@askalf/dario 6.0.31 → 6.0.33

package/dist/admin-api.d.ts

@@ -40,9 +40,10 @@
  * writes behind one HTTP request.
  *
  * `GET /admin/accounts` reports each account's persisted metadata — alias,
- * scopes, token expiry — plus its live pool status (5h/7d utilization,
- * representative-claim, routing status, request count, consecutive auth
- * failures) when the proxy supplies a `poolStatus` snapshot, which it does
+ * scopes, token expiry — plus its live pool status (5h/7d utilization and
+ * how old that reading is, when its window resets, representative-claim,
+ * routing status, request and rejection counts, consecutive auth failures)
+ * when the proxy supplies a `poolStatus` snapshot, which it does
  * whenever pool mode is active. It's the headless, admin-token-gated
  * equivalent of the `GET /accounts` pool view.
  *
@@ -90,9 +91,24 @@ export interface AdminAccountLive {
     lastObservedAt: number | null;
     /** Age of that reading in ms, or `null` when never observed. */
     utilAgeMs: number | null;
+    /**
+     * When the window that reading was measured against rolls over — epoch ms
+     * and ms-from-now — or `null` when no response has stated one. For a
+     * `rejected` seat this is when the rejection lifts (dario#1244).
+     */
+    resetAt: number | null;
+    resetInMs: number | null;
     claim: string;
     status: string;
     requestCount: number;
+    /**
+     * Upstream 429s this account answered. `requestCount` counts requests it
+     * served and a 429 served nothing, so a seat parked on its first attempt
+     * read `request_count: 0` next to `status: rejected` (dario#1244).
+     */
+    rejectedCount: number;
+    /** Epoch ms of the most recent 429 on this account, or `null` if never. */
+    lastRejectedAt: number | null;
     /**
      * Consecutive auth failures on this account (dario#234's cool-down
      * counter). `status: 'auth-cooldown'` alone doesn't distinguish a single

package/dist/admin-api.js

@@ -359,9 +359,18 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
                     ...(l ? {
                         util5h: l.util5h,
                         util7d: l.util7d,
+                        // The reading's age and its window's reset, so `rejected` says
+                        // since when and until when — the same fields GET /accounts has
+                        // carried since #1032 and #1232; this surface dropped them.
+                        last_observed_at: l.lastObservedAt ?? null,
+                        util_age_ms: l.utilAgeMs ?? null,
+                        reset_at: l.resetAt ?? null,
+                        reset_in_ms: l.resetInMs ?? null,
                         claim: l.claim,
                         status: l.status,
                         request_count: l.requestCount,
+                        rejected_count: l.rejectedCount ?? 0,
+                        last_rejected_at: l.lastRejectedAt ?? null,
                         consecutive_auth_failures: l.consecutiveAuthFailures,
                     } : {}),
                 };

package/dist/claude-model.js

@@ -72,7 +72,17 @@ function servableTarget(target, bases) {
         return null;
     const resolved = resolveAliasAgainst(stripped, bases) ?? stripped;
     const base = resolved.endsWith('[1m]') ? resolved.slice(0, -4) : resolved;
-    return bases.some((b) => b.toLowerCase() === base) ? resolved : null;
+    // The catalog keeps ONE spelling per model — the short id when upstream
+    // lists both `claude-opus-4-8` and `claude-opus-4-8-YYYYMMDD` (see
+    // normalizeUpstreamIds) — while a client may send either. Compare with the
+    // date stripped on both sides, and return the name as written: Anthropic
+    // accepts both forms, so the pool forwards whichever the caller chose.
+    const key = undated(base);
+    return bases.some((b) => undated(b.toLowerCase()) === key) ? resolved : null;
+}
+/** `claude-opus-4-8-20260101` → `claude-opus-4-8`; anything else unchanged. */
+function undated(id) {
+    return id.replace(/-\d{8}$/, '');
 }
 /**
  * The id the Claude pool would serve `model` as AND the effort the entry asked

package/dist/pool.d.ts

@@ -65,6 +65,34 @@ export interface UtilFreshness {
  * null rather than as an age of ~56 years since epoch.
  */
 export declare function utilFreshness(rl: RateLimitSnapshot, now: number): UtilFreshness;
+/** When an account's rate-limit window rolls over — see `rateLimitWindow`. */
+export interface RateLimitWindow {
+    /**
+     * Epoch ms the window resets at, from `anthropic-ratelimit-unified-reset`;
+     * null when no response on this account has stated one.
+     */
+    resetAt: number | null;
+    /** Ms until that reset, floored at 0 once it has passed; null when unknown. */
+    resetInMs: number | null;
+}
+/**
+ * The reset moment of the window an account's last reading was measured
+ * against (dario#1244). The snapshot has carried `reset` since the header was
+ * first parsed and routing has expired rejections on it since #1232, but no
+ * operator surface showed it: a seat read `status: rejected` with nothing
+ * saying until when, and `requestCount: 0` beside it (a 429 serves nothing,
+ * so the attempt was never counted) made the rejection look like one dario
+ * had made up. For a `rejected` seat this is when the rejection lifts; for
+ * an `allowed` one, when its representative window rolls. The header is
+ * epoch SECONDS; both fields here are milliseconds, like `expiresInMs` and
+ * `utilAgeMs`.
+ */
+export declare function rateLimitWindow(rl: RateLimitSnapshot, now: number): RateLimitWindow;
+/**
+ * One line for a log or a doctor row:
+ * `5h 104%, 7d 25%, claim five_hour, resets in 37m`.
+ */
+export declare function describeRateLimitSnapshot(rl: RateLimitSnapshot, now?: number): string;
 export interface PoolAccount {
     alias: string;
     accessToken: string;
@@ -73,6 +101,16 @@ export interface PoolAccount {
     identity: AccountIdentity;
     rateLimit: RateLimitSnapshot;
     requestCount: number;
+    /**
+     * Upstream 429s this account has answered. `requestCount` counts requests
+     * the account SERVED, and a 429 served nothing — so a seat parked on its
+     * first attempt read `requestCount: 0` next to `status: rejected`, as if
+     * dario had rejected a seat it never called (dario#1244). This is the field
+     * that says it was tried.
+     */
+    rejectedCount: number;
+    /** Epoch ms of the most recent 429 on this account; undefined if never. */
+    lastRejectedAt?: number;
     /** Epoch ms of the OAuth grant (refresh-grant.ts); undefined when unknown. */
     grantedAt?: number;
     /**
@@ -304,7 +342,14 @@ export declare class AccountPool {
     /** Select the next-best account, excluding the given set of aliases. */
     selectExcluding(excluded: Set<string>, family?: string | null): PoolAccount | null;
     updateRateLimits(alias: string, snapshot: RateLimitSnapshot): void;
-    markRejected(alias: string, snapshot: RateLimitSnapshot): void;
+    /**
+     * Park `alias` on an upstream 429. Returns true when this takes a seat OUT
+     * of rotation — the first 429 of a window — and false when the seat was
+     * already parked inside a live window: the all-exhausted fallback in
+     * `select()` re-probes parked seats, so a pool with nothing left can 429
+     * the same seat many times, and only the transition is worth a log line.
+     */
+    markRejected(alias: string, snapshot: RateLimitSnapshot): boolean;
     updateTokens(alias: string, accessToken: string, refreshToken: string, expiresAt: number): void;
     get(alias: string): PoolAccount | undefined;
     all(): PoolAccount[];

package/dist/pool.js

@@ -58,6 +58,42 @@ export function utilFreshness(rl, now) {
         utilAgeMs: lastObservedAt === null ? null : Math.max(0, now - lastObservedAt),
     };
 }
+/**
+ * The reset moment of the window an account's last reading was measured
+ * against (dario#1244). The snapshot has carried `reset` since the header was
+ * first parsed and routing has expired rejections on it since #1232, but no
+ * operator surface showed it: a seat read `status: rejected` with nothing
+ * saying until when, and `requestCount: 0` beside it (a 429 serves nothing,
+ * so the attempt was never counted) made the rejection look like one dario
+ * had made up. For a `rejected` seat this is when the rejection lifts; for
+ * an `allowed` one, when its representative window rolls. The header is
+ * epoch SECONDS; both fields here are milliseconds, like `expiresInMs` and
+ * `utilAgeMs`.
+ */
+export function rateLimitWindow(rl, now) {
+    if (!(rl.reset > 0))
+        return { resetAt: null, resetInMs: null };
+    const resetAt = rl.reset * 1000;
+    return { resetAt, resetInMs: Math.max(0, resetAt - now) };
+}
+/**
+ * One line for a log or a doctor row:
+ * `5h 104%, 7d 25%, claim five_hour, resets in 37m`.
+ */
+export function describeRateLimitSnapshot(rl, now = Date.now()) {
+    const pct = (n) => `${Math.round(n * 100)}%`;
+    const { resetInMs } = rateLimitWindow(rl, now);
+    const reset = resetInMs === null ? 'no reset stated'
+        : resetInMs === 0 ? 'window already rolled'
+            : `resets in ${formatDurationMs(resetInMs)}`;
+    return `5h ${pct(rl.util5h)}, 7d ${pct(rl.util7d)}, claim ${rl.claim}, ${reset}`;
+}
+function formatDurationMs(ms) {
+    const totalMins = Math.max(1, Math.round(ms / 60_000));
+    const h = Math.floor(totalMins / 60);
+    const m = totalMins % 60;
+    return h > 0 ? `${h}h ${m}m` : `${m}m`;
+}
 /**
  * Cool-down schedule after auth failures. First failure: 60s. Each
  * consecutive failure doubles the window up to 30 minutes. Cleared
@@ -318,21 +354,36 @@ export class AccountPool {
     }
     add(alias, opts) {
         const existing = this.accounts.get(alias);
+        // A record whose grantedAt differs from the live entry's is a NEW grant
+        // under this alias — a re-login, possibly on a different organization
+        // with its own windows. The live state describes the old credential (its
+        // rejection and reading, its auth streak, its identity), so it starts
+        // fresh (dario#1244): before this, a seat re-granted to clear
+        // `auth-cooldown` stayed cooling until the old streak's timer ran out,
+        // and one re-granted on another organization stayed parked on the old
+        // organization's window. A reconcile carrying the same grant — a token
+        // refresh, an admin change to another seat, a peer instance's rotation in
+        // HA — keeps the live state as before. So does a record with no grantedAt
+        // at all: it cannot be told apart from the same grant.
+        const regranted = existing !== undefined && opts.grantedAt !== undefined && opts.grantedAt !== existing.grantedAt;
+        const keep = regranted ? undefined : existing;
         this.accounts.set(alias, {
             alias,
             accessToken: opts.accessToken,
             refreshToken: opts.refreshToken,
             expiresAt: opts.expiresAt,
-            grantedAt: opts.grantedAt ?? existing?.grantedAt,
-            identity: existing?.identity ?? {
+            grantedAt: opts.grantedAt ?? keep?.grantedAt,
+            identity: keep?.identity ?? {
                 deviceId: opts.deviceId,
                 accountUuid: opts.accountUuid,
                 sessionId: randomUUID(),
             },
-            rateLimit: existing?.rateLimit ?? { ...EMPTY_SNAPSHOT },
-            requestCount: existing?.requestCount ?? 0,
-            lastAuthFailureAt: existing?.lastAuthFailureAt,
-            consecutiveAuthFailures: existing?.consecutiveAuthFailures ?? 0,
+            rateLimit: keep?.rateLimit ?? { ...EMPTY_SNAPSHOT },
+            requestCount: keep?.requestCount ?? 0,
+            rejectedCount: keep?.rejectedCount ?? 0,
+            lastRejectedAt: keep?.lastRejectedAt,
+            lastAuthFailureAt: keep?.lastAuthFailureAt,
+            consecutiveAuthFailures: keep?.consecutiveAuthFailures ?? 0,
         });
     }
     remove(alias) {
@@ -549,11 +600,23 @@ export class AccountPool {
         account.rateLimit = snapshot;
         account.requestCount++;
     }
+    /**
+     * Park `alias` on an upstream 429. Returns true when this takes a seat OUT
+     * of rotation — the first 429 of a window — and false when the seat was
+     * already parked inside a live window: the all-exhausted fallback in
+     * `select()` re-probes parked seats, so a pool with nothing left can 429
+     * the same seat many times, and only the transition is worth a log line.
+     */
     markRejected(alias, snapshot) {
         const account = this.accounts.get(alias);
         if (!account)
-            return;
+            return false;
+        const now = snapshot.updatedAt || Date.now();
+        const wasParked = account.rateLimit.status === 'rejected' && !rateLimitWindowPassed(account.rateLimit, now);
         account.rateLimit = { ...snapshot, status: 'rejected' };
+        account.rejectedCount++;
+        account.lastRejectedAt = now;
+        return !wasParked;
     }
     updateTokens(alias, accessToken, refreshToken, expiresAt) {
         const account = this.accounts.get(alias);

package/dist/proxy.js

@@ -12,7 +12,7 @@ import { darioVersion } from './version.js';
 import { buildCCRequest, applyCcPromptCaching, isGenuineCCClient, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, forwardClientCCIdentityHeaders, isMcpToolName, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
 import { stampCch, hasCchSeed } from './cch.js';
 import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion } from './live-fingerprint.js';
-import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, reconcilePoolAccounts, resolvePoolStrategy, utilFreshness } from './pool.js';
+import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, reconcilePoolAccounts, resolvePoolStrategy, utilFreshness, rateLimitWindow, describeRateLimitSnapshot } from './pool.js';
 import { Analytics, billingBucketFromClaim, formatUsageLogLine, SUBSCRIPTION_CLAIMS, CODEX_CLAIM } from './analytics.js';
 import { OverageGuard, buildHaltErrorBody } from './overage-guard.js';
 import { notify as osNotify } from './notify.js';
@@ -23,6 +23,8 @@ import { handleAdminRequest } from './admin-api.js';
 import { createTokenBucket } from './rate-limit.js';
 import { getOpenAIBackend, isOpenAIModel, forwardToOpenAI } from './openai-backend.js';
 import { forwardToCodex, getCodexModelSlugs, peekCodexModelSlugs, pickCodexFallback, pickClaudeTarget, CODEX_BACKEND_BASE_URL } from './codex-backend.js';
+import { isClaudeServableModel } from './claude-model.js';
+import { MODEL_UNROUTABLE } from './upstream-rejection.js';
 import { readCompareTarget, teeResponse, runCompare, writeCompareRecord, COMPARE_RESULT_HEADER } from './compare.js';
 import { listCodexAccountAliases, loadAllCodexAccounts, codexAccountNeedsRefresh, hasAnyCodexAccount, selectCodexAccount, getFreshCodexAccount, getCodexRefreshFailure, CodexCredentialsUnavailableError } from './codex-accounts.js';
 import { route as routeProvider } from './provider-adapter.js';
@@ -2100,9 +2102,12 @@ export async function startProxy(opts = {}) {
                             // surface documents itself as reporting the same snapshot, so it
                             // must not be the one place a stale reading still looks current.
                             ...utilFreshness(a.rateLimit, snapNow),
+                            ...rateLimitWindow(a.rateLimit, snapNow),
                             claim: a.rateLimit.claim,
                             status: reportedAccountStatus(a, snapNow),
                             requestCount: a.requestCount,
+                            rejectedCount: a.rejectedCount,
+                            lastRejectedAt: a.lastRejectedAt ?? null,
                             // Raw streak, not just the cooldown boolean: a single 401 also
                             // shows `auth-cooldown` for 60s, indistinguishable from a
                             // genuinely dead refresh token by that field alone. The magnitude
@@ -2199,9 +2204,16 @@ export async function startProxy(opts = {}) {
                     util5h: a.rateLimit.util5h,
                     util7d: a.rateLimit.util7d,
                     ...utilFreshness(a.rateLimit, now),
+                    // When that window rolls (dario#1244): for a rejected seat, when
+                    // the rejection lifts. Milliseconds, like expiresInMs.
+                    ...rateLimitWindow(a.rateLimit, now),
                     claim: a.rateLimit.claim,
                     status: reportedAccountStatus(a, now),
                     requestCount: a.requestCount,
+                    // 429s answered — the attempts requestCount does not count, so a
+                    // parked seat no longer reads as one that was never called.
+                    rejectedCount: a.rejectedCount,
+                    lastRejectedAt: a.lastRejectedAt ?? null,
                     expiresInMs: Math.max(0, a.expiresAt - now),
                     // Refresh-token grant age (refresh-grant.ts): the wall a token
                     // refresh cannot move. null fields = grant date unknown.
@@ -2726,6 +2738,11 @@ export async function startProxy(opts = {}) {
             // wire shape, and no upstream round-trip for a request nothing can serve.
             // Upstreams do the same (Anthropic: "The request body is not valid
             // JSON"; OpenAI: "We could not parse the JSON body of your request").
+            //
+            // The object this guard parses is kept as `parsedBody` and reused by the
+            // provider-prefix block and the template build below, so the bytes are
+            // JSON.parsed once per request (#642-audit; second-read finding on #1231).
+            let parsedBody = null;
             {
                 let invalid = null;
                 if (body.length === 0)
@@ -2740,6 +2757,8 @@ export async function startProxy(opts = {}) {
                         const v = JSON.parse(text);
                         if (v === null || typeof v !== 'object' || Array.isArray(v))
                             invalid = 'request body must be a JSON object';
+                        else
+                            parsedBody = v;
                     }
                     catch (err) {
                         invalid = `request body is not valid JSON: ${err instanceof Error ? err.message : String(err)}`;
@@ -2775,15 +2794,14 @@ export async function startProxy(opts = {}) {
             // recognizes through its own Anthropic gateway, bypassing localhost).
             let forcedProvider = cliProviderOverride;
             let requestEffort; // dario#419 — per-request effort parsed from a model-name suffix (model:high / model-high)
-            // Parsed body, shared between the provider-prefix detection below and the
-            // template-build block further down so the same bytes are not JSON.parsed
-            // twice per request (#642-audit). Mutations in the prefix block re-serialize
-            // `body` FROM this object, so it always represents the current body.
-            let parsedBody = null;
-            if (body.length > 0) {
+            // `parsedBody` was parsed by the invalid-body guard above and is shared
+            // with the template-build block further down so the same bytes are not
+            // JSON.parsed twice per request (#642-audit). Mutations in the prefix block
+            // re-serialize `body` FROM this object, so it always represents the current
+            // body.
+            if (parsedBody !== null) {
                 try {
-                    const parsed = JSON.parse(body.toString());
-                    parsedBody = parsed;
+                    const parsed = parsedBody;
                     // User-defined aliases first — before provider-prefix parsing, so
                     // an alias target carrying a prefix (`my-fast` → `openai:gpt-4o`)
                     // retargets the backend through the existing machinery below.
@@ -2927,7 +2945,7 @@ export async function startProxy(opts = {}) {
             // reaches the subscription even when an API-key backend is configured too.
             if (body.length > 0) {
                 try {
-                    const peek = JSON.parse(body.toString());
+                    const peek = (parsedBody ?? {}); // parsed once by the invalid-body guard; `body` is re-serialized from it
                     const rawModel = (peek.model || '').toString();
                     const requestPoolFallbackModels = selectPoolFallbackModels(poolFallbackSpec, rawModel);
                     const requestPoolFallbackModel = requestPoolFallbackModels[0] ?? null;
@@ -3117,6 +3135,42 @@ export async function startProxy(opts = {}) {
                         await forwardToOpenAI(req, res, body, openaiBackend, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose);
                         return;
                     }
+                    // dario#1236 — the Claude adapter claims by default, so a model NO
+                    // provider lists used to reach api.anthropic.com verbatim and come
+                    // back as Anthropic's 404 `model: gpt-5.6-sol`, attributed to
+                    // whichever seat sent it, after spending a pool request. Ask the
+                    // positive question the failover chain already asks (claude-model.ts)
+                    // and refuse locally instead.
+                    //
+                    // Deliberately NOT refused: a `claude-*` name the catalog does not
+                    // know (the live catalog can lag a model by a fetch, and on a cold
+                    // start it is the baked list — Anthropic's own 404 stays
+                    // authoritative for those); a request under a server-wide
+                    // --model/--fast-model override, which replaces the name; upstream
+                    // API-key mode, which has no pool to protect and may reach models the
+                    // OAuth catalog never lists; and an OpenAI-shape name the legacy
+                    // OPENAI_MODEL_MAP translates to a Claude model.
+                    if (rawModel && decision.provider === 'claude' && !upstreamApiKey && !modelOverride && !fastModelOverride
+                        && !(isOpenAI && OPENAI_MODEL_MAP[rawModel])
+                        && !/^claude-/i.test(rawModel.trim())
+                        && !isClaudeServableModel(rawModel, getCachedBases(), (m) => resolveClaudeAlias(applyModelAlias(m, modelAliases) ?? m))) {
+                        const consulted = [
+                            codexCreds || codexUnavailable
+                                ? `codex account ${(codexCreds ?? codexUnavailable).alias} (${codexModels.length} listed slug${codexModels.length === 1 ? '' : 's'})`
+                                : 'no codex account',
+                            openaiBackend ? `openai backend ${openaiBackend.name}${isOpenAI ? '' : ' (OpenAI path only)'}` : 'no openai backend',
+                            `claude catalog (${getCachedBases().length} bases)`,
+                        ].join(', ');
+                        if (verbose)
+                            console.log(`[dario] #${requestCount} ${req.method} ${urlPath} (model: ${rawModel}) no provider lists ${rawModel}; refusing — consulted ${consulted}`);
+                        requestCount++;
+                        const message = `no provider lists model "${rawModel}" (consulted ${consulted}); refused locally rather than forwarded to the Claude pool, which would 404 it after spending a request`;
+                        res.writeHead(400, { ...JSON_HEADERS, 'x-dario-upstream-rejection': MODEL_UNROUTABLE });
+                        res.end(JSON.stringify(isOpenAI
+                            ? { error: { message, type: 'invalid_request_error', param: 'model', code: 'model_not_found' } }
+                            : { type: 'error', error: { type: 'invalid_request_error', message } }));
+                        return;
+                    }
                 }
                 catch { /* not JSON — fall through to existing path */ }
             }
@@ -3679,7 +3733,15 @@ export async function startProxy(opts = {}) {
                 if (poolAccount) {
                     const snapshot = parseRateLimits(upstream.headers);
                     if (upstream.status === 429) {
-                        pool.markRejected(poolAccount.alias, snapshot);
+                        // Say so the moment a seat leaves rotation. With a peer to fail
+                        // over to the client sees 200, and nothing else named the seat,
+                        // the reading, or when it comes back (dario#1244). Once per
+                        // parking: the all-exhausted fallback re-probes parked seats, and
+                        // those repeats are verbose-only.
+                        const parked = pool.markRejected(poolAccount.alias, snapshot);
+                        if (parked || verbose) {
+                            console.error(`[dario] #${requestCount} rate limited (429) on account "${poolAccount.alias}": ${describeRateLimitSnapshot(snapshot)} — parked until the window rolls`);
+                        }
                     }
                     else {
                         pool.updateRateLimits(poolAccount.alias, snapshot);

package/dist/tui/tabs/accounts.d.ts

@@ -34,6 +34,8 @@ export interface AccountsState {
         util5h?: number;
         util7d?: number;
         status?: string;
+        /** Ms until the seat's rate-limit window rolls; null/absent when unknown. */
+        resetInMs?: number | null;
     }>;
     error: string | null;
     /** Where the list came from: the running proxy's pool, the proxy's

package/dist/tui/tabs/accounts.js

@@ -98,8 +98,11 @@ export const AccountsTab = {
                 const expiresCol = pad(formatExpiry(acc.expiresAt), 14);
                 const u5 = pad(acc.util5h !== undefined ? `${Math.round(acc.util5h * 100)}%` : '—', 9);
                 const u7 = pad(acc.util7d !== undefined ? `${Math.round(acc.util7d * 100)}%` : '—', 9);
-                const statusCol = acc.status ?? '—';
-                const statusFg = statusCol === 'auth-cooldown' ? fg('yellow', statusCol) : dim(statusCol);
+                // A parked seat says for how long (dario#1244): "rejected 37m".
+                const statusCol = acc.status === 'rejected' && typeof acc.resetInMs === 'number'
+                    ? `rejected ${formatCountdown(acc.resetInMs)}`
+                    : (acc.status ?? '—');
+                const statusFg = statusCol === 'auth-cooldown' || acc.status === 'rejected' ? fg('yellow', statusCol) : dim(statusCol);
                 push('  ' + aliasCol + expiresCol + u5 + u7 + statusFg);
             }
             else {
@@ -143,6 +146,7 @@ export async function refreshAccounts(ctx) {
                         util5h: a.util5h,
                         util7d: a.util7d,
                         status: a.status,
+                        resetInMs: a.resetInMs,
                     })),
                     error: null,
                 };
@@ -177,6 +181,15 @@ async function diskFallback() {
         return { loading: false, accounts: [], error: e.message, source: 'disk' };
     }
 }
+/** `37m` / `4h59m` / `now` — how long until a parked seat's window rolls. */
+function formatCountdown(ms) {
+    if (ms <= 0)
+        return 'now';
+    const totalMins = Math.max(1, Math.round(ms / 60_000));
+    const h = Math.floor(totalMins / 60);
+    const m = totalMins % 60;
+    return h > 0 ? `${h}h${m}m` : `${m}m`;
+}
 function formatExpiry(expiresAt) {
     if (expiresAt === 0)
         return dim('—');

package/dist/upstream-rejection.d.ts

@@ -3,6 +3,14 @@ export interface UpstreamRejection {
     class: UpstreamRejectionClass;
     marker: 'billing_required' | 'rate_limited' | 'credential_rejected' | 'upstream_rejected';
 }
+/**
+ * `x-dario-upstream-rejection` value for a request dario refused LOCALLY
+ * because no provider lists its model (dario#1236). Not a classification of
+ * an upstream answer — there was no upstream request, which is the point — but
+ * it rides the same header so a fleet log or tracker reads one field for
+ * every "this request was not served" verdict.
+ */
+export declare const MODEL_UNROUTABLE = "model_unroutable";
 /** Classify subscription entitlement failures separately from temporary quota exhaustion. */
 export declare function classifyUpstreamRejection(status: number, body: string): UpstreamRejection;
 /** Operator action paired with the failure class. Never suggest credential churn for billing. */

package/dist/upstream-rejection.js

@@ -1,3 +1,11 @@
+/**
+ * `x-dario-upstream-rejection` value for a request dario refused LOCALLY
+ * because no provider lists its model (dario#1236). Not a classification of
+ * an upstream answer — there was no upstream request, which is the point — but
+ * it rides the same header so a fleet log or tracker reads one field for
+ * every "this request was not served" verdict.
+ */
+export const MODEL_UNROUTABLE = 'model_unroutable';
 /** Classify subscription entitlement failures separately from temporary quota exhaustion. */
 export function classifyUpstreamRejection(status, body) {
     const normalized = body.toLowerCase();

package/docs/admin-api.md

@@ -95,12 +95,20 @@ All endpoints accept the token as `authorization: Bearer <token>` or
 | `DELETE /admin/accounts/<alias>` | — | `{ alias, removed }` (`404` if no such alias) |
 
 `GET /admin/accounts` is the monitoring surface: each entry carries the
-persisted metadata (`alias`, `scopes`, `expires_in_ms`) **plus live pool
-status whenever pool mode is active** — `util5h` / `util7d` utilization,
-representative `claim` (e.g. `five_hour`), routing `status`,
-`request_count`, and `consecutive_auth_failures`. It's the admin-token-gated
-equivalent of the proxy-key-gated `GET /accounts` pool view; a headless
-operator needs only the admin token to watch headroom.
+persisted metadata (`alias`, `scopes`, `expires_in_ms`, the grant-age fields)
+**plus live pool status whenever pool mode is active** — `util5h` / `util7d`
+utilization with `last_observed_at` / `util_age_ms` (how old that reading is;
+it does not tick while a seat is parked), `reset_at` / `reset_in_ms` (when
+the window it was measured against rolls — for a `rejected` seat, when the
+rejection lifts), representative `claim` (e.g. `five_hour`), routing
+`status`, `request_count` (requests served), `rejected_count` /
+`last_rejected_at` (429s answered — a 429 serves nothing, so it is not a
+request), and `consecutive_auth_failures`. What each `status` means and what
+to do about it: [Reading a seat's `status`](./multi-account-pool.md#reading-a-seats-status).
+It's the admin-token-gated equivalent of the proxy-key-gated `GET /accounts`
+pool view; a headless operator needs only the admin token to watch headroom.
+Completing a login for an alias that is already in the pool re-grants it: the
+seat starts fresh — no carried-over rejection, cool-down or identity.
 
 ## Pinning a request to one seat
 

package/docs/integrations/cordon.md

@@ -24,8 +24,8 @@ services:
     expose: ["3456"]
 
   cordon:
-    # cordon does not publish an image yet; build it from the repo.
-    build: https://github.com/askalf/cordon.git
+    # multi-arch, Sigstore-attested: gh attestation verify oci://ghcr.io/askalf/cordon:v0.2.0 --repo askalf/cordon
+    image: ghcr.io/askalf/cordon:v0.2.0
     environment:
       ANTHROPIC_BASE: http://dario:3456
       OPENAI_BASE: http://dario:3456

package/docs/multi-account-pool.md

@@ -91,6 +91,19 @@ curl http://localhost:3456/accounts     # per-account utilization, claim, sticky
 curl http://localhost:3456/analytics    # per-account / per-model stats, burn rate, exhaustion predictions
 ```
 
+## Reading a seat's `status`
+
+`GET /accounts` (and the admin API's `GET /admin/accounts`, in snake_case) report one `status` per seat. It is the routing verdict, and every value comes with the fields that explain it.
+
+| `status` | What it means | What to do |
+|---|---|---|
+| `allowed` | The seat's last response was a 200 with headroom. `util5h` / `util7d` are that response's reading — a ratio against 1.0, so `0.42` is 42% — `lastObservedAt` / `utilAgeMs` say how old it is, `resetAt` / `resetInMs` when its representative window rolls. | Nothing. |
+| `rejected` | The seat's last response was a 429: the organization behind its token is over the window named by `claim` (`five_hour`, `seven_day`, …). `util5h: 1.04` is 104% of the five-hour window, not 1%. `rejectedCount` / `lastRejectedAt` say the seat was tried — a 429 serves nothing, so `requestCount` does not move — and `resetInMs` says how long it stays parked. Requests route around it; it returns on its own when the window rolls. | Nothing — the window clears itself. If the reading surprises you (your usage page for that account says 0%), the token belongs to a different organization than the page you are looking at, or to the same organization as another seat: the reading is Anthropic's own, taken on that token. `dario accounts check <alias>` asks the seat directly. |
+| `unknown` | No current observation: a seat that has served nothing yet, or a rejection whose window has rolled (`resetInMs: 0`) and that nothing has measured since. | Nothing; the next request measures it. |
+| `auth-cooldown` | Upstream answered 401/403 or `invalid_grant`. `consecutiveAuthFailures` tells a blip (1) from a dead refresh token (a streak); the cool-down doubles with the streak, from 1 minute to 30. | A streak means re-grant the seat — `dario accounts remove` + `add`, or the admin login flow under the same alias. A new grant starts the seat fresh: no carried-over cool-down, rejection or identity. See [Refresh-token grant age](#refresh-token-grant-age) for the 28-day wall behind most streaks. |
+
+The proxy logs every parking as it happens, once per window: `rate limited (429) on account "spare": 5h 104%, 7d 25%, claim five_hour, resets in 37m — parked until the window rolls`. The re-probes the all-exhausted fallback makes of an already-parked seat are logged only under `-v`.
+
 Every request carries a `billingBucket` field (`subscription` / `subscription_fallback` / `extra_usage` / `api` / `unknown`) so you can see which bucket each request billed against and a `subscriptionPercent` headline number tells you at a glance whether dario is actually routing through your subscription or silently falling to API overage.
 
 ## Refresh-token grant age

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.0.31",
+  "version": "6.0.33",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {
@@ -40,7 +40,9 @@
     "check:overage": "node scripts/check-overage-live.mjs",
     "cch:calibrate": "node scripts/cch-calibrate.mjs",
     "fix:pkg": "node -e \"const fs=require('fs');fs.writeFileSync('package.json',JSON.stringify(JSON.parse(fs.readFileSync('package.json','utf-8')),null,2)+'\\n')\"",
-    "audit:tui": "node tools/tui-audit/audit.mjs"
+    "audit:tui": "node tools/tui-audit/audit.mjs",
+    "readme:assets": "node scripts/readme/hero.mjs && node scripts/readme/terminal.mjs && node scripts/readme/tui.mjs",
+    "check:readme": "node scripts/check-readme-line-count.mjs && node scripts/check-readme-links.mjs"
   },
   "keywords": [
     "llm",