maxpool 1.5.6 → 1.5.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.6",
+  "version": "1.5.7",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -1432,11 +1432,15 @@ export class AccountManager {
 
     const ramp = this._recoveryRamp(account, now);
     const failurePenalty = account.consecutiveFailures * 5;
-    // Bias toward an account whose weekly quota is still unknown so it gets
-    // probed and learned (matches the legacy unknown-quota exploration nudge).
-    const explorationBonus = account.quota.unified7dReset == null ? -0.5 : 0;
-
-    return concurrency + capPenalty + paceCost + spread + ramp + failurePenalty + explorationBonus;
+    // NO unknown-quota bonus. An account whose quota we cannot see must never be
+    // MORE attractive than a known-healthy one — the old -0.5 nudge (safe only
+    // while the prober quickly resolved "unknown") turned into a relentless pull
+    // toward blind accounts once probing was off, driving an out-of-band-burned
+    // account to exhaustion. Unknown now scores neutral; the prober (on by
+    // default) learns the real number within a cycle. `probing`/requalify still
+    // flags a never-seen account for learning — that path is unchanged.
+
+    return concurrency + capPenalty + paceCost + spread + ramp + failurePenalty;
   }
 
   /**

package/src/config.js

@@ -62,7 +62,11 @@ export function createDefaultConfig() {
     // Raise toward 0.97 to squeeze more out of accounts before rotating
     // (less margin, slightly higher 429 risk); lower to rotate more eagerly.
     switchThreshold: 0.90,
-    quotaProbeSeconds: 0, // background quota probe; 0 = off (opt-in)
+    // Background quota probe: poll every account's real 5h/7d utilization from the
+    // zero-spend usage endpoint every N seconds. ON by default — without it maxpool
+    // is blind to idle / out-of-band-used accounts and the scorer will pile traffic
+    // onto exactly the account it cannot see. 0 = off.
+    quotaProbeSeconds: 60,
     routing: {
       mode: 'automatic',
       preferredAccount: null,
@@ -135,8 +139,9 @@ export async function loadConfig() {
     if (err.code === 'ENOENT') return null;
     throw err;
   }
+  let parsed;
   try {
-    return JSON.parse(raw);
+    parsed = JSON.parse(raw);
   } catch (err) {
     // With atomic temp+rename writes a torn read is impossible, so a parse
     // failure means genuine corruption. Surface it clearly rather than as a
@@ -144,6 +149,18 @@ export async function loadConfig() {
     // the file with defaults and lose recoverable OAuth credentials.
     throw new Error(`config at ${path} is not valid JSON (corrupt?): ${err.message}`);
   }
+  // Backfill top-level keys ABSENT from an older on-disk config with the current
+  // defaults, so a changed default (e.g. quotaProbeSeconds flipping on) actually
+  // reaches existing installs instead of shipping inert. A key that is present —
+  // even falsy, like an explicit `0` — is an intentional user choice and always
+  // wins; only genuinely-missing keys inherit the default.
+  if (parsed && typeof parsed === 'object') {
+    const defaults = createDefaultConfig();
+    for (const key of Object.keys(defaults)) {
+      if (!(key in parsed)) parsed[key] = defaults[key];
+    }
+  }
+  return parsed;
 }
 
 export async function loadOrCreateConfig() {

package/src/index.js

@@ -530,8 +530,13 @@ async function serverWorkerCommand() {
   // Persist quota every minute; unref so it never keeps the process alive.
   let quotaSaveInterval = null;
 
-  // Opt-in background quota probe (config.quotaProbeSeconds, default 0 = off).
-  const prober = new Prober(accountManager, { intervalMs: (config.quotaProbeSeconds || 0) * 1000 });
+  // Background quota probe (config.quotaProbeSeconds, default 60s). Keeps every
+  // account's real 5h/7d utilization fresh so the scorer is never blind to an idle
+  // or out-of-band-used account. MAXPOOL_DISABLE_QUOTA_PROBE=1 forces it off — used
+  // by spawned integration tests so a startup probe can't race their refresh/rotation
+  // assertions (mirrors MAXPOOL_DISABLE_SLEEP_GUARD).
+  const probeSeconds = process.env.MAXPOOL_DISABLE_QUOTA_PROBE === '1' ? 0 : (config.quotaProbeSeconds || 0);
+  const prober = new Prober(accountManager, { intervalMs: probeSeconds * 1000 });
 
   // Persist refreshed tokens back to config. Defense-in-depth: the updater reads
   // the on-disk refresh token and SKIPS the rotation if a fresher writer already

package/src/prober.js

@@ -1,10 +1,11 @@
-// Opt-in background quota probe.
+// Background quota probe.
 //
-// DISABLED BY DEFAULT. When enabled (config.quotaProbeSeconds > 0), periodically
+// ON BY DEFAULT (config.quotaProbeSeconds, default 60s; 0 = off). Periodically
 // reads each OAuth account's quota from the zero-spend /api/oauth/usage endpoint
-// so idle accounts' utilization/reset stay fresh without waiting to be rotated
-// to — and without consuming any message quota. This is the one sanctioned
-// active-upstream feature; the proxy is otherwise passive.
+// so idle / out-of-band-used accounts' utilization/reset stay fresh without waiting
+// to be rotated to — and without consuming any message quota. Without it the scorer
+// is blind to an account it isn't actively routing to and will pile traffic onto it.
+// This is the one sanctioned active-upstream feature; the proxy is otherwise passive.
 
 import { fetchUsage } from './oauth.js';