@askalf/dario 5.2.9 → 5.2.10

package/dist/accounts.d.ts

@@ -134,6 +134,9 @@ export declare function ensureLoginCredentialsInPool(alias?: string): Promise<st
  *   - 'in-sync'      : tokens match; no action
  *   - 'resynced'     : login.json was stale; overwrote with current
  *                       credentials. Caller should reload pool state
+ *   - 'creds-stale'  : login.json is STRICTLY NEWER than credentials.json
+ *                       (the pool refreshed it; the legacy file is stale) —
+ *                       left login.json untouched. dario#805.
  *
  * Why: the single-account path keeps refreshing `credentials.json` in
  * the background (proxy startup auth check, periodic refresh in oauth.ts).
@@ -143,9 +146,17 @@ export declare function ensureLoginCredentialsInPool(alias?: string): Promise<st
  * says "healthy" so the selector keeps picking it. Detect this at startup
  * and overwrite with the current canonical content. dario#235.
  *
+ * BUT the divergence runs BOTH ways. In pool mode the pool's own refresh
+ * loop advances `login.json` while `credentials.json` stays frozen (the
+ * pool never writes it). Blindly overwriting login.json from credentials.json
+ * would then clobber a live token with the stale legacy one whose refresh
+ * Anthropic already rotated → invalid_grant on every startup → fleet-wide
+ * auth outage. So we reconcile by FRESHNESS, not by assuming credentials.json
+ * wins. dario#805 (the second outage of this class within 12h).
+ *
  * Runs at any pool size ≥ 1: a lone `login` entry is a live pool member
  * since pool-at-one (dario#618) and can go stale exactly the same way —
  * e.g. after `accounts remove` shrinks a migrated pool back to just the
  * back-filled snapshot.
  */
-export declare function resyncLoginFromCredentialsIfStale(): Promise<'no-pool' | 'no-login' | 'no-creds' | 'in-sync' | 'resynced'>;
+export declare function resyncLoginFromCredentialsIfStale(): Promise<'no-pool' | 'no-login' | 'no-creds' | 'in-sync' | 'resynced' | 'creds-stale'>;

package/dist/accounts.js

@@ -553,6 +553,9 @@ export async function ensureLoginCredentialsInPool(alias = MIGRATED_LOGIN_ALIAS)
  *   - 'in-sync'      : tokens match; no action
  *   - 'resynced'     : login.json was stale; overwrote with current
  *                       credentials. Caller should reload pool state
+ *   - 'creds-stale'  : login.json is STRICTLY NEWER than credentials.json
+ *                       (the pool refreshed it; the legacy file is stale) —
+ *                       left login.json untouched. dario#805.
  *
  * Why: the single-account path keeps refreshing `credentials.json` in
  * the background (proxy startup auth check, periodic refresh in oauth.ts).
@@ -562,6 +565,14 @@ export async function ensureLoginCredentialsInPool(alias = MIGRATED_LOGIN_ALIAS)
  * says "healthy" so the selector keeps picking it. Detect this at startup
  * and overwrite with the current canonical content. dario#235.
  *
+ * BUT the divergence runs BOTH ways. In pool mode the pool's own refresh
+ * loop advances `login.json` while `credentials.json` stays frozen (the
+ * pool never writes it). Blindly overwriting login.json from credentials.json
+ * would then clobber a live token with the stale legacy one whose refresh
+ * Anthropic already rotated → invalid_grant on every startup → fleet-wide
+ * auth outage. So we reconcile by FRESHNESS, not by assuming credentials.json
+ * wins. dario#805 (the second outage of this class within 12h).
+ *
  * Runs at any pool size ≥ 1: a lone `login` entry is a live pool member
  * since pool-at-one (dario#618) and can go stale exactly the same way —
  * e.g. after `accounts remove` shrinks a migrated pool back to just the
@@ -584,9 +595,19 @@ export async function resyncLoginFromCredentialsIfStale() {
         loginAcc.refreshToken === tok.refreshToken) {
         return 'in-sync';
     }
-    // Tokens diverged — credentials.json has refreshed since last back-fill.
-    // Overwrite the snapshot, preserving deviceId/accountUuid (they don't
-    // rotate with token refresh; they're pool-internal identity).
+    // Tokens diverged. Reconcile by FRESHNESS — a strictly-newer login.json is
+    // the pool having refreshed it (credentials.json is the stale legacy copy),
+    // and overwriting it from credentials.json would swap a live token for one
+    // whose refresh Anthropic already rotated → invalid_grant → outage (#805).
+    // Only the strict case is skipped; equal expiresAt keeps the #235 behaviour
+    // (overwrite), since a real refresh always advances expiresAt.
+    if (loginAcc.expiresAt > tok.expiresAt) {
+        return 'creds-stale';
+    }
+    // credentials.json is the newer (or equal-age) token — the #235 case: the
+    // single-account path refreshed it and the pool snapshot is stale. Overwrite,
+    // preserving deviceId/accountUuid (they don't rotate with token refresh;
+    // they're pool-internal identity).
     await saveAccount({
         alias: MIGRATED_LOGIN_ALIAS,
         accessToken: tok.accessToken,

package/dist/proxy.js

@@ -1139,6 +1139,9 @@ export async function startProxy(opts = {}) {
     if (resyncResult === 'resynced') {
         console.log('[dario] re-synced pool `login` account from current credentials.json (was stale; dario#235)');
     }
+    else if (resyncResult === 'creds-stale') {
+        console.log('[dario] kept the newer pool `login` token; credentials.json is stale — NOT overwriting (dario#805)');
+    }
     // Admin mode (#599) manages the pool over HTTP: it may legitimately start
     // with zero accounts and returns a clean 503 until one is added via
     // POST /admin/login/*, taking effect with no restart (see onAccountsChanged).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "5.2.9",
+  "version": "5.2.10",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {