maxpool 1.5.46 → 1.5.47

package/README.md

@@ -194,7 +194,7 @@ Provider fallback credentials can be supplied per Claude Code process with `ANTH
 
 `x-maxpool-session: <id>` enables session affinity. With this header, the first request for a Claude Code process is routed by the adaptive load balancer, then later requests from the same process keep using that home account while it remains available. If the home account is rate-limited, exhausted, in cooldown, or removed, the session temporarily uses another eligible route. When the home account becomes available again, the session returns to it. For the `all` profile, a Claude session that had to spill onto GLM/Kimi moves back to Claude once a Claude account frees up — **as long as it produced no provider-format tool calls while there**.
 
-**Cross-provider fallback + compatibility (`all` profile).** Claude, GLM (z.ai), and Kimi (Moonshot) interoperate for ordinary sessions — a regular tool-use id (`call_`/`tool_`) passes Anthropic's loose validation, so a Kimi or GLM session runs fine on Claude and a Claude session spills onto GLM/Kimi when Claude is unavailable. `scheduler.crossProviderFallbackPolicy` controls it, cyclable live in the TUI Routing menu (`m` → `f`): `never` = strict same-family (Claude→Claude, GLM→GLM, Kimi→Kimi), `when-exhausted` (default) = cross only once the home family is exhausted, `always` = providers peer with Claude.
+**Cross-provider fallback + compatibility (`all` profile).** Claude, GLM (z.ai), and Kimi (Moonshot) interoperate for ordinary sessions — a regular tool-use id (`call_`/`tool_`) passes Anthropic's loose validation, so a Kimi or GLM session that used no server tools runs on Claude (its *thinking* blocks are rejected, but Maxpool strips them automatically — see self-heal below) and a Claude session spills onto GLM/Kimi when Claude is unavailable. `scheduler.crossProviderFallbackPolicy` controls it, cyclable live in the TUI Routing menu (`m` → `f`): `never` (default) = **Claude sessions never spill onto a provider** (note: this governs the Claude→provider direction only — it is NOT a same-family pin), `when-exhausted` = cross only once the home family is exhausted, `always` = providers peer with Claude.
 
 The one hard incompatibility Maxpool guards is a **`server_tool_use` id** that isn't `srvtoolu_` — Anthropic 400s that on replay (e.g. a `cc glm` session that used a server tool, resumed under `cc all`). Maxpool predicts that case ahead (pins the session to GLM/Kimi) and, for anything it can't predict (a rejected thinking signature), **self-heals**: the 400 is pre-stream, so Maxpool latches the session provider-only and transparently retries on GLM/Kimi — the client never sees the error. (Note: Claude Code may warn a resumed `glm-*` model "could not be restored" and fall back to `claude-opus-4-8`; that's a client-side message — routing is unaffected.)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.46",
+  "version": "1.5.47",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -136,8 +136,9 @@ const DEFAULT_SCHEDULER = {
   crossAccountThinkingMigration: true,
   // Cross-PROVIDER fallback policy for 'cc all' (profile=all), i.e. whether a session
   // may be served by a provider FAMILY other than its home (Claude ↔ GLM ↔ Kimi).
-  //   'never'         — strict pin: a Claude session uses Claude only; a GLM session
-  //                     uses GLM only; a Kimi session uses Kimi only.
+  //   'never'         — (DEFAULT) a Claude session never spills onto a provider. NOTE:
+  //                     this governs the Claude→provider direction ONLY — it is NOT a
+  //                     same-family pin (a provider-origin session still reaches Claude).
   //   'when-exhausted'— home family preferred; a Claude session falls back to GLM/Kimi
   //                     only once all Claude accounts are unavailable, and a GLM session
   //                     may fall to Kimi once GLM is exhausted.
@@ -157,6 +158,18 @@ const DEFAULT_SCHEDULER = {
   // kept even while Claude→provider is 'never'. Only has effect under policy:'never' (the
   // 'when-exhausted'/'always' paths never pinned to home). Set false for a strict home-pin.
   providerCrossFallback: true,
+  // PER-PROVIDER Claude→provider control. One knob per provider so GLM and Kimi are
+  // steered independently (their reliability and quota differ). Each takes the same
+  // 'never' | 'when-exhausted' | 'always'. Undefined ⇒ inherit crossProviderFallbackPolicy,
+  // so an existing config upgrades to byte-identical behavior. Default 'never': letting a
+  // Claude session finish on a provider contaminates its transcript (BOTH providers emit
+  // thinking blocks Anthropic rejects — measured 2026-07-25), and while Maxpool now repairs
+  // that automatically, a provider server-tool call is NOT repairable.
+  // Ships EMPTY on purpose: an unset provider INHERITS crossProviderFallbackPolicy (whose
+  // default is already 'never'), so off-by-default holds without a per-provider entry
+  // shadowing the global one. Seeding explicit values here would mean cycling the global
+  // policy silently did nothing — the two-gate trap.
+  providers: {},
 };
 const LOAD_EVENT_MAX_AGE_MS = 60 * 60 * 1000;
 // Consecutive failed recovery probes before we stop trusting the SHARED breaker and
@@ -1717,7 +1730,7 @@ export class AccountManager {
   _effectivePriority(account, requestInfo = {}) {
     const base = Number.isFinite(account.priority) ? account.priority : 0;
     if (account.type === 'provider'
-        && this._crossProviderFallbackPolicy() === 'always'
+        && this._claudeFallbackFor(account.provider) === 'always'
         && !this._effectiveIncompatible(requestInfo).incompatible) {
       return 0;
     }
@@ -1745,6 +1758,23 @@ export class AccountManager {
     };
   }
 
+  /** Claude→provider policy for ONE provider. Falls back to the legacy global policy when
+   *  unset, so an existing config keeps its exact behavior on upgrade. */
+  _claudeFallbackFor(providerKey) {
+    const per = this.scheduler.providers?.[providerKey]?.claudeFallback;
+    const valid = new Set(['never', 'when-exhausted', 'always']);
+    return valid.has(per) ? per : this._crossProviderFallbackPolicy();
+  }
+
+  setClaudeFallbackForProvider(providerKey, policy) {
+    const valid = new Set(['never', 'when-exhausted', 'always']);
+    if (!providerKey || !valid.has(policy)) return false;
+    const providers = { ...(this.scheduler.providers || {}) };
+    providers[providerKey] = { ...(providers[providerKey] || {}), claudeFallback: policy };
+    this.scheduler.providers = providers;
+    return true;
+  }
+
   _isRequestCompatible(account, profile, requestInfo = {}) {
     if (!this._matchesProfile(account, profile)) return false;
 
@@ -1789,7 +1819,9 @@ export class AccountManager {
     // lets providers serve as a priority-fallback; 'always' peers them
     // (_effectivePriority). Signed thinking no longer bars providers here — but its
     // live MIGRATION stays Claude-only (see the rebalance guard).
-    if (account.type === 'provider' && policy === 'never') return false;
+    // PER-PROVIDER Claude→provider gate (GLM and Kimi steer independently). Unset ⇒
+    // inherits the legacy global policy, so behavior is unchanged on upgrade.
+    if (account.type === 'provider' && this._claudeFallbackFor(account.provider) === 'never') return false;
     return true;
   }
 
@@ -1835,6 +1867,25 @@ export class AccountManager {
     this.sessionPolicies.set(sessionKey, { ...existing, largeContext: true });
   }
 
+  // Latch a session whose transcript carries provider-authored thinking blocks Anthropic
+  // rejects. Without this the repair is per-REQUEST: the client resends the whole poisoned
+  // history every turn, so each turn pays another rejected round-trip before the strip
+  // (measured: ~9 rejections per contaminated session). Sticky → later turns are stripped
+  // BEFORE the first attempt. In-memory only, like the other session policies.
+  markSessionThinkingContaminated(sessionKey) {
+    if (!sessionKey) return;
+    const existing = this.sessionPolicies.get(sessionKey) || {};
+    if (!existing.thinkingContaminated) {
+      console.log(`[Maxpool] Session "${sessionKey}" carries provider-authored thinking — stripping it up front from now on`);
+    }
+    this.sessionPolicies.set(sessionKey, { ...existing, thinkingContaminated: true });
+  }
+
+  isSessionThinkingContaminated(sessionKey) {
+    if (!sessionKey) return false;
+    return Boolean(this.sessionPolicies.get(sessionKey)?.thinkingContaminated);
+  }
+
   _isSessionLargeContext(requestInfo = {}) {
     if (requestInfo.largeContext) return true;
     if (!requestInfo.sessionKey) return false;

package/src/config.js

@@ -110,6 +110,14 @@ export function createDefaultConfig() {
       // (GLM/Kimi) session cross to the OTHER provider (GLM↔Kimi)? Default ON — reliable,
       // both legs accept each other's ids. Only has effect under policy:'never'.
       providerCrossFallback: true,
+      // Per-provider Claude→provider control (TUI routing: g = GLM, k = Kimi). Same values
+      // as the policy above; unset inherits it. Default 'never' — a Claude session that
+      // finishes on a provider comes back with thinking blocks Anthropic rejects (Maxpool
+      // repairs that automatically, but a provider server-tool call is unrepairable).
+      // Left EMPTY: an unset provider inherits the policy above, so off-by-default holds
+      // without shadowing it. The TUI writes an entry here only when you steer one
+      // provider differently from the other.
+      providers: {},
     },
     retry: {
       maxAttemptsPerRequest: 0,

package/src/index.js

@@ -974,10 +974,14 @@ async function serverWorkerCommand() {
         // policy cycled with the TUI 'f' key). Without this, the toggle takes effect
         // in memory but silently reverts on the next config write / restart. Merge
         // onto the existing disk scheduler block so other scheduler keys survive.
-        if (config.scheduler?.crossProviderFallbackPolicy) {
+        if (config.scheduler?.crossProviderFallbackPolicy || config.scheduler?.providers) {
           diskConfig.scheduler = {
             ...diskConfig.scheduler,
-            crossProviderFallbackPolicy: config.scheduler.crossProviderFallbackPolicy,
+            ...(config.scheduler.crossProviderFallbackPolicy
+              ? { crossProviderFallbackPolicy: config.scheduler.crossProviderFallbackPolicy } : {}),
+            // Per-provider Claude→provider settings (TUI routing g / k). Must be listed
+            // here explicitly or the toggle takes effect in memory and silently reverts.
+            ...(config.scheduler.providers ? { providers: config.scheduler.providers } : {}),
           };
         }
         // Persist live-toggled automatic-update flags (the TUI 'u' Updates menu). Same

package/src/server.js

@@ -354,6 +354,18 @@ async function forwardRequest(
   const configuredAttempts = Number(retryConfig.maxAttemptsPerRequest) || accountManager.accounts.length;
   const maxAttempts = Math.max(1, configuredAttempts);
 
+  // PRE-STRIP a session already known to carry provider-authored thinking. The client
+  // resends the whole poisoned history every turn, so without this each turn pays another
+  // rejected round-trip before the reactive repair kicks in. Latched by the first repair.
+  if (retryCount === 0 && !requestInfo.thinkingStripped
+    && accountManager.isSessionThinkingContaminated?.(requestInfo.sessionKey)) {
+    const pre = stripForeignThinkingBlocks(body);
+    if (pre.body) {
+      body = pre.body;
+      requestInfo = { ...requestInfo, thinkingStripped: true };
+    }
+  }
+
   // Select account
   const lease = accountManager.acquireAccount(requestInfo, excludedIndexes);
   const account = lease?.account;
@@ -896,8 +908,14 @@ async function forwardRequest(
       // for the strip-and-recover retry below. Deliberately NOT the fuzzy
       // isAnthropicIncompatBody heuristic, so a merely malformed request can never cause
       // us to rewrite a user's transcript.
+      // Two deterministic shapes, both repairable by stripping: a signature Anthropic
+      // can't validate, AND a provider block that carries NO signature field at all
+      // ("messages.4.content.0.thinking.signature: Field required"). The second variant
+      // used to fall straight through to a PERMANENT provider pin even though stripping
+      // fixes it. Still deterministic — never the fuzzy isAnthropicIncompatBody heuristic.
       const isSignatureRejection = account.type !== 'provider'
-        && /invalid `signature` in `thinking`/i.test(errorBody);
+        && (/invalid `signature` in `thinking`/i.test(errorBody)
+          || /content\.\d+\.thinking\.signature/i.test(errorBody));
       const errorType = errorBody.includes('Invalid `signature` in `thinking` block')
         ? 'invalid_thinking_signature'
         : anthropicIncompat ? 'anthropic_incompatible_transcript'
@@ -943,6 +961,9 @@ async function forwardRequest(
         && canRetryBufferedBody && retryCount + 1 < maxAttempts && !res.headersSent) {
         const { body: cleanBody, removed } = stripForeignThinkingBlocks(body);
         if (cleanBody) {
+          // Latch it so EVERY later turn is stripped up front instead of re-paying this
+          // rejected round-trip (the client resends the full poisoned history each turn).
+          accountManager.markSessionThinkingContaminated?.(requestInfo.sessionKey);
           console.log(`[Maxpool] Recovering session on Claude: stripped ${removed} provider-authored thinking block(s) Anthropic rejected`);
           return forwardRequest(
             req, res, cleanBody, accountManager, upstream, retryCount + 1, hooks, reqId, ctx, logDir,

package/src/tui.js

@@ -559,6 +559,8 @@ export class TUI {
       );
     } else if (k === 'p' && this.am.accounts.some(account => account.type !== 'provider')) {
       this._startSelection('prefer');
+    } else if (k === 'g' || k === 'k') {
+      this._cycleProviderClaudeFallback(k === 'g' ? 'zai' : 'kimi');
     } else if (k === 'f' || k === 'F') {
       // Cycle the cross-provider fallback policy in place — reversible + non-destructive,
       // so no confirm dialog (unlike restart/delete). Accept F too (Shift-f muscle memory).
@@ -568,6 +570,34 @@ export class TUI {
     }
   }
 
+  /** Cycle ONE provider's Claude→provider setting. Turning it ON is the risky direction
+   *  (a Claude session can finish on that provider), so it asks first; turning it back off
+   *  is always safe and never prompts. */
+  _cycleProviderClaudeFallback(providerKey) {
+    const order = ['never', 'when-exhausted', 'always'];
+    const label = providerKey === 'zai' ? 'GLM' : 'Kimi';
+    const cur = this.am._claudeFallbackFor?.(providerKey) || 'never';
+    const next = order[(order.indexOf(cur) + 1) % order.length];
+    const apply = async () => {
+      this.am.setClaudeFallbackForProvider?.(providerKey, next);
+      const sched = { ...(this.config.scheduler || {}) };
+      sched.providers = { ...(sched.providers || {}) };
+      sched.providers[providerKey] = { ...(sched.providers[providerKey] || {}), claudeFallback: next };
+      this.config.scheduler = sched;
+      try { await this.saveConfig(this.config); } catch (e) { this._addLog(`Could not save: ${e.message}`); }
+      this._addLog(`${label} takes over when Claude is out: ${next}`);
+    };
+    if (cur === 'never') {
+      this._confirm(
+        `Let ${label} take over when Claude is out?`,
+        `A session that starts on Claude can finish on ${label}. Most move back to Claude fine. If ${label} runs a web search, that session stays on ${label} until you start a new one.`,
+        apply,
+      );
+      return;
+    }
+    apply();
+  }
+
   async _cycleCrossProviderPolicy() {
     const order = ['never', 'when-exhausted', 'always'];
     const cur = this.am._crossProviderFallbackPolicy();
@@ -1459,8 +1489,9 @@ export class TUI {
         // Show the CURRENT cross-provider policy inline so pressing f visibly changes it
         // right here at the footer (the policy also renders in the header, far from the
         // keypress — the "f does nothing" report).
-        const xp = this.am._crossProviderFallbackPolicy?.() || 'when-exhausted';
-        return ` ${bold('a')} Automatic  ${bold('p')} Manual preference  ${bold('f')} Cross-provider: ${cyan(xp)} ↻  ${bold('Esc')} Back`;
+        const g = this.am._claudeFallbackFor?.('zai') || 'never';
+        const k = this.am._claudeFallbackFor?.('kimi') || 'never';
+        return ` ${bold('a')} Automatic  ${bold('p')} Preference  ${bold('g')} GLM: ${cyan(g)} ↻  ${bold('k')} Kimi: ${cyan(k)} ↻  ${bold('Esc')} Back`;
       }
       case 'select': {
         const act = this.selAction === 'prefer'