maxpool 1.5.19 → 1.5.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.19",
+  "version": "1.5.21",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -974,16 +974,52 @@ export class AccountManager {
    */
   refreshExpiredQuotas() {
     let changed = false;
+    const now = Date.now();
     const sessionReset = [];
     for (const account of this.accounts) {
       const r = this._clearExpiredQuotas(account);
       if (r.changed) changed = true;
       if (r.session) sessionReset.push(account);
+      this._clearRecoveredNetworkError(account, now);
     }
     if (sessionReset.length) this._switchOnSessionReset(sessionReset);
     return changed;
   }
 
+  /**
+   * Clear a fully-healed transient error so a long-gone blip stops showing as a
+   * phantom "Err" in the TUI. A network blip (markTransientFailure network:true)
+   * and an expired upstream_throttled window both set `lastError` WITHOUT bumping
+   * `consecutiveFailures`; once the account is active again with no live backoff
+   * window, that error is history. Runs for EVERY account on the display/request
+   * refresh — required (not just `_isAvailable`, which never evaluates an idle
+   * fallback provider that Claude-health keeps out of the candidate set, so its
+   * blip lingered ~100 min until restart). Mirrors the rate_limited /
+   * upstream_throttled recovery clears in `_isAvailable`.
+   *
+   * The `consecutiveFailures > 0` guard is load-bearing: a genuinely-flaky account
+   * (markResult failure — windowless, status active, counter bumped) must KEEP its
+   * error visible. Only the fleet-wide-blip paths leave the counter at 0.
+   */
+  _clearRecoveredNetworkError(account, now = Date.now()) {
+    if (!account.lastError) return;
+    if (account.status !== 'active') return;         // throttled / error / exhausted keep their error
+    if (account.consecutiveFailures > 0) return;     // an ongoing per-account fault stays visible
+    const blocked = Math.max(
+      account.cooldownUntil || 0,
+      account.rateLimitedUntil || 0,
+      account.provisionalUpstreamUntil || 0,
+    );
+    if (blocked && now < blocked) return;            // still in a backoff window → keep showing why
+    account.lastError = null;
+    account.lastErrorAt = null;
+    // Mirror _isAvailable's recovery: drop the now-past backoff windows + fingerprint
+    // so getStatus() doesn't emit a stale past cooldown and no fingerprint dangles.
+    account.cooldownUntil = null;
+    account.provisionalUpstreamUntil = null;
+    account.provisionalUpstreamFingerprint = null;
+  }
+
   /**
    * Given accounts whose session quota just reset, switch to the one whose
    * weekly limit expires soonest — but only if that is sooner than the current
@@ -2402,6 +2438,47 @@ export class AccountManager {
     return idx;
   }
 
+  /**
+   * Serialize runtime (client-supplied) PROVIDER accounts so they survive a
+   * restart. They're created lazily from `cc all` request headers
+   * (prepareRuntimeProviders), NOT from config — so without persistence a cold boot
+   * / reload shows only the config OAuth accounts until the next `cc all` request
+   * re-sends the tokens. Persisted to state.json (0600, same protection as the
+   * OAuth-token-bearing config) alongside quota.
+   */
+  exportRuntimeProviders() {
+    return this.accounts
+      .filter(a => a.runtime && a.type === 'provider' && a.credential)
+      .map(a => ({
+        name: a.name,
+        type: a.type,
+        provider: a.provider,
+        authToken: a.credential,
+        upstream: a.upstream,
+        authHeader: a.authHeader,
+        profiles: a.profiles,
+        priority: a.priority,
+        model: a.model,
+        modelMap: a.modelMap,
+        stripBetaHeaders: a.stripBetaHeaders,
+      }));
+  }
+
+  /**
+   * Restore persisted runtime providers on boot, via the SAME upsert the header
+   * path uses (so a restored provider is byte-identical to a header-created one). A
+   * live `cc all` request refreshes the token before routing (prepareRuntimeProviders
+   * runs ahead of account selection), so a stale restored token never serves a
+   * request. Idempotent — upsertRuntimeAccount matches by name.
+   */
+  restoreRuntimeProviders(list) {
+    if (!Array.isArray(list)) return;
+    for (const p of list) {
+      if (!p || !p.name || !(p.authToken || p.credential)) continue;
+      this.upsertRuntimeAccount({ ...p, authToken: p.authToken || p.credential });
+    }
+  }
+
   /**
    * Remove an account by index.
    */

package/src/index.js

@@ -528,6 +528,15 @@ async function serverWorkerCommand() {
   // lease holder); a cold/direct worker reads the on-disk state file.
   const savedState = await loadState();
   if (savedState?.quota) accountManager.restoreQuotaState(savedState.quota);
+  // Runtime fallback providers (glm-fallback/kimi-fallback) are created lazily from
+  // `cc all` request headers, not config — so without restoring them here a restart
+  // shows only the config OAuth accounts until the next `cc all` request re-sends the
+  // tokens. NOTE: a SEAMLESS reload worker reads state at spawn (before the outgoing
+  // worker's final flush), so a provider created <60s before that reload (not yet
+  // interval-flushed) is missed until the next `cc all` request — the same
+  // self-healing window as an abrupt SIGKILL. A cold restart reads the clean-shutdown
+  // final flush and restores fully (the reported zero-request case).
+  if (savedState?.runtimeProviders) accountManager.restoreRuntimeProviders(savedState.runtimeProviders);
   // Track the state-file generation we last observed so a stale flush is refused.
   let stateGeneration = Number(savedState?._generation) || 0;
 
@@ -550,7 +559,15 @@ async function serverWorkerCommand() {
     // flush REFUSED (dropping the final quota snapshot). The guard only exists to
     // serialize CROSS-worker writes; the final flush is provably intra-worker.
     const expectedGeneration = force ? null : stateGeneration;
-    return saveState({ quota: accountManager.exportQuotaState() }, { expectedGeneration })
+    return saveState(
+      {
+        quota: accountManager.exportQuotaState(),
+        // Runtime providers so glm-fallback/kimi-fallback survive a restart (they're
+        // header-derived, not in config). Empty [] when none — harmless.
+        runtimeProviders: accountManager.exportRuntimeProviders(),
+      },
+      { expectedGeneration },
+    )
       .then(written => { if (written != null) stateGeneration = written; })
       .catch(() => {});
   };