maxpool 1.5.6 → 1.5.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.6",
+  "version": "1.5.8",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -1432,11 +1432,15 @@ export class AccountManager {
 
     const ramp = this._recoveryRamp(account, now);
     const failurePenalty = account.consecutiveFailures * 5;
-    // Bias toward an account whose weekly quota is still unknown so it gets
-    // probed and learned (matches the legacy unknown-quota exploration nudge).
-    const explorationBonus = account.quota.unified7dReset == null ? -0.5 : 0;
-
-    return concurrency + capPenalty + paceCost + spread + ramp + failurePenalty + explorationBonus;
+    // NO unknown-quota bonus. An account whose quota we cannot see must never be
+    // MORE attractive than a known-healthy one — the old -0.5 nudge (safe only
+    // while the prober quickly resolved "unknown") turned into a relentless pull
+    // toward blind accounts once probing was off, driving an out-of-band-burned
+    // account to exhaustion. Unknown now scores neutral; the prober (on by
+    // default) learns the real number within a cycle. `probing`/requalify still
+    // flags a never-seen account for learning — that path is unchanged.
+
+    return concurrency + capPenalty + paceCost + spread + ramp + failurePenalty;
   }
 
   /**

package/src/config.js

@@ -62,7 +62,11 @@ export function createDefaultConfig() {
     // Raise toward 0.97 to squeeze more out of accounts before rotating
     // (less margin, slightly higher 429 risk); lower to rotate more eagerly.
     switchThreshold: 0.90,
-    quotaProbeSeconds: 0, // background quota probe; 0 = off (opt-in)
+    // Background quota probe: poll every account's real 5h/7d utilization from the
+    // zero-spend usage endpoint every N seconds. ON by default — without it maxpool
+    // is blind to idle / out-of-band-used accounts and the scorer will pile traffic
+    // onto exactly the account it cannot see. 0 = off.
+    quotaProbeSeconds: 60,
     routing: {
       mode: 'automatic',
       preferredAccount: null,
@@ -135,8 +139,9 @@ export async function loadConfig() {
     if (err.code === 'ENOENT') return null;
     throw err;
   }
+  let parsed;
   try {
-    return JSON.parse(raw);
+    parsed = JSON.parse(raw);
   } catch (err) {
     // With atomic temp+rename writes a torn read is impossible, so a parse
     // failure means genuine corruption. Surface it clearly rather than as a
@@ -144,6 +149,18 @@ export async function loadConfig() {
     // the file with defaults and lose recoverable OAuth credentials.
     throw new Error(`config at ${path} is not valid JSON (corrupt?): ${err.message}`);
   }
+  // Backfill top-level keys ABSENT from an older on-disk config with the current
+  // defaults, so a changed default (e.g. quotaProbeSeconds flipping on) actually
+  // reaches existing installs instead of shipping inert. A key that is present —
+  // even falsy, like an explicit `0` — is an intentional user choice and always
+  // wins; only genuinely-missing keys inherit the default.
+  if (parsed && typeof parsed === 'object') {
+    const defaults = createDefaultConfig();
+    for (const key of Object.keys(defaults)) {
+      if (!(key in parsed)) parsed[key] = defaults[key];
+    }
+  }
+  return parsed;
 }
 
 export async function loadOrCreateConfig() {

package/src/index.js

@@ -530,8 +530,13 @@ async function serverWorkerCommand() {
   // Persist quota every minute; unref so it never keeps the process alive.
   let quotaSaveInterval = null;
 
-  // Opt-in background quota probe (config.quotaProbeSeconds, default 0 = off).
-  const prober = new Prober(accountManager, { intervalMs: (config.quotaProbeSeconds || 0) * 1000 });
+  // Background quota probe (config.quotaProbeSeconds, default 60s). Keeps every
+  // account's real 5h/7d utilization fresh so the scorer is never blind to an idle
+  // or out-of-band-used account. MAXPOOL_DISABLE_QUOTA_PROBE=1 forces it off — used
+  // by spawned integration tests so a startup probe can't race their refresh/rotation
+  // assertions (mirrors MAXPOOL_DISABLE_SLEEP_GUARD).
+  const probeSeconds = process.env.MAXPOOL_DISABLE_QUOTA_PROBE === '1' ? 0 : (config.quotaProbeSeconds || 0);
+  const prober = new Prober(accountManager, { intervalMs: probeSeconds * 1000 });
 
   // Persist refreshed tokens back to config. Defense-in-depth: the updater reads
   // the on-disk refresh token and SKIPS the rotation if a fresher writer already

package/src/prober.js

@@ -1,10 +1,11 @@
-// Opt-in background quota probe.
+// Background quota probe.
 //
-// DISABLED BY DEFAULT. When enabled (config.quotaProbeSeconds > 0), periodically
+// ON BY DEFAULT (config.quotaProbeSeconds, default 60s; 0 = off). Periodically
 // reads each OAuth account's quota from the zero-spend /api/oauth/usage endpoint
-// so idle accounts' utilization/reset stay fresh without waiting to be rotated
-// to — and without consuming any message quota. This is the one sanctioned
-// active-upstream feature; the proxy is otherwise passive.
+// so idle / out-of-band-used accounts' utilization/reset stay fresh without waiting
+// to be rotated to — and without consuming any message quota. Without it the scorer
+// is blind to an account it isn't actively routing to and will pile traffic onto it.
+// This is the one sanctioned active-upstream feature; the proxy is otherwise passive.
 
 import { fetchUsage } from './oauth.js';
 

package/src/restart-controller.js

@@ -1,14 +1,30 @@
 const NON_UPSTREAM_ROUTES = new Set(['(queued)', '(none available)']);
 
 export class RestartController {
-  constructor({ pauseAdmission, restartNow, log = console.log }) {
+  constructor({
+    pauseAdmission,
+    restartNow,
+    log = console.log,
+    // Bounded drain: wait at most this long for in-flight upstream requests to
+    // finish, then force the restart anyway. Without a bound, a single long
+    // streaming/thinking request (minutes) — or a held stream on the 7-day
+    // heartbeat — pins the restart on "Restart pending…" forever (the stuck-`r`
+    // bug). Dropped requests reconnect after restart, as the message promises.
+    drainTimeoutMs = 10_000,
+    setTimeoutFn = setTimeout,
+    clearTimeoutFn = clearTimeout,
+  }) {
     this.pauseAdmission = pauseAdmission;
     this.restartNow = restartNow;
     this.log = log;
+    this.drainTimeoutMs = drainTimeoutMs;
+    this.setTimeoutFn = setTimeoutFn;
+    this.clearTimeoutFn = clearTimeoutFn;
     this.activeRequests = new Set();
     this.upstreamRequests = new Set();
     this.pending = false;
     this.restarting = false;
+    this._drainTimer = null;
   }
 
   requestStarted(id) {
@@ -41,7 +57,14 @@ export class RestartController {
 
     this.pending = true;
     const queuedOrIdle = Math.max(0, this.activeRequests.size - this.upstreamRequests.size);
-    this.log(`[Maxpool] Restart pending; admission paused while ${this.upstreamRequests.size} upstream request(s) finish. ${queuedOrIdle} queued/idle request(s) will reconnect after restart.`);
+    this.log(`[Maxpool] Restart pending; admission paused while ${this.upstreamRequests.size} upstream request(s) finish (up to ${Math.round(this.drainTimeoutMs / 1000)}s). ${queuedOrIdle} queued/idle request(s) will reconnect after restart.`);
+    // Force the restart if the drain overruns — never hang on a long stream.
+    this._drainTimer = this.setTimeoutFn(() => {
+      if (!this.pending || this.restarting) return;
+      this.log(`[Maxpool] Restart drain timed out; forcing restart with ${this.upstreamRequests.size} upstream request(s) still in flight (they will reconnect).`);
+      this._restart();
+    }, this.drainTimeoutMs);
+    this._drainTimer?.unref?.();
   }
 
   _maybeRestart() {
@@ -53,6 +76,10 @@ export class RestartController {
     if (this.restarting) return;
     this.restarting = true;
     this.pending = false;
+    if (this._drainTimer) {
+      this.clearTimeoutFn(this._drainTimer);
+      this._drainTimer = null;
+    }
     this.restartNow();
   }
 }