@askalf/dario 6.0.32 → 6.0.33

package/dist/admin-api.d.ts

@@ -40,9 +40,10 @@
  * writes behind one HTTP request.
  *
  * `GET /admin/accounts` reports each account's persisted metadata — alias,
- * scopes, token expiry — plus its live pool status (5h/7d utilization,
- * representative-claim, routing status, request count, consecutive auth
- * failures) when the proxy supplies a `poolStatus` snapshot, which it does
+ * scopes, token expiry — plus its live pool status (5h/7d utilization and
+ * how old that reading is, when its window resets, representative-claim,
+ * routing status, request and rejection counts, consecutive auth failures)
+ * when the proxy supplies a `poolStatus` snapshot, which it does
  * whenever pool mode is active. It's the headless, admin-token-gated
  * equivalent of the `GET /accounts` pool view.
  *
@@ -90,9 +91,24 @@ export interface AdminAccountLive {
     lastObservedAt: number | null;
     /** Age of that reading in ms, or `null` when never observed. */
     utilAgeMs: number | null;
+    /**
+     * When the window that reading was measured against rolls over — epoch ms
+     * and ms-from-now — or `null` when no response has stated one. For a
+     * `rejected` seat this is when the rejection lifts (dario#1244).
+     */
+    resetAt: number | null;
+    resetInMs: number | null;
     claim: string;
     status: string;
     requestCount: number;
+    /**
+     * Upstream 429s this account answered. `requestCount` counts requests it
+     * served and a 429 served nothing, so a seat parked on its first attempt
+     * read `request_count: 0` next to `status: rejected` (dario#1244).
+     */
+    rejectedCount: number;
+    /** Epoch ms of the most recent 429 on this account, or `null` if never. */
+    lastRejectedAt: number | null;
     /**
      * Consecutive auth failures on this account (dario#234's cool-down
      * counter). `status: 'auth-cooldown'` alone doesn't distinguish a single

package/dist/admin-api.js

@@ -359,9 +359,18 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
                     ...(l ? {
                         util5h: l.util5h,
                         util7d: l.util7d,
+                        // The reading's age and its window's reset, so `rejected` says
+                        // since when and until when — the same fields GET /accounts has
+                        // carried since #1032 and #1232; this surface dropped them.
+                        last_observed_at: l.lastObservedAt ?? null,
+                        util_age_ms: l.utilAgeMs ?? null,
+                        reset_at: l.resetAt ?? null,
+                        reset_in_ms: l.resetInMs ?? null,
                         claim: l.claim,
                         status: l.status,
                         request_count: l.requestCount,
+                        rejected_count: l.rejectedCount ?? 0,
+                        last_rejected_at: l.lastRejectedAt ?? null,
                         consecutive_auth_failures: l.consecutiveAuthFailures,
                     } : {}),
                 };

package/dist/pool.d.ts

@@ -65,6 +65,34 @@ export interface UtilFreshness {
  * null rather than as an age of ~56 years since epoch.
  */
 export declare function utilFreshness(rl: RateLimitSnapshot, now: number): UtilFreshness;
+/** When an account's rate-limit window rolls over — see `rateLimitWindow`. */
+export interface RateLimitWindow {
+    /**
+     * Epoch ms the window resets at, from `anthropic-ratelimit-unified-reset`;
+     * null when no response on this account has stated one.
+     */
+    resetAt: number | null;
+    /** Ms until that reset, floored at 0 once it has passed; null when unknown. */
+    resetInMs: number | null;
+}
+/**
+ * The reset moment of the window an account's last reading was measured
+ * against (dario#1244). The snapshot has carried `reset` since the header was
+ * first parsed and routing has expired rejections on it since #1232, but no
+ * operator surface showed it: a seat read `status: rejected` with nothing
+ * saying until when, and `requestCount: 0` beside it (a 429 serves nothing,
+ * so the attempt was never counted) made the rejection look like one dario
+ * had made up. For a `rejected` seat this is when the rejection lifts; for
+ * an `allowed` one, when its representative window rolls. The header is
+ * epoch SECONDS; both fields here are milliseconds, like `expiresInMs` and
+ * `utilAgeMs`.
+ */
+export declare function rateLimitWindow(rl: RateLimitSnapshot, now: number): RateLimitWindow;
+/**
+ * One line for a log or a doctor row:
+ * `5h 104%, 7d 25%, claim five_hour, resets in 37m`.
+ */
+export declare function describeRateLimitSnapshot(rl: RateLimitSnapshot, now?: number): string;
 export interface PoolAccount {
     alias: string;
     accessToken: string;
@@ -73,6 +101,16 @@ export interface PoolAccount {
     identity: AccountIdentity;
     rateLimit: RateLimitSnapshot;
     requestCount: number;
+    /**
+     * Upstream 429s this account has answered. `requestCount` counts requests
+     * the account SERVED, and a 429 served nothing — so a seat parked on its
+     * first attempt read `requestCount: 0` next to `status: rejected`, as if
+     * dario had rejected a seat it never called (dario#1244). This is the field
+     * that says it was tried.
+     */
+    rejectedCount: number;
+    /** Epoch ms of the most recent 429 on this account; undefined if never. */
+    lastRejectedAt?: number;
     /** Epoch ms of the OAuth grant (refresh-grant.ts); undefined when unknown. */
     grantedAt?: number;
     /**
@@ -304,7 +342,14 @@ export declare class AccountPool {
     /** Select the next-best account, excluding the given set of aliases. */
     selectExcluding(excluded: Set<string>, family?: string | null): PoolAccount | null;
     updateRateLimits(alias: string, snapshot: RateLimitSnapshot): void;
-    markRejected(alias: string, snapshot: RateLimitSnapshot): void;
+    /**
+     * Park `alias` on an upstream 429. Returns true when this takes a seat OUT
+     * of rotation — the first 429 of a window — and false when the seat was
+     * already parked inside a live window: the all-exhausted fallback in
+     * `select()` re-probes parked seats, so a pool with nothing left can 429
+     * the same seat many times, and only the transition is worth a log line.
+     */
+    markRejected(alias: string, snapshot: RateLimitSnapshot): boolean;
     updateTokens(alias: string, accessToken: string, refreshToken: string, expiresAt: number): void;
     get(alias: string): PoolAccount | undefined;
     all(): PoolAccount[];

package/dist/pool.js

@@ -58,6 +58,42 @@ export function utilFreshness(rl, now) {
         utilAgeMs: lastObservedAt === null ? null : Math.max(0, now - lastObservedAt),
     };
 }
+/**
+ * The reset moment of the window an account's last reading was measured
+ * against (dario#1244). The snapshot has carried `reset` since the header was
+ * first parsed and routing has expired rejections on it since #1232, but no
+ * operator surface showed it: a seat read `status: rejected` with nothing
+ * saying until when, and `requestCount: 0` beside it (a 429 serves nothing,
+ * so the attempt was never counted) made the rejection look like one dario
+ * had made up. For a `rejected` seat this is when the rejection lifts; for
+ * an `allowed` one, when its representative window rolls. The header is
+ * epoch SECONDS; both fields here are milliseconds, like `expiresInMs` and
+ * `utilAgeMs`.
+ */
+export function rateLimitWindow(rl, now) {
+    if (!(rl.reset > 0))
+        return { resetAt: null, resetInMs: null };
+    const resetAt = rl.reset * 1000;
+    return { resetAt, resetInMs: Math.max(0, resetAt - now) };
+}
+/**
+ * One line for a log or a doctor row:
+ * `5h 104%, 7d 25%, claim five_hour, resets in 37m`.
+ */
+export function describeRateLimitSnapshot(rl, now = Date.now()) {
+    const pct = (n) => `${Math.round(n * 100)}%`;
+    const { resetInMs } = rateLimitWindow(rl, now);
+    const reset = resetInMs === null ? 'no reset stated'
+        : resetInMs === 0 ? 'window already rolled'
+            : `resets in ${formatDurationMs(resetInMs)}`;
+    return `5h ${pct(rl.util5h)}, 7d ${pct(rl.util7d)}, claim ${rl.claim}, ${reset}`;
+}
+function formatDurationMs(ms) {
+    const totalMins = Math.max(1, Math.round(ms / 60_000));
+    const h = Math.floor(totalMins / 60);
+    const m = totalMins % 60;
+    return h > 0 ? `${h}h ${m}m` : `${m}m`;
+}
 /**
  * Cool-down schedule after auth failures. First failure: 60s. Each
  * consecutive failure doubles the window up to 30 minutes. Cleared
@@ -318,21 +354,36 @@ export class AccountPool {
     }
     add(alias, opts) {
         const existing = this.accounts.get(alias);
+        // A record whose grantedAt differs from the live entry's is a NEW grant
+        // under this alias — a re-login, possibly on a different organization
+        // with its own windows. The live state describes the old credential (its
+        // rejection and reading, its auth streak, its identity), so it starts
+        // fresh (dario#1244): before this, a seat re-granted to clear
+        // `auth-cooldown` stayed cooling until the old streak's timer ran out,
+        // and one re-granted on another organization stayed parked on the old
+        // organization's window. A reconcile carrying the same grant — a token
+        // refresh, an admin change to another seat, a peer instance's rotation in
+        // HA — keeps the live state as before. So does a record with no grantedAt
+        // at all: it cannot be told apart from the same grant.
+        const regranted = existing !== undefined && opts.grantedAt !== undefined && opts.grantedAt !== existing.grantedAt;
+        const keep = regranted ? undefined : existing;
         this.accounts.set(alias, {
             alias,
             accessToken: opts.accessToken,
             refreshToken: opts.refreshToken,
             expiresAt: opts.expiresAt,
-            grantedAt: opts.grantedAt ?? existing?.grantedAt,
-            identity: existing?.identity ?? {
+            grantedAt: opts.grantedAt ?? keep?.grantedAt,
+            identity: keep?.identity ?? {
                 deviceId: opts.deviceId,
                 accountUuid: opts.accountUuid,
                 sessionId: randomUUID(),
             },
-            rateLimit: existing?.rateLimit ?? { ...EMPTY_SNAPSHOT },
-            requestCount: existing?.requestCount ?? 0,
-            lastAuthFailureAt: existing?.lastAuthFailureAt,
-            consecutiveAuthFailures: existing?.consecutiveAuthFailures ?? 0,
+            rateLimit: keep?.rateLimit ?? { ...EMPTY_SNAPSHOT },
+            requestCount: keep?.requestCount ?? 0,
+            rejectedCount: keep?.rejectedCount ?? 0,
+            lastRejectedAt: keep?.lastRejectedAt,
+            lastAuthFailureAt: keep?.lastAuthFailureAt,
+            consecutiveAuthFailures: keep?.consecutiveAuthFailures ?? 0,
         });
     }
     remove(alias) {
@@ -549,11 +600,23 @@ export class AccountPool {
         account.rateLimit = snapshot;
         account.requestCount++;
     }
+    /**
+     * Park `alias` on an upstream 429. Returns true when this takes a seat OUT
+     * of rotation — the first 429 of a window — and false when the seat was
+     * already parked inside a live window: the all-exhausted fallback in
+     * `select()` re-probes parked seats, so a pool with nothing left can 429
+     * the same seat many times, and only the transition is worth a log line.
+     */
     markRejected(alias, snapshot) {
         const account = this.accounts.get(alias);
         if (!account)
-            return;
+            return false;
+        const now = snapshot.updatedAt || Date.now();
+        const wasParked = account.rateLimit.status === 'rejected' && !rateLimitWindowPassed(account.rateLimit, now);
         account.rateLimit = { ...snapshot, status: 'rejected' };
+        account.rejectedCount++;
+        account.lastRejectedAt = now;
+        return !wasParked;
     }
     updateTokens(alias, accessToken, refreshToken, expiresAt) {
         const account = this.accounts.get(alias);

package/dist/proxy.js

@@ -12,7 +12,7 @@ import { darioVersion } from './version.js';
 import { buildCCRequest, applyCcPromptCaching, isGenuineCCClient, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, forwardClientCCIdentityHeaders, isMcpToolName, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
 import { stampCch, hasCchSeed } from './cch.js';
 import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion } from './live-fingerprint.js';
-import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, reconcilePoolAccounts, resolvePoolStrategy, utilFreshness } from './pool.js';
+import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, reconcilePoolAccounts, resolvePoolStrategy, utilFreshness, rateLimitWindow, describeRateLimitSnapshot } from './pool.js';
 import { Analytics, billingBucketFromClaim, formatUsageLogLine, SUBSCRIPTION_CLAIMS, CODEX_CLAIM } from './analytics.js';
 import { OverageGuard, buildHaltErrorBody } from './overage-guard.js';
 import { notify as osNotify } from './notify.js';
@@ -2102,9 +2102,12 @@ export async function startProxy(opts = {}) {
                             // surface documents itself as reporting the same snapshot, so it
                             // must not be the one place a stale reading still looks current.
                             ...utilFreshness(a.rateLimit, snapNow),
+                            ...rateLimitWindow(a.rateLimit, snapNow),
                             claim: a.rateLimit.claim,
                             status: reportedAccountStatus(a, snapNow),
                             requestCount: a.requestCount,
+                            rejectedCount: a.rejectedCount,
+                            lastRejectedAt: a.lastRejectedAt ?? null,
                             // Raw streak, not just the cooldown boolean: a single 401 also
                             // shows `auth-cooldown` for 60s, indistinguishable from a
                             // genuinely dead refresh token by that field alone. The magnitude
@@ -2201,9 +2204,16 @@ export async function startProxy(opts = {}) {
                     util5h: a.rateLimit.util5h,
                     util7d: a.rateLimit.util7d,
                     ...utilFreshness(a.rateLimit, now),
+                    // When that window rolls (dario#1244): for a rejected seat, when
+                    // the rejection lifts. Milliseconds, like expiresInMs.
+                    ...rateLimitWindow(a.rateLimit, now),
                     claim: a.rateLimit.claim,
                     status: reportedAccountStatus(a, now),
                     requestCount: a.requestCount,
+                    // 429s answered — the attempts requestCount does not count, so a
+                    // parked seat no longer reads as one that was never called.
+                    rejectedCount: a.rejectedCount,
+                    lastRejectedAt: a.lastRejectedAt ?? null,
                     expiresInMs: Math.max(0, a.expiresAt - now),
                     // Refresh-token grant age (refresh-grant.ts): the wall a token
                     // refresh cannot move. null fields = grant date unknown.
@@ -3723,7 +3733,15 @@ export async function startProxy(opts = {}) {
                 if (poolAccount) {
                     const snapshot = parseRateLimits(upstream.headers);
                     if (upstream.status === 429) {
-                        pool.markRejected(poolAccount.alias, snapshot);
+                        // Say so the moment a seat leaves rotation. With a peer to fail
+                        // over to the client sees 200, and nothing else named the seat,
+                        // the reading, or when it comes back (dario#1244). Once per
+                        // parking: the all-exhausted fallback re-probes parked seats, and
+                        // those repeats are verbose-only.
+                        const parked = pool.markRejected(poolAccount.alias, snapshot);
+                        if (parked || verbose) {
+                            console.error(`[dario] #${requestCount} rate limited (429) on account "${poolAccount.alias}": ${describeRateLimitSnapshot(snapshot)} — parked until the window rolls`);
+                        }
                     }
                     else {
                         pool.updateRateLimits(poolAccount.alias, snapshot);

package/dist/tui/tabs/accounts.d.ts

@@ -34,6 +34,8 @@ export interface AccountsState {
         util5h?: number;
         util7d?: number;
         status?: string;
+        /** Ms until the seat's rate-limit window rolls; null/absent when unknown. */
+        resetInMs?: number | null;
     }>;
     error: string | null;
     /** Where the list came from: the running proxy's pool, the proxy's

package/dist/tui/tabs/accounts.js

@@ -98,8 +98,11 @@ export const AccountsTab = {
                 const expiresCol = pad(formatExpiry(acc.expiresAt), 14);
                 const u5 = pad(acc.util5h !== undefined ? `${Math.round(acc.util5h * 100)}%` : '—', 9);
                 const u7 = pad(acc.util7d !== undefined ? `${Math.round(acc.util7d * 100)}%` : '—', 9);
-                const statusCol = acc.status ?? '—';
-                const statusFg = statusCol === 'auth-cooldown' ? fg('yellow', statusCol) : dim(statusCol);
+                // A parked seat says for how long (dario#1244): "rejected 37m".
+                const statusCol = acc.status === 'rejected' && typeof acc.resetInMs === 'number'
+                    ? `rejected ${formatCountdown(acc.resetInMs)}`
+                    : (acc.status ?? '—');
+                const statusFg = statusCol === 'auth-cooldown' || acc.status === 'rejected' ? fg('yellow', statusCol) : dim(statusCol);
                 push('  ' + aliasCol + expiresCol + u5 + u7 + statusFg);
             }
             else {
@@ -143,6 +146,7 @@ export async function refreshAccounts(ctx) {
                         util5h: a.util5h,
                         util7d: a.util7d,
                         status: a.status,
+                        resetInMs: a.resetInMs,
                     })),
                     error: null,
                 };
@@ -177,6 +181,15 @@ async function diskFallback() {
         return { loading: false, accounts: [], error: e.message, source: 'disk' };
     }
 }
+/** `37m` / `4h59m` / `now` — how long until a parked seat's window rolls. */
+function formatCountdown(ms) {
+    if (ms <= 0)
+        return 'now';
+    const totalMins = Math.max(1, Math.round(ms / 60_000));
+    const h = Math.floor(totalMins / 60);
+    const m = totalMins % 60;
+    return h > 0 ? `${h}h${m}m` : `${m}m`;
+}
 function formatExpiry(expiresAt) {
     if (expiresAt === 0)
         return dim('—');

package/docs/admin-api.md

@@ -95,12 +95,20 @@ All endpoints accept the token as `authorization: Bearer <token>` or
 | `DELETE /admin/accounts/<alias>` | — | `{ alias, removed }` (`404` if no such alias) |
 
 `GET /admin/accounts` is the monitoring surface: each entry carries the
-persisted metadata (`alias`, `scopes`, `expires_in_ms`) **plus live pool
-status whenever pool mode is active** — `util5h` / `util7d` utilization,
-representative `claim` (e.g. `five_hour`), routing `status`,
-`request_count`, and `consecutive_auth_failures`. It's the admin-token-gated
-equivalent of the proxy-key-gated `GET /accounts` pool view; a headless
-operator needs only the admin token to watch headroom.
+persisted metadata (`alias`, `scopes`, `expires_in_ms`, the grant-age fields)
+**plus live pool status whenever pool mode is active** — `util5h` / `util7d`
+utilization with `last_observed_at` / `util_age_ms` (how old that reading is;
+it does not tick while a seat is parked), `reset_at` / `reset_in_ms` (when
+the window it was measured against rolls — for a `rejected` seat, when the
+rejection lifts), representative `claim` (e.g. `five_hour`), routing
+`status`, `request_count` (requests served), `rejected_count` /
+`last_rejected_at` (429s answered — a 429 serves nothing, so it is not a
+request), and `consecutive_auth_failures`. What each `status` means and what
+to do about it: [Reading a seat's `status`](./multi-account-pool.md#reading-a-seats-status).
+It's the admin-token-gated equivalent of the proxy-key-gated `GET /accounts`
+pool view; a headless operator needs only the admin token to watch headroom.
+Completing a login for an alias that is already in the pool re-grants it: the
+seat starts fresh — no carried-over rejection, cool-down or identity.
 
 ## Pinning a request to one seat
 

package/docs/multi-account-pool.md

@@ -91,6 +91,19 @@ curl http://localhost:3456/accounts     # per-account utilization, claim, sticky
 curl http://localhost:3456/analytics    # per-account / per-model stats, burn rate, exhaustion predictions
 ```
 
+## Reading a seat's `status`
+
+`GET /accounts` (and the admin API's `GET /admin/accounts`, in snake_case) report one `status` per seat. It is the routing verdict, and every value comes with the fields that explain it.
+
+| `status` | What it means | What to do |
+|---|---|---|
+| `allowed` | The seat's last response was a 200 with headroom. `util5h` / `util7d` are that response's reading — a ratio against 1.0, so `0.42` is 42% — `lastObservedAt` / `utilAgeMs` say how old it is, `resetAt` / `resetInMs` when its representative window rolls. | Nothing. |
+| `rejected` | The seat's last response was a 429: the organization behind its token is over the window named by `claim` (`five_hour`, `seven_day`, …). `util5h: 1.04` is 104% of the five-hour window, not 1%. `rejectedCount` / `lastRejectedAt` say the seat was tried — a 429 serves nothing, so `requestCount` does not move — and `resetInMs` says how long it stays parked. Requests route around it; it returns on its own when the window rolls. | Nothing — the window clears itself. If the reading surprises you (your usage page for that account says 0%), the token belongs to a different organization than the page you are looking at, or to the same organization as another seat: the reading is Anthropic's own, taken on that token. `dario accounts check <alias>` asks the seat directly. |
+| `unknown` | No current observation: a seat that has served nothing yet, or a rejection whose window has rolled (`resetInMs: 0`) and that nothing has measured since. | Nothing; the next request measures it. |
+| `auth-cooldown` | Upstream answered 401/403 or `invalid_grant`. `consecutiveAuthFailures` tells a blip (1) from a dead refresh token (a streak); the cool-down doubles with the streak, from 1 minute to 30. | A streak means re-grant the seat — `dario accounts remove` + `add`, or the admin login flow under the same alias. A new grant starts the seat fresh: no carried-over cool-down, rejection or identity. See [Refresh-token grant age](#refresh-token-grant-age) for the 28-day wall behind most streaks. |
+
+The proxy logs every parking as it happens, once per window: `rate limited (429) on account "spare": 5h 104%, 7d 25%, claim five_hour, resets in 37m — parked until the window rolls`. The re-probes the all-exhausted fallback makes of an already-parked seat are logged only under `-v`.
+
 Every request carries a `billingBucket` field (`subscription` / `subscription_fallback` / `extra_usage` / `api` / `unknown`) so you can see which bucket each request billed against and a `subscriptionPercent` headline number tells you at a glance whether dario is actually routing through your subscription or silently falling to API overage.
 
 ## Refresh-token grant age

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.0.32",
+  "version": "6.0.33",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {