@askalf/dario 4.8.121 → 4.8.123

package/dist/model-catalog.d.ts

@@ -32,7 +32,7 @@
  * — the same ordering normalizeUpstreamIds() produces for live data.
  */
 export declare const BAKED_BASE_MODELS: readonly string[];
-/** The set of suspended families, resolved from env at call time. */
+/** The set of suspended families, resolved from env (memoized by raw value). */
 export declare function suspendedFamilies(): Set<string>;
 /** True when `model` (any spelling) belongs to a suspended family. */
 export declare function isSuspendedModel(model: string): boolean;

package/dist/model-catalog.js

@@ -67,14 +67,23 @@ export const BAKED_BASE_MODELS = [
  * to re-suspend if access is ever pulled again.
  */
 const DEFAULT_SUSPENDED_MODELS = '';
-/** The set of suspended families, resolved from env at call time. */
+// Memoized by the raw env value (#642-audit): isSuspendedModel runs per request,
+// and this rebuilt a Set from process.env every call. Keyed on the raw string so
+// a runtime change to DARIO_SUSPENDED_MODELS still re-parses; the common (empty)
+// value allocates the Set once.
+let _suspendedCache = null;
+/** The set of suspended families, resolved from env (memoized by raw value). */
 export function suspendedFamilies() {
     const raw = process.env.DARIO_SUSPENDED_MODELS ?? DEFAULT_SUSPENDED_MODELS;
-    return new Set(raw
+    if (_suspendedCache && _suspendedCache.raw === raw)
+        return _suspendedCache.set;
+    const set = new Set(raw
         .split(',')
         .map((s) => s.trim())
         .filter((s) => s.length > 0)
         .map((s) => modelFamily(s) ?? s.toLowerCase()));
+    _suspendedCache = { raw, set };
+    return set;
 }
 /** True when `model` (any spelling) belongs to a suspended family. */
 export function isSuspendedModel(model) {

package/dist/pool.d.ts

@@ -111,6 +111,7 @@ export declare class AccountPool {
     private queueTimeoutMs;
     private drainTimer;
     private sticky;
+    private lastStickyCleanup;
     add(alias: string, opts: {
         accessToken: string;
         refreshToken: string;

package/dist/pool.js

@@ -142,6 +142,7 @@ export function computeHeadroom(snapshot, family) {
 }
 const STICKY_TTL_MS = 6 * 60 * 60 * 1000; // 6h
 const STICKY_MAX_ENTRIES = 2_000; // lazy cleanup cap
+const STICKY_CLEANUP_INTERVAL_MS = 30_000; // amortize the O(n) TTL/orphan sweep
 /**
  * Headroom floor under which an account is treated as "effectively exhausted"
  * for routing decisions. A sticky binding whose account drops below this
@@ -150,6 +151,21 @@ const STICKY_MAX_ENTRIES = 2_000; // lazy cleanup cap
  * loop stops once every candidate is below it. 0.02 == 2%.
  */
 const POOL_HEADROOM_FLOOR = 0.02;
+// Pick the account with the most headroom in a single pass. The prior
+// `.reduce()` form recomputed the incumbent's headroom every iteration
+// (~2n computeHeadroom calls); this computes each once (#642-audit).
+function pickMaxHeadroom(accounts, family) {
+    let best = accounts[0];
+    let bestHeadroom = computeHeadroom(best.rateLimit, family);
+    for (let i = 1; i < accounts.length; i++) {
+        const h = computeHeadroom(accounts[i].rateLimit, family);
+        if (h > bestHeadroom) {
+            best = accounts[i];
+            bestHeadroom = h;
+        }
+    }
+    return best;
+}
 export class AccountPool {
     accounts = new Map();
     queue = [];
@@ -157,6 +173,8 @@ export class AccountPool {
     queueTimeoutMs = 60_000;
     drainTimer = null;
     sticky = new Map();
+    // Amortize the O(n) sticky TTL/orphan sweep — timestamp of the last run.
+    lastStickyCleanup = 0;
     add(alias, opts) {
         const existing = this.accounts.get(alias);
         this.accounts.set(alias, {
@@ -194,8 +212,17 @@ export class AccountPool {
         const account = this.accounts.get(alias);
         if (!account)
             return;
-        account.lastAuthFailureAt = Date.now();
-        account.consecutiveAuthFailures = (account.consecutiveAuthFailures ?? 0) + 1;
+        const now = Date.now();
+        // Escalate the exponential cool-down only for a genuinely fresh failure.
+        // A burst of concurrent in-flight requests that all 401 on the same account
+        // (before the first cool-down takes hold) would otherwise bump the counter
+        // k times and jump the window to authCooldownMs(k) instead of 60s
+        // (#642-audit). isInAuthCooldown reflects state BEFORE this failure, so the
+        // burst escalates once; always refresh the timestamp to hold the window.
+        if (!isInAuthCooldown(account, now)) {
+            account.consecutiveAuthFailures = (account.consecutiveAuthFailures ?? 0) + 1;
+        }
+        account.lastAuthFailureAt = now;
     }
     /**
      * Clear an account's auth-failure cool-down. Called by the proxy after a
@@ -230,11 +257,7 @@ export class AccountPool {
             a.expiresAt > now + 30_000 &&
             !isInAuthCooldown(a, now));
         if (eligible.length > 0) {
-            return eligible.reduce((best, curr) => {
-                const bestHeadroom = computeHeadroom(best.rateLimit, family);
-                const currHeadroom = computeHeadroom(curr.rateLimit, family);
-                return currHeadroom > bestHeadroom ? curr : best;
-            });
+            return pickMaxHeadroom(eligible, family);
         }
         // All accounts exhausted — return the one with the earliest reset.
         // Auth-cooldown'd accounts are excluded from this fallback too: we
@@ -310,14 +333,25 @@ export class AccountPool {
      */
     cleanupSticky() {
         const now = Date.now();
-        for (const [key, b] of this.sticky) {
-            if (!this.accounts.has(b.alias) || now - b.boundAt > STICKY_TTL_MS) {
-                this.sticky.delete(key);
+        // TTL/orphan sweep is O(n); amortize it — run at most once per
+        // STICKY_CLEANUP_INTERVAL_MS instead of on every selectSticky (#642-audit).
+        // Stale bindings are never wrongly USED meanwhile: selectSticky re-validates
+        // a binding's expiry/rejection/headroom before returning it.
+        if (now - this.lastStickyCleanup >= STICKY_CLEANUP_INTERVAL_MS) {
+            this.lastStickyCleanup = now;
+            for (const [key, b] of this.sticky) {
+                if (!this.accounts.has(b.alias) || now - b.boundAt > STICKY_TTL_MS) {
+                    this.sticky.delete(key);
+                }
             }
         }
+        // Hard size cap always enforced (bounds memory). Batch-evict down to 80% so
+        // the O(n log n) sort amortizes over many inserts rather than firing on every
+        // new conversation at the cap (#642-audit).
         if (this.sticky.size > STICKY_MAX_ENTRIES) {
+            const target = Math.floor(STICKY_MAX_ENTRIES * 0.8);
             const sorted = [...this.sticky.entries()].sort((a, b) => a[1].boundAt - b[1].boundAt);
-            const toDrop = sorted.slice(0, this.sticky.size - STICKY_MAX_ENTRIES);
+            const toDrop = sorted.slice(0, this.sticky.size - target);
             for (const [key] of toDrop)
                 this.sticky.delete(key);
         }
@@ -340,11 +374,7 @@ export class AccountPool {
             a.expiresAt > now + 30_000 &&
             !isInAuthCooldown(a, now));
         if (eligible.length > 0) {
-            return eligible.reduce((best, curr) => {
-                const bestHeadroom = computeHeadroom(best.rateLimit, family);
-                const currHeadroom = computeHeadroom(curr.rateLimit, family);
-                return currHeadroom > bestHeadroom ? curr : best;
-            });
+            return pickMaxHeadroom(eligible, family);
         }
         if (candidates.length > 0) {
             return candidates.reduce((a, b) => a.requestCount < b.requestCount ? a : b);

package/dist/proxy.js

@@ -455,6 +455,21 @@ function sanitizeContent(text, patterns) {
     }
     return result.replace(/\n{3,}/g, '\n\n').trim();
 }
+// Memoize the compiled preserve-tag pattern set by Set reference (#642-audit):
+// opts.preserveOrchestrationTags is a single Set instance passed on every
+// request, so recompile the ~28 patterns once instead of per request. The
+// default (no-preserve) path already uses the precompiled constant.
+let _orchPreserveKey;
+let _orchPatterns;
+function orchestrationPatternsFor(preserveTags) {
+    if (preserveTags === undefined)
+        return ORCHESTRATION_PATTERNS_DEFAULT;
+    if (preserveTags !== _orchPreserveKey) {
+        _orchPreserveKey = preserveTags;
+        _orchPatterns = buildOrchestrationPatterns(preserveTags);
+    }
+    return _orchPatterns;
+}
 /**
  * Strip orchestration tags from all messages in a request body.
  *
@@ -465,7 +480,7 @@ export function sanitizeMessages(body, preserveTags) {
     const messages = body.messages;
     if (!messages)
         return;
-    const patterns = preserveTags === undefined ? ORCHESTRATION_PATTERNS_DEFAULT : buildOrchestrationPatterns(preserveTags);
+    const patterns = orchestrationPatternsFor(preserveTags);
     for (const msg of messages) {
         if (typeof msg.content === 'string') {
             msg.content = sanitizeContent(msg.content, patterns);
@@ -1758,9 +1773,15 @@ export async function startProxy(opts = {}) {
             // recognizes through its own Anthropic gateway, bypassing localhost).
             let forcedProvider = cliProviderOverride;
             let requestEffort; // dario#419 — per-request effort parsed from a model-name suffix (model:high / model-high)
+            // Parsed body, shared between the provider-prefix detection below and the
+            // template-build block further down so the same bytes are not JSON.parsed
+            // twice per request (#642-audit). Mutations in the prefix block re-serialize
+            // `body` FROM this object, so it always represents the current body.
+            let parsedBody = null;
             if (body.length > 0) {
                 try {
                     const parsed = JSON.parse(body.toString());
+                    parsedBody = parsed;
                     const rawModel = parsed.model ?? '';
                     const prefix = parseProviderPrefix(rawModel);
                     if (prefix) {
@@ -1866,7 +1887,11 @@ export async function startProxy(opts = {}) {
             } : undefined;
             if (body.length > 0) {
                 try {
-                    const parsed = JSON.parse(body.toString());
+                    // Reuse the object parsed for provider-prefix detection above — the same
+                    // bytes, so re-parsing is wasted work on large bodies (#642-audit). Falls
+                    // back to a fresh parse when the earlier block didn't run (e.g. the body
+                    // was not JSON, or an OpenAI-backend reroute skipped it).
+                    const parsed = parsedBody ?? JSON.parse(body.toString());
                     // Strip orchestration tags from messages (Aider, Cursor, etc.)
                     sanitizeMessages(parsed, opts.preserveOrchestrationTags);
                     const result = isOpenAI ? openaiToAnthropic(parsed, modelOverride) : (modelOverride ? { ...parsed, model: modelOverride } : parsed);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "4.8.121",
+  "version": "4.8.123",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {