@askalf/dario 5.2.9 → 5.2.11

package/dist/accounts.d.ts

@@ -134,6 +134,9 @@ export declare function ensureLoginCredentialsInPool(alias?: string): Promise<st
  *   - 'in-sync'      : tokens match; no action
  *   - 'resynced'     : login.json was stale; overwrote with current
  *                       credentials. Caller should reload pool state
+ *   - 'creds-stale'  : login.json is STRICTLY NEWER than credentials.json
+ *                       (the pool refreshed it; the legacy file is stale) —
+ *                       left login.json untouched. dario#805.
  *
  * Why: the single-account path keeps refreshing `credentials.json` in
  * the background (proxy startup auth check, periodic refresh in oauth.ts).
@@ -143,9 +146,50 @@ export declare function ensureLoginCredentialsInPool(alias?: string): Promise<st
  * says "healthy" so the selector keeps picking it. Detect this at startup
  * and overwrite with the current canonical content. dario#235.
  *
+ * BUT the divergence runs BOTH ways. In pool mode the pool's own refresh
+ * loop advances `login.json` while `credentials.json` stays frozen (the
+ * pool never writes it). Blindly overwriting login.json from credentials.json
+ * would then clobber a live token with the stale legacy one whose refresh
+ * Anthropic already rotated → invalid_grant on every startup → fleet-wide
+ * auth outage. So we reconcile by FRESHNESS, not by assuming credentials.json
+ * wins. dario#805 (the second outage of this class within 12h).
+ *
  * Runs at any pool size ≥ 1: a lone `login` entry is a live pool member
  * since pool-at-one (dario#618) and can go stale exactly the same way —
  * e.g. after `accounts remove` shrinks a migrated pool back to just the
  * back-filled snapshot.
  */
-export declare function resyncLoginFromCredentialsIfStale(): Promise<'no-pool' | 'no-login' | 'no-creds' | 'in-sync' | 'resynced'>;
+export declare function resyncLoginFromCredentialsIfStale(): Promise<'no-pool' | 'no-login' | 'no-creds' | 'in-sync' | 'resynced' | 'creds-stale'>;
+/**
+ * Mirror the pool's freshly-refreshed `login` account token back into the
+ * legacy `~/.dario/credentials.json` store. dario#808.
+ *
+ * The divergence #805 fixed runs one way (credentials.json stale, login.json
+ * fresh) but left the two files diverged: the pool's refresh loop advances
+ * accounts/login.json while nothing ever writes credentials.json, so the
+ * legacy file stays frozen at the last `dario login`. Consequences:
+ *   - `dario doctor` reads credentials.json for its OAuth row and prints
+ *     'expired'/'expiring' in pool-of-1 mode even when the live pool token is
+ *     fresh and the fleet is 200-healthy — an alarm-inducing false positive.
+ *   - any other reader of credentials.json (a co-resident Claude Code, an ops
+ *     script) sees a stale token indefinitely.
+ *
+ * Fix: whenever the pool refreshes the `login` account, mirror the new token
+ * into credentials.json so the legacy file tracks the pool store. Only the
+ * `login` alias is mirrored — it's the one back-filled FROM credentials.json
+ * (ensureLoginCredentialsInPool), so it's the only account whose canonical
+ * home is that file; `work`/`personal` accounts have no legacy counterpart.
+ *
+ * Freshness-guarded, symmetric with #805: mirror only when the refreshed login
+ * token is strictly NEWER than the current credentials.json (by `expiresAt`).
+ * A newer-or-equal credentials.json means another process (e.g. a concurrent
+ * `dario login --force-reauth`) just wrote a fresher family — never clobber it;
+ * resyncLoginFromCredentialsIfStale pulls that direction on next startup.
+ *
+ * Best-effort: a mirror failure must never fail the refresh that produced the
+ * live token. Returns one of:
+ *   - 'skip-not-login' : alias isn't the reserved `login` — nothing to mirror
+ *   - 'mirrored'       : credentials.json updated to the pool token
+ *   - 'creds-newer'    : credentials.json is newer-or-equal — left untouched
+ */
+export declare function mirrorLoginToCredentials(refreshed: AccountCredentials): Promise<'skip-not-login' | 'mirrored' | 'creds-newer'>;

package/dist/accounts.js

@@ -23,7 +23,7 @@ import { homedir } from 'node:os';
 import { randomUUID, randomBytes, createHash } from 'node:crypto';
 import { createServer } from 'node:http';
 import { detectCCOAuthConfig } from './cc-oauth-detect.js';
-import { loadCredentials, buildManualAuthorizeUrl, parseManualPaste, readLineFromStdin, enumerateKeychainCredentials } from './oauth.js';
+import { loadCredentials, saveCredentialsTokens, buildManualAuthorizeUrl, parseManualPaste, readLineFromStdin, enumerateKeychainCredentials } from './oauth.js';
 import { openBrowser } from './open-browser.js';
 import { redactSecrets } from './redact.js';
 import { durableWriteFile } from './durable-write.js';
@@ -553,6 +553,9 @@ export async function ensureLoginCredentialsInPool(alias = MIGRATED_LOGIN_ALIAS)
  *   - 'in-sync'      : tokens match; no action
  *   - 'resynced'     : login.json was stale; overwrote with current
  *                       credentials. Caller should reload pool state
+ *   - 'creds-stale'  : login.json is STRICTLY NEWER than credentials.json
+ *                       (the pool refreshed it; the legacy file is stale) —
+ *                       left login.json untouched. dario#805.
  *
  * Why: the single-account path keeps refreshing `credentials.json` in
  * the background (proxy startup auth check, periodic refresh in oauth.ts).
@@ -562,6 +565,14 @@ export async function ensureLoginCredentialsInPool(alias = MIGRATED_LOGIN_ALIAS)
  * says "healthy" so the selector keeps picking it. Detect this at startup
  * and overwrite with the current canonical content. dario#235.
  *
+ * BUT the divergence runs BOTH ways. In pool mode the pool's own refresh
+ * loop advances `login.json` while `credentials.json` stays frozen (the
+ * pool never writes it). Blindly overwriting login.json from credentials.json
+ * would then clobber a live token with the stale legacy one whose refresh
+ * Anthropic already rotated → invalid_grant on every startup → fleet-wide
+ * auth outage. So we reconcile by FRESHNESS, not by assuming credentials.json
+ * wins. dario#805 (the second outage of this class within 12h).
+ *
  * Runs at any pool size ≥ 1: a lone `login` entry is a live pool member
  * since pool-at-one (dario#618) and can go stale exactly the same way —
  * e.g. after `accounts remove` shrinks a migrated pool back to just the
@@ -584,9 +595,19 @@ export async function resyncLoginFromCredentialsIfStale() {
         loginAcc.refreshToken === tok.refreshToken) {
         return 'in-sync';
     }
-    // Tokens diverged — credentials.json has refreshed since last back-fill.
-    // Overwrite the snapshot, preserving deviceId/accountUuid (they don't
-    // rotate with token refresh; they're pool-internal identity).
+    // Tokens diverged. Reconcile by FRESHNESS — a strictly-newer login.json is
+    // the pool having refreshed it (credentials.json is the stale legacy copy),
+    // and overwriting it from credentials.json would swap a live token for one
+    // whose refresh Anthropic already rotated → invalid_grant → outage (#805).
+    // Only the strict case is skipped; equal expiresAt keeps the #235 behaviour
+    // (overwrite), since a real refresh always advances expiresAt.
+    if (loginAcc.expiresAt > tok.expiresAt) {
+        return 'creds-stale';
+    }
+    // credentials.json is the newer (or equal-age) token — the #235 case: the
+    // single-account path refreshed it and the pool snapshot is stale. Overwrite,
+    // preserving deviceId/accountUuid (they don't rotate with token refresh;
+    // they're pool-internal identity).
     await saveAccount({
         alias: MIGRATED_LOGIN_ALIAS,
         accessToken: tok.accessToken,
@@ -598,3 +619,53 @@ export async function resyncLoginFromCredentialsIfStale() {
     });
     return 'resynced';
 }
+/**
+ * Mirror the pool's freshly-refreshed `login` account token back into the
+ * legacy `~/.dario/credentials.json` store. dario#808.
+ *
+ * The divergence #805 fixed runs one way (credentials.json stale, login.json
+ * fresh) but left the two files diverged: the pool's refresh loop advances
+ * accounts/login.json while nothing ever writes credentials.json, so the
+ * legacy file stays frozen at the last `dario login`. Consequences:
+ *   - `dario doctor` reads credentials.json for its OAuth row and prints
+ *     'expired'/'expiring' in pool-of-1 mode even when the live pool token is
+ *     fresh and the fleet is 200-healthy — an alarm-inducing false positive.
+ *   - any other reader of credentials.json (a co-resident Claude Code, an ops
+ *     script) sees a stale token indefinitely.
+ *
+ * Fix: whenever the pool refreshes the `login` account, mirror the new token
+ * into credentials.json so the legacy file tracks the pool store. Only the
+ * `login` alias is mirrored — it's the one back-filled FROM credentials.json
+ * (ensureLoginCredentialsInPool), so it's the only account whose canonical
+ * home is that file; `work`/`personal` accounts have no legacy counterpart.
+ *
+ * Freshness-guarded, symmetric with #805: mirror only when the refreshed login
+ * token is strictly NEWER than the current credentials.json (by `expiresAt`).
+ * A newer-or-equal credentials.json means another process (e.g. a concurrent
+ * `dario login --force-reauth`) just wrote a fresher family — never clobber it;
+ * resyncLoginFromCredentialsIfStale pulls that direction on next startup.
+ *
+ * Best-effort: a mirror failure must never fail the refresh that produced the
+ * live token. Returns one of:
+ *   - 'skip-not-login' : alias isn't the reserved `login` — nothing to mirror
+ *   - 'mirrored'       : credentials.json updated to the pool token
+ *   - 'creds-newer'    : credentials.json is newer-or-equal — left untouched
+ */
+export async function mirrorLoginToCredentials(refreshed) {
+    if (refreshed.alias !== MIGRATED_LOGIN_ALIAS)
+        return 'skip-not-login';
+    const creds = await loadCredentials();
+    const currentExpiry = creds?.claudeAiOauth?.expiresAt ?? 0;
+    // Only mirror a strictly-newer pool token. Equal expiry means the files
+    // already agree (or a same-second write elsewhere); newer credentials.json
+    // is another process's fresher family we must not overwrite (#805 direction).
+    if (currentExpiry >= refreshed.expiresAt)
+        return 'creds-newer';
+    await saveCredentialsTokens({
+        accessToken: refreshed.accessToken,
+        refreshToken: refreshed.refreshToken,
+        expiresAt: refreshed.expiresAt,
+        scopes: refreshed.scopes ?? creds?.claudeAiOauth?.scopes ?? [],
+    });
+    return 'mirrored';
+}

package/dist/cc-template-data.json

@@ -1,6 +1,6 @@
 {
   "_version": "2.1.214",
-  "_captured": "2026-07-14T06:32:01.705Z",
+  "_captured": "2026-07-18T14:14:16.825Z",
   "_source": "bundled",
   "_schemaVersion": 3,
   "agent_identity": "You are a Claude agent, built on Anthropic's Claude Agent SDK.",
@@ -8,7 +8,7 @@
   "tools": [
     {
       "name": "Agent",
-      "description": "Launch a new agent to handle complex, multi-step tasks. Each agent type has specific capabilities and tools available to it.\n\nAvailable agent types are listed in <system-reminder> messages in the conversation.\n\nWhen using the Agent tool, specify a subagent_type parameter to select which agent type to use. If omitted, the general-purpose agent is used.\n\n## When to use\n\nReach for this when the task matches an available agent type, when you have independent work to run in parallel, or when answering would mean reading across several files — delegate it and you keep the conclusion, not the file dumps. For a single-fact lookup where you already know the file, symbol, or value, search directly. Once you've delegated a search, don't also run it yourself — wait for the result.\n\n- The agent's final message is returned to you as the tool result; it is not shown to the user — relay what matters.\n- Use SendMessage with the agent's ID or name to continue a previously spawned agent with its context intact; a new Agent call starts fresh.\n- Each agent type's model, reasoning effort, and tools come from its definition (`.claude/agents/*.md` frontmatter or SDK `agents`).\n- `isolation: \"worktree\"` gives the agent its own git worktree (auto-cleaned if unchanged).\n- Subagents run in the background by default; you'll be notified when one completes. Pass `run_in_background: false` for a synchronous run when you need the result before continuing.",
+      "description": "Launch a new agent to handle complex, multi-step tasks. Each agent type has specific capabilities and tools available to it.\n\nAvailable agent types are listed in <system-reminder> messages in the conversation.\n\nWhen using the Agent tool, specify a subagent_type parameter to select which agent type to use. If omitted, the general-purpose agent is used.\n\n## When to use\n\nReach for this when the task matches an available agent type, when you have independent work to run in parallel, or when answering would mean reading across several files — delegate it and you keep the conclusion, not the file dumps. For a single-fact lookup where you already know the file, symbol, or value, search directly. Once you've delegated a search, don't also run it yourself — wait for the result.\n\n- The agent's final report is not shown to the user — relay what matters.\n- Use SendMessage with the agent's ID or name to continue a previously spawned agent with its context intact; a new Agent call starts fresh.\n- Each agent type's model, reasoning effort, and tools come from its definition (`.claude/agents/*.md` frontmatter or SDK `agents`).\n- `isolation: \"worktree\"` gives the agent its own git worktree (auto-cleaned if unchanged).\n- Subagents run in the background by default; you'll be notified when one completes. Pass `run_in_background: false` for a synchronous run when you need the result before continuing. Never fabricate or predict a pending agent's results — the notification is never something you write yourself; if the user asks before it arrives, say it's still running.",
       "input_schema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
@@ -939,6 +939,11 @@
                   "description": "One-sentence statement of the defect",
                   "type": "string"
                 },
+                "short_summary": {
+                  "description": "Compressed label for compact UI (≤60 chars): the claim alone, no rationale or consequence clause",
+                  "type": "string",
+                  "maxLength": 60
+                },
                 "failure_scenario": {
                   "description": "Concrete inputs/state → wrong output/crash",
                   "type": "string"
@@ -1038,7 +1043,7 @@
     },
     {
       "name": "Skill",
-      "description": "Execute a skill within the main conversation\n\nWhen users ask you to perform tasks, check if any of the available skills match. Skills provide specialized capabilities and domain knowledge.\n\nWhen users reference a \"slash command\" or \"/<something>\", they are referring to a skill. Use this tool to invoke it.\n\nHow to invoke:\n- Set `skill` to the exact name of an available skill (no leading slash). For plugin-namespaced skills use the fully qualified `plugin:skill` form.\n- Set `args` to pass optional arguments.\n- Some skills are scoped to a directory: their name is prefixed with the directory (e.g. `apps/web:deploy`) and their description says which directory they apply to. When a skill name has both a scoped and an unscoped variant, pick by the files you are working on: if the files are under a variant's directory, invoke that variant (most specific directory wins); otherwise invoke the unscoped one.\n\nImportant:\n- Available skills are listed in system-reminder messages in the conversation\n- Only invoke a skill that appears in that list, or one the user explicitly typed as `/<name>` in their message. Never guess or invent a skill name from training data; otherwise do not call this tool\n- When a skill matches the user's request, this is a BLOCKING REQUIREMENT: invoke the relevant Skill tool BEFORE generating any other response about the task\n- NEVER mention a skill without actually calling this tool\n- Do not invoke a skill that is already running\n- Do not use this tool for built-in CLI commands (like /help, /clear, etc.)\n- If you see a <command-name> tag in the current conversation turn, the skill has ALREADY been loaded - follow the instructions directly instead of calling this tool again\n",
+      "description": "Invoke a skill.\n\nA skill is a packaged set of instructions the user or project has set up for a particular kind of task (deploy steps, a review checklist, a repo-specific workflow). Available skills appear in a system-reminder listing with one-line descriptions. When the task at hand is one a listed skill covers, call this tool first — the skill's instructions load into the turn for you to follow in place of your default approach; some skills instead run in a subagent and return the finished result. Users may also ask for one by name (`/<name>`, or \"slash command\"); that's a request to invoke it.\n\n- `skill`: exact name from the listing, no leading slash. Plugin skills use `plugin:skill`. Directory-scoped skills are listed with a path prefix (`apps/web:deploy`); when both scoped and unscoped variants of a name exist, pick the one whose directory contains the files you're working on (most specific wins; unscoped otherwise).\n- `args`: optional arguments to pass through.\n\nOnly names from the listing (or that the user typed explicitly) are valid. Built-in CLI commands (`/help`, `/clear`, …) aren't skills. If a `<command-name>` block is already present this turn, the skill is loaded — follow it directly rather than calling again.\n",
       "input_schema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",

package/dist/oauth.d.ts

@@ -73,6 +73,15 @@ export declare function loadCredentials(): Promise<CredentialsFile | null>;
  * tiebreaker preference. Exported for direct testing.
  */
 export declare function pickFreshestCredentials(candidates: CredentialsFile[]): CredentialsFile | null;
+/**
+ * Mirror a set of OAuth tokens into the legacy `~/.dario/credentials.json`
+ * store. Thin durable-write wrapper over `saveCredentials` for callers outside
+ * this module — specifically the pool's login-account mirror (dario#808), which
+ * keeps credentials.json tracking the pool store after a background/startup
+ * refresh advanced `accounts/login.json`. Shares saveCredentials' durability
+ * (fsync temp + dir, #790), cache invalidation, and refresh-dead-flag clear.
+ */
+export declare function saveCredentialsTokens(tokens: OAuthTokens): Promise<void>;
 /**
  * Automatic OAuth flow using a local callback server (same as Claude Code).
  * Opens browser, captures the authorization code automatically.

package/dist/oauth.js

@@ -424,6 +424,17 @@ async function saveCredentials(creds) {
     credentialsCache = creds;
     credentialsCacheTime = Date.now();
 }
+/**
+ * Mirror a set of OAuth tokens into the legacy `~/.dario/credentials.json`
+ * store. Thin durable-write wrapper over `saveCredentials` for callers outside
+ * this module — specifically the pool's login-account mirror (dario#808), which
+ * keeps credentials.json tracking the pool store after a background/startup
+ * refresh advanced `accounts/login.json`. Shares saveCredentials' durability
+ * (fsync temp + dir, #790), cache invalidation, and refresh-dead-flag clear.
+ */
+export async function saveCredentialsTokens(tokens) {
+    await saveCredentials({ claudeAiOauth: tokens });
+}
 /**
  * Automatic OAuth flow using a local callback server (same as Claude Code).
  * Opens browser, captures the authorization code automatically.

package/dist/proxy.js

@@ -16,7 +16,7 @@ import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCo
 import { Analytics, billingBucketFromClaim, formatUsageLogLine, SUBSCRIPTION_CLAIMS } from './analytics.js';
 import { OverageGuard, buildHaltErrorBody } from './overage-guard.js';
 import { notify as osNotify } from './notify.js';
-import { loadAllAccounts, loadAccount, saveAccount, refreshAccountToken, resyncLoginFromCredentialsIfStale, ensureLoginCredentialsInPool } from './accounts.js';
+import { loadAllAccounts, loadAccount, saveAccount, refreshAccountToken, resyncLoginFromCredentialsIfStale, ensureLoginCredentialsInPool, mirrorLoginToCredentials } from './accounts.js';
 import { handleAdminRequest } from './admin-api.js';
 import { createTokenBucket } from './rate-limit.js';
 import { getOpenAIBackend, isOpenAIModel, forwardToOpenAI } from './openai-backend.js';
@@ -1139,6 +1139,9 @@ export async function startProxy(opts = {}) {
     if (resyncResult === 'resynced') {
         console.log('[dario] re-synced pool `login` account from current credentials.json (was stale; dario#235)');
     }
+    else if (resyncResult === 'creds-stale') {
+        console.log('[dario] kept the newer pool `login` token; credentials.json is stale — NOT overwriting (dario#805)');
+    }
     // Admin mode (#599) manages the pool over HTTP: it may legitimately start
     // with zero accounts and returns a clean 503 until one is added via
     // POST /admin/login/*, taking effect with no restart (see onAccountsChanged).
@@ -1230,6 +1233,11 @@ export async function startProxy(opts = {}) {
                         return;
                     const refreshed = await refreshAccountToken(saved);
                     pool.updateTokens(acc.alias, refreshed.accessToken, refreshed.refreshToken, refreshed.expiresAt);
+                    // Mirror a refreshed `login` token back to credentials.json so the
+                    // legacy file (and `dario doctor`) tracks the pool store (#808).
+                    await mirrorLoginToCredentials(refreshed).catch((err) => {
+                        console.error(`[dario] login→credentials.json mirror failed (startup) for ${acc.alias}: ${err instanceof Error ? err.message : err}`);
+                    });
                     console.error(`[dario] Startup refresh recovered account ${acc.alias} (was expired/expiring).`);
                 }
                 catch (err) {
@@ -1250,6 +1258,11 @@ export async function startProxy(opts = {}) {
                         continue;
                     const refreshed = await refreshAccountToken(saved);
                     pool.updateTokens(acc.alias, refreshed.accessToken, refreshed.refreshToken, refreshed.expiresAt);
+                    // Mirror a refreshed `login` token back to credentials.json so the
+                    // legacy file (and `dario doctor`) tracks the pool store (#808).
+                    await mirrorLoginToCredentials(refreshed).catch((err) => {
+                        console.error(`[dario] login→credentials.json mirror failed (background) for ${acc.alias}: ${err instanceof Error ? err.message : err}`);
+                    });
                 }
                 catch (err) {
                     console.error(`[dario] Background refresh failed for ${acc.alias}: ${err instanceof Error ? err.message : err}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "5.2.9",
+  "version": "5.2.11",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {