@askalf/dario 4.8.116 → 4.8.117

package/dist/health-response.d.ts

@@ -25,4 +25,18 @@ export interface HealthResponse {
     httpStatus: number;
     body: Record<string, unknown>;
 }
+export interface PoolAccountStatusLike {
+    expiresAt: number;
+    inAuthCooldown: boolean;
+}
+export interface PoolDerivedStatus {
+    authenticated: boolean;
+    status: 'healthy' | 'broken' | 'none';
+    expiresAt?: number;
+    expiresIn?: string;
+    /** Distinguishes the pool-derived shape from single-account getStatus(). */
+    mode: 'pool';
+    accounts: number;
+}
+export declare function derivePoolStatus(accounts: readonly PoolAccountStatusLike[], now: number, adminEnabled: boolean): PoolDerivedStatus;
 export declare function buildHealthResponse(s: HealthStatusLike, requestCount: number, viaPublicTunnel: boolean): HealthResponse;

package/dist/health-response.js

@@ -14,6 +14,51 @@
  * The HTTP status (200 healthy / 503 degraded) is identical either way, so external
  * uptime monitoring that keys on the status code is unaffected.
  */
+function formatMsLeft(ms) {
+    const clamped = Math.max(0, ms);
+    return `${Math.floor(clamped / 3_600_000)}h ${Math.floor((clamped % 3_600_000) / 60_000)}m`;
+}
+export function derivePoolStatus(accounts, now, adminEnabled) {
+    if (accounts.length === 0) {
+        // Empty admin pool: 'none'/503 is CORRECT here (every LLM request 503s
+        // until an account exists) — but say how to fix it instead of implying
+        // `dario login`, which is exactly what an admin-mode operator avoids.
+        return {
+            authenticated: false,
+            status: 'none',
+            mode: 'pool',
+            accounts: 0,
+            expiresIn: adminEnabled
+                ? 'no accounts yet — add one via POST /admin/login/start'
+                : 'no accounts yet — run `dario accounts add <alias>`',
+        };
+    }
+    const usable = accounts.filter((a) => !a.inAuthCooldown);
+    if (usable.length === 0) {
+        // Every account is routing-excluded after upstream auth failures — the
+        // next request will fail, which is the deadness /health exists to signal.
+        return {
+            authenticated: false,
+            status: 'broken',
+            mode: 'pool',
+            accounts: accounts.length,
+            expiresAt: Math.min(...accounts.map((a) => a.expiresAt)),
+            expiresIn: 'all accounts in auth-cooldown',
+        };
+    }
+    // Earliest expiry among USABLE accounts — the pool's background refresh
+    // (15-min loop) keeps these rolling, mirroring what the startup banner
+    // reports for a warm pool.
+    const earliest = Math.min(...usable.map((a) => a.expiresAt));
+    return {
+        authenticated: true,
+        status: 'healthy',
+        mode: 'pool',
+        accounts: accounts.length,
+        expiresAt: earliest,
+        expiresIn: formatMsLeft(earliest - now),
+    };
+}
 export function buildHealthResponse(s, requestCount, viaPublicTunnel) {
     const dead = s.status === 'broken' ||
         s.status === 'none' ||

package/dist/model-catalog.d.ts

@@ -118,4 +118,14 @@ export declare function getModelCatalog(deps?: CatalogDeps): Promise<ModelCatalo
 export declare function getCachedBases(): readonly string[];
 /** Fire-and-forget warmup so the first client /v1/models call is served warm. */
 export declare function prewarmModelCatalog(deps?: CatalogDeps): void;
+/**
+ * Reset the failed-fetch backoff and kick a refetch now. For the moment
+ * upstream auth first becomes available — e.g. the first account hot-added
+ * through the admin API (#599): the startup prewarm was skipped (or a client
+ * /v1/models call already failed) while the pool was empty, and the 5-min
+ * retry backoff would otherwise keep serving the baked list even though a
+ * bearer now exists (#636). No-ops into a plain cache read when the catalog
+ * is already fresh from upstream.
+ */
+export declare function retryModelCatalogNow(deps?: CatalogDeps): void;
 export declare function _resetModelCatalogForTest(): void;

package/dist/model-catalog.js

@@ -302,6 +302,19 @@ export function getCachedBases() {
 export function prewarmModelCatalog(deps = {}) {
     void getModelCatalog(deps);
 }
+/**
+ * Reset the failed-fetch backoff and kick a refetch now. For the moment
+ * upstream auth first becomes available — e.g. the first account hot-added
+ * through the admin API (#599): the startup prewarm was skipped (or a client
+ * /v1/models call already failed) while the pool was empty, and the 5-min
+ * retry backoff would otherwise keep serving the baked list even though a
+ * bearer now exists (#636). No-ops into a plain cache read when the catalog
+ * is already fresh from upstream.
+ */
+export function retryModelCatalogNow(deps = {}) {
+    lastAttempt = 0;
+    void getModelCatalog(deps);
+}
 export function _resetModelCatalogForTest() {
     cache = null;
     lastAttempt = 0;

package/dist/proxy.js

@@ -7,7 +7,7 @@ import { homedir } from 'node:os';
 import { setDefaultResultOrder } from 'node:dns';
 import { arch, platform } from 'node:process';
 import { getAccessToken, getStatus } from './oauth.js';
-import { buildHealthResponse } from './health-response.js';
+import { buildHealthResponse, derivePoolStatus } from './health-response.js';
 import { buildCCRequest, applyCcPromptCaching, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, CC_TEMPLATE } from './cc-template.js';
 import { stampCch } from './cch.js';
 import { describeTemplate, detectDrift, checkCCCompat } from './live-fingerprint.js';
@@ -21,7 +21,7 @@ import { createTokenBucket } from './rate-limit.js';
 import { getOpenAIBackend, isOpenAIModel, forwardToOpenAI } from './openai-backend.js';
 import { RequestQueue, QueueFullError, QueueTimeoutError, DEFAULT_MAX_CONCURRENT, DEFAULT_MAX_QUEUED, DEFAULT_QUEUE_TIMEOUT_MS } from './request-queue.js';
 import { redactSecrets } from './redact.js';
-import { BAKED_BASE_MODELS, withLongContextVariants, buildOpenAIModelsList, getModelCatalog, getCachedBases, resolveAliasAgainst, prewarmModelCatalog, isSuspendedModel } from './model-catalog.js';
+import { BAKED_BASE_MODELS, withLongContextVariants, buildOpenAIModelsList, getModelCatalog, getCachedBases, resolveAliasAgainst, prewarmModelCatalog, retryModelCatalogNow, isSuspendedModel } from './model-catalog.js';
 const ANTHROPIC_API = 'https://api.anthropic.com';
 const DEFAULT_PORT = 3456;
 const MAX_BODY_BYTES = 10 * 1024 * 1024; // 10 MB — generous for large prompts, prevents abuse
@@ -1201,17 +1201,50 @@ export async function startProxy(opts = {}) {
         ...SECURITY_HEADERS,
     };
     const JSON_HEADERS = { 'Content-Type': 'application/json', ...SECURITY_HEADERS };
+    // Pool-aware status for /status + /health (#636). In pool mode the legacy
+    // single-account getStatus() reads credentials.json, which a login-less
+    // pool setup (#618 pool-at-1, #599 admin bootstrap) legitimately doesn't
+    // have — those endpoints reported none/503 while the pool served fine,
+    // breaking docker healthchecks and making the TUI claim the proxy was down.
+    async function currentStatus() {
+        if (!pool)
+            return getStatus();
+        const now = Date.now();
+        return derivePoolStatus(pool.all().map((a) => ({ expiresAt: a.expiresAt, inAuthCooldown: isInAuthCooldown(a, now) })), now, adminEnabled);
+    }
     // Model catalog wiring — /v1/models serves the upstream-autodetected set,
     // authenticated the same way the request path is (per-token API key when
-    // ANTHROPIC_UPSTREAM_API_KEY is set, OAuth bearer otherwise). Prewarmed so
-    // the first client call is answered from cache; every failure path inside
+    // ANTHROPIC_UPSTREAM_API_KEY is set, OAuth bearer otherwise — from the pool
+    // when pool mode is active, so a login-less setup doesn't fail the fetch
+    // with a misleading "Run `dario login` first" (#636)). Prewarmed so the
+    // first client call is answered from cache; every failure path inside
     // getModelCatalog falls back to the baked list, so the route always 200s.
     const catalogDeps = {
         upstreamApiKey: upstreamApiKey || undefined,
-        getToken: getAccessToken,
+        getToken: pool
+            ? async () => {
+                const now = Date.now();
+                const accounts = pool.all();
+                if (accounts.length === 0) {
+                    throw new Error(adminEnabled
+                        ? 'pool has no accounts yet — add one via POST /admin/login/start'
+                        : 'pool has no accounts yet — run `dario accounts add <alias>`');
+                }
+                const usable = accounts.filter((a) => !isInAuthCooldown(a, now) && a.expiresAt > now);
+                return (usable[0] ?? accounts[0]).accessToken;
+            }
+            : getAccessToken,
         log: verbose ? (m) => console.log(m) : undefined,
     };
-    prewarmModelCatalog(catalogDeps);
+    if (pool && pool.size === 0) {
+        // Empty admin pool: skip the prewarm instead of logging a guaranteed
+        // failure at startup. The catalog refetches when the first account is
+        // hot-added (onAccountsChanged below).
+        console.log('[dario] model catalog: no accounts yet — serving baked list until one is added');
+    }
+    else {
+        prewarmModelCatalog(catalogDeps);
+    }
     const ERR_UNAUTH = JSON.stringify({ error: 'Unauthorized', message: 'Invalid or missing API key' });
     const ERR_FORBIDDEN = JSON.stringify({ error: 'Forbidden', message: 'Path not allowed. Supported paths: POST /v1/messages, POST /v1/messages/count_tokens, POST /v1/chat/completions, GET /v1/models' });
     const ERR_METHOD = JSON.stringify({ error: 'Method not allowed' });
@@ -1234,7 +1267,7 @@ export async function startProxy(opts = {}) {
         // and dependent services (`depends_on: service_healthy`) need this to
         // react instead of cheerfully passing while every /v1/messages 401s.
         if (urlPath === '/health' || urlPath === '/') {
-            const s = await getStatus();
+            const s = await currentStatus();
             // Public requests arrive through the Cloudflare tunnel (the edge stamps
             // `cf-ray`); they get only the liveness verdict, never the OAuth internals.
             // See buildHealthResponse for the full rationale.
@@ -1263,6 +1296,12 @@ export async function startProxy(opts = {}) {
                         const size = reconcilePoolAccounts(pool, await loadAllAccounts());
                         if (verbose)
                             console.log(`[dario] admin: pool hot-reloaded — ${size} account${size === 1 ? '' : 's'}`);
+                        // The startup prewarm was skipped (or failed) while the pool was
+                        // empty; now that a bearer exists, refetch past the failed-fetch
+                        // backoff so /v1/models upgrades from the baked list without
+                        // waiting out the retry window (#636).
+                        if (size > 0)
+                            retryModelCatalogNow(catalogDeps);
                     }
                     catch (err) {
                         console.error(`[dario] admin: pool hot-reload failed: ${err instanceof Error ? err.message : err}`);
@@ -1336,7 +1375,7 @@ export async function startProxy(opts = {}) {
         }
         // Status endpoint
         if (urlPath === '/status') {
-            const s = await getStatus();
+            const s = await currentStatus();
             res.writeHead(200, JSON_HEADERS);
             res.end(JSON.stringify(s));
             return;

package/dist/tui/proxy-client.d.ts

@@ -30,13 +30,20 @@ export declare class ProxyClient {
     constructor(opts: ProxyClientOpts);
     /**
      * GET a JSON endpoint. Rejects on non-2xx, network failure, JSON
-     * parse error, or timeout.
+     * parse error, or timeout. `opts.anyStatus` accepts every HTTP status
+     * and parses the body regardless — for endpoints like /health that
+     * deliberately answer 503 with a JSON body.
      */
-    getJson<T = unknown>(path: string): Promise<T>;
+    getJson<T = unknown>(path: string, opts?: {
+        anyStatus?: boolean;
+    }): Promise<T>;
     /**
-     * Reachability probe — GET /health, returns parsed payload on
-     * success or null on any failure. Never throws; callers use the
-     * null as "proxy not running / unreachable".
+     * Reachability probe — GET /health, returns the parsed payload or null.
+     * /health answers 503 WITH a JSON body when upstream auth is degraded —
+     * that's a running proxy telling us it's unhealthy, not an unreachable
+     * proxy, so any HTTP response with a JSON body resolves (#636). Null is
+     * reserved for no-HTTP-response-at-all (connection refused, timeout) or
+     * a non-JSON body (something else is squatting on the port).
      */
     health(): Promise<HealthResponse | null>;
     /**

package/dist/tui/proxy-client.js

@@ -28,9 +28,11 @@ export class ProxyClient {
     }
     /**
      * GET a JSON endpoint. Rejects on non-2xx, network failure, JSON
-     * parse error, or timeout.
+     * parse error, or timeout. `opts.anyStatus` accepts every HTTP status
+     * and parses the body regardless — for endpoints like /health that
+     * deliberately answer 503 with a JSON body.
      */
-    async getJson(path) {
+    async getJson(path, opts) {
         const url = new URL(this.baseUrl + path);
         return new Promise((resolve, reject) => {
             const req = httpRequest({
@@ -44,7 +46,7 @@ export class ProxyClient {
                 res.on('data', (c) => chunks.push(c));
                 res.on('end', () => {
                     const body = Buffer.concat(chunks).toString('utf-8');
-                    if (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300) {
+                    if (!opts?.anyStatus && (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300)) {
                         reject(new Error(`HTTP ${res.statusCode}: ${body.slice(0, 200)}`));
                         return;
                     }
@@ -65,13 +67,16 @@ export class ProxyClient {
         });
     }
     /**
-     * Reachability probe — GET /health, returns parsed payload on
-     * success or null on any failure. Never throws; callers use the
-     * null as "proxy not running / unreachable".
+     * Reachability probe — GET /health, returns the parsed payload or null.
+     * /health answers 503 WITH a JSON body when upstream auth is degraded —
+     * that's a running proxy telling us it's unhealthy, not an unreachable
+     * proxy, so any HTTP response with a JSON body resolves (#636). Null is
+     * reserved for no-HTTP-response-at-all (connection refused, timeout) or
+     * a non-JSON body (something else is squatting on the port).
      */
     async health() {
         try {
-            return await this.getJson('/health');
+            return await this.getJson('/health', { anyStatus: true });
         }
         catch {
             return null;

package/dist/tui/tabs/status.js

@@ -88,7 +88,12 @@ export const StatusTab = {
         // ── Proxy section ──────────────────────────────────────────
         lines.push(' ' + brand('Proxy'));
         if (state.health) {
-            lines.push('  ' + renderKvRow('Status', fg('green', state.health.status), w - 4));
+            // /health answers 'degraded' (HTTP 503) from a RUNNING proxy whose
+            // upstream auth is unhealthy — render that honestly instead of the old
+            // behavior of collapsing any non-2xx into "unreachable" (#636).
+            const healthOk = state.health.status === 'ok';
+            lines.push('  ' + renderKvRow('Status', healthOk ? fg('green', state.health.status)
+                : fg('yellow', `${state.health.status} — proxy running, upstream auth not ready`), w - 4));
             lines.push('  ' + renderKvRow('OAuth', formatOauth(state.health.oauth, state.health.expiresIn), w - 4));
             lines.push('  ' + renderKvRow('Requests', String(state.health.requests ?? 0), w - 4));
         }
@@ -220,8 +225,11 @@ function formatOauth(label, expiresIn) {
         return fg('yellow', 'expired (refresh on next request)');
     if (label === 'broken')
         return fg('red', 'broken — run `dario login`');
+    // Pool mode passes a how-to-fix hint through expiresIn (e.g. "no accounts
+    // yet — add one via POST /admin/login/start"); single-account 'none' has no
+    // expiresIn and keeps the classic label.
     if (label === 'none')
-        return dim('no credentials');
+        return dim(expiresIn ? `none — ${expiresIn}` : 'no credentials');
     return label;
 }
 function formatAgo(ts) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "4.8.116",
+  "version": "4.8.117",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {