@askalf/dario 4.8.116 → 4.8.118

package/README.md

@@ -18,8 +18,6 @@
 
 > 🗓️ **2026-06-15 — Anthropic splits Claude billing.** Agent-SDK and `claude -p` (headless) traffic stops counting against your subscription pool and moves to a small separate monthly credit ($20 / $100 / $200 by plan), then metered per-token API rates. Most proxies forward your requests in exactly the shape that gets reclassified into that bucket. dario rewrites every request into interactive Claude Code wire-shape before it leaves your machine, so your traffic stays in the subscription pool you already pay for — same install, no config change for the cliff. **[What changes, and how to verify it on your own machine →](#the-deadline-2026-06-15)**
 
-> ⛔ **Claude Fable 5 / Mythos 5 — temporarily suspended for all Anthropic customers.** On 2026-06-12 a US-government legal directive disabled Fable 5 and Mythos 5 for **every** Anthropic plan and tier — `api.anthropic.com` now returns `not_found` for them, and no account or proxy can route around it ([details](https://www.anthropic.com/news/fable-mythos-access)). As of **v4.8.71**, dario filters both families out of `/v1/models` and rejects any spelling (`fable`, `fable1m`, `claude-fable-5`, `claude-fable-5[1m]`, `claude:fable`) up front with a clean `404` pointing at `claude-opus-4-8` / `claude-sonnet-5` — instead of forwarding into a confusing upstream error. Reversible without a code change once access is restored: set `DARIO_SUSPENDED_MODELS=` (empty) on the instance. `npm install -g @askalf/dario@latest`
->
 > ⚠️ Still on a version **before 4.8.39**? Upgrade now — those could silently corrupt code/structured content routed through the proxy (the identifier scrub stripped tokens like the JS `continue` keyword). **[Details →](https://github.com/askalf/dario/issues/457)**
 
 ---
@@ -194,7 +192,7 @@ You point every tool at one URL. dario reads each request, decides which backend
 
 The tool doesn't know. The backend doesn't know. dario is the seam.
 
-**The full Claude lineup, autodetected.** Opus 4.8, Sonnet 5, and Haiku 4.5 — plus `[1m]` long-context variants, generated by one rule for every family — by full id (`claude-opus-4-8`) or shortcut (`opus` / `sonnet` / `haiku`, append `1m` for the long-context form). `GET /v1/models` asks Anthropic's live catalog (TTL-cached, baked fallback when offline), and the family shortcuts track it — a new model shows up and resolves the day it lands, no dario release needed; the model-specific wire shape (effort level, beta set, thinking config) is applied automatically. **Globally-suspended families are filtered out** of both the live catalog and the baked fallback, so `/v1/models` never advertises a model that 404s upstream and suspended ids are rejected locally with an actionable error — currently Claude Fable 5 and Mythos 5 (US-government directive, 2026-06-12); governed by `DARIO_SUSPENDED_MODELS` (default `fable`), set it empty to re-enable when access is restored.
+**The full Claude lineup, autodetected.** Opus 4.8, Sonnet 5, and Haiku 4.5 — plus `[1m]` long-context variants, generated by one rule for every family — by full id (`claude-opus-4-8`) or shortcut (`opus` / `sonnet` / `haiku`, append `1m` for the long-context form). `GET /v1/models` asks Anthropic's live catalog (TTL-cached, baked fallback when offline), and the family shortcuts track it — a new model shows up and resolves the day it lands, no dario release needed; the model-specific wire shape (effort level, beta set, thinking config) is applied automatically. **Suspended families are filtered out** of both the live catalog and the baked fallback, so `/v1/models` never advertises a model that 404s upstream and suspended ids are rejected locally with an actionable error. Nothing is suspended by default; the mechanism is retained via `DARIO_SUSPENDED_MODELS` (comma-separated families, every spelling caught) for if a family is ever pulled upstream again.
 
 ---
 
@@ -224,6 +222,7 @@ Tune via `~/.dario/config.json` → `overageGuard`, or CLI flags: `--overage-beh
 ## Capabilities
 
 - **Multi-account pool.** Drop Claude accounts in `~/.dario/accounts/` and pool mode auto-activates — one is enough to serve, so `dario accounts add` alone bootstraps a proxy with no `dario login` step. With more, every request routes to the account with the most headroom, multi-turn sessions pin to one account so the prompt cache survives, in-flight 429s fail over to a peer before your client sees an error. → [`docs/multi-account-pool.md`](./docs/multi-account-pool.md)
+- **Headless admin API (`DARIO_ADMIN=1`).** Provision and manage pool accounts entirely over HTTP — start with zero accounts, `POST /admin/login/start`, paste the code back, and the account is routable the moment the `200` lands (live pool hot-reload, no restart). Token-gated even on loopback, audit-logged, rate-limited; `GET /admin/accounts` reports live per-account headroom. Built for Docker / k8s / Raspberry-Pi deployments where a console is the awkward part. → [`docs/admin-api.md`](./docs/admin-api.md)
 - **Behavioral stealth (`--stealth`).** Static wire fidelity covers *what* the request looks like; `--stealth` adds *when* it arrives — response-length-correlated think time and 1.2–4.2s session-start latency, the inter-arrival pattern real interactive sessions have and agent loops don't. → [`docs/wire-fidelity.md`](./docs/wire-fidelity.md)
 - **Runs any non-Claude-Code agent.** A 64-entry schema-verified `TOOL_MAP` pre-maps Cline, Roo, Kilo, Cursor, Windsurf, Continue, Copilot, OpenHands, OpenClaw, Hermes, [hands](https://github.com/askalf/hands) tool names to CC's native set. No flag, no validator errors. → [`docs/integrations/agent-compat.md`](./docs/integrations/agent-compat.md)
 - **Recover output capability.** `dario proxy --system-prompt=partial` strips CC's tone/verbosity/no-comments constraints for 1.2–2.8× more output on open-ended work — empirically without flipping billing (the classifier doesn't read that slot). [Discussion #183](https://github.com/askalf/dario/discussions/183) has the per-prompt receipts. → [`docs/system-prompt.md`](./docs/system-prompt.md)
@@ -302,9 +301,6 @@ No. `five_hour` and `seven_day` are both subscription billing — different acco
 **Will the 2026-06-15 split break my setup? / What if Anthropic ships another silent change?**
 No, and it's caught automatically — see [The deadline](#the-deadline-2026-06-15) and [How it stays working](#how-it-works-and-how-it-stays-working). dario rewrites every request to interactive-CC shape before it reaches `api.anthropic.com`, and the three-class drift watcher picks up new changes (npm-release hourly, remote-config every 30 min, classifier-rule daily). v3.38.5 + v3.38.6 — 13 minutes apart, same day as v2.1.142's silent drops — are the prior art.
 
-**I'm getting `404 not_found` for `claude-fable-5` / `fable`. Did dario break?**
-No — Claude Fable 5 and Mythos 5 were disabled for **all** Anthropic customers by a US-government legal directive on 2026-06-12 (every plan and tier; [details](https://www.anthropic.com/news/fable-mythos-access)). `api.anthropic.com` returns `not_found` for them, so no subscription or proxy can route them. Since v4.8.71 dario drops both families from `/v1/models` and rejects them locally with a clear 404 pointing at `claude-opus-4-8` / `claude-sonnet-5`, instead of forwarding into a confusing upstream error. When access is restored, set `DARIO_SUSPENDED_MODELS=` (empty) on the instance to re-enable — no upgrade needed.
-
 Full FAQ: [`docs/faq.md`](./docs/faq.md)
 
 ---

package/dist/health-response.d.ts

@@ -20,9 +20,25 @@ export interface HealthStatusLike {
     expiresIn?: string;
     refreshFailures?: number;
     lastRefreshError?: string;
+    /** dario's package version, surfaced to internal callers on /health (#640). */
+    version?: string;
 }
 export interface HealthResponse {
     httpStatus: number;
     body: Record<string, unknown>;
 }
+export interface PoolAccountStatusLike {
+    expiresAt: number;
+    inAuthCooldown: boolean;
+}
+export interface PoolDerivedStatus {
+    authenticated: boolean;
+    status: 'healthy' | 'broken' | 'none';
+    expiresAt?: number;
+    expiresIn?: string;
+    /** Distinguishes the pool-derived shape from single-account getStatus(). */
+    mode: 'pool';
+    accounts: number;
+}
+export declare function derivePoolStatus(accounts: readonly PoolAccountStatusLike[], now: number, adminEnabled: boolean): PoolDerivedStatus;
 export declare function buildHealthResponse(s: HealthStatusLike, requestCount: number, viaPublicTunnel: boolean): HealthResponse;

package/dist/health-response.js

@@ -14,6 +14,51 @@
  * The HTTP status (200 healthy / 503 degraded) is identical either way, so external
  * uptime monitoring that keys on the status code is unaffected.
  */
+function formatMsLeft(ms) {
+    const clamped = Math.max(0, ms);
+    return `${Math.floor(clamped / 3_600_000)}h ${Math.floor((clamped % 3_600_000) / 60_000)}m`;
+}
+export function derivePoolStatus(accounts, now, adminEnabled) {
+    if (accounts.length === 0) {
+        // Empty admin pool: 'none'/503 is CORRECT here (every LLM request 503s
+        // until an account exists) — but say how to fix it instead of implying
+        // `dario login`, which is exactly what an admin-mode operator avoids.
+        return {
+            authenticated: false,
+            status: 'none',
+            mode: 'pool',
+            accounts: 0,
+            expiresIn: adminEnabled
+                ? 'no accounts yet — add one via POST /admin/login/start'
+                : 'no accounts yet — run `dario accounts add <alias>`',
+        };
+    }
+    const usable = accounts.filter((a) => !a.inAuthCooldown);
+    if (usable.length === 0) {
+        // Every account is routing-excluded after upstream auth failures — the
+        // next request will fail, which is the deadness /health exists to signal.
+        return {
+            authenticated: false,
+            status: 'broken',
+            mode: 'pool',
+            accounts: accounts.length,
+            expiresAt: Math.min(...accounts.map((a) => a.expiresAt)),
+            expiresIn: 'all accounts in auth-cooldown',
+        };
+    }
+    // Earliest expiry among USABLE accounts — the pool's background refresh
+    // (15-min loop) keeps these rolling, mirroring what the startup banner
+    // reports for a warm pool.
+    const earliest = Math.min(...usable.map((a) => a.expiresAt));
+    return {
+        authenticated: true,
+        status: 'healthy',
+        mode: 'pool',
+        accounts: accounts.length,
+        expiresAt: earliest,
+        expiresIn: formatMsLeft(earliest - now),
+    };
+}
 export function buildHealthResponse(s, requestCount, viaPublicTunnel) {
     const dead = s.status === 'broken' ||
         s.status === 'none' ||
@@ -24,6 +69,9 @@ export function buildHealthResponse(s, requestCount, viaPublicTunnel) {
         ? liveness
         : {
             ...liveness,
+            // Version for internal callers only — an update-check signal (#640),
+            // withheld from the public-tunnel view alongside the OAuth internals.
+            ...(s.version ? { version: s.version } : {}),
             oauth: s.status,
             expiresIn: s.expiresIn,
             requests: requestCount,

package/dist/model-catalog.d.ts

@@ -118,4 +118,14 @@ export declare function getModelCatalog(deps?: CatalogDeps): Promise<ModelCatalo
 export declare function getCachedBases(): readonly string[];
 /** Fire-and-forget warmup so the first client /v1/models call is served warm. */
 export declare function prewarmModelCatalog(deps?: CatalogDeps): void;
+/**
+ * Reset the failed-fetch backoff and kick a refetch now. For the moment
+ * upstream auth first becomes available — e.g. the first account hot-added
+ * through the admin API (#599): the startup prewarm was skipped (or a client
+ * /v1/models call already failed) while the pool was empty, and the 5-min
+ * retry backoff would otherwise keep serving the baked list even though a
+ * bearer now exists (#636). No-ops into a plain cache read when the catalog
+ * is already fresh from upstream.
+ */
+export declare function retryModelCatalogNow(deps?: CatalogDeps): void;
 export declare function _resetModelCatalogForTest(): void;

package/dist/model-catalog.js

@@ -302,6 +302,19 @@ export function getCachedBases() {
 export function prewarmModelCatalog(deps = {}) {
     void getModelCatalog(deps);
 }
+/**
+ * Reset the failed-fetch backoff and kick a refetch now. For the moment
+ * upstream auth first becomes available — e.g. the first account hot-added
+ * through the admin API (#599): the startup prewarm was skipped (or a client
+ * /v1/models call already failed) while the pool was empty, and the 5-min
+ * retry backoff would otherwise keep serving the baked list even though a
+ * bearer now exists (#636). No-ops into a plain cache read when the catalog
+ * is already fresh from upstream.
+ */
+export function retryModelCatalogNow(deps = {}) {
+    lastAttempt = 0;
+    void getModelCatalog(deps);
+}
 export function _resetModelCatalogForTest() {
     cache = null;
     lastAttempt = 0;

package/dist/proxy.js

@@ -7,7 +7,8 @@ import { homedir } from 'node:os';
 import { setDefaultResultOrder } from 'node:dns';
 import { arch, platform } from 'node:process';
 import { getAccessToken, getStatus } from './oauth.js';
-import { buildHealthResponse } from './health-response.js';
+import { buildHealthResponse, derivePoolStatus } from './health-response.js';
+import { darioVersion } from './version.js';
 import { buildCCRequest, applyCcPromptCaching, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, CC_TEMPLATE } from './cc-template.js';
 import { stampCch } from './cch.js';
 import { describeTemplate, detectDrift, checkCCCompat } from './live-fingerprint.js';
@@ -21,7 +22,7 @@ import { createTokenBucket } from './rate-limit.js';
 import { getOpenAIBackend, isOpenAIModel, forwardToOpenAI } from './openai-backend.js';
 import { RequestQueue, QueueFullError, QueueTimeoutError, DEFAULT_MAX_CONCURRENT, DEFAULT_MAX_QUEUED, DEFAULT_QUEUE_TIMEOUT_MS } from './request-queue.js';
 import { redactSecrets } from './redact.js';
-import { BAKED_BASE_MODELS, withLongContextVariants, buildOpenAIModelsList, getModelCatalog, getCachedBases, resolveAliasAgainst, prewarmModelCatalog, isSuspendedModel } from './model-catalog.js';
+import { BAKED_BASE_MODELS, withLongContextVariants, buildOpenAIModelsList, getModelCatalog, getCachedBases, resolveAliasAgainst, prewarmModelCatalog, retryModelCatalogNow, isSuspendedModel } from './model-catalog.js';
 const ANTHROPIC_API = 'https://api.anthropic.com';
 const DEFAULT_PORT = 3456;
 const MAX_BODY_BYTES = 10 * 1024 * 1024; // 10 MB — generous for large prompts, prevents abuse
@@ -1201,17 +1202,50 @@ export async function startProxy(opts = {}) {
         ...SECURITY_HEADERS,
     };
     const JSON_HEADERS = { 'Content-Type': 'application/json', ...SECURITY_HEADERS };
+    // Pool-aware status for /status + /health (#636). In pool mode the legacy
+    // single-account getStatus() reads credentials.json, which a login-less
+    // pool setup (#618 pool-at-1, #599 admin bootstrap) legitimately doesn't
+    // have — those endpoints reported none/503 while the pool served fine,
+    // breaking docker healthchecks and making the TUI claim the proxy was down.
+    async function currentStatus() {
+        if (!pool)
+            return getStatus();
+        const now = Date.now();
+        return derivePoolStatus(pool.all().map((a) => ({ expiresAt: a.expiresAt, inAuthCooldown: isInAuthCooldown(a, now) })), now, adminEnabled);
+    }
     // Model catalog wiring — /v1/models serves the upstream-autodetected set,
     // authenticated the same way the request path is (per-token API key when
-    // ANTHROPIC_UPSTREAM_API_KEY is set, OAuth bearer otherwise). Prewarmed so
-    // the first client call is answered from cache; every failure path inside
+    // ANTHROPIC_UPSTREAM_API_KEY is set, OAuth bearer otherwise — from the pool
+    // when pool mode is active, so a login-less setup doesn't fail the fetch
+    // with a misleading "Run `dario login` first" (#636)). Prewarmed so the
+    // first client call is answered from cache; every failure path inside
     // getModelCatalog falls back to the baked list, so the route always 200s.
     const catalogDeps = {
         upstreamApiKey: upstreamApiKey || undefined,
-        getToken: getAccessToken,
+        getToken: pool
+            ? async () => {
+                const now = Date.now();
+                const accounts = pool.all();
+                if (accounts.length === 0) {
+                    throw new Error(adminEnabled
+                        ? 'pool has no accounts yet — add one via POST /admin/login/start'
+                        : 'pool has no accounts yet — run `dario accounts add <alias>`');
+                }
+                const usable = accounts.filter((a) => !isInAuthCooldown(a, now) && a.expiresAt > now);
+                return (usable[0] ?? accounts[0]).accessToken;
+            }
+            : getAccessToken,
         log: verbose ? (m) => console.log(m) : undefined,
     };
-    prewarmModelCatalog(catalogDeps);
+    if (pool && pool.size === 0) {
+        // Empty admin pool: skip the prewarm instead of logging a guaranteed
+        // failure at startup. The catalog refetches when the first account is
+        // hot-added (onAccountsChanged below).
+        console.log('[dario] model catalog: no accounts yet — serving baked list until one is added');
+    }
+    else {
+        prewarmModelCatalog(catalogDeps);
+    }
     const ERR_UNAUTH = JSON.stringify({ error: 'Unauthorized', message: 'Invalid or missing API key' });
     const ERR_FORBIDDEN = JSON.stringify({ error: 'Forbidden', message: 'Path not allowed. Supported paths: POST /v1/messages, POST /v1/messages/count_tokens, POST /v1/chat/completions, GET /v1/models' });
     const ERR_METHOD = JSON.stringify({ error: 'Method not allowed' });
@@ -1234,11 +1268,11 @@ export async function startProxy(opts = {}) {
         // and dependent services (`depends_on: service_healthy`) need this to
         // react instead of cheerfully passing while every /v1/messages 401s.
         if (urlPath === '/health' || urlPath === '/') {
-            const s = await getStatus();
+            const s = await currentStatus();
             // Public requests arrive through the Cloudflare tunnel (the edge stamps
             // `cf-ray`); they get only the liveness verdict, never the OAuth internals.
             // See buildHealthResponse for the full rationale.
-            const { httpStatus, body } = buildHealthResponse(s, requestCount, req.headers['cf-ray'] !== undefined);
+            const { httpStatus, body } = buildHealthResponse({ ...s, version: darioVersion() }, requestCount, req.headers['cf-ray'] !== undefined);
             res.writeHead(httpStatus, JSON_HEADERS);
             res.end(JSON.stringify(body));
             return;
@@ -1263,6 +1297,12 @@ export async function startProxy(opts = {}) {
                         const size = reconcilePoolAccounts(pool, await loadAllAccounts());
                         if (verbose)
                             console.log(`[dario] admin: pool hot-reloaded — ${size} account${size === 1 ? '' : 's'}`);
+                        // The startup prewarm was skipped (or failed) while the pool was
+                        // empty; now that a bearer exists, refetch past the failed-fetch
+                        // backoff so /v1/models upgrades from the baked list without
+                        // waiting out the retry window (#636).
+                        if (size > 0)
+                            retryModelCatalogNow(catalogDeps);
                     }
                     catch (err) {
                         console.error(`[dario] admin: pool hot-reload failed: ${err instanceof Error ? err.message : err}`);
@@ -1336,9 +1376,11 @@ export async function startProxy(opts = {}) {
         }
         // Status endpoint
         if (urlPath === '/status') {
-            const s = await getStatus();
+            const s = await currentStatus();
+            // Version for auto-update checks (#640) — /status is key-gated (loopback
+            // or DARIO_API_KEY), so no public-disclosure concern like /health has.
             res.writeHead(200, JSON_HEADERS);
-            res.end(JSON.stringify(s));
+            res.end(JSON.stringify({ version: darioVersion(), ...s }));
             return;
         }
         // Pool status endpoint — shows loaded accounts, headroom, and the

package/dist/tui/proxy-client.d.ts

@@ -30,13 +30,20 @@ export declare class ProxyClient {
     constructor(opts: ProxyClientOpts);
     /**
      * GET a JSON endpoint. Rejects on non-2xx, network failure, JSON
-     * parse error, or timeout.
+     * parse error, or timeout. `opts.anyStatus` accepts every HTTP status
+     * and parses the body regardless — for endpoints like /health that
+     * deliberately answer 503 with a JSON body.
      */
-    getJson<T = unknown>(path: string): Promise<T>;
+    getJson<T = unknown>(path: string, opts?: {
+        anyStatus?: boolean;
+    }): Promise<T>;
     /**
-     * Reachability probe — GET /health, returns parsed payload on
-     * success or null on any failure. Never throws; callers use the
-     * null as "proxy not running / unreachable".
+     * Reachability probe — GET /health, returns the parsed payload or null.
+     * /health answers 503 WITH a JSON body when upstream auth is degraded —
+     * that's a running proxy telling us it's unhealthy, not an unreachable
+     * proxy, so any HTTP response with a JSON body resolves (#636). Null is
+     * reserved for no-HTTP-response-at-all (connection refused, timeout) or
+     * a non-JSON body (something else is squatting on the port).
      */
     health(): Promise<HealthResponse | null>;
     /**

package/dist/tui/proxy-client.js

@@ -28,9 +28,11 @@ export class ProxyClient {
     }
     /**
      * GET a JSON endpoint. Rejects on non-2xx, network failure, JSON
-     * parse error, or timeout.
+     * parse error, or timeout. `opts.anyStatus` accepts every HTTP status
+     * and parses the body regardless — for endpoints like /health that
+     * deliberately answer 503 with a JSON body.
      */
-    async getJson(path) {
+    async getJson(path, opts) {
         const url = new URL(this.baseUrl + path);
         return new Promise((resolve, reject) => {
             const req = httpRequest({
@@ -44,7 +46,7 @@ export class ProxyClient {
                 res.on('data', (c) => chunks.push(c));
                 res.on('end', () => {
                     const body = Buffer.concat(chunks).toString('utf-8');
-                    if (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300) {
+                    if (!opts?.anyStatus && (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300)) {
                         reject(new Error(`HTTP ${res.statusCode}: ${body.slice(0, 200)}`));
                         return;
                     }
@@ -65,13 +67,16 @@ export class ProxyClient {
         });
     }
     /**
-     * Reachability probe — GET /health, returns parsed payload on
-     * success or null on any failure. Never throws; callers use the
-     * null as "proxy not running / unreachable".
+     * Reachability probe — GET /health, returns the parsed payload or null.
+     * /health answers 503 WITH a JSON body when upstream auth is degraded —
+     * that's a running proxy telling us it's unhealthy, not an unreachable
+     * proxy, so any HTTP response with a JSON body resolves (#636). Null is
+     * reserved for no-HTTP-response-at-all (connection refused, timeout) or
+     * a non-JSON body (something else is squatting on the port).
      */
     async health() {
         try {
-            return await this.getJson('/health');
+            return await this.getJson('/health', { anyStatus: true });
         }
         catch {
             return null;

package/dist/tui/tabs/accounts.d.ts

@@ -1,8 +1,16 @@
 /**
  * Accounts tab — list of OAuth subscription accounts in the pool.
  *
- * Read-mostly. Mutations (add/remove) require the CLI — the tab
- * shows the relevant command in the footer.
+ * Source of truth is the RUNNING PROXY's live pool (`GET /accounts`), not a
+ * local disk read: the TUI is its own process, and in a containerized / admin
+ * (#599) / login-less-pool (#630) deployment the accounts live in the proxy's
+ * volume, so reading `~/.dario/accounts/` in the TUI process comes up empty
+ * while the proxy serves several accounts fine (#641). We fall back to the disk
+ * read only when the proxy is unreachable, and flag it so the user knows the
+ * view may be stale.
+ *
+ * Read-mostly. Mutations (add/remove) require the CLI or the admin API — the
+ * tab shows the relevant command in the footer.
  *
  * Layout:
  *
@@ -16,17 +24,21 @@
  *   To add: `dario accounts add <alias>`
  *   To remove: `dario accounts remove <alias>`
  */
-import type { Tab } from '../tab.js';
+import type { Tab, TabContext } from '../tab.js';
 export interface AccountsState {
     loading: boolean;
     accounts: Array<{
         alias: string;
         expiresAt: number;
-        /** Optional rate-limit fields populated when /accounts endpoint exists. */
+        /** Live pool fields — present when sourced from the proxy's `/accounts`. */
         util5h?: number;
         util7d?: number;
+        status?: string;
     }>;
     error: string | null;
+    /** Where the list came from: the running proxy's pool, the proxy's
+     *  single-account mode, or a local disk fallback when the proxy is down. */
+    source?: 'pool' | 'single-account' | 'disk';
 }
 export declare const AccountsTab: Tab<AccountsState>;
-export declare function refreshAccounts(): Promise<AccountsState>;
+export declare function refreshAccounts(ctx?: TabContext<AccountsState>): Promise<AccountsState>;

package/dist/tui/tabs/accounts.js

@@ -1,8 +1,16 @@
 /**
  * Accounts tab — list of OAuth subscription accounts in the pool.
  *
- * Read-mostly. Mutations (add/remove) require the CLI — the tab
- * shows the relevant command in the footer.
+ * Source of truth is the RUNNING PROXY's live pool (`GET /accounts`), not a
+ * local disk read: the TUI is its own process, and in a containerized / admin
+ * (#599) / login-less-pool (#630) deployment the accounts live in the proxy's
+ * volume, so reading `~/.dario/accounts/` in the TUI process comes up empty
+ * while the proxy serves several accounts fine (#641). We fall back to the disk
+ * read only when the proxy is unreachable, and flag it so the user knows the
+ * view may be stale.
+ *
+ * Read-mostly. Mutations (add/remove) require the CLI or the admin API — the
+ * tab shows the relevant command in the footer.
  *
  * Layout:
  *
@@ -25,8 +33,8 @@ export const AccountsTab = {
     initialState() {
         return { loading: true, accounts: [], error: null };
     },
-    async onMount(_state, _ctx) {
-        return refreshAccounts();
+    async onMount(_state, ctx) {
+        return refreshAccounts(ctx);
     },
     onKey(state, key) {
         if (key.name === 'printable' && key.ch === 'r' && !key.ctrl) {
@@ -34,6 +42,18 @@ export const AccountsTab = {
         }
         return undefined;
     },
+    onTick(state, ctx) {
+        // onKey can only return new state, not run async work — so a manual
+        // refresh ('r') just sets loading:true and this tick drives the refetch.
+        // `refreshInFlight` guards against the 250ms tick stacking overlapping
+        // fetches while one is already running.
+        if (state.loading && !refreshInFlight) {
+            refreshInFlight = true;
+            void refreshAccounts(ctx)
+                .then((next) => ctx.setState(next))
+                .finally(() => { refreshInFlight = false; });
+        }
+    },
     render(state, dimv) {
         const lines = [];
         const w = dimv.cols;
@@ -45,18 +65,42 @@ export const AccountsTab = {
         }
         if (state.accounts.length === 0) {
             lines.push('');
-            lines.push('  ' + dim('No accounts in the pool.'));
-            lines.push('  ' + 'Add one: ' + fg('cyan', 'dario accounts add <alias>'));
+            if (state.source === 'single-account') {
+                lines.push('  ' + dim('Single-account mode (`dario login`) — no pool.'));
+                lines.push('  ' + 'Start a pool: ' + fg('cyan', 'dario accounts add <alias>'));
+            }
+            else {
+                lines.push('  ' + dim('No accounts in the pool.'));
+                lines.push('  ' + 'Add one: ' + fg('cyan', 'dario accounts add <alias>'));
+            }
             return lines.join('\n');
         }
+        // Live pool data (from /accounts) carries utilization; the disk fallback
+        // doesn't, so show the util columns only when the pool populated them.
+        const hasUtil = state.accounts.some((a) => a.util5h !== undefined);
+        if (state.source === 'disk') {
+            lines.push('  ' + fg('yellow', 'proxy unreachable — showing on-disk accounts (may be stale)'));
+        }
         // Header row
-        lines.push('  ' + dim(pad('alias', 20) + pad('expires', 16) + pad('source', 24)));
-        lines.push('  ' + dim('─'.repeat(Math.min(w - 4, 60))));
+        lines.push('  ' + dim(hasUtil
+            ? pad('alias', 20) + pad('expires', 14) + pad('util5h', 9) + pad('util7d', 9) + pad('status', 14)
+            : pad('alias', 20) + pad('expires', 16) + pad('source', 24)));
+        lines.push('  ' + dim('─'.repeat(Math.min(w - 4, 66))));
         for (const acc of state.accounts) {
             const aliasCol = pad(acc.alias, 20);
-            const expiresCol = pad(formatExpiry(acc.expiresAt), 16);
-            const sourceCol = '~/.dario/accounts/' + acc.alias + '.json';
-            lines.push('  ' + aliasCol + expiresCol + dim(sourceCol));
+            if (hasUtil) {
+                const expiresCol = pad(formatExpiry(acc.expiresAt), 14);
+                const u5 = pad(acc.util5h !== undefined ? `${Math.round(acc.util5h * 100)}%` : '—', 9);
+                const u7 = pad(acc.util7d !== undefined ? `${Math.round(acc.util7d * 100)}%` : '—', 9);
+                const statusCol = acc.status ?? '—';
+                const statusFg = statusCol === 'auth-cooldown' ? fg('yellow', statusCol) : dim(statusCol);
+                lines.push('  ' + aliasCol + expiresCol + u5 + u7 + statusFg);
+            }
+            else {
+                const expiresCol = pad(formatExpiry(acc.expiresAt), 16);
+                const sourceCol = '~/.dario/accounts/' + acc.alias + '.json';
+                lines.push('  ' + aliasCol + expiresCol + dim(sourceCol));
+            }
         }
         lines.push('');
         lines.push(' ' + dim('Mutations via CLI:'));
@@ -69,27 +113,62 @@ export const AccountsTab = {
         return lines.join('\n');
     },
 };
-export async function refreshAccounts() {
+/** Guards the onTick refetch against overlapping in-flight fetches. */
+let refreshInFlight = false;
+export async function refreshAccounts(ctx) {
+    // Preferred source: the running proxy's live pool. This is what actually
+    // serves traffic, and it works regardless of which process/host/volume the
+    // TUI itself runs on — the fix for #641, where a containerized proxy held
+    // the accounts and the TUI's local disk read came up empty.
+    if (ctx) {
+        try {
+            const r = await ctx.client.getJson('/accounts');
+            if (r.mode === 'single-account') {
+                return { loading: false, accounts: [], error: null, source: 'single-account' };
+            }
+            if (Array.isArray(r.accounts)) {
+                const now = Date.now();
+                return {
+                    loading: false,
+                    source: 'pool',
+                    accounts: r.accounts.map((a) => ({
+                        alias: a.alias,
+                        expiresAt: now + (a.expiresInMs ?? 0),
+                        util5h: a.util5h,
+                        util7d: a.util7d,
+                        status: a.status,
+                    })),
+                    error: null,
+                };
+            }
+            // Unknown shape — fall through to the disk read below.
+        }
+        catch {
+            // Proxy unreachable (not running, wrong port, missing key) — fall back
+            // to the on-disk view so a standalone TUI still shows something, flagged
+            // stale so the user knows it isn't the live pool.
+            return diskFallback();
+        }
+    }
+    return diskFallback();
+}
+async function diskFallback() {
     try {
         const { listAccountAliases, loadAllAccounts } = await import('../../accounts.js');
         const aliases = await listAccountAliases();
         if (aliases.length === 0) {
-            // Single-account / login.json path — show a synthetic "default"
-            // entry sourced from ~/.dario/credentials.json or keychain.
-            return { loading: false, accounts: [], error: null };
+            return { loading: false, accounts: [], error: null, source: 'disk' };
         }
         const all = await loadAllAccounts();
         return {
             loading: false,
-            accounts: all.map(a => ({
-                alias: a.alias,
-                expiresAt: a.expiresAt,
-            })),
+            source: 'disk',
+            accounts: all.map((a) => ({ alias: a.alias, expiresAt: a.expiresAt })),
             error: null,
         };
     }
     catch (e) {
-        return { loading: false, accounts: [], error: e.message };
+        return { loading: false, accounts: [], error: e.message, source: 'disk' };
     }
 }
 function formatExpiry(expiresAt) {

package/dist/tui/tabs/status.js

@@ -88,7 +88,12 @@ export const StatusTab = {
         // ── Proxy section ──────────────────────────────────────────
         lines.push(' ' + brand('Proxy'));
         if (state.health) {
-            lines.push('  ' + renderKvRow('Status', fg('green', state.health.status), w - 4));
+            // /health answers 'degraded' (HTTP 503) from a RUNNING proxy whose
+            // upstream auth is unhealthy — render that honestly instead of the old
+            // behavior of collapsing any non-2xx into "unreachable" (#636).
+            const healthOk = state.health.status === 'ok';
+            lines.push('  ' + renderKvRow('Status', healthOk ? fg('green', state.health.status)
+                : fg('yellow', `${state.health.status} — proxy running, upstream auth not ready`), w - 4));
             lines.push('  ' + renderKvRow('OAuth', formatOauth(state.health.oauth, state.health.expiresIn), w - 4));
             lines.push('  ' + renderKvRow('Requests', String(state.health.requests ?? 0), w - 4));
         }
@@ -220,8 +225,11 @@ function formatOauth(label, expiresIn) {
         return fg('yellow', 'expired (refresh on next request)');
     if (label === 'broken')
         return fg('red', 'broken — run `dario login`');
+    // Pool mode passes a how-to-fix hint through expiresIn (e.g. "no accounts
+    // yet — add one via POST /admin/login/start"); single-account 'none' has no
+    // expiresIn and keeps the classic label.
     if (label === 'none')
-        return dim('no credentials');
+        return dim(expiresIn ? `none — ${expiresIn}` : 'no credentials');
     return label;
 }
 function formatAgo(ts) {

package/dist/version.d.ts

@@ -0,0 +1,3 @@
+export declare function darioVersion(): string;
+/** Test-only: clear the memoized version. */
+export declare function _resetVersionCacheForTest(): void;

package/dist/version.js

@@ -0,0 +1,32 @@
+/**
+ * dario's own package version, read once from the bundled package.json.
+ *
+ * Surfaced on `/status` and `/health` (#640) so a headless operator can confirm
+ * an auto-update actually rolled the running proxy — `curl /health | jq .version`
+ * beats exec-ing into the container to read package.json.
+ */
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+let cached = null;
+export function darioVersion() {
+    if (cached !== null)
+        return cached;
+    let v = 'unknown';
+    try {
+        // dist/version.js → ../package.json (same layout the MCP server + CLI use).
+        const here = dirname(fileURLToPath(import.meta.url));
+        const pkg = JSON.parse(readFileSync(join(here, '..', 'package.json'), 'utf-8'));
+        if (typeof pkg.version === 'string')
+            v = pkg.version;
+    }
+    catch {
+        // package.json missing/malformed — keep 'unknown', never throw.
+    }
+    cached = v;
+    return v;
+}
+/** Test-only: clear the memoized version. */
+export function _resetVersionCacheForTest() {
+    cached = null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "4.8.116",
+  "version": "4.8.118",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {