@askalf/dario 6.0.34 → 6.0.36

package/README.md

@@ -27,7 +27,7 @@
 
 <p><strong>One local endpoint. Every AI tool you own. The subscriptions you already pay for.</strong></p>
 
-<sub><code>npm i -g @askalf/dario</code> · <strong>0</strong> runtime deps · <a href="https://www.npmjs.com/package/@askalf/dario">SLSA-attested</a> every release · nothing phones home · ~31k lines you can read in a weekend · independent, unofficial, third-party (<a href="DISCLAIMER.md">DISCLAIMER.md</a>)</sub>
+<sub><code>npm i -g @askalf/dario</code> · <strong>0</strong> runtime deps · <a href="https://www.npmjs.com/package/@askalf/dario">SLSA-attested</a> every release · nothing phones home · ~32k lines you can read in a weekend · independent, unofficial, third-party (<a href="DISCLAIMER.md">DISCLAIMER.md</a>)</sub>
 
 <sub><a href="#start-in-60-seconds">Start</a> · <a href="#point-your-tools-at-it">Your tools</a> · <a href="#what-it-does-with-a-request">Routing</a> · <a href="#two-plans-one-endpoint">Two plans</a> · <a href="#many-seats-one-endpoint">Pool</a> · <a href="#it-tracks-a-moving-target">Drift</a> · <a href="#trust--transparency">Trust</a> · <a href="#will-my-account-get-suspended">Risk</a> · <a href="#commands">Commands</a> · <a href="#faq">FAQ</a> · <a href="docs/returning.md">Coming back after a while?</a></sub>
 
@@ -373,7 +373,7 @@ Keeping that current is the whole job, and it's automated. These watchers run un
 | [`deployed-version-watch`](./.github/workflows/deployed-version-watch.yml) | Publishing is not deploying: is what's running what was last released? | ![hourly](https://img.shields.io/github/actions/workflow/status/askalf/dario/deployed-version-watch.yml?branch=master&label=hourly) |
 | [`cc-drift-watcher-liveness`](./.github/workflows/cc-drift-watcher-liveness.yml) | The watcher itself going quiet. Lives on GitHub-hosted infrastructure on purpose, so it survives the failures it watches for. | ![every 2 h](https://img.shields.io/github/actions/workflow/status/askalf/dario/cc-drift-watcher-liveness.yml?branch=master&label=every%202%20h) |
 
-Guarded by a PR-time compat gate that runs the full suite against a live proxy before any wire-shape change merges. A few changes the watchers caught and shipped fixes for, same day:
+Guarded at PR time by [`live-test`](./.github/workflows/live-test.yml), a required check that runs the full suite against a live proxy on a self-hosted runner, plus [`compat-test-self-hosted`](./.github/workflows/compat-test-self-hosted.yml), which replays the compat suite through a passthrough proxy on wire-shape changes. A few changes the watchers caught and shipped fixes for, same day:
 
 | Change (no subscriber-facing note) | Effect | dario shipped |
 |---|---|---|
@@ -405,7 +405,7 @@ The split isn't live, but it was announced once on short notice and could return
 
 | Signal | Status |
 |---|---|
-| Source | **~31k** lines of TypeScript across **67** files, auditable in a weekend. One credential path since v5: the pool. |
+| Source | **~32k** lines of TypeScript across **68** files, auditable in a weekend. One credential path since v5: the pool. |
 | Dependencies | **0 runtime.** Verify: `npm ls --production` |
 | Provenance | Every release [SLSA-attested](https://www.npmjs.com/package/@askalf/dario) via GitHub Actions + Sigstore, published with OIDC trusted publishing — no long-lived npm token exists to leak |
 | Scanning | [CodeQL](https://github.com/askalf/dario/actions/workflows/codeql.yml) on every push and weekly · [ClusterFuzzLite](./.github/workflows/cflite.yml) fuzzes the SSE translator and rejection parsers weekly · [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/askalf/dario) and [Best Practices](https://www.bestpractices.dev/projects/13638) badges above are live |
@@ -598,19 +598,32 @@ Two easy ways to help beyond code: **star the repo**, the clearest signal this i
 |---|---|
 | [@GodsBoy](https://github.com/GodsBoy) | Proxy auth, token redaction, error sanitization ([#2](https://github.com/askalf/dario/pull/2)) |
 | [@belangertrading](https://github.com/belangertrading) | Billing-classification investigation ([#4](https://github.com/askalf/dario/issues/4), [#6](https://github.com/askalf/dario/issues/6), [#7](https://github.com/askalf/dario/issues/7), [#12](https://github.com/askalf/dario/issues/12), [#23](https://github.com/askalf/dario/issues/23)), multi-agent billing FAQ ([#27](https://github.com/askalf/dario/pull/27)) |
+| [@wysie](https://github.com/wysie) | ESM `require` crash in `dario login` ([#15](https://github.com/askalf/dario/issues/15)), OAuth for Max-plan accounts ([#18](https://github.com/askalf/dario/issues/18)) |
 | [@earlvanze](https://github.com/earlvanze) | OpenClaw tool mappings ([#19](https://github.com/askalf/dario/pull/19)), OAuth manual override ([#47](https://github.com/askalf/dario/pull/47)), HTTPS warning ([#53](https://github.com/askalf/dario/pull/53)) |
+| [@nathan-widjaja](https://github.com/nathan-widjaja) | README positioning structure — the promise → who → first use → why-switch spine the page still runs on ([#21](https://github.com/askalf/dario/issues/21)) |
+| [@trinhnvgem](https://github.com/trinhnvgem) | OAuth login failures on first release ([#22](https://github.com/askalf/dario/issues/22)), container and headless callback binding ([#28](https://github.com/askalf/dario/issues/28)) |
+| [@adubkov](https://github.com/adubkov) | The container / headless-SSH case behind the manual OAuth code paste ([#28](https://github.com/askalf/dario/issues/28)) |
 | [@iNicholasBE](https://github.com/iNicholasBE) | macOS keychain credential detection ([#30](https://github.com/askalf/dario/pull/30)) |
 | [@boeingchoco](https://github.com/boeingchoco) | Reverse tool-param translation ([#29](https://github.com/askalf/dario/issues/29)), SSE framing regression catch, hybrid-tool motivation ([#33](https://github.com/askalf/dario/issues/33), [#36](https://github.com/askalf/dario/issues/36)) |
 | [@tetsuco](https://github.com/tetsuco) | Scrubber path corruption ([#35](https://github.com/askalf/dario/issues/35)), OpenClaw reverse-mapping collisions ([#37](https://github.com/askalf/dario/issues/37)), 20x-tier report ([#42](https://github.com/askalf/dario/issues/42)) |
 | [@mikelovatt](https://github.com/mikelovatt) | Silent subscription-drain surfaced via friendly billing buckets ([#34](https://github.com/askalf/dario/issues/34)) |
 | [@ringge](https://github.com/ringge) | `--no-auto-detect` for text-tool auto-preserve ([#40](https://github.com/askalf/dario/issues/40)) |
+| [@rustanacexd](https://github.com/rustanacexd) | Cursor BYOK routing for Claude, and `--effort=max` ([#190](https://github.com/askalf/dario/issues/190)) |
+| [@daimonbot](https://github.com/daimonbot) | Official multi-arch Docker image on GHCR ([#199](https://github.com/askalf/dario/issues/199)) |
 | [@Saik0s](https://github.com/Saik0s) | Wildcard CORS allow-headers, Opus 4.7 catalog entry ([#222](https://github.com/askalf/dario/pull/222)) |
+| [@lwsh123k](https://github.com/lwsh123k) | `cch` anchored to the billing tag instead of first match ([#528](https://github.com/askalf/dario/issues/528)) |
 | [@boredland](https://github.com/boredland) | Time-to-reset in `dario doctor --usage` ([#550](https://github.com/askalf/dario/pull/550)) |
 | [@pnewell](https://github.com/pnewell) | `--preserve-output-format` for structured-output SDKs ([#583](https://github.com/askalf/dario/pull/583)) |
+| [@matteo-rama](https://github.com/matteo-rama) | Headless admin bootstrap ([#599](https://github.com/askalf/dario/issues/599)), Analytics `NaN` and per-account rate-limit rows ([#600](https://github.com/askalf/dario/issues/600)), pool-aware `/status` and `/health` ([#636](https://github.com/askalf/dario/issues/636)), `version` on both ([#640](https://github.com/askalf/dario/issues/640)), Accounts TUI reads the live pool ([#641](https://github.com/askalf/dario/issues/641)) |
+| [@miklisanton](https://github.com/miklisanton) | Mid-session `/model` switch 400 ([#744](https://github.com/askalf/dario/issues/744)), empty-turn guards behind the subagent 400s ([#1033](https://github.com/askalf/dario/issues/1033), [#1117](https://github.com/askalf/dario/issues/1117)) |
+| [@p-i-](https://github.com/p-i-) | Independent wire-fidelity audit with a re-runnable harness — version-blind `bun-match`, and the correction to the packet-identical claim ([#813](https://github.com/askalf/dario/issues/813)) |
 | [@jerzydziewierz](https://github.com/jerzydziewierz) | TUI Config tab clipping and scrolling ([#861](https://github.com/askalf/dario/pull/861)) |
+| [@ramarro123](https://github.com/ramarro123) | Admin bulk re-auth ([#913](https://github.com/askalf/dario/issues/913)), shared state across instances ([#993](https://github.com/askalf/dario/issues/993)), prompt-cache behaviour under litellm ([#1018](https://github.com/askalf/dario/issues/1018)), parked-seat and shared-window reporting ([#1244](https://github.com/askalf/dario/issues/1244)) |
+| [@zytegalaxy](https://github.com/zytegalaxy) | The ChatGPT/Codex engine and `dario add altman` ([#1009](https://github.com/askalf/dario/issues/1009)) |
 | [@chaogebaba](https://github.com/chaogebaba) | Auto-release must never fire from a fork ([#1029](https://github.com/askalf/dario/pull/1029)) |
+| [@robincle](https://github.com/robincle) | Utilisation freshness — `lastObservedAt` / `utilAgeMs` on `/accounts` ([#1032](https://github.com/askalf/dario/issues/1032)) |
 | [@anupamme](https://github.com/anupamme) | Refresh-lock ownership by server-issued lock id ([#1059](https://github.com/askalf/dario/pull/1059)) |
-| [@LiveNathan](https://github.com/LiveNathan) | Never send or stamp empty text blocks ([#1067](https://github.com/askalf/dario/pull/1067)) |
+| [@LiveNathan](https://github.com/LiveNathan) | Never send or stamp empty text blocks ([#1067](https://github.com/askalf/dario/pull/1067)), empty final user turn from CC's stream-interruption retry ([#1092](https://github.com/askalf/dario/issues/1092), as [@NathanLively](https://github.com/NathanLively)) |
 
 ## Disclaimers
 

package/dist/admin-api.d.ts

@@ -102,6 +102,8 @@ export interface AdminAccountLive {
     resetInMs: number | null;
     claim: string;
     status: string;
+    /** none · wait · regrant — the operator's next step (dario#1244). */
+    action?: 'none' | 'wait' | 'regrant';
     requestCount: number;
     /**
      * Upstream 429s this account answered. `requestCount` counts requests it

package/dist/admin-api.js

@@ -378,6 +378,7 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
                         reading_from: l.readingFrom ?? null,
                         claim: l.claim,
                         status: l.status,
+                        action: l.action ?? 'none',
                         request_count: l.requestCount,
                         rejected_count: l.rejectedCount ?? 0,
                         last_rejected_at: l.lastRejectedAt ?? null,

package/dist/cli.d.ts

@@ -105,6 +105,42 @@ export declare function parseBooleanEnv(value: string | undefined): boolean | un
  *   Set(['thinking','env']) — value "thinking,env"        → preserve listed
  */
 export declare function resolvePreserveOrchestrationTags(args: string[], env: string | undefined): Set<string> | undefined;
+/**
+ * The seat shape a running proxy returns from `/accounts`.
+ *
+ * Everything past `alias` is optional on purpose. A freshly installed CLI
+ * routinely queries a proxy still running the PREVIOUS release, whose seats
+ * predate whichever field the newest feature added — `sharesWindowWith`,
+ * `organizationId` and `grantedAt` all arrived that way (dario#1248 review).
+ * The payload is accepted on `mode` + `accounts` alone, so the renderer, not
+ * the fetch, is where a missing field would throw. Defaulting each one here
+ * keeps `accounts list --live` degrading to a thinner line instead of dying
+ * with a TypeError and skipping the on-disk fallback it advertises.
+ */
+export interface LiveSeat {
+    alias?: string;
+    status?: string;
+    action?: 'none' | 'wait' | 'regrant';
+    util5h?: number;
+    util7d?: number;
+    utilAgeMs?: number | null;
+    resetInMs?: number | null;
+    requestCount?: number;
+    rejectedCount?: number;
+    organizationId?: string | null;
+    sharesWindowWith?: string[];
+    grantedAt?: number | null;
+}
+export interface LivePayload {
+    mode?: string;
+    accounts?: LiveSeat[];
+    distinctWindows?: number;
+}
+/**
+ * Render the live pool listing. Pure — returns the lines rather than printing
+ * them, so a legacy payload can be driven straight through it in a test.
+ */
+export declare function formatLiveAccountsListing(payload: LivePayload, port: number, now: number): string[];
 /**
  * Decide whether this module is being invoked as the CLI entry point or
  * imported as a library. Pure, exported for tests; the file-bottom uses

package/dist/cli.js

@@ -894,6 +894,52 @@ function parsePositiveIntFlag(prefix) {
     }
     return n;
 }
+/**
+ * Render the live pool listing. Pure — returns the lines rather than printing
+ * them, so a legacy payload can be driven straight through it in a test.
+ */
+export function formatLiveAccountsListing(payload, port, now) {
+    const seats = Array.isArray(payload.accounts) ? payload.accounts : [];
+    const num = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : 0);
+    const pct = (n) => `${Math.round(num(n) * 100)}%`;
+    const mins = (ms) => {
+        const m = Math.max(1, Math.round(ms / 60_000));
+        return m >= 60 ? `${Math.floor(m / 60)}h ${m % 60}m` : `${m}m`;
+    };
+    const age = (ms) => typeof ms !== 'number' || !Number.isFinite(ms)
+        ? 'never measured'
+        : ms < 60_000 ? `read ${Math.round(ms / 1000)}s ago` : `read ${mins(ms)} ago`;
+    const lines = [];
+    lines.push('');
+    lines.push(`  dario — Accounts (live, from http://127.0.0.1:${port})`);
+    lines.push('  ────────────────');
+    lines.push('');
+    const windows = typeof payload.distinctWindows === 'number' ? payload.distinctWindows : seats.length;
+    lines.push(`  Pool of ${seats.length} (${seats.length === 1 ? '1 seat' : seats.length + ' seats'} on ${windows} distinct window${windows === 1 ? '' : 's'})`);
+    lines.push('');
+    for (const s of seats) {
+        const alias = typeof s.alias === 'string' ? s.alias : '(unnamed)';
+        const rawStatus = typeof s.status === 'string' ? s.status : 'unknown';
+        const status = rawStatus === 'rejected' && typeof s.resetInMs === 'number' ? `rejected, back in ${mins(s.resetInMs)}` : rawStatus;
+        lines.push(`    ${alias.padEnd(20)} ${status.padEnd(26)} 5h ${pct(s.util5h).padEnd(6)} 7d ${pct(s.util7d).padEnd(6)} ${age(s.utilAgeMs)}`);
+        // The one-word next step (dario#1244): a parked seat wants nothing from
+        // the operator; an auth-failure streak wants a re-grant.
+        const next = s.action === 'regrant' ? 'next: re-grant this seat (dario accounts remove + add)'
+            : s.action === 'wait' ? 'next: nothing, it comes back on its own'
+                : null;
+        const facts = [
+            `served ${num(s.requestCount)}`,
+            `429s ${num(s.rejectedCount)}`,
+            ...(next ? [next] : []),
+            typeof s.organizationId === 'string' && s.organizationId ? `org ${s.organizationId.slice(0, 8)}…` : 'org not yet observed',
+            ...(Array.isArray(s.sharesWindowWith) && s.sharesWindowWith.length > 0 ? [`shares its window with ${s.sharesWindowWith.join(', ')}`] : []),
+        ];
+        lines.push(`    ${''.padEnd(20)} ${facts.join('  ·  ')}`);
+        lines.push(`    ${''.padEnd(20)} ${describeGrantAge(grantAge(typeof s.grantedAt === 'number' ? s.grantedAt : undefined, now))}`);
+    }
+    lines.push('');
+    return lines;
+}
 /**
  * `dario accounts list --live` — the running proxy's view of the pool
  * (dario#1244): status with its countdown, the reading and its age, 429s
@@ -924,34 +970,8 @@ async function accountsListLive() {
     }
     if (!payload || payload.mode !== 'pool' || !Array.isArray(payload.accounts))
         return false;
-    const seats = payload.accounts;
-    const now = Date.now();
-    const pct = (n) => `${Math.round(n * 100)}%`;
-    const mins = (ms) => {
-        const m = Math.max(1, Math.round(ms / 60_000));
-        return m >= 60 ? `${Math.floor(m / 60)}h ${m % 60}m` : `${m}m`;
-    };
-    const age = (ms) => ms === null ? 'never measured' : ms < 60_000 ? `read ${Math.round(ms / 1000)}s ago` : `read ${mins(ms)} ago`;
-    console.log('');
-    console.log(`  dario — Accounts (live, from http://127.0.0.1:${port})`);
-    console.log('  ────────────────');
-    console.log('');
-    const windows = payload.distinctWindows ?? seats.length;
-    console.log(`  Pool of ${seats.length} (${seats.length === 1 ? '1 seat' : seats.length + ' seats'} on ${windows} distinct window${windows === 1 ? '' : 's'})`);
-    console.log('');
-    for (const s of seats) {
-        const status = s.status === 'rejected' && typeof s.resetInMs === 'number' ? `rejected, back in ${mins(s.resetInMs)}` : s.status;
-        console.log(`    ${s.alias.padEnd(20)} ${status.padEnd(26)} 5h ${pct(s.util5h).padEnd(6)} 7d ${pct(s.util7d).padEnd(6)} ${age(s.utilAgeMs)}`);
-        const facts = [
-            `served ${s.requestCount}`,
-            `429s ${s.rejectedCount}`,
-            s.organizationId ? `org ${s.organizationId.slice(0, 8)}…` : 'org not yet observed',
-            ...(s.sharesWindowWith.length > 0 ? [`shares its window with ${s.sharesWindowWith.join(', ')}`] : []),
-        ];
-        console.log(`    ${''.padEnd(20)} ${facts.join('  ·  ')}`);
-        console.log(`    ${''.padEnd(20)} ${describeGrantAge(grantAge(s.grantedAt ?? undefined, now))}`);
-    }
-    console.log('');
+    for (const line of formatLiveAccountsListing(payload, port, Date.now()))
+        console.log(line);
     return true;
 }
 async function accounts() {

package/dist/pool.d.ts

@@ -230,6 +230,22 @@ export declare function reportedAccountStatus(account: PoolAccount, now?: number
 export declare function accountIneligibility(account: PoolAccount, now?: number): AccountIneligibility | null;
 /** Boolean form of `accountIneligibility` — the router's eligibility filter. */
 export declare function isAccountEligible(account: PoolAccount, now?: number): boolean;
+/**
+ * A seat parked on a 429 whose stated window has not rolled yet — the one
+ * state the router must never re-probe: the 429 named the reset, the clock
+ * has not reached it, and a probe can only 429 again. A rejection with no
+ * stated reset is NOT this: with nothing to expire, asking is the only way
+ * back, so it stays probeable (dario#1244).
+ */
+export declare function isParkedInLiveWindow(account: PoolAccount, now?: number): boolean;
+/**
+ * The operator's next step for one seat, next to `status` on both listings
+ * (dario#1244 — "do I have to re-login?" should not need the docs table).
+ * `wait`: the seat comes back on its own (a live rate-limit window, or a
+ * single auth blip cooling down). `regrant`: an auth-failure streak, which is
+ * a dead refresh token. `none`: nothing to do.
+ */
+export declare function accountAction(account: PoolAccount, now?: number): 'none' | 'wait' | 'regrant';
 export interface PoolStatus {
     accounts: number;
     healthy: number;
@@ -341,6 +357,18 @@ export declare class AccountPool {
      * unified-buckets-only headroom — same behavior as before this PR.
      */
     select(family?: string | null): PoolAccount | null;
+    /**
+     * When EVERY seat is parked inside a live rate-limit window: the epoch ms
+     * the earliest window rolls, i.e. the moment the pool can serve again
+     * without a probe. Null otherwise — including a pool mixing parked seats
+     * with an auth-cooling or token-expired one, which is not "all seats over
+     * their windows" and must not be reported (or cooled) as if it were; those
+     * pools stay on the existing unavailable handling (dario#1244, and the
+     * review on dario#1254 that caught the mixed case).
+     */
+    parkedUntil(now?: number): number | null;
+    /** Seats currently parked inside a live window (dario#1244). */
+    parkedCount(now?: number): number;
     /**
      * Select with session stickiness. If `stickyKey` is already bound to a
      * healthy account (not rejected, token not near expiry, headroom > 2%),

package/dist/pool.js

@@ -250,6 +250,31 @@ export function accountIneligibility(account, now = Date.now()) {
 export function isAccountEligible(account, now = Date.now()) {
     return accountIneligibility(account, now) === null;
 }
+/**
+ * A seat parked on a 429 whose stated window has not rolled yet — the one
+ * state the router must never re-probe: the 429 named the reset, the clock
+ * has not reached it, and a probe can only 429 again. A rejection with no
+ * stated reset is NOT this: with nothing to expire, asking is the only way
+ * back, so it stays probeable (dario#1244).
+ */
+export function isParkedInLiveWindow(account, now = Date.now()) {
+    const rl = account.rateLimit;
+    return rl.status === 'rejected' && rl.reset > 0 && rl.reset * 1000 > now;
+}
+/**
+ * The operator's next step for one seat, next to `status` on both listings
+ * (dario#1244 — "do I have to re-login?" should not need the docs table).
+ * `wait`: the seat comes back on its own (a live rate-limit window, or a
+ * single auth blip cooling down). `regrant`: an auth-failure streak, which is
+ * a dead refresh token. `none`: nothing to do.
+ */
+export function accountAction(account, now = Date.now()) {
+    if (isInAuthCooldown(account, now))
+        return account.consecutiveAuthFailures >= 2 ? 'regrant' : 'wait';
+    if (isParkedInLiveWindow(account, now))
+        return 'wait';
+    return 'none';
+}
 /**
  * Resolve the pool strategy from an explicit value (CLI flag / config file,
  * already precedence-merged by the caller) with `DARIO_POOL_STRATEGY` as
@@ -515,20 +540,45 @@ export class AccountPool {
             }
             return pickMaxHeadroom(eligible, family);
         }
-        // All accounts exhausted — return the one with the earliest reset.
-        // Auth-cooldown'd accounts are excluded from this fallback too: we
-        // know upstream rejected their tokens, so picking them on rate-limit
-        // grounds wouldn't help. Better to return null and let the caller
-        // surface "no account available" than to hand back a dead account.
-        const withReset = all.filter(a => a.rateLimit.reset > 0 && !isInAuthCooldown(a, now));
-        if (withReset.length > 0) {
-            return withReset.reduce((a, b) => a.rateLimit.reset < b.rateLimit.reset ? a : b);
-        }
-        // No rate-limit data at all — least-used first, still skipping cool-downs.
-        const usable = all.filter(a => !isInAuthCooldown(a, now));
-        if (usable.length === 0)
+        // No seat is eligible. A seat parked inside a live window is not
+        // re-probed: its 429 named the reset, the clock has not reached it, and a
+        // probe there is one upstream round trip that can only 429 again — on the
+        // dario#1244 gateway that was 500 probes of one seat inside a single
+        // window, `rejectedCount` climbing by one each time and the operator
+        // reading it as a seat that needed a re-login. The caller reads
+        // `parkedUntil()` and answers the client itself; the seat returns on its
+        // own when the window rolls (`rateLimitWindowPassed` makes it eligible
+        // again). Auth-cooldown seats are skipped for the same reason: upstream
+        // already rejected their tokens.
+        //
+        // What is left — a rejection with no stated reset (nothing to expire, so
+        // asking is the only way back) or an expiring token — is tried least-used
+        // first, as before.
+        const probeable = all.filter(a => !isInAuthCooldown(a, now) && !isParkedInLiveWindow(a, now));
+        if (probeable.length === 0)
             return null;
-        return usable.reduce((a, b) => a.requestCount < b.requestCount ? a : b);
+        return probeable.reduce((a, b) => a.requestCount < b.requestCount ? a : b);
+    }
+    /**
+     * When EVERY seat is parked inside a live rate-limit window: the epoch ms
+     * the earliest window rolls, i.e. the moment the pool can serve again
+     * without a probe. Null otherwise — including a pool mixing parked seats
+     * with an auth-cooling or token-expired one, which is not "all seats over
+     * their windows" and must not be reported (or cooled) as if it were; those
+     * pools stay on the existing unavailable handling (dario#1244, and the
+     * review on dario#1254 that caught the mixed case).
+     */
+    parkedUntil(now = Date.now()) {
+        if (this.accounts.size === 0)
+            return null;
+        const all = [...this.accounts.values()];
+        if (!all.every(a => isParkedInLiveWindow(a, now)))
+            return null;
+        return Math.min(...all.map(a => a.rateLimit.reset * 1000));
+    }
+    /** Seats currently parked inside a live window (dario#1244). */
+    parkedCount(now = Date.now()) {
+        return [...this.accounts.values()].filter(a => isParkedInLiveWindow(a, now)).length;
     }
     /**
      * Select with session stickiness. If `stickyKey` is already bound to a
@@ -645,8 +695,13 @@ export class AccountPool {
             }
             return pickMaxHeadroom(eligible, family);
         }
-        if (candidates.length > 0) {
-            return candidates.reduce((a, b) => a.requestCount < b.requestCount ? a : b);
+        // Mid-flight: the seats a 429 could still hand this request to. A seat
+        // parked inside a live window is not one of them — on the dario#1244
+        // gateway every request walked all six parked seats, six guaranteed 429s
+        // a request. Cool-downs are skipped for the same reason.
+        const probeable = candidates.filter(a => !isInAuthCooldown(a, now) && !isParkedInLiveWindow(a, now));
+        if (probeable.length > 0) {
+            return probeable.reduce((a, b) => a.requestCount < b.requestCount ? a : b);
         }
         return null;
     }

package/dist/proxy.js

@@ -12,7 +12,7 @@ import { darioVersion } from './version.js';
 import { buildCCRequest, applyCcPromptCaching, isGenuineCCClient, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, forwardClientCCIdentityHeaders, isMcpToolName, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
 import { stampCch, hasCchSeed } from './cch.js';
 import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion } from './live-fingerprint.js';
-import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, reconcilePoolAccounts, resolvePoolStrategy, utilFreshness, rateLimitWindow, describeRateLimitSnapshot, windowPeers, distinctWindows } from './pool.js';
+import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, reconcilePoolAccounts, resolvePoolStrategy, utilFreshness, rateLimitWindow, describeRateLimitSnapshot, windowPeers, distinctWindows, accountAction } from './pool.js';
 import { PoolSync, DEFAULT_POOL_SYNC_INTERVAL_MS } from './pool-sync.js';
 import { Analytics, billingBucketFromClaim, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, CODEX_CLAIM } from './analytics.js';
 import { OverageGuard, buildHaltErrorBody } from './overage-guard.js';
@@ -33,7 +33,7 @@ import { selectPoolFallbackModels } from './pool-fallback-tier.js';
 import { RequestQueue, QueueFullError, QueueTimeoutError, DEFAULT_MAX_CONCURRENT, DEFAULT_MAX_QUEUED, DEFAULT_QUEUE_TIMEOUT_MS } from './request-queue.js';
 import { redactSecrets } from './redact.js';
 import { BAKED_BASE_MODELS, withLongContextVariants, buildOpenAIModelsList, getModelCatalog, getCachedBases, resolveAliasAgainst, prewarmModelCatalog, retryModelCatalogNow, isSuspendedModel } from './model-catalog.js';
-import { classifyUpstreamRejection, diagnosticSnippet } from './upstream-rejection.js';
+import { classifyUpstreamRejection, diagnosticSnippet, POOL_PARKED } from './upstream-rejection.js';
 import { ProviderCooldowns, canAttempt, allProvidersCooled, cooldownRetryAfterMs, parseRetryAfterMs, ALL_PROVIDERS_RATE_LIMITED, } from './provider-cooldown.js';
 const ANTHROPIC_API = 'https://api.anthropic.com';
 const DEFAULT_PORT = 3456;
@@ -1655,6 +1655,9 @@ export async function startProxy(opts = {}) {
         overlayTemplateHeaderValues(staticHeaders, CC_TEMPLATE.header_values);
     }
     let requestCount = 0;
+    // dario#1244: the "pool parked" line is logged on the transition into the
+    // state, not on every request that arrives while it holds.
+    let poolParkedAnnounced = false;
     const queue = new RequestQueue({
         maxConcurrent: opts.maxConcurrent ?? DEFAULT_MAX_CONCURRENT,
         maxQueued: opts.maxQueued ?? DEFAULT_MAX_QUEUED,
@@ -2150,6 +2153,7 @@ export async function startProxy(opts = {}) {
                             ...rateLimitWindow(a.rateLimit, snapNow),
                             claim: a.rateLimit.claim,
                             status: reportedAccountStatus(a, snapNow),
+                            action: accountAction(a, snapNow),
                             requestCount: a.requestCount,
                             rejectedCount: a.rejectedCount,
                             lastRejectedAt: a.lastRejectedAt ?? null,
@@ -2258,6 +2262,8 @@ export async function startProxy(opts = {}) {
                     ...rateLimitWindow(a.rateLimit, now),
                     claim: a.rateLimit.claim,
                     status: reportedAccountStatus(a, now),
+                    // The one-word next step: none · wait · regrant (dario#1244).
+                    action: accountAction(a, now),
                     requestCount: a.requestCount,
                     // 429s answered — the attempts requestCount does not count, so a
                     // parked seat no longer reads as one that was never called.
@@ -2625,6 +2631,31 @@ export async function startProxy(opts = {}) {
             //
             // Shared because two callers must agree: the selector, and the dispatch
             // below for a request the selector DEFERRED but no provider could serve.
+            /**
+             * Every seat in the pool is parked inside a live window (dario#1244).
+             * The old fallback re-probed the earliest-reset seat on every request:
+             * one upstream round trip per request that could only 429,
+             * `rejectedCount` climbing by one each time — 500 on one seat inside a
+             * single window on the reporter's gateway — and the client waiting on a
+             * verdict dario already held. Answer it here: 429, `retry-after` at the
+             * earliest reset, the marker in the same channel the other rejection
+             * classes use, and nothing sent upstream.
+             */
+            const writePoolParked = (untilMs) => {
+                const retryAfterSec = Math.max(1, Math.ceil((untilMs - Date.now()) / 1000));
+                res.writeHead(429, {
+                    ...JSON_HEADERS,
+                    'retry-after': String(retryAfterSec),
+                    'x-dario-upstream-rejection': POOL_PARKED,
+                });
+                res.end(JSON.stringify({
+                    error: {
+                        type: 'rate_limit_error',
+                        message: `All ${pool.size} pool seat${pool.size === 1 ? '' : 's'} are over their rate-limit windows; the earliest resets in ${retryAfterSec}s. Nothing was sent upstream.`,
+                    },
+                    reason: POOL_PARKED,
+                }));
+            };
             const writePoolUnavailable = () => {
                 res.writeHead(503, JSON_HEADERS);
                 res.end(JSON.stringify(pool.size === 0
@@ -2738,6 +2769,20 @@ export async function startProxy(opts = {}) {
                     return true;
                 }
                 poolAccount = pool.select();
+                if (poolAccount)
+                    poolParkedAnnounced = false;
+                // Every seat parked inside a live window (dario#1244): cool the
+                // provider to the earliest reset so a fallback chain sees the Claude
+                // half as what it is, say so once, and — unless a fallback is armed —
+                // answer the client here instead of spending a probe that can only 429.
+                const parkedUntil = poolAccount ? null : pool.parkedUntil();
+                if (parkedUntil !== null) {
+                    providerCooldowns.note('claude', parkedUntil - Date.now());
+                    if (!poolParkedAnnounced) {
+                        poolParkedAnnounced = true;
+                        console.error(`[dario] #${requestCount} pool parked: all ${pool.size} seats are over their rate-limit windows, earliest resets in ${Math.max(1, Math.ceil((parkedUntil - Date.now()) / 60000))}m — answering 429 locally until then, nothing sent upstream`);
+                    }
+                }
                 if (!poolAccount) {
                     // Pool-exhausted fallback: when armed, the pool HAS accounts (all
                     // drained / cooling), and the client speaks OpenAI shape, defer —
@@ -2763,7 +2808,10 @@ export async function startProxy(opts = {}) {
                     // see, not traffic to quietly re-bill somewhere else.
                     const fallbackViable = poolFallbackModels.length > 0 && pool.size > 0;
                     if (!fallbackViable) {
-                        writePoolUnavailable();
+                        if (parkedUntil !== null)
+                            writePoolParked(parkedUntil);
+                        else
+                            writePoolUnavailable();
                         return false;
                     }
                 }
@@ -3295,6 +3343,13 @@ export async function startProxy(opts = {}) {
             // would fall through to the Claude path with no account and an empty
             // bearer token, turning a clean 503 into a confusing upstream 401.
             if (!upstreamApiKey && !poolAccount) {
+                // A fallback was armed but nothing could serve, and the pool itself is
+                // parked: the exact reset beats a cool-down estimate (dario#1244).
+                const parkedNow = pool.parkedUntil();
+                if (parkedNow !== null) {
+                    writePoolParked(parkedNow);
+                    return;
+                }
                 // A chain where every entry is cooling is a rate limit, not a
                 // misconfiguration — say so in the machine-readable way, once.
                 if (allProvidersCooled(poolFallbackModels.length > 0 ? ['codex', 'claude'] : ['claude'], providerCooldowns)) {

package/dist/upstream-rejection.d.ts

@@ -11,6 +11,12 @@ export interface UpstreamRejection {
  * every "this request was not served" verdict.
  */
 export declare const MODEL_UNROUTABLE = "model_unroutable";
+/**
+ * Every seat in the pool is parked inside a live rate-limit window, so dario
+ * answered 429 itself, with `retry-after` at the earliest reset, and sent
+ * nothing upstream (dario#1244).
+ */
+export declare const POOL_PARKED = "pool_parked";
 /** Classify subscription entitlement failures separately from temporary quota exhaustion. */
 export declare function classifyUpstreamRejection(status: number, body: string): UpstreamRejection;
 /** Operator action paired with the failure class. Never suggest credential churn for billing. */

package/dist/upstream-rejection.js

@@ -6,6 +6,12 @@
  * every "this request was not served" verdict.
  */
 export const MODEL_UNROUTABLE = 'model_unroutable';
+/**
+ * Every seat in the pool is parked inside a live rate-limit window, so dario
+ * answered 429 itself, with `retry-after` at the earliest reset, and sent
+ * nothing upstream (dario#1244).
+ */
+export const POOL_PARKED = 'pool_parked';
 /** Classify subscription entitlement failures separately from temporary quota exhaustion. */
 export function classifyUpstreamRejection(status, body) {
     const normalized = body.toLowerCase();

package/docs/drift-monitor.md

@@ -113,7 +113,8 @@ is a proof that the tools / system_prompt / beta headers / field orders are
 byte-identical at the live version, so only the version string moves — the
 same deterministic-bump risk class `cc-drift-watch.yml` already auto-merges for
 `SUPPORTED_CC_RANGE.maxTested`. Auto-merge still gates on the required checks
-(build ×3, compat, test, docker-cap-drop-smoke); a red check leaves the PR open
+(build ×3, live-test, CodeQL, actionlint, validate-package-json); compat runs
+alongside but is not required. A red required check leaves the PR open
 with the bot branch preserved. A shape rebake (exit 2) changes the wire-shape
 contract, so a human reviews compat-test + the diff before merging.
 

package/docs/multi-account-pool.md

@@ -93,7 +93,7 @@ curl http://localhost:3456/analytics    # per-account / per-model stats, burn ra
 
 ## Reading a seat's `status`
 
-`GET /accounts` (and the admin API's `GET /admin/accounts`, in snake_case) report one `status` per seat. It is the routing verdict, and every value comes with the fields that explain it.
+`GET /accounts` (and the admin API's `GET /admin/accounts`, in snake_case) report one `status` per seat. It is the routing verdict, and every value comes with the fields that explain it. Next to it, `action` is the last column of this table in one word: `none`, `wait` (the seat comes back on its own; `resetInMs` says when) or `regrant` (an auth-failure streak, which is a dead refresh token).
 
 | `status` | What it means | What to do |
 |---|---|---|
@@ -102,6 +102,8 @@ curl http://localhost:3456/analytics    # per-account / per-model stats, burn ra
 | `unknown` | No current observation: a seat that has served nothing yet, or a rejection whose window has rolled (`resetInMs: 0`) and that nothing has measured since. | Nothing; the next request measures it. |
 | `auth-cooldown` | Upstream answered 401/403 or `invalid_grant`. `consecutiveAuthFailures` tells a blip (1) from a dead refresh token (a streak); the cool-down doubles with the streak, from 1 minute to 30. | A streak means re-grant the seat — `dario accounts remove` + `add`, or the admin login flow under the same alias. A new grant starts the seat fresh: no carried-over cool-down, rejection or identity. See [Refresh-token grant age](#refresh-token-grant-age) for the 28-day wall behind most streaks. |
 
+**When every seat is parked.** A pool whose seats are all `rejected` inside live windows does not probe them again: dario answers the request itself with `429`, `retry-after` set to the earliest reset, `x-dario-upstream-rejection: pool_parked`, and nothing sent upstream. One log line marks the transition (`pool parked: all 6 seats are over their rate-limit windows, earliest resets in 21m`). Before 6.0.35 every such request re-probed the earliest-reset seat, so `rejectedCount` on that seat grew by one per request — a seat reading `rejected_count: 500` next to `request_count: 1` was that, not a seat that needed a re-login. With a `--pool-fallback` armed, the request goes to the fallback instead, as before.
+
 The proxy logs every parking as it happens, once per window: `rate limited (429) on account "spare": 5h 104%, 7d 25%, claim five_hour, resets in 37m — parked until the window rolls`. The re-probes the all-exhausted fallback makes of an already-parked seat are logged only under `-v`.
 
 `dario accounts list --live` prints the same view from the running proxy — status with its countdown, the reading and its age, requests served and 429s answered, the organization, shared windows, grant age — where the plain `dario accounts list` only knows what is on disk.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.0.34",
+  "version": "6.0.36",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {