@askalf/dario 4.8.108 → 4.8.110

package/README.md

@@ -18,7 +18,7 @@
 
 > 🗓️ **2026-06-15 — Anthropic splits Claude billing.** Agent-SDK and `claude -p` (headless) traffic stops counting against your subscription pool and moves to a small separate monthly credit ($20 / $100 / $200 by plan), then metered per-token API rates. Most proxies forward your requests in exactly the shape that gets reclassified into that bucket. dario rewrites every request into interactive Claude Code wire-shape before it leaves your machine, so your traffic stays in the subscription pool you already pay for — same install, no config change for the cliff. **[What changes, and how to verify it on your own machine →](#the-deadline-2026-06-15)**
 
-> ⛔ **Claude Fable 5 / Mythos 5 — temporarily suspended for all Anthropic customers.** On 2026-06-12 a US-government legal directive disabled Fable 5 and Mythos 5 for **every** Anthropic plan and tier — `api.anthropic.com` now returns `not_found` for them, and no account or proxy can route around it ([details](https://www.anthropic.com/news/fable-mythos-access)). As of **v4.8.71**, dario filters both families out of `/v1/models` and rejects any spelling (`fable`, `fable1m`, `claude-fable-5`, `claude-fable-5[1m]`, `claude:fable`) up front with a clean `404` pointing at `claude-opus-4-8` / `claude-sonnet-4-6` — instead of forwarding into a confusing upstream error. Reversible without a code change once access is restored: set `DARIO_SUSPENDED_MODELS=` (empty) on the instance. `npm install -g @askalf/dario@latest`
+> ⛔ **Claude Fable 5 / Mythos 5 — temporarily suspended for all Anthropic customers.** On 2026-06-12 a US-government legal directive disabled Fable 5 and Mythos 5 for **every** Anthropic plan and tier — `api.anthropic.com` now returns `not_found` for them, and no account or proxy can route around it ([details](https://www.anthropic.com/news/fable-mythos-access)). As of **v4.8.71**, dario filters both families out of `/v1/models` and rejects any spelling (`fable`, `fable1m`, `claude-fable-5`, `claude-fable-5[1m]`, `claude:fable`) up front with a clean `404` pointing at `claude-opus-4-8` / `claude-sonnet-5` — instead of forwarding into a confusing upstream error. Reversible without a code change once access is restored: set `DARIO_SUSPENDED_MODELS=` (empty) on the instance. `npm install -g @askalf/dario@latest`
 >
 > ⚠️ Still on a version **before 4.8.39**? Upgrade now — those could silently corrupt code/structured content routed through the proxy (the identifier scrub stripped tokens like the JS `continue` keyword). **[Details →](https://github.com/askalf/dario/issues/457)**
 
@@ -76,7 +76,7 @@ Type `dario` with no args (in another terminal) to open a full-screen control pa
 │                                                                     │
 │  Per-model:                                                         │
 │   opus-4-8      ████████████░░░░░░░░  60%  (148 req)               │
-│   sonnet-4-6    █████░░░░░░░░░░░░░░░  26%  ( 64 req)               │
+│   sonnet-5      █████░░░░░░░░░░░░░░░  26%  ( 64 req)               │
 │   haiku-4-5     ███░░░░░░░░░░░░░░░░░  14%  ( 35 req)               │
 │                                                                     │
 │  Rate-limit:                                                        │
@@ -194,7 +194,7 @@ You point every tool at one URL. dario reads each request, decides which backend
 
 The tool doesn't know. The backend doesn't know. dario is the seam.
 
-**The full Claude lineup, autodetected.** Opus 4.8, Sonnet 4.6, and Haiku 4.5 — plus `[1m]` long-context variants, generated by one rule for every family — by full id (`claude-opus-4-8`) or shortcut (`opus` / `sonnet` / `haiku`, append `1m` for the long-context form). `GET /v1/models` asks Anthropic's live catalog (TTL-cached, baked fallback when offline), and the family shortcuts track it — a new model shows up and resolves the day it lands, no dario release needed; the model-specific wire shape (effort level, beta set, thinking config) is applied automatically. **Globally-suspended families are filtered out** of both the live catalog and the baked fallback, so `/v1/models` never advertises a model that 404s upstream and suspended ids are rejected locally with an actionable error — currently Claude Fable 5 and Mythos 5 (US-government directive, 2026-06-12); governed by `DARIO_SUSPENDED_MODELS` (default `fable`), set it empty to re-enable when access is restored.
+**The full Claude lineup, autodetected.** Opus 4.8, Sonnet 5, and Haiku 4.5 — plus `[1m]` long-context variants, generated by one rule for every family — by full id (`claude-opus-4-8`) or shortcut (`opus` / `sonnet` / `haiku`, append `1m` for the long-context form). `GET /v1/models` asks Anthropic's live catalog (TTL-cached, baked fallback when offline), and the family shortcuts track it — a new model shows up and resolves the day it lands, no dario release needed; the model-specific wire shape (effort level, beta set, thinking config) is applied automatically. **Globally-suspended families are filtered out** of both the live catalog and the baked fallback, so `/v1/models` never advertises a model that 404s upstream and suspended ids are rejected locally with an actionable error — currently Claude Fable 5 and Mythos 5 (US-government directive, 2026-06-12); governed by `DARIO_SUSPENDED_MODELS` (default `fable`), set it empty to re-enable when access is restored.
 
 ---
 
@@ -303,7 +303,7 @@ No. `five_hour` and `seven_day` are both subscription billing — different acco
 No, and it's caught automatically — see [The deadline](#the-deadline-2026-06-15) and [How it stays working](#how-it-works-and-how-it-stays-working). dario rewrites every request to interactive-CC shape before it reaches `api.anthropic.com`, and the three-class drift watcher picks up new changes (npm-release hourly, remote-config every 30 min, classifier-rule daily). v3.38.5 + v3.38.6 — 13 minutes apart, same day as v2.1.142's silent drops — are the prior art.
 
 **I'm getting `404 not_found` for `claude-fable-5` / `fable`. Did dario break?**
-No — Claude Fable 5 and Mythos 5 were disabled for **all** Anthropic customers by a US-government legal directive on 2026-06-12 (every plan and tier; [details](https://www.anthropic.com/news/fable-mythos-access)). `api.anthropic.com` returns `not_found` for them, so no subscription or proxy can route them. Since v4.8.71 dario drops both families from `/v1/models` and rejects them locally with a clear 404 pointing at `claude-opus-4-8` / `claude-sonnet-4-6`, instead of forwarding into a confusing upstream error. When access is restored, set `DARIO_SUSPENDED_MODELS=` (empty) on the instance to re-enable — no upgrade needed.
+No — Claude Fable 5 and Mythos 5 were disabled for **all** Anthropic customers by a US-government legal directive on 2026-06-12 (every plan and tier; [details](https://www.anthropic.com/news/fable-mythos-access)). `api.anthropic.com` returns `not_found` for them, so no subscription or proxy can route them. Since v4.8.71 dario drops both families from `/v1/models` and rejects them locally with a clear 404 pointing at `claude-opus-4-8` / `claude-sonnet-5`, instead of forwarding into a confusing upstream error. When access is restored, set `DARIO_SUSPENDED_MODELS=` (empty) on the instance to re-enable — no upgrade needed.
 
 Full FAQ: [`docs/faq.md`](./docs/faq.md)
 

package/dist/admin-api.d.ts

@@ -7,16 +7,17 @@
  * `DARIO_API_KEY` as a fallback — even on loopback, since they add/remove
  * OAuth credentials):
  *
- *   POST   /admin/login/start     { alias }            -> { login_id, authorize_url, expires_at }
- *   POST   /admin/login/complete  { login_id, code }   -> { alias, status, expires_at }
- *   GET    /admin/accounts                              -> { accounts: [...], count }
- *   DELETE /admin/accounts/<alias>                      -> { alias, removed }
+ *   POST   /admin/login/start     { alias }        -> { authorize_url, expires_at }
+ *   POST   /admin/login/complete  { alias, code }  -> { alias, status, expires_at }
+ *   GET    /admin/accounts                          -> { accounts: [...], count }
+ *   DELETE /admin/accounts/<alias>                  -> { alias, removed }
  *
  * The login flow mirrors `dario accounts add --manual` (PKCE + manual paste):
  * `/start` returns the authorize URL the operator opens in a browser; they POST
  * the code Anthropic displays back to `/complete`. The PKCE verifier + state
- * live in an in-memory map keyed by `login_id` with a short TTL — never on
- * disk, never returned to the client, single-use.
+ * live in an in-memory map keyed by the account `alias` with a short TTL — never
+ * on disk, never returned to the client, single-use. One pending login per
+ * alias; a second `/start` for the same alias just replaces it (#599).
  *
  * Account changes take effect on the next proxy restart (the pool is built at
  * startup, src/proxy.ts). Hot-reload of a running pool is a deliberate

package/dist/admin-api.js

@@ -1,9 +1,10 @@
-import { randomUUID, timingSafeEqual } from 'node:crypto';
+import { timingSafeEqual } from 'node:crypto';
 import { startAddAccount, completeAddAccount, removeAccount, listAccountAliases, loadAccount, } from './accounts.js';
 import { parseManualPaste } from './oauth.js';
 const PENDING_TTL_MS = 10 * 60_000;
-const MAX_PENDING = 64; // backstop against unbounded growth from repeated /start
+const MAX_PENDING = 64; // backstop against unbounded growth (distinct aliases)
 const ACCOUNTS_PREFIX = '/admin/accounts/';
+// Keyed by account alias — one pending login per alias (#599).
 const pendingLogins = new Map();
 function prunePending(now) {
     for (const [id, p] of pendingLogins) {
@@ -102,39 +103,38 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
                 send(res, 400, { error: 'missing "alias"' });
                 return true;
             }
-            if (pendingLogins.size >= MAX_PENDING) {
+            // Only a brand-new alias grows the map; a repeat /start replaces in place.
+            if (!pendingLogins.has(alias) && pendingLogins.size >= MAX_PENDING) {
                 send(res, 429, { error: 'too many pending logins; complete or wait for one to expire' });
                 return true;
             }
             const { authorizeUrl, codeVerifier, state } = await startAddAccount(alias); // throws on invalid alias
-            const loginId = randomUUID();
             const expiresAt = now + PENDING_TTL_MS;
-            pendingLogins.set(loginId, { alias, codeVerifier, state, expiresAt });
+            pendingLogins.set(alias, { codeVerifier, state, expiresAt });
             send(res, 200, {
-                login_id: loginId,
                 authorize_url: authorizeUrl,
                 expires_at: new Date(expiresAt).toISOString(),
-                instructions: 'Open authorize_url, approve, then POST the displayed code to /admin/login/complete with this login_id.',
+                instructions: `Open authorize_url, approve, then POST { "alias": "${alias}", "code": "<displayed code>" } to /admin/login/complete.`,
             });
             return true;
         }
-        // POST /admin/login/complete  { login_id, code }
+        // POST /admin/login/complete  { alias, code }
         if (urlPath === '/admin/login/complete') {
             if (method !== 'POST') {
                 send(res, 405, { error: 'Method not allowed (use POST)' });
                 return true;
             }
             const body = await readJsonBody(req);
-            const loginId = typeof body.login_id === 'string' ? body.login_id : '';
+            const alias = typeof body.alias === 'string' ? body.alias.trim() : '';
             const rawCode = typeof body.code === 'string' ? body.code : '';
-            if (!loginId || !rawCode) {
-                send(res, 400, { error: 'missing "login_id" or "code"' });
+            if (!alias || !rawCode) {
+                send(res, 400, { error: 'missing "alias" or "code"' });
                 return true;
             }
-            const p = pendingLogins.get(loginId);
+            const p = pendingLogins.get(alias);
             if (!p || p.expiresAt <= now) {
-                pendingLogins.delete(loginId);
-                send(res, 410, { error: 'login_id unknown or expired — start a new login' });
+                pendingLogins.delete(alias);
+                send(res, 410, { error: 'no pending login for that alias (unknown or expired) — start a new login' });
                 return true;
             }
             // Accept "code#state" or a bare code; verify the embedded state if present.
@@ -147,8 +147,8 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
                 send(res, 400, { error: 'state mismatch — code is from a different login attempt' });
                 return true;
             }
-            pendingLogins.delete(loginId); // single-use, regardless of exchange outcome
-            const creds = await completeAddAccount(p.alias, code, p.codeVerifier, p.state);
+            pendingLogins.delete(alias); // single-use, regardless of exchange outcome
+            const creds = await completeAddAccount(alias, code, p.codeVerifier, p.state);
             deps.onAccountsChanged?.();
             send(res, 200, { alias: creds.alias, status: 'added', expires_at: new Date(creds.expiresAt).toISOString() });
             return true;

package/dist/cc-template-data.json

@@ -1,5 +1,5 @@
 {
-  "_version": "2.1.196",
+  "_version": "2.1.197",
   "_captured": "2026-06-30T06:36:26.548Z",
   "_source": "bundled",
   "_schemaVersion": 3,
@@ -1417,7 +1417,7 @@
   "anthropic_beta": "claude-code-20250219,interleaved-thinking-2025-05-14,thinking-token-count-2026-05-13,context-management-2025-06-27,prompt-caching-scope-2026-01-05,mid-conversation-system-2026-04-07,advisor-tool-2026-03-01,effort-2025-11-24",
   "header_values": {
     "accept": "application/json",
-    "user-agent": "claude-cli/2.1.196 (external, sdk-cli)",
+    "user-agent": "claude-cli/2.1.197 (external, sdk-cli)",
     "x-stainless-arch": "x64",
     "x-stainless-lang": "js",
     "x-stainless-os": "Linux",
@@ -1442,5 +1442,5 @@
     "output_config",
     "stream"
   ],
-  "_supportedMaxTested": "2.1.196"
+  "_supportedMaxTested": "2.1.197"
 }

package/dist/proxy.js

@@ -928,8 +928,17 @@ export async function startProxy(opts = {}) {
         // Single-account mode — existing auth check
         status = await getStatus();
         if (!status.authenticated) {
-            console.error('[dario] Not authenticated. Run `dario login` first.');
-            process.exit(1);
+            if (process.env.DARIO_ADMIN === '1') {
+                // Admin API on (#599): start anyway so POST /admin/login/start can
+                // bootstrap the first account headlessly — the whole point of the API
+                // is "no console access". LLM routes return 503 until an account
+                // exists. Scoped to DARIO_ADMIN=1; default dario still exits here.
+                console.warn('[dario] No credentials yet — starting in admin-only mode (DARIO_ADMIN=1). Add an account via POST /admin/login/start (or run `dario login`); LLM requests return 503 until then.');
+            }
+            else {
+                console.error('[dario] Not authenticated. Run `dario login` first.');
+                process.exit(1);
+            }
         }
     }
     const cliVersion = detectCliVersion();

package/dist/tui/tabs/hits.d.ts

@@ -11,7 +11,7 @@
  *   ┌─ Hits ────────────────────────[ ↑↓ select · r refresh ]
  *   │  HH:MM:SS  METHOD  MODEL          IN     OUT   LAT    ST
  *   │  18:42:01  POST    fable-5        842    216   1.2s  200  ←
- *   │  18:42:03  POST    sonnet-4-6     1.2k   480   0.8s  200
+ *   │  18:42:03  POST    sonnet-5       1.2k   480   0.8s  200
  *   │  …
  *   ├─────────────────────────────────────────────────────────────
  *   │  selected: 18:42:01  req_011…NvMn

package/dist/tui/tabs/hits.js

@@ -11,7 +11,7 @@
  *   ┌─ Hits ────────────────────────[ ↑↓ select · r refresh ]
  *   │  HH:MM:SS  METHOD  MODEL          IN     OUT   LAT    ST
  *   │  18:42:01  POST    fable-5        842    216   1.2s  200  ←
- *   │  18:42:03  POST    sonnet-4-6     1.2k   480   0.8s  200
+ *   │  18:42:03  POST    sonnet-5       1.2k   480   0.8s  200
  *   │  …
  *   ├─────────────────────────────────────────────────────────────
  *   │  selected: 18:42:01  req_011…NvMn

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "4.8.108",
+  "version": "4.8.110",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {