@askalf/dario 4.8.154 → 5.0.1

package/dist/cli.js

@@ -53,6 +53,22 @@ const DEFAULT_COMMAND = args.includes('--no-tui') ? 'help' : 'tui';
 // `dario --version` etc. still dispatch as expected.
 const positionalArgs = args.filter((a) => a !== '--no-tui');
 const command = positionalArgs[0] ?? DEFAULT_COMMAND;
+// v5.0 pool-as-primitive: materialize the just-authenticated `dario login`
+// credentials as a pool of one (accounts/login.json under the reserved `login`
+// alias) so every surface — proxy, doctor, config-report, /accounts — reads a
+// single credential model. Idempotent and copy-only: a no-op when an accounts/
+// pool already exists or no credentials are reachable, and it never refreshes
+// the token lineage (see ensureLoginCredentialsInPool). Best-effort — a failure
+// here shouldn't fail an otherwise-successful login; the proxy back-fills again
+// at startup.
+async function materializeLoginPool() {
+    try {
+        const alias = await ensureLoginCredentialsInPool();
+        if (alias)
+            console.log('  Pool: materialized as a pool of one (alias `login`).');
+    }
+    catch { /* non-fatal; proxy startup back-fills again */ }
+}
 async function login() {
     console.log('');
     console.log('  dario — Claude Login');
@@ -74,6 +90,7 @@ async function login() {
     if (creds?.claudeAiOauth?.accessToken && creds.claudeAiOauth.expiresAt > Date.now()) {
         if (noProxy) {
             console.log('  Found valid credentials. (--no-proxy / --manual: not starting proxy.)');
+            await materializeLoginPool();
             console.log('');
             return;
         }
@@ -93,6 +110,7 @@ async function login() {
             const tokens = await refreshTokens();
             const expiresIn = Math.round((tokens.expiresAt - Date.now()) / 60000);
             console.log(`  Refresh successful! Token expires in ${expiresIn} minutes.`);
+            await materializeLoginPool();
             console.log('');
             console.log('  Run `dario proxy` to start the API proxy.');
             console.log('');
@@ -129,6 +147,7 @@ async function login() {
         const expiresIn = Math.round((tokens.expiresAt - Date.now()) / 60000);
         console.log('  Login successful!');
         console.log(`  Token expires in ${expiresIn} minutes (auto-refreshes).`);
+        await materializeLoginPool();
         console.log('');
         if (noProxy) {
             console.log('  (--no-proxy / --manual: credentials saved, proxy not started.)');
@@ -360,9 +379,10 @@ async function proxy() {
     // read-to-completion pattern. Costs tokens (the response is fully
     // generated even if nobody reads it), so it's opt-in.
     const drainOnClose = args.includes('--drain-on-close') || fileCfg.drainOnClose || undefined;
-    // --session-* knobs (v3.28, direction #1). Control the single-account
-    // session-id lifecycle: idle threshold, jitter on that threshold, hard
-    // max-age, and whether to give each upstream client its own session.
+    // --session-* knobs (v3.28, direction #1). Control the session-id lifecycle:
+    // idle threshold, jitter on that threshold, hard max-age, and whether to give
+    // each upstream client its own session. v5.0: this policy now applies
+    // per-account (a pool of one behaves exactly as the pre-v5 single account).
     // All defaults preserve v3.27 behaviour exactly. Logic lives in
     // src/session-rotation.ts; these flags just feed resolveSessionRotationConfig.
     const sessionIdleRotateMs = parsePositiveIntFlag('--session-idle-rotate=');
@@ -777,23 +797,24 @@ async function accounts() {
         console.log('  ────────────────');
         console.log('');
         if (aliases.length === 0) {
-            console.log('  No multi-account pool configured.');
+            console.log('  No accounts in the pool yet.');
             console.log('');
-            console.log('  Pool mode activates automatically when ~/.dario/accounts/');
-            console.log('  has any entry. Add the first with:');
+            console.log('  The pool is the one credential model (v5.0): `dario login`');
+            console.log('  is a pool of one, materialized as the `login` account. Add');
+            console.log('  more to load-balance across subscriptions:');
             console.log('    dario accounts add <alias>');
             console.log('');
-            console.log('  Single-account dario (the default) keeps working as-is');
-            console.log('  with ~/.dario/credentials.json — you do not need to');
-            console.log('  migrate unless you want pool routing across accounts.');
+            console.log('  If you have run `dario login` but see this, its credentials');
+            console.log('  materialize into the pool on the next `dario login` or');
+            console.log('  `dario proxy`.');
             console.log('');
             return;
         }
         const loaded = await loadAllAccounts();
         const now = Date.now();
-        console.log(`  ${aliases.length} account${aliases.length === 1 ? '' : 's'} configured`);
+        console.log(`  Pool of ${aliases.length} (${aliases.length === 1 ? '1 account' : aliases.length + ' accounts'})`);
         if (aliases.length === 1) {
-            console.log('  (Pool routing serves this account — add another to load-balance across subscriptions.)');
+            console.log('  (A pool of one — add another with `dario accounts add <alias>` to load-balance.)');
         }
         console.log('');
         for (const a of loaded) {
@@ -1094,13 +1115,6 @@ async function help() {
     dario backend add NAME --key=sk-... [--base-url=...]
                              Add an OpenAI-compat backend (OpenAI, OpenRouter, Groq, etc.)
     dario backend remove N   Remove an OpenAI-compat backend
-    dario shim -- CMD ARGS   [DEPRECATED — removal scheduled for v5.x]
-                             Run CMD with dario's fetch-patch in-process.
-                             Only replaces 3 of 8 billing-classifier axes
-                             (system blocks, agent identity, header order).
-                             Falls back to passthrough on 1-block system
-                             requests (\`claude -p\`, Agent SDK). Use proxy
-                             mode for non-CC clients. See CHANGELOG v4.2.0.
     dario subagent install   Register ~/.claude/agents/dario.md so Claude Code
                              can delegate dario diagnostics / template-refresh
                              operations to a named sub-agent (v3.26)
@@ -1208,7 +1222,7 @@ async function help() {
                              proxy's JA3/JA4 ClientHello indistinguishable
                              from a stock CC request. Install Bun
                              (https://bun.sh) so dario auto-relaunches
-                             under it, or use shim mode. (v3.23)
+                             under it. (v3.23)
     --stealth                Single-flag behavioral-stealth preset.
                              Flips pace-jitter, think-time, and
                              session-start defaults from 0 to non-zero
@@ -1268,11 +1282,12 @@ async function help() {
                              is fully generated even if nobody reads
                              it) for fingerprint fidelity. Bounded by
                              the 5-minute upstream timeout. (v3.25)
-    --session-idle-rotate=MS Idle ms before the single-account session
-                             id rotates (default: 900000 = 15 min).
+    --session-idle-rotate=MS Idle ms before an account's session id
+                             rotates (default: 900000 = 15 min).
                              Real CC rotates once per conversation, not
                              per call; the default matches its observed
-                             cadence. Pool mode is unaffected. (v3.28)
+                             cadence. Applies per account — a pool of one
+                             rotates as the pre-v5 single account did. (v3.28)
     --session-rotate-jitter=MS
                              Max additional uniform-random jitter (ms)
                              added to the idle threshold, sampled once
@@ -1489,109 +1504,20 @@ async function help() {
   Tokens auto-refresh in the background — set it and forget it.
 `);
 }
+// `dario shim` was removed in v5.0 (deprecated since v4.2 — it matched only
+// 3 of the 8 billing-classifier axes and fell back to passthrough on 1-block
+// system requests). This stub keeps the failure mode a one-line pointer
+// instead of an "unknown command" for users upgrading across the boundary.
 async function shim() {
-    // dario shim -- <command> [args...]
-    // The `--` separator is conventional but optional; if the user omits it
-    // we just pass everything after `shim` through to the child.
-    const rest = args.slice(1);
-    const sepIdx = rest.indexOf('--');
-    let verbose = false;
-    let priority = 'normal';
-    let head;
-    let childArgs;
-    if (sepIdx >= 0) {
-        head = rest.slice(0, sepIdx);
-        childArgs = rest.slice(sepIdx + 1);
-    }
-    else {
-        head = [];
-        childArgs = rest;
-    }
-    for (const flag of head) {
-        if (flag === '-v' || flag === '--verbose')
-            verbose = true;
-        else if (flag.startsWith('--priority=')) {
-            const v = flag.slice('--priority='.length);
-            if (v !== 'normal' && v !== 'below-normal' && v !== 'low') {
-                console.error(`--priority: invalid value ${JSON.stringify(v)}. Expected one of: normal, below-normal, low.`);
-                process.exit(1);
-            }
-            priority = v;
-        }
-        else {
-            console.error(`Unknown shim flag: ${flag}`);
-            process.exit(1);
-        }
-    }
-    if (childArgs.length === 0) {
-        console.error('Usage: dario shim [-v] [--priority=normal|below-normal|low] -- <command> [args...]');
-        console.error('Example: dario shim -- claude --print -p "hi"');
-        console.error('         dario shim --priority=below-normal -- claude   (recommended on Windows when RDP\'d into the host)');
-        process.exit(1);
-    }
-    // v4.2.0+: shim mode is DEPRECATED — set for removal in v5.x.
-    //
-    // The empirical reason (verified by side-by-side fingerprint diff of
-    // shim's `_rewriteBody` against the proxy's `buildCCRequest` — see
-    // CHANGELOG v4.2.0 entry): shim mode only replaces 3 of the 8 axes
-    // Anthropic's billing classifier actually inspects (system blocks,
-    // agent identity, header order). It leaves the client's JSON key
-    // order, max_tokens value, metadata billing tag, and any non-CC
-    // fields (temperature, top_p, service_tier) unchanged on the wire.
-    // And on the most-common claude -p / Agent-SDK request shape (which
-    // sends a 1-block system, not the 3-block shape shim's shape-check
-    // hardcodes), shim silently falls back to total passthrough — sending
-    // the client's raw body to api.anthropic.com with zero replay.
-    //
-    // For interactive CC (`dario shim -- claude`), this is mostly a no-op
-    // because CC's own outbound already matches every axis dario would
-    // synthesize. But for any non-CC client (`dario shim -- aider`,
-    // `dario shim -- cline`, your own scripts), shim mode does not deliver
-    // the wire fidelity the README claims.
-    //
-    // We warn loudly here instead of silently breaking, and point users
-    // at proxy mode. Set DARIO_SHIM_NO_DEPRECATION_WARNING=1 to suppress
-    // the banner for scripts that need the exit-code semantics but have
-    // already migrated their understanding.
-    if (process.env['DARIO_SHIM_NO_DEPRECATION_WARNING'] !== '1') {
-        console.error('');
-        console.error('[dario] ⚠ DEPRECATION: `dario shim` is deprecated in v4.2 and scheduled for removal in v5.x.');
-        console.error('[dario]');
-        console.error('[dario] Shim mode only matches a subset of the wire-shape axes Anthropic\'s billing classifier');
-        console.error('[dario] inspects. Specifically, it does not normalize JSON key order, max_tokens, metadata');
-        console.error('[dario] billing-tag, or non-CC body fields. On `claude -p` / Agent-SDK style requests (1-block');
-        console.error('[dario] system), shim falls back to total passthrough — the client\'s raw body reaches the');
-        console.error('[dario] upstream unchanged.');
-        console.error('[dario]');
-        console.error('[dario] Use proxy mode instead, which rebuilds every request to CC\'s exact wire shape:');
-        console.error('[dario]');
-        console.error('[dario]   Terminal 1:  dario proxy');
-        console.error('[dario]   Terminal 2:  ANTHROPIC_BASE_URL=http://localhost:3456 \\');
-        console.error('[dario]                ANTHROPIC_API_KEY=dario \\');
-        console.error('[dario]                ' + childArgs.join(' '));
-        console.error('[dario]');
-        console.error('[dario] To suppress this banner: DARIO_SHIM_NO_DEPRECATION_WARNING=1');
-        console.error('');
-    }
-    const { runShim } = await import('./shim/host.js');
-    try {
-        const result = await runShim({
-            command: childArgs[0],
-            args: childArgs.slice(1),
-            verbose,
-            priority,
-        });
-        if (verbose) {
-            const summary = result.analytics.summary(60);
-            console.error(`[dario shim] ${result.events.length} relay events, ` +
-                `subscriptionPercent=${summary.window.subscriptionPercent}%`);
-        }
-        process.exit(result.exitCode);
-    }
-    catch (err) {
-        console.error('shim failed:', sanitizeError(err));
-        process.exit(1);
-    }
+    console.error('`dario shim` was removed in v5.0. Use proxy mode instead:');
+    console.error('');
+    console.error('  Terminal 1:  dario proxy');
+    console.error('  Terminal 2:  ANTHROPIC_BASE_URL=http://localhost:3456 \\');
+    console.error('               ANTHROPIC_API_KEY=dario \\');
+    console.error('               <your command>');
+    console.error('');
+    console.error('See MIGRATION.md (v4 → v5) for details.');
+    process.exit(1);
 }
 async function subagent() {
     const sub = args[1] ?? 'status';

package/dist/config-report.js

@@ -82,10 +82,25 @@ export async function collectEffectiveConfig() {
     try {
         const { listAccountAliases } = await import('./accounts.js');
         const aliases = await listAccountAliases();
+        // Pool-as-primitive (v5.0): the pool is the one credential model. An empty
+        // accounts/ dir means either not-logged-in or a `dario login` whose
+        // credentials.json hasn't been back-filled into the pool yet (that happens
+        // on the next `dario login` / `dario proxy`), so report the pending pool-of-one.
+        let mode;
+        if (aliases.length > 0) {
+            mode = `pool of ${aliases.length}`;
+        }
+        else {
+            const { loadCredentials } = await import('./oauth.js');
+            const creds = await loadCredentials();
+            mode = creds?.claudeAiOauth?.accessToken
+                ? 'pool of 1 (login, not yet materialized)'
+                : 'empty (run `dario login`)';
+        }
         sections.push({
             title: 'Account pool',
             rows: [
-                { label: 'mode', value: aliases.length === 0 ? 'single-account (no pool)' : `pool of ${aliases.length}` },
+                { label: 'mode', value: mode },
                 ...(aliases.length > 0 ? [{ label: 'aliases', value: aliases.join(', ') }] : []),
             ],
         });

package/dist/doctor.d.ts

@@ -70,7 +70,7 @@ export interface IdentityDriftInput {
         deviceId: string;
         accountUuid: string;
     } | null;
-    /** Pool account snapshots — `[]` for single-account mode. */
+    /** Pool account snapshots — `[]` when no pool accounts are materialized yet. */
     poolAccounts: Array<{
         alias: string;
         deviceId: string;

package/dist/doctor.js

@@ -104,7 +104,7 @@ export function checkIdentityDrift(input) {
         return [{
                 status: 'info',
                 label: 'Identity',
-                detail: `~/.claude.json userID=${shortId(live.deviceId)} — single-account mode reads identity live per-request, so drift between the loaded bearer and ~/.claude.json only surfaces as 401 from Anthropic on non-Haiku models. Pool mode (\`dario accounts add\`) snapshots identity for drift detection.`,
+                detail: `~/.claude.json userID=${shortId(live.deviceId)} — no pool accounts snapshotted yet, so identity drift can't be checked. It starts once the login pool-of-one is materialized (\`dario login\` / \`dario proxy\`) or you \`dario accounts add\` more; until then a mismatch only surfaces as a 401 from Anthropic on non-Haiku models.`,
             }];
     }
     const aligned = [];
@@ -740,7 +740,17 @@ export async function runChecks(opts = {}) {
         const { listAccountAliases, loadAllAccounts } = await import('./accounts.js');
         const aliases = await listAccountAliases();
         if (aliases.length === 0) {
-            checks.push({ status: 'info', label: 'Pool', detail: 'single-account mode — `dario accounts add <alias>` enables headroom-routed pool across multiple subscriptions' });
+            // Pool-as-primitive (v5.0): no accounts/ entries. Either not logged in,
+            // or a pre-v5 `dario login` whose credentials.json hasn't been back-filled
+            // into the pool yet — that happens on the next `dario login` / `dario proxy`.
+            const { loadCredentials } = await import('./oauth.js');
+            const creds = await loadCredentials();
+            if (creds?.claudeAiOauth?.accessToken) {
+                checks.push({ status: 'info', label: 'Pool', detail: 'pool of 1 (login credentials present, not yet materialized — runs on next `dario login` or `dario proxy`); `dario accounts add <alias>` adds more for headroom routing' });
+            }
+            else {
+                checks.push({ status: 'info', label: 'Pool', detail: 'empty — run `dario login` (a pool of one) or `dario accounts add <alias>`' });
+            }
         }
         else {
             const loaded = await loadAllAccounts();
@@ -749,9 +759,9 @@ export async function runChecks(opts = {}) {
             checks.push({
                 status: expired > 0 ? 'warn' : 'ok',
                 label: 'Pool',
-                detail: `${aliases.length} account${aliases.length === 1 ? '' : 's'}` +
+                detail: `pool of ${aliases.length}` +
                     (expired > 0 ? `, ${expired} expired` : '') +
-                    (aliases.length === 1 ? ' (pool active — add more to load-balance)' : ''),
+                    (aliases.length === 1 ? ' (a pool of one — `dario accounts add <alias>` to load-balance)' : ''),
             });
             // Next-account-in-rotation surfacing. The proxy's per-request
             // selector picks by max headroom (with 7d_<family> per-model
@@ -761,9 +771,9 @@ export async function runChecks(opts = {}) {
             // operators wondering "if I send a request right now, which
             // account gets it?" — it matches `pool.select()` with no family
             // hint, the same call the proxy uses when no model is parsed
-            // yet (e.g. on misshapen requests). Bypassed when only one
-            // account is loaded since "rotation" doesn't apply.
-            if (aliases.length >= 2) {
+            // yet (e.g. on misshapen requests). Shown for a pool of one too
+            // (v5.0): it confirms the sole account is eligible, not rejected.
+            if (aliases.length >= 1) {
                 try {
                     const { AccountPool } = await import('./pool.js');
                     const pool = new AccountPool();

package/dist/live-fingerprint.d.ts

@@ -41,9 +41,9 @@
  *      provided both run on the same Node major. A cross-runtime worry
  *      surfaces when Anthropic ships Bun- or bundled-binary CC: at that
  *      point Node-dario and Bun-CC would JA-differ.
- *      → Mitigation: detect Bun-compiled CC, fall back to shim mode
- *        (which patches fetch INSIDE the CC process, inheriting CC's
- *        own TLS stack for free).
+ *      → Mitigation: dario auto-relaunches under Bun when it's on PATH so
+ *        the proxy's ClientHello matches CC's Bun/BoringSSL shape;
+ *        `--strict-tls` refuses to start otherwise.
  *
  *   3. HTTP/2 frame ordering + SETTINGS parameters. Similar to TLS, this
  *      is controlled by the HTTP library. Node and undici produce a
@@ -115,8 +115,8 @@ export interface TemplateData {
     /**
      * The `anthropic-beta` flag set CC sent on the captured request, verbatim.
      * Schema v2 (v3.19). Previously the proxy path hardcoded this — bumping
-     * CC's beta list required a dario release. Now the shim and proxy both
-     * replay whatever the live capture recorded. Falls back to
+     * CC's beta list required a dario release. Now the proxy replays
+     * whatever the live capture recorded. Falls back to
      * `'claude-code-20250219'` when undefined (bundled snapshots, older caches).
      */
     anthropic_beta?: string;
@@ -236,9 +236,9 @@ export declare function probeInstalledCCVersion(): string | null;
 export declare function formatCaptureAge(capturedIso: string, now?: number): string;
 /**
  * One-line human summary of the active template — what source, which CC
- * version captured it, and how old that capture is. Proxy and shim
- * startup log this so users can tell at a glance whether they're on a
- * fresh live capture or a stale bundled fallback.
+ * version captured it, and how old that capture is. Proxy startup logs
+ * this so users can tell at a glance whether they're on a fresh live
+ * capture or a stale bundled fallback.
  */
 export declare function describeTemplate(t: TemplateData): string;
 export interface DriftResult {

package/dist/live-fingerprint.js

@@ -41,9 +41,9 @@
  *      provided both run on the same Node major. A cross-runtime worry
  *      surfaces when Anthropic ships Bun- or bundled-binary CC: at that
  *      point Node-dario and Bun-CC would JA-differ.
- *      → Mitigation: detect Bun-compiled CC, fall back to shim mode
- *        (which patches fetch INSIDE the CC process, inheriting CC's
- *        own TLS stack for free).
+ *      → Mitigation: dario auto-relaunches under Bun when it's on PATH so
+ *        the proxy's ClientHello matches CC's Bun/BoringSSL shape;
+ *        `--strict-tls` refuses to start otherwise.
  *
  *   3. HTTP/2 frame ordering + SETTINGS parameters. Similar to TLS, this
  *      is controlled by the HTTP library. Node and undici produce a
@@ -735,9 +735,9 @@ export function formatCaptureAge(capturedIso, now = Date.now()) {
 }
 /**
  * One-line human summary of the active template — what source, which CC
- * version captured it, and how old that capture is. Proxy and shim
- * startup log this so users can tell at a glance whether they're on a
- * fresh live capture or a stale bundled fallback.
+ * version captured it, and how old that capture is. Proxy startup logs
+ * this so users can tell at a glance whether they're on a fresh live
+ * capture or a stale bundled fallback.
  */
 export function describeTemplate(t) {
     const source = t._source ?? 'bundled';

package/dist/proxy.d.ts

@@ -463,17 +463,8 @@ export declare function describeAuthReject(headers: IncomingMessage['headers']):
  */
 export declare function upstreamAuthHeaders(upstreamApiKey: string, accessToken: string): Record<string, string>;
 /**
- * Whether the proxy routes through the account pool. Any entry in
- * `~/.dario/accounts/` activates the pool (#618) — so a cold
- * `dario accounts add` bootstraps a servable proxy with no `dario login`
- * step — and admin mode always does (#599), where the pool may start empty
- * and be populated over HTTP. Login-only setups (no accounts/ entries) keep
- * the single-account credentials.json path. Pure + exported for unit
- * testing.
- */
-export declare function shouldUsePool(accountCount: number, adminEnabled: boolean): boolean;
-/**
- * Resolve the single-account startup auth outcome, refreshing an expired-but-
+ * Resolve the startup auth outcome when the pool is empty and there's a
+ * `dario login` credentials.json to fall back on — refreshing an expired-but-
  * refreshable access token before giving up.
  *
  * The classic single-account startup used to read getStatus() once and, on any