maxpool 1.5.72 → 1.5.74

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.72",
+  "version": "1.5.74",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -1191,6 +1191,17 @@ export class AccountManager {
    *  body signal only — never the session-sticky policy — and fails CLOSED on any
    *  body we couldn't fully scan (non-JSON / parse error → bodyThinkingScanned unset). */
   _migrationSafeForRequest(requestInfo = {}) {
+    // A same-PROVIDER migration (GLM→GLM, Kimi→Kimi) is always safe: the thinking
+    // format is identical on both sides, so there is no cross-format replay risk.
+    // The body-scanning gate below exists for Anthropic cross-account migration
+    // (where a signed thinking block replayed to a different account can 400). It
+    // was blocking provider rebalancing entirely — a GLM session bound to an account
+    // at 92% weekly stayed there forever because bodyThinkingScanned was never set
+    // on provider-origin requests (no Anthropic thinking blocks to scan).
+    const boundName = this._sessionBinding(requestInfo.sessionKey)?.currentName;
+    const boundAcct = boundName ? this.accounts.find(a => a.name === boundName) : null;
+    if (boundAcct?.type === 'provider') return true;
+
     // Fail closed on any body we couldn't fully scan (non-JSON / parse error).
     if (requestInfo.bodyThinkingScanned !== true) return false;
     // An Anthropic-incompatible (provider-pinned) session's only possible cross is

package/src/server.js

@@ -1043,7 +1043,18 @@ async function forwardRequest(
         // self-heals instead of poisoning the session into a 400 loop. Signatures are
         // portable in practice (verified 2026-07-02); this only fires if Anthropic
         // ever account-binds them.
-        if (lease.migratedFromName && requestInfo.sessionKey
+        // ONLY for a Claude→Claude migration. When the issuer is a PROVIDER, reverting
+        // there is not a repair — the provider happily serves the request, but the
+        // transcript keeps its provider-authored thinking blocks, so the very next turn
+        // that routes back to Claude 400s on the SAME block. Measured 2026-08-09: the
+        // same coordinate (messages.5.content.23) failed 4 times in 2 minutes, each one
+        // "reverting to issuer glm max@gomokka.com" and never repairing anything.
+        // The correct repair for a provider-authored block is the strip below.
+        const issuer = lease.migratedFromName
+          ? accountManager.accounts?.find(a => a.name === lease.migratedFromName)
+          : null;
+        const issuerIsClaude = issuer && issuer.type !== 'provider';
+        if (lease.migratedFromName && issuerIsClaude && requestInfo.sessionKey
           && canRetryBufferedBody && retryCount + 1 < maxAttempts && !res.headersSent) {
           accountManager.revertSessionBinding(requestInfo.sessionKey, lease.migratedFromName);
           excludedIndexes.add(account.index);