maxpool 1.5.15 → 1.5.17

package/README.md

@@ -194,7 +194,9 @@ Provider fallback credentials can be supplied per Claude Code process with `ANTH
 
 `x-maxpool-session: <id>` enables session affinity. With this header, the first request for a Claude Code process is routed by the adaptive load balancer, then later requests from the same process keep using that home account while it remains available. If the home account is rate-limited, exhausted, in cooldown, or removed, the session temporarily uses another eligible route. When the home account becomes available again, the session returns to it. For the `all` profile, a Claude session that had to spill onto GLM/Kimi moves back to Claude once a Claude account frees up — **as long as it produced no provider-format tool calls while there**.
 
-**Cross-provider session pinning (`all` profile).** Maxpool classifies each session's home provider from its transcript: Anthropic tool-use ids are `toolu_`/`srvtoolu_`, GLM (z.ai) emits `call_`, Kimi (Moonshot) emits `tool_`. A session whose replayed history contains any non-Anthropic tool-use id (e.g. resuming a `cc glm` session under `cc all`) is **pinned to GLM/Kimi** and never routed to a Claude account — Anthropic rejects a non-`srvtoolu_` `server_tool_use.id` with a 400, so that direction is a hard incompatibility, not a preference. The reverse (a Claude session spilling onto GLM/Kimi) is safe. This is governed by `scheduler.crossProviderFallbackPolicy` (`never` | `when-exhausted` (default) | `always`), cyclable live in the TUI Routing menu (`m` → `f`): `never` = strict same-family pin, `when-exhausted` = cross only once the home family is exhausted, `always` = providers peer with Claude for a Claude session. A GLM/Kimi-origin session is never sent to Claude under any policy. (Note: Claude Code itself may warn that a resumed `glm-*` model "could not be restored" and fall back to `claude-opus-4-8`; that is a client-side session-store message — Maxpool still routes the session to GLM/Kimi correctly by its transcript.)
+**Cross-provider fallback + compatibility (`all` profile).** Claude, GLM (z.ai), and Kimi (Moonshot) interoperate for ordinary sessions — a regular tool-use id (`call_`/`tool_`) passes Anthropic's loose validation, so a Kimi or GLM session runs fine on Claude and a Claude session spills onto GLM/Kimi when Claude is unavailable. `scheduler.crossProviderFallbackPolicy` controls it, cyclable live in the TUI Routing menu (`m` → `f`): `never` = strict same-family (Claude→Claude, GLM→GLM, Kimi→Kimi), `when-exhausted` (default) = cross only once the home family is exhausted, `always` = providers peer with Claude.
+
+The one hard incompatibility Maxpool guards is a **`server_tool_use` id** that isn't `srvtoolu_` — Anthropic 400s that on replay (e.g. a `cc glm` session that used a server tool, resumed under `cc all`). Maxpool predicts that case ahead (pins the session to GLM/Kimi) and, for anything it can't predict (a rejected thinking signature), **self-heals**: the 400 is pre-stream, so Maxpool latches the session provider-only and transparently retries on GLM/Kimi — the client never sees the error. (Note: Claude Code may warn a resumed `glm-*` model "could not be restored" and fall back to `claude-opus-4-8`; that's a client-side message — routing is unaffected.)
 
 Provider rows do not use Claude Max session/week bars unless the provider returns compatible quota headers. For GLM/Kimi, Maxpool always tracks operational telemetry (`Act`, `OK`, `Fail`, `Last`) and also parses common `x-ratelimit-*` / `ratelimit-*` headers if present.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.15",
+  "version": "1.5.17",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -42,6 +42,19 @@ function emptyQuota() {
     scopedWeekly: {},
     unifiedStatus: null,   // allowed | allowed_warning | rejected
     resetsAt: null,
+    // Provider (z.ai / Kimi) quota — kept SEPARATE from unified* so a provider
+    // reading never leaks into the OAuth quota gates (_isAvailable / _weeklyRawState
+    // / _accountScarcity read unified* only). z.ai is pollable; Kimi is not.
+    providerSes: null,          // utilization 0-1 (z.ai 5h token window)
+    providerSesReset: null,     // ms
+    providerWk: null,           // utilization 0-1 (z.ai weekly), null if plan has none
+    providerWkReset: null,      // ms
+    providerQuotaSource: null,  // 'zai' (pollable) | 'console-only' (kimi) | null
+    // Freshness: last time a background usage PROBE succeeded for this account
+    // (oauth fetchUsage OR provider fetchProviderUsage). Drives the TUI staleness
+    // marker — a swallowed failing probe no longer silently freezes a stale tag.
+    // Header-driven updates do NOT stamp this (headers can't refresh scoped/provider).
+    lastProbeOkAt: null,        // ms
   };
 }
 
@@ -589,8 +602,14 @@ export class AccountManager {
     if (!fam) return null;
     const e = account.quota?.scopedWeekly?.[fam];
     if (!e || e.isActive === false) return null;
-    const exhausted = e.severity === 'critical'
-      || (e.utilization != null && e.utilization >= this.scheduler.weeklyExhaustedThreshold);
+    // Bench ONLY at genuine exhaustion (>= weeklyExhaustedThreshold). Anthropic
+    // labels a scoped weekly `severity:'critical'` well before it's actually
+    // capped (~90%), where the model still has headroom and is still served — a
+    // hard bench there strands the remainder and mislabels the account "maxed".
+    // A real scoped 429 writes utilization:1 (markRateLimited), so genuine
+    // exhaustion is still caught by the threshold. Same predicate drives the TUI
+    // `maxed` tag, so "maxed" renders iff the model is actually benched.
+    const exhausted = e.utilization != null && e.utilization >= this.scheduler.weeklyExhaustedThreshold;
     return exhausted ? { resetAt: e.resetAt || null, family: fam } : null;
   }
 
@@ -1034,16 +1053,16 @@ export class AccountManager {
   _migrationSafeForRequest(requestInfo = {}) {
     // Fail closed on any body we couldn't fully scan (non-JSON / parse error).
     if (requestInfo.bodyThinkingScanned !== true) return false;
-    // A foreign (GLM/Kimi) session is provider-pinned; the only cross it could make
-    // is GLM↔Kimi, whose mismatched thinking formats risk a reasoning-loop — keep it
-    // on its bound provider rather than rebalancing.
-    if (this._effectiveOrigin(requestInfo).class === 'foreign') return false;
+    // An Anthropic-incompatible (provider-pinned) session's only possible cross is
+    // GLM↔Kimi, whose mismatched thinking formats risk a reasoning-loop — keep it on
+    // its bound provider rather than rebalancing.
+    if (this._effectiveIncompatible(requestInfo).incompatible) return false;
     // A signed-thinking request is migration-safe when cross-account thinking
     // migration is enabled: the signature is content/model integrity, not account-
-    // bound, and the rebalance candidate filter (_matchesRequest → _isRequestCompatible)
-    // already bars providers for thinking, so every eligible target is a Claude
-    // account. When the flag is off, keep the conservative bar (never migrate signed
-    // thinking) until the revert-to-issuer fail-safe lands (#16).
+    // bound. The rebalance candidate loop (_shouldRebalanceBoundSession) additionally
+    // skips PROVIDER targets for a signed-thinking request, so every migration target
+    // stays a Claude account (a signed block isn't shuttled to a provider mid-session).
+    // When the flag is off, keep the conservative bar (never migrate signed thinking).
     if (requestInfo.requiresAnthropicThinkingIntegrity === true) {
       return this.scheduler.crossAccountThinkingMigration === true;
     }
@@ -1084,6 +1103,10 @@ export class AccountManager {
     for (const account of this.accounts) {
       if (account.index === bound.index) continue;
       if (excludedIndexes.has(account.index)) continue;
+      // Keep a signed-thinking session's live migration on Claude accounts only —
+      // don't shuttle an Anthropic-signed block onto a provider mid-session even
+      // though _isRequestCompatible now allows providers for thinking under policy.
+      if (requestInfo.requiresAnthropicThinkingIntegrity === true && account.type === 'provider') continue;
       if (!this._matchesRequest(account, profile, requestInfo)) continue;
       // Genuinely-healthy alternatives only (normal/soft/unknown weekly + model headroom).
       if (!this._isAvailable(account, { allowWeeklyReserve: false, allowWeeklyCritical: false, model: requestInfo.model })) continue;
@@ -1493,7 +1516,7 @@ export class AccountManager {
     const base = Number.isFinite(account.priority) ? account.priority : 0;
     if (account.type === 'provider'
         && this._crossProviderFallbackPolicy() === 'always'
-        && this._effectiveOrigin(requestInfo).class !== 'foreign') {
+        && !this._effectiveIncompatible(requestInfo).incompatible) {
       return 0;
     }
     return base;
@@ -1506,53 +1529,45 @@ export class AccountManager {
     return true;
   }
 
-  // Effective home-provider origin for a request: the request's own transcript
-  // classification, OR a sticky 'foreign' latch on the session (which never
-  // downgrades — once a GLM/Kimi tool-use id is seen, later no-tool follow-up turns
-  // of that session stay provider-pinned). Both the selector AND the retry oracle
-  // read this so they never disagree (foreign-barred here == foreign-barred there).
-  _effectiveOrigin(requestInfo = {}) {
+  // Effective Anthropic-incompatibility for a request: the request's own transcript
+  // verdict, OR a sticky latch on the session — set once a foreign server_tool_use
+  // id is seen, or once Anthropic REJECTED the transcript on replay (react-and-heal
+  // in server.js). Never downgrades, so a later no-tool follow-up turn stays
+  // provider-pinned. Both the selector AND the retry oracle read this so they never
+  // disagree. homeProvider is a SOFT hint (first foreign id shape) for 'never' only.
+  _effectiveIncompatible(requestInfo = {}) {
     const sticky = requestInfo.sessionKey ? this.sessionPolicies.get(requestInfo.sessionKey) : null;
-    if (sticky?.originClass === 'foreign') {
-      return { class: 'foreign', provider: sticky.originProvider || requestInfo.originProvider || null };
-    }
-    if (requestInfo.originClass === 'foreign') {
-      return { class: 'foreign', provider: requestInfo.originProvider || null };
-    }
     return {
-      class: requestInfo.originClass || sticky?.originClass || null,
-      provider: requestInfo.originProvider || sticky?.originProvider || null,
+      incompatible: Boolean(requestInfo.anthropicIncompatible || sticky?.anthropicIncompatible),
+      homeProvider: requestInfo.homeProvider || sticky?.homeProvider || null,
     };
   }
 
   _isRequestCompatible(account, profile, requestInfo = {}) {
     if (!this._matchesProfile(account, profile)) return false;
 
-    const origin = this._effectiveOrigin(requestInfo);
+    const { incompatible, homeProvider } = this._effectiveIncompatible(requestInfo);
+    const policy = this._crossProviderFallbackPolicy();
 
-    if (origin.class === 'foreign') {
-      // HARD, policy-INDEPENDENT: a GLM/Kimi transcript can never replay to an
-      // Anthropic account (400 on the non-`srvtoolu_` id). Provider accounts only.
-      // This branch also SUPERSEDES the Anthropic-thinking bar below — a foreign
-      // session's (unsigned) thinking must go BACK to its provider, never be
-      // force-pinned to Claude (the misroute that caused the reported 400).
+    if (incompatible) {
+      // The transcript can't replay to Claude (a foreign server_tool_use id, or
+      // content Anthropic rejected on replay) — provider accounts ONLY, regardless
+      // of policy. Providers are lenient and accept each other's ids (GLM↔Kimi is
+      // fine); 'never' pins to the detected home provider when known.
       if (account.type !== 'provider') return false;
-      // 'never' pins to the ORIGIN provider family when known (GLM→GLM, Kimi→Kimi).
-      // 'when-exhausted'/'always' let the sibling provider serve too (priority 10<20
-      // keeps it a fallback). Unknown origin provider ⇒ any provider allowed.
-      if (this._crossProviderFallbackPolicy() === 'never'
-          && origin.provider && account.provider !== origin.provider) return false;
+      if (policy === 'never' && homeProvider && account.provider !== homeProvider) return false;
       return true;
     }
 
-    // Anthropic-origin or unknown: oauth (Claude) is always eligible. Provider
-    // fallback (Claude→GLM/Kimi, the SAFE direction) is policy-gated and still
-    // barred for signed thinking (an Anthropic signature can't be validated by a
-    // provider). 'never' = Claude session uses Claude only.
-    if (account.type === 'provider') {
-      if (this._crossProviderFallbackPolicy() === 'never') return false;
-      if (this._requiresAnthropicThinkingIntegrity(requestInfo)) return false;
-    }
+    // Compatible session — includes Kimi and GLM-without-server-tools, whose regular
+    // tool_use ids pass Anthropic's loose validation, AND ordinary Claude sessions.
+    // Claude is eligible + preferred (priority 0). Provider fallback is the SAFE
+    // direction (lenient providers accept Anthropic ids/signatures) and is
+    // policy-gated ONLY: 'never' keeps a Claude session on Claude; 'when-exhausted'
+    // lets providers serve as a priority-fallback; 'always' peers them
+    // (_effectivePriority). Signed thinking no longer bars providers here — but its
+    // live MIGRATION stays Claude-only (see the rebalance guard).
+    if (account.type === 'provider' && policy === 'never') return false;
     return true;
   }
 
@@ -1561,33 +1576,34 @@ export class AccountManager {
     if (requestInfo.requiresAnthropicThinkingIntegrity) {
       this.markSessionThinkingProtected(requestInfo.sessionKey, requestInfo.model);
     }
-    if (requestInfo.originClass === 'foreign') {
-      this.markSessionOrigin(requestInfo.sessionKey, 'foreign', requestInfo.originProvider);
+    if (requestInfo.anthropicIncompatible) {
+      this.markSessionIncompatible(requestInfo.sessionKey, requestInfo.homeProvider);
     }
   }
 
-  // Latch a session's foreign (GLM/Kimi) origin. Only 'foreign' is sticky — an
-  // Anthropic classification never bars anything, and never-downgrade keeps a
-  // provider-pinned session correct across a later no-tool follow-up turn.
-  markSessionOrigin(sessionKey, originClass, originProvider = null) {
-    if (!sessionKey || originClass !== 'foreign') return;
+  // Latch a session as Anthropic-incompatible (a foreign server_tool_use id, or a
+  // transcript Anthropic rejected on replay). Sticky + never-downgrades so the
+  // session stays provider-pinned across later follow-up turns.
+  markSessionIncompatible(sessionKey, homeProvider = null) {
+    if (!sessionKey) return;
     const existing = this.sessionPolicies.get(sessionKey) || {};
-    if (existing.originClass !== 'foreign') {
-      console.log(`[Maxpool] Session "${sessionKey}" is ${originProvider || 'provider'}-origin (foreign transcript) — pinned to provider accounts`);
+    if (!existing.anthropicIncompatible) {
+      console.log(`[Maxpool] Session "${sessionKey}" is Anthropic-incompatible (${homeProvider || 'provider'} transcript) — pinned to GLM/Kimi`);
     }
     this.sessionPolicies.set(sessionKey, {
       ...existing,
-      originClass: 'foreign',
-      originProvider: existing.originProvider || originProvider || null,
+      anthropicIncompatible: true,
+      homeProvider: existing.homeProvider || homeProvider || null,
     });
   }
 
+  // Marks a session as containing Anthropic signed thinking. This no longer bars
+  // provider fallback (a lenient provider accepts an Anthropic signature) — it only
+  // keeps the session's live cross-account MIGRATION on Claude (the rebalance guard),
+  // so a signed block isn't needlessly shuttled to a provider mid-session.
   markSessionThinkingProtected(sessionKey, model = null) {
     if (!sessionKey) return;
     const existing = this.sessionPolicies.get(sessionKey) || {};
-    if (!existing.requiresAnthropicThinkingIntegrity) {
-      console.log(`[Maxpool] Session "${sessionKey}" contains Anthropic signed thinking; provider fallback disabled`);
-    }
     this.sessionPolicies.set(sessionKey, {
       ...existing,
       requiresAnthropicThinkingIntegrity: true,
@@ -1651,6 +1667,16 @@ export class AccountManager {
     // soft de-preference of accounts burning ahead of an even pace. Never a bench.
     const paceCost = this._accountScarcity(account, now) * this.scheduler.paceCostWeight;
 
+    // Per-model weekly de-preference: an account whose scoped weekly for THIS
+    // request's model (e.g. Fable) is high-but-not-exhausted is a poor pick for
+    // that model — shed its load toward healthier accounts BEFORE the hard bench
+    // at weeklyExhaustedThreshold, so it's chosen only as overflow (rarely
+    // re-429ing). Scoped weekly is otherwise absent from scoring. Soft, never a
+    // bench; 0 below reserve and for models with no scoped cap.
+    const scopedPace = requestInfo.model
+      ? this._scopedScarcity(account, requestInfo.model, now) * this.scheduler.paceCostWeight
+      : 0;
+
     const fleetRecentWeight = ctx?.fleetRecentWeight ?? 0;
     const recentWeight = this._loadSummary(account, this.scheduler.spreadWindowMs, now).weight;
     const share = fleetRecentWeight > 0 ? recentWeight / fleetRecentWeight : 0;
@@ -1666,7 +1692,22 @@ export class AccountManager {
     // default) learns the real number within a cycle. `probing`/requalify still
     // flags a never-seen account for learning — that path is unchanged.
 
-    return concurrency + capPenalty + paceCost + spread + ramp + failurePenalty;
+    return concurrency + capPenalty + paceCost + scopedPace + spread + ramp + failurePenalty;
+  }
+
+  /**
+   * Per-model weekly pace-overage for `model`'s family, or 0 when the account has
+   * no scoped cap for it, the cap is inactive, or it's below the reserve tier
+   * (plenty of headroom → no steering). Same pace discount as _windowScarcity, so
+   * a scoped window about to reset is cheap to spend.
+   */
+  _scopedScarcity(account, model, now = Date.now()) {
+    const fam = modelFamily(model);
+    if (!fam) return 0;
+    const e = account.quota?.scopedWeekly?.[fam];
+    if (!e || e.isActive === false || e.utilization == null) return 0;
+    if (e.utilization < this.scheduler.weeklyReserveThreshold) return 0;
+    return this._windowScarcity(e.utilization, e.resetAt, WEEK_MS, now);
   }
 
   /**
@@ -1798,8 +1839,15 @@ export class AccountManager {
     }
     // Per-model weekly sub-limits (Fable, Opus, ...). Replace wholesale with the
     // fresh probe set so a family that dropped out of the response doesn't linger
-    // stale; expiry on reset is a backstop for the between-probe window.
+    // stale; expiry on reset is a backstop for the between-probe window. EXCEPTION:
+    // a `reactive` scoped-429 bench is authoritative-high — while its resetAt is
+    // still future, a lagging probe may neither lower it nor drop it (a probe that
+    // omits the family, or reports the pre-429 level, would otherwise un-bench it
+    // and trigger an immediate re-429 flap). _clearExpiredQuotas self-clears it at
+    // resetAt even if probes die.
     if (usage.scopedWeekly && typeof usage.scopedWeekly === 'object') {
+      const now = Date.now();
+      const prev = (q.scopedWeekly && typeof q.scopedWeekly === 'object') ? q.scopedWeekly : {};
       const fresh = {};
       for (const [fam, e] of Object.entries(usage.scopedWeekly)) {
         if (!e) continue;
@@ -1810,9 +1858,21 @@ export class AccountManager {
           isActive: e.isActive !== false,
         };
       }
+      for (const [fam, pe] of Object.entries(prev)) {
+        if (!pe || !pe.reactive || pe.resetAt == null || pe.resetAt <= now) continue;
+        const f = fresh[fam];
+        // Probe absent, null, or LOWER than the reactive bench → keep the bench.
+        // Probe CONFIRMS >= the reactive level → take the fresh reading (still >=
+        // threshold, so still exhausted; no stickiness needed).
+        if (!f || f.utilization == null || f.utilization < (pe.utilization ?? 0)) {
+          fresh[fam] = { ...pe };
+        }
+      }
       q.scopedWeekly = fresh;
     }
 
+    q.lastProbeOkAt = Date.now();
+
     // If we just learned this account's weekly window while probing, re-evaluate
     // selection (same path as learning it from a live response).
     if (account.probing && q.unified7dReset != null) {
@@ -1821,6 +1881,55 @@ export class AccountManager {
     }
   }
 
+  /**
+   * Update a PROVIDER account's quota from a provider usage probe
+   * (fetchProviderUsage). z.ai maps to Ses/Wk token windows; Kimi has no pollable
+   * source and only sets a `console-only` marker. Writes ONLY the provider* fields
+   * (never the unified or scopedWeekly fields) so a provider reading can't reach
+   * the OAuth quota gates.
+   */
+  applyProviderUsage(accountIndex, usage) {
+    const account = this.accounts[accountIndex];
+    if (!account || !usage) return;
+    const q = account.quota;
+    if (usage.error) {
+      // Distinguish "no pollable quota" (Kimi) from a transient probe failure.
+      // Never clear existing values on a transient error — let them age into the
+      // staleness marker instead of blanking the bars.
+      if (usage.source === 'console-only') q.providerQuotaSource = 'console-only';
+      return;
+    }
+    q.providerQuotaSource = usage.source || 'zai';
+    if (usage.ses) {
+      if (usage.ses.utilization != null) q.providerSes = clamp01(usage.ses.utilization);
+      if (usage.ses.resetAt != null) q.providerSesReset = usage.ses.resetAt;
+    }
+    if (usage.wk) {
+      if (usage.wk.utilization != null) q.providerWk = clamp01(usage.wk.utilization);
+      if (usage.wk.resetAt != null) q.providerWkReset = usage.wk.resetAt;
+    } else {
+      // Weekly window absent from this plan/response — clear so a stale weekly
+      // reading doesn't linger after a plan/window change.
+      q.providerWk = null;
+      q.providerWkReset = null;
+    }
+    q.lastProbeOkAt = Date.now();
+  }
+
+  /**
+   * True when the background quota probe hasn't succeeded in > 2× its interval —
+   * the last-known scoped/provider values are aging with no confirmation. Returns
+   * false when the probe is off (nothing to be stale against) or has never yet
+   * succeeded (startup — shown as "no data", not "stale").
+   */
+  _quotaProbeStale(account, now = Date.now()) {
+    const interval = this.quotaProbeIntervalMs;
+    if (!interval || interval <= 0) return false;
+    const last = account?.quota?.lastProbeOkAt;
+    if (last == null) return false;
+    return (now - last) > Math.max(2 * interval, 120_000);
+  }
+
   /**
    * Update an account's quota tracking from upstream response headers.
    */
@@ -1959,6 +2068,10 @@ export class AccountManager {
         resetAt: Date.now() + (retryAfter * 1000),
         severity: 'critical',
         isActive: true,
+        // Authoritative-high: a real reject. A lagging 60s probe reporting the
+        // pre-429 level (e.g. 0.96) must NOT lower/drop this before resetAt, else
+        // the account un-benches and immediately re-429s — a per-probe flap.
+        reactive: true,
       };
       account.lastStatus = options.status || 429;
       account.lastErrorAt = Date.now();
@@ -2416,7 +2529,7 @@ export class AccountManager {
       sessions: {
         stickyBindings: this.sessionBindings.size,
         thinkingProtected: [...this.sessionPolicies.values()].filter(p => p.requiresAnthropicThinkingIntegrity).length,
-        foreignPinned: [...this.sessionPolicies.values()].filter(p => p.originClass === 'foreign').length,
+        providerPinned: [...this.sessionPolicies.values()].filter(p => p.anthropicIncompatible).length,
       },
     };
   }

package/src/index.js

@@ -564,6 +564,9 @@ async function serverWorkerCommand() {
   // assertions (mirrors MAXPOOL_DISABLE_SLEEP_GUARD).
   const probeSeconds = process.env.MAXPOOL_DISABLE_QUOTA_PROBE === '1' ? 0 : (config.quotaProbeSeconds || 0);
   const prober = new Prober(accountManager, { intervalMs: probeSeconds * 1000 });
+  // Tell the AM the probe cadence so the TUI can flag a scoped/provider tag whose
+  // background probe has gone stale (> 2× interval since last success).
+  accountManager.quotaProbeIntervalMs = probeSeconds * 1000;
 
   // Persist refreshed tokens back to config. Defense-in-depth: the updater reads
   // the on-disk refresh token and SKIPS the rotation if a fresher writer already

package/src/oauth.js

@@ -245,6 +245,61 @@ export async function fetchUsage(accessToken) {
   }
 }
 
+// z.ai quota monitor — a DIFFERENT host/path than the message upstream
+// (account.upstream is the Anthropic-compat endpoint). Zero-spend read.
+const ZAI_QUOTA_URL = 'https://api.z.ai/api/monitor/usage/quota/limit';
+
+/** Classify one z.ai `limits[]` entry into a Ses (5h) or Wk (weekly) TOKEN window.
+ *  Only `TOKENS_LIMIT` maps to the quota bars; `TIME_LIMIT` is a tool-call cap
+ *  (web-search/reader counts) and is intentionally ignored. `unit` is z.ai's
+ *  window enum (3 = 5-hour session, 6 = weekly); we fall back to reset-distance
+ *  when the code is unfamiliar so a new plan tier still classifies sanely. */
+export function classifyZaiLimit(l, now = Date.now()) {
+  if (!l || l.type !== 'TOKENS_LIMIT') return null;
+  const reset = Number(l.nextResetTime);
+  const resetAt = Number.isFinite(reset) && reset > 0 ? reset : null;
+  const pct = typeof l.percentage === 'number' ? l.percentage : parseFloat(l.percentage);
+  const utilization = Number.isFinite(pct) ? Math.max(0, Math.min(1, pct / 100)) : null;
+  let bucket;
+  if (l.unit === 3) bucket = 'ses';
+  else if (l.unit === 6) bucket = 'wk';
+  else if (resetAt) bucket = (resetAt - now) <= 12 * 60 * 60 * 1000 ? 'ses' : 'wk';
+  else bucket = 'ses';
+  return { bucket, utilization, resetAt };
+}
+
+/** Read a provider account's quota. z.ai has a pollable monitor endpoint mapped
+ *  to Ses/Wk token windows; Kimi (Moonshot coding key) has NO pollable quota
+ *  (web console only), so it returns a `console-only` marker instead of fake
+ *  bars. Returns { ses, wk, level } | { error, status?, source? }. */
+export async function fetchProviderUsage(account) {
+  const provider = account?.provider;
+  const token = account?.credential;
+  if (provider === 'kimi') return { error: 'unsupported', source: 'console-only' };
+  if (provider !== 'zai' || !token) return { error: 'unsupported', source: null };
+  try {
+    const res = await fetch(ZAI_QUOTA_URL, {
+      headers: { 'Authorization': `Bearer ${token}`, 'Accept': 'application/json' },
+    });
+    if (!res.ok) return { error: `HTTP ${res.status}`, status: res.status };
+    const data = await res.json();
+    if (data?.code !== 200 || !data?.data) {
+      return { error: `bad_envelope${data?.code != null ? ' code=' + data.code : ''}` };
+    }
+    const now = Date.now();
+    let ses = null, wk = null;
+    for (const l of (Array.isArray(data.data.limits) ? data.data.limits : [])) {
+      const c = classifyZaiLimit(l, now);
+      if (!c) continue;
+      if (c.bucket === 'ses') ses = { utilization: c.utilization, resetAt: c.resetAt };
+      else if (c.bucket === 'wk') wk = { utilization: c.utilization, resetAt: c.resetAt };
+    }
+    return { ses, wk, level: data.data.level || null, source: 'zai' };
+  } catch (err) {
+    return { error: err.message || String(err), status: null };
+  }
+}
+
 // OAuth config (extracted from Claude Code)
 const OAUTH_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
 const OAUTH_AUTHORIZE = 'https://claude.ai/oauth/authorize';

package/src/prober.js

@@ -7,13 +7,14 @@
 // is blind to an account it isn't actively routing to and will pile traffic onto it.
 // This is the one sanctioned active-upstream feature; the proxy is otherwise passive.
 
-import { fetchUsage } from './oauth.js';
+import { fetchUsage, fetchProviderUsage } from './oauth.js';
 
 export class Prober {
-  constructor(accountManager, { intervalMs = 0, probeFn = fetchUsage, timeoutMs = 10_000, log = console.log } = {}) {
+  constructor(accountManager, { intervalMs = 0, probeFn = fetchUsage, providerProbeFn = fetchProviderUsage, timeoutMs = 10_000, log = console.log } = {}) {
     this.am = accountManager;
     this.intervalMs = intervalMs;
     this.probeFn = probeFn;
+    this.providerProbeFn = providerProbeFn;
     this.timeoutMs = timeoutMs;
     this.log = log;
     this.timer = null;
@@ -49,15 +50,21 @@ export class Prober {
     if (this._inflight) { try { await this._inflight; } catch { /* swallow */ } }
   }
 
-  /** Probe every OAuth account once. Overlapping cycles are skipped. The active
-   *  cycle is tracked on `_inflight` so stop() can await it. */
+  /** Probe every OAuth account (usage endpoint) and every provider account with a
+   *  pollable/known quota source (z.ai monitor; Kimi → console-only marker) once.
+   *  Overlapping cycles are skipped. The active cycle is tracked on `_inflight` so
+   *  stop() can await it. */
   probeAll() {
     if (this._running) return this._inflight || Promise.resolve();
     this._running = true;
     this._inflight = (async () => {
       try {
-        const accounts = this.am.accounts.filter(a => a.type === 'oauth' && a.credential);
-        await Promise.all(accounts.map(a => this.probeOne(a)));
+        const oauth = this.am.accounts.filter(a => a.type === 'oauth' && a.credential);
+        const providers = this.am.accounts.filter(a => a.type === 'provider' && a.credential);
+        await Promise.all([
+          ...oauth.map(a => this.probeOne(a)),
+          ...providers.map(a => this.probeProvider(a)),
+        ]);
       } finally {
         this._running = false;
         this._inflight = null;
@@ -66,6 +73,16 @@ export class Prober {
     return this._inflight;
   }
 
+  /** Probe one PROVIDER account. Provider tokens are static API keys (no OAuth
+   *  refresh). Best-effort; never throws. */
+  async probeProvider(account) {
+    try {
+      const usage = await this._withTimeout(this.providerProbeFn(account));
+      if (!usage) return; // timed out — try again next cycle
+      this.am.applyProviderUsage(account.index, usage);
+    } catch { /* best-effort; never let a probe throw */ }
+  }
+
   async probeOne(account) {
     try {
       await this.am.ensureTokenFresh(account.index);

package/src/server.js

@@ -736,8 +736,14 @@ async function forwardRequest(
 
     if (upstreamRes.status >= 400 && upstreamRes.status < 500) {
       const errorBody = await readErrorBody(upstreamRes);
+      // A transcript a lenient provider (GLM/Kimi) produced can be rejected by
+      // Anthropic on replay (a non-srvtoolu_ server_tool_use id, or a thinking
+      // signature it can't validate). Detect it on an Anthropic account so we can
+      // self-heal onto a provider instead of surfacing the 400.
+      const anthropicIncompat = account.type !== 'provider' && isAnthropicIncompatBody(errorBody);
       const errorType = errorBody.includes('Invalid `signature` in `thinking` block')
         ? 'invalid_thinking_signature'
+        : anthropicIncompat ? 'anthropic_incompatible_transcript'
         : `HTTP ${upstreamRes.status}`;
       accountManager.releaseAccount(lease, { status: upstreamRes.status, error: errorType });
 
@@ -768,6 +774,24 @@ async function forwardRequest(
         }
       }
 
+      // React-and-heal: this transcript can't run on Claude (foreign server_tool_use
+      // id / thinking Anthropic can't validate). The 400 is pre-stream and the body
+      // is buffered, so latch the session Anthropic-incompatible (sticky → once per
+      // session) and retry PROVIDER-only, rather than surfacing the 400. Only worth
+      // it when a provider can actually serve it (profile=all with a GLM/Kimi token).
+      const providerAvailable = accountManager.accounts?.some(a => a.type === 'provider' && a.enabled !== false);
+      if (anthropicIncompat && requestInfo.sessionKey && providerAvailable
+        && canRetryBufferedBody && retryCount + 1 < maxAttempts && !res.headersSent) {
+        accountManager.markSessionIncompatible?.(requestInfo.sessionKey, requestInfo.homeProvider);
+        excludedIndexes.add(account.index);
+        console.log(`[Maxpool] Anthropic rejected this transcript (server_tool_use/thinking); pinning session to GLM/Kimi and retrying`);
+        return forwardRequest(
+          req, res, body, accountManager, upstream, retryCount + 1, hooks, reqId, ctx, logDir,
+          retryConfig, queueConfig, { ...requestInfo, anthropicIncompatible: true },
+          canRetryBufferedBody, canQueueBufferedBody, excludedIndexes,
+        );
+      }
+
       ctx.status = upstreamRes.status;
       sendErrorBody(res, requestInfo, upstreamRes.status, errorBody, upstreamRes.headers);
       return;
@@ -987,15 +1011,15 @@ function computeQueueWindowMs({
 }
 
 function unavailableMessage(accountManager, requestInfo = {}, retryAfter, willRecoverSoon = true) {
-  const origin = accountManager._effectiveOrigin?.(requestInfo) || { class: null, provider: null };
+  const incompat = accountManager._effectiveIncompatible?.(requestInfo) || { incompatible: false, homeProvider: null };
 
-  // A foreign (GLM/Kimi)-origin session is pinned to provider accounts — Anthropic
-  // would 400 on its tool-use ids. "All Claude at limit" would be the wrong story
-  // (the Claude accounts are irrelevant to it); say what actually blocks it.
-  if (origin.class === 'foreign') {
-    const fam = origin.provider === 'zai' ? 'GLM' : origin.provider === 'kimi' ? 'Kimi' : 'GLM/Kimi';
+  // An Anthropic-incompatible session is pinned to provider accounts — Anthropic
+  // 400s on its server_tool_use id / foreign thinking. "All Claude at limit" would
+  // be the wrong story (Claude is irrelevant to it); say what actually blocks it.
+  if (incompat.incompatible) {
+    const fam = incompat.homeProvider === 'zai' ? 'GLM' : incompat.homeProvider === 'kimi' ? 'Kimi' : 'GLM/Kimi';
     const eta = Number.isFinite(retryAfter) && retryAfter > 0 ? ` Retry in ${retryAfter}s.` : '';
-    return `This session started on ${fam}, so only GLM/Kimi can serve it (a GLM/Kimi transcript can't run on Claude — Anthropic rejects its tool-call ids). No GLM/Kimi provider is available right now.${eta} Check the x-maxpool-zai-token / x-maxpool-kimi-token headers, or resume this session with 'cc glm'/'cc kimi'.`;
+    return `This session's transcript can only run on GLM/Kimi — Claude rejects its server-tool ids/thinking on replay. No GLM/Kimi provider is available right now.${eta} Check the x-maxpool-zai-token / x-maxpool-kimi-token headers, or resume with 'cc ${incompat.homeProvider === 'kimi' ? 'kimi' : 'glm'}'.`;
   }
 
   const thinking = requestInfo.requiresAnthropicThinkingIntegrity
@@ -1021,7 +1045,7 @@ function unavailableMessage(accountManager, requestInfo = {}, retryAfter, willRe
   return `All ${n} accounts exhausted. Retry in ${retryAfter}s.`;
 }
 
-export const __serverTest = { unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin };
+export const __serverTest = { unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody };
 
 async function readErrorBody(upstreamRes, limitBytes = 64 * 1024) {
   if (!upstreamRes.body) return '';
@@ -1489,15 +1513,13 @@ function describeRequest(req, body) {
     // rebalancing); an unparsed body leaves this false → treated as NOT safe
     // (fail-closed) so we never replay a signed thinking block to a new account.
     info.bodyThinkingScanned = true;
-    // Home-provider origin of the resumed transcript (from tool-use id shapes).
-    // A 'foreign' (GLM/Kimi) session can NEVER be replayed to an Anthropic account
-    // (Anthropic 400s on a non-srvtoolu_ server_tool_use id) — routing pins it to
-    // provider accounts. A missing originClass = no tool blocks yet (ambiguous) OR
-    // an unparsed body; both fail OPEN in routing (never stranded), and stickiness
-    // (once a foreign id is seen) keeps a latched session pinned regardless.
+    // Whether the resumed transcript can replay to a Claude account. A session with
+    // a foreign server_tool_use id CANNOT (Anthropic 400s) → routing pins it to
+    // providers. Everything else stays Claude-eligible (Kimi/GLM without server-tools
+    // replay fine); a rare rejected-thinking 400 self-heals via react-and-heal.
     const origin = detectTranscriptOrigin(json);
-    if (origin.class) info.originClass = origin.class;
-    if (origin.provider) info.originProvider = origin.provider;
+    if (origin.anthropicIncompatible) info.anthropicIncompatible = true;
+    if (origin.homeProvider) info.homeProvider = origin.homeProvider;
   } catch {
     // Non-JSON requests are rare; body size still gives a useful load signal.
   }
@@ -1517,39 +1539,57 @@ function requiresAnthropicThinkingIntegrity(json) {
 // anything NOT matching this is treated as foreign (fail-closed classification).
 const ANTHROPIC_TOOL_ID = /^(toolu|srvtoolu)_/;
 
-// Classify a resumed transcript's HOME PROVIDER from the tool-use id shapes in its
-// replayed `messages`. Returns { class: 'foreign' | 'anthropic' | null, provider:
-// 'zai' | 'kimi' | null }. ANY non-Anthropic tool-use / server_tool_use / tool_result
-// id ⇒ 'foreign' (that session can never be replayed to Anthropic). 'anthropic' if
-// only Anthropic ids seen; null if no tool blocks at all (ambiguous — a fresh session
-// with no incompatible history yet). The request MODEL is NOT used — Claude Code
-// rewrites it to claude-opus-4-8 on resume, so only the transcript is trustworthy.
+// Decide whether a resumed transcript can replay to an Anthropic (Claude) account,
+// from the tool-use id shapes in its `messages`. Returns { anthropicIncompatible,
+// homeProvider }.
+//   anthropicIncompatible = the transcript has a `server_tool_use` id NOT matching
+//     ^srvtoolu_ — the ONE DETERMINISTIC incompatibility (Anthropic 400s on replay,
+//     the reported bug). Anthropic validates a client `tool_use.id` LOOSELY
+//     (^[a-zA-Z0-9_-]+$), so GLM `call_…` / Kimi `tool_…` client ids PASS and a
+//     Kimi/GLM session without server-tools is FINE on Claude — we do NOT predict
+//     those (a rejected thinking signature, if it ever happens, self-heals via the
+//     4xx react-and-heal in forwardRequest). server_tool_use is rare (GLM ~15%,
+//     Kimi 0%), so most sessions are compatible.
+//   homeProvider = the first foreign tool-use id shape (call_→zai, tool_→kimi), a
+//     SOFT hint for the 'never' same-family preference only; ambiguous/none → null.
+// The request MODEL is not used — Claude Code rewrites it to opus on resume.
 function detectTranscriptOrigin(json) {
-  if (!json || typeof json !== 'object') return { class: null, provider: null };
-  let sawAnthropic = false;
-  let foreignProvider = null; // 'zai' | 'kimi' | 'foreign'
-  const classifyForeign = id =>
-    id.startsWith('call_') ? 'zai' : id.startsWith('tool_') ? 'kimi' : 'foreign';
+  if (!json || typeof json !== 'object') return { anthropicIncompatible: false, homeProvider: null };
+  let incompatible = false;
+  let homeProvider = null;
+  const fam = id => id.startsWith('call_') ? 'zai' : id.startsWith('tool_') ? 'kimi' : null;
+  const noteForeign = id => { if (!homeProvider) homeProvider = fam(id); };
   const visit = value => {
-    if (foreignProvider) return; // one foreign id is decisive — early-exit the walk
-    if (Array.isArray(value)) { for (const v of value) { visit(v); if (foreignProvider) return; } return; }
+    if (incompatible) return; // server_tool_use is decisive — stop
+    if (Array.isArray(value)) { for (const v of value) { visit(v); if (incompatible) return; } return; }
     if (!value || typeof value !== 'object') return;
     const t = value.type;
-    if ((t === 'tool_use' || t === 'server_tool_use') && typeof value.id === 'string') {
-      if (ANTHROPIC_TOOL_ID.test(value.id)) sawAnthropic = true;
-      else { foreignProvider = classifyForeign(value.id); return; }
-    }
-    if (t === 'tool_result' && typeof value.tool_use_id === 'string') {
-      if (ANTHROPIC_TOOL_ID.test(value.tool_use_id)) sawAnthropic = true;
-      else { foreignProvider = classifyForeign(value.tool_use_id); return; }
+    if (t === 'server_tool_use' && typeof value.id === 'string' && !ANTHROPIC_TOOL_ID.test(value.id)) {
+      incompatible = true; noteForeign(value.id); return;
     }
+    if (t === 'tool_use' && typeof value.id === 'string' && !ANTHROPIC_TOOL_ID.test(value.id)) noteForeign(value.id);
+    if (t === 'tool_result' && typeof value.tool_use_id === 'string' && !ANTHROPIC_TOOL_ID.test(value.tool_use_id)) noteForeign(value.tool_use_id);
     if (value.content) visit(value.content);
     if (value.messages) visit(value.messages);
   };
   visit(json.messages);
-  if (foreignProvider) return { class: 'foreign', provider: foreignProvider === 'foreign' ? null : foreignProvider };
-  if (sawAnthropic) return { class: 'anthropic', provider: null };
-  return { class: null, provider: null };
+  return { anthropicIncompatible: incompatible, homeProvider };
+}
+
+// Does this upstream 4xx error body indicate the transcript is un-replayable to
+// Anthropic (a lenient GLM/Kimi provider produced content Anthropic rejects on
+// replay)? Matches the three known shapes: a non-srvtoolu_ server_tool_use id, or a
+// thinking-block signature Anthropic can't validate (invalid OR missing). Used to
+// self-heal onto a provider instead of surfacing the 400.
+function isAnthropicIncompatBody(body) {
+  if (!body) return false;
+  // The deterministic server-tool-id 400, the known invalid-signature error, or a
+  // thinking-block signature VALIDATION error (missing/invalid) — the last gated on
+  // a validation verb so a user message merely echoing "thinking"/"signature" can't
+  // false-latch the session provider-pinned for life.
+  return /srvtoolu_|server_tool_use/.test(body)
+    || /invalid `signature` in `thinking`/i.test(body)
+    || (/thinking/.test(body) && /signature/.test(body) && /(should match|required|invalid|expected|must )/i.test(body));
 }
 
 function containsThinkingBlock(value) {

package/src/tui.js

@@ -864,6 +864,11 @@ export class TUI {
       lines.push(yellow('  No accounts configured. Press [a] to add one.'));
     } else {
       lines.push('');
+      // Column legend — the per-row numbers are otherwise cryptic. Ses/Wk are the
+      // two quota bars; Now is live concurrency; 15m/1h are recent throughput.
+      if (W >= 88) {
+        lines.push(' ' + dim('Ses/Wk = 5h/7d quota (used% · resets-in) · Now = in-flight (weight) · 15m/1h = requests served (avg latency · Nf=fails)'));
+      }
       const showBoth = W >= 70;
       const bw = showBoth
         ? Math.max(5, Math.min(20, Math.floor((W - 56) / 2)))
@@ -979,7 +984,7 @@ export class TUI {
     status = rpad(status, 13);
 
     if (a.type === 'provider') {
-      return this._renderProviderAcct(sel, cur, name, type, status, a);
+      return this._renderProviderAcct(sel, cur, name, type, status, a, bw, showBoth);
     }
 
     // Quota ratios — prefer unified (Claude Max), fall back to standard (API key)
@@ -1008,25 +1013,53 @@ export class TUI {
     }
     const weekly = weeklyPolicyText(this.am, a);
     if (weekly) line += `  ${weekly}`;
-    // Per-model weekly caps (e.g. Fable maxed while the unified weekly still has
-    // headroom) — surfaced separately so a capped model on an otherwise-healthy
-    // account is visible, and routing away from it is explained.
+    // Per-model weekly caps (e.g. Fable, while the unified weekly still has
+    // headroom). Show the ACTUAL utilization — "Fable 90%" (yellow) while high but
+    // still usable, "Fable maxed" (red) ONLY at genuine exhaustion. This is the
+    // SAME predicate the router benches on (_scopedExhausted), so "maxed" renders
+    // iff the model is actually benched — 90%/critical is no longer mislabelled.
     const exhaustedFloor = this.am.scheduler?.weeklyExhaustedThreshold ?? 0.985;
-    const capped = Object.entries(q.scopedWeekly || {})
-      .filter(([, e]) => e && e.isActive !== false
-        && (e.severity === 'critical' || (e.utilization != null && e.utilization >= exhaustedFloor)))
-      .map(([fam]) => fam.charAt(0).toUpperCase() + fam.slice(1));
-    if (capped.length) line += `  ${red(`${capped.join(',')} maxed`)}`;
+    const reserveFloor = this.am.scheduler?.weeklyReserveThreshold ?? 0.85;
+    const scopedTags = [];
+    for (const [fam, e] of Object.entries(q.scopedWeekly || {})) {
+      if (!e || e.isActive === false || e.utilization == null) continue;
+      if (e.utilization < reserveFloor) continue;
+      const Fam = fam.charAt(0).toUpperCase() + fam.slice(1);
+      scopedTags.push(e.utilization >= exhaustedFloor
+        ? red(`${Fam} maxed`)
+        : yellow(`${Fam} ${Math.round(e.utilization * 100)}%`));
+    }
+    if (scopedTags.length) line += `  ${scopedTags.join(' ')}`;
+    // Freshness: scoped caps are refreshed ONLY by the background probe (response
+    // headers don't carry them). If the probe has gone stale (> 2× interval since
+    // last success), say so rather than imply the last-known value is current.
+    if (this.am._quotaProbeStale?.(a)) line += `  ${dim('stale')}`;
     line += `  ${dim(loadText(this._accountLoad(a)))}`;
     return line;
   }
 
-  _renderProviderAcct(sel, cur, name, type, status, a) {
+  _renderProviderAcct(sel, cur, name, type, status, a, bw = 11, showBoth = true) {
     const completed = a.completedRequests || 0;
     const failed = a.failedRequests || 0;
     const active = a.inFlight || 0;
     const last = a.lastStatus ? `${statusColor(a.lastStatus)} ${formatMs(a.lastResponseMs)}` : '-';
     const q = a.quota || {};
+
+    // Quota segment. z.ai has a pollable monitor endpoint → real Ses/Wk token bars,
+    // same rendering as OAuth accounts. Kimi (Moonshot coding key) has NO pollable
+    // quota (web console only) → an honest label, never a fake bar. Fields are the
+    // SEPARATE provider* set, so a provider reading never leaks into an OAuth bar.
+    let quotaSeg = '';
+    if (q.providerSes != null || q.providerWk != null) {
+      quotaSeg = `  Ses ${bar(q.providerSes, bw, q.providerSesReset)}`;
+      if (showBoth && q.providerWk != null) quotaSeg += `  Wk ${bar(q.providerWk, bw, q.providerWkReset)}`;
+      if (this.am._quotaProbeStale?.(a)) quotaSeg += `  ${dim('stale')}`;
+    } else if (q.providerQuotaSource === 'console-only') {
+      quotaSeg = `  ${dim('Quota console-only')}`;
+    } else if (q.providerQuotaSource === 'zai') {
+      quotaSeg = `  ${dim('Ses/Wk probing')}`;
+    }
+
     let limit = '';
     if (q.genericLimit != null && q.genericRemaining != null) {
       const used = q.genericLimit - q.genericRemaining;
@@ -1034,7 +1067,7 @@ export class TUI {
       limit = `  Lim ${used}/${q.genericLimit}${reset ? ` ${reset}` : ''}`;
     }
     const err = a.lastError ? `  Err ${String(a.lastError).slice(0, 18)}` : '';
-    return ` ${sel}${cur} ${name} ${type} ${status} Act ${String(active).padStart(2)}  OK ${String(completed).padStart(3)}  Fail ${String(failed).padStart(2)}  Last ${last}  ${dim(loadText(this._accountLoad(a)))}${limit}${err}`;
+    return ` ${sel}${cur} ${name} ${type} ${status} Act ${String(active).padStart(2)}  OK ${String(completed).padStart(3)}  Fail ${String(failed).padStart(2)}  Last ${last}${quotaSeg}  ${dim(loadText(this._accountLoad(a)))}${limit}${err}`;
   }
 
   _accountLoad(account) {