._crossProviderFallbackPolicy();
 
-    if (origin.class === 'foreign') {
-      // HARD, policy-INDEPENDENT: a GLM/Kimi transcript can never replay to an
-      // Anthropic account (400 on the non-`srvtoolu_` id). Provider accounts only.
-      // This branch also SUPERSEDES the Anthropic-thinking bar below — a foreign
-      // session's (unsigned) thinking must go BACK to its provider, never be
-      // force-pinned to Claude (the misroute that caused the reported 400).
+    if (incompatible) {
+      // The transcript can't replay to Claude (a foreign server_tool_use id, or
+      // content Anthropic rejected on replay) — provider accounts ONLY, regardless
+      // of policy. Providers are lenient and accept each other's ids (GLM↔Kimi is
+      // fine); 'never' pins to the detected home provider when known.
       if (account.type !== 'provider') return false;
-      // 'never' pins to the ORIGIN provider family when known (GLM→GLM, Kimi→Kimi).
-      // 'when-exhausted'/'always' let the sibling provider serve too (priority 10<20
-      // keeps it a fallback). Unknown origin provider ⇒ any provider allowed.
-      if (this._crossProviderFallbackPolicy() === 'never'
-          && origin.provider && account.provider !== origin.provider) return false;
+      if (policy === 'never' && homeProvider && account.provider !== homeProvider) return false;
       return true;
     }
 
-    // Anthropic-origin or unknown: oauth (Claude) is always eligible. Provider
-    // fallback (Claude→GLM/Kimi, the SAFE direction) is policy-gated and still
-    // barred for signed thinking (an Anthropic signature can't be validated by a
-    // provider). 'never' = Claude session uses Claude only.
-    if (account.type === 'provider') {
-      if (this._crossProviderFallbackPolicy() === 'never') return false;
-      if (this._requiresAnthropicThinkingIntegrity(requestInfo)) return false;
-    }
+    // Compatible session — includes Kimi and GLM-without-server-tools, whose regular
+    // tool_use ids pass Anthropic's loose validation, AND ordinary Claude sessions.
+    // Claude is eligible + preferred (priority 0). Provider fallback is the SAFE
+    // direction (lenient providers accept Anthropic ids/signatures) and is
+    // policy-gated ONLY: 'never' keeps a Claude session on Claude; 'when-exhausted'
+    // lets providers serve as a priority-fallback; 'always' peers them
+    // (_effectivePriority). Signed thinking no longer bars providers here — but its
+    // live MIGRATION stays Claude-only (see the rebalance guard).
+    if (account.type === 'provider' && policy === 'never') return false;
     return true;
   }
 
@@ -1561,33 +1557,34 @@ export class AccountManager {
     if (requestInfo.requiresAnthropicThinkingIntegrity) {
       this.markSessionThinkingProtected(requestInfo.sessionKey, requestInfo.model);
     }
-    if (requestInfo.originClass === 'foreign') {
-      this.markSessionOrigin(requestInfo.sessionKey, 'foreign', requestInfo.originProvider);
+    if (requestInfo.anthropicIncompatible) {
+      this.markSessionIncompatible(requestInfo.sessionKey, requestInfo.homeProvider);
     }
   }
 
-  // Latch a session's foreign (GLM/Kimi) origin. Only 'foreign' is sticky — an
-  // Anthropic classification never bars anything, and never-downgrade keeps a
-  // provider-pinned session correct across a later no-tool follow-up turn.
-  markSessionOrigin(sessionKey, originClass, originProvider = null) {
-    if (!sessionKey || originClass !== 'foreign') return;
+  // Latch a session as Anthropic-incompatible (a foreign server_tool_use id, or a
+  // transcript Anthropic rejected on replay). Sticky + never-downgrades so the
+  // session stays provider-pinned across later follow-up turns.
+  markSessionIncompatible(sessionKey, homeProvider = null) {
+    if (!sessionKey) return;
     const existing = this.sessionPolicies.get(sessionKey) || {};
-    if (existing.originClass !== 'foreign') {
-      console.log(`[Maxpool] Session "${sessionKey}" is ${originProvider || 'provider'}-origin (foreign transcript) — pinned to provider accounts`);
+    if (!existing.anthropicIncompatible) {
+      console.log(`[Maxpool] Session "${sessionKey}" is Anthropic-incompatible (${homeProvider || 'provider'} transcript) — pinned to GLM/Kimi`);
     }
     this.sessionPolicies.set(sessionKey, {
       ...existing,
-      originClass: 'foreign',
-      originProvider: existing.originProvider || originProvider || null,
+      anthropicIncompatible: true,
+      homeProvider: existing.homeProvider || homeProvider || null,
     });
   }
 
+  // Marks a session as containing Anthropic signed thinking. This no longer bars
+  // provider fallback (a lenient provider accepts an Anthropic signature) — it only
+  // keeps the session's live cross-account MIGRATION on Claude (the rebalance guard),
+  // so a signed block isn't needlessly shuttled to a provider mid-session.
   markSessionThinkingProtected(sessionKey, model = null) {
     if (!sessionKey) return;
     const existing = this.sessionPolicies.get(sessionKey) || {};
-    if (!existing.requiresAnthropicThinkingIntegrity) {
-      console.log(`[Maxpool] Session "${sessionKey}" contains Anthropic signed thinking; provider fallback disabled`);
-    }
     this.sessionPolicies.set(sessionKey, {
       ...existing,
       requiresAnthropicThinkingIntegrity: true,
@@ -2416,7 +2413,7 @@ export class AccountManager {
       sessions: {
         stickyBindings: this.sessionBindings.size,
         thinkingProtected: [...this.sessionPolicies.values()].filter(p => p.requiresAnthropicThinkingIntegrity).length,
-        foreignPinned: [...this.sessionPolicies.values()].filter(p => p.originClass === 'foreign').length,
+        providerPinned: [...this.sessionPolicies.values()].filter(p => p.anthropicIncompatible).length,
       },
     };
   }

package/src/server.js

@@ -736,8 +736,14 @@ async function forwardRequest(
 
     if (upstreamRes.status >= 400 && upstreamRes.status < 500) {
       const errorBody = await readErrorBody(upstreamRes);
+      // A transcript a lenient provider (GLM/Kimi) produced can be rejected by
+      // Anthropic on replay (a non-srvtoolu_ server_tool_use id, or a thinking
+      // signature it can't validate). Detect it on an Anthropic account so we can
+      // self-heal onto a provider instead of surfacing the 400.
+      const anthropicIncompat = account.type !== 'provider' && isAnthropicIncompatBody(errorBody);
       const errorType = errorBody.includes('Invalid `signature` in `thinking` block')
         ? 'invalid_thinking_signature'
+        : anthropicIncompat ? 'anthropic_incompatible_transcript'
         : `HTTP ${upstreamRes.status}`;
       accountManager.releaseAccount(lease, { status: upstreamRes.status, error: errorType });
 
@@ -768,6 +774,24 @@ async function forwardRequest(
         }
       }
 
+      // React-and-heal: this transcript can't run on Claude (foreign server_tool_use
+      // id / thinking Anthropic can't validate). The 400 is pre-stream and the body
+      // is buffered, so latch the session Anthropic-incompatible (sticky → once per
+      // session) and retry PROVIDER-only, rather than surfacing the 400. Only worth
+      // it when a provider can actually serve it (profile=all with a GLM/Kimi token).
+      const providerAvailable = accountManager.accounts?.some(a => a.type === 'provider' && a.enabled !== false);
+      if (anthropicIncompat && requestInfo.sessionKey && providerAvailable
+        && canRetryBufferedBody && retryCount + 1 < maxAttempts && !res.headersSent) {
+        accountManager.markSessionIncompatible?.(requestInfo.sessionKey, requestInfo.homeProvider);
+        excludedIndexes.add(account.index);
+        console.log(`[Maxpool] Anthropic rejected this transcript (server_tool_use/thinking); pinning session to GLM/Kimi and retrying`);
+        return forwardRequest(
+          req, res, body, accountManager, upstream, retryCount + 1, hooks, reqId, ctx, logDir,
+          retryConfig, queueConfig, { ...requestInfo, anthropicIncompatible: true },
+          canRetryBufferedBody, canQueueBufferedBody, excludedIndexes,
+        );
+      }
+
       ctx.status = upstreamRes.status;
       sendErrorBody(res, requestInfo, upstreamRes.status, errorBody, upstreamRes.headers);
       return;
@@ -987,15 +1011,15 @@ function computeQueueWindowMs({
 }
 
 function unavailableMessage(accountManager, requestInfo = {}, retryAfter, willRecoverSoon = true) {
-  const origin = accountManager._effectiveOrigin?.(requestInfo) || { class: null, provider: null };
+  const incompat = accountManager._effectiveIncompatible?.(requestInfo) || { incompatible: false, homeProvider: null };
 
-  // A foreign (GLM/Kimi)-origin session is pinned to provider accounts — Anthropic
-  // would 400 on its tool-use ids. "All Claude at limit" would be the wrong story
-  // (the Claude accounts are irrelevant to it); say what actually blocks it.
-  if (origin.class === 'foreign') {
-    const fam = origin.provider === 'zai' ? 'GLM' : origin.provider === 'kimi' ? 'Kimi' : 'GLM/Kimi';
+  // An Anthropic-incompatible session is pinned to provider accounts — Anthropic
+  // 400s on its server_tool_use id / foreign thinking. "All Claude at limit" would
+  // be the wrong story (Claude is irrelevant to it); say what actually blocks it.
+  if (incompat.incompatible) {
+    const fam = incompat.homeProvider === 'zai' ? 'GLM' : incompat.homeProvider === 'kimi' ? 'Kimi' : 'GLM/Kimi';
     const eta = Number.isFinite(retryAfter) && retryAfter > 0 ? ` Retry in ${retryAfter}s.` : '';
-    return `This session started on ${fam}, so only GLM/Kimi can serve it (a GLM/Kimi transcript can't run on Claude — Anthropic rejects its tool-call ids). No GLM/Kimi provider is available right now.${eta} Check the x-maxpool-zai-token / x-maxpool-kimi-token headers, or resume this session with 'cc glm'/'cc kimi'.`;
+    return `This session's transcript can only run on GLM/Kimi — Claude rejects its server-tool ids/thinking on replay. No GLM/Kimi provider is available right now.${eta} Check the x-maxpool-zai-token / x-maxpool-kimi-token headers, or resume with 'cc ${incompat.homeProvider === 'kimi' ? 'kimi' : 'glm'}'.`;
   }
 
   const thinking = requestInfo.requiresAnthropicThinkingIntegrity
@@ -1021,7 +1045,7 @@ function unavailableMessage(accountManager, requestInfo = {}, retryAfter, willRe
   return `All ${n} accounts exhausted. Retry in ${retryAfter}s.`;
 }
 
-export const __serverTest = { unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin };
+export const __serverTest = { unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody };
 
 async function readErrorBody(upstreamRes, limitBytes = 64 * 1024) {
   if (!upstreamRes.body) return '';
@@ -1489,15 +1513,13 @@ function describeRequest(req, body) {
     // rebalancing); an unparsed body leaves this false → treated as NOT safe
     // (fail-closed) so we never replay a signed thinking block to a new account.
     info.bodyThinkingScanned = true;
-    // Home-provider origin of the resumed transcript (from tool-use id shapes).
-    // A 'foreign' (GLM/Kimi) session can NEVER be replayed to an Anthropic account
-    // (Anthropic 400s on a non-srvtoolu_ server_tool_use id) — routing pins it to
-    // provider accounts. A missing originClass = no tool blocks yet (ambiguous) OR
-    // an unparsed body; both fail OPEN in routing (never stranded), and stickiness
-    // (once a foreign id is seen) keeps a latched session pinned regardless.
+    // Whether the resumed transcript can replay to a Claude account. A session with
+    // a foreign server_tool_use id CANNOT (Anthropic 400s) → routing pins it to
+    // providers. Everything else stays Claude-eligible (Kimi/GLM without server-tools
+    // replay fine); a rare rejected-thinking 400 self-heals via react-and-heal.
     const origin = detectTranscriptOrigin(json);
-    if (origin.class) info.originClass = origin.class;
-    if (origin.provider) info.originProvider = origin.provider;
+    if (origin.anthropicIncompatible) info.anthropicIncompatible = true;
+    if (origin.homeProvider) info.homeProvider = origin.homeProvider;
   } catch {
     // Non-JSON requests are rare; body size still gives a useful load signal.
   }
@@ -1517,39 +1539,57 @@ function requiresAnthropicThinkingIntegrity(json) {
 // anything NOT matching this is treated as foreign (fail-closed classification).
 const ANTHROPIC_TOOL_ID = /^(toolu|srvtoolu)_/;
 
-// Classify a resumed transcript's HOME PROVIDER from the tool-use id shapes in its
-// replayed `messages`. Returns { class: 'foreign' | 'anthropic' | null, provider:
-// 'zai' | 'kimi' | null }. ANY non-Anthropic tool-use / server_tool_use / tool_result
-// id ⇒ 'foreign' (that session can never be replayed to Anthropic). 'anthropic' if
-// only Anthropic ids seen; null if no tool blocks at all (ambiguous — a fresh session
-// with no incompatible history yet). The request MODEL is NOT used — Claude Code
-// rewrites it to claude-opus-4-8 on resume, so only the transcript is trustworthy.
+// Decide whether a resumed transcript can replay to an Anthropic (Claude) account,
+// from the tool-use id shapes in its `messages`. Returns { anthropicIncompatible,
+// homeProvider }.
+//   anthropicIncompatible = the transcript has a `server_tool_use` id NOT matching
+//     ^srvtoolu_ — the ONE DETERMINISTIC incompatibility (Anthropic 400s on replay,
+//     the reported bug). Anthropic validates a client `tool_use.id` LOOSELY
+//     (^[a-zA-Z0-9_-]+$), so GLM `call_…` / Kimi `tool_…` client ids PASS and a
+//     Kimi/GLM session without server-tools is FINE on Claude — we do NOT predict
+//     those (a rejected thinking signature, if it ever happens, self-heals via the
+//     4xx react-and-heal in forwardRequest). server_tool_use is rare (GLM ~15%,
+//     Kimi 0%), so most sessions are compatible.
+//   homeProvider = the first foreign tool-use id shape (call_→zai, tool_→kimi), a
+//     SOFT hint for the 'never' same-family preference only; ambiguous/none → null.
+// The request MODEL is not used — Claude Code rewrites it to opus on resume.
 function detectTranscriptOrigin(json) {
-  if (!json || typeof json !== 'object') return { class: null, provider: null };
-  let sawAnthropic = false;
-  let foreignProvider = null; // 'zai' | 'kimi' | 'foreign'
-  const classifyForeign = id =>
-    id.startsWith('call_') ? 'zai' : id.startsWith('tool_') ? 'kimi' : 'foreign';
+  if (!json || typeof json !== 'object') return { anthropicIncompatible: false, homeProvider: null };
+  let incompatible = false;
+  let homeProvider = null;
+  const fam = id => id.startsWith('call_') ? 'zai' : id.startsWith('tool_') ? 'kimi' : null;
+  const noteForeign = id => { if (!homeProvider) homeProvider = fam(id); };
   const visit = value => {
-    if (foreignProvider) return; // one foreign id is decisive — early-exit the walk
-    if (Array.isArray(value)) { for (const v of value) { visit(v); if (foreignProvider) return; } return; }
+    if (incompatible) return; // server_tool_use is decisive — stop
+    if (Array.isArray(value)) { for (const v of value) { visit(v); if (incompatible) return; } return; }
     if (!value || typeof value !== 'object') return;
     const t = value.type;
-    if ((t === 'tool_use' || t === 'server_tool_use') && typeof value.id === 'string') {
-      if (ANTHROPIC_TOOL_ID.test(value.id)) sawAnthropic = true;
-      else { foreignProvider = classifyForeign(value.id); return; }
-    }
-    if (t === 'tool_result' && typeof value.tool_use_id === 'string') {
-      if (ANTHROPIC_TOOL_ID.test(value.tool_use_id)) sawAnthropic = true;
-      else { foreignProvider = classifyForeign(value.tool_use_id); return; }
+    if (t === 'server_tool_use' && typeof value.id === 'string' && !ANTHROPIC_TOOL_ID.test(value.id)) {
+      incompatible = true; noteForeign(value.id); return;
     }
+    if (t === 'tool_use' && typeof value.id === 'string' && !ANTHROPIC_TOOL_ID.test(value.id)) noteForeign(value.id);
+    if (t === 'tool_result' && typeof value.tool_use_id === 'string' && !ANTHROPIC_TOOL_ID.test(value.tool_use_id)) noteForeign(value.tool_use_id);
     if (value.content) visit(value.content);
     if (value.messages) visit(value.messages);
   };
   visit(json.messages);
-  if (foreignProvider) return { class: 'foreign', provider: foreignProvider === 'foreign' ? null : foreignProvider };
-  if (sawAnthropic) return { class: 'anthropic', provider: null };
-  return { class: null, provider: null };
+  return { anthropicIncompatible: incompatible, homeProvider };
+}
+
+// Does this upstream 4xx error body indicate the transcript is un-replayable to
+// Anthropic (a lenient GLM/Kimi provider produced content Anthropic rejects on
+// replay)? Matches the three known shapes: a non-srvtoolu_ server_tool_use id, or a
+// thinking-block signature Anthropic can't validate (invalid OR missing). Used to
+// self-heal onto a provider instead of surfacing the 400.
+function isAnthropicIncompatBody(body) {
+  if (!body) return false;
+  // The deterministic server-tool-id 400, the known invalid-signature error, or a
+  // thinking-block signature VALIDATION error (missing/invalid) — the last gated on
+  // a validation verb so a user message merely echoing "thinking"/"signature" can't
+  // false-latch the session provider-pinned for life.
+  return /srvtoolu_|server_tool_use/.test(body)
+    || /invalid `signature` in `thinking`/i.test(body)
+    || (/thinking/.test(body) && /signature/.test(body) && /(should match|required|invalid|expected|must )/i.test(body));
 }
 
 function containsThinkingBlock(value) {

package/src/tui.js

@@ -864,6 +864,11 @@ export class TUI {
       lines.push(yellow('  No accounts configured. Press [a] to add one.'));
     } else {
       lines.push('');
+      // Column legend — the per-row numbers are otherwise cryptic. Ses/Wk are the
+      // two quota bars; Now is live concurrency; 15m/1h are recent throughput.
+      if (W >= 88) {
+        lines.push(' ' + dim('Ses/Wk = 5h/7d quota (used% · resets-in) · Now = in-flight (weight) · 15m/1h = requests served (avg latency · Nf=fails)'));
+      }
       const showBoth = W >= 70;
       const bw = showBoth
         ? Math.max(5, Math.min(20, Math.floor((W - 56) / 2)))