@askalf/dario 4.8.136 → 4.8.137

package/dist/analytics.js

@@ -25,6 +25,16 @@ export function billingBucketFromClaim(claim) {
     switch (claim) {
         case 'five_hour':
         case 'seven_day':
+        // `*_overage_included` — the plan's INCLUDED overage credit, observed live
+        // 2026-07-05 on a Max account at 7d 82% with the `7d_oi` bucket at 99%:
+        // fable answered normally (genuine model echo, stop_reason end_turn),
+        // status=allowed_warning, overage-utilization 0 — $0 out of pocket, so it
+        // is subscription billing, not extra usage. Real paid overage still
+        // arrives as `overage` and still halts the guard. Pre-classification the
+        // guard's halt-on-unknown design 503'd the proxy on every such claim
+        // (30-min cooldown loops) exactly when the weekly window tightens.
+        case 'five_hour_overage_included':
+        case 'seven_day_overage_included':
             return 'subscription';
         case 'five_hour_fallback':
         case 'seven_day_fallback':
@@ -49,6 +59,8 @@ export const SUBSCRIPTION_CLAIMS = new Set([
     'seven_day',
     'five_hour_fallback',
     'seven_day_fallback',
+    'five_hour_overage_included',
+    'seven_day_overage_included',
 ]);
 /**
  * The sentinel `claim` dario assigns when a response carried no rate-limit

package/dist/notify.d.ts

@@ -22,6 +22,22 @@
  *
  * See dario#288 — overage-guard.
  */
+/**
+ * Spawn a detached, output-ignored child and swallow EVERY failure mode.
+ *
+ * The subtle one: a missing binary does NOT throw from `spawn()` — it
+ * surfaces as an ASYNC `'error'` event on the ChildProcess, and with no
+ * handler attached that's an uncaught exception that kills the whole
+ * process. Seen live 2026-07-05 (#672): `spawn notify-send` ENOENT inside
+ * the Docker image crashed the proxy on every overage-guard event — the
+ * guard fired, notify killed the process, docker restarted it, ~15s of
+ * refused connections per event. The existing try/catch only covered the
+ * sync-throw path (EMFILE etc.), which is also kept here.
+ *
+ * Exported for test/notify.mjs, which spawns a guaranteed-nonexistent
+ * binary and asserts the process survives the async error event.
+ */
+export declare function spawnFireAndForget(cmd: string, args: string[]): void;
 /**
  * Fire a native notification. Returns immediately — the underlying spawn
  * is fire-and-forget. Errors (missing binary, permission denied, no

package/dist/notify.js

@@ -24,6 +24,32 @@
  */
 import { spawn } from 'node:child_process';
 import { platform } from 'node:os';
+/**
+ * Spawn a detached, output-ignored child and swallow EVERY failure mode.
+ *
+ * The subtle one: a missing binary does NOT throw from `spawn()` — it
+ * surfaces as an ASYNC `'error'` event on the ChildProcess, and with no
+ * handler attached that's an uncaught exception that kills the whole
+ * process. Seen live 2026-07-05 (#672): `spawn notify-send` ENOENT inside
+ * the Docker image crashed the proxy on every overage-guard event — the
+ * guard fired, notify killed the process, docker restarted it, ~15s of
+ * refused connections per event. The existing try/catch only covered the
+ * sync-throw path (EMFILE etc.), which is also kept here.
+ *
+ * Exported for test/notify.mjs, which spawns a guaranteed-nonexistent
+ * binary and asserts the process survives the async error event.
+ */
+export function spawnFireAndForget(cmd, args) {
+    try {
+        const child = spawn(cmd, args, { detached: true, stdio: 'ignore' });
+        child.on('error', () => { });
+        child.unref();
+    }
+    catch {
+        // Sync throw path (EMFILE and friends); silent — same contract as
+        // the notification itself: best-effort, never load-bearing.
+    }
+}
 /**
  * Fire a native notification. Returns immediately — the underlying spawn
  * is fire-and-forget. Errors (missing binary, permission denied, no
@@ -47,46 +73,38 @@ export function notify(title, message) {
     const safeTitle = sanitize(title);
     const safeMessage = sanitize(message);
     const plat = platform();
-    try {
-        if (plat === 'darwin') {
-            // AppleScript single-quote inside the script body would need
-            // escaping; sanitize() strips them so the literal substitution
-            // below stays safe. Spawned via array argv to avoid a shell
-            // entirely.
-            spawn('osascript', [
-                '-e',
-                `display notification "${safeMessage}" with title "${safeTitle}"`,
-            ], { detached: true, stdio: 'ignore' }).unref();
-        }
-        else if (plat === 'linux') {
-            spawn('notify-send', [safeTitle, safeMessage], {
-                detached: true,
-                stdio: 'ignore',
-            }).unref();
-        }
-        else if (plat === 'win32') {
-            // BurntToast is the cleanest path — single-line PowerShell, real
-            // Windows toast notification. If BurntToast isn't installed the
-            // command fails silently (stdio: ignore swallows the error
-            // output), which is the desired behavior.
-            //
-            // We don't probe-then-spawn; the cost of one failed BurntToast
-            // attempt is the same as one probe attempt, and probing makes the
-            // hot path slower for the success case.
-            const ps = `try { Import-Module BurntToast -ErrorAction Stop; New-BurntToastNotification -Text '${safeTitle}', '${safeMessage}' } catch { exit 1 }`;
-            spawn('powershell.exe', [
-                '-NoProfile',
-                '-NonInteractive',
-                '-Command',
-                ps,
-            ], { detached: true, stdio: 'ignore' }).unref();
-        }
-        // freebsd / openbsd / aix / sunos / android — BEL only. There's no
-        // single "right" native notification on these platforms.
+    if (plat === 'darwin') {
+        // AppleScript single-quote inside the script body would need
+        // escaping; sanitize() strips them so the literal substitution
+        // below stays safe. Spawned via array argv to avoid a shell
+        // entirely.
+        spawnFireAndForget('osascript', [
+            '-e',
+            `display notification "${safeMessage}" with title "${safeTitle}"`,
+        ]);
     }
-    catch {
-        // spawn() itself can throw on EMFILE or similar; silent.
+    else if (plat === 'linux') {
+        spawnFireAndForget('notify-send', [safeTitle, safeMessage]);
+    }
+    else if (plat === 'win32') {
+        // BurntToast is the cleanest path — single-line PowerShell, real
+        // Windows toast notification. If BurntToast isn't installed the
+        // command fails silently (stdio: ignore swallows the error
+        // output), which is the desired behavior.
+        //
+        // We don't probe-then-spawn; the cost of one failed BurntToast
+        // attempt is the same as one probe attempt, and probing makes the
+        // hot path slower for the success case.
+        const ps = `try { Import-Module BurntToast -ErrorAction Stop; New-BurntToastNotification -Text '${safeTitle}', '${safeMessage}' } catch { exit 1 }`;
+        spawnFireAndForget('powershell.exe', [
+            '-NoProfile',
+            '-NonInteractive',
+            '-Command',
+            ps,
+        ]);
     }
+    // freebsd / openbsd / aix / sunos / android — BEL only. There's no
+    // single "right" native notification on these platforms.
 }
 /**
  * Strip characters that would break the embedded shell/AppleScript

package/dist/proxy.js

@@ -13,7 +13,7 @@ import { buildCCRequest, applyCcPromptCaching, parseEffortSuffix, reverseMapResp
 import { stampCch, hasCchSeed } from './cch.js';
 import { describeTemplate, detectDrift, checkCCCompat } from './live-fingerprint.js';
 import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, reconcilePoolAccounts } from './pool.js';
-import { Analytics, billingBucketFromClaim } from './analytics.js';
+import { Analytics, billingBucketFromClaim, SUBSCRIPTION_CLAIMS } from './analytics.js';
 import { OverageGuard, buildHaltErrorBody } from './overage-guard.js';
 import { notify as osNotify } from './notify.js';
 import { loadAllAccounts, loadAccount, refreshAccountToken, resyncLoginFromCredentialsIfStale, ensureLoginCredentialsInPool } from './accounts.js';
@@ -2897,10 +2897,10 @@ export async function startProxy(opts = {}) {
                     if (overageUtil !== null) {
                         overagePct = `${Math.round(parseFloat(overageUtil) * 100)}%`;
                     }
-                    else if (billingClaim === 'five_hour'
-                        || billingClaim === 'five_hour_fallback'
-                        || billingClaim === 'seven_day'
-                        || billingClaim === 'seven_day_fallback') {
+                    else if (billingClaim && SUBSCRIPTION_CLAIMS.has(billingClaim)) {
+                        // Any subscription-side claim (incl. *_overage_included) with no
+                        // overage-utilization header means $0 extra usage — same sync
+                        // source as the guard so this list can't drift again.
                         overagePct = '0%';
                     }
                     else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "4.8.136",
+  "version": "4.8.137",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {