maxpool 1.5.7 → 1.5.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.7",
+  "version": "1.5.9",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -71,6 +71,14 @@ const DEFAULT_SCHEDULER = {
   recoveryRampWeight: 4,          // decaying penalty applied to a just-recovered account
   recoveryRampMs: 5 * 60_000,     // how long the post-recovery ramp lasts
   spreadWindowMs: 15 * 60_000,    // rolling window used to measure recent per-account load
+  // Allow a signed-thinking session to rebalance onto a DIFFERENT Claude account
+  // (never a provider — GLM/Kimi can't validate an Anthropic signature). Anthropic
+  // thinking-block signatures are content/model integrity, NOT account-bound —
+  // verified empirically 2026-07-02 (a `partnerships`-signed block replayed under
+  // `personal` returned 200). DEFAULT OFF until the revert-to-issuer fail-safe lands
+  // (issue #16): with it off, a heavy thinking session still can't strand an account,
+  // but it also can't poison a session if Anthropic ever changes the contract.
+  crossAccountThinkingMigration: false,
 };
 const LOAD_EVENT_MAX_AGE_MS = 60 * 60 * 1000;
 const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
@@ -948,16 +956,31 @@ export class AccountManager {
    *  body signal only — never the session-sticky policy — and fails CLOSED on any
    *  body we couldn't fully scan (non-JSON / parse error → bodyThinkingScanned unset). */
   _migrationSafeForRequest(requestInfo = {}) {
-    return requestInfo.bodyThinkingScanned === true
-      && requestInfo.requiresAnthropicThinkingIntegrity !== true;
+    // Fail closed on any body we couldn't fully scan (non-JSON / parse error).
+    if (requestInfo.bodyThinkingScanned !== true) return false;
+    // A signed-thinking request is migration-safe when cross-account thinking
+    // migration is enabled: the signature is content/model integrity, not account-
+    // bound, and the rebalance candidate filter (_matchesRequest → _isRequestCompatible)
+    // already bars providers for thinking, so every eligible target is a Claude
+    // account. When the flag is off, keep the conservative bar (never migrate signed
+    // thinking) until the revert-to-issuer fail-safe lands (#16).
+    if (requestInfo.requiresAnthropicThinkingIntegrity === true) {
+      return this.scheduler.crossAccountThinkingMigration === true;
+    }
+    return true;
   }
 
-  /** Flap-stable "hot": weekly reserve/critical or 5h-cap pressure — signals that
-   *  do NOT flip the instant a request migrates (unlike live in-flight, left to the
-   *  score loop). A healthy bound account is never hot, so it never migrates → no
-   *  ping-pong. */
+  /** Flap-stable "hot": burn-PACE reserve/critical/exhausted, or immediate session-
+   *  quota pressure (5h cap or an API-key token/request limit via
+   *  `_isSessionQuotaUnavailable`).
+   *  Pace (not raw level) is the right trigger — it spreads a long/heavy session's
+   *  later load onto fresh capacity BEFORE it exhausts one account, while a light or
+   *  near-reset session (whose pace stays normal) never triggers → no churn. Does
+   *  NOT flip the instant a request migrates (unlike live in-flight, left to the
+   *  score loop), so a healthy bound account never ping-pongs. */
   _isBoundAccountHot(account) {
-    return this._isNearQuota(account);
+    return this._isSessionQuotaUnavailable(account)
+      || ['reserve', 'critical', 'exhausted'].includes(this._weeklyPaceState(account));
   }
 
   /** Decide whether a bound session should leave its (hot) account THIS request.
@@ -970,7 +993,11 @@ export class AccountManager {
     if (!this._isBoundAccountHot(bound)) return false;
 
     const boundScore = this._scoreAccount(bound, requestInfo, scoringCtx);
-    const boundTier = WEEKLY_TIER[this._weeklyRawState(bound)] ?? 0;
+    // Tier guard on the SAME axis as the trigger (pace, not raw). If the trigger is
+    // pace but the tier guard is raw, a pace-hot fast-burner whose RAW tier is still
+    // `normal` can never find a strictly-healthier raw tier → migration never fires
+    // for the exact account this is meant to relieve. Match the axes.
+    const boundTier = WEEKLY_TIER[this._weeklyPaceState(bound)] ?? 0;
 
     let bestScore = Infinity;
     let bestTier = Infinity;
@@ -983,7 +1010,7 @@ export class AccountManager {
       const score = this._scoreAccount(account, requestInfo, scoringCtx);
       if (score < bestScore) {
         bestScore = score;
-        bestTier = WEEKLY_TIER[this._weeklyRawState(account)] ?? 0;
+        bestTier = WEEKLY_TIER[this._weeklyPaceState(account)] ?? 0;
       }
     }
     if (!Number.isFinite(bestScore)) return false; // no healthy alternative

package/src/restart-controller.js

@@ -1,14 +1,30 @@
 const NON_UPSTREAM_ROUTES = new Set(['(queued)', '(none available)']);
 
 export class RestartController {
-  constructor({ pauseAdmission, restartNow, log = console.log }) {
+  constructor({
+    pauseAdmission,
+    restartNow,
+    log = console.log,
+    // Bounded drain: wait at most this long for in-flight upstream requests to
+    // finish, then force the restart anyway. Without a bound, a single long
+    // streaming/thinking request (minutes) — or a held stream on the 7-day
+    // heartbeat — pins the restart on "Restart pending…" forever (the stuck-`r`
+    // bug). Dropped requests reconnect after restart, as the message promises.
+    drainTimeoutMs = 10_000,
+    setTimeoutFn = setTimeout,
+    clearTimeoutFn = clearTimeout,
+  }) {
     this.pauseAdmission = pauseAdmission;
     this.restartNow = restartNow;
     this.log = log;
+    this.drainTimeoutMs = drainTimeoutMs;
+    this.setTimeoutFn = setTimeoutFn;
+    this.clearTimeoutFn = clearTimeoutFn;
     this.activeRequests = new Set();
     this.upstreamRequests = new Set();
     this.pending = false;
     this.restarting = false;
+    this._drainTimer = null;
   }
 
   requestStarted(id) {
@@ -41,7 +57,14 @@ export class RestartController {
 
     this.pending = true;
     const queuedOrIdle = Math.max(0, this.activeRequests.size - this.upstreamRequests.size);
-    this.log(`[Maxpool] Restart pending; admission paused while ${this.upstreamRequests.size} upstream request(s) finish. ${queuedOrIdle} queued/idle request(s) will reconnect after restart.`);
+    this.log(`[Maxpool] Restart pending; admission paused while ${this.upstreamRequests.size} upstream request(s) finish (up to ${Math.round(this.drainTimeoutMs / 1000)}s). ${queuedOrIdle} queued/idle request(s) will reconnect after restart.`);
+    // Force the restart if the drain overruns — never hang on a long stream.
+    this._drainTimer = this.setTimeoutFn(() => {
+      if (!this.pending || this.restarting) return;
+      this.log(`[Maxpool] Restart drain timed out; forcing restart with ${this.upstreamRequests.size} upstream request(s) still in flight (they will reconnect).`);
+      this._restart();
+    }, this.drainTimeoutMs);
+    this._drainTimer?.unref?.();
   }
 
   _maybeRestart() {
@@ -53,6 +76,10 @@ export class RestartController {
     if (this.restarting) return;
     this.restarting = true;
     this.pending = false;
+    if (this._drainTimer) {
+      this.clearTimeoutFn(this._drainTimer);
+      this._drainTimer = null;
+    }
     this.restartNow();
   }
 }