maxpool 1.5.61 → 1.5.63

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.61",
+  "version": "1.5.63",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -176,6 +176,10 @@ const LOAD_EVENT_MAX_AGE_MS = 60 * 60 * 1000;
 // fall back to per-account handling. Bounds any future "poisoned probe" from becoming
 // an indefinite fleet-wide outage (2026-07-25 incident).
 const MAX_FAILED_PROBES = 4;
+// Consecutive quota-probe failures before we say so. High enough that a network blip or a
+// single 429 never trips it; low enough that a permanently dead endpoint surfaces the same
+// day rather than never.
+const PROBE_FAILURE_ALERT_AT = 20;
 const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
 const FIVE_HOUR_MS = 5 * 60 * 60 * 1000;
 
@@ -2150,7 +2154,18 @@ export class AccountManager {
     if (q.unified7d == null) return 'unknown';
 
     const used = clamp01(q.unified7d);
-    if (used >= this.scheduler.weeklyExhaustedThreshold) return 'exhausted';
+    // NEVER bench on utilization alone while the upstream explicitly says the account is
+    // ALLOWED. Anthropic reports both a percentage and a verdict; the verdict is the
+    // authority, and it keeps saying "allowed"/"allowed_warning" at 100% used. This mirrors
+    // _isAccountWideRejected above, which already treats an explicit 'rejected' as decisive
+    // for the negative case — the positive case was simply missing.
+    // Measured 2026-08-06: max@gomokka.com sat benched at unified7d=1.00 with
+    // unifiedStatus='allowed_warning' and returned 200 to a live request. Capacity the user
+    // was waiting on, withheld because a threshold outranked the upstream's own answer.
+    // 'exhausted' is the only state that removes an account from routing, so the override
+    // is scoped to it — critical/reserve still apply their soft costs unchanged.
+    const upstreamAllows = typeof q.unifiedStatus === 'string' && q.unifiedStatus.startsWith('allowed');
+    if (used >= this.scheduler.weeklyExhaustedThreshold && !upstreamAllows) return 'exhausted';
     if (used >= this.scheduler.weeklyCriticalThreshold) return 'critical';
     if (used >= this.scheduler.weeklyReserveThreshold) return 'reserve';
     if (used >= this.scheduler.weeklySoftThreshold) return 'soft';
@@ -2183,6 +2198,8 @@ export class AccountManager {
    * Same effect as learning quota from a live response, but for idle accounts.
    */
   applyUsageData(accountIndex, usage) {
+    // A successful probe ends any escalation streak.
+    if (this.accounts[accountIndex]?.quota) this.accounts[accountIndex].quota.consecutiveProbeFailures = 0;
     const account = this.accounts[accountIndex];
     if (!account || !usage) return;
     const q = account.quota;
@@ -2257,6 +2274,24 @@ export class AccountManager {
     q.lastProbeError = message ? String(message).slice(0, 160) : 'probe failed';
     q.lastProbeErrorAt = Date.now();
     q.lastProbeErrorStatus = Number.isFinite(status) ? status : null;
+    // ESCALATE A SYSTEMIC PROBE FAILURE. These fields were written and never read by
+    // anything, so a probe failing on every call would do so in total silence.
+    // (Correction: an earlier version of this comment claimed the Anthropic quota probe was
+    // dead because /v1/usages and /v1/usage 404. Those are the KIMI PROVIDER endpoints
+    // (src/oauth.js fetchProviderUsage). Anthropic's OAuth quota endpoint is
+    // /api/oauth/usage and it is healthy — every account carries a recent lastProbeOkAt and
+    // zero consecutive failures, and this escalation has never fired. The guard is still
+    // worth having; the diagnosis that motivated it was wrong.)
+    q.consecutiveProbeFailures = (q.consecutiveProbeFailures || 0) + 1;
+    const n = q.consecutiveProbeFailures;
+    // Once, at a threshold that cannot be a blip, then every 100th so it stays visible
+    // without walling the log.
+    if (n === PROBE_FAILURE_ALERT_AT || (n > PROBE_FAILURE_ALERT_AT && n % 100 === 0)) {
+      console.error(`[Maxpool] Quota probe has failed ${n}x in a row for "${account.name}"`
+        + `${status ? ` (HTTP ${status})` : ''}: ${q.lastProbeError}. `
+        + 'Weekly quota can only be learned from upstream 429 headers until this recovers, '
+        + 'so an account that has not hit a 429 will show a blank weekly.');
+    }
   }
 
   /**