maxpool 1.5.56 → 1.5.58

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.56",
+  "version": "1.5.58",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -1785,13 +1785,14 @@ export class AccountManager {
     // are all unavailable the request HOLDS/queues (recoverable) rather than 400ing.
     if (requestInfo.hasImage && account.provider === 'kimi') return false;
 
-    // A large-context session: a provider already rejected this request with a
-    // context-length 400. The GLM/Kimi *coding* endpoints serve a fixed model capped
-    // at ~256K and IGNORE the model id (so a K3/GLM 1M PLAN doesn't lift the coding
-    // leg's ceiling). Only a 1M-context Claude account can hold it — bench the
-    // providers for this session so it routes to Claude, or HOLDS for one, instead of
-    // re-404ing on a too-small leg. Sticky per session (context only grows turn over
-    // turn), so no follow-up turn re-pays the wasted attempt.
+    // A large-context session: a provider already rejected THIS request with a
+    // context-length 400. Deliberately REACTIVE — it never assumes a ceiling, it learns
+    // one from an actual rejection, so it self-corrects as providers grow. That matters:
+    // the old ~256K coding-endpoint cap is gone (verified 2026-08-02 — GLM 5.2 and Kimi
+    // K3 both accepted a ~400K-token payload and both honoured the requested model id),
+    // so this branch simply stops firing rather than needing a new constant.
+    // Sticky per session (context only grows turn over turn) so no follow-up turn re-pays
+    // the wasted attempt.
     if (account.type === 'provider' && this._isSessionLargeContext(requestInfo)) return false;
 
     const { incompatible, homeProvider } = this._effectiveIncompatible(requestInfo);

package/src/oauth.js

@@ -27,14 +27,17 @@ export function tokenFingerprint(token) {
  * Refresh an expired OAuth access token using the refresh token.
  * Retries on 5xx and network errors with exponential backoff.
  */
+// How long to wait for the user to finish the browser login. Env-overridable.
+const LOGIN_TIMEOUT_MS = Math.max(60_000, Number(process.env.MAXPOOL_LOGIN_TIMEOUT_MS) || 300_000);
+
 export async function refreshAccessToken(refreshToken, endpoint = DEFAULT_TOKEN_ENDPOINT) {
   const maxRetries = 2;
   const baseDelayMs = 500;
-  // Bound each refresh POST so a hung connect during an outage can't pin the
-  // single-flight _refreshPromise indefinitely (which would stall that account's
-  // recovery). Comfortably above a normal refresh latency; a timeout is classified
-  // as a network error below and retried / short-cooled.
-  const perAttemptTimeoutMs = 10_000;
+  // 30s, not 10s. A refresh aborted by OUR timeout is the dangerous case (see below), so
+  // the timeout must be generous enough that a merely slow network never triggers it.
+  // Measured 2026-08-03: refreshes aborted at 10s during a degraded-network window, and
+  // the retries that followed destroyed 4 accounts.
+  const perAttemptTimeoutMs = Math.max(10_000, Number(process.env.MAXPOOL_TOKEN_REFRESH_TIMEOUT_MS) || 30_000);
 
   for (let attempt = 0; attempt <= maxRetries; attempt++) {
     try {
@@ -83,10 +86,26 @@ export async function refreshAccessToken(refreshToken, endpoint = DEFAULT_TOKEN_
           (err.code === 'ECONNRESET' || err.code === 'ECONNREFUSED' ||
            err.code === 'ETIMEDOUT' || err.code === 'UND_ERR_CONNECT_TIMEOUT'));
 
-      if (attempt < maxRetries && isNetworkError) {
+      // NEVER re-send a single-use refresh token after an AMBIGUOUS failure. A timeout,
+      // an abort, or a reset AFTER the request left us means the server may have processed
+      // it and rotated the token — retrying then spends a token that is already dead and
+      // the account is destroyed with invalid_grant. Only a failure that provably happened
+      // BEFORE the server saw the request (connection refused, DNS) is safe to retry.
+      //
+      // Measured 2026-08-03: a degraded network aborted refreshes at 10s; the retry loop
+      // re-sent each token up to 3 times within seconds, and 4 accounts died with
+      // "Refresh token not found or invalid" — requiring a manual re-login each.
+      const sentToServer = !(err.code === 'ECONNREFUSED' || err.code === 'ENOTFOUND'
+        || err.code === 'EAI_AGAIN' || err.code === 'UND_ERR_CONNECT_TIMEOUT');
+      if (attempt < maxRetries && isNetworkError && !sentToServer) {
         continue;
       }
-      if (isNetworkError) err.retryable = true;
+      if (isNetworkError) {
+        err.retryable = true;
+        // Tell the caller the token's fate is UNKNOWN, so it cools the account and tries
+        // once later instead of treating this as a clean failure.
+        err.ambiguousRefresh = sentToServer;
+      }
       throw err;
     }
   }
@@ -555,11 +574,13 @@ function startCallbackServer(expectedState) {
     });
     server.on('error', reject);
 
-    // Timeout after 2 minutes (unref so it doesn't keep the process alive)
+    // Bounded so a forgotten browser tab can't pin the process. 5 minutes, not 2:
+    // reported 2026-08-03 that a real login (password + 2FA, several accounts in a row)
+    // repeatedly overran 2 minutes and had to be restarted from scratch.
     const timer = setTimeout(() => {
-      rejectCode(new Error('Login timed out after 2 minutes'));
+      rejectCode(new Error(`Login timed out after ${Math.round(LOGIN_TIMEOUT_MS / 60_000)} minutes`));
       server.close();
-    }, 120_000);
+    }, LOGIN_TIMEOUT_MS);
     timer.unref();
   });
 }

package/src/server.js

@@ -2370,7 +2370,10 @@ function prepareRuntimeProviders(accountManager, headers) {
 
   const kimiToken = headerValue(headers, 'x-maxpool-kimi-token');
   if (kimiToken) {
-    const model = headerValue(headers, 'x-maxpool-kimi-model') || 'kimi-k2.7';
+    // Fallback only — `cc all` always sends x-maxpool-kimi-model from the llm_config SSOT,
+    // so this is what a bare/older client gets. Kept current deliberately: it read
+    // 'kimi-k2.7' while the fleet had moved to k3.
+    const model = headerValue(headers, 'x-maxpool-kimi-model') || 'kimi-k3';
     accountManager.upsertRuntimeAccount({
       name: 'kimi-fallback',
       type: 'provider',

package/src/tui.js

@@ -1152,16 +1152,31 @@ export class TUI {
     }
     lines.push(` Routing  ${cyan(routing)}${xpText}`);
     const queuedCount = this.am.queueState?.waiting?.length || 0;
-    if (this.am._isUpstreamThrottleBlocking?.() || queuedCount) {
+    // Throttle and WAITING are different things and used to share one line labelled
+    // "Anthropic upstream throttled" — so a request parked purely because every account
+    // is at its quota was either invisible (no throttle) or described as a throttle it
+    // wasn't. Waiting is the headline state of this proxy; it gets its own line, always
+    // shown whenever anything is parked, naming what it is waiting FOR.
+    if (this.am._isUpstreamThrottleBlocking?.()) {
       const throttle = this.am.upstreamThrottle;
       const remaining = throttle.until ? Math.max(0, Math.ceil((throttle.until - Date.now()) / 1000)) : 0;
-      const state = this.am._isUpstreamThrottleBlocking?.()
-        ? throttle.probeInFlight ? 'probing recovery' : `retry in ${remaining}s`
-        : 'recovering';
-      const queued = queuedCount;
-      const oldest = queued ? Math.max(0, Date.now() - this.am.queueState.waiting[0].queuedAt) : 0;
-      const queueText = queued ? `  queued ${queued}  oldest ${formatMs(oldest)}` : '';
-      lines.push(` ${yellow(' Anthropic upstream throttled')}  ${dim(state + queueText)}`);
+      const state = throttle.probeInFlight ? 'probing recovery' : `retry in ${remaining}s`;
+      lines.push(` ${yellow(' Anthropic upstream throttled')}  ${dim(state)}`);
+    }
+    if (queuedCount) {
+      const oldest = Math.max(0, Date.now() - this.am.queueState.waiting[0].queuedAt);
+      // Name the soonest thing that would release them, so a long wait reads as
+      // "waiting for a known reset" rather than "hung".
+      let why = 'waiting for capacity';
+      try {
+        const plan = this.am.nextRetryForRequest?.({}, new Set()) || {};
+        if (Number.isFinite(plan.retryAfterMs) && plan.retryAfterMs > 0) {
+          why = `next account frees in ~${formatMs(plan.retryAfterMs)}`;
+        } else if (plan.cause) {
+          why = `waiting (${plan.cause.replace(/_/g, ' ')})`;
+        }
+      } catch { /* display-only; never let the oracle break the render */ }
+      lines.push(` ${cyan(' Parked')} ${dim(`${queuedCount} request${queuedCount === 1 ? '' : 's'} held  oldest ${formatMs(oldest)}  ·  ${why}`)}`);
     }
 
     // ── Accounts