maxpool 1.5.63 → 1.5.65

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.63",
+  "version": "1.5.65",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -50,6 +50,10 @@ function emptyQuota() {
     // { fable:{utilization,resetAt,severity,isActive}, opus:{...}, sonnet:{...} }.
     scopedWeekly: {},
     unifiedStatus: null,   // allowed | allowed_warning | rejected
+    // TRUE when a SUCCESSFUL probe reported no weekly cap for this account — i.e.
+    // "this plan has no weekly limit", NOT "we couldn't read one". Without it both
+    // states render as an empty bar and a healthy account reads as broken.
+    weeklyAbsent: false,
     resetsAt: null,
     // Provider (z.ai / Kimi) quota — kept SEPARATE from unified* so a provider
     // reading never leaks into the OAuth quota gates (_isAvailable / _weeklyRawState
@@ -1396,6 +1400,41 @@ export class AccountManager {
     return { cause: 'unavailable', retryAt: null, queueable: false };
   }
 
+  /**
+   * Why is every Claude account unavailable RIGHT NOW? Counts the per-account causes
+   * the retry oracle already computes, so the 429 can name the real one.
+   *
+   * "All N accounts are at their limit" was wrong whenever the true cause was a short
+   * NETWORK cooldown (5s each, applied on a connection drop): the user reads a quota
+   * problem, waits, and considers adding accounts — when the fleet is actually fine and
+   * recovers in seconds. Returns { total, quota, transient, network, dominant }.
+   */
+  unavailabilityCensus(model = null) {
+    const QUOTA = new Set(['exhausted', 'weekly_exhausted', 'session_limit', 'token_limit', 'request_limit', 'rate_limited']);
+    const TRANSIENT = new Set(['cooldown', 'upstream_failure', 'concurrency_cap', 'weekly_critical']);
+    const c = { total: 0, quota: 0, transient: 0, network: 0, disabled: 0, error: 0, other: 0 };
+    for (const a of this.accounts) {
+      if (a.type === 'provider') continue;
+      c.total++;
+      const cause = this._retryInfo(a, model)?.cause || 'unavailable';
+      if (cause === 'disabled') c.disabled++;
+      else if (cause === 'error') c.error++;
+      else if (QUOTA.has(cause)) c.quota++;
+      else if (TRANSIENT.has(cause)) {
+        c.transient++;
+        // A cooldown whose window matches the NETWORK cooldown is a connectivity blip,
+        // not congestion — the distinction the user's report was about.
+        if (cause === 'cooldown' && a.cooldownUntil
+          && (a.cooldownUntil - Date.now()) <= this.scheduler.networkCooldownMs) c.network++;
+      } else c.other++;
+    }
+    const eligible = c.total - c.disabled - c.error;
+    c.dominant = eligible <= 0 ? 'none'
+      : c.quota >= Math.max(1, Math.ceil(eligible / 2)) ? 'quota'
+        : c.transient > 0 ? 'transient' : 'other';
+    return c;
+  }
+
   // The soonest active short-term (non-weekly) blocker for an account, or null if
   // none is active. Ordered most-specific-first; each entry is a {cause, retryAt,
   // queueable} the retry oracle can hold on. Kept separate from the weekly state
@@ -2212,6 +2251,11 @@ export class AccountManager {
       if (usage.sevenDay.utilization != null) q.unified7d = clamp01(usage.sevenDay.utilization);
       if (usage.sevenDay.resetAt != null) q.unified7dReset = usage.sevenDay.resetAt;
     }
+    // Only a SUCCESSFUL probe carrying the flag speaks to this. A header-driven update
+    // can't see the limits[] array, and a FAILED read knows nothing about the account's
+    // caps — either one claiming "uncapped" would mislabel a capped account as having no
+    // weekly limit, which is the exact wrong direction (it reads as free capacity).
+    if (!usage.error && usage.weeklyAbsent !== undefined) q.weeklyAbsent = Boolean(usage.weeklyAbsent);
     // Per-model weekly sub-limits (Fable, Opus, ...). Replace wholesale with the
     // fresh probe set so a family that dropped out of the response doesn't linger
     // stale; expiry on reset is a backstop for the between-probe window. EXCEPTION:
@@ -2320,11 +2364,16 @@ export class AccountManager {
     if (usage.wk) {
       if (usage.wk.utilization != null) q.providerWk = clamp01(usage.wk.utilization);
       if (usage.wk.resetAt != null) q.providerWkReset = usage.wk.resetAt;
+      q.weeklyAbsent = false;
     } else {
       // Weekly window absent from this plan/response — clear so a stale weekly
-      // reading doesn't linger after a plan/window change.
+      // reading doesn't linger after a plan/window change. A SUCCESSFUL poll that
+      // carries no weekly is positive knowledge that the plan has none: measured
+      // 2026-08-06, z.ai `max` returns exactly one TOKENS_LIMIT (unit 3 = the 5h
+      // session) and no unit-6 weekly, so GLM's blank Wk is correct, not a gap.
       q.providerWk = null;
       q.providerWkReset = null;
+      q.weeklyAbsent = true;
     }
     q.lastProbeOkAt = Date.now();
   }
@@ -2773,6 +2822,8 @@ export class AccountManager {
       modelMap: acctData.modelMap || null,
       stripBetaHeaders: Boolean(acctData.stripBetaHeaders),
       runtime: Boolean(acctData.runtime),
+      configSourced: Boolean(acctData.configSourced),
+      secretName: acctData.secretName || null,
       enabled: acctData.enabled !== false,
       refreshToken: acctData.refreshToken || null,
       expiresAt: acctData.expiresAt || null,
@@ -2827,6 +2878,8 @@ export class AccountManager {
     account.modelMap = acctData.modelMap || account.modelMap;
     account.stripBetaHeaders = Boolean(acctData.stripBetaHeaders);
     account.runtime = true;
+    if (acctData.configSourced !== undefined) account.configSourced = acctData.configSourced;
+    if (acctData.secretName !== undefined) account.secretName = acctData.secretName;
     // Restore path carries an explicit enabled (persisted disable); honor it. The `cc
     // all` header path (prepareRuntimeProviders) omits enabled, so a re-sent token
     // NEVER silently re-enables a provider the user benched in the TUI.
@@ -2851,7 +2904,7 @@ export class AccountManager {
    */
   exportRuntimeProviders() {
     return this.accounts
-      .filter(a => a.runtime && a.type === 'provider' && a.credential)
+      .filter(a => a.runtime && a.type === 'provider' && a.credential && !a.configSourced)
       .map(a => ({
         name: a.name,
         type: a.type,
@@ -2877,6 +2930,10 @@ export class AccountManager {
    * live `cc all` request refreshes the token before routing (prepareRuntimeProviders
    * runs ahead of account selection), so a stale restored token never serves a
    * request. Idempotent — upsertRuntimeAccount matches by name.
+   *
+   * Config-sourced providers (resolved from GCP Secret Manager at startup) are
+   * EXCLUDED — their source of truth is config + GCP, not state.json, so persisting
+   * their token to disk would duplicate the secret and survive a GCP deletion.
    */
   restoreRuntimeProviders(list) {
     if (!Array.isArray(list)) return;
@@ -2886,6 +2943,69 @@ export class AccountManager {
     }
   }
 
+  /**
+   * Load config-sourced provider accounts — resolved from GCP Secret Manager at
+   * startup, NOT from per-request headers. Each config entry is { name, provider,
+   * secretName, upstream?, priority?, modelMap? }. The secret is resolved by the
+   * caller (index.js) and passed as `token`; if null the provider is created but
+   * marked error so the TUI shows WHY it's broken.
+   *
+   * These are marked configSourced so they're excluded from state.json persistence
+   * (their source of truth is config + GCP, not disk) and so the header path can
+   * dedup against them (same token → skip creating a duplicate runtime provider).
+   */
+  loadConfigProviders(entries) {
+    if (!Array.isArray(entries)) return;
+    // Remove existing config-sourced providers that are no longer in the config
+    // (handles a config edit that removes an entry).
+    const wantedNames = new Set(entries.map(e => e.name).filter(Boolean));
+    for (const a of this.accounts) {
+      if (a.configSourced && !wantedNames.has(a.name)) {
+        const idx = this.accounts.indexOf(a);
+        if (idx >= 0 && this.accounts[idx].inFlight === 0) this.removeAccount(idx);
+      }
+    }
+    for (const entry of entries) {
+      if (!entry || !entry.name || !entry.provider) continue;
+      this.upsertRuntimeAccount({
+        name: entry.name,
+        type: 'provider',
+        provider: entry.provider,
+        authToken: entry.token || null,
+        upstream: entry.upstream || (entry.provider === 'kimi'
+          ? 'https://api.kimi.com/coding'
+          : 'https://api.z.ai/api/anthropic'),
+        authHeader: 'authorization',
+        profiles: ['all'],
+        priority: Number.isFinite(entry.priority) ? entry.priority : 10,
+        modelMap: entry.modelMap,
+        model: entry.model,
+        stripBetaHeaders: true,
+        configSourced: true,
+      });
+      if (!entry.token) {
+        const a = this.accounts.find(a => a.name === entry.name);
+        if (a) { a.status = 'error'; a.lastError = 'secret-unresolved'; }
+      }
+    }
+  }
+
+  /**
+   * Return the config-sourced provider definitions (name + provider + secretName)
+   * for the TUI and for config serialization. Tokens are NEVER included.
+   */
+  configProviderDefs() {
+    return this.accounts
+      .filter(a => a.configSourced && a.type === 'provider')
+      .map(a => ({
+        name: a.name,
+        provider: a.provider,
+        secretName: a.secretName || null,
+        upstream: a.upstream,
+        priority: a.priority,
+      }));
+  }
+
   /**
    * Remove an account by index.
    */

package/src/config.js

@@ -154,6 +154,11 @@ export function createDefaultConfig() {
       heartbeatMs: 10_000,
     },
     accounts: [],
+    // Config-sourced provider accounts (GLM/Kimi). Each entry references a GCP
+    // Secret Manager secret by NAME — the key is resolved at startup and held in
+    // memory only. See src/secret-resolver.js.
+    //   [{ name, provider:'zai'|'kimi', secretName, upstream?, priority? }]
+    providers: [],
   };
 }
 

package/src/index.js

@@ -593,6 +593,40 @@ async function serverWorkerCommand() {
   // self-healing window as an abrupt SIGKILL. A cold restart reads the clean-shutdown
   // final flush and restores fully (the reported zero-request case).
   if (savedState?.runtimeProviders) accountManager.restoreRuntimeProviders(savedState.runtimeProviders);
+
+  // ── config-sourced providers (GCP Secret Manager) ──────────────────────────
+  // Provider keys (GLM, Kimi) defined in the config's `providers` section, each
+  // referencing a GCP Secret Manager secret by NAME — the key is resolved at
+  // startup and held in memory only, never written to config or state.json.
+  // Team members add a provider by storing the key in GCP, then pointing maxpool
+  // at the secret name via the TUI. Deleting the GCP secret disables the provider
+  // on the next restart — no key to hunt down in config files.
+  if (Array.isArray(config.providers) && config.providers.length > 0) {
+    try {
+      const { resolveSecrets } = await import('./secret-resolver.js');
+      // Split: GCP-sourced (secretName) vs direct (apiKey). Both produce a token
+      // the same way — the resolution path is the only difference.
+      const gcpEntries = config.providers.filter(p => p.secretName);
+      const directEntries = config.providers.filter(p => p.apiKey && !p.secretName);
+      const secretNames = gcpEntries.map(p => p.secretName);
+      const resolved = await resolveSecrets(secretNames);
+      const entries = config.providers.map(p => ({
+        ...p,
+        token: p.secretName ? (resolved[p.secretName] || null) : (p.apiKey || null),
+      }));
+      accountManager.loadConfigProviders(entries);
+      const ok = entries.filter(e => e.token).length;
+      const fail = entries.length - ok;
+      console.log(`[Maxpool] Config providers: ${ok} active${fail ? `, ${fail} unresolved` : ''}`);
+      for (const p of config.providers) {
+        const a = accountManager.accounts.find(a => a.name === p.name);
+        if (a && p.secretName) a.secretName = p.secretName;
+      }
+    } catch (err) {
+      console.error(`[Maxpool] Config provider resolution failed: ${err.message}`);
+    }
+  }
+
   // Track the state-file generation we last observed so a stale flush is refused.
   let stateGeneration = Number(savedState?._generation) || 0;
 

package/src/oauth.js

@@ -267,10 +267,18 @@ export async function fetchUsage(accessToken) {
       }
     }
 
+    const sevenDay = limitsWeeklyAll || normalizeUsageBucket(data?.seven_day);
     return {
       fiveHour: limitsSession || normalizeUsageBucket(data?.five_hour),
-      sevenDay: limitsWeeklyAll || normalizeUsageBucket(data?.seven_day),
+      sevenDay,
       scopedWeekly,
+      // A SUCCESSFUL read that carries no weekly bucket is positive knowledge: this
+      // account HAS no weekly cap, as opposed to "we haven't managed to read one yet".
+      // Both render as a blank bar otherwise, so a perfectly healthy account looks
+      // broken. Measured 2026-08-06: privacy@gomokka.com returns limits=[session,
+      // weekly_scoped(inactive)] and `seven_day: null`, while every other account
+      // returns a `weekly_all` — it is genuinely uncapped, not unread.
+      weeklyAbsent: sevenDay == null || sevenDay.utilization == null,
     };
   } catch (err) {
     return { error: err.message || String(err), status: null };

package/src/secret-resolver.js

@@ -0,0 +1,49 @@
+/**
+ * Resolve a GCP Secret Manager secret name to its plaintext value.
+ *
+ * Uses `gcloud secrets versions access` — the same path load-secrets.sh uses.
+ * The key is resolved ONCE at startup (or when a provider is added via the TUI)
+ * and held in maxpool's process memory, never written to disk or logs.
+ *
+ * Returns null on any failure (missing secret, no gcloud, auth error) so a
+ * broken provider degrades to "disabled" instead of crashing the proxy.
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+
+const DEFAULT_PROJECT = 'mokka-business-automations';
+
+export async function resolveSecret(secretName, { project = DEFAULT_PROJECT, timeoutMs = 10_000 } = {}) {
+  if (!secretName || typeof secretName !== 'string') return null;
+  try {
+    const { stdout } = await execFileAsync(
+      'gcloud',
+      ['secrets', 'versions', 'access', 'latest', '--secret', secretName, '--project', project],
+      { timeout: timeoutMs, maxBuffer: 1024 * 1024 },
+    );
+    const value = stdout.trim();
+    return value || null;
+  } catch {
+    // Missing secret, no gcloud, auth expired, no network — all degrade to null.
+    // The TUI shows the provider as "error: secret-unresolved" so the operator
+    // knows which secret failed, not just that "the provider is broken".
+    return null;
+  }
+}
+
+/**
+ * Resolve multiple secrets in parallel. Returns { name → value } for the ones
+ * that resolved; failed ones are simply absent (caller treats absence as
+ * "provider can't activate"). Parallel because N secrets at ~500ms each
+ * serialized would add seconds to startup.
+ */
+export async function resolveSecrets(secretNames, opts = {}) {
+  const unique = [...new Set(secretNames.filter(Boolean))];
+  if (!unique.length) return {};
+  const entries = await Promise.all(
+    unique.map(async name => [name, await resolveSecret(name, opts)]),
+  );
+  return Object.fromEntries(entries.filter(([, v]) => v != null));
+}

package/src/server.js

@@ -403,6 +403,13 @@ async function forwardRequest(
 ) {
   const configuredAttempts = Number(retryConfig.maxAttemptsPerRequest) || accountManager.accounts.length;
   const maxAttempts = Math.max(1, configuredAttempts);
+  // A body REPAIR (strip a block, convert a tool pair, downgrade effort) is not an
+  // account failover — it re-sends a FIXED body and consumes no account. Charging both
+  // to one budget sized by ACCOUNT COUNT meant a 1-account fleet could never repair
+  // anything and a 2-account fleet got exactly one repair, while the chain is now six
+  // deep. Each repair latches its own flag, so this budget is a backstop, not the bound.
+  const repairCount = requestInfo.repairCount || 0;
+  const canRepairBody = repairCount < 6 && !res.headersSent;
 
   // PRE-STRIP a session already known to carry provider-authored thinking. The client
   // resends the whole poisoned history every turn, so without this each turn pays another
@@ -1076,7 +1083,8 @@ async function forwardRequest(
       // text + tool_use preserved. Tried once per request (thinkingStripped guard); if it
       // still fails, the provider pin below is the fallback.
       if (isSignatureRejection && !requestInfo.thinkingStripped
-        && canRetryBufferedBody && retryCount + 1 < maxAttempts && !res.headersSent) {
+        && canRetryBufferedBody && canRepairBody) {
+        console.log(`[Maxpool] Anthropic rejected a block: ${describeRejectedBlock(body, errorBody)}`);
         const { body: cleanBody, removed, converted } = stripForeignThinkingBlocks(body);
         if (cleanBody) {
           // Latch it so EVERY later turn is stripped up front instead of re-paying this
@@ -1085,7 +1093,35 @@ async function forwardRequest(
           console.log(`[Maxpool] Recovering session on Claude: stripped ${removed} provider thinking block(s), converted ${converted} provider search block(s) to text`);
           return forwardRequest(
             req, res, cleanBody, accountManager, upstream, retryCount + 1, hooks, reqId, ctx, logDir,
-            retryConfig, queueConfig, { ...requestInfo, thinkingStripped: true },
+            retryConfig, queueConfig, { ...requestInfo, thinkingStripped: true, repairCount: repairCount + 1 },
+            canRetryBufferedBody, canQueueBufferedBody, excludedIndexes,
+          );
+        }
+      }
+
+      // COORDINATE REPAIR (runs after the broad strip found nothing, or found the wrong
+      // thing). Anthropic pointed at an exact block index; trust that over our own shape
+      // model. Its own flag, so it still fires on a request whose broad strip already ran.
+      if (isSignatureRejection && !requestInfo.rejectedBlockStripped && canRetryBufferedBody && canRepairBody) {
+        const { body: fixedBody, removed, type } = stripRejectedBlockClass(body, errorBody);
+        if (fixedBody) {
+          // Latch the session ONLY for the class the pre-strip can actually repair up
+          // front. `stripForeignThinkingBlocks` never touches `redacted_thinking`, so
+          // latching on it would make every later turn pay a rejected round-trip that
+          // the pre-strip cannot prevent — and would mislabel the give-up message as a
+          // GLM/Kimi story. Same reason `thinkingStripped` is set only for `thinking`:
+          // setting it here would bar the broad strip on the retry.
+          const preStripCanRepeat = type === 'thinking';
+          if (preStripCanRepeat) accountManager.markSessionThinkingContaminated?.(requestInfo.sessionKey);
+          console.log(`[Maxpool] Recovering session on Claude: Anthropic rejected a "${type}" block by index; removed ${removed} block(s) of that type`);
+          return forwardRequest(
+            req, res, fixedBody, accountManager, upstream, retryCount + 1, hooks, reqId, ctx, logDir,
+            retryConfig, queueConfig, {
+              ...requestInfo,
+              rejectedBlockStripped: true,
+              thinkingStripped: preStripCanRepeat || requestInfo.thinkingStripped,
+              repairCount: repairCount + 1,
+            },
             canRetryBufferedBody, canQueueBufferedBody, excludedIndexes,
           );
         }
@@ -1147,9 +1183,24 @@ async function forwardRequest(
         // Say only what ACTUALLY happened. `thinkingStripped` is set only when the strip
         // ran; without it we found nothing provider-shaped, so claiming we stripped —
         // or blaming GLM/Kimi — would misdirect the user.
-        const what = requestInfo.thinkingStripped
-          ? 'This session ran on GLM/Kimi earlier, and Anthropic will not accept parts of what they wrote. Maxpool repaired what it could and retried on Claude, but Anthropic still rejected the history.'
-          : "Anthropic rejected part of this session's history that maxpool could not repair automatically.";
+        // Log the shape on the way out: this is the ONE place a give-up is observable,
+        // and without it the two surviving explanations (a block the strip cannot see
+        // vs. a body over the retry buffer) are indistinguishable in the log.
+        console.log(`[Maxpool] Unrepaired signature 400: ${describeRejectedBlock(body, errorBody)} bufferable=${canRetryBufferedBody} stripped=${!!requestInfo.thinkingStripped}`);
+        // A body over the retry buffer bars EVERY repair above without a word — the user
+        // then sees "could not repair" for a transcript maxpool never even tried to fix.
+        // Name that separately so the reason is actionable rather than mysterious.
+        // `peek` (not the full class-strip) because on THIS path the body may be the very
+        // one just declared too large to rewrite — a full parse+rebuild there costs 15ms
+        // and a discarded 4.8MB Buffer on a 9.6MB body, to read one string.
+        const rejectedType = canRetryBufferedBody ? peekRejectedBlockType(body, errorBody) : null;
+        const what = !canRetryBufferedBody
+          ? `This session's history is too large for maxpool to rewrite automatically (over ${Math.round(retryConfig.maxRetryBufferBytes / (1024 * 1024))}MB). Run /compact and it will keep going.`
+          : rejectedType && rejectedType !== 'thinking' && rejectedType !== 'redacted_thinking'
+            ? `Anthropic rejected a "${rejectedType}" block in this session's history, which maxpool cannot remove without losing conversation content.`
+            : requestInfo.thinkingStripped || requestInfo.rejectedBlockStripped
+              ? 'This session ran on GLM/Kimi earlier, and Anthropic will not accept parts of what they wrote. Maxpool repaired what it could and retried on Claude, but Anthropic still rejected the history.'
+              : "Anthropic rejected part of this session's history that maxpool could not repair automatically.";
         const hint = provs.length === 0
           ? ''
           : provs.every(a => a.enabled === false)
@@ -1160,7 +1211,12 @@ async function forwardRequest(
           type: 'error',
           error: {
             type: 'invalid_request_error',
-            message: `Start a new session to keep working — this one cannot continue. ${what}${hint}`,
+            // The lead depends on whether the session is actually RECOVERABLE. Telling a
+            // user "this one cannot continue" and then "run /compact and it will keep
+            // going" is two mutually exclusive remedies in one sentence.
+            message: canRetryBufferedBody
+              ? `Start a new session to keep working — this one cannot continue. ${what}${hint}`
+              : `${what}${hint}`,
           },
         });
         return;
@@ -1506,6 +1562,20 @@ function unavailableMessage(accountManager, requestInfo = {}, retryAfter, willRe
   // MINUTES (not momentary), and raw seconds are unreadable. Scale the wording to the
   // actual wait and render it in human units, the way every other branch already does.
   const waitLong = Number.isFinite(retryAfter) && retryAfter >= 120;
+
+  // "at their limit" is a QUOTA claim. When the accounts are actually in short network
+  // cooldowns (a connectivity blip drops every in-flight connection and cools each
+  // account for ~5s), that claim sends the user to check quota and add accounts while
+  // the fleet is healthy and recovers in seconds. Name the real cause.
+  const census = accountManager.unavailabilityCensus?.(requestInfo.model);
+  if (census && census.dominant === 'transient') {
+    const netly = census.network > 0;
+    const what = netly
+      ? `${census.network} of ${census.total} Claude accounts are in a brief reconnect cooldown`
+      : `all ${census.total} Claude accounts are momentarily busy`;
+    return `No account can take this request right now — ${what}, not out of quota. Retry in ~${formatRetryDuration(retryAfter)}; it clears on its own.${providersBarredHint}`;
+  }
+
   return `No account can take this request right now — all ${claudeCount} Claude accounts${providersClause} are ${waitLong ? 'at their limit' : 'momentarily at their limit'}. Retry in ~${formatRetryDuration(retryAfter)}.${providersBarredHint}`;
 }
 
@@ -1520,7 +1590,7 @@ function isContextLengthError(errorBody) {
   return /exceeded model token limit|maximum context length|context length exceeded|context window (?:size )?(?:exceeded|too)|prompt is too long|input is too long|reduce the length of|too many (?:input )?tokens|request too large/i.test(errorBody);
 }
 
-export const __serverTest = { unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, classifyEffortRejection, repairEffort, isCapacitySignalStatus, isStrippableThinkingBlock, stripForeignThinkingBlocks, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, commitStreamGraceHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody, isContextLengthError, streamResponse, startIdleRequestReaper };
+export const __serverTest = { unavailableMessage, computeQueueWindowMs, isRetriableUpstreamStatus, classifyEffortRejection, repairEffort, isCapacitySignalStatus, isStrippableThinkingBlock, stripForeignThinkingBlocks, parseRejectedBlockPath, stripRejectedBlockClass, peekRejectedBlockType, describeRejectedBlock, headerValue, getMaxpoolProfile, ensureQueueHeartbeat, clearQueueHeartbeat, commitStreamGraceHeartbeat, describeRequest, classifyRateLimit, detectTranscriptOrigin, isAnthropicIncompatBody, isContextLengthError, streamResponse, startIdleRequestReaper };
 
 async function readErrorBody(upstreamRes, limitBytes = 64 * 1024) {
   if (!upstreamRes.body) return '';
@@ -1708,6 +1778,119 @@ function isStrippableThinkingBlock(block) {
   return block?.type === 'thinking';
 }
 
+/**
+ * Anthropic's signature 400 names the EXACT block it rejected:
+ *   "messages.29.content.58: Invalid `signature` in `thinking` block"
+ * That coordinate is GROUND TRUTH. Every other repair here depends on maxpool's own
+ * model of what a provider-authored block looks like, and that model is what silently
+ * failed — the role gate above meant `stripForeignThinkingBlocks` returned "nothing to
+ * remove" for a block Anthropic had just pointed at by index.
+ *
+ * Returns { mi, ci } or null.
+ */
+function parseRejectedBlockPath(errorBody) {
+  const s = String(errorBody || '');
+  const m = /messages\.(\d+)\.content\.(\d+)/.exec(s);
+  if (!m) return null;
+  // A NESTED path — `messages.29.content.58.content.3` — points INSIDE the block at
+  // [58], not at it. Taking the outer coordinate would name the wrong block: the user
+  // would be told a "tool_result" was rejected when a thinking block nested in it is
+  // the real culprit, and a class-strip keyed on that type would be wrong too.
+  if (/^\.content\./.test(s.slice(m.index + m[0].length))) return null;
+  return { mi: Number(m[1]), ci: Number(m[2]) };
+}
+
+/**
+ * The rejected block's TYPE only — no parse-and-rebuild. Used on the give-up path,
+ * where the body may be the very one we just declared too large to rewrite (measured:
+ * a full stripRejectedBlockClass on a 9.6MB body costs 15ms and allocates a 4.8MB
+ * Buffer that is discarded, because only `.type` is ever read).
+ */
+function peekRejectedBlockType(body, errorBody) {
+  const path = parseRejectedBlockPath(errorBody);
+  if (!path) return null;
+  try {
+    const json = JSON.parse(Buffer.isBuffer(body) ? body.toString('utf8') : String(body));
+    return json?.messages?.[path.mi]?.content?.[path.ci]?.type || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * One line naming exactly what Anthropic rejected: coordinate, role, block type, and
+ * whether the body was even parseable. Without it, the two remaining explanations for a
+ * silent give-up (a block shape the strip cannot see vs. a body over the retry buffer)
+ * are indistinguishable in the log — and once the repair starts working, the successful
+ * path logs the same line as the already-working one, so the question becomes
+ * unanswerable. Types and roles only; no transcript content.
+ */
+function describeRejectedBlock(body, errorBody) {
+  const path = parseRejectedBlockPath(errorBody);
+  if (!path) return 'coordinate=unparsed';
+  try {
+    const json = JSON.parse(Buffer.isBuffer(body) ? body.toString('utf8') : String(body));
+    const msg = json?.messages?.[path.mi];
+    const block = msg?.content?.[path.ci];
+    return `coordinate=messages.${path.mi}.content.${path.ci} role=${msg?.role ?? 'MISSING'} type=${block?.type ?? 'MISSING'} blocks=${Array.isArray(msg?.content) ? msg.content.length : 'n/a'}`;
+  } catch {
+    return `coordinate=messages.${path.mi}.content.${path.ci} body=UNPARSEABLE`;
+  }
+}
+
+/**
+ * Last-resort repair driven by the upstream's own coordinate, for a rejected block no
+ * shape heuristic here recognised. Removes every block sharing the rejected block's
+ * TYPE, on any role — fixing the whole class in ONE round-trip rather than replaying
+ * once per bad block (a 47-block transcript would otherwise cost 47 rejected requests).
+ *
+ * Restricted to the thinking family on purpose: `text` / `tool_use` / `tool_result`
+ * carry conversation content and tool pairing, so removing them would corrupt the
+ * transcript rather than repair it. A rejected block outside that family returns null
+ * and the 400 surfaces with its real cause intact.
+ *
+ * Returns { body, removed, type } — `body` is null when nothing was safe to remove.
+ */
+function stripRejectedBlockClass(body, errorBody) {
+  const path = parseRejectedBlockPath(errorBody);
+  if (!path) return { body: null, removed: 0, type: null };
+  try {
+    const json = JSON.parse(Buffer.isBuffer(body) ? body.toString('utf8') : String(body));
+    if (!Array.isArray(json?.messages)) return { body: null, removed: 0, type: null };
+    const target = json.messages[path.mi]?.content?.[path.ci];
+    const type = target?.type;
+    // Only the thinking family is safe to drop wholesale (verified 2026-07-25: a
+    // history with thinking blocks removed replays 200 OK, text + tool_use preserved).
+    if (type !== 'thinking' && type !== 'redacted_thinking') {
+      return { body: null, removed: 0, type: type || null };
+    }
+    let removed = 0;
+    const messages = [];
+    for (const msg of json.messages) {
+      if (!Array.isArray(msg?.content)) { messages.push(msg); continue; }
+      const kept = msg.content.filter(b => {
+        if (b?.type !== type) return true;
+        removed++;
+        return false;
+      });
+      if (kept.length === msg.content.length) { messages.push(msg); continue; }
+      // A turn stripping empties is DROPPED — an empty content array is itself invalid,
+      // and keeping the original would resend the exact body that just 400'd. Except
+      // messages[0], which must survive as a `user` turn (see the same guard above).
+      if (kept.length === 0) {
+        if (messages.length === 0) { messages.push({ ...msg, content: [{ type: 'text', text: '(content removed)' }] }); }
+        continue;
+      }
+      messages.push({ ...msg, content: kept });
+    }
+    if (!removed) return { body: null, removed: 0, type };
+    json.messages = messages;
+    return { body: Buffer.from(JSON.stringify(json)), removed, type };
+  } catch {
+    return { body: null, removed: 0, type: null };
+  }
+}
+
 /**
  * Recovery for a provider-contaminated transcript: drop the assistant `thinking` /
  * `redacted_thinking` blocks whose signature Anthropic can't validate, so the session
@@ -1847,10 +2030,12 @@ function stripForeignThinkingBlocks(body) {
       // assistant turn but its result can be carried on the following user turn.
       const tools = convertForeignServerTools(msg.content, foreignToolIds);
       converted += tools.converted;
-      if (msg.role !== 'assistant') {
-        messages.push(tools.converted ? { ...msg, content: tools.content } : msg);
-        continue;
-      }
+      // Thinking blocks are stripped on EVERY role, not just `assistant`. Anthropic
+      // validates the signature wherever the block sits, so a role gate here made the
+      // repair silently find NOTHING to remove — which left `thinkingStripped` false,
+      // barred the session latch, and surfaced the 400 to the user as "maxpool could
+      // not repair automatically" while healthy Claude accounts sat idle. Measured
+      // 2026-08-06: 315 signature 400s, the broad strip finding nothing on a subset.
       let localRemoved = 0;
       const kept = tools.content.filter(block => {
         if (!isStrippableThinkingBlock(block)) return true;
@@ -1866,7 +2051,14 @@ function stripForeignThinkingBlocks(body) {
       // leaving it would resend the exact body that just 400'd while reporting success
       // and burning the single recovery attempt. Verified against the live API — the
       // resulting consecutive user messages are accepted (200 OK).
-      if (kept.length === 0) continue;
+      // EXCEPT messages[0]: Anthropic requires the first message to be role `user`, so
+      // dropping it leaves an `assistant`-first transcript that is rejected outright.
+      // Reachable only since the role gate was removed — before that, non-assistant
+      // turns were never dropped at all.
+      if (kept.length === 0) {
+        if (messages.length === 0) { messages.push({ ...msg, content: [{ type: 'text', text: '(content removed)' }] }); }
+        continue;
+      }
       messages.push({ ...msg, content: kept });
     }
     if (!removed && !converted) return { body: null, removed: 0, converted: 0 };
@@ -2381,8 +2573,18 @@ function getMaxpoolProfile(headers) {
 function prepareRuntimeProviders(accountManager, headers) {
   if (getMaxpoolProfile(headers) !== 'all') return;
 
+  // Config-sourced providers already exist (resolved from GCP at startup). A `cc all`
+  // session sends the SAME token as a header → dedup by token so we don't create a
+  // duplicate provider for every request. The config provider wins (it persists, has
+  // the right name, and carries quota state from earlier requests).
+  const configTokens = new Set(
+    (accountManager.accounts || [])
+      .filter(a => a.configSourced && a.credential)
+      .map(a => a.credential),
+  );
+
   const zaiToken = headerValue(headers, 'x-maxpool-zai-token');
-  if (zaiToken) {
+  if (zaiToken && !configTokens.has(zaiToken)) {
     const opus = headerValue(headers, 'x-maxpool-zai-opus-model') || headerValue(headers, 'x-maxpool-zai-model') || 'glm-5.2';
     const sonnet = headerValue(headers, 'x-maxpool-zai-sonnet-model') || headerValue(headers, 'x-maxpool-zai-model') || opus;
     const haiku = headerValue(headers, 'x-maxpool-zai-haiku-model') || 'glm-5.1';
@@ -2401,7 +2603,7 @@ function prepareRuntimeProviders(accountManager, headers) {
   }
 
   const kimiToken = headerValue(headers, 'x-maxpool-kimi-token');
-  if (kimiToken) {
+  if (kimiToken && !configTokens.has(kimiToken)) {
     // Fallback only — `cc all` always sends x-maxpool-kimi-model from the llm_config SSOT,
     // so this is what a bare/older client gets. Kept current deliberately: it read
     // 'kimi-k2.7' while the fleet had moved to k3.

package/src/tui.js

@@ -405,6 +405,7 @@ export class TUI {
       case 'accounts': this._keyAccounts(k); break;
       case 'routing': this._keyRouting(k); break;
       case 'updates': this._keyUpdates(k); break;
+      case 'providers': this._keyProviders(k); break;
       case 'select': this._keySelect(k); break;
       case 'input':  this._keyInput(k); break;
       case 'confirm': this._keyConfirm(k); break;
@@ -442,6 +443,8 @@ export class TUI {
       );
     } else if (k === 'u') {
       this.mode = 'updates';
+    } else if (k === 'p') {
+      this.mode = 'providers';
     }
     // Enable/disable lives ONLY under [a] Accounts now (with rename/delete/login) —
     // one home for every account mutation, instead of a duplicate top-level toggle.
@@ -582,6 +585,140 @@ export class TUI {
     }
   }
 
+  _keyProviders(k) {
+    if (k === 'a') {
+      this._providerAddStep('name');
+    } else if (k === 'd') {
+      this._startProviderSelection('delete');
+    } else if (k === 't') {
+      this._startProviderSelection('toggle');
+    } else if (k === 'esc' || k === 'q') {
+      this.mode = 'normal';
+    }
+  }
+
+  // Multi-step input for adding a provider. Steps: name → type → secret name.
+  _providerAddStep(step, prev) {
+    if (step === 'name') {
+      this.mode = 'input';
+      this.inputPrompt = 'Provider display name (e.g. glm-ahmed)';
+      this.inputBuf = '';
+      this.inputSensitive = false;
+      this.inputCb = value => {
+        const name = String(value || '').trim();
+        if (!name) { this.mode = 'providers'; return; }
+        if (this.am.accounts.some(a => a.name === name)) {
+          this._addLog(`Account "${name}" already exists`); this.mode = 'providers'; return;
+        }
+        this._providerAddStep('type', { name });
+      };
+    } else if (step === 'type') {
+      this.mode = 'input';
+      this.inputPrompt = `Type for ${prev.name} (zai or kimi)`;
+      this.inputBuf = 'zai';
+      this.inputSensitive = false;
+      this.inputCb = value => {
+        const provider = String(value || '').trim().toLowerCase();
+        if (provider !== 'zai' && provider !== 'kimi') { this._addLog('Type must be zai or kimi'); this.mode = 'providers'; return; }
+        this._providerAddStep('secret', { ...prev, provider });
+      };
+    } else if (step === 'secret') {
+      this.mode = 'input';
+      this.inputPrompt = `${prev.name}: GCP secret name OR paste API key directly`;
+      this.inputBuf = '';
+      this.inputSensitive = false;
+      this.inputCb = async value => {
+        const input = String(value || '').trim();
+        if (!input) { this.mode = 'providers'; return; }
+        // Heuristic: a GCP secret name is uppercase/dashes/underscores and short.
+        // An API key is long and contains dots/mixed-case/alphanumeric.
+        const looksLikeSecretName = /^[A-Z][A-Z0-9_-]{2,60}$/.test(input) && !input.includes('.');
+        if (looksLikeSecretName) {
+          await this._doAddProvider({ ...prev, secretName: input });
+        } else {
+          // Direct key paste — store in config (0600, same protection as OAuth tokens).
+          await this._doAddProvider({ ...prev, apiKey: input });
+        }
+      };
+    }
+  }
+
+  async _doAddProvider({ name, provider, secretName, apiKey }) {
+    this.mode = 'providers';
+    const isDirect = !secretName && apiKey;
+    if (secretName) this._addLog(`Resolving secret "${secretName}" from GCP…`);
+    else this._addLog(`Adding "${name}" with direct API key…`);
+    this.render();
+    try {
+      let token = null;
+      if (secretName) {
+        const { resolveSecret } = await import('../secret-resolver.js');
+        token = await resolveSecret(secretName);
+        if (!token) {
+          this._addLog(`✗ Secret "${secretName}" not found in GCP — create it first: gcloud secrets create ${secretName} --data-file=-`);
+          return;
+        }
+      } else {
+        token = apiKey;
+      }
+      // Add to config (persistence) and activate immediately.
+      const { atomicConfigUpdate } = await import('../config.js');
+      await atomicConfigUpdate(cfg => {
+        if (!Array.isArray(cfg.providers)) cfg.providers = [];
+        const entry = { name, provider };
+        if (secretName) entry.secretName = secretName;
+        else entry.apiKey = apiKey;
+        cfg.providers.push(entry);
+      });
+      // Activate in the running process.
+      this.am.loadConfigProviders([{ name, provider, secretName, token }]);
+      const a = this.am.accounts.find(a => a.name === name);
+      if (a && secretName) a.secretName = secretName;
+      this._addLog(`✓ Added "${name}" (${provider})${secretName ? ` — GCP secret "${secretName}"` : ' — direct key'}`);
+    } catch (err) {
+      this._addLog(`✗ Failed to add provider: ${err.message}`);
+    }
+  }
+
+  _startProviderSelection(action) {
+    const providers = this.am.accounts.filter(a => a.type === 'provider');
+    if (!providers.length) { this._addLog('No providers to manage'); return; }
+    this._selOptions = providers.map(a => a.index);
+    this._selLabels = providers.map(a => {
+      const enabled = a.enabled !== false;
+      const tag = a.configSourced ? ' (GCP)' : ' (header)';
+      const secret = a.secretName ? ` [${a.secretName}]` : '';
+      return `${a.name}${tag}${secret}${enabled ? '' : ' ✕'}`;
+    });
+    this.selAction = action;
+    this.mode = 'select';
+  }
+
+  _renderProviders(buf, width) {
+    const providers = this.am.accounts.filter(a => a.type === 'provider');
+    buf.push(`${bold('Providers (GLM / Kimi)')}  ${dim('— managed via GCP Secret Manager')}`);
+    buf.push('');
+    if (!providers.length) {
+      buf.push(dim('  No providers configured.'));
+      buf.push('');
+      buf.push(dim('  Press ') + bold('a') + dim(' to add one. You\'ll need:'));
+      buf.push(dim('    1. An API key from z.ai (GLM) or Moonshot (Kimi)'));
+      buf.push(dim('    2. The key stored in GCP: ') + 'gcloud secrets create <name> --data-file=-');
+      buf.push(dim('    3. The GCP secret name (e.g. RESTRICTED_MAXPOOL_ZAI_NEW)'));
+      return;
+    }
+    for (const a of providers) {
+      const enabled = a.enabled !== false;
+      const tag = a.configSourced ? dim(' (GCP)') : dim(' (header)');
+      const secret = a.secretName ? dim(` [${a.secretName}]`) : '';
+      const status = a.status === 'error' ? red(a.lastError || 'error')
+        : enabled ? green('active') : red('✕');
+      const q = a.quota;
+      const ses = q?.providerSes != null ? ` Ses ${Math.round(q.providerSes * 100)}%` : '';
+      buf.push(`  ${enabled ? '' : dim('')} ${bold(a.name)} ${a.provider}${tag}${secret} ${status}${ses}`);
+    }
+  }
+
   _keyRouting(k) {
     if (k === 'a') {
       this._confirm(
@@ -641,6 +778,51 @@ export class TUI {
   }
 
   _keySelect(k) {
+    // Provider selection (from the providers screen) uses its own option list.
+    if (this._selOptions && (this.selAction === 'delete' || this.selAction === 'toggle')
+      && this.mode === 'select' && this.am.accounts[this._selOptions[0]]?.type === 'provider') {
+      const opts = this._selOptions;
+      const position = Math.max(0, opts.indexOf(this.selIdx));
+      if (k === 'up' || k === 'k') this.selIdx = opts[Math.max(0, position - 1)] ?? this.selIdx;
+      else if (k === 'down' || k === 'j') this.selIdx = opts[Math.min(opts.length - 1, position + 1)] ?? this.selIdx;
+      else if (k === 'enter') {
+        const account = this.am.accounts[this.selIdx];
+        if (!account) { this.mode = 'providers'; return; }
+        if (this.selAction === 'toggle') {
+          const enable = !account.enabled;
+          this._confirm(
+            `${enable ? 'Enable' : 'Disable'} "${account.name}"?`,
+            enable ? 'Allow this provider to receive requests again.' : 'Stop routing to it. Active requests continue.',
+            () => { this._doToggle(this.selIdx, enable); this.mode = 'providers'; },
+          );
+        } else if (this.selAction === 'delete') {
+          this._confirm(
+            `Delete provider "${account.name}"?`,
+            account.configSourced
+              ? 'Removes it from config and GCP reference. The GCP secret itself stays — delete it separately if needed.'
+              : 'Removes the runtime provider. It returns on the next request that sends its token.',
+            async () => {
+              if (account.configSourced) {
+                try {
+                  const { atomicConfigUpdate } = await import('../config.js');
+                  await atomicConfigUpdate(cfg => {
+                    if (Array.isArray(cfg.providers)) {
+                      cfg.providers = cfg.providers.filter(p => p.name !== account.name);
+                    }
+                  });
+                } catch (err) { this._addLog(`Config update failed: ${err.message}`); }
+              }
+              this.am.removeAccount(this.selIdx);
+              this._addLog(`Deleted provider "${account.name}"`);
+              this.mode = 'providers';
+            },
+          );
+        }
+      }
+      else if (k === 'esc' || k === 'q') { this.mode = 'providers'; }
+      return;
+    }
+
     const selectable = this._selectableIndexes(this.selAction);
     const position = Math.max(0, selectable.indexOf(this.selIdx));
     if (k === 'up' || k === 'k') this.selIdx = selectable[Math.max(0, position - 1)] ?? this.selIdx;
@@ -1283,6 +1465,13 @@ export class TUI {
     // Pad to fill
     while (lines.length < H - footerH) lines.push('');
 
+    // Providers panel — shown when the user is on the providers screen
+    if (this.mode === 'providers' || this.mode === 'select') {
+      const pLines = [];
+      this._renderProviders(pLines, W);
+      lines.push(...pLines);
+    }
+
     // ── Footer
     lines.push(' ' + dim('─'.repeat(W - 2)));
     if (this.mode === 'confirm') lines.push(` ${this.confirmDetail}`);
@@ -1405,7 +1594,12 @@ export class TUI {
 
     let line = ` ${sel}${cur} ${name} ${type} ${status} ${l1} ${bar(r1, bw, t1)}`;
     if (showBoth) {
-      line += `  ${l2} ${bar(r2, bw, t2)}`;
+      // "no weekly cap on this plan" is a DIFFERENT state from "not read yet", and
+      // both render as an empty bar. Say which, so a healthy uncapped account
+      // (privacy@gomokka.com, measured 2026-08-06) doesn't read as broken.
+      line += (r2 == null && q.weeklyAbsent)
+        ? `  ${l2} ${emptyBar('none', bw)}`
+        : `  ${l2} ${bar(r2, bw, t2)}`;
     }
     const weekly = weeklyPolicyText(this.am, a);
     if (weekly) line += `  ${weekly}`;
@@ -1481,7 +1675,10 @@ export class TUI {
     let sesCell, wkCell, note = '';
     if (q.providerSes != null || q.providerWk != null) {
       sesCell = q.providerSes != null ? bar(q.providerSes, bw, q.providerSesReset) : emptyBar('—', bw);
-      wkCell = q.providerWk != null ? bar(q.providerWk, bw, q.providerWkReset) : emptyBar('—', bw);
+      // z.ai's `max` plan genuinely has NO weekly token window (measured 2026-08-06:
+      // one TOKENS_LIMIT, unit 3 = 5h). "none" says that; "—" read as a broken probe.
+      wkCell = q.providerWk != null ? bar(q.providerWk, bw, q.providerWkReset)
+        : emptyBar(q.weeklyAbsent ? 'none' : '—', bw);
       note = this._probeHealthNote(a);
     } else if (q.providerQuotaSource === 'console-only') {
       sesCell = emptyBar('n/a', bw);
@@ -1527,13 +1724,15 @@ export class TUI {
   _renderFooter() {
     switch (this.mode) {
       case 'normal':
-        return ` ${bold('a')} Accounts  ${bold('m')} Routing  ${bold('s')} Sync  ${bold('u')} Updates  ${bold('r')} Restart  ${bold('q')} Stop`;
+        return ` ${bold('a')} Accounts  ${bold('p')} Providers  ${bold('m')} Routing  ${bold('s')} Sync  ${bold('u')} Updates  ${bold('r')} Restart  ${bold('q')} Stop`;
       case 'updates': {
         const state = this._autoUpdateOn() ? green('on') : dim('off');
         return ` ${bold('c')} Check & apply now  ${bold('t')} Automatic updates: ${state} ↻  ${bold('Esc')} Back`;
       }
       case 'accounts':
         return ` ${bold('l')} Login/re-auth (browser)  ${bold('k')} API key  ${bold('n')} Rename  ${bold('t')} Enable/disable  ${bold('d')} Delete  ${bold('Esc')} Back`;
+      case 'providers':
+        return ` ${bold('a')} Add provider  ${bold('d')} Delete  ${bold('t')} Enable/disable  ${bold('Esc')} Back`;
       case 'routing': {
         // Show the CURRENT cross-provider policy inline so pressing f visibly changes it
         // right here at the footer (the policy also renders in the header, far from the