maxpool 1.5.46 → 1.5.48

package/README.md

@@ -194,7 +194,7 @@ Provider fallback credentials can be supplied per Claude Code process with `ANTH
 
 `x-maxpool-session: <id>` enables session affinity. With this header, the first request for a Claude Code process is routed by the adaptive load balancer, then later requests from the same process keep using that home account while it remains available. If the home account is rate-limited, exhausted, in cooldown, or removed, the session temporarily uses another eligible route. When the home account becomes available again, the session returns to it. For the `all` profile, a Claude session that had to spill onto GLM/Kimi moves back to Claude once a Claude account frees up — **as long as it produced no provider-format tool calls while there**.
 
-**Cross-provider fallback + compatibility (`all` profile).** Claude, GLM (z.ai), and Kimi (Moonshot) interoperate for ordinary sessions — a regular tool-use id (`call_`/`tool_`) passes Anthropic's loose validation, so a Kimi or GLM session runs fine on Claude and a Claude session spills onto GLM/Kimi when Claude is unavailable. `scheduler.crossProviderFallbackPolicy` controls it, cyclable live in the TUI Routing menu (`m` → `f`): `never` = strict same-family (Claude→Claude, GLM→GLM, Kimi→Kimi), `when-exhausted` (default) = cross only once the home family is exhausted, `always` = providers peer with Claude.
+**Cross-provider fallback + compatibility (`all` profile).** Claude, GLM (z.ai), and Kimi (Moonshot) interoperate for ordinary sessions — a regular tool-use id (`call_`/`tool_`) passes Anthropic's loose validation, so a Kimi or GLM session that used no server tools runs on Claude (its *thinking* blocks are rejected, but Maxpool strips them automatically — see self-heal below) and a Claude session spills onto GLM/Kimi when Claude is unavailable. `scheduler.crossProviderFallbackPolicy` controls it, cyclable live in the TUI Routing menu (`m` → `f`): `never` (default) = **Claude sessions never spill onto a provider** (note: this governs the Claude→provider direction only — it is NOT a same-family pin), `when-exhausted` = cross only once the home family is exhausted, `always` = providers peer with Claude.
 
 The one hard incompatibility Maxpool guards is a **`server_tool_use` id** that isn't `srvtoolu_` — Anthropic 400s that on replay (e.g. a `cc glm` session that used a server tool, resumed under `cc all`). Maxpool predicts that case ahead (pins the session to GLM/Kimi) and, for anything it can't predict (a rejected thinking signature), **self-heals**: the 400 is pre-stream, so Maxpool latches the session provider-only and transparently retries on GLM/Kimi — the client never sees the error. (Note: Claude Code may warn a resumed `glm-*` model "could not be restored" and fall back to `claude-opus-4-8`; that's a client-side message — routing is unaffected.)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.46",
+  "version": "1.5.48",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -136,8 +136,9 @@ const DEFAULT_SCHEDULER = {
   crossAccountThinkingMigration: true,
   // Cross-PROVIDER fallback policy for 'cc all' (profile=all), i.e. whether a session
   // may be served by a provider FAMILY other than its home (Claude ↔ GLM ↔ Kimi).
-  //   'never'         — strict pin: a Claude session uses Claude only; a GLM session
-  //                     uses GLM only; a Kimi session uses Kimi only.
+  //   'never'         — (DEFAULT) a Claude session never spills onto a provider. NOTE:
+  //                     this governs the Claude→provider direction ONLY — it is NOT a
+  //                     same-family pin (a provider-origin session still reaches Claude).
   //   'when-exhausted'— home family preferred; a Claude session falls back to GLM/Kimi
   //                     only once all Claude accounts are unavailable, and a GLM session
   //                     may fall to Kimi once GLM is exhausted.
@@ -157,6 +158,18 @@ const DEFAULT_SCHEDULER = {
   // kept even while Claude→provider is 'never'. Only has effect under policy:'never' (the
   // 'when-exhausted'/'always' paths never pinned to home). Set false for a strict home-pin.
   providerCrossFallback: true,
+  // PER-PROVIDER Claude→provider control. One knob per provider so GLM and Kimi are
+  // steered independently (their reliability and quota differ). Each takes the same
+  // 'never' | 'when-exhausted' | 'always'. Undefined ⇒ inherit crossProviderFallbackPolicy,
+  // so an existing config upgrades to byte-identical behavior. Default 'never': letting a
+  // Claude session finish on a provider contaminates its transcript (BOTH providers emit
+  // thinking blocks Anthropic rejects — measured 2026-07-25), and while Maxpool now repairs
+  // that automatically, a provider server-tool call is NOT repairable.
+  // Ships EMPTY on purpose: an unset provider INHERITS crossProviderFallbackPolicy (whose
+  // default is already 'never'), so off-by-default holds without a per-provider entry
+  // shadowing the global one. Seeding explicit values here would mean cycling the global
+  // policy silently did nothing — the two-gate trap.
+  providers: {},
 };
 const LOAD_EVENT_MAX_AGE_MS = 60 * 60 * 1000;
 // Consecutive failed recovery probes before we stop trusting the SHARED breaker and
@@ -1717,7 +1730,7 @@ export class AccountManager {
   _effectivePriority(account, requestInfo = {}) {
     const base = Number.isFinite(account.priority) ? account.priority : 0;
     if (account.type === 'provider'
-        && this._crossProviderFallbackPolicy() === 'always'
+        && this._claudeFallbackFor(account.provider) === 'always'
         && !this._effectiveIncompatible(requestInfo).incompatible) {
       return 0;
     }
@@ -1745,6 +1758,23 @@ export class AccountManager {
     };
   }
 
+  /** Claude→provider policy for ONE provider. Falls back to the legacy global policy when
+   *  unset, so an existing config keeps its exact behavior on upgrade. */
+  _claudeFallbackFor(providerKey) {
+    const per = this.scheduler.providers?.[providerKey]?.claudeFallback;
+    const valid = new Set(['never', 'when-exhausted', 'always']);
+    return valid.has(per) ? per : this._crossProviderFallbackPolicy();
+  }
+
+  setClaudeFallbackForProvider(providerKey, policy) {
+    const valid = new Set(['never', 'when-exhausted', 'always']);
+    if (!providerKey || !valid.has(policy)) return false;
+    const providers = { ...(this.scheduler.providers || {}) };
+    providers[providerKey] = { ...(providers[providerKey] || {}), claudeFallback: policy };
+    this.scheduler.providers = providers;
+    return true;
+  }
+
   _isRequestCompatible(account, profile, requestInfo = {}) {
     if (!this._matchesProfile(account, profile)) return false;
 
@@ -1789,7 +1819,9 @@ export class AccountManager {
     // lets providers serve as a priority-fallback; 'always' peers them
     // (_effectivePriority). Signed thinking no longer bars providers here — but its
     // live MIGRATION stays Claude-only (see the rebalance guard).
-    if (account.type === 'provider' && policy === 'never') return false;
+    // PER-PROVIDER Claude→provider gate (GLM and Kimi steer independently). Unset ⇒
+    // inherits the legacy global policy, so behavior is unchanged on upgrade.
+    if (account.type === 'provider' && this._claudeFallbackFor(account.provider) === 'never') return false;
     return true;
   }
 
@@ -1835,6 +1867,37 @@ export class AccountManager {
     this.sessionPolicies.set(sessionKey, { ...existing, largeContext: true });
   }
 
+  // Latch a session whose transcript carries provider-authored thinking blocks Anthropic
+  // rejects. Without this the repair is per-REQUEST: the client resends the whole poisoned
+  // history every turn, so each turn pays another rejected round-trip before the strip
+  // (measured: ~9 rejections per contaminated session). Sticky → later turns are stripped
+  // BEFORE the first attempt. In-memory only, like the other session policies.
+  markSessionThinkingContaminated(sessionKey) {
+    if (!sessionKey) return;
+    const existing = this.sessionPolicies.get(sessionKey) || {};
+    if (!existing.thinkingContaminated) {
+      console.log(`[Maxpool] Session "${sessionKey}" carries provider-authored thinking — stripping it up front from now on`);
+    }
+    this.sessionPolicies.set(sessionKey, { ...existing, thinkingContaminated: true });
+  }
+
+  /** Release a session pinned provider-only by an earlier turn. The incompatible latch is
+   *  deliberately sticky (it never downgrades), which is right while the transcript really
+   *  is unrepairable — but a repaired body IS replayable on Claude, so the pin must lift
+   *  or every previously-broken session stays exiled forever. */
+  clearSessionIncompatible(sessionKey) {
+    if (!sessionKey) return;
+    const existing = this.sessionPolicies.get(sessionKey);
+    if (!existing?.anthropicIncompatible) return;
+    this.sessionPolicies.set(sessionKey, { ...existing, anthropicIncompatible: false });
+    console.log(`[Maxpool] Session "${sessionKey}" repaired — Claude routes re-enabled`);
+  }
+
+  isSessionThinkingContaminated(sessionKey) {
+    if (!sessionKey) return false;
+    return Boolean(this.sessionPolicies.get(sessionKey)?.thinkingContaminated);
+  }
+
   _isSessionLargeContext(requestInfo = {}) {
     if (requestInfo.largeContext) return true;
     if (!requestInfo.sessionKey) return false;

package/src/config.js

@@ -110,6 +110,14 @@ export function createDefaultConfig() {
       // (GLM/Kimi) session cross to the OTHER provider (GLM↔Kimi)? Default ON — reliable,
       // both legs accept each other's ids. Only has effect under policy:'never'.
       providerCrossFallback: true,
+      // Per-provider Claude→provider control (TUI routing: g = GLM, k = Kimi). Same values
+      // as the policy above; unset inherits it. Default 'never' — a Claude session that
+      // finishes on a provider comes back with thinking blocks Anthropic rejects (Maxpool
+      // repairs that automatically, but a provider server-tool call is unrepairable).
+      // Left EMPTY: an unset provider inherits the policy above, so off-by-default holds
+      // without shadowing it. The TUI writes an entry here only when you steer one
+      // provider differently from the other.
+      providers: {},
     },
     retry: {
       maxAttemptsPerRequest: 0,

package/src/index.js

@@ -17,7 +17,7 @@ import {
   runReloadBaton,
   RELOAD_SWAPPED, RELOAD_ROLLED_BACK,
   MSG_LISTEN, MSG_RELEASE, MSG_TAKEOVER, MSG_PROBE_READY,
-  MSG_RELOAD_REQUEST, MSG_READY, MSG_FAILED, MSG_RELEASED, MSG_PRIMARY,
+  MSG_RELOAD_REQUEST, MSG_READY, MSG_FAILED, MSG_RELEASED, MSG_PRIMARY, MSG_ROLLED_BACK,
 } from './reload-protocol.js';
 
 const args = process.argv.slice(2);
@@ -626,7 +626,9 @@ async function serverWorkerCommand() {
   // before (or without) the npm update check. The cold worker's update check below
   // fills in latest/hasUpdate.
   getCurrentVersion()
-    .then(v => { accountManager.versionInfo ||= { current: v, latest: null, hasUpdate: false, checkedAt: null }; })
+    .then(v => {
+      accountManager.versionInfo ||= { current: v, latest: null, hasUpdate: false, checkedAt: null };
+    })
     .catch(() => {});
 
   // Persist refreshed tokens back to config. Defense-in-depth: the updater reads
@@ -727,6 +729,10 @@ async function serverWorkerCommand() {
   // Self-heal timer for a seamless reload that rolls back (new worker fails to boot,
   // we're never released). Cleared on MSG_RELEASE; fires cancelRestart otherwise.
   let reloadWatchdog = null;
+  // One cold-restart fallback per reload request — see the rollback watchdog below.
+  let coldFallbackUsed = false;
+  let reloadIsForUpdate = false;
+  let lastRollbackReason = null;
 
   // Best-effort terminal restore on ANY abnormal exit path (uncaughtException,
   // a bare process.exit, a crash) so the user's shell is never left in raw mode
@@ -857,6 +863,8 @@ async function serverWorkerCommand() {
       || process.env.MAXPOOL_TUI_COLD_RESTART === '1';
     if (!forceCold && reloadStrategy({ supervised }) === 'seamless') {
       try {
+        coldFallbackUsed = false;   // fresh reload → fresh cold-fallback budget
+        lastRollbackReason = null;
         process.send({ type: MSG_RELOAD_REQUEST });
         // Arm the rollback self-heal: restartController already latched
         // pending/restarting + paused admission (in _restart, before we got here).
@@ -868,7 +876,29 @@ async function serverWorkerCommand() {
           reloadWatchdog = null;
           if (draining) return; // MSG_RELEASE already arrived → a real reload, not a rollback
           if (restartController?.cancelRestart()) {
-            console.log('[Maxpool] Reload rolled back (new worker never took over) — resumed serving.');
+            console.log('[Maxpool] Reload rolled back (new worker never took over).');
+          }
+          // FALL BACK TO A COLD RESTART — but ONLY when a newer build is actually on disk
+          // waiting to be picked up. Resuming the old worker is what made "press u → c"
+          // look like nothing happened: the graceful swap failed under machine load and
+          // the update was abandoned, forever. Gating on a real pending update preserves
+          // the safety property that a plain failed reload leaves a HEALTHY worker serving
+          // (never kill a working process for nothing), while an update still lands.
+          // One attempt per reload request, so a build that cannot boot can't crash-loop.
+          // Cold-restart ONLY when the new build was merely SLOW to signal ready (a
+          // loaded machine — the reported case). If it reported failure or died before
+          // ready, the build cannot boot: restarting into it would leave the user with no
+          // working proxy at all, strictly worse than the bug being fixed. Absent reason
+          // (older supervisor) is treated as unsafe.
+          const swapWasSlowNotBroken = lastRollbackReason === 'timeout';
+          if (reloadIsForUpdate && swapWasSlowNotBroken && !coldFallbackUsed) {
+            coldFallbackUsed = true;
+            console.log('[Maxpool] Applying the update with a full restart instead — one moment.');
+            restartWorkerNow();
+          } else if (reloadIsForUpdate && !swapWasSlowNotBroken) {
+            console.log('[Maxpool] The new version failed to start — resumed serving on the current version. Update NOT applied.');
+          } else {
+            console.log('[Maxpool] Rollback complete — resumed serving on the current version.');
           }
         }, RELOAD_ROLLBACK_SELFHEAL_MS);
         reloadWatchdog.unref?.();
@@ -974,10 +1004,14 @@ async function serverWorkerCommand() {
         // policy cycled with the TUI 'f' key). Without this, the toggle takes effect
         // in memory but silently reverts on the next config write / restart. Merge
         // onto the existing disk scheduler block so other scheduler keys survive.
-        if (config.scheduler?.crossProviderFallbackPolicy) {
+        if (config.scheduler?.crossProviderFallbackPolicy || config.scheduler?.providers) {
           diskConfig.scheduler = {
             ...diskConfig.scheduler,
-            crossProviderFallbackPolicy: config.scheduler.crossProviderFallbackPolicy,
+            ...(config.scheduler.crossProviderFallbackPolicy
+              ? { crossProviderFallbackPolicy: config.scheduler.crossProviderFallbackPolicy } : {}),
+            // Per-provider Claude→provider settings (TUI routing g / k). Must be listed
+            // here explicitly or the toggle takes effect in memory and silently reverts.
+            ...(config.scheduler.providers ? { providers: config.scheduler.providers } : {}),
           };
         }
         // Persist live-toggled automatic-update flags (the TUI 'u' Updates menu). Same
@@ -1056,6 +1090,11 @@ async function serverWorkerCommand() {
     if (r?.applicable && config?.autoApply && restartController) {
       markApplied(r.installedVersion);
       notifyUpdate('Applying update — seamless reload…');
+      // Mark this reload as UPDATE-driven: if the seamless swap rolls back (machine
+      // under load), the watchdog cold-restarts so the update actually lands instead of
+      // silently resuming the old build. A plain 'r' restart never does that — there a
+      // rollback should leave the healthy worker serving.
+      reloadIsForUpdate = true;
       restartController.requestRestart();
     }
   };
@@ -1067,6 +1106,11 @@ async function serverWorkerCommand() {
     if (r?.applicable && restartController) {
       markApplied(r.installedVersion);
       notifyUpdate('Applying update — seamless reload…');
+      // Mark this reload as UPDATE-driven: if the seamless swap rolls back (machine
+      // under load), the watchdog cold-restarts so the update actually lands instead of
+      // silently resuming the old build. A plain 'r' restart never does that — there a
+      // rollback should leave the healthy worker serving.
+      reloadIsForUpdate = true;
       restartController.requestRestart();
     }
   };
@@ -1280,6 +1324,9 @@ async function serverWorkerCommand() {
           // sends MSG_PRIMARY (the baton waits on it).
           await listenOnHandle(handle);
           await becomePrimary({ viaTakeover: true });
+        } else if (msg?.type === MSG_ROLLED_BACK) {
+          // Why the swap failed decides whether a cold restart is safe (see the watchdog).
+          lastRollbackReason = msg.reason || null;
         } else if (msg?.type === MSG_RELEASE) {
           // Baton release: stop accepting NEW (keep in-flight), retire keep-alive
           // sockets with Connection: close, stop writing, flush once, drop TUI.

package/src/reload-protocol.js

@@ -14,6 +14,11 @@
 
 // Supervisor → worker
 export const MSG_LISTEN = 'listen';       // (with handle) accept on this socket + take TUI/lease
+// Tells the surviving old worker WHY a reload rolled back. 'timeout' = the new worker
+// was merely slow to signal ready (a loaded machine) — safe to retry with a cold
+// restart. 'failed' = it reported failure or died before ready — a cold restart there
+// would commit to a build that cannot boot and leave NO working proxy.
+export const MSG_ROLLED_BACK = 'rolled-back';
 export const MSG_RELEASE = 'release';     // stop accepting, stop writing, flush, give up TUI
 export const MSG_TAKEOVER = 'takeover';   // (with handle) start accepting + acquire writer lease + TUI
 export const MSG_PROBE_READY = 'probe-ready'; // ask a headless worker to confirm it booted OK
@@ -70,11 +75,13 @@ export async function runReloadBaton({
     ready = await newWorker.waitFor([MSG_READY, MSG_FAILED], readyTimeoutMs);
   } catch (err) {
     log(`reload: readiness wait failed (${err.message}); rolling back`);
+    try { oldWorker.send({ type: MSG_ROLLED_BACK, reason: 'timeout' }); } catch { /* old worker gone */ }
     return RELOAD_ROLLED_BACK;
   }
   // (b) New worker did not come up cleanly → roll back fully, old stays primary.
   if (!ready || ready.type === MSG_FAILED) {
     log(`reload: new worker reported failed (${ready?.reason || 'no ready'}); rolling back`);
+    try { oldWorker.send({ type: MSG_ROLLED_BACK, reason: 'failed' }); } catch { /* old worker gone */ }
     return RELOAD_ROLLED_BACK;
   }
 

package/src/server.js

@@ -354,6 +354,34 @@ async function forwardRequest(
   const configuredAttempts = Number(retryConfig.maxAttemptsPerRequest) || accountManager.accounts.length;
   const maxAttempts = Math.max(1, configuredAttempts);
 
+  // PRE-STRIP a session already known to carry provider-authored thinking. The client
+  // resends the whole poisoned history every turn, so without this each turn pays another
+  // rejected round-trip before the reactive repair kicks in. Latched by the first repair.
+  // ALSO repairs a transcript maxpool predicts Anthropic will reject (a provider web
+  // search). That prediction happens BEFORE any request is sent and bars every Claude
+  // account, so the reactive repair in the 4xx handler could never be reached for it —
+  // the session stayed exiled to GLM/Kimi, or got NO ROUTE AT ALL when they're disabled
+  // (8 healthy Claude accounts idle while the user is told nothing is available).
+  // Repairing here, ahead of routing, is what makes that case recoverable.
+  if (retryCount === 0 && !requestInfo.thinkingStripped
+    && (requestInfo.anthropicIncompatible
+      || accountManager.isSessionThinkingContaminated?.(requestInfo.sessionKey))) {
+    const pre = stripForeignThinkingBlocks(body);
+    if (pre.body) {
+      body = pre.body;
+      requestInfo = { ...requestInfo, thinkingStripped: true };
+      if (pre.converted) {
+        // The body now replays cleanly on Claude, so drop the predictive verdict —
+        // otherwise routing still exiles it and _noteRequestPolicy latches it sticky.
+        requestInfo = { ...requestInfo, anthropicIncompatible: false };
+        // And un-latch a session pinned by an EARLIER turn: the sticky policy is ORed in
+        // and never downgrades, so without this the user's already-broken sessions stay
+        // pinned forever even though we can now repair them.
+        accountManager.clearSessionIncompatible?.(requestInfo.sessionKey);
+      }
+    }
+  }
+
   // Select account
   const lease = accountManager.acquireAccount(requestInfo, excludedIndexes);
   const account = lease?.account;
@@ -896,8 +924,18 @@ async function forwardRequest(
       // for the strip-and-recover retry below. Deliberately NOT the fuzzy
       // isAnthropicIncompatBody heuristic, so a merely malformed request can never cause
       // us to rewrite a user's transcript.
+      // Two deterministic shapes, both repairable by stripping: a signature Anthropic
+      // can't validate, AND a provider block that carries NO signature field at all
+      // ("messages.4.content.0.thinking.signature: Field required"). The second variant
+      // used to fall straight through to a PERMANENT provider pin even though stripping
+      // fixes it. Still deterministic — never the fuzzy isAnthropicIncompatBody heuristic.
       const isSignatureRejection = account.type !== 'provider'
-        && /invalid `signature` in `thinking`/i.test(errorBody);
+        && (/invalid `signature` in `thinking`/i.test(errorBody)
+          || /content\.\d+\.thinking\.signature/i.test(errorBody)
+          // A provider web search: `server_tool_use.id: String should match pattern
+          // '^srvtoolu_…'`. Repairable by converting the pair to text (verified 200 OK) —
+          // it used to fall through to a PERMANENT provider pin.
+          || /server_tool_use\.id: String should match pattern/i.test(errorBody));
       const errorType = errorBody.includes('Invalid `signature` in `thinking` block')
         ? 'invalid_thinking_signature'
         : anthropicIncompat ? 'anthropic_incompatible_transcript'
@@ -941,9 +979,12 @@ async function forwardRequest(
       // still fails, the provider pin below is the fallback.
       if (isSignatureRejection && !requestInfo.thinkingStripped
         && canRetryBufferedBody && retryCount + 1 < maxAttempts && !res.headersSent) {
-        const { body: cleanBody, removed } = stripForeignThinkingBlocks(body);
+        const { body: cleanBody, removed, converted } = stripForeignThinkingBlocks(body);
         if (cleanBody) {
-          console.log(`[Maxpool] Recovering session on Claude: stripped ${removed} provider-authored thinking block(s) Anthropic rejected`);
+          // Latch it so EVERY later turn is stripped up front instead of re-paying this
+          // rejected round-trip (the client resends the full poisoned history each turn).
+          accountManager.markSessionThinkingContaminated?.(requestInfo.sessionKey);
+          console.log(`[Maxpool] Recovering session on Claude: stripped ${removed} provider thinking block(s), converted ${converted} provider search block(s) to text`);
           return forwardRequest(
             req, res, cleanBody, accountManager, upstream, retryCount + 1, hooks, reqId, ctx, logDir,
             retryConfig, queueConfig, { ...requestInfo, thinkingStripped: true },
@@ -1009,8 +1050,8 @@ async function forwardRequest(
         // ran; without it we found nothing provider-shaped, so claiming we stripped —
         // or blaming GLM/Kimi — would misdirect the user.
         const what = requestInfo.thinkingStripped
-          ? 'This session ran on GLM/Kimi earlier and Anthropic rejects the thinking blocks they wrote. Maxpool removed them and retried on Claude, but Anthropic still rejected the history.'
-          : "Anthropic rejected a thinking block in this session's history, and maxpool could not identify it as provider-authored, so it could not be repaired automatically.";
+          ? 'This session ran on GLM/Kimi earlier, and Anthropic will not accept parts of what they wrote. Maxpool repaired what it could and retried on Claude, but Anthropic still rejected the history.'
+          : "Anthropic rejected part of this session's history that maxpool could not repair automatically.";
         const hint = provs.length === 0
           ? ''
           : provs.every(a => a.enabled === false)
@@ -1535,22 +1576,96 @@ function isStrippableThinkingBlock(block) {
  *
  * Returns { body, removed } — `body` is null when nothing needed stripping.
  */
+// A provider's web search leaves a `server_tool_use` id Anthropic rejects (it demands
+// ^srvtoolu_). Verified 2026-07-26 against the live API: renaming the id is NOT enough —
+// a second gate rejects the result's `encrypted_content`, which only Anthropic can mint.
+// But converting the pair into plain TEXT is accepted (200 OK) and keeps what the search
+// actually found, so the session survives with its information intact. This is what made
+// the web-search case look permanently unrepairable.
+/** Collect foreign server-tool ids across the WHOLE transcript first — a call sits on the
+ *  assistant turn but its result is often carried on the FOLLOWING user turn, so a
+ *  per-message scan would leave that result behind (and it alone still 400s). */
+function collectForeignServerToolIds(messages) {
+  const ids = new Set();
+  const clientIds = new Set();
+  const walk = (blocks) => {
+    if (!Array.isArray(blocks)) return;
+    for (const b of blocks) {
+      if (b?.type === 'tool_use' && b.id) clientIds.add(b.id);
+      if (b?.type === 'server_tool_use' && !ANTHROPIC_TOOL_ID.test(String(b.id || ''))) ids.add(b.id);
+      if (Array.isArray(b?.content)) walk(b.content);   // nested, mirrors detectTranscriptOrigin
+    }
+  };
+  for (const msg of messages) walk(msg?.content);
+  // NEVER treat an id that a real client tool_use also owns as foreign: converting its
+  // tool_result would orphan that tool_use and Anthropic 400s ("tool_use ids without
+  // tool_result"), which the sticky pre-strip would then re-inflict every turn — a
+  // permanent loop. Providers with per-turn counters (call_0, call_1) make the collision
+  // likely, not theoretical.
+  for (const id of clientIds) ids.delete(id);
+  return ids;
+}
+
+function convertForeignServerTools(content, foreignIds) {
+  if (!foreignIds || foreignIds.size === 0) return { content, converted: 0 };
+  let converted = 0;
+  const out = [];
+  for (const b of content) {
+    if (b?.type === 'server_tool_use' && foreignIds.has(b.id)) {
+      const q = b.input?.query;
+      out.push({ type: 'text', text: q ? `[searched the web for: ${q}]` : `[used ${b.name || 'a tool'}]` });
+      converted++;
+      continue;
+    }
+    // Any result block referring to a foreign call — web_search_tool_result and friends.
+    if (b?.tool_use_id && foreignIds.has(b.tool_use_id)) {
+      const rows = Array.isArray(b.content) ? b.content : [];
+      // Fall back through the shapes a PROVIDER may use — the point of converting rather
+      // than dropping is to keep what the search found; assuming Anthropic's {title,url}
+      // would silently discard a GLM row that carries text instead.
+      const found = rows
+        .map(r => [r?.title, r?.url].filter(Boolean).join(' — ')
+          || (typeof r === 'string' ? r : (r?.text ?? r?.content ?? r?.snippet ?? '')))
+        .map(t => (typeof t === 'string' ? t.slice(0, 300) : ''))
+        .filter(Boolean).slice(0, 10);
+      out.push({ type: 'text', text: found.length ? `[search results: ${found.join(' | ')}]` : '[search returned no usable results]' });
+      converted++;
+      continue;
+    }
+    out.push(b);
+  }
+  return { content: out, converted };
+}
+
 function stripForeignThinkingBlocks(body) {
   try {
     const json = JSON.parse(Buffer.isBuffer(body) ? body.toString('utf8') : String(body));
     if (!Array.isArray(json?.messages)) return { body: null, removed: 0 };
     let removed = 0;
+    let converted = 0;
+    const foreignToolIds = collectForeignServerToolIds(json.messages);
     const messages = [];
     for (const msg of json.messages) {
-      if (msg?.role !== 'assistant' || !Array.isArray(msg.content)) { messages.push(msg); continue; }
+      if (!Array.isArray(msg?.content)) { messages.push(msg); continue; }
+      // Foreign server-tool pairs are converted on EVERY role: the call sits on the
+      // assistant turn but its result can be carried on the following user turn.
+      const tools = convertForeignServerTools(msg.content, foreignToolIds);
+      converted += tools.converted;
+      if (msg.role !== 'assistant') {
+        messages.push(tools.converted ? { ...msg, content: tools.content } : msg);
+        continue;
+      }
       let localRemoved = 0;
-      const kept = msg.content.filter(block => {
+      const kept = tools.content.filter(block => {
         if (!isStrippableThinkingBlock(block)) return true;
         localRemoved++;
         return false;
       });
       removed += localRemoved;
-      if (!localRemoved) { messages.push(msg); continue; }
+      if (!localRemoved) {
+        messages.push(tools.converted ? { ...msg, content: tools.content } : msg);
+        continue;
+      }
       // A turn that stripping empties is DROPPED, not left with its poisoned block:
       // leaving it would resend the exact body that just 400'd while reporting success
       // and burning the single recovery attempt. Verified against the live API — the
@@ -1558,11 +1673,11 @@ function stripForeignThinkingBlocks(body) {
       if (kept.length === 0) continue;
       messages.push({ ...msg, content: kept });
     }
-    if (!removed) return { body: null, removed: 0 };
+    if (!removed && !converted) return { body: null, removed: 0, converted: 0 };
     json.messages = messages;
-    return { body: Buffer.from(JSON.stringify(json)), removed };
+    return { body: Buffer.from(JSON.stringify(json)), removed, converted };
   } catch {
-    return { body: null, removed: 0 };   // non-JSON / unparseable → no rewrite
+    return { body: null, removed: 0, converted: 0 };   // non-JSON / unparseable → no rewrite
   }
 }
 

package/src/tui.js

@@ -559,6 +559,8 @@ export class TUI {
       );
     } else if (k === 'p' && this.am.accounts.some(account => account.type !== 'provider')) {
       this._startSelection('prefer');
+    } else if (k === 'g' || k === 'k') {
+      this._cycleProviderClaudeFallback(k === 'g' ? 'zai' : 'kimi');
     } else if (k === 'f' || k === 'F') {
       // Cycle the cross-provider fallback policy in place — reversible + non-destructive,
       // so no confirm dialog (unlike restart/delete). Accept F too (Shift-f muscle memory).
@@ -568,6 +570,34 @@ export class TUI {
     }
   }
 
+  /** Cycle ONE provider's Claude→provider setting. Turning it ON is the risky direction
+   *  (a Claude session can finish on that provider), so it asks first; turning it back off
+   *  is always safe and never prompts. */
+  _cycleProviderClaudeFallback(providerKey) {
+    const order = ['never', 'when-exhausted', 'always'];
+    const label = providerKey === 'zai' ? 'GLM' : 'Kimi';
+    const cur = this.am._claudeFallbackFor?.(providerKey) || 'never';
+    const next = order[(order.indexOf(cur) + 1) % order.length];
+    const apply = async () => {
+      this.am.setClaudeFallbackForProvider?.(providerKey, next);
+      const sched = { ...(this.config.scheduler || {}) };
+      sched.providers = { ...(sched.providers || {}) };
+      sched.providers[providerKey] = { ...(sched.providers[providerKey] || {}), claudeFallback: next };
+      this.config.scheduler = sched;
+      try { await this.saveConfig(this.config); } catch (e) { this._addLog(`Could not save: ${e.message}`); }
+      this._addLog(`${label} takes over when Claude is out: ${next}`);
+    };
+    if (cur === 'never') {
+      this._confirm(
+        `Let ${label} take over when Claude is out?`,
+        `A session that starts on Claude can finish on ${label}. Most move back to Claude fine. If ${label} runs a web search, that session stays on ${label} until you start a new one.`,
+        apply,
+      );
+      return;
+    }
+    apply();
+  }
+
   async _cycleCrossProviderPolicy() {
     const order = ['never', 'when-exhausted', 'always'];
     const cur = this.am._crossProviderFallbackPolicy();
@@ -1459,8 +1489,9 @@ export class TUI {
         // Show the CURRENT cross-provider policy inline so pressing f visibly changes it
         // right here at the footer (the policy also renders in the header, far from the
         // keypress — the "f does nothing" report).
-        const xp = this.am._crossProviderFallbackPolicy?.() || 'when-exhausted';
-        return ` ${bold('a')} Automatic  ${bold('p')} Manual preference  ${bold('f')} Cross-provider: ${cyan(xp)} ↻  ${bold('Esc')} Back`;
+        const g = this.am._claudeFallbackFor?.('zai') || 'never';
+        const k = this.am._claudeFallbackFor?.('kimi') || 'never';
+        return ` ${bold('a')} Automatic  ${bold('p')} Preference  ${bold('g')} GLM: ${cyan(g)} ↻  ${bold('k')} Kimi: ${cyan(k)} ↻  ${bold('Esc')} Back`;
       }
       case 'select': {
         const act = this.selAction === 'prefer'