@askalf/dario 6.0.29 → 6.0.30

package/dist/pool.d.ts

@@ -118,6 +118,41 @@ export type AccountIneligibility = 'rate-limited' | 'token-expired' | 'auth-cool
  * need to name the failure, and a boolean forces each of them to re-derive it
  * and drift again.
  */
+/**
+ * Has the window that produced a `rejected` reading rolled over?
+ *
+ * A rejection is a verdict with an expiry date: `anthropic-ratelimit-unified-reset`
+ * names the moment the window that refused the request resets. Past it, the old
+ * reading says nothing about the account any more.
+ *
+ * This matters because a rejected account is filtered out of `select()`, so it
+ * is sent no further requests, so `updateRateLimits` never runs for it and its
+ * snapshot never refreshes. The only routes back into rotation were the
+ * all-exhausted fallback in `select()` and a proxy restart. Observed on the
+ * fleet box (2026-09-06): one seat sat parked on a 106% five-hour reading while
+ * a second subscription carried every request, and it would have stayed parked
+ * past its own reset for as long as the other seat held out.
+ *
+ * `reset` is epoch SECONDS — the header's own unit, the same one `formatReset`
+ * scales — so it is converted here. A snapshot with no reset (0) keeps its
+ * rejection: with no stated rollover there is nothing to expire, and guessing
+ * would push a genuinely throttled account back into rotation.
+ */
+export declare function rateLimitWindowPassed(rl: RateLimitSnapshot, now?: number): boolean;
+/**
+ * The status string the operator-facing surfaces report for one account —
+ * `GET /accounts` and `GET /admin/accounts`, which must agree with each other
+ * and with what routing actually does.
+ *
+ * Auth cool-down outranks the rate-limit reading: a 401 streak is both the more
+ * urgent fact and the one the rate-limit headers cannot describe, since 401
+ * responses carry none. An expired rejection degrades to `unknown` rather than
+ * `allowed` — the window rolled over, but nothing has measured the account
+ * since, and reporting `allowed` would assert a serving capacity no request has
+ * demonstrated. `unknown` is what a never-used account already reports, which is
+ * exactly the state this is: no current observation.
+ */
+export declare function reportedAccountStatus(account: PoolAccount, now?: number): string;
 export declare function accountIneligibility(account: PoolAccount, now?: number): AccountIneligibility | null;
 /** Boolean form of `accountIneligibility` — the router's eligibility filter. */
 export declare function isAccountEligible(account: PoolAccount, now?: number): boolean;

package/dist/pool.js

@@ -100,8 +100,54 @@ export const TOKEN_EXPIRY_MARGIN_MS = 30_000;
  * need to name the failure, and a boolean forces each of them to re-derive it
  * and drift again.
  */
+/**
+ * Has the window that produced a `rejected` reading rolled over?
+ *
+ * A rejection is a verdict with an expiry date: `anthropic-ratelimit-unified-reset`
+ * names the moment the window that refused the request resets. Past it, the old
+ * reading says nothing about the account any more.
+ *
+ * This matters because a rejected account is filtered out of `select()`, so it
+ * is sent no further requests, so `updateRateLimits` never runs for it and its
+ * snapshot never refreshes. The only routes back into rotation were the
+ * all-exhausted fallback in `select()` and a proxy restart. Observed on the
+ * fleet box (2026-09-06): one seat sat parked on a 106% five-hour reading while
+ * a second subscription carried every request, and it would have stayed parked
+ * past its own reset for as long as the other seat held out.
+ *
+ * `reset` is epoch SECONDS — the header's own unit, the same one `formatReset`
+ * scales — so it is converted here. A snapshot with no reset (0) keeps its
+ * rejection: with no stated rollover there is nothing to expire, and guessing
+ * would push a genuinely throttled account back into rotation.
+ */
+export function rateLimitWindowPassed(rl, now = Date.now()) {
+    return rl.reset > 0 && rl.reset * 1000 <= now;
+}
+/**
+ * The status string the operator-facing surfaces report for one account —
+ * `GET /accounts` and `GET /admin/accounts`, which must agree with each other
+ * and with what routing actually does.
+ *
+ * Auth cool-down outranks the rate-limit reading: a 401 streak is both the more
+ * urgent fact and the one the rate-limit headers cannot describe, since 401
+ * responses carry none. An expired rejection degrades to `unknown` rather than
+ * `allowed` — the window rolled over, but nothing has measured the account
+ * since, and reporting `allowed` would assert a serving capacity no request has
+ * demonstrated. `unknown` is what a never-used account already reports, which is
+ * exactly the state this is: no current observation.
+ */
+export function reportedAccountStatus(account, now = Date.now()) {
+    if (isInAuthCooldown(account, now))
+        return 'auth-cooldown';
+    if (account.rateLimit.status === 'rejected' && rateLimitWindowPassed(account.rateLimit, now))
+        return 'unknown';
+    return account.rateLimit.status;
+}
 export function accountIneligibility(account, now = Date.now()) {
-    if (account.rateLimit.status === 'rejected')
+    // A rejection outlives its own window unless it is allowed to expire:
+    // nothing refreshes a parked account's snapshot, because being parked is
+    // what stops it being sent requests.
+    if (account.rateLimit.status === 'rejected' && !rateLimitWindowPassed(account.rateLimit, now))
         return 'rate-limited';
     if (account.expiresAt <= now + TOKEN_EXPIRY_MARGIN_MS)
         return 'token-expired';

package/dist/proxy.js

@@ -12,7 +12,7 @@ import { darioVersion } from './version.js';
 import { buildCCRequest, applyCcPromptCaching, isGenuineCCClient, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, forwardClientCCIdentityHeaders, isMcpToolName, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
 import { stampCch, hasCchSeed } from './cch.js';
 import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion } from './live-fingerprint.js';
-import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reconcilePoolAccounts, resolvePoolStrategy, utilFreshness } from './pool.js';
+import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, reconcilePoolAccounts, resolvePoolStrategy, utilFreshness } from './pool.js';
 import { Analytics, billingBucketFromClaim, formatUsageLogLine, SUBSCRIPTION_CLAIMS, CODEX_CLAIM } from './analytics.js';
 import { OverageGuard, buildHaltErrorBody } from './overage-guard.js';
 import { notify as osNotify } from './notify.js';
@@ -2101,7 +2101,7 @@ export async function startProxy(opts = {}) {
                             // must not be the one place a stale reading still looks current.
                             ...utilFreshness(a.rateLimit, snapNow),
                             claim: a.rateLimit.claim,
-                            status: isInAuthCooldown(a, snapNow) ? 'auth-cooldown' : a.rateLimit.status,
+                            status: reportedAccountStatus(a, snapNow),
                             requestCount: a.requestCount,
                             // Raw streak, not just the cooldown boolean: a single 401 also
                             // shows `auth-cooldown` for 60s, indistinguishable from a
@@ -2200,7 +2200,7 @@ export async function startProxy(opts = {}) {
                     util7d: a.rateLimit.util7d,
                     ...utilFreshness(a.rateLimit, now),
                     claim: a.rateLimit.claim,
-                    status: inCooldown ? 'auth-cooldown' : a.rateLimit.status,
+                    status: reportedAccountStatus(a, now),
                     requestCount: a.requestCount,
                     expiresInMs: Math.max(0, a.expiresAt - now),
                     // Refresh-token grant age (refresh-grant.ts): the wall a token

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.0.29",
+  "version": "6.0.30",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {