maxpool 1.5.8 → 1.5.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.5.8",
+  "version": "1.5.10",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -71,6 +71,16 @@ const DEFAULT_SCHEDULER = {
   recoveryRampWeight: 4,          // decaying penalty applied to a just-recovered account
   recoveryRampMs: 5 * 60_000,     // how long the post-recovery ramp lasts
   spreadWindowMs: 15 * 60_000,    // rolling window used to measure recent per-account load
+  // Allow a signed-thinking session to rebalance onto a DIFFERENT Claude account
+  // (never a provider — GLM/Kimi can't validate an Anthropic signature). Anthropic
+  // thinking-block signatures are content/model integrity, NOT account-bound —
+  // verified empirically 2026-07-02 (a `partnerships`-signed block replayed under
+  // `personal` returned 200). ON by default: a heavy thinking session can now spread
+  // its later load onto fresh accounts instead of stranding one. The revert-to-issuer
+  // fail-safe (server.js, on `invalid_thinking_signature` for a migrated request)
+  // makes this safe even if Anthropic ever account-binds signatures — a rejected
+  // replay self-heals to the issuer instead of poisoning the session.
+  crossAccountThinkingMigration: true,
 };
 const LOAD_EVENT_MAX_AGE_MS = 60 * 60 * 1000;
 const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
@@ -430,6 +440,12 @@ export class AccountManager {
 
   acquireAccount(requestInfo = {}, excludedIndexes = new Set()) {
     this._noteRequestPolicy(requestInfo);
+    // Capture the session's prior account BEFORE selection, so the caller can tell
+    // whether this acquire MOVED the session (the thinking-signature fail-safe needs
+    // the pre-migration issuing account to revert to).
+    const prevCurrentName = requestInfo.sessionKey
+      ? this._sessionBinding(requestInfo.sessionKey)?.currentName
+      : null;
     const account = this.getActiveAccount(requestInfo, excludedIndexes);
     if (!account) return null;
 
@@ -441,7 +457,22 @@ export class AccountManager {
     account.inFlight++;
     account.activeWeight += weight;
     account.lastUsedAt = Date.now();
-    return { account, weight, startedAt: Date.now(), upstreamThrottleProbe };
+    // Non-null only when this acquire moved the session off its prior account.
+    const migratedFromName = (prevCurrentName && account.name !== prevCurrentName) ? prevCurrentName : null;
+    return { account, weight, startedAt: Date.now(), upstreamThrottleProbe, migratedFromName };
+  }
+
+  /** Fail-safe: snap a session's binding back to the pre-migration issuing account
+   *  after a rejected cross-account thinking replay, so the retry (and future
+   *  requests) route to the account that actually generated the thinking blocks.
+   *  Defensive — signatures are portable in practice (verified 2026-07-02); this
+   *  only fires if Anthropic ever account-binds them. */
+  revertSessionBinding(sessionKey, name) {
+    if (!sessionKey || !name) return;
+    const binding = this._sessionBinding(sessionKey);
+    if (!binding) return;
+    binding.currentName = name;
+    this.sessionBindings.set(sessionKey, binding);
   }
 
   releaseAccount(lease, outcome = {}) {
@@ -948,16 +979,31 @@ export class AccountManager {
    *  body signal only — never the session-sticky policy — and fails CLOSED on any
    *  body we couldn't fully scan (non-JSON / parse error → bodyThinkingScanned unset). */
   _migrationSafeForRequest(requestInfo = {}) {
-    return requestInfo.bodyThinkingScanned === true
-      && requestInfo.requiresAnthropicThinkingIntegrity !== true;
+    // Fail closed on any body we couldn't fully scan (non-JSON / parse error).
+    if (requestInfo.bodyThinkingScanned !== true) return false;
+    // A signed-thinking request is migration-safe when cross-account thinking
+    // migration is enabled: the signature is content/model integrity, not account-
+    // bound, and the rebalance candidate filter (_matchesRequest → _isRequestCompatible)
+    // already bars providers for thinking, so every eligible target is a Claude
+    // account. When the flag is off, keep the conservative bar (never migrate signed
+    // thinking) until the revert-to-issuer fail-safe lands (#16).
+    if (requestInfo.requiresAnthropicThinkingIntegrity === true) {
+      return this.scheduler.crossAccountThinkingMigration === true;
+    }
+    return true;
   }
 
-  /** Flap-stable "hot": weekly reserve/critical or 5h-cap pressure — signals that
-   *  do NOT flip the instant a request migrates (unlike live in-flight, left to the
-   *  score loop). A healthy bound account is never hot, so it never migrates → no
-   *  ping-pong. */
+  /** Flap-stable "hot": burn-PACE reserve/critical/exhausted, or immediate session-
+   *  quota pressure (5h cap or an API-key token/request limit via
+   *  `_isSessionQuotaUnavailable`).
+   *  Pace (not raw level) is the right trigger — it spreads a long/heavy session's
+   *  later load onto fresh capacity BEFORE it exhausts one account, while a light or
+   *  near-reset session (whose pace stays normal) never triggers → no churn. Does
+   *  NOT flip the instant a request migrates (unlike live in-flight, left to the
+   *  score loop), so a healthy bound account never ping-pongs. */
   _isBoundAccountHot(account) {
-    return this._isNearQuota(account);
+    return this._isSessionQuotaUnavailable(account)
+      || ['reserve', 'critical', 'exhausted'].includes(this._weeklyPaceState(account));
   }
 
   /** Decide whether a bound session should leave its (hot) account THIS request.
@@ -970,7 +1016,11 @@ export class AccountManager {
     if (!this._isBoundAccountHot(bound)) return false;
 
     const boundScore = this._scoreAccount(bound, requestInfo, scoringCtx);
-    const boundTier = WEEKLY_TIER[this._weeklyRawState(bound)] ?? 0;
+    // Tier guard on the SAME axis as the trigger (pace, not raw). If the trigger is
+    // pace but the tier guard is raw, a pace-hot fast-burner whose RAW tier is still
+    // `normal` can never find a strictly-healthier raw tier → migration never fires
+    // for the exact account this is meant to relieve. Match the axes.
+    const boundTier = WEEKLY_TIER[this._weeklyPaceState(bound)] ?? 0;
 
     let bestScore = Infinity;
     let bestTier = Infinity;
@@ -983,7 +1033,7 @@ export class AccountManager {
       const score = this._scoreAccount(account, requestInfo, scoringCtx);
       if (score < bestScore) {
         bestScore = score;
-        bestTier = WEEKLY_TIER[this._weeklyRawState(account)] ?? 0;
+        bestTier = WEEKLY_TIER[this._weeklyPaceState(account)] ?? 0;
       }
     }
     if (!Number.isFinite(bestScore)) return false; // no healthy alternative
@@ -1109,6 +1159,22 @@ export class AccountManager {
     const profile = requestInfo.profile || 'claude';
     const scoringCtx = this._scoringContext();
 
+    // Fail-safe retry pin: steer this request's remaining retry/queue chain onto a
+    // specific account (the pre-migration issuer, after a cross-account thinking
+    // replay was rejected). Honored ahead of everything else, but FALLS THROUGH to
+    // normal selection whenever that account is excluded/unavailable — a down issuer
+    // never strands the request (the retry then re-migrates and terminates via
+    // excludedIndexes + maxAttempts). See the thinking-signature fail-safe in server.js.
+    if (requestInfo.pinnedAccountName) {
+      const pinned = this.accounts.find(a => a.name === requestInfo.pinnedAccountName);
+      if (pinned && !excludedIndexes.has(pinned.index)
+        && this._matchesRequest(pinned, profile, requestInfo)
+        && this._isAvailable(pinned, { allowWeeklyReserve: true, allowWeeklyCritical: true })) {
+        this.currentIndex = pinned.index;
+        return pinned;
+      }
+    }
+
     const hasBinding = Boolean(requestInfo.sessionKey && this.sessionBindings.has(requestInfo.sessionKey));
     const preferred = this._preferredAccount(profile, excludedIndexes, requestInfo);
     if (preferred) {

package/src/index.js

@@ -139,6 +139,10 @@ async function serverCommand() {
 
 async function supervisorCommand() {
   const { createServer } = await import('node:net');
+  // Test-only: the restart integration test delivers a GROUP SIGUSR2 to drive the
+  // worker's restart path; ignore it on the supervisor so the group signal doesn't
+  // kill it (default SIGUSR2 action is terminate). Gated — never active normally.
+  if (process.env.MAXPOOL_TEST_RESTART_SIGNAL === '1') process.on('SIGUSR2', () => {});
   const config = await loadOrCreateConfig();
   initEventLog(config, { manageRotation: true }); // supervisor is the single rotation owner
   const port = config.proxy.port;
@@ -733,8 +737,19 @@ async function serverWorkerCommand() {
   restartController = new RestartController({
     pauseAdmission: () => accountManager.setAdmissionPaused(true),
     restartNow: requestReload,
+    // Configurable so ops can tune the bounded pre-restart drain, and so the
+    // integration test can exercise the force-restart path without a 10s wait.
+    ...(Number.isFinite(config.restartDrainTimeoutMs) ? { drainTimeoutMs: config.restartDrainTimeoutMs } : {}),
   });
 
+  // Test-only: drive the real interactive restart path (the TUI `r` key) headless,
+  // so the end-to-end "restart while requests are in flight completes bounded and
+  // the server comes back" is provable without allocating a pty. Gated — never
+  // active in normal runs.
+  if (process.env.MAXPOOL_TEST_RESTART_SIGNAL === '1') {
+    process.on('SIGUSR2', () => restartController?.requestRestart());
+  }
+
   const shutdownGracefully = (reason, options = {}) => {
     // A terminal-close shutdown must NEVER exit non-zero: the supervisor reads a
     // fast non-zero exit as a crash and respawns a fresh worker — onto the now-dead

package/src/server.js

@@ -746,6 +746,24 @@ async function forwardRequest(
       }
       if (errorType === 'invalid_thinking_signature') {
         console.log(`[Maxpool] Non-retryable Anthropic thinking signature error on "${account.name}"`);
+        // Fail-safe: if this request had been MIGRATED to a different Claude account
+        // this turn (cross-account thinking rebalance), the rejected block was issued
+        // by the PRE-MIGRATION account. Revert the session there, exclude the failed
+        // target, and retry PINNED to the issuer — so a rejected cross-account replay
+        // self-heals instead of poisoning the session into a 400 loop. Signatures are
+        // portable in practice (verified 2026-07-02); this only fires if Anthropic
+        // ever account-binds them.
+        if (lease.migratedFromName && requestInfo.sessionKey
+          && canRetryBufferedBody && retryCount + 1 < maxAttempts && !res.headersSent) {
+          accountManager.revertSessionBinding(requestInfo.sessionKey, lease.migratedFromName);
+          excludedIndexes.add(account.index);
+          console.log(`[Maxpool] Thinking-signature fail-safe: reverting session to issuer "${lease.migratedFromName}" and retrying`);
+          return forwardRequest(
+            req, res, body, accountManager, upstream, retryCount + 1, hooks, reqId, ctx, logDir,
+            retryConfig, queueConfig, { ...requestInfo, pinnedAccountName: lease.migratedFromName },
+            canRetryBufferedBody, canQueueBufferedBody, excludedIndexes,
+          );
+        }
       }
 
       ctx.status = upstreamRes.status;