@askalf/dario 5.5.83 → 5.5.85

package/dist/provider-adapter.d.ts

@@ -15,10 +15,11 @@
  * Claude adapter the whole proxy and the OpenAI adapter nearly empty. The seam
  * that pays for itself is routing + request-shaping; the rest is shared.
  *
- * The adapters reuse the same primitive proxy.ts uses (`isOpenAIModel`), so this
- * is a consolidation of the existing decision, not a re-derivation of it.
+ * The adapters reuse the same primitives proxy.ts uses (`isOpenAIModel`,
+ * `isCodexModel`), so this is a consolidation of the existing decision, not a
+ * re-derivation of it.
  */
-export type ProviderId = 'claude' | 'openai';
+export type ProviderId = 'claude' | 'openai' | 'codex';
 /** Inputs the routing decision needs, computed once per request. */
 export interface RouteContext {
     /** urlPath === '/v1/chat/completions' (OpenAI chat shape). */
@@ -29,6 +30,10 @@ export interface RouteContext {
     forcedProvider: ProviderId | null;
     /** An openai-compat backend is configured (`dario backend add …`). */
     hasOpenAIBackend: boolean;
+    /** At least one Codex/ChatGPT-subscription account is stored (`dario codex add …`). */
+    hasCodexAccount: boolean;
+    /** Model slugs the Codex backend lists for the selected account (discovered, cached). */
+    codexModels: readonly string[];
     /** `--pool-fallback=<model>` value, or null when disabled. */
     poolFallbackModel: string | null;
     /** Live pool account count. */
@@ -49,6 +54,22 @@ export interface ProviderAdapter {
     /** True if this adapter should PRIMARILY handle the request. */
     claimsPrimary(ctx: RouteContext): boolean;
 }
+/**
+ * Codex/ChatGPT-subscription adapter — the "altman" engine (dario#1009).
+ * Claims an OpenAI-shape request when a Codex account is stored and either the
+ * model carries a `codex:`/`chatgpt:` prefix or its name is one the backend
+ * itself listed for that account (`codexModels`, discovered by
+ * codex-backend.ts — the slugs are per-account and move, so they are never
+ * hardcoded here). Ranks above the openai adapter so a listed slug reaches the
+ * subscription even when an API-key backend is also configured; anything not
+ * listed — `gpt-4o` and friends — is untouched and still lands on that backend.
+ *
+ * OpenAI-path only: the ChatGPT backend speaks Responses, and dario's
+ * chat/completions⇄Responses translation (codex-backend.ts) is written against
+ * the OpenAI request shape. An Anthropic-shape /v1/messages request would need
+ * a second translation that doesn't exist, so it stays with Claude.
+ */
+export declare const codexAdapter: ProviderAdapter;
 /**
  * OpenAI-compat backend adapter. Claims a request under exactly the condition
  * the request handler reroutes on: a configured backend, an OpenAI-shape

package/dist/provider-adapter.js

@@ -15,10 +15,40 @@
  * Claude adapter the whole proxy and the OpenAI adapter nearly empty. The seam
  * that pays for itself is routing + request-shaping; the rest is shared.
  *
- * The adapters reuse the same primitive proxy.ts uses (`isOpenAIModel`), so this
- * is a consolidation of the existing decision, not a re-derivation of it.
+ * The adapters reuse the same primitives proxy.ts uses (`isOpenAIModel`,
+ * `isCodexModel`), so this is a consolidation of the existing decision, not a
+ * re-derivation of it.
  */
 import { isOpenAIModel } from './openai-backend.js';
+import { isCodexModel } from './codex-backend.js';
+/**
+ * Codex/ChatGPT-subscription adapter — the "altman" engine (dario#1009).
+ * Claims an OpenAI-shape request when a Codex account is stored and either the
+ * model carries a `codex:`/`chatgpt:` prefix or its name is one the backend
+ * itself listed for that account (`codexModels`, discovered by
+ * codex-backend.ts — the slugs are per-account and move, so they are never
+ * hardcoded here). Ranks above the openai adapter so a listed slug reaches the
+ * subscription even when an API-key backend is also configured; anything not
+ * listed — `gpt-4o` and friends — is untouched and still lands on that backend.
+ *
+ * OpenAI-path only: the ChatGPT backend speaks Responses, and dario's
+ * chat/completions⇄Responses translation (codex-backend.ts) is written against
+ * the OpenAI request shape. An Anthropic-shape /v1/messages request would need
+ * a second translation that doesn't exist, so it stays with Claude.
+ */
+export const codexAdapter = {
+    id: 'codex',
+    priority: 200,
+    claimsPrimary(ctx) {
+        if (!ctx.hasCodexAccount)
+            return false;
+        if (!ctx.isOpenAIPath)
+            return false;
+        if (ctx.forcedProvider === 'claude' || ctx.forcedProvider === 'openai')
+            return false;
+        return ctx.forcedProvider === 'codex' || isCodexModel(ctx.model, ctx.codexModels);
+    },
+};
 /**
  * OpenAI-compat backend adapter. Claims a request under exactly the condition
  * the request handler reroutes on: a configured backend, an OpenAI-shape
@@ -33,7 +63,7 @@ export const openaiAdapter = {
             return false;
         if (!ctx.isOpenAIPath)
             return false;
-        if (ctx.forcedProvider === 'claude')
+        if (ctx.forcedProvider === 'claude' || ctx.forcedProvider === 'codex')
             return false;
         return ctx.forcedProvider === 'openai' || isOpenAIModel(ctx.model);
     },
@@ -51,7 +81,7 @@ export const claudeAdapter = {
         return true;
     },
 };
-export const DEFAULT_ADAPTERS = [openaiAdapter, claudeAdapter];
+export const DEFAULT_ADAPTERS = [codexAdapter, openaiAdapter, claudeAdapter];
 /**
  * Resolve the routing decision. Offers the request to adapters in priority
  * order and takes the first primary claim; the Claude adapter always claims, so

package/dist/proxy.d.ts

@@ -78,7 +78,7 @@ export declare function selectModelOverride(incomingModel: string, modelOverride
  */
 export declare function buildPoolFallbackBody(body: Buffer, fallbackModel: string): Buffer | null;
 export declare function parseProviderPrefix(model: string): {
-    provider: 'openai' | 'claude';
+    provider: 'openai' | 'claude' | 'codex';
     model: string;
 } | null;
 /**
@@ -255,10 +255,16 @@ export declare const OPENAI_MODELS_LIST: {
 /**
  * Whether dario must have a Claude login to start. False (an empty pool is
  * expected, not a fatal "run dario login") for the modes that serve requests
- * without the Claude OAuth pool: admin-bootstrap, upstream-api-key, and
- * --no-claude-auth. Pure so the startup gate is unit-testable.
+ * without the Claude OAuth pool: admin-bootstrap, upstream-api-key,
+ * --no-claude-auth, and a stored Codex/ChatGPT-subscription account.
+ *
+ * The codex case (dario#1137) is the one a user hits without asking for it: a
+ * ChatGPT-only user has stored an account and has real capacity to serve
+ * requests, so demanding a Claude login — or a `--no-claude-auth` flag they
+ * have no reason to know about — is dario refusing to start over a credential
+ * it will never use. Pure so the startup gate is unit-testable.
  */
-export declare function requiresClaudeLogin(poolSize: number, adminEnabled: boolean, hasUpstreamApiKey: boolean, noClaudeAuth: boolean): boolean;
+export declare function requiresClaudeLogin(poolSize: number, adminEnabled: boolean, hasUpstreamApiKey: boolean, noClaudeAuth: boolean, hasCodexAccount?: boolean): boolean;
 interface ProxyOptions {
     port?: number;
     host?: string;

package/dist/proxy.js

@@ -20,6 +20,8 @@ import { loadAllAccounts, loadAccount, saveAccount, refreshAccountToken, resyncL
 import { handleAdminRequest } from './admin-api.js';
 import { createTokenBucket } from './rate-limit.js';
 import { getOpenAIBackend, isOpenAIModel, forwardToOpenAI } from './openai-backend.js';
+import { forwardToCodex, getCodexModelSlugs, CODEX_BACKEND_BASE_URL } from './codex-backend.js';
+import { listCodexAccountAliases, hasAnyCodexAccount, selectCodexAccount, getFreshCodexAccount } from './codex-accounts.js';
 import { route as routeProvider } from './provider-adapter.js';
 import { RequestQueue, QueueFullError, QueueTimeoutError, DEFAULT_MAX_CONCURRENT, DEFAULT_MAX_QUEUED, DEFAULT_QUEUE_TIMEOUT_MS } from './request-queue.js';
 import { redactSecrets } from './redact.js';
@@ -312,6 +314,8 @@ const PROVIDER_PREFIXES = {
     groq: 'openai',
     compat: 'openai',
     local: 'openai',
+    codex: 'codex',
+    chatgpt: 'codex',
     claude: 'claude',
     anthropic: 'claude',
 };
@@ -891,11 +895,17 @@ export const OPENAI_MODELS_LIST = buildOpenAIModelsList(withLongContextVariants(
 /**
  * Whether dario must have a Claude login to start. False (an empty pool is
  * expected, not a fatal "run dario login") for the modes that serve requests
- * without the Claude OAuth pool: admin-bootstrap, upstream-api-key, and
- * --no-claude-auth. Pure so the startup gate is unit-testable.
+ * without the Claude OAuth pool: admin-bootstrap, upstream-api-key,
+ * --no-claude-auth, and a stored Codex/ChatGPT-subscription account.
+ *
+ * The codex case (dario#1137) is the one a user hits without asking for it: a
+ * ChatGPT-only user has stored an account and has real capacity to serve
+ * requests, so demanding a Claude login — or a `--no-claude-auth` flag they
+ * have no reason to know about — is dario refusing to start over a credential
+ * it will never use. Pure so the startup gate is unit-testable.
  */
-export function requiresClaudeLogin(poolSize, adminEnabled, hasUpstreamApiKey, noClaudeAuth) {
-    return poolSize === 0 && !adminEnabled && !hasUpstreamApiKey && !noClaudeAuth;
+export function requiresClaudeLogin(poolSize, adminEnabled, hasUpstreamApiKey, noClaudeAuth, hasCodexAccount = false) {
+    return poolSize === 0 && !adminEnabled && !hasUpstreamApiKey && !noClaudeAuth && !hasCodexAccount;
 }
 /**
  * Append a JSON-ND line to the proxy log file. No-op when stream is
@@ -1211,6 +1221,18 @@ export async function startProxy(opts = {}) {
     if (openaiBackend) {
         console.log(`  OpenAI-compat backend: ${openaiBackend.name} → ${openaiBackend.baseUrl}`);
     }
+    // Codex/ChatGPT-subscription accounts — the "altman" engine (dario#1009).
+    // This startup probe only decides what to PRINT and whether a Claude login
+    // is required to boot; routing re-asks hasAnyCodexAccount() per request
+    // (dario#1138), so an account stored by `dario codex add` against an
+    // already-running proxy is picked up without a restart — `dario login`
+    // restarts the proxy by convention, `dario codex add` does not. The
+    // credentials themselves are re-read per request too (they rotate on
+    // refresh).
+    const startupCodexAliases = await listCodexAccountAliases();
+    if (startupCodexAliases.length > 0) {
+        console.log(`  Codex accounts: ${startupCodexAliases.join(', ')} → ${CODEX_BACKEND_BASE_URL}`);
+    }
     // Pool-exhausted fallback (strictly opt-in). When the Claude pool can't
     // serve — every seat rate-limited or in auth cool-down — OpenAI-shape
     // requests (/v1/chat/completions) are re-pointed at the configured
@@ -1395,13 +1417,15 @@ export async function startProxy(opts = {}) {
     //   - admin bootstrap (#599): starts empty, returns a clean 503 until an
     //     account is added over the admin API;
     //   - upstream-api-key mode: OAuth + pool are bypassed, requests carry
-    //     x-api-key, so an empty pool is expected.
+    //     x-api-key, so an empty pool is expected;
+    //   - a stored Codex/ChatGPT-subscription account (dario#1137): that user
+    //     never had a Claude login and doesn't need one to be served.
     // Otherwise an empty pool means the login back-fill found no credentials —
     // the user hasn't logged in. Preserve the single-account self-heal there: a
     // dead-but-refreshable token (a container restarted right after a normal
     // expiry, gap #1) is refreshed, then back-filled so the recovered login
     // becomes the pool-of-one it should be — rather than crash-looping on exit(1).
-    if (requiresClaudeLogin(pool.size, adminEnabled, !!upstreamApiKey, opts.noClaudeAuth ?? false)) {
+    if (requiresClaudeLogin(pool.size, adminEnabled, !!upstreamApiKey, opts.noClaudeAuth ?? false, startupCodexAliases.length > 0)) {
         const single = await resolveSingleAccountStartupStatus();
         if (!single.authenticated) {
             console.error('[dario] Not authenticated. Run `dario login` first.');
@@ -2143,7 +2167,23 @@ export async function startProxy(opts = {}) {
             // shadows a real id still applies at request time).
             const advertised = withLongContextVariants(catalog.bases);
             const aliasNames = Object.keys(modelAliases).filter((n) => !advertised.includes(n));
-            const body = JSON.stringify(buildOpenAIModelsList(advertised.concat(aliasNames)));
+            // Codex/ChatGPT-subscription slugs the backend lists for the stored
+            // account (dario#1010), so a client's model picker can discover the
+            // models that account may actually use. Discovery is cached and never
+            // throws, so /v1/models keeps its "always answers" property.
+            let codexNames = [];
+            if (await hasAnyCodexAccount()) {
+                const stored = await selectCodexAccount();
+                if (stored) {
+                    const creds = await getFreshCodexAccount(stored).catch(() => stored);
+                    codexNames = (await getCodexModelSlugs(creds))
+                        .filter((s) => !advertised.includes(s) && !aliasNames.includes(s));
+                }
+            }
+            // Codex slugs are served by the ChatGPT subscription, not Anthropic, so
+            // they advertise `owned_by: "openai"` (dario#1137).
+            const codexOwners = Object.fromEntries(codexNames.map((s) => [s, 'openai']));
+            const body = JSON.stringify(buildOpenAIModelsList(advertised.concat(aliasNames, codexNames), codexOwners));
             res.writeHead(200, { ...JSON_HEADERS, 'Access-Control-Allow-Origin': corsOrigin });
             res.end(body);
             return;
@@ -2242,30 +2282,46 @@ export async function startProxy(opts = {}) {
         // the first version of this forwarded nothing (dario#885).
         let genuineCCRequest = false;
         try {
-            // Select an account by headroom (v5.0: the pool is the one credential
-            // model, so every OAuth request selects from it — a plain `dario login`
-            // is a pool of one). Upstream-api-key mode is the sole path with no pool
-            // account. Inside-request 429/auth failover retries the next-best account
-            // before surfacing an error to the client (see the dispatch loop below).
+            // Account selection is DEFERRED to `selectPoolAccount()` below, after the
+            // provider decision (dario#1137). Selecting here meant the empty-pool 503
+            // fired BEFORE the codex adapter was ever consulted, so a
+            // ChatGPT-subscription-only user — whose empty Claude pool is legitimate,
+            // not a setup error — got "No account configured" for every request that
+            // should have gone to their subscription. A pool account is now required
+            // only once the routing block has declined the request, i.e. when it
+            // really is Claude's. Inside-request 429/auth failover retries the
+            // next-best account before surfacing an error (see the dispatch loop).
+            // `null as PoolAccount | null` rather than a `: PoolAccount | null` annotation:
+            // every assignment happens inside the selectPoolAccount closure below, so
+            // control-flow analysis narrows the annotated form to `null` for the whole
+            // rest of the handler and `poolAccount?.alias` fails to compile. The `as`
+            // form gives the declared type without seeding a narrowing.
             let poolAccount = null;
-            let accessToken;
-            if (upstreamApiKey) {
-                // Per-token API-key mode: no OAuth, no pool selection. `poolAccount`
-                // stays null, so every pool-failover retry below is skipped; the
-                // x-api-key is set on the outbound headers instead of a Bearer.
-                accessToken = '';
-            }
-            else {
+            let accessToken = '';
+            /**
+             * Take a Claude pool account for this request. Returns false when it has
+             * already answered the client (empty or fully drained pool with no viable
+             * fallback) — the caller must return immediately. Leaves `poolAccount`
+             * null without answering in the pool-exhausted-fallback case, which the
+             * fallback dispatch right below picks up.
+             */
+            const selectPoolAccount = () => {
+                if (upstreamApiKey) {
+                    // Per-token API-key mode: no OAuth, no pool selection. `poolAccount`
+                    // stays null, so every pool-failover retry below is skipped; the
+                    // x-api-key is set on the outbound headers instead of a Bearer.
+                    return true;
+                }
                 // Pool is the one credential model (v5.0): a plain `dario login` is a
                 // pool of one, so every OAuth request selects from the pool.
                 poolAccount = pool.select();
                 if (!poolAccount) {
                     // Pool-exhausted fallback: when armed, the pool HAS accounts (all
                     // drained / cooling), and the client speaks OpenAI shape, defer —
-                    // the fallback dispatch below the body read re-points the request
-                    // at the openai-compat backend. An EMPTY pool still 503s: that's
-                    // a setup error the operator needs to see, not traffic to quietly
-                    // re-bill somewhere else.
+                    // the fallback dispatch below re-points the request at the
+                    // openai-compat backend. An EMPTY pool still 503s: that's a setup
+                    // error the operator needs to see, not traffic to quietly re-bill
+                    // somewhere else.
                     const fallbackViable = poolFallbackModel !== null && openaiBackend !== null
                         && isOpenAI && pool.size > 0;
                     if (!fallbackViable) {
@@ -2286,11 +2342,12 @@ export async function startProxy(opts = {}) {
                                 error: 'No accounts available in pool',
                                 message: 'all accounts are rate-limited or in auth cool-down; retry shortly',
                             }));
-                        return;
+                        return false;
                     }
                 }
                 accessToken = poolAccount?.accessToken ?? '';
-            }
+                return true;
+            };
             // Client-side session key (constant per request) for the rotation registry
             // — consulted at body-build, at the outbound header, and on each mid-request
             // failover rewrite so all three agree on the selected account's session.
@@ -2418,18 +2475,54 @@ export async function startProxy(opts = {}) {
             // (forcedProvider === 'openai' || isOpenAIModel(model))`), consolidated so
             // the routing rule is testable and lives in one place. `openaiBackend`
             // stays in the guard for TS narrowing (route already implies it non-null).
+            //
+            // `codex` joins as a third provider (dario#1009/#1010): an OpenAI-shape
+            // request naming a model the ChatGPT backend LISTS for the stored account
+            // (or carrying a `codex:`/`chatgpt:` prefix) is served from that
+            // subscription, via the chat/completions⇄Responses translation in
+            // codex-backend.ts. It ranks above the openai adapter so a listed slug
+            // reaches the subscription even when an API-key backend is configured too.
             if (body.length > 0) {
                 try {
                     const peek = JSON.parse(body.toString());
                     const rawModel = (peek.model || '').toString();
+                    // Credentials are re-read per request (not cached at startup) because
+                    // a refresh rotates them on disk; getFreshCodexAccount refreshes when
+                    // inside the expiry buffer, collapsing concurrent refreshes per alias.
+                    // Resolved BEFORE routing because the routable model set is whatever
+                    // THIS account's backend lists — discovery is cached, so the common
+                    // case is a map lookup, not a request.
+                    let codexCreds = null;
+                    let codexModels = [];
+                    // Presence is re-asked here rather than read from a startup flag so
+                    // an account added while the proxy runs routes on the very next
+                    // request; the absent answer is cached ~30s, so an idle proxy with
+                    // no codex account is not stat-ing the filesystem per request.
+                    if (isOpenAI && await hasAnyCodexAccount()) {
+                        const stored = await selectCodexAccount();
+                        if (stored) {
+                            codexCreds = await getFreshCodexAccount(stored);
+                            codexModels = await getCodexModelSlugs(codexCreds);
+                        }
+                    }
                     const decision = routeProvider({
                         isOpenAIPath: isOpenAI,
                         model: rawModel,
                         forcedProvider,
                         hasOpenAIBackend: openaiBackend !== null,
+                        hasCodexAccount: codexCreds !== null,
+                        codexModels,
                         poolFallbackModel,
                         poolSize: pool.size,
                     });
+                    if (rawModel && codexCreds && decision.provider === 'codex') {
+                        if (verbose) {
+                            console.log(`[dario] #${requestCount} ${req.method} ${urlPath} (model: ${rawModel}) → codex account ${codexCreds.alias}`);
+                        }
+                        requestCount++;
+                        await forwardToCodex(req, res, body, codexCreds, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose);
+                        return;
+                    }
                     if (rawModel && openaiBackend && decision.provider === 'openai') {
                         if (verbose) {
                             console.log(`[dario] #${requestCount} ${req.method} ${urlPath} (model: ${rawModel}) → openai backend`);
@@ -2441,6 +2534,13 @@ export async function startProxy(opts = {}) {
                 }
                 catch { /* not JSON — fall through to existing path */ }
             }
+            // Claude's turn: the routing block above declined this request, so it
+            // needs a pool account. Selecting HERE and not before the body read is
+            // the fix for dario#1137 — a ChatGPT-subscription-only user has a
+            // legitimately empty Claude pool, and the empty-pool 503 used to answer
+            // codex-bound requests before the adapter was ever consulted.
+            if (!selectPoolAccount())
+                return;
             // Pool-exhausted fallback dispatch. In OAuth mode poolAccount can only
             // be null here when the selection above deferred to this path (armed
             // fallback + drained pool + OpenAI-shape request): swap the model and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "5.5.83",
+  "version": "5.5.85",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {