@askalf/dario 6.0.38 → 6.0.40

package/dist/doctor-core.js

@@ -11,6 +11,7 @@
  * system surfaces as `fail` instead of crashing the CLI.
  */
 import { grantAge, grantThresholds, worstGrantLevel, describeGrantAge } from './refresh-grant.js';
+import { maskEmail } from './pool.js';
 import { readFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -221,7 +222,89 @@ export function checkOrganizations(input) {
     return [{
             status: 'info',
             label: 'Organizations',
-            detail: `${head} — ${pairs}. Seats on one organization may be one subscription counted twice: \`sharesWindowWith\` on GET /accounts says so when they report the same window`,
+            detail: `${head} — ${pairs}. Seats on one organization are not one subscription: the Accounts row says which seats are the same account, from each token's OAuth profile.`,
+        }];
+}
+/**
+ * The Accounts doctor row (dario#1244, #1263): how many distinct Anthropic
+ * accounts the pool's seats are, from the OAuth account uuid each record
+ * carries — the fact, not an inference from reset seconds. Two seats with one
+ * uuid ARE one subscription under two aliases; a seat without one is not yet
+ * identified (its next token refresh fills it in) and is never guessed at.
+ */
+export function checkAccountIdentity(input) {
+    if (input.accounts.length < 2)
+        return [];
+    const byId = new Map();
+    let unidentified = 0;
+    for (const a of input.accounts) {
+        if (!a.accountId) {
+            unidentified++;
+            continue;
+        }
+        const g = byId.get(a.accountId);
+        if (g) {
+            g.aliases.push(a.alias);
+            if (!g.email && a.accountEmail)
+                g.email = a.accountEmail;
+        }
+        else
+            byId.set(a.accountId, { aliases: [a.alias], email: a.accountEmail });
+    }
+    const distinct = byId.size + unidentified;
+    const head = `${input.accounts.length} seats, ${distinct} distinct account${distinct === 1 ? '' : 's'}`
+        + (unidentified > 0 ? ` (${unidentified} not yet identified — filled in by the next token refresh)` : '');
+    const dups = [...byId.values()].filter((g) => g.aliases.length > 1);
+    if (dups.length === 0) {
+        return [{ status: 'ok', label: 'Accounts', detail: `${head} — no alias is a duplicate of another` }];
+    }
+    const named = dups.map((g) => `${g.aliases.join(' + ')} are the same account${g.email ? ` (${maskEmail(g.email)})` : ''}`).join('; ');
+    return [{
+            status: 'info',
+            label: 'Accounts',
+            detail: `${head} — ${named}. Duplicates share one window and one set of limits; the pool counts them once.`,
+        }];
+}
+/**
+ * The Client identity doctor row (dario#1244, 2026-09-08). Every `accounts add`
+ * used to copy the machine's Claude Code identity into the new alias, so a
+ * pool of colleagues' tokens on one machine presented ONE `device_id` /
+ * `account_uuid` in `metadata.user_id` across every OAuth account it held.
+ * Anthropic ties what it sees to that identity (see checkIdentityDrift).
+ * Seats that are genuinely the same account may share it; seats that are
+ * different accounts, or not yet identified, must not.
+ */
+export function checkSharedClientIdentity(input) {
+    if (input.accounts.length < 2)
+        return [];
+    const byIdentity = new Map();
+    for (const a of input.accounts) {
+        if (!a.deviceId && !a.accountUuid)
+            continue;
+        const k = `${a.deviceId}|${a.accountUuid}`;
+        const list = byIdentity.get(k);
+        if (list)
+            list.push(a);
+        else
+            byIdentity.set(k, [a]);
+    }
+    const offending = [...byIdentity.entries()].filter(([, seats]) => {
+        if (seats.length < 2)
+            return false;
+        const ids = new Set(seats.map((s) => s.accountId));
+        return ids.size > 1 || ids.has(undefined);
+    });
+    if (offending.length === 0) {
+        return [{ status: 'ok', label: 'Client identity', detail: 'every seat presents its own client identity (or shares one only with the same account)' }];
+    }
+    const parts = offending.map(([k, seats]) => {
+        const accounts = new Set(seats.map((s) => s.accountId ?? `?${s.alias}`)).size;
+        return `${seats.length} seats present ONE client identity (device ${(k.split('|')[0] || '(empty)').slice(0, 8)}…) across ${accounts} account${accounts === 1 ? '' : 's'}: ${seats.map((s) => s.alias).join(', ')}`;
+    });
+    return [{
+            status: 'warn',
+            label: 'Client identity',
+            detail: `${parts.join('; ')}. Every alias added on a machine with Claude Code installed copied its identity, and Anthropic ties usage and limits to the identity it sees. Give each seat its own: \`dario accounts identity --fresh <alias>\` (or \`--all\`); the running proxy presents the new one on the seat's next request.`,
         }];
 }
 const REGRANT_FIX = " — re-grant with `dario accounts add <alias>` (or `dario login --force-reauth` for the login seat); the new grant restarts the clock";
@@ -811,8 +894,8 @@ export async function runChecks(opts = {}) {
                     : '';
                 checks.push({
                     status: util >= 0.90 ? 'warn' : 'ok',
-                    label: `Usage 7d (${family} only)`,
-                    detail: `${pct(util)} used${marker}`,
+                    label: family === 'oi' ? 'Included overage credit (7d, oi)' : `Usage 7d (${family} only)`,
+                    detail: `${pct(util)} used${marker}${family === 'oi' ? " — the plan's included-overage credit; binds Fable's weekly allowance (#1262)" : ''}`,
                 });
             }
             if (firstOk.overageUtil > 0) {
@@ -969,6 +1052,7 @@ export async function runChecks(opts = {}) {
             });
             checks.push(...checkRefreshGrant({ accounts: loaded.map((a) => ({ alias: a.alias, grantedAt: a.grantedAt })), now }));
             checks.push(...checkOrganizations({ accounts: loaded.map((a) => ({ alias: a.alias, organizationId: a.organizationId })) }));
+            checks.push(...checkAccountIdentity({ accounts: loaded.map((a) => ({ alias: a.alias, accountId: a.accountId, accountEmail: a.accountEmail })) }));
             // Next-account-in-rotation surfacing. The proxy's per-request
             // selector picks by max headroom (with 7d_<family> per-model
             // bucket considered when a request's model family is known);
@@ -1047,6 +1131,10 @@ export async function runChecks(opts = {}) {
         });
         for (const c of driftChecks)
             checks.push(c);
+        for (const c of checkSharedClientIdentity({
+            accounts: loaded.map((a) => ({ alias: a.alias, deviceId: a.deviceId, accountUuid: a.accountUuid, accountId: a.accountId, identityFrom: a.identityFrom })),
+        }))
+            checks.push(c);
     }
     catch (err) {
         checks.push({ status: 'warn', label: 'Identity', detail: `check failed: ${err.message}` });

package/dist/live-fingerprint.d.ts

@@ -496,7 +496,7 @@ export declare function detectDrift(t: TemplateData, installedOverride?: string
  */
 export declare const SUPPORTED_CC_RANGE: {
     readonly min: "1.0.0";
-    readonly maxTested: "2.1.263";
+    readonly maxTested: "2.1.265";
 };
 /**
  * Compare two dotted-numeric version strings. Returns negative if `a<b`,

package/dist/live-fingerprint.js

@@ -1194,7 +1194,7 @@ export function detectDrift(t, installedOverride) {
  */
 export const SUPPORTED_CC_RANGE = {
     min: '1.0.0',
-    maxTested: '2.1.263',
+    maxTested: '2.1.265',
 };
 /**
  * Compare two dotted-numeric version strings. Returns negative if `a<b`,

package/dist/pool.d.ts

@@ -38,6 +38,34 @@ export interface RateLimitSnapshot {
     reset: number;
     fallbackPct: number;
     updatedAt: number;
+    /**
+     * `retry-after` on the response, in ms, or null/undefined when absent. Read
+     * for a 429 that names no exhausted window (see `exhausted`): it is the only
+     * duration the upstream actually stated for that case.
+     */
+    retryAfterMs?: number | null;
+    /**
+     * Set by `markRejected`. True when the 429 itself showed a window was over —
+     * a utilization at or past the 1.0 threshold on some window or bucket — so the
+     * seat is parked until `reset`. False when the 429 said no such thing
+     * (dario#1244 follow-up, 2026-09-08): a seat on the fleet box was parked for
+     * 546 HOURS on a 429 reading `5h 0%, 7d 0%, claim unknown`, because the
+     * status code alone used to decide and the stated reset was honoured
+     * blindly. Such a rejection cools for `retryAfterMs` (or a minute) and stays
+     * probeable. Undefined on snapshots that predate the field, which behave as
+     * before (exhausted).
+     */
+    exhausted?: boolean;
+    /** Epoch ms a non-exhausted rejection stops being ineligible. */
+    cooldownUntil?: number;
+    /**
+     * Which per-model buckets the upstream has shown to bind which model
+     * family on THIS account, learned from responses: `{ fable: ['oi'] }`. Merged
+     * across readings by the pool, so a binding learned on one response holds
+     * for the seat's later headroom decisions. See `WIRE_BUCKET_BINDINGS` for the
+     * static seed and the evidence.
+     */
+    boundBuckets?: Record<string, string[]>;
 }
 export declare const EMPTY_SNAPSHOT: RateLimitSnapshot;
 /** Freshness of an account's utilisation reading — see `utilFreshness`. */
@@ -94,25 +122,35 @@ export declare function rateLimitWindow(rl: RateLimitSnapshot, now: number): Rat
  */
 export declare function describeRateLimitSnapshot(rl: RateLimitSnapshot, now?: number): string;
 /**
- * The identity of the rate-limit window a reading was measured against:
- * its representative claim plus its reset second, or null when the reading
- * states no live window (no reset, a reset that has passed, or no claim).
+ * The log line for a 429 as `markRejected` classified it: an exhausted window
+ * parks the seat until its reset; anything else cools briefly and says which
+ * stated reset was NOT honoured, so the operator can see the reading dario
+ * declined to act on.
+ */
+/** `th***@example.com` — enough to recognise an account by eye, never the whole address on a listing or a log. */
+export declare function maskEmail(email: string | null | undefined): string | null;
+export declare function describeRejection(rl: RateLimitSnapshot, now?: number): string;
+/**
+ * For every seat, the other aliases that are the SAME Anthropic account —
+ * one subscription under several aliases (dario#1244).
  *
- * Two seats that report the same key are one subscription under two aliases
- * (dario#1244, "a few have the same issue"): two independent windows all but
- * never share a reset second, and two readings of one window always do. The
- * organization id is deliberately NOT part of the key — several seats can
- * share an organization and still have their own windows — the window itself
- * is the fact that matters for headroom.
+ * Identity, not inference. The first version of this keyed seats on
+ * `claim@reset` — "two independent windows all but never share a reset
+ * second". They do: Anthropic aligns the five-hour reset to a 20-minute grid
+ * (dario#1263 — two demonstrably different accounts, both resetting at
+ * exactly :40:00), so a five-hour window has 15 possible reset seconds and a
+ * pool of 18 seats is GUARANTEED collisions. That heuristic told an operator
+ * seven independent colleagues were one subscription. `accountId` is the
+ * account uuid the OAuth grant belongs to (accounts.ts, `fetchOAuthProfile`);
+ * two seats with the same one are the same account, full stop, and two
+ * seats without one are simply not yet identified — never guessed.
  */
-export declare function windowKey(rl: RateLimitSnapshot, now: number): string | null;
-/** For every seat, the other aliases whose last reading names the same live window. */
-export declare function windowPeers(accounts: readonly PoolAccount[], now: number): Map<string, string[]>;
+export declare function accountPeers(accounts: readonly PoolAccount[]): Map<string, string[]>;
 /**
- * How many windows the pool really has: each measured live window once, and
- * each seat without a live reading as its own (nothing says otherwise yet).
+ * How many accounts the pool really has: each identified account once, and
+ * each seat not yet identified as its own (nothing says otherwise).
  */
-export declare function distinctWindows(accounts: readonly PoolAccount[], now: number): number;
+export declare function distinctAccounts(accounts: readonly PoolAccount[]): number;
 export interface PoolAccount {
     alias: string;
     accessToken: string;
@@ -131,6 +169,19 @@ export interface PoolAccount {
     rejectedCount: number;
     /** Epoch ms of the most recent 429 on this account; undefined if never. */
     lastRejectedAt?: number;
+    /**
+     * The Anthropic account uuid behind this seat's token, from the OAuth
+     * profile at grant time (accounts.ts). The one fact that says whether two
+     * aliases are one subscription (dario#1244, #1263). Undefined until the
+     * seat's record carries it — a record from before this field is filled in
+     * by its next token refresh.
+     */
+    accountId?: string;
+    /** Email on that account, for the operator's eye; masked on every listing. */
+    accountEmail?: string;
+    /** `organization.rate_limit_tier` / `seat_tier` from the same profile, when stated. */
+    rateLimitTier?: string;
+    seatTier?: string;
     /**
      * The Anthropic organization behind this seat's token, from the
      * `anthropic-organization-id` response header: learned on the first
@@ -238,6 +289,32 @@ export declare function isAccountEligible(account: PoolAccount, now?: number): b
  * back, so it stays probeable (dario#1244).
  */
 export declare function isParkedInLiveWindow(account: PoolAccount, now?: number): boolean;
+/**
+ * A seat rejected by a 429 that named no exhausted window, still inside the
+ * cool-down that rejection earned (see `RateLimitSnapshot.exhausted`). It is
+ * deliberately NOT "parked in a live window" — the reset it stated was never
+ * this seat's window — but it is equally not askable yet: the upstream said
+ * retry after N, and asking sooner is the retry storm the cool-down exists to
+ * prevent (dario#1264 review).
+ */
+export declare function isCoolingAfterRejection(account: PoolAccount, now?: number): boolean;
+/**
+ * Whether the router may send this seat a request RIGHT NOW, for reasons that
+ * expire on their own: an auth cool-down, a live rate-limit window, or the
+ * cool-down a non-window 429 earned.
+ *
+ * ONE predicate, filtered on by both fallback paths (the all-exhausted branch
+ * in `select()` and the mid-flight `selectExcluding()`). They carried the
+ * condition inline and independently, so `isCoolingAfterRejection` was added to
+ * neither — a seat that had just answered `retry-after: 17` could be retried
+ * inside the same client request. Caught in review on #1264; the shape of the
+ * bug is why this is a named predicate rather than two copies of a filter.
+ *
+ * Note this is NOT `isAccountEligible`: eligibility also refuses an expired
+ * token, which no amount of waiting fixes and which these paths handle
+ * separately.
+ */
+export declare function isProbeable(account: PoolAccount, now?: number): boolean;
 /**
  * The operator's next step for one seat, next to `status` on both listings
  * (dario#1244 — "do I have to re-login?" should not need the docs table).
@@ -280,8 +357,50 @@ export type PoolStrategy = 'headroom' | 'fill-first';
  * in this codebase (see resolveSessionRotationConfig).
  */
 export declare function resolvePoolStrategy(explicit?: string | null, env?: NodeJS.ProcessEnv): PoolStrategy;
+/**
+ * Which wire buckets bind which model family, when the wire does not say it
+ * by name. `7d_sonnet` names its family; `7d_oi` does not — it is the plan's
+ * INCLUDED-OVERAGE credit, and it is what Fable's weekly allowance is metered
+ * on (dario#1262):
+ *
+ *   - 2026-07-05, live Max account: Fable drew `representative-claim:
+ *     seven_day_overage_included` at 7d 82% with `7d_oi` at 99%, served at $0;
+ *     at `7d_oi` ≥ 1.0 Fable answered a hard 429 (`7d_oi-status: rejected`,
+ *     `7d_oi-surpassed-threshold: 1.0`) while Opus kept serving.
+ *   - 2026-09-08 (#1262): a Fable response at `7d 0.63, 7d_oi 0.98` — headroom
+ *     read 0.37 against a seat two points from refusal.
+ *
+ * So for Fable, `oi` IS the binding weekly bucket, under a name that is not
+ * "fable". This seed makes that true from the first response. Bindings for
+ * other families are LEARNED per account from the wire (see
+ * `parseRateLimits`): a response whose claim is `*_overage_included`, or a 429
+ * whose `7d_<bucket>-status` is `rejected`, proves that bucket binds the family
+ * that request was for. Nothing here maps a family to `oi` by assumption:
+ * a seat drawing on included overage for Opus is bound by `oi` for Opus
+ * exactly when its responses say so.
+ */
+export declare const WIRE_BUCKET_BINDINGS: Readonly<Record<string, readonly string[]>>;
+/** Parse `retry-after`: delta-seconds or an HTTP date; null when absent or unreadable. */
+export declare function parseRetryAfterMs(value: string | null, now?: number): number | null;
+/** Union of two readings' learned bindings, per family, order-preserving. */
+export declare function mergeBoundBuckets(prev: Record<string, string[]> | undefined, next: Record<string, string[]> | undefined): Record<string, string[]> | undefined;
+/** `next` with everything the account had already learned carried forward. */
+export declare function withBoundBuckets(prev: RateLimitSnapshot, next: RateLimitSnapshot): RateLimitSnapshot;
 /** Parse an Anthropic response's rate-limit headers into a snapshot. */
-export declare function parseRateLimits(headers: Headers): RateLimitSnapshot;
+export declare function parseRateLimits(headers: Headers, family?: string | null): RateLimitSnapshot;
+/**
+ * Does this 429 say a rate-limit WINDOW is over? True only when the reading
+ * itself shows one: a utilization at or past the 1.0 threshold on any window
+ * or bucket (the unified headers are a ratio against
+ * `surpassed-threshold: 1.0`, so `1.02` is 102%; every live rejection observed
+ * has read 1.00–1.06). A 429 with a claim but 30% used, or with no claim and
+ * 0% used, is a refusal of some other kind — concurrency, an account-level
+ * lock, a monthly credit — and its stated `reset` is not the moment this
+ * seat's window rolls. 0.99 rather than 1 absorbs float formatting.
+ */
+export declare function isWindowRejection(rl: RateLimitSnapshot): boolean;
+/** Cool-down for a 429 that named no exhausted window, when it stated no `retry-after`. */
+export declare const NON_WINDOW_REJECTION_COOLDOWN_MS = 60000;
 /**
  * Extract the model family (`opus` / `sonnet` / `haiku` / `fable`) from a
  * request's model id. Used to look up the per-model 7d bucket in
@@ -307,8 +426,14 @@ export declare function modelFamily(modelId: string | null | undefined): string
  * isn't represented in the snapshot (e.g. account hasn't seen a Sonnet
  * request yet so `7d_sonnet` is unknown), headroom is computed from the
  * unified buckets only — best-effort, populated on the next response.
+ *
+ * A bucket counts for a family when it names the family (`7d_sonnet`), when
+ * `WIRE_BUCKET_BINDINGS` says it binds the family (`7d_oi` → fable, dario#1262),
+ * or when this account's responses have shown it does (`boundBuckets`).
  */
 export declare function computeHeadroom(snapshot: RateLimitSnapshot, family?: string | null): number;
+/** Every bucket name that binds `family` for this reading — by name, by seed, or as learned. */
+export declare function bucketsBindingFamily(snapshot: RateLimitSnapshot, family: string): string[];
 export declare class AccountPool {
     private readonly strategy;
     private accounts;
@@ -327,6 +452,10 @@ export declare class AccountPool {
         accountUuid: string;
         grantedAt?: number;
         organizationId?: string;
+        accountId?: string;
+        accountEmail?: string;
+        rateLimitTier?: string;
+        seatTier?: string;
     }): void;
     remove(alias: string): boolean;
     get size(): number;
@@ -367,7 +496,7 @@ export declare class AccountPool {
      * review on dario#1254 that caught the mixed case).
      */
     parkedUntil(now?: number): number | null;
-    /** Seats currently parked inside a live window (dario#1244). */
+    /** Seats a rate limit is currently keeping out of rotation (dario#1244, #1264). */
     parkedCount(now?: number): number;
     /**
      * Select with session stickiness. If `stickyKey` is already bound to a