@askalf/dario 5.4.29 → 5.4.31

package/dist/admin-api.d.ts

@@ -7,10 +7,12 @@
  * `DARIO_API_KEY` as a fallback — even on loopback, since they add/remove
  * OAuth credentials):
  *
- *   POST   /admin/login/start     { alias? }       -> { alias, authorize_url, expires_at }
- *   POST   /admin/login/complete  { alias, code }  -> { alias, status, expires_at }
- *   GET    /admin/accounts                          -> { accounts: [...], count }
- *   DELETE /admin/accounts/<alias>                  -> { alias, removed }
+ *   POST   /admin/login/start         { alias? }               -> { alias, authorize_url, expires_at }
+ *   POST   /admin/login/start-needed  { threshold? }            -> { started: [...], count, truncated? }
+ *   POST   /admin/login/complete      { alias, code }            -> { alias, status, expires_at }
+ *   POST   /admin/login/complete      { items: [{alias,code}] }  -> { results: [...], count, truncated? }
+ *   GET    /admin/accounts                                       -> { accounts: [...], count }
+ *   DELETE /admin/accounts/<alias>                               -> { alias, removed }
  *
  * The login flow mirrors `dario accounts add --manual` (PKCE + manual paste):
  * `/start` returns the authorize URL the operator opens in a browser; they POST
@@ -21,11 +23,28 @@
  * alias is optional on `/start`: omit it and a non-colliding default
  * (`account-1`, …) is generated and returned for you to pass to `/complete`.
  *
+ * `/admin/login/start-needed` (#913) is the bulk entry point for a pool that's
+ * partly broken: it finds every account whose live `consecutiveAuthFailures`
+ * has crossed `NEEDS_LOGIN_THRESHOLD`, starts a fresh login for each (same
+ * mechanics as `/start` — reuses `doStartLogin`), and returns all the
+ * authorize URLs in one response. The threshold, not the raw `auth-cooldown`
+ * boolean, is deliberate: a single 401 already shows `auth-cooldown` for 60s,
+ * indistinguishable from a genuinely dead refresh token by that field alone
+ * (verified empirically — see the PR). `consecutiveAuthFailures` is the only
+ * signal that actually separates "blip" from "needs a human."
+ *
+ * `/admin/login/complete` also accepts a **batch** body (`{ items: [...] }`)
+ * instead of a single `{ alias, code }` — completes several pending logins in
+ * one call (#913). Each item is rate-limited individually (see below), so a
+ * batch can't be used to bypass the mutation throttle by hiding N credential
+ * writes behind one HTTP request.
+ *
  * `GET /admin/accounts` reports each account's persisted metadata — alias,
  * scopes, token expiry — plus its live pool status (5h/7d utilization,
- * representative-claim, routing status, request count) when the proxy supplies
- * a `poolStatus` snapshot, which it does whenever pool mode is active. It's the
- * headless, admin-token-gated equivalent of the `GET /accounts` pool view.
+ * representative-claim, routing status, request count, consecutive auth
+ * failures) when the proxy supplies a `poolStatus` snapshot, which it does
+ * whenever pool mode is active. It's the headless, admin-token-gated
+ * equivalent of the `GET /accounts` pool view.
  *
  * Account changes take effect immediately: the proxy passes an
  * `onAccountsChanged` hook (src/proxy.ts) that hot-reloads the live pool from
@@ -41,6 +60,11 @@
  * `rateLimit` hook (token bucket in src/rate-limit.ts, owned by the proxy):
  * a throttled call returns `429` with `Retry-After` instead of acting. Reads
  * (`GET /admin/accounts`) and successful auth are never throttled (#620).
+ * The two bulk endpoints consume the SAME bucket once per item they actually
+ * act on, not once per HTTP request — a 50-account `start-needed` call costs
+ * 50 tokens, same as 50 individual `/start` calls, and stops (returning
+ * `truncated: true`) the moment the bucket runs dry rather than borrowing
+ * against it.
  */
 import type { IncomingMessage, ServerResponse } from 'node:http';
 /** Persisted account metadata surfaced by `GET /admin/accounts`. */
@@ -56,6 +80,13 @@ export interface AdminAccountLive {
     claim: string;
     status: string;
     requestCount: number;
+    /**
+     * Consecutive auth failures on this account (dario#234's cool-down
+     * counter). `status: 'auth-cooldown'` alone doesn't distinguish a single
+     * 60s blip from a dead refresh token — both look identical. This is the
+     * only field that does; `/admin/login/start-needed` filters on it.
+     */
+    consecutiveAuthFailures: number;
 }
 /** An audited admin action — see `AdminDeps.audit`. Never carries secrets. */
 export interface AdminAuditEvent {

package/dist/admin-api.js

@@ -4,6 +4,19 @@ import { parseManualPaste } from './oauth.js';
 const PENDING_TTL_MS = 10 * 60_000;
 const MAX_PENDING = 64; // backstop against unbounded growth (distinct aliases)
 const ACCOUNTS_PREFIX = '/admin/accounts/';
+/**
+ * `consecutiveAuthFailures` floor for `/admin/login/start-needed` to treat an
+ * account as needing a new login rather than mid-blip. Empirically: 1 failure
+ * = 60s cooldown (identical `auth-cooldown` shape to a dead account), 2 = 2min,
+ * 3 = 4min — by the third consecutive failure the account has been failing on
+ * and off for several minutes, past what a single transient 401 produces.
+ * Overridable per-call via `{ threshold }` since "how patient to be" is an
+ * operator judgment call, not a fixed constant this file should own alone.
+ */
+const NEEDS_LOGIN_THRESHOLD = 3;
+// Backstop on batch /complete — bounds worst-case response size / work
+// independent of the rate limiter, which already caps actual throughput.
+const MAX_BATCH_ITEMS = 64;
 // Keyed by account alias — one pending login per alias (#599).
 const pendingLogins = new Map();
 function prunePending(now) {
@@ -20,6 +33,66 @@ function nextDefaultAlias(taken) {
             return candidate; // taken is finite → always terminates
     }
 }
+/**
+ * Core of `/admin/login/start`, factored out so `/admin/login/start-needed`
+ * (#913) can drive the same PKCE-start + pending-login-registration + audit
+ * path per alias without duplicating it. Never throws — startAddAccount's
+ * only failure mode (invalid alias) becomes a `{ ok: false }` result so a
+ * caller looping over many aliases can skip one bad alias without aborting
+ * the rest.
+ */
+async function doStartLogin(alias, now, deps, remote) {
+    // Only a brand-new alias grows the map; a repeat start replaces in place.
+    if (!pendingLogins.has(alias) && pendingLogins.size >= MAX_PENDING) {
+        return { ok: false, status: 429, error: 'too many pending logins; complete or wait for one to expire' };
+    }
+    try {
+        const { authorizeUrl, codeVerifier, state } = await startAddAccount(alias);
+        const expiresAt = now + PENDING_TTL_MS;
+        pendingLogins.set(alias, { codeVerifier, state, expiresAt });
+        deps.audit?.({ action: 'login_start', ok: true, status: 200, alias, remote });
+        return { ok: true, alias, authorizeUrl, expiresAt };
+    }
+    catch (err) {
+        return { ok: false, status: 400, error: err.message };
+    }
+}
+/**
+ * Core of `/admin/login/complete`, factored out so the batch form (#913) can
+ * drive it per item. Unlike the pre-refactor inline version, a failed token
+ * exchange is now audited too (`login_complete ok:false`) — previously it
+ * only hit the outer catch-all and left no audit trail, which is fine for a
+ * human watching one response but not for a batch where a silent per-item
+ * failure would otherwise be undiscoverable after the fact.
+ */
+async function doCompleteLogin(alias, rawCode, now, deps, remote) {
+    if (!alias || !rawCode)
+        return { ok: false, status: 400, error: 'missing "alias" or "code"' };
+    const p = pendingLogins.get(alias);
+    if (!p || p.expiresAt <= now) {
+        pendingLogins.delete(alias);
+        return { ok: false, status: 410, error: 'no pending login for that alias (unknown or expired) — start a new login' };
+    }
+    // Accept "code#state" or a bare code; verify the embedded state if present.
+    const { code, state: pastedState } = parseManualPaste(rawCode);
+    if (!code)
+        return { ok: false, status: 400, error: 'no authorization code found in "code"' };
+    if (pastedState && pastedState !== p.state) {
+        return { ok: false, status: 400, error: 'state mismatch — code is from a different login attempt' };
+    }
+    pendingLogins.delete(alias); // single-use, regardless of exchange outcome
+    try {
+        const creds = await completeAddAccount(alias, code, p.codeVerifier, p.state);
+        await deps.onAccountsChanged?.();
+        deps.audit?.({ action: 'login_complete', ok: true, status: 200, alias: creds.alias, remote });
+        return { ok: true, alias: creds.alias, expiresAt: creds.expiresAt };
+    }
+    catch (err) {
+        const message = err.message;
+        deps.audit?.({ action: 'login_complete', ok: false, status: 400, alias, remote });
+        return { ok: false, status: 400, error: message };
+    }
+}
 /** On-disk account inventory — the default `AdminDeps.listAccounts`. */
 async function defaultListAccounts() {
     const aliases = await listAccountAliases();
@@ -97,6 +170,7 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
     const remote = req.socket?.remoteAddress;
     const isAccountDelete = method === 'DELETE' && urlPath.startsWith(ACCOUNTS_PREFIX) && urlPath.length > ACCOUNTS_PREFIX.length;
     const known = urlPath === '/admin/login/start' ||
+        urlPath === '/admin/login/start-needed' ||
         urlPath === '/admin/login/complete' ||
         urlPath === '/admin/accounts' ||
         isAccountDelete;
@@ -120,9 +194,16 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
         }
         return true;
     }
-    // Rate-limit the mutating routes (reads are exempt). Runs after auth so an
-    // unauthenticated flood is handled by the 'auth' bucket above, not this one.
-    const isMutation = urlPath === '/admin/login/start' || urlPath === '/admin/login/complete' || isAccountDelete;
+    // Rate-limit the single-item mutating routes up front (reads are exempt).
+    // Runs after auth so an unauthenticated flood is handled by the 'auth'
+    // bucket above, not this one. `/admin/login/complete` and `/start-needed`
+    // are NOT gated here — both can act on a variable number of accounts per
+    // request, so they consume the bucket per item, inside their own handlers,
+    // after the body is parsed (see doStartLogin/doCompleteLogin call sites
+    // below). That is a deliberate cost-accounting choice, not an oversight: a
+    // blanket pre-parse token here would let a single HTTP request move N
+    // accounts' credentials for the price of one throttle token.
+    const isMutation = urlPath === '/admin/login/start' || isAccountDelete;
     if (isMutation) {
         const wait = deps.rateLimit?.('mutation') ?? 0;
         if (wait > 0) {
@@ -149,57 +230,109 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
                 const taken = new Set([...records.map((r) => r.alias), ...pendingLogins.keys()]);
                 alias = nextDefaultAlias(taken);
             }
-            // Only a brand-new alias grows the map; a repeat /start replaces in place.
-            if (!pendingLogins.has(alias) && pendingLogins.size >= MAX_PENDING) {
-                send(res, 429, { error: 'too many pending logins; complete or wait for one to expire' });
+            const result = await doStartLogin(alias, now, deps, remote);
+            if (!result.ok) {
+                send(res, result.status, { error: result.error });
                 return true;
             }
-            const { authorizeUrl, codeVerifier, state } = await startAddAccount(alias); // throws on invalid alias
-            const expiresAt = now + PENDING_TTL_MS;
-            pendingLogins.set(alias, { codeVerifier, state, expiresAt });
-            deps.audit?.({ action: 'login_start', ok: true, status: 200, alias, remote });
             send(res, 200, {
-                alias,
-                authorize_url: authorizeUrl,
-                expires_at: new Date(expiresAt).toISOString(),
-                instructions: `Open authorize_url, approve, then POST { "alias": "${alias}", "code": "<displayed code>" } to /admin/login/complete.`,
+                alias: result.alias,
+                authorize_url: result.authorizeUrl,
+                expires_at: new Date(result.expiresAt).toISOString(),
+                instructions: `Open authorize_url, approve, then POST { "alias": "${result.alias}", "code": "<displayed code>" } to /admin/login/complete.`,
             });
             return true;
         }
-        // POST /admin/login/complete  { alias, code }
-        if (urlPath === '/admin/login/complete') {
+        // POST /admin/login/start-needed  { threshold? }  (#913)
+        // Bulk-starts a login for every live pool account whose consecutive auth
+        // failures have crossed `threshold` (default NEEDS_LOGIN_THRESHOLD) — the
+        // "which accounts are actually stuck, with a link for each" entry point.
+        // No-op (empty `started`) outside pool mode, where there's no live
+        // consecutiveAuthFailures signal to filter on.
+        if (urlPath === '/admin/login/start-needed') {
             if (method !== 'POST') {
                 send(res, 405, { error: 'Method not allowed (use POST)' });
                 return true;
             }
             const body = await readJsonBody(req);
-            const alias = typeof body.alias === 'string' ? body.alias.trim() : '';
-            const rawCode = typeof body.code === 'string' ? body.code : '';
-            if (!alias || !rawCode) {
-                send(res, 400, { error: 'missing "alias" or "code"' });
+            const threshold = typeof body.threshold === 'number' && body.threshold > 0
+                ? body.threshold
+                : NEEDS_LOGIN_THRESHOLD;
+            const live = deps.poolStatus?.() ?? null;
+            const candidates = live
+                ? [...live.entries()]
+                    .filter(([, l]) => l.consecutiveAuthFailures >= threshold)
+                    .map(([alias, l]) => ({ alias, consecutiveAuthFailures: l.consecutiveAuthFailures }))
+                : [];
+            const started = [];
+            let truncated = false;
+            for (const c of candidates) {
+                const wait = deps.rateLimit?.('mutation') ?? 0;
+                if (wait > 0) {
+                    truncated = true;
+                    break;
+                }
+                const result = await doStartLogin(c.alias, now, deps, remote);
+                // A per-alias failure (e.g. MAX_PENDING already full) is skipped, not
+                // fatal to the rest of the batch — the operator still gets every
+                // account that could be started, and can retry the skipped ones.
+                if (result.ok) {
+                    started.push({
+                        alias: result.alias,
+                        authorize_url: result.authorizeUrl,
+                        expires_at: new Date(result.expiresAt).toISOString(),
+                        consecutive_auth_failures: c.consecutiveAuthFailures,
+                    });
+                }
+            }
+            send(res, 200, { started, count: started.length, ...(truncated ? { truncated: true } : {}) });
+            return true;
+        }
+        // POST /admin/login/complete  { alias, code }  OR  { items: [{alias,code}] }  (#913)
+        if (urlPath === '/admin/login/complete') {
+            if (method !== 'POST') {
+                send(res, 405, { error: 'Method not allowed (use POST)' });
                 return true;
             }
-            const p = pendingLogins.get(alias);
-            if (!p || p.expiresAt <= now) {
-                pendingLogins.delete(alias);
-                send(res, 410, { error: 'no pending login for that alias (unknown or expired) — start a new login' });
+            const body = await readJsonBody(req);
+            if (Array.isArray(body.items)) {
+                if (body.items.length > MAX_BATCH_ITEMS) {
+                    send(res, 400, { error: `too many items in batch (max ${MAX_BATCH_ITEMS})` });
+                    return true;
+                }
+                const results = [];
+                let truncated = false;
+                for (const raw of body.items) {
+                    const item = (raw ?? {});
+                    const alias = typeof item.alias === 'string' ? item.alias.trim() : '';
+                    const rawCode = typeof item.code === 'string' ? item.code : '';
+                    const wait = deps.rateLimit?.('mutation') ?? 0;
+                    if (wait > 0) {
+                        truncated = true;
+                        break;
+                    }
+                    const result = await doCompleteLogin(alias, rawCode, now, deps, remote);
+                    results.push(result.ok
+                        ? { alias: result.alias, status: 'added', expires_at: new Date(result.expiresAt).toISOString() }
+                        : { alias: alias || '(missing)', status: 'error', error: result.error });
+                }
+                send(res, 200, { results, count: results.length, ...(truncated ? { truncated: true } : {}) });
                 return true;
             }
-            // Accept "code#state" or a bare code; verify the embedded state if present.
-            const { code, state: pastedState } = parseManualPaste(rawCode);
-            if (!code) {
-                send(res, 400, { error: 'no authorization code found in "code"' });
+            // Single-item form — unchanged shape/behavior from before the batch form existed.
+            const alias = typeof body.alias === 'string' ? body.alias.trim() : '';
+            const rawCode = typeof body.code === 'string' ? body.code : '';
+            const wait = deps.rateLimit?.('mutation') ?? 0;
+            if (wait > 0) {
+                sendThrottled(res, wait, 'mutation', deps.audit, remote, alias || undefined);
                 return true;
             }
-            if (pastedState && pastedState !== p.state) {
-                send(res, 400, { error: 'state mismatch — code is from a different login attempt' });
+            const result = await doCompleteLogin(alias, rawCode, now, deps, remote);
+            if (!result.ok) {
+                send(res, result.status, { error: result.error });
                 return true;
             }
-            pendingLogins.delete(alias); // single-use, regardless of exchange outcome
-            const creds = await completeAddAccount(alias, code, p.codeVerifier, p.state);
-            await deps.onAccountsChanged?.();
-            deps.audit?.({ action: 'login_complete', ok: true, status: 200, alias: creds.alias, remote });
-            send(res, 200, { alias: creds.alias, status: 'added', expires_at: new Date(creds.expiresAt).toISOString() });
+            send(res, 200, { alias: result.alias, status: 'added', expires_at: new Date(result.expiresAt).toISOString() });
             return true;
         }
         // GET /admin/accounts — persisted metadata + live pool status (#599).
@@ -223,6 +356,7 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
                         claim: l.claim,
                         status: l.status,
                         request_count: l.requestCount,
+                        consecutive_auth_failures: l.consecutiveAuthFailures,
                     } : {}),
                 };
             });
@@ -249,9 +383,10 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
         return true;
     }
     catch (err) {
-        // startAddAccount throws on an invalid alias; completeAddAccount throws
-        // (with secrets redacted) on a failed token exchange; readJsonBody throws
-        // on oversized / malformed bodies.
+        // doStartLogin/doCompleteLogin catch their own failure modes (invalid
+        // alias, failed token exchange) and return a result instead of throwing —
+        // this remains as the backstop for readJsonBody (oversized / malformed
+        // bodies) and removeAccount's alias validation.
         send(res, 400, { error: err.message });
         return true;
     }

package/dist/live-fingerprint.d.ts

@@ -354,7 +354,7 @@ export declare function detectDrift(t: TemplateData, installedOverride?: string
  */
 export declare const SUPPORTED_CC_RANGE: {
     readonly min: "1.0.0";
-    readonly maxTested: "2.1.222";
+    readonly maxTested: "2.1.224";
 };
 /**
  * Compare two dotted-numeric version strings. Returns negative if `a<b`,

package/dist/live-fingerprint.js

@@ -969,7 +969,7 @@ export function detectDrift(t, installedOverride) {
  */
 export const SUPPORTED_CC_RANGE = {
     min: '1.0.0',
-    maxTested: '2.1.222',
+    maxTested: '2.1.224',
 };
 /**
  * Compare two dotted-numeric version strings. Returns negative if `a<b`,

package/dist/proxy.js

@@ -1759,6 +1759,11 @@ export async function startProxy(opts = {}) {
                             claim: a.rateLimit.claim,
                             status: isInAuthCooldown(a, snapNow) ? 'auth-cooldown' : a.rateLimit.status,
                             requestCount: a.requestCount,
+                            // Raw streak, not just the cooldown boolean: a single 401 also
+                            // shows `auth-cooldown` for 60s, indistinguishable from a
+                            // genuinely dead refresh token by that field alone. The magnitude
+                            // is what /admin/login/start-needed filters on (#913).
+                            consecutiveAuthFailures: a.consecutiveAuthFailures,
                         });
                     }
                     return snap;

package/docs/admin-api.md

@@ -88,17 +88,88 @@ All endpoints accept the token as `authorization: Bearer <token>` or
 | Method + path | Body | Returns |
 |---|---|---|
 | `POST /admin/login/start` | `{ "alias"?: string }` | `{ alias, authorize_url, expires_at, instructions }` |
+| `POST /admin/login/start-needed` | `{ "threshold"?: number }` | `{ started: [...], count, truncated? }` |
 | `POST /admin/login/complete` | `{ "alias": string, "code": string }` | `{ alias, status: "added", expires_at }` |
+| `POST /admin/login/complete` (batch) | `{ "items": [{ "alias", "code" }, ...] }` | `{ results: [...], count, truncated? }` |
 | `GET /admin/accounts` | — | `{ accounts: [...], count }` |
 | `DELETE /admin/accounts/<alias>` | — | `{ alias, removed }` (`404` if no such alias) |
 
 `GET /admin/accounts` is the monitoring surface: each entry carries the
 persisted metadata (`alias`, `scopes`, `expires_in_ms`) **plus live pool
 status whenever pool mode is active** — `util5h` / `util7d` utilization,
-representative `claim` (e.g. `five_hour`), routing `status`, and
-`request_count`. It's the admin-token-gated equivalent of the proxy-key-gated
-`GET /accounts` pool view; a headless operator needs only the admin token to
-watch headroom.
+representative `claim` (e.g. `five_hour`), routing `status`,
+`request_count`, and `consecutive_auth_failures`. It's the admin-token-gated
+equivalent of the proxy-key-gated `GET /accounts` pool view; a headless
+operator needs only the admin token to watch headroom.
+
+## Bulk re-auth, in one round-trip
+
+For a pool with several accounts, the round-trip of "notice one's broken,
+`/start` it, `/complete` it" per account doesn't scale. Two endpoints collapse
+that:
+
+```bash
+# 1. One call: every account that's actually stuck, each with a ready link.
+curl -s -X POST -H "$ADMIN" "$BASE/admin/login/start-needed"
+# -> { "started": [
+#      { "alias": "acct-3", "authorize_url": "...", "expires_at": "...",
+#        "consecutive_auth_failures": 5 },
+#      { "alias": "acct-7", "authorize_url": "...", "expires_at": "...",
+#        "consecutive_auth_failures": 12 }
+#    ], "count": 2 }
+
+# 2. Open each authorize_url, collect each code, complete them all in one call.
+curl -s -X POST -H "$ADMIN" "$BASE/admin/login/complete" -d '{
+  "items": [
+    { "alias": "acct-3", "code": "<code from acct-3'"'"'s authorize_url>" },
+    { "alias": "acct-7", "code": "<code from acct-7'"'"'s authorize_url>" }
+  ]
+}'
+# -> { "results": [
+#      { "alias": "acct-3", "status": "added", "expires_at": "..." },
+#      { "alias": "acct-7", "status": "added", "expires_at": "..." }
+#    ], "count": 2 }
+```
+
+**Why a threshold, not "any account currently cooling down."** A single
+upstream 401 already puts an account into a 60-second cool-down
+(`status: "auth-cooldown"` — see [multi-account-pool.md](./multi-account-pool.md)),
+and that looks identical, field-for-field, to an account whose refresh token
+is permanently dead. The only thing that actually separates a passing blip
+from a genuinely stuck account is `consecutive_auth_failures` climbing over
+several failed retries — `/admin/login/start-needed` filters on that count
+(default floor: 3, roughly "failed, waited, failed again, waited longer,
+failed a third time" — a few minutes of sustained failure, past what one bad
+request produces), not the raw cool-down flag. Pass `{ "threshold": 1 }` to
+be more aggressive, or a higher number to wait for a longer failure streak
+before it's worth an operator's attention.
+
+**No pool, no signal.** `consecutive_auth_failures` only exists once pool
+mode is active (see the `poolStatus` note above); `start-needed` returns an
+empty `started: []` outside pool mode rather than guessing.
+
+**Rate limiting is per account acted on, not per HTTP call.** Both bulk
+endpoints draw from the same mutation bucket as every other admin mutation —
+starting or completing 10 accounts in one request costs the same 10 tokens
+as 10 separate calls would. If the bucket runs dry partway through, the
+response carries `truncated: true` and whatever succeeded before that point;
+re-issue the same call (already-completed aliases won't be re-started —
+`start-needed` only lists accounts still above the threshold) to pick up the
+rest once the bucket refills.
+
+**Batch `/complete` reports per-item, not all-or-nothing.** A bad or expired
+code in one item doesn't fail the others — `results[i]` carries its own
+`status: "added" | "error"`, mirroring what a solo `/complete` call for that
+alias would have returned. The single-object form (`{ "alias", "code" }`,
+no `items` wrapper) is unchanged and still returns the flat
+`{ alias, status, expires_at }` shape.
+
+**Not what idea 3 in #913 asked for, and doesn't need to be.** The
+`redirect_uri` in `authorize_url` is Anthropic's own hosted
+`https://platform.claude.com/oauth/code/callback` page, not anything dario
+serves — open it in any browser on any machine, exactly as the zero-to-serving
+walkthrough above already does. There's no dario-hosted callback in this flow
+for a `DARIO_DOMAIN`/`DARIO_CALLBACK` variable to redirect.
 
 ## What the generic surfaces report (v4.8.117+)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "5.4.29",
+  "version": "5.4.31",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {