@askalf/dario 4.8.117 → 4.8.118

package/README.md

@@ -18,8 +18,6 @@
 
 > 🗓️ **2026-06-15 — Anthropic splits Claude billing.** Agent-SDK and `claude -p` (headless) traffic stops counting against your subscription pool and moves to a small separate monthly credit ($20 / $100 / $200 by plan), then metered per-token API rates. Most proxies forward your requests in exactly the shape that gets reclassified into that bucket. dario rewrites every request into interactive Claude Code wire-shape before it leaves your machine, so your traffic stays in the subscription pool you already pay for — same install, no config change for the cliff. **[What changes, and how to verify it on your own machine →](#the-deadline-2026-06-15)**
 
-> ⛔ **Claude Fable 5 / Mythos 5 — temporarily suspended for all Anthropic customers.** On 2026-06-12 a US-government legal directive disabled Fable 5 and Mythos 5 for **every** Anthropic plan and tier — `api.anthropic.com` now returns `not_found` for them, and no account or proxy can route around it ([details](https://www.anthropic.com/news/fable-mythos-access)). As of **v4.8.71**, dario filters both families out of `/v1/models` and rejects any spelling (`fable`, `fable1m`, `claude-fable-5`, `claude-fable-5[1m]`, `claude:fable`) up front with a clean `404` pointing at `claude-opus-4-8` / `claude-sonnet-5` — instead of forwarding into a confusing upstream error. Reversible without a code change once access is restored: set `DARIO_SUSPENDED_MODELS=` (empty) on the instance. `npm install -g @askalf/dario@latest`
->
 > ⚠️ Still on a version **before 4.8.39**? Upgrade now — those could silently corrupt code/structured content routed through the proxy (the identifier scrub stripped tokens like the JS `continue` keyword). **[Details →](https://github.com/askalf/dario/issues/457)**
 
 ---
@@ -194,7 +192,7 @@ You point every tool at one URL. dario reads each request, decides which backend
 
 The tool doesn't know. The backend doesn't know. dario is the seam.
 
-**The full Claude lineup, autodetected.** Opus 4.8, Sonnet 5, and Haiku 4.5 — plus `[1m]` long-context variants, generated by one rule for every family — by full id (`claude-opus-4-8`) or shortcut (`opus` / `sonnet` / `haiku`, append `1m` for the long-context form). `GET /v1/models` asks Anthropic's live catalog (TTL-cached, baked fallback when offline), and the family shortcuts track it — a new model shows up and resolves the day it lands, no dario release needed; the model-specific wire shape (effort level, beta set, thinking config) is applied automatically. **Globally-suspended families are filtered out** of both the live catalog and the baked fallback, so `/v1/models` never advertises a model that 404s upstream and suspended ids are rejected locally with an actionable error — currently Claude Fable 5 and Mythos 5 (US-government directive, 2026-06-12); governed by `DARIO_SUSPENDED_MODELS` (default `fable`), set it empty to re-enable when access is restored.
+**The full Claude lineup, autodetected.** Opus 4.8, Sonnet 5, and Haiku 4.5 — plus `[1m]` long-context variants, generated by one rule for every family — by full id (`claude-opus-4-8`) or shortcut (`opus` / `sonnet` / `haiku`, append `1m` for the long-context form). `GET /v1/models` asks Anthropic's live catalog (TTL-cached, baked fallback when offline), and the family shortcuts track it — a new model shows up and resolves the day it lands, no dario release needed; the model-specific wire shape (effort level, beta set, thinking config) is applied automatically. **Suspended families are filtered out** of both the live catalog and the baked fallback, so `/v1/models` never advertises a model that 404s upstream and suspended ids are rejected locally with an actionable error. Nothing is suspended by default; the mechanism is retained via `DARIO_SUSPENDED_MODELS` (comma-separated families, every spelling caught) for if a family is ever pulled upstream again.
 
 ---
 
@@ -224,6 +222,7 @@ Tune via `~/.dario/config.json` → `overageGuard`, or CLI flags: `--overage-beh
 ## Capabilities
 
 - **Multi-account pool.** Drop Claude accounts in `~/.dario/accounts/` and pool mode auto-activates — one is enough to serve, so `dario accounts add` alone bootstraps a proxy with no `dario login` step. With more, every request routes to the account with the most headroom, multi-turn sessions pin to one account so the prompt cache survives, in-flight 429s fail over to a peer before your client sees an error. → [`docs/multi-account-pool.md`](./docs/multi-account-pool.md)
+- **Headless admin API (`DARIO_ADMIN=1`).** Provision and manage pool accounts entirely over HTTP — start with zero accounts, `POST /admin/login/start`, paste the code back, and the account is routable the moment the `200` lands (live pool hot-reload, no restart). Token-gated even on loopback, audit-logged, rate-limited; `GET /admin/accounts` reports live per-account headroom. Built for Docker / k8s / Raspberry-Pi deployments where a console is the awkward part. → [`docs/admin-api.md`](./docs/admin-api.md)
 - **Behavioral stealth (`--stealth`).** Static wire fidelity covers *what* the request looks like; `--stealth` adds *when* it arrives — response-length-correlated think time and 1.2–4.2s session-start latency, the inter-arrival pattern real interactive sessions have and agent loops don't. → [`docs/wire-fidelity.md`](./docs/wire-fidelity.md)
 - **Runs any non-Claude-Code agent.** A 64-entry schema-verified `TOOL_MAP` pre-maps Cline, Roo, Kilo, Cursor, Windsurf, Continue, Copilot, OpenHands, OpenClaw, Hermes, [hands](https://github.com/askalf/hands) tool names to CC's native set. No flag, no validator errors. → [`docs/integrations/agent-compat.md`](./docs/integrations/agent-compat.md)
 - **Recover output capability.** `dario proxy --system-prompt=partial` strips CC's tone/verbosity/no-comments constraints for 1.2–2.8× more output on open-ended work — empirically without flipping billing (the classifier doesn't read that slot). [Discussion #183](https://github.com/askalf/dario/discussions/183) has the per-prompt receipts. → [`docs/system-prompt.md`](./docs/system-prompt.md)
@@ -302,9 +301,6 @@ No. `five_hour` and `seven_day` are both subscription billing — different acco
 **Will the 2026-06-15 split break my setup? / What if Anthropic ships another silent change?**
 No, and it's caught automatically — see [The deadline](#the-deadline-2026-06-15) and [How it stays working](#how-it-works-and-how-it-stays-working). dario rewrites every request to interactive-CC shape before it reaches `api.anthropic.com`, and the three-class drift watcher picks up new changes (npm-release hourly, remote-config every 30 min, classifier-rule daily). v3.38.5 + v3.38.6 — 13 minutes apart, same day as v2.1.142's silent drops — are the prior art.
 
-**I'm getting `404 not_found` for `claude-fable-5` / `fable`. Did dario break?**
-No — Claude Fable 5 and Mythos 5 were disabled for **all** Anthropic customers by a US-government legal directive on 2026-06-12 (every plan and tier; [details](https://www.anthropic.com/news/fable-mythos-access)). `api.anthropic.com` returns `not_found` for them, so no subscription or proxy can route them. Since v4.8.71 dario drops both families from `/v1/models` and rejects them locally with a clear 404 pointing at `claude-opus-4-8` / `claude-sonnet-5`, instead of forwarding into a confusing upstream error. When access is restored, set `DARIO_SUSPENDED_MODELS=` (empty) on the instance to re-enable — no upgrade needed.
-
 Full FAQ: [`docs/faq.md`](./docs/faq.md)
 
 ---

package/dist/health-response.d.ts

@@ -20,6 +20,8 @@ export interface HealthStatusLike {
     expiresIn?: string;
     refreshFailures?: number;
     lastRefreshError?: string;
+    /** dario's package version, surfaced to internal callers on /health (#640). */
+    version?: string;
 }
 export interface HealthResponse {
     httpStatus: number;

package/dist/health-response.js

@@ -69,6 +69,9 @@ export function buildHealthResponse(s, requestCount, viaPublicTunnel) {
         ? liveness
         : {
             ...liveness,
+            // Version for internal callers only — an update-check signal (#640),
+            // withheld from the public-tunnel view alongside the OAuth internals.
+            ...(s.version ? { version: s.version } : {}),
             oauth: s.status,
             expiresIn: s.expiresIn,
             requests: requestCount,

package/dist/proxy.js

@@ -8,6 +8,7 @@ import { setDefaultResultOrder } from 'node:dns';
 import { arch, platform } from 'node:process';
 import { getAccessToken, getStatus } from './oauth.js';
 import { buildHealthResponse, derivePoolStatus } from './health-response.js';
+import { darioVersion } from './version.js';
 import { buildCCRequest, applyCcPromptCaching, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, CC_TEMPLATE } from './cc-template.js';
 import { stampCch } from './cch.js';
 import { describeTemplate, detectDrift, checkCCCompat } from './live-fingerprint.js';
@@ -1271,7 +1272,7 @@ export async function startProxy(opts = {}) {
             // Public requests arrive through the Cloudflare tunnel (the edge stamps
             // `cf-ray`); they get only the liveness verdict, never the OAuth internals.
             // See buildHealthResponse for the full rationale.
-            const { httpStatus, body } = buildHealthResponse(s, requestCount, req.headers['cf-ray'] !== undefined);
+            const { httpStatus, body } = buildHealthResponse({ ...s, version: darioVersion() }, requestCount, req.headers['cf-ray'] !== undefined);
             res.writeHead(httpStatus, JSON_HEADERS);
             res.end(JSON.stringify(body));
             return;
@@ -1376,8 +1377,10 @@ export async function startProxy(opts = {}) {
         // Status endpoint
         if (urlPath === '/status') {
             const s = await currentStatus();
+            // Version for auto-update checks (#640) — /status is key-gated (loopback
+            // or DARIO_API_KEY), so no public-disclosure concern like /health has.
             res.writeHead(200, JSON_HEADERS);
-            res.end(JSON.stringify(s));
+            res.end(JSON.stringify({ version: darioVersion(), ...s }));
             return;
         }
         // Pool status endpoint — shows loaded accounts, headroom, and the

package/dist/tui/tabs/accounts.d.ts

@@ -1,8 +1,16 @@
 /**
  * Accounts tab — list of OAuth subscription accounts in the pool.
  *
- * Read-mostly. Mutations (add/remove) require the CLI — the tab
- * shows the relevant command in the footer.
+ * Source of truth is the RUNNING PROXY's live pool (`GET /accounts`), not a
+ * local disk read: the TUI is its own process, and in a containerized / admin
+ * (#599) / login-less-pool (#630) deployment the accounts live in the proxy's
+ * volume, so reading `~/.dario/accounts/` in the TUI process comes up empty
+ * while the proxy serves several accounts fine (#641). We fall back to the disk
+ * read only when the proxy is unreachable, and flag it so the user knows the
+ * view may be stale.
+ *
+ * Read-mostly. Mutations (add/remove) require the CLI or the admin API — the
+ * tab shows the relevant command in the footer.
  *
  * Layout:
  *
@@ -16,17 +24,21 @@
  *   To add: `dario accounts add <alias>`
  *   To remove: `dario accounts remove <alias>`
  */
-import type { Tab } from '../tab.js';
+import type { Tab, TabContext } from '../tab.js';
 export interface AccountsState {
     loading: boolean;
     accounts: Array<{
         alias: string;
         expiresAt: number;
-        /** Optional rate-limit fields populated when /accounts endpoint exists. */
+        /** Live pool fields — present when sourced from the proxy's `/accounts`. */
         util5h?: number;
         util7d?: number;
+        status?: string;
     }>;
     error: string | null;
+    /** Where the list came from: the running proxy's pool, the proxy's
+     *  single-account mode, or a local disk fallback when the proxy is down. */
+    source?: 'pool' | 'single-account' | 'disk';
 }
 export declare const AccountsTab: Tab<AccountsState>;
-export declare function refreshAccounts(): Promise<AccountsState>;
+export declare function refreshAccounts(ctx?: TabContext<AccountsState>): Promise<AccountsState>;

package/dist/tui/tabs/accounts.js

@@ -1,8 +1,16 @@
 /**
  * Accounts tab — list of OAuth subscription accounts in the pool.
  *
- * Read-mostly. Mutations (add/remove) require the CLI — the tab
- * shows the relevant command in the footer.
+ * Source of truth is the RUNNING PROXY's live pool (`GET /accounts`), not a
+ * local disk read: the TUI is its own process, and in a containerized / admin
+ * (#599) / login-less-pool (#630) deployment the accounts live in the proxy's
+ * volume, so reading `~/.dario/accounts/` in the TUI process comes up empty
+ * while the proxy serves several accounts fine (#641). We fall back to the disk
+ * read only when the proxy is unreachable, and flag it so the user knows the
+ * view may be stale.
+ *
+ * Read-mostly. Mutations (add/remove) require the CLI or the admin API — the
+ * tab shows the relevant command in the footer.
  *
  * Layout:
  *
@@ -25,8 +33,8 @@ export const AccountsTab = {
     initialState() {
         return { loading: true, accounts: [], error: null };
     },
-    async onMount(_state, _ctx) {
-        return refreshAccounts();
+    async onMount(_state, ctx) {
+        return refreshAccounts(ctx);
     },
     onKey(state, key) {
         if (key.name === 'printable' && key.ch === 'r' && !key.ctrl) {
@@ -34,6 +42,18 @@ export const AccountsTab = {
         }
         return undefined;
     },
+    onTick(state, ctx) {
+        // onKey can only return new state, not run async work — so a manual
+        // refresh ('r') just sets loading:true and this tick drives the refetch.
+        // `refreshInFlight` guards against the 250ms tick stacking overlapping
+        // fetches while one is already running.
+        if (state.loading && !refreshInFlight) {
+            refreshInFlight = true;
+            void refreshAccounts(ctx)
+                .then((next) => ctx.setState(next))
+                .finally(() => { refreshInFlight = false; });
+        }
+    },
     render(state, dimv) {
         const lines = [];
         const w = dimv.cols;
@@ -45,18 +65,42 @@ export const AccountsTab = {
         }
         if (state.accounts.length === 0) {
             lines.push('');
-            lines.push('  ' + dim('No accounts in the pool.'));
-            lines.push('  ' + 'Add one: ' + fg('cyan', 'dario accounts add <alias>'));
+            if (state.source === 'single-account') {
+                lines.push('  ' + dim('Single-account mode (`dario login`) — no pool.'));
+                lines.push('  ' + 'Start a pool: ' + fg('cyan', 'dario accounts add <alias>'));
+            }
+            else {
+                lines.push('  ' + dim('No accounts in the pool.'));
+                lines.push('  ' + 'Add one: ' + fg('cyan', 'dario accounts add <alias>'));
+            }
             return lines.join('\n');
         }
+        // Live pool data (from /accounts) carries utilization; the disk fallback
+        // doesn't, so show the util columns only when the pool populated them.
+        const hasUtil = state.accounts.some((a) => a.util5h !== undefined);
+        if (state.source === 'disk') {
+            lines.push('  ' + fg('yellow', 'proxy unreachable — showing on-disk accounts (may be stale)'));
+        }
         // Header row
-        lines.push('  ' + dim(pad('alias', 20) + pad('expires', 16) + pad('source', 24)));
-        lines.push('  ' + dim('─'.repeat(Math.min(w - 4, 60))));
+        lines.push('  ' + dim(hasUtil
+            ? pad('alias', 20) + pad('expires', 14) + pad('util5h', 9) + pad('util7d', 9) + pad('status', 14)
+            : pad('alias', 20) + pad('expires', 16) + pad('source', 24)));
+        lines.push('  ' + dim('─'.repeat(Math.min(w - 4, 66))));
         for (const acc of state.accounts) {
             const aliasCol = pad(acc.alias, 20);
-            const expiresCol = pad(formatExpiry(acc.expiresAt), 16);
-            const sourceCol = '~/.dario/accounts/' + acc.alias + '.json';
-            lines.push('  ' + aliasCol + expiresCol + dim(sourceCol));
+            if (hasUtil) {
+                const expiresCol = pad(formatExpiry(acc.expiresAt), 14);
+                const u5 = pad(acc.util5h !== undefined ? `${Math.round(acc.util5h * 100)}%` : '—', 9);
+                const u7 = pad(acc.util7d !== undefined ? `${Math.round(acc.util7d * 100)}%` : '—', 9);
+                const statusCol = acc.status ?? '—';
+                const statusFg = statusCol === 'auth-cooldown' ? fg('yellow', statusCol) : dim(statusCol);
+                lines.push('  ' + aliasCol + expiresCol + u5 + u7 + statusFg);
+            }
+            else {
+                const expiresCol = pad(formatExpiry(acc.expiresAt), 16);
+                const sourceCol = '~/.dario/accounts/' + acc.alias + '.json';
+                lines.push('  ' + aliasCol + expiresCol + dim(sourceCol));
+            }
         }
         lines.push('');
         lines.push(' ' + dim('Mutations via CLI:'));
@@ -69,27 +113,62 @@ export const AccountsTab = {
         return lines.join('\n');
     },
 };
-export async function refreshAccounts() {
+/** Guards the onTick refetch against overlapping in-flight fetches. */
+let refreshInFlight = false;
+export async function refreshAccounts(ctx) {
+    // Preferred source: the running proxy's live pool. This is what actually
+    // serves traffic, and it works regardless of which process/host/volume the
+    // TUI itself runs on — the fix for #641, where a containerized proxy held
+    // the accounts and the TUI's local disk read came up empty.
+    if (ctx) {
+        try {
+            const r = await ctx.client.getJson('/accounts');
+            if (r.mode === 'single-account') {
+                return { loading: false, accounts: [], error: null, source: 'single-account' };
+            }
+            if (Array.isArray(r.accounts)) {
+                const now = Date.now();
+                return {
+                    loading: false,
+                    source: 'pool',
+                    accounts: r.accounts.map((a) => ({
+                        alias: a.alias,
+                        expiresAt: now + (a.expiresInMs ?? 0),
+                        util5h: a.util5h,
+                        util7d: a.util7d,
+                        status: a.status,
+                    })),
+                    error: null,
+                };
+            }
+            // Unknown shape — fall through to the disk read below.
+        }
+        catch {
+            // Proxy unreachable (not running, wrong port, missing key) — fall back
+            // to the on-disk view so a standalone TUI still shows something, flagged
+            // stale so the user knows it isn't the live pool.
+            return diskFallback();
+        }
+    }
+    return diskFallback();
+}
+async function diskFallback() {
     try {
         const { listAccountAliases, loadAllAccounts } = await import('../../accounts.js');
         const aliases = await listAccountAliases();
         if (aliases.length === 0) {
-            // Single-account / login.json path — show a synthetic "default"
-            // entry sourced from ~/.dario/credentials.json or keychain.
-            return { loading: false, accounts: [], error: null };
+            return { loading: false, accounts: [], error: null, source: 'disk' };
         }
         const all = await loadAllAccounts();
         return {
             loading: false,
-            accounts: all.map(a => ({
-                alias: a.alias,
-                expiresAt: a.expiresAt,
-            })),
+            source: 'disk',
+            accounts: all.map((a) => ({ alias: a.alias, expiresAt: a.expiresAt })),
             error: null,
         };
     }
     catch (e) {
-        return { loading: false, accounts: [], error: e.message };
+        return { loading: false, accounts: [], error: e.message, source: 'disk' };
     }
 }
 function formatExpiry(expiresAt) {

package/dist/version.d.ts

@@ -0,0 +1,3 @@
+export declare function darioVersion(): string;
+/** Test-only: clear the memoized version. */
+export declare function _resetVersionCacheForTest(): void;

package/dist/version.js

@@ -0,0 +1,32 @@
+/**
+ * dario's own package version, read once from the bundled package.json.
+ *
+ * Surfaced on `/status` and `/health` (#640) so a headless operator can confirm
+ * an auto-update actually rolled the running proxy — `curl /health | jq .version`
+ * beats exec-ing into the container to read package.json.
+ */
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+let cached = null;
+export function darioVersion() {
+    if (cached !== null)
+        return cached;
+    let v = 'unknown';
+    try {
+        // dist/version.js → ../package.json (same layout the MCP server + CLI use).
+        const here = dirname(fileURLToPath(import.meta.url));
+        const pkg = JSON.parse(readFileSync(join(here, '..', 'package.json'), 'utf-8'));
+        if (typeof pkg.version === 'string')
+            v = pkg.version;
+    }
+    catch {
+        // package.json missing/malformed — keep 'unknown', never throw.
+    }
+    cached = v;
+    return v;
+}
+/** Test-only: clear the memoized version. */
+export function _resetVersionCacheForTest() {
+    cached = null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "4.8.117",
+  "version": "4.8.118",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {