maxpool 1.5.34 → 1.5.36

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.34",
+  "version": "1.5.36",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/server.js

@@ -25,6 +25,11 @@ const UPSTREAM_TTFB_MS = Math.max(5_000, Number(process.env.MAXPOOL_TTFB_MS) ||
 const STREAM_IDLE_MS = Math.max(30_000, Number(process.env.MAXPOOL_STREAM_IDLE_MS) || 300_000);  // max gap BETWEEN streamed chunks (reset per chunk)
 const UPSTREAM_BODY_MS = Math.max(30_000, Number(process.env.MAXPOOL_BODY_MS) || 300_000);       // non-streaming body read
 const CLIENT_DRAIN_MS = Math.max(5_000, Number(process.env.MAXPOOL_DRAIN_MS) || 60_000);         // max wait for a backpressured client to drain (half-open client → free the lease)
+// A provider 403 is (unlike a 401) almost always transient QUOTA/PLAN exhaustion — cool
+// the provider down RECOVERABLY for this window, then re-probe, instead of permanently
+// disabling it. Short (not reset-length) so a provider-pinned session's hold window
+// isn't blown, and a still-exhausted provider just re-benches on the next single retry.
+const PROVIDER_FORBIDDEN_COOLDOWN_SEC = Math.max(60, Number(process.env.MAXPOOL_PROVIDER_403_COOLDOWN_SEC) || 1800);
 // Backstop reaper idle ceiling. Floored WELL above the longest a legit NON-streaming
 // request can go silent (no heartbeat there): TTFB 120s + nonStreamMaxWaitMs 300s +
 // UPSTREAM_BODY_MS 300s ≈ 720s — so a slow-but-alive non-streaming request is never
@@ -84,6 +89,11 @@ export function createProxyServer(accountManager, config, hooks = {}) {
 
   const server = http.createServer(async (req, res) => {
     try {
+      // Disable Nagle on the client socket: flush each SSE event immediately instead
+      // of coalescing small writes into bursts. Smooths streaming cadence toward the
+      // HTTP/2-direct shape, reducing how often a client terminal's re-render churns
+      // on long streams. Same underlying socket as res, so this covers the write path.
+      try { req.socket?.setNoDelay(true); } catch { /* socket may already be gone */ }
       try { res.setHeader('x-maxpool-worker', workerStamp); } catch { /* headers sent */ }
       if (draining) {
         try { res.setHeader('Connection', 'close'); } catch { /* headers may be sent */ }
@@ -654,16 +664,27 @@ async function forwardRequest(
 
     if (account.type === 'provider' && isProviderAuthStatus(upstreamRes.status)) {
       const errorBody = await readErrorBody(upstreamRes);
-      const reason = upstreamRes.status === 401 ? 'auth_failed' : 'forbidden';
-      accountManager.markAuthFailed(account.index, upstreamRes.status, reason);
-      accountManager.releaseAccount(lease, { status: upstreamRes.status, error: reason });
+      const forbidden = upstreamRes.status === 403;
+      if (forbidden) {
+        // 403 = almost always QUOTA/PLAN exhaustion (e.g. Kimi Coding-Plan weekly maxed),
+        // NOT bad credentials — the usage probe still succeeds with the same key. Cool it
+        // down RECOVERABLY (rides the rate-limit recovery in _isAvailable → auto-un-benches
+        // at expiry) instead of the permanent auth-disable that stranded it until restart.
+        // `neutral` release so a transient quota-403 doesn't bump failure/scoring counters.
+        accountManager.markRateLimited(account.index, PROVIDER_FORBIDDEN_COOLDOWN_SEC, { status: 403, recordFailure: false });
+        accountManager.releaseAccount(lease, { neutral: true });
+      } else {
+        // 401 = genuinely bad/missing credentials → permanent disable (needs re-auth).
+        accountManager.markAuthFailed(account.index, upstreamRes.status, 'auth_failed');
+        accountManager.releaseAccount(lease, { status: upstreamRes.status, error: 'auth_failed' });
+      }
       excludedIndexes.add(account.index);
 
       if (logDir) {
-        logSections.push(`=== RESPONSE ${upstreamRes.status} — "${account.name}" disabled (${reason}), failing over ===\n${formatHeaders(upstreamRes.headers)}`);
+        logSections.push(`=== RESPONSE ${upstreamRes.status} — "${account.name}" ${forbidden ? `cooled down ${PROVIDER_FORBIDDEN_COOLDOWN_SEC}s (quota/forbidden)` : 'disabled (auth)'}, failing over ===\n${formatHeaders(upstreamRes.headers)}`);
         if (errorBody) logSections.push(`=== ERROR BODY ===\n${errorBody}`);
       }
-      console.log(`[Maxpool] ${upstreamRes.status} on provider "${account.name}" — disabled and failing over before first byte`);
+      console.log(`[Maxpool] ${upstreamRes.status} on provider "${account.name}" — ${forbidden ? `cooled down ${PROVIDER_FORBIDDEN_COOLDOWN_SEC}s (recoverable)` : 'disabled'} and failing over before first byte`);
 
       if (
         canRetryBufferedBody &&

package/src/tui.js

@@ -318,7 +318,14 @@ export class TUI {
     this.active.delete(id);
     const dur = r ? ((Date.now() - r.started) / 1000).toFixed(1) : '?';
     const acct = info.account || r?.account || '?';
-    this._addLog(`${info.method} ${info.path} → ${acct} (${info.status}, ${dur}s)`);
+    // Tag PROVIDER-routed requests with the maxpool session id so provider traffic
+    // (when-exhausted overflow, or an incompatible-session pin) is traceable back to
+    // the session that caused it: grep the event log for `→ glm-fallback … [sess X]`,
+    // then `ps eww -p <pid> | grep x-maxpool-session` to find the terminal. Truthiness
+    // guard — a header-less request has sessionKey '' (server.js headerValue) → no tag.
+    const isProvider = this.am.accounts.find(a => a.name === acct)?.type === 'provider';
+    const tag = (isProvider && r?.sessionKey) ? `  [sess ${String(r.sessionKey).slice(0, 8)}]` : '';
+    this._addLog(`${info.method} ${info.path} → ${acct} (${info.status}, ${dur}s)${tag}`);
   }
 
   _addLog(msg) {
@@ -946,6 +953,15 @@ export class TUI {
       const p = this.am._crossProviderFallbackPolicy?.() || 'when-exhausted';
       const pc = p === 'never' ? yellow(p) : p === 'always' ? green(p) : cyan(p);
       xpText = `  ${dim('·')}  ${dim('Cross-provider:')} ${pc}`;
+      // Overflow visibility: when GLM/Kimi actually served requests recently, surface the
+      // volume so provider traffic isn't a mystery — it's overflow that spilled here while
+      // OAuth was saturated. Reuses the SAME 15m load window as the per-row "15m Nr" column.
+      const now = Date.now();
+      let provReq = 0;
+      for (const a of this.am.accounts) {
+        if (a.type === 'provider') provReq += this.am._loadSummary?.(a, 15 * 60_000, now)?.requests || 0;
+      }
+      if (provReq > 0) xpText += `  ${dim('·')}  ${yellow(`providers: ${provReq} req/15m`)}`;
     }
     lines.push(` Routing  ${cyan(routing)}${xpText}`);
     const queuedCount = this.am.queueState?.waiting?.length || 0;