@askalf/dario 5.4.27 → 5.4.28

package/dist/health-response.d.ts

@@ -34,6 +34,18 @@ export interface HealthStatusLike {
         mode: 'single';
         active: number;
     };
+    /**
+     * Request-queue snapshot (dario#905), surfaced to internal callers only.
+     * `active === maxConcurrent` with `queued > 0` for a sustained period is
+     * the slot-exhaustion signature — before this field existed, that state
+     * was invisible from outside the process while every request 504'd.
+     */
+    queue?: {
+        active: number;
+        queued: number;
+        maxConcurrent: number;
+        maxQueued: number;
+    };
 }
 export interface HealthResponse {
     httpStatus: number;

package/dist/health-response.js

@@ -82,6 +82,7 @@ export function buildHealthResponse(s, requestCount, includeInternal) {
             expiresIn: s.expiresIn,
             requests: requestCount,
             ...(s.sessions ? { sessions: s.sessions } : {}),
+            ...(s.queue ? { queue: s.queue } : {}),
             ...(s.refreshFailures ? { refreshFailures: s.refreshFailures } : {}),
         }
         : liveness;

package/dist/proxy.d.ts

@@ -345,6 +345,12 @@ interface ProxyOptions {
     maxQueued?: number;
     /** Max ms a queued request waits before it times out with 504. Default 60000. dario#80. */
     queueTimeoutMs?: number;
+    /**
+     * Max ms before the upstream fetch is aborted. Default 300000 (5 min,
+     * matching the Anthropic SDK). Injectable so tests can exercise the
+     * timeout → slot-release path without waiting 5 minutes (dario#905).
+     */
+    upstreamTimeoutMs?: number;
     /**
      * Override the outbound `output_config.effort` value on non-haiku
      * requests. Default (undefined) pins `'high'`, matching CC 2.1.116's

package/dist/proxy.js

@@ -1426,6 +1426,7 @@ export async function startProxy(opts = {}) {
         maxQueued: opts.maxQueued ?? DEFAULT_MAX_QUEUED,
         queueTimeoutMs: opts.queueTimeoutMs ?? DEFAULT_QUEUE_TIMEOUT_MS,
     });
+    const upstreamTimeoutMs = opts.upstreamTimeoutMs ?? UPSTREAM_TIMEOUT_MS;
     // Cache context-1m beta availability. Set false once per account after the
     // first "long context" rejection, so we skip sending context-1m on every
     // subsequent request instead of paying the round-trip + retry cost each time.
@@ -1528,7 +1529,7 @@ export async function startProxy(opts = {}) {
     // disconnect no longer aborts the upstream fetch — we keep consuming
     // the SSE so Anthropic sees a CC-shaped read-to-EOF pattern. See
     // src/stream-drain.ts for the rationale + tradeoff.
-    const { decideOnClientClose, resolveDrainOnClose } = await import('./stream-drain.js');
+    const { decideOnClientClose, resolveDrainOnClose, waitForClientDrain } = await import('./stream-drain.js');
     const drainOnClose = resolveDrainOnClose(opts.drainOnClose);
     if (verbose) {
         console.log(`[dario] drain-on-close: ${drainOnClose ? 'enabled' : 'disabled'}`);
@@ -1709,6 +1710,9 @@ export async function startProxy(opts = {}) {
                 sessions: pool.size === 0
                     ? { mode: 'single', active: sessionRegistry.size() }
                     : { mode: 'pool', stickyBindings: pool.stickyCount() },
+                // Concurrency-slot visibility (dario#905): active pinned at
+                // maxConcurrent with queued > 0 is the slot-exhaustion signature.
+                queue: queue.snapshot(),
             }, requestCount, includeInternal);
             res.writeHead(httpStatus, JSON_HEADERS);
             res.end(JSON.stringify(body));
@@ -1856,7 +1860,10 @@ export async function startProxy(opts = {}) {
         // Always-on as of v4 (pre-v4 this was gated to pool mode).
         if (urlPath === '/analytics' && req.method === 'GET') {
             res.writeHead(200, JSON_HEADERS);
-            res.end(JSON.stringify(analytics.summary()));
+            // `queue` rides along the summary (dario#905): request-queue.ts always
+            // documented snapshot() as "exposed for /analytics", but it was never
+            // actually wired in, so slot exhaustion was invisible from outside.
+            res.end(JSON.stringify({ ...analytics.summary(), queue: queue.snapshot() }));
             return;
         }
         // Analytics live stream — SSE of new RequestRecord JSON, one event
@@ -2278,7 +2285,7 @@ export async function startProxy(opts = {}) {
                             console.log(`[dario] #${requestCount} ${req.method} ${urlPath} (model: ${rawModel}) → openai backend`);
                         }
                         requestCount++;
-                        await forwardToOpenAI(req, res, body, openaiBackend, corsOrigin, SECURITY_HEADERS, UPSTREAM_TIMEOUT_MS, verbose);
+                        await forwardToOpenAI(req, res, body, openaiBackend, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose);
                         return;
                     }
                 }
@@ -2303,7 +2310,7 @@ export async function startProxy(opts = {}) {
                 }
                 console.log(`[dario] #${requestCount} pool exhausted — /v1/chat/completions → ${openaiBackend.name} as ${poolFallbackModel}`);
                 requestCount++;
-                await forwardToOpenAI(req, res, fallbackBody, openaiBackend, corsOrigin, { ...SECURITY_HEADERS, 'x-dario-pool-fallback': poolFallbackModel }, UPSTREAM_TIMEOUT_MS, verbose);
+                await forwardToOpenAI(req, res, fallbackBody, openaiBackend, corsOrigin, { ...SECURITY_HEADERS, 'x-dario-pool-fallback': poolFallbackModel }, upstreamTimeoutMs, verbose);
                 return;
             }
             // Parse body once, apply OpenAI translation, model override, and sanitization
@@ -2750,7 +2757,7 @@ export async function startProxy(opts = {}) {
                     upstreamAbortReason = 'timeout';
                     upstreamAbort.abort();
                 }
-            }, UPSTREAM_TIMEOUT_MS);
+            }, upstreamTimeoutMs);
             onClientClose = () => {
                 const action = decideOnClientClose(res.writableEnded, upstreamAbort.signal.aborted, drainOnClose);
                 if (action === 'abort') {
@@ -3177,7 +3184,7 @@ export async function startProxy(opts = {}) {
                         if (fallbackBody) {
                             console.log(`[dario] #${requestCount} pool exhausted mid-flight (429, no peer) — /v1/chat/completions → ${openaiBackend.name} as ${poolFallbackModel}`);
                             requestCount++;
-                            await forwardToOpenAI(req, res, fallbackBody, openaiBackend, corsOrigin, { ...SECURITY_HEADERS, 'x-dario-pool-fallback': poolFallbackModel }, UPSTREAM_TIMEOUT_MS, verbose);
+                            await forwardToOpenAI(req, res, fallbackBody, openaiBackend, corsOrigin, { ...SECURITY_HEADERS, 'x-dario-pool-fallback': poolFallbackModel }, upstreamTimeoutMs, verbose);
                             return;
                         }
                     }
@@ -3320,12 +3327,11 @@ export async function startProxy(opts = {}) {
                     if (res.write(chunk) === false)
                         needsDrain = true;
                 };
-                // Resolves on 'close' too, so a vanished client can't wedge the loop.
-                const waitForDrain = () => new Promise((resolve) => {
-                    const done = () => { res.off('drain', done); res.off('close', done); resolve(); };
-                    res.once('drain', done);
-                    res.once('close', done);
-                });
+                // Resolves on 'close' (vanished client) AND on upstream abort. The
+                // abort arm is what keeps a connected-but-not-reading client from
+                // parking this handler forever and leaking its queue slot — the
+                // dario#905 wedge. See waitForClientDrain in src/stream-drain.ts.
+                const waitForDrain = () => waitForClientDrain(res, upstreamAbort.signal);
                 try {
                     let buffer = '';
                     const MAX_LINE_LENGTH = 1_000_000; // 1MB max per SSE line
@@ -3567,10 +3573,10 @@ export async function startProxy(opts = {}) {
                 writeLogLine(logFileStream, { ...errLogBase, reject: 'client-closed' });
             }
             else if (upstreamAbortReason === 'timeout') {
-                console.error(`[dario] #${requestCount} upstream timeout after ${UPSTREAM_TIMEOUT_MS / 1000}s`);
+                console.error(`[dario] #${requestCount} upstream timeout after ${upstreamTimeoutMs / 1000}s`);
                 if (!res.headersSent) {
                     res.writeHead(504, JSON_HEADERS);
-                    res.end(JSON.stringify({ error: 'Upstream timeout', message: `Anthropic did not respond within ${UPSTREAM_TIMEOUT_MS / 1000}s` }));
+                    res.end(JSON.stringify({ error: 'Upstream timeout', message: `Anthropic did not respond within ${upstreamTimeoutMs / 1000}s` }));
                 }
                 else if (!res.writableEnded) {
                     res.end();

package/dist/stream-drain.d.ts

@@ -58,3 +58,37 @@ export declare function decideOnClientClose(writableEnded: boolean, upstreamAbor
  * Explicit `true`/`false` on the options object always wins.
  */
 export declare function resolveDrainOnClose(explicit: boolean | undefined, env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Minimal event surface of `http.ServerResponse` that the drain wait needs —
+ * structural so tests can pass a plain EventEmitter.
+ */
+export interface DrainWaitable {
+    once(event: 'drain' | 'close', listener: () => void): unknown;
+    off(event: 'drain' | 'close', listener: () => void): unknown;
+}
+/**
+ * Wait out client-socket backpressure after `res.write()` returned false
+ * (dario#905). Settles on the first of:
+ *
+ *   - `'drain'` on `res`  — the client consumed its buffer; resume streaming.
+ *   - `'close'` on `res`  — the client connection is gone; the loop resumes
+ *                           and the gated writer / next read handles teardown.
+ *   - `signal` aborts     — the upstream AbortController fired (upstream
+ *                           timeout, client-close abort, SSE overflow).
+ *
+ * The abort arm is the load-bearing one. Without it, a client that stays
+ * connected but stops reading (dead peer behind an open TCP window, wedged
+ * consumer) parks the request handler on this promise forever: the upstream
+ * timeout still fires, but it only aborts the upstream fetch — which nothing
+ * is awaiting — so the handler's `finally` never runs and its concurrency
+ * slot leaks. Leaked slots accumulate until `active === maxConcurrent`, at
+ * which point every request 504s with `queue-timeout` while `/health` stays
+ * green (dario#905). With the abort arm, the wait resolves, the next
+ * `reader.read()` rejects on the aborted body, and normal teardown releases
+ * the slot.
+ *
+ * Resolves immediately when the signal is already aborted, and removes all
+ * three listeners on settle so repeated waits within one response never
+ * accumulate listeners on the shared signal.
+ */
+export declare function waitForClientDrain(res: DrainWaitable, signal: AbortSignal): Promise<void>;

package/dist/stream-drain.js

@@ -66,3 +66,45 @@ export function resolveDrainOnClose(explicit, env = process.env) {
     const v = (env.DARIO_DRAIN_ON_CLOSE ?? '').toLowerCase();
     return v === '1' || v === 'true' || v === 'yes';
 }
+/**
+ * Wait out client-socket backpressure after `res.write()` returned false
+ * (dario#905). Settles on the first of:
+ *
+ *   - `'drain'` on `res`  — the client consumed its buffer; resume streaming.
+ *   - `'close'` on `res`  — the client connection is gone; the loop resumes
+ *                           and the gated writer / next read handles teardown.
+ *   - `signal` aborts     — the upstream AbortController fired (upstream
+ *                           timeout, client-close abort, SSE overflow).
+ *
+ * The abort arm is the load-bearing one. Without it, a client that stays
+ * connected but stops reading (dead peer behind an open TCP window, wedged
+ * consumer) parks the request handler on this promise forever: the upstream
+ * timeout still fires, but it only aborts the upstream fetch — which nothing
+ * is awaiting — so the handler's `finally` never runs and its concurrency
+ * slot leaks. Leaked slots accumulate until `active === maxConcurrent`, at
+ * which point every request 504s with `queue-timeout` while `/health` stays
+ * green (dario#905). With the abort arm, the wait resolves, the next
+ * `reader.read()` rejects on the aborted body, and normal teardown releases
+ * the slot.
+ *
+ * Resolves immediately when the signal is already aborted, and removes all
+ * three listeners on settle so repeated waits within one response never
+ * accumulate listeners on the shared signal.
+ */
+export function waitForClientDrain(res, signal) {
+    return new Promise((resolve) => {
+        if (signal.aborted) {
+            resolve();
+            return;
+        }
+        const done = () => {
+            res.off('drain', done);
+            res.off('close', done);
+            signal.removeEventListener('abort', done);
+            resolve();
+        };
+        res.once('drain', done);
+        res.once('close', done);
+        signal.addEventListener('abort', done);
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "5.4.27",
+  "version": "5.4.28",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {