@askalf/dario 4.8.110 → 4.8.111

package/dist/admin-api.d.ts

@@ -7,7 +7,7 @@
  * `DARIO_API_KEY` as a fallback — even on loopback, since they add/remove
  * OAuth credentials):
  *
- *   POST   /admin/login/start     { alias }        -> { authorize_url, expires_at }
+ *   POST   /admin/login/start     { alias? }       -> { alias, authorize_url, expires_at }
  *   POST   /admin/login/complete  { alias, code }  -> { alias, status, expires_at }
  *   GET    /admin/accounts                          -> { accounts: [...], count }
  *   DELETE /admin/accounts/<alias>                  -> { alias, removed }
@@ -17,18 +17,93 @@
  * the code Anthropic displays back to `/complete`. The PKCE verifier + state
  * live in an in-memory map keyed by the account `alias` with a short TTL — never
  * on disk, never returned to the client, single-use. One pending login per
- * alias; a second `/start` for the same alias just replaces it (#599).
+ * alias; a second `/start` for the same alias just replaces it (#599). The
+ * alias is optional on `/start`: omit it and a non-colliding default
+ * (`account-1`, …) is generated and returned for you to pass to `/complete`.
  *
- * Account changes take effect on the next proxy restart (the pool is built at
- * startup, src/proxy.ts). Hot-reload of a running pool is a deliberate
- * follow-up — keeping this surface small while it manipulates credentials.
+ * `GET /admin/accounts` reports each account's persisted metadata — alias,
+ * scopes, token expiry — plus its live pool status (5h/7d utilization,
+ * representative-claim, routing status, request count) when the proxy supplies
+ * a `poolStatus` snapshot, which it does whenever pool mode is active. It's the
+ * headless, admin-token-gated equivalent of the `GET /accounts` pool view.
+ *
+ * Account changes take effect immediately: the proxy passes an
+ * `onAccountsChanged` hook (src/proxy.ts) that hot-reloads the live pool from
+ * disk, awaited before this handler responds, so an added account is routable
+ * by the time the client sees its 200 — no proxy restart (#599).
+ *
+ * Every mutation (login start / complete, account removal) and every auth
+ * reject is handed to an `audit` hook (src/proxy.ts) that records who did what
+ * to the account pool — to the console always, and to the JSON log file when
+ * one is configured. Secrets never reach it (#599).
+ *
+ * Mutations and repeated auth failures are rate-limited via an injected
+ * `rateLimit` hook (token bucket in src/rate-limit.ts, owned by the proxy):
+ * a throttled call returns `429` with `Retry-After` instead of acting. Reads
+ * (`GET /admin/accounts`) and successful auth are never throttled (#620).
  */
 import type { IncomingMessage, ServerResponse } from 'node:http';
+/** Persisted account metadata surfaced by `GET /admin/accounts`. */
+export interface AdminAccountRecord {
+    alias: string;
+    scopes: string[];
+    expiresAt: number;
+}
+/** Live per-account pool status keyed by alias — see `AdminDeps.poolStatus`. */
+export interface AdminAccountLive {
+    util5h: number;
+    util7d: number;
+    claim: string;
+    status: string;
+    requestCount: number;
+}
+/** An audited admin action — see `AdminDeps.audit`. Never carries secrets. */
+export interface AdminAuditEvent {
+    action: 'login_start' | 'login_complete' | 'account_remove' | 'auth_reject' | 'rate_limited';
+    ok: boolean;
+    status: number;
+    /** Account alias, when the action targets one. */
+    alias?: string;
+    /** Client address (`req.socket.remoteAddress`), when known. */
+    remote?: string;
+    /** Extra context, e.g. the rate-limited category ('auth' | 'mutation'). */
+    detail?: string;
+}
 export interface AdminDeps {
     /** Admin bearer token buffer; `null` = enabled but no token configured (fail closed). */
     adminTokenBuf: Buffer | null;
-    /** Invoked after an account is added or removed (e.g. to log / signal a reload). */
-    onAccountsChanged?: () => void;
+    /**
+     * Invoked after an account is added or removed. Awaited before the response
+     * is sent, so a handler that hot-reloads the live pool (src/proxy.ts) makes
+     * the change routable by the time the client sees its 200.
+     */
+    onAccountsChanged?: () => void | Promise<void>;
+    /**
+     * Persisted-account inventory (alias, scopes, token expiry). Defaults to the
+     * on-disk store at `~/.dario/accounts`; injectable for tests.
+     */
+    listAccounts?: () => Promise<AdminAccountRecord[]>;
+    /**
+     * Live per-account pool status keyed by alias, from the running AccountPool.
+     * When present, `GET /admin/accounts` merges each account's 5h/7d headroom,
+     * representative-claim, routing status, and request count onto its persisted
+     * metadata. Returns `null` (or absent) in single-account mode — no pool.
+     */
+    poolStatus?: () => Map<string, AdminAccountLive> | null;
+    /**
+     * Audit sink for admin activity — every mutation (login start / complete,
+     * account removal) and every auth reject. The proxy records it (console +
+     * log file) so a headless operator has a trail of who provisioned or removed
+     * an account. Never receives secrets.
+     */
+    audit?: (event: AdminAuditEvent) => void;
+    /**
+     * Rate-limit gate for a request category. Consumes one token and returns `0`
+     * if allowed, or the milliseconds to wait if throttled. Applied to mutations
+     * (`'mutation'`) and to failed auth attempts (`'auth'`); reads and successful
+     * auth are never gated. Absent = no limiting. Owned by the proxy (#620).
+     */
+    rateLimit?: (category: 'auth' | 'mutation') => number;
 }
 /**
  * Handle an `/admin/*` request. Returns `true` if it owned the request (matched

package/dist/admin-api.js

@@ -12,15 +12,38 @@ function prunePending(now) {
             pendingLogins.delete(id);
     }
 }
+/** First `account-<n>` not already taken by an existing account or pending login. */
+function nextDefaultAlias(taken) {
+    for (let n = 1;; n++) {
+        const candidate = `account-${n}`;
+        if (!taken.has(candidate))
+            return candidate; // taken is finite → always terminates
+    }
+}
+/** On-disk account inventory — the default `AdminDeps.listAccounts`. */
+async function defaultListAccounts() {
+    const aliases = await listAccountAliases();
+    const loaded = await Promise.all(aliases.map(async (alias) => {
+        const a = await loadAccount(alias);
+        return a ? { alias: a.alias, scopes: a.scopes, expiresAt: a.expiresAt } : null;
+    }));
+    return loaded.filter((a) => a !== null);
+}
 const HEADERS = {
     'Content-Type': 'application/json',
     'X-Content-Type-Options': 'nosniff',
     'Cache-Control': 'no-store',
 };
-function send(res, status, body) {
-    res.writeHead(status, HEADERS);
+function send(res, status, body, extraHeaders) {
+    res.writeHead(status, extraHeaders ? { ...HEADERS, ...extraHeaders } : HEADERS);
     res.end(JSON.stringify(body));
 }
+/** Emit a 429 with `Retry-After` and audit the throttle. */
+function sendThrottled(res, waitMs, category, audit, remote, alias) {
+    const retryAfterS = Math.max(1, Math.ceil(waitMs / 1000));
+    audit?.({ action: 'rate_limited', ok: false, status: 429, remote, alias, detail: category });
+    send(res, 429, { error: 'rate limited', message: `too many admin requests; retry in ~${retryAfterS}s` }, { 'Retry-After': String(retryAfterS) });
+}
 /** Constant-time bearer / x-api-key check. Fails closed when no token configured. */
 function adminAuthOk(req, tokenBuf) {
     if (!tokenBuf)
@@ -71,6 +94,7 @@ async function readJsonBody(req, limitBytes = 64 * 1024) {
  */
 export async function handleAdminRequest(req, res, urlPath, deps) {
     const method = req.method ?? 'GET';
+    const remote = req.socket?.remoteAddress;
     const isAccountDelete = method === 'DELETE' && urlPath.startsWith(ACCOUNTS_PREFIX) && urlPath.length > ACCOUNTS_PREFIX.length;
     const known = urlPath === '/admin/login/start' ||
         urlPath === '/admin/login/complete' ||
@@ -80,6 +104,14 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
         return false;
     // Auth — always required, even on loopback (these mutate OAuth credentials).
     if (!adminAuthOk(req, deps.adminTokenBuf)) {
+        // Throttle repeated failures (brute force / broken client) before replying.
+        const wait = deps.rateLimit?.('auth') ?? 0;
+        if (wait > 0) {
+            sendThrottled(res, wait, 'auth', deps.audit, remote);
+            return true;
+        }
+        const status = deps.adminTokenBuf ? 401 : 403;
+        deps.audit?.({ action: 'auth_reject', ok: false, status, remote });
         if (!deps.adminTokenBuf) {
             send(res, 403, { error: 'admin API enabled but no token configured — set DARIO_ADMIN_TOKEN (or DARIO_API_KEY)' });
         }
@@ -88,20 +120,34 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
         }
         return true;
     }
+    // Rate-limit the mutating routes (reads are exempt). Runs after auth so an
+    // unauthenticated flood is handled by the 'auth' bucket above, not this one.
+    const isMutation = urlPath === '/admin/login/start' || urlPath === '/admin/login/complete' || isAccountDelete;
+    if (isMutation) {
+        const wait = deps.rateLimit?.('mutation') ?? 0;
+        if (wait > 0) {
+            sendThrottled(res, wait, 'mutation', deps.audit, remote);
+            return true;
+        }
+    }
     const now = Date.now();
     prunePending(now);
     try {
-        // POST /admin/login/start  { alias }
+        // POST /admin/login/start  { alias? }
         if (urlPath === '/admin/login/start') {
             if (method !== 'POST') {
                 send(res, 405, { error: 'Method not allowed (use POST)' });
                 return true;
             }
             const body = await readJsonBody(req);
-            const alias = typeof body.alias === 'string' ? body.alias.trim() : '';
+            let alias = typeof body.alias === 'string' ? body.alias.trim() : '';
+            // Alias is optional: a headless caller can omit it and get a generated,
+            // non-colliding default (account-1, account-2, …) back in the response to
+            // thread into /complete. Explicit aliases still win for named setups.
             if (!alias) {
-                send(res, 400, { error: 'missing "alias"' });
-                return true;
+                const records = await (deps.listAccounts ?? defaultListAccounts)();
+                const taken = new Set([...records.map((r) => r.alias), ...pendingLogins.keys()]);
+                alias = nextDefaultAlias(taken);
             }
             // Only a brand-new alias grows the map; a repeat /start replaces in place.
             if (!pendingLogins.has(alias) && pendingLogins.size >= MAX_PENDING) {
@@ -111,7 +157,9 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
             const { authorizeUrl, codeVerifier, state } = await startAddAccount(alias); // throws on invalid alias
             const expiresAt = now + PENDING_TTL_MS;
             pendingLogins.set(alias, { codeVerifier, state, expiresAt });
+            deps.audit?.({ action: 'login_start', ok: true, status: 200, alias, remote });
             send(res, 200, {
+                alias,
                 authorize_url: authorizeUrl,
                 expires_at: new Date(expiresAt).toISOString(),
                 instructions: `Open authorize_url, approve, then POST { "alias": "${alias}", "code": "<displayed code>" } to /admin/login/complete.`,
@@ -149,27 +197,41 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
             }
             pendingLogins.delete(alias); // single-use, regardless of exchange outcome
             const creds = await completeAddAccount(alias, code, p.codeVerifier, p.state);
-            deps.onAccountsChanged?.();
+            await deps.onAccountsChanged?.();
+            deps.audit?.({ action: 'login_complete', ok: true, status: 200, alias: creds.alias, remote });
             send(res, 200, { alias: creds.alias, status: 'added', expires_at: new Date(creds.expiresAt).toISOString() });
             return true;
         }
-        // GET /admin/accounts
+        // GET /admin/accounts — persisted metadata + live pool status (#599).
         if (urlPath === '/admin/accounts') {
             if (method !== 'GET') {
                 send(res, 405, { error: 'Method not allowed (use GET)' });
                 return true;
             }
-            const aliases = await listAccountAliases();
-            const accounts = (await Promise.all(aliases.map(async (alias) => {
-                const a = await loadAccount(alias);
-                if (!a)
-                    return null;
-                return { alias: a.alias, scopes: a.scopes, expires_in_ms: Math.max(0, a.expiresAt - now) };
-            }))).filter((a) => a !== null);
+            const records = await (deps.listAccounts ?? defaultListAccounts)();
+            const live = deps.poolStatus?.() ?? null;
+            const accounts = records.map((r) => {
+                const l = live?.get(r.alias);
+                return {
+                    alias: r.alias,
+                    scopes: r.scopes,
+                    expires_in_ms: Math.max(0, r.expiresAt - now),
+                    // Inline the running pool's live status when this account is in it.
+                    ...(l ? {
+                        util5h: l.util5h,
+                        util7d: l.util7d,
+                        claim: l.claim,
+                        status: l.status,
+                        request_count: l.requestCount,
+                    } : {}),
+                };
+            });
             send(res, 200, {
                 accounts,
                 count: accounts.length,
-                note: 'live rate-limit / utilization is at GET /accounts when pool mode is active',
+                // Live util/claim/status is inlined above when the pool is active;
+                // single-account mode has no pool, so point at the pool view instead.
+                ...(live ? {} : { note: 'live rate-limit / utilization is at GET /accounts when pool mode is active' }),
             });
             return true;
         }
@@ -178,7 +240,8 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
             const alias = decodeURIComponent(urlPath.slice(ACCOUNTS_PREFIX.length));
             const removed = await removeAccount(alias); // validates alias internally
             if (removed)
-                deps.onAccountsChanged?.();
+                await deps.onAccountsChanged?.();
+            deps.audit?.({ action: 'account_remove', ok: removed, status: removed ? 200 : 404, alias, remote });
             send(res, removed ? 200 : 404, { alias, removed });
             return true;
         }

package/dist/analytics.d.ts

@@ -83,6 +83,21 @@ export declare const NO_BILLING_CLAIM = "unknown";
  * the proxy on every transient non-200/stream-abort.
  */
 export declare function isNonSubscriptionBilling(claim: string | null | undefined): boolean;
+interface Rate {
+    input: number;
+    output: number;
+    cacheRead: number;
+    cacheCreate: number;
+}
+/**
+ * The per-1M-token rate for `model` in effect at `atMs` (epoch ms): the intro
+ * rate while within its window, otherwise the standard rate. A trailing context
+ * tag (`claude-sonnet-5[1m]`, `claude-opus-4-7[1m]`) is stripped before lookup —
+ * the [1m] ids used to fall through to the sonnet fallback and bill at the wrong
+ * family's rate. Unknown models fall back to the sonnet-4-6 rate. Exported for
+ * tests.
+ */
+export declare function pricingRateFor(model: string, atMs: number): Rate;
 export declare class Analytics extends EventEmitter {
     private records;
     private maxRecords;

package/dist/analytics.js

@@ -74,26 +74,47 @@ export function isNonSubscriptionBilling(claim) {
         return false;
     return !SUBSCRIPTION_CLAIMS.has(claim);
 }
-// Anthropic pricing (per 1M tokens, USD). Not authoritative — used for
-// rough burn-rate display in the /analytics summary.
 const PRICING = {
-    // Fable 5 official per-token pricing wasn't published at integration time
-    // (2026-06-09) — assumed at the current flagship (opus-4-8) rate. Display-only.
-    'claude-fable-5': { input: 5, output: 25, cacheRead: 0.5, cacheCreate: 6.25 },
+    // Fable 5 — official pricing (published with the 2026-07-01 redeploy):
+    // $10/$50 per 1M in/out, 5m cache-write $12.50, cache-read $1 (platform docs).
+    // Was previously assumed at the opus-4-8 rate ($5/$25) — corrected here.
+    'claude-fable-5': { input: 10, output: 50, cacheRead: 1, cacheCreate: 12.5 },
     'claude-opus-4-8': { input: 5, output: 25, cacheRead: 0.5, cacheCreate: 6.25 },
     'claude-opus-4-7': { input: 5, output: 25, cacheRead: 0.5, cacheCreate: 6.25 },
-    'claude-opus-4-6': { input: 15, output: 75, cacheRead: 1.5, cacheCreate: 18.75 },
-    // Sonnet 5 standard $3/$15; intro $2/$10 through 2026-08-31 (display estimate, not date-modeled).
-    'claude-sonnet-5': { input: 3, output: 15, cacheRead: 0.3, cacheCreate: 3.75 },
+    // Opus 4.6 is $5/$25 (same as 4.7/4.8), not the old $15/$75 Opus-4.1 rate.
+    'claude-opus-4-6': { input: 5, output: 25, cacheRead: 0.5, cacheCreate: 6.25 },
+    // Sonnet 5 standard $3/$15; launch intro $2/$10 through 2026-08-31, then
+    // standard. Cache rates follow Anthropic's usual 0.1x-read / 1.25x-write of
+    // input. Date-modeled below (was a flat display estimate before).
+    'claude-sonnet-5': {
+        input: 3, output: 15, cacheRead: 0.3, cacheCreate: 3.75,
+        intro: { input: 2, output: 10, cacheRead: 0.2, cacheCreate: 2.5, until: '2026-08-31' },
+    },
     'claude-sonnet-4-6': { input: 3, output: 15, cacheRead: 0.3, cacheCreate: 3.75 },
     'claude-haiku-4-5': { input: 0.8, output: 4, cacheRead: 0.08, cacheCreate: 1 },
 };
+/**
+ * The per-1M-token rate for `model` in effect at `atMs` (epoch ms): the intro
+ * rate while within its window, otherwise the standard rate. A trailing context
+ * tag (`claude-sonnet-5[1m]`, `claude-opus-4-7[1m]`) is stripped before lookup —
+ * the [1m] ids used to fall through to the sonnet fallback and bill at the wrong
+ * family's rate. Unknown models fall back to the sonnet-4-6 rate. Exported for
+ * tests.
+ */
+export function pricingRateFor(model, atMs) {
+    const baseModel = model.replace(/\[[^\]]*\]$/, '');
+    const entry = PRICING[baseModel] ?? PRICING['claude-sonnet-4-6'];
+    if (entry.intro && atMs <= Date.parse(`${entry.intro.until}T23:59:59.999Z`)) {
+        const { until: _until, ...introRate } = entry.intro;
+        return introRate;
+    }
+    return { input: entry.input, output: entry.output, cacheRead: entry.cacheRead, cacheCreate: entry.cacheCreate };
+}
 function estimateCost(record) {
-    // Strip a trailing context tag (`claude-fable-5[1m]`, `claude-opus-4-7[1m]`)
-    // before the lookup — the [1m] ids billed at the wrong family's rate before
-    // (fell through to the sonnet fallback).
-    const baseModel = record.model.replace(/\[[^\]]*\]$/, '');
-    const p = PRICING[baseModel] ?? PRICING['claude-sonnet-4-6'];
+    // Price each record at the rate effective at ITS OWN timestamp, so a window
+    // that spans a pricing cutover (e.g. Sonnet 5's intro ending 2026-08-31)
+    // estimates each side correctly rather than repricing history at today's rate.
+    const p = pricingRateFor(record.model, record.timestamp);
     return ((record.inputTokens * p.input) +
         (record.outputTokens * p.output) +
         (record.cacheReadTokens * p.cacheRead) +

package/dist/model-catalog.js

@@ -49,19 +49,24 @@ export const BAKED_BASE_MODELS = [
  * them, even when upstream still lists the id, because api.anthropic.com
  * returns `not_found` for every request to them.
  *
- * Claude Fable 5 AND Mythos 5 were disabled for ALL Anthropic customers by a
- * US-government legal directive on 2026-06-12 (all plans/tiers; other models
- * unaffected) — https://www.anthropic.com/news/fable-mythos-access. dario's
- * baked fallback still carries `claude-fable-5`, and upstream may still list
- * it, so without this filter dario keeps advertising a model that 404s.
+ * NOW EMPTY. Claude Fable 5 AND Mythos 5 were disabled for all Anthropic
+ * customers by a US-government export-control directive on 2026-06-12, so dario
+ * defaulted to suspending the `fable` family (it would otherwise advertise a
+ * model that 404s). The directive was lifted and **Fable 5 returned globally on
+ * 2026-07-01** — Claude Platform, Claude.ai, Claude Code, and Cowork, including
+ * Pro/Max/Team (up to 50% of weekly limits through 2026-07-07, then via credits)
+ * — https://www.anthropic.com/news/redeploying-fable-5. dario's subscription
+ * path runs on that surface, so the default suspension is removed here.
+ * (Mythos 5 is restored only to a set of US organizations, not globally — dario
+ * never carried it, so nothing to do there.)
  *
- * TEMP — reversible without a code change: `DARIO_SUSPENDED_MODELS` overrides
- * the default (comma-separated families or model ids; each is normalized to
- * its family). Set `DARIO_SUSPENDED_MODELS=` (empty) to re-enable everything
- * once access is restored. Matching is by FAMILY, so every spelling is caught:
- * `fable`, `fable1m`, `claude-fable-5`, `claude-fable-5[1m]`, `claude:fable`.
+ * The mechanism is retained for future use: `DARIO_SUSPENDED_MODELS` (comma-
+ * separated families or model ids, each normalized to its family) suspends by
+ * FAMILY, so every spelling is caught — `fable`, `fable1m`, `claude-fable-5`,
+ * `claude-fable-5[1m]`, `claude:fable`. Set e.g. `DARIO_SUSPENDED_MODELS=fable`
+ * to re-suspend if access is ever pulled again.
  */
-const DEFAULT_SUSPENDED_MODELS = 'fable';
+const DEFAULT_SUSPENDED_MODELS = '';
 /** The set of suspended families, resolved from env at call time. */
 export function suspendedFamilies() {
     const raw = process.env.DARIO_SUSPENDED_MODELS ?? DEFAULT_SUSPENDED_MODELS;

package/dist/pool.d.ts

@@ -198,3 +198,26 @@ export declare class AccountPool {
     waitForAccount(): Promise<PoolAccount>;
     private drainQueue;
 }
+/** Minimal account shape the pool needs to route — a structural subset of
+ *  accounts.ts' AccountCredentials, declared here to keep pool.ts dependency-free. */
+export interface ReconcilableAccount {
+    alias: string;
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+    deviceId: string;
+    accountUuid: string;
+}
+/**
+ * Reconcile a live pool against the current on-disk account set: add or refresh
+ * the tokens of every account that exists on disk, and drop any the pool still
+ * holds that no longer does. `add` preserves a known alias's rate-limit and
+ * identity state, so re-adding an unchanged account is a cheap token refresh
+ * rather than a reset.
+ *
+ * This is the hot-reload primitive behind the headless admin API (#599): the
+ * proxy calls it from `onAccountsChanged` so accounts provisioned or removed
+ * over HTTP take effect immediately, with no proxy restart. Returns the pool
+ * size after reconciliation.
+ */
+export declare function reconcilePoolAccounts(pool: AccountPool, accounts: ReconcilableAccount[]): number;

package/dist/pool.js

@@ -464,3 +464,32 @@ export class AccountPool {
         }
     }
 }
+/**
+ * Reconcile a live pool against the current on-disk account set: add or refresh
+ * the tokens of every account that exists on disk, and drop any the pool still
+ * holds that no longer does. `add` preserves a known alias's rate-limit and
+ * identity state, so re-adding an unchanged account is a cheap token refresh
+ * rather than a reset.
+ *
+ * This is the hot-reload primitive behind the headless admin API (#599): the
+ * proxy calls it from `onAccountsChanged` so accounts provisioned or removed
+ * over HTTP take effect immediately, with no proxy restart. Returns the pool
+ * size after reconciliation.
+ */
+export function reconcilePoolAccounts(pool, accounts) {
+    const wanted = new Set(accounts.map(a => a.alias));
+    for (const a of accounts) {
+        pool.add(a.alias, {
+            accessToken: a.accessToken,
+            refreshToken: a.refreshToken,
+            expiresAt: a.expiresAt,
+            deviceId: a.deviceId,
+            accountUuid: a.accountUuid,
+        });
+    }
+    for (const existing of pool.all()) {
+        if (!wanted.has(existing.alias))
+            pool.remove(existing.alias);
+    }
+    return pool.size;
+}

package/dist/proxy.d.ts

@@ -410,6 +410,7 @@ export interface ProxyLogEntry {
     stream?: boolean;
     reject?: string;
     error?: string;
+    event?: string;
 }
 /**
  * Append a JSON-ND line to the proxy log file. No-op when stream is

package/dist/proxy.js

@@ -11,12 +11,13 @@ import { buildHealthResponse } from './health-response.js';
 import { buildCCRequest, applyCcPromptCaching, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, CC_TEMPLATE } from './cc-template.js';
 import { stampCch } from './cch.js';
 import { describeTemplate, detectDrift, checkCCCompat } from './live-fingerprint.js';
-import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs } from './pool.js';
+import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, reconcilePoolAccounts } from './pool.js';
 import { Analytics, billingBucketFromClaim } from './analytics.js';
 import { OverageGuard, buildHaltErrorBody } from './overage-guard.js';
 import { notify as osNotify } from './notify.js';
-import { loadAllAccounts, loadAccount, refreshAccountToken, resyncLoginFromCredentialsIfStale } from './accounts.js';
+import { loadAllAccounts, loadAccount, refreshAccountToken, resyncLoginFromCredentialsIfStale, ensureLoginCredentialsInPool } from './accounts.js';
 import { handleAdminRequest } from './admin-api.js';
+import { createTokenBucket } from './rate-limit.js';
 import { getOpenAIBackend, isOpenAIModel, forwardToOpenAI } from './openai-backend.js';
 import { RequestQueue, QueueFullError, QueueTimeoutError, DEFAULT_MAX_CONCURRENT, DEFAULT_MAX_QUEUED, DEFAULT_QUEUE_TIMEOUT_MS } from './request-queue.js';
 import { redactSecrets } from './redact.js';
@@ -827,8 +828,9 @@ export async function startProxy(opts = {}) {
     if (openaiBackend) {
         console.log(`  OpenAI-compat backend: ${openaiBackend.name} → ${openaiBackend.baseUrl}`);
     }
-    // Multi-account pool — activated when ~/.dario/accounts/ has 2+ entries.
-    // Single-account dario keeps its existing code path unchanged.
+    // Multi-account pool — activated when ~/.dario/accounts/ has 2+ entries (or
+    // whenever admin mode is on; see the #599 block below). Single-account dario
+    // keeps its existing code path unchanged.
     //
     // Before loading the pool, check whether the back-filled `login` snapshot
     // has gone stale relative to credentials.json (dario#235). The single-
@@ -839,8 +841,24 @@ export async function startProxy(opts = {}) {
     if (resyncResult === 'resynced') {
         console.log('[dario] re-synced pool `login` account from current credentials.json (was stale; dario#235)');
     }
+    // Admin mode (#599) manages the account pool over HTTP, so route through the
+    // pool engine even for 0–1 accounts. This is what makes a headless deploy
+    // work: an empty pool returns a clean 503 (not the single-account path's
+    // generic upstream error), and accounts added via POST /admin/login/* take
+    // effect immediately — no proxy restart (see onAccountsChanged below).
+    //
+    // Back-fill first: an operator who enables admin mode on top of an existing
+    // single-account `dario login` setup keeps that account (ensureLogin… is a
+    // no-op when accounts/ is already populated or no credentials are reachable).
+    const adminEnabled = process.env.DARIO_ADMIN === '1';
+    if (adminEnabled) {
+        try {
+            await ensureLoginCredentialsInPool();
+        }
+        catch { /* non-fatal — pool just starts empty */ }
+    }
     const accountsList = await loadAllAccounts();
-    const pool = accountsList.length >= 2 ? new AccountPool() : null;
+    const pool = (accountsList.length >= 2 || adminEnabled) ? new AccountPool() : null;
     // Per-model rate-limit bucket families seen during this proxy run. First-
     // sight is logged once when verbose so a new Anthropic bucket (e.g. an
     // eventual `7d_opus`) doesn't slip past unnoticed. Pure observability —
@@ -914,31 +932,32 @@ export async function startProxy(opts = {}) {
         }, 15 * 60 * 1000);
         refreshInterval.unref();
         // Pool mode doesn't check single-account status — compute a placeholder
-        // for the startup banner using the pool's earliest expiry.
-        const earliest = Math.min(...pool.all().map(a => a.expiresAt));
-        const msLeft = Math.max(0, earliest - Date.now());
-        status = {
-            authenticated: true,
-            status: 'healthy',
-            expiresAt: earliest,
-            expiresIn: `${Math.floor(msLeft / 3600000)}h ${Math.floor((msLeft % 3600000) / 60000)}m`,
-        };
+        // for the startup banner using the pool's earliest expiry. An admin-mode
+        // pool can legitimately start empty (#599): report that plainly instead of
+        // Math.min([]) === Infinity, and tell the operator how to bootstrap.
+        if (pool.size === 0) {
+            console.warn('[dario] Starting with no accounts (admin mode). Add one via POST /admin/login/start; LLM requests return 503 until then.');
+            status = { authenticated: false, status: 'none', expiresAt: 0, expiresIn: 'no accounts yet' };
+        }
+        else {
+            const earliest = Math.min(...pool.all().map(a => a.expiresAt));
+            const msLeft = Math.max(0, earliest - Date.now());
+            status = {
+                authenticated: true,
+                status: 'healthy',
+                expiresAt: earliest,
+                expiresIn: `${Math.floor(msLeft / 3600000)}h ${Math.floor((msLeft % 3600000) / 60000)}m`,
+            };
+        }
     }
     else {
-        // Single-account mode — existing auth check
+        // Single-account mode — the classic `dario login` path. Admin mode never
+        // lands here: it always routes through the pool above (#599), which starts
+        // even with zero accounts and returns a clean 503 until one is added.
         status = await getStatus();
         if (!status.authenticated) {
-            if (process.env.DARIO_ADMIN === '1') {
-                // Admin API on (#599): start anyway so POST /admin/login/start can
-                // bootstrap the first account headlessly — the whole point of the API
-                // is "no console access". LLM routes return 503 until an account
-                // exists. Scoped to DARIO_ADMIN=1; default dario still exits here.
-                console.warn('[dario] No credentials yet — starting in admin-only mode (DARIO_ADMIN=1). Add an account via POST /admin/login/start (or run `dario login`); LLM requests return 503 until then.');
-            }
-            else {
-                console.error('[dario] Not authenticated. Run `dario login` first.');
-                process.exit(1);
-            }
+            console.error('[dario] Not authenticated. Run `dario login` first.');
+            process.exit(1);
         }
     }
     const cliVersion = detectCliVersion();
@@ -1131,12 +1150,22 @@ export async function startProxy(opts = {}) {
     // these endpoints add/remove OAuth accounts: the admin token is
     // DARIO_ADMIN_TOKEN, falling back to DARIO_API_KEY. Enabled-but-tokenless
     // fails closed (403) so account control is never left open on loopback.
-    const adminEnabled = process.env.DARIO_ADMIN === '1';
+    // adminEnabled is resolved once up top (it gates pool activation). Reuse it.
     const adminToken = process.env.DARIO_ADMIN_TOKEN || process.env.DARIO_API_KEY || '';
     const adminTokenBuf = adminToken ? Buffer.from(adminToken) : null;
     if (adminEnabled) {
         console.log(`[dario] admin API enabled at /admin/* (token ${adminTokenBuf ? 'configured' : 'MISSING — endpoints return 403 until DARIO_ADMIN_TOKEN is set'})`);
     }
+    // Admin rate limiting (#620). Two token buckets, created once per proxy:
+    // failed auth (brute-force / broken-client throttle) and mutations. Global,
+    // not per-IP — the surface is loopback-default so remoteAddress collapses to
+    // 127.0.0.1 (and behind a tunnel it's the tunnel address), making a single
+    // bucket per category simpler and sufficient. Disable with
+    // DARIO_ADMIN_RATE_LIMIT=off. Defaults are generous for a human operator +
+    // scripts and only bite runaway callers.
+    const adminRateLimitOff = /^(off|0|false)$/i.test(process.env.DARIO_ADMIN_RATE_LIMIT ?? '');
+    const adminAuthBucket = createTokenBucket(10, 0.5); // 10 burst, then 1 / 2s
+    const adminMutationBucket = createTokenBucket(30, 1); // 30 burst, then 1 / 1s
     // CORS origin defaults to the localhost URL the proxy is served at. Users
     // binding to a non-loopback address (e.g. a Tailscale interface) can
     // override via DARIO_CORS_ORIGIN — otherwise browser-based clients hitting
@@ -1210,9 +1239,68 @@ export async function startProxy(opts = {}) {
         if (adminEnabled && urlPath.startsWith('/admin/')) {
             const handled = await handleAdminRequest(req, res, urlPath, {
                 adminTokenBuf,
-                onAccountsChanged: () => {
-                    if (verbose)
-                        console.log('[dario] admin: account pool changed on disk (effective on next proxy restart)');
+                onAccountsChanged: async () => {
+                    // Hot-reload the live pool from disk so accounts added / removed via
+                    // the admin API take effect immediately — no proxy restart (#599).
+                    // Awaited by handleAdminRequest before it responds, so the account is
+                    // already routable by the time the client sees the 200.
+                    if (!pool)
+                        return;
+                    try {
+                        const size = reconcilePoolAccounts(pool, await loadAllAccounts());
+                        if (verbose)
+                            console.log(`[dario] admin: pool hot-reloaded — ${size} account${size === 1 ? '' : 's'}`);
+                    }
+                    catch (err) {
+                        console.error(`[dario] admin: pool hot-reload failed: ${err instanceof Error ? err.message : err}`);
+                    }
+                },
+                // Live per-account status so GET /admin/accounts reports headroom, not
+                // just persisted metadata — the same snapshot GET /accounts exposes.
+                poolStatus: () => {
+                    if (!pool)
+                        return null;
+                    const snapNow = Date.now();
+                    const snap = new Map();
+                    for (const a of pool.all()) {
+                        snap.set(a.alias, {
+                            util5h: a.rateLimit.util5h,
+                            util7d: a.rateLimit.util7d,
+                            claim: a.rateLimit.claim,
+                            status: isInAuthCooldown(a, snapNow) ? 'auth-cooldown' : a.rateLimit.status,
+                            requestCount: a.requestCount,
+                        });
+                    }
+                    return snap;
+                },
+                // Audit trail for admin activity. Console always (headless operators
+                // read container stdout; the JSON log file is opt-in), plus a structured
+                // line when --log-file / DARIO_LOG_FILE is set.
+                audit: (e) => {
+                    const detail = e.detail ? ` detail=${e.detail}` : '';
+                    const line = `[dario] admin-audit: ${e.action} alias=${e.alias ?? '-'} ok=${e.ok} status=${e.status} from=${e.remote ?? '-'}${detail}`;
+                    if (e.ok)
+                        console.log(line);
+                    else
+                        console.warn(line);
+                    writeLogLine(logFileStream, {
+                        ts: new Date().toISOString(),
+                        req: 0,
+                        method: req.method ?? '',
+                        path: urlPath,
+                        status: e.status,
+                        event: `admin.${e.action}`,
+                        account: e.alias,
+                        reject: e.ok ? undefined : 'admin-auth',
+                    });
+                },
+                // Token-bucket gate (#620). 0 = allowed (token consumed); >0 = throttled,
+                // the ms to wait. Off switch short-circuits to always-allowed.
+                rateLimit: (category) => {
+                    if (adminRateLimitOff)
+                        return 0;
+                    const bucket = category === 'auth' ? adminAuthBucket : adminMutationBucket;
+                    return bucket.tryRemove() ? 0 : bucket.retryAfterMs();
                 },
             });
             if (handled)
@@ -1520,8 +1608,23 @@ export async function startProxy(opts = {}) {
             else if (pool) {
                 poolAccount = pool.select();
                 if (!poolAccount) {
+                    // Two distinct empty-selection cases (#599): the pool has no accounts
+                    // at all (headless admin bootstrap — nothing added yet), vs. it has
+                    // accounts but all are rate-limited / in auth cool-down. Give each a
+                    // truthful, actionable message so a headless operator isn't told
+                    // "rate-limited" when they simply haven't added an account.
                     res.writeHead(503, JSON_HEADERS);
-                    res.end(JSON.stringify({ error: 'No accounts available in pool' }));
+                    res.end(JSON.stringify(pool.size === 0
+                        ? {
+                            error: 'No account configured',
+                            message: adminEnabled
+                                ? 'dario is running in admin mode with no account yet. Add one via POST /admin/login/start, then retry.'
+                                : 'No accounts available. Run `dario login`, or add accounts with `dario accounts add`.',
+                        }
+                        : {
+                            error: 'No accounts available in pool',
+                            message: 'all accounts are rate-limited or in auth cool-down; retry shortly',
+                        }));
                     return;
                 }
                 accessToken = poolAccount.accessToken;
@@ -1681,13 +1784,12 @@ export async function startProxy(opts = {}) {
                     const result = isOpenAI ? openaiToAnthropic(parsed, modelOverride) : (modelOverride ? { ...parsed, model: modelOverride } : parsed);
                     const r = result;
                     requestModel = (r.model || '').toLowerCase();
-                    // Suspended-model guard. Fable 5 / Mythos 5 are disabled for ALL
-                    // Anthropic customers (US-gov directive 2026-06-12); forwarding any
-                    // spelling of them 404s upstream with a confusing not_found. Reject
-                    // up front with an actionable error instead — runs before the
-                    // template build / account lease / forwarding, so nothing to unwind.
-                    // TEMP + reversible: governed by DARIO_SUSPENDED_MODELS (default
-                    // 'fable'); set it empty to re-enable when access is restored.
+                    // Suspended-model guard. Empty by default (Fable 5 returned globally
+                    // 2026-07-01, so nothing is suspended out of the box). Operators can
+                    // still suspend a family via DARIO_SUSPENDED_MODELS — e.g. a model
+                    // that 404s upstream — and this rejects any spelling of it up front
+                    // with an actionable error, before the template build / account lease
+                    // / forwarding, so there's nothing to unwind.
                     if (requestModel && isSuspendedModel(requestModel)) {
                         if (verbose)
                             console.log(`[dario] suspended model rejected: ${requestModel} (${urlPath})`);
@@ -1696,7 +1798,7 @@ export async function startProxy(opts = {}) {
                             type: 'error',
                             error: {
                                 type: 'not_found_error',
-                                message: `Model "${requestModel}" is suspended in this dario instance. Claude Fable 5 and Mythos 5 are disabled for all Anthropic customers (US government directive 2026-06-12 — https://www.anthropic.com/news/fable-mythos-access). Use claude-opus-4-8 or claude-sonnet-4-6 instead. To re-enable when access is restored, set DARIO_SUSPENDED_MODELS= (empty) on the dario instance.`,
+                                message: `Model "${requestModel}" is suspended in this dario instance via DARIO_SUSPENDED_MODELS. Use claude-opus-4-8 or claude-sonnet-4-6 instead, or clear that family from DARIO_SUSPENDED_MODELS to re-enable it.`,
                             },
                         }));
                         return;

package/dist/rate-limit.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Minimal token-bucket rate limiter (#620).
+ *
+ * Zero-dependency, in-memory, monotonic-time refill. Used to throttle the
+ * admin API's mutations and repeated auth failures (src/admin-api.ts), but
+ * kept generic. The clock is injectable so the refill math is deterministic
+ * under test — no `sleep`.
+ *
+ * `tryRemove()` consumes one token if any are available; `retryAfterMs()`
+ * reports how long until the next token, for a `Retry-After` header.
+ */
+export interface RateLimiter {
+    /** Consume one token. Returns true if allowed, false if the bucket is empty. */
+    tryRemove(nowMs?: number): boolean;
+    /** Milliseconds until at least one token is available (0 if available now). */
+    retryAfterMs(nowMs?: number): number;
+}
+/**
+ * @param capacity     max tokens (burst size); also the starting fill.
+ * @param refillPerSec tokens added per second (fractional allowed).
+ * @param now          clock in ms; injectable for tests.
+ */
+export declare function createTokenBucket(capacity: number, refillPerSec: number, now?: () => number): RateLimiter;

package/dist/rate-limit.js

@@ -0,0 +1,33 @@
+/**
+ * @param capacity     max tokens (burst size); also the starting fill.
+ * @param refillPerSec tokens added per second (fractional allowed).
+ * @param now          clock in ms; injectable for tests.
+ */
+export function createTokenBucket(capacity, refillPerSec, now = Date.now) {
+    let tokens = capacity;
+    let last = now();
+    function refill(t) {
+        if (t <= last)
+            return; // clock didn't advance — nothing to add
+        tokens = Math.min(capacity, tokens + ((t - last) / 1000) * refillPerSec);
+        last = t;
+    }
+    return {
+        tryRemove(nowMs = now()) {
+            refill(nowMs);
+            if (tokens >= 1) {
+                tokens -= 1;
+                return true;
+            }
+            return false;
+        },
+        retryAfterMs(nowMs = now()) {
+            refill(nowMs);
+            if (tokens >= 1)
+                return 0;
+            if (refillPerSec <= 0)
+                return Infinity; // never refills
+            return Math.ceil(((1 - tokens) / refillPerSec) * 1000);
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "4.8.110",
+  "version": "4.8.111",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {