@askalf/dario 5.5.65 → 5.5.67

package/dist/doctor.d.ts

@@ -77,6 +77,29 @@ export interface IdentityDriftInput {
         accountUuid: string;
     }>;
 }
+/**
+ * The OAuth doctor row, as a pure decision — mirrors checkIdentityDrift so the
+ * branch logic is unit-testable without touching the filesystem.
+ *
+ * WHY THIS EXISTS. The legacy `credentials.json` is not what serves once an
+ * account pool exists: dario#805 deliberately keeps a NEWER pool token and
+ * refuses to overwrite that file, so "credentials.json is stale" is an expected
+ * steady state — every recovery that restores a pool account leaves one behind.
+ * Reporting that as `OAuth expired` while the pool answers every request is a
+ * false alarm, and dario-doctor-watch opens an issue for it on EVERY run:
+ * dario#1105 was filed while a live probe was returning 200 on both Haiku and
+ * Sonnet. A watcher that cries wolf on a healthy proxy trains its reader to
+ * ignore it, which is the failure the watcher exists to prevent.
+ *
+ * So: a live pool overrides a dead legacy file (and says so, rather than hiding
+ * it), and only "nothing can serve" is reported as a failure.
+ */
+export declare function oauthCheckRow(input: {
+    legacyStatus: string;
+    legacyCanRefresh: boolean;
+    poolHealthy: number;
+    poolTotal: number;
+}): Check;
 export declare function checkIdentityDrift(input: IdentityDriftInput): Check[];
 export declare function probeNpmLatestCC(): string | null;
 /**

package/dist/doctor.js

@@ -88,6 +88,39 @@ export function formatChecksJson(checks) {
         checks,
     }, null, 2);
 }
+/**
+ * The OAuth doctor row, as a pure decision — mirrors checkIdentityDrift so the
+ * branch logic is unit-testable without touching the filesystem.
+ *
+ * WHY THIS EXISTS. The legacy `credentials.json` is not what serves once an
+ * account pool exists: dario#805 deliberately keeps a NEWER pool token and
+ * refuses to overwrite that file, so "credentials.json is stale" is an expected
+ * steady state — every recovery that restores a pool account leaves one behind.
+ * Reporting that as `OAuth expired` while the pool answers every request is a
+ * false alarm, and dario-doctor-watch opens an issue for it on EVERY run:
+ * dario#1105 was filed while a live probe was returning 200 on both Haiku and
+ * Sonnet. A watcher that cries wolf on a healthy proxy trains its reader to
+ * ignore it, which is the failure the watcher exists to prevent.
+ *
+ * So: a live pool overrides a dead legacy file (and says so, rather than hiding
+ * it), and only "nothing can serve" is reported as a failure.
+ */
+export function oauthCheckRow(input) {
+    const { legacyStatus, legacyCanRefresh, poolHealthy, poolTotal } = input;
+    if (poolHealthy > 0) {
+        return {
+            status: 'ok',
+            label: 'OAuth',
+            detail: `pool credential live (${poolHealthy}/${poolTotal} account${poolTotal === 1 ? '' : 's'}) — ` +
+                `the legacy credentials.json is ${legacyStatus} and unused (dario#805)`,
+        };
+    }
+    return {
+        status: legacyStatus === 'expired' && legacyCanRefresh ? 'warn' : 'fail',
+        label: 'OAuth',
+        detail: legacyStatus === 'none' ? 'not authenticated — run `dario login`' : legacyStatus,
+    };
+}
 export function checkIdentityDrift(input) {
     const { live, poolAccounts } = input;
     // Short-prefix for surfaced IDs — 64-char userIDs and 36-char UUIDs are
@@ -477,11 +510,20 @@ export async function runChecks(opts = {}) {
         const { getStatus } = await import('./oauth.js');
         const s = await getStatus();
         if (!s.authenticated) {
-            checks.push({
-                status: s.status === 'expired' && s.canRefresh ? 'warn' : 'fail',
-                label: 'OAuth',
-                detail: s.status === 'none' ? 'not authenticated — run `dario login`' : s.status,
-            });
+            // What actually serves is the POOL, not the legacy credentials.json —
+            // so ask the pool before reporting an auth failure. See oauthCheckRow.
+            let poolHealthy = 0, poolTotal = 0;
+            try {
+                const { listAccountAliases, loadAllAccounts } = await import('./accounts.js');
+                if ((await listAccountAliases()).length > 0) {
+                    const loaded = await loadAllAccounts();
+                    const now = Date.now();
+                    poolTotal = loaded.length;
+                    poolHealthy = loaded.filter((a) => a.expiresAt > now).length;
+                }
+            }
+            catch { /* pool unreadable — oauthCheckRow falls back to the legacy verdict */ }
+            checks.push(oauthCheckRow({ legacyStatus: s.status, legacyCanRefresh: !!s.canRefresh, poolHealthy, poolTotal }));
         }
         else {
             checks.push({ status: 'ok', label: 'OAuth', detail: `${s.status} (expires in ${s.expiresIn})` });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "5.5.65",
+  "version": "5.5.67",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {
@@ -24,7 +24,7 @@
   "scripts": {
     "build": "tsc && cp src/cc-template-data.json dist/",
     "test": "node --test --test-concurrency=8 test/all.test.mjs",
-    "test:serial": "node test/issue-29-tool-translation.mjs && node test/hybrid-tools.mjs && node test/tool-schema-contract.mjs && node test/scrub-paths.mjs && node test/provider-prefix.mjs && node test/analytics-recording.mjs && node test/analytics-billing-bucket.mjs && node test/failover-429.mjs && node test/pool-sticky.mjs && node test/live-fingerprint.mjs && node test/proxy-header-order.mjs && node test/proxy-body-order.mjs && node test/runtime-fingerprint.mjs && node test/pacing.mjs && node test/stream-drain.mjs && node test/subagent.mjs && node test/mcp-protocol.mjs && node test/mcp-tools.mjs && node test/mcp-e2e.mjs && node test/session-rotation.mjs && node test/drift-detection.mjs && node test/cc-authorize-probe-classifier.mjs && node test/compat-range.mjs && node test/doctor-formatter.mjs && node test/doctor-identity-drift.mjs && node test/atomic-write.mjs && node test/account-refresh-singleflight.mjs && node test/durable-token-persist.mjs && node test/streaming-edge-cases.mjs && node test/client-detection.mjs && node test/manual-oauth-flow.mjs && node test/scrub-template.mjs && node test/context-bleed.mjs && node test/passthrough-header-forwarding.mjs && node test/capture-provenance.mjs && node test/sanitize-messages.mjs && node test/platform-tools.mjs && node test/strict-template-flags.mjs && node test/request-queue.mjs && node test/effort-flag.mjs && node test/template-invariants.mjs",
+    "test:serial": "node test/issue-29-tool-translation.mjs && node test/hybrid-tools.mjs && node test/tool-schema-contract.mjs && node test/scrub-paths.mjs && node test/provider-prefix.mjs && node test/analytics-recording.mjs && node test/analytics-billing-bucket.mjs && node test/failover-429.mjs && node test/pool-sticky.mjs && node test/live-fingerprint.mjs && node test/proxy-header-order.mjs && node test/proxy-body-order.mjs && node test/runtime-fingerprint.mjs && node test/pacing.mjs && node test/stream-drain.mjs && node test/subagent.mjs && node test/mcp-protocol.mjs && node test/mcp-tools.mjs && node test/mcp-e2e.mjs && node test/session-rotation.mjs && node test/drift-detection.mjs && node test/cc-authorize-probe-classifier.mjs && node test/compat-range.mjs && node test/doctor-formatter.mjs && node test/doctor-identity-drift.mjs && node test/doctor-oauth-pool.mjs && node test/atomic-write.mjs && node test/account-refresh-singleflight.mjs && node test/durable-token-persist.mjs && node test/streaming-edge-cases.mjs && node test/client-detection.mjs && node test/manual-oauth-flow.mjs && node test/scrub-template.mjs && node test/context-bleed.mjs && node test/passthrough-header-forwarding.mjs && node test/capture-provenance.mjs && node test/sanitize-messages.mjs && node test/platform-tools.mjs && node test/strict-template-flags.mjs && node test/request-queue.mjs && node test/effort-flag.mjs && node test/template-invariants.mjs",
     "audit": "npm audit --production --audit-level=high",
     "prepublishOnly": "npm run build",
     "start": "node dist/cli.js",
@@ -34,6 +34,7 @@
     "compat": "node test/compat.mjs",
     "test:refresh-lock-race": "node test/integration/dual-instance-race.mjs",
     "lint:pkg": "node scripts/check-package-json.mjs",
+    "preflight": "node scripts/preflight.mjs",
     "drift:sdk": "node scripts/check-sdk-drift.mjs",
     "drift:wire": "node scripts/check-wire-drift.mjs",
     "check:overage": "node scripts/check-overage-live.mjs",