maxpool 1.5.40 → 1.5.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.40",
+  "version": "1.5.41",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -1699,6 +1699,15 @@ export class AccountManager {
     // are all unavailable the request HOLDS/queues (recoverable) rather than 400ing.
     if (requestInfo.hasImage && account.provider === 'kimi') return false;
 
+    // A large-context session: a provider already rejected this request with a
+    // context-length 400. The GLM/Kimi *coding* endpoints serve a fixed model capped
+    // at ~256K and IGNORE the model id (so a K3/GLM 1M PLAN doesn't lift the coding
+    // leg's ceiling). Only a 1M-context Claude account can hold it — bench the
+    // providers for this session so it routes to Claude, or HOLDS for one, instead of
+    // re-404ing on a too-small leg. Sticky per session (context only grows turn over
+    // turn), so no follow-up turn re-pays the wasted attempt.
+    if (account.type === 'provider' && this._isSessionLargeContext(requestInfo)) return false;
+
     const { incompatible, homeProvider } = this._effectiveIncompatible(requestInfo);
     const policy = this._crossProviderFallbackPolicy();
 
@@ -1732,6 +1741,9 @@ export class AccountManager {
     if (requestInfo.anthropicIncompatible) {
       this.markSessionIncompatible(requestInfo.sessionKey, requestInfo.homeProvider);
     }
+    if (requestInfo.largeContext) {
+      this.markSessionLargeContext(requestInfo.sessionKey);
+    }
   }
 
   // Latch a session as Anthropic-incompatible (a foreign server_tool_use id, or a
@@ -1750,6 +1762,25 @@ export class AccountManager {
     });
   }
 
+  // Latch a session as large-context: a provider (the GLM/Kimi coding endpoint, fixed
+  // ~256K) rejected a request with a context-length 400 that only a 1M Claude can hold.
+  // Sticky + never-downgrades so every follow-up turn (context only grows) skips the
+  // too-small providers instead of re-paying a wasted 400. Cleared only by a new session.
+  markSessionLargeContext(sessionKey) {
+    if (!sessionKey) return;
+    const existing = this.sessionPolicies.get(sessionKey) || {};
+    if (!existing.largeContext) {
+      console.log(`[Maxpool] Session "${sessionKey}" exceeds provider context limits — pinned to Claude (GLM/Kimi benched for this session)`);
+    }
+    this.sessionPolicies.set(sessionKey, { ...existing, largeContext: true });
+  }
+
+  _isSessionLargeContext(requestInfo = {}) {
+    if (requestInfo.largeContext) return true;
+    if (!requestInfo.sessionKey) return false;
+    return Boolean(this.sessionPolicies.get(requestInfo.sessionKey)?.largeContext);
+  }
+
   // Marks a session as containing Anthropic signed thinking. This no longer bars
   // provider fallback (a lenient provider accepts an Anthropic signature) — it only
   // keeps the session's live cross-account MIGRATION on Claude (the rebalance guard),
@@ -2587,6 +2618,10 @@ export class AccountManager {
     account.modelMap = acctData.modelMap || account.modelMap;
     account.stripBetaHeaders = Boolean(acctData.stripBetaHeaders);
     account.runtime = true;
+    // Restore path carries an explicit enabled (persisted disable); honor it. The `cc
+    // all` header path (prepareRuntimeProviders) omits enabled, so a re-sent token
+    // NEVER silently re-enables a provider the user benched in the TUI.
+    if (acctData.enabled !== undefined) account.enabled = acctData.enabled !== false;
     if (account.status === 'error' && changed) {
       account.status = 'active';
       account.lastError = null;
@@ -2620,6 +2655,10 @@ export class AccountManager {
         model: a.model,
         modelMap: a.modelMap,
         stripBetaHeaders: a.stripBetaHeaders,
+        // Persist the user's enable/disable so a provider they benched in the TUI stays
+        // benched across a restart — without this an intentionally-disabled GLM/Kimi
+        // silently comes back enabled on the next boot (restore defaults enabled:true).
+        enabled: a.enabled,
       }));
   }
 
@@ -2797,6 +2836,7 @@ export class AccountManager {
         stickyBindings: this.sessionBindings.size,
         thinkingProtected: [...this.sessionPolicies.values()].filter(p => p.requiresAnthropicThinkingIntegrity).length,
         providerPinned: [...this.sessionPolicies.values()].filter(p => p.anthropicIncompatible).length,
+        largeContextPinned: [...this.sessionPolicies.values()].filter(p => p.largeContext).length,
       },
     };
   }

package/src/prober.js

@@ -70,7 +70,11 @@ export class Prober {
     this._stopping = false;
     this._inflight = (async () => {
       try {
-        // Skip auth-dead accounts (dead refresh token): probing them just re-POSTs
+        // DISABLED accounts are INTENTIONALLY still probed (no `a.enabled` filter):
+        // a user often disables an account precisely BECAUSE it's exhausted, and still
+        // wants to see its quota recover — so keep refreshing its usage for visibility
+        // even though routing skips it. Do NOT add an enabled gate here.
+        // Skip only auth-dead accounts (dead refresh token): probing them just re-POSTs
         // the rejected token every cycle — a 400 storm. They recover only on re-auth.
         const oauth = this.am.accounts.filter(a => a.type === 'oauth' && a.credential && !a.refreshDead);
         const providers = this.am.accounts.filter(a => a.type === 'provider' && a.credential);

package/src/server.js

@@ -53,6 +53,16 @@ const DEFAULT_QUEUE = {
   // resets idle-gap client timeouts; if a client uses a wall-clock total-request
   // deadline, lower this to just under it.
   streamHoldMaxMs: 7 * 24 * 60 * 60 * 1000,
+  // HARD ceiling on EVERY streaming hold (capacity/quota/throttle/concurrency alike).
+  // maxpool CANNOT keep a client alive past its own stream watchdog — Claude Code aborts
+  // "Stream idle timeout - no chunks received" after CLAUDE_STREAM_IDLE_TIMEOUT_MS of no
+  // real content EVENTS, and it drops SSE ping/comment keep-alives before the watchdog
+  // sees them (anthropic-sdk-typescript#998). So a 7-day/24h server-side hold only parks
+  // a request the client already abandoned. Bound it to the wait the user actually wants
+  // (front-loaded work waiting for a free account ≈ a few hours) so beyond that the
+  // request error-fasts with an honest retryable 429 instead of a silent multi-day park.
+  // Pair with a raised client watchdog (the cc launch sets CLAUDE_STREAM_IDLE_TIMEOUT_MS).
+  streamClientToleranceMs: Math.max(60_000, Number(process.env.MAXPOOL_STREAM_CLIENT_TOLERANCE_MS) || 3 * 60 * 60 * 1000),
   // Non-streaming requests have no SSE heartbeat to keep them alive, so a long
   // hold would die on the client timeout anyway. Cap their wait conservatively.
   nonStreamMaxWaitMs: 5 * 60 * 1000,
@@ -235,9 +245,10 @@ export function createProxyServer(accountManager, config, hooks = {}) {
         }
         requestInfo.profile = getMaxpoolProfile(req.headers);
         requestInfo.sessionKey = headerValue(req.headers, 'x-maxpool-session');
-        if (requestInfo.requiresAnthropicThinkingIntegrity && requestInfo.profile === 'all') {
-          console.log('[Maxpool] Anthropic thinking detected; provider fallback disabled for this session/request');
-        }
+        // (Removed a FALSE "provider fallback disabled for signed thinking" log here: it
+        // fired on every thinking `all` request but was untrue under the default
+        // when-exhausted/always policies — providers DO serve thinking requests — and it
+        // repeatedly misdirected diagnosis of the "Stream idle timeout" reports.)
         prepareRuntimeProviders(accountManager, req.headers);
 
         await forwardRequest(
@@ -856,9 +867,15 @@ async function forwardRequest(
       // signature it can't validate). Detect it on an Anthropic account so we can
       // self-heal onto a provider instead of surfacing the 400.
       const anthropicIncompat = account.type !== 'provider' && isAnthropicIncompatBody(errorBody);
+      // A provider (GLM ~200K / Kimi 256K context) rejecting an oversized request that
+      // only a large-context Claude (1M) can hold — e.g. "exceeded model token limit:
+      // 262144". Detect it ONLY on a provider (a Claude account's context-length 400 is
+      // terminal — nothing bigger to fall to) so we can pin the session to Claude.
+      const providerTooSmall = account.type === 'provider' && isContextLengthError(errorBody);
       const errorType = errorBody.includes('Invalid `signature` in `thinking` block')
         ? 'invalid_thinking_signature'
         : anthropicIncompat ? 'anthropic_incompatible_transcript'
+        : providerTooSmall ? 'provider_context_too_small'
         : `HTTP ${upstreamRes.status}`;
       accountManager.releaseAccount(lease, { status: upstreamRes.status, error: errorType });
 
@@ -907,6 +924,33 @@ async function forwardRequest(
         );
       }
 
+      // React-and-heal: a PROVIDER (GLM/Kimi coding endpoint, fixed ~256K context)
+      // rejected an oversized request only a 1M-context Claude can hold — e.g. Kimi's
+      // "exceeded model token limit: 262144 (requested: 643557)". The coding leg IGNORES
+      // the model id, so a K3/GLM-1M plan doesn't lift its ceiling. Latch the session
+      // large-context (so its follow-up turns skip the too-small providers) and retry
+      // EXCLUDING every provider → routes to Claude, or HOLDS for a Claude account,
+      // instead of surfacing a 400 the client just retry-loops on. Only worth it when a
+      // Claude account exists to serve it; with none, the 400 surfaces (nothing bigger).
+      const claudeAvailable = accountManager.accounts?.some(a => a.type !== 'provider' && a.enabled !== false);
+      if (providerTooSmall && requestInfo.sessionKey && claudeAvailable
+        && canRetryBufferedBody && retryCount + 1 < maxAttempts && !res.headersSent) {
+        accountManager.markSessionLargeContext?.(requestInfo.sessionKey);
+        // Bench EVERY provider: today's GLM + Kimi coding legs both cap at ~256K, so once
+        // one 400s on size the others can't hold it either. If a genuine 1M-context
+        // provider is ever added, make this exclusion context-limit-aware instead of
+        // type-wide (the _isRequestCompatible gate would need the same treatment).
+        for (const a of (accountManager.accounts || [])) {
+          if (a.type === 'provider') excludedIndexes.add(a.index);
+        }
+        console.log(`[Maxpool] Provider "${account.name}" context too small for this request; pinning session to Claude and retrying`);
+        return forwardRequest(
+          req, res, body, accountManager, upstream, retryCount + 1, hooks, reqId, ctx, logDir,
+          retryConfig, queueConfig, { ...requestInfo, largeContext: true },
+          canRetryBufferedBody, canQueueBufferedBody, excludedIndexes,
+        );
+      }
+
       ctx.status = upstreamRes.status;
       sendErrorBody(res, requestInfo, upstreamRes.status, errorBody, upstreamRes.headers);
       return;
@@ -1135,7 +1179,7 @@ function formatRetryDuration(seconds) {
  */
 function computeQueueWindowMs({
   cause, stream, retryPlanCause,
-  maxWaitMs, capacityMaxWaitMs, nonStreamMaxWaitMs, streamHoldMaxMs,
+  maxWaitMs, capacityMaxWaitMs, nonStreamMaxWaitMs, streamHoldMaxMs, streamClientToleranceMs,
   isCountTokens, countTokensMaxWaitMs,
 }) {
   let windowMs;
@@ -1147,6 +1191,12 @@ function computeQueueWindowMs({
     windowMs = streamHoldMaxMs;
   }
   if (retryPlanCause === 'concurrency_cap') windowMs = Math.min(windowMs, capacityMaxWaitMs);
+  // Bound EVERY streaming cause to the client-tolerance ceiling — the client's own
+  // watchdog kills the stream well before a 24h/7d server hold, so anything past this
+  // just parks an abandoned request. A finite reset WITHIN the ceiling still holds +
+  // resumes (via the nextRetryForRequest oracle); a reset beyond it error-fasts (a real
+  // retryable 429 at the pre-heartbeat gate) instead of hanging.
+  if (stream && streamClientToleranceMs != null) windowMs = Math.min(windowMs, streamClientToleranceMs);
   // count_tokens: cap the QUEUE wait low (bounds only the wait-for-an-account, never
   // the upstream processing once acquired) so a non-heartbeated metadata call fast-
   // fails with a retryable 429 instead of hanging past the client's idle window.
@@ -1166,9 +1216,22 @@ function unavailableMessage(accountManager, requestInfo = {}, retryAfter, willRe
     return `This session's transcript can only run on ${fam} — Claude rejects its server-tool ids/thinking on replay. No ${fam} provider is available right now.${eta} Check the x-maxpool-zai-token / x-maxpool-kimi-token headers, or resume with 'cc ${incompat.homeProvider === 'kimi' ? 'kimi' : 'glm'}'.`;
   }
 
-  const thinking = requestInfo.requiresAnthropicThinkingIntegrity
-    || accountManager._requiresAnthropicThinkingIntegrity?.(requestInfo);
-  const n = accountManager.accounts.length;
+  // A large-context session (a provider already 400'd it as too big for its ~256K leg):
+  // only a 1M-context Claude can hold it — the providers are structurally BARRED, not
+  // merely "at their limit". Say the oversized truth + the two real ways out (wait for a
+  // Claude account, or /compact), instead of the misleading "providers at limit" line.
+  if (accountManager._isSessionLargeContext?.(requestInfo)) {
+    const eta = Number.isFinite(retryAfter) && retryAfter > 0
+      ? ` A Claude account should free in ~${formatRetryDuration(retryAfter)}.` : '';
+    return `This session is too large for the GLM/Kimi fallbacks (their ~256K limit) — it needs a 1M-context Claude account, and they're all busy right now.${eta} It sends as soon as one frees; /compact shortens the session if you'd rather not wait.`;
+  }
+
+  const claudeCount = accountManager.accounts.filter(a => a.type !== 'provider').length;
+  // Only name the providers when this pool actually HAS them (`cc all`). On `cc ma`
+  // (Claude-only) there are none, so the old hardcoded "and the GLM/Kimi providers"
+  // was a lie. When present they DO serve (not barred), so they're saturated too.
+  const providersClause = accountManager.accounts.some(a => a.type === 'provider')
+    ? ' and the GLM/Kimi providers' : '';
 
   // No route is expected to recover within the queue window — i.e. every Claude
   // account is at its own 5h/weekly limit. A short "retry in Ns" would be a lie;
@@ -1177,19 +1240,24 @@ function unavailableMessage(accountManager, requestInfo = {}, retryAfter, willRe
     const eta = Number.isFinite(retryAfter) && retryAfter > 0
       ? ` Soonest reset in ~${formatRetryDuration(retryAfter)}, beyond the hold window.`
       : '';
-    const base = `No Claude account can take this request — all ${n} are at their 5h or weekly limit.${eta} Add another Claude account or wait for a quota reset.`;
-    return thinking
-      ? `${base} GLM/Kimi fallback is unavailable because this session contains Anthropic signed thinking blocks; start a fresh non-thinking session to use them.`
-      : base;
+    return `No account can take this request — all ${claudeCount} Claude accounts${providersClause} are at their limit.${eta} Add another Claude account or wait for a quota reset.`;
   }
 
-  if (thinking) {
-    return `No Claude account could accept this request. Non-Claude fallback is disabled because this session contains Anthropic signed thinking blocks. Retry in ${retryAfter}s, wait for Claude capacity, or start a fresh non-thinking session to use GLM/Kimi.`;
-  }
-  return `All ${n} accounts exhausted. Retry in ${retryAfter}s.`;
+  return `No account can take this request right now — all ${claudeCount} Claude accounts${providersClause} are momentarily at their limit. Retry in ${retryAfter}s.`;
+}
+
+// A provider (GLM/Kimi) rejecting a request whose token count exceeds its context
+// window — Kimi's coding leg ("exceeded model token limit: 262144"), GLM's, or an
+// OpenAI-style "maximum context length". Kept narrow (specific context-overflow
+// phrasings, NOT a bare "token limit" which a rate-limit body also carries) so the
+// pin-to-Claude heal only fires on a genuine size overflow, not any 400. Rate-limit
+// 429s are intercepted earlier (classifyRateLimit) and never reach this check.
+function isContextLengthError(errorBody) {
+  if (!errorBody) return false;
+  return /exceeded model token limit|maximum context length|context length exceeded|context window (?:size )?(?:exceeded|too)|prompt is too long|input is too long|reduce the length of|too many (?:input )?tokens|request too large/i.test(errorBody);
 }
 
-export const __serverTest = { unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, commitStreamGraceHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody, streamResponse, startIdleRequestReaper };
+export const __serverTest = { unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, commitStreamGraceHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody, isContextLengthError, streamResponse, startIdleRequestReaper };
 
 async function readErrorBody(upstreamRes, limitBytes = 64 * 1024) {
   if (!upstreamRes.body) return '';
@@ -1467,6 +1535,9 @@ async function queueAndRetry(
   const streamHoldMaxMs = queueConfig.streamHoldMaxMs == null
     ? 7 * 24 * 60 * 60 * 1000
     : Math.max(0, Number(queueConfig.streamHoldMaxMs) || 0);
+  const streamClientToleranceMs = queueConfig.streamClientToleranceMs == null
+    ? 3 * 60 * 60 * 1000
+    : Math.max(0, Number(queueConfig.streamClientToleranceMs) || 0);
   const queueWindowMs = computeQueueWindowMs({
     cause,
     stream: Boolean(requestInfo.stream),
@@ -1475,6 +1546,7 @@ async function queueAndRetry(
     capacityMaxWaitMs,
     nonStreamMaxWaitMs,
     streamHoldMaxMs,
+    streamClientToleranceMs,
     isCountTokens: Boolean(requestInfo.isCountTokens),
     countTokensMaxWaitMs,
   });

package/src/tui.js

@@ -586,6 +586,9 @@ export class TUI {
       .map(index => ({ account: this.am.accounts[index], index }))
       .filter(({ account }) => {
         if (action === 'prefer') return account.type !== 'provider' && account.enabled;
+        // Enable/disable also works on runtime providers (GLM/Kimi) — a session-only
+        // toggle, since they're not in config. Rename/delete stay config-account-only.
+        if (action === 'toggle') return this._configAccountIndex(account) >= 0 || account.type === 'provider';
         return this._configAccountIndex(account) >= 0;
       })
       .map(({ index }) => index);
@@ -872,7 +875,18 @@ export class TUI {
     if (!account) return;
     const configIndex = this._configAccountIndex(account);
     if (configIndex < 0) {
-      this._addLog(`Cannot ${enabled ? 'enable' : 'disable'} runtime provider "${account.name}" here`);
+      // A runtime provider (GLM/Kimi) isn't in config — it's re-created from the `cc all`
+      // request headers — but its enable/disable IS durable: the flag persists in memory
+      // across `cc all` requests (the header upsert never re-enables it) and to state.json
+      // on the next save, so it stays benched across a restart too. Re-enable it here the
+      // same way whenever the user wants it back — there's no "removed forever" state.
+      if (account.type === 'provider') {
+        this.am.setAccountEnabled(idx, enabled);
+        if (!enabled && this.am.preferredAccountName === account.name) this.am.setRoutingMode?.('automatic');
+        this._addLog(`${enabled ? 'Enabled' : 'Disabled'} provider "${account.name}" — ${enabled ? 'routing resumed' : 'benched (stays off across cc all + restart; re-enable here anytime)'}`);
+        return;
+      }
+      this._addLog(`Cannot ${enabled ? 'enable' : 'disable'} "${account.name}" here (not in config)`);
       return;
     }
     const previous = this.config.accounts[configIndex].enabled;