@askalf/dario 6.0.38 → 6.0.40

package/dist/pool.js

@@ -88,6 +88,27 @@ export function describeRateLimitSnapshot(rl, now = Date.now()) {
             : `resets in ${formatDurationMs(resetInMs)}`;
     return `5h ${pct(rl.util5h)}, 7d ${pct(rl.util7d)}, claim ${rl.claim}, ${reset}`;
 }
+/**
+ * The log line for a 429 as `markRejected` classified it: an exhausted window
+ * parks the seat until its reset; anything else cools briefly and says which
+ * stated reset was NOT honoured, so the operator can see the reading dario
+ * declined to act on.
+ */
+/** `th***@example.com` — enough to recognise an account by eye, never the whole address on a listing or a log. */
+export function maskEmail(email) {
+    if (typeof email !== 'string' || !email.includes('@'))
+        return null;
+    const [user, domain] = email.split('@', 2);
+    return `${(user ?? '').slice(0, 2)}***@${domain ?? ''}`;
+}
+export function describeRejection(rl, now = Date.now()) {
+    if (rl.exhausted !== false)
+        return `${describeRateLimitSnapshot(rl, now)} — parked until the window rolls`;
+    const { resetInMs } = rateLimitWindow(rl, now);
+    const stated = resetInMs === null ? 'no reset stated' : `stated reset in ${formatDurationMs(resetInMs)} not honoured`;
+    const cool = Math.max(0, (rl.cooldownUntil ?? now) - now);
+    return `429 without an exhausted window (5h ${Math.round(rl.util5h * 100)}%, 7d ${Math.round(rl.util7d * 100)}%, claim ${rl.claim}; ${stated}) — cooling ${formatDurationMs(cool)}, seat stays probeable`;
+}
 function formatDurationMs(ms) {
     const totalMins = Math.max(1, Math.round(ms / 60_000));
     const h = Math.floor(totalMins / 60);
@@ -95,59 +116,51 @@ function formatDurationMs(ms) {
     return h > 0 ? `${h}h ${m}m` : `${m}m`;
 }
 /**
- * The identity of the rate-limit window a reading was measured against:
- * its representative claim plus its reset second, or null when the reading
- * states no live window (no reset, a reset that has passed, or no claim).
+ * For every seat, the other aliases that are the SAME Anthropic account —
+ * one subscription under several aliases (dario#1244).
  *
- * Two seats that report the same key are one subscription under two aliases
- * (dario#1244, "a few have the same issue"): two independent windows all but
- * never share a reset second, and two readings of one window always do. The
- * organization id is deliberately NOT part of the key — several seats can
- * share an organization and still have their own windows — the window itself
- * is the fact that matters for headroom.
+ * Identity, not inference. The first version of this keyed seats on
+ * `claim@reset` — "two independent windows all but never share a reset
+ * second". They do: Anthropic aligns the five-hour reset to a 20-minute grid
+ * (dario#1263 — two demonstrably different accounts, both resetting at
+ * exactly :40:00), so a five-hour window has 15 possible reset seconds and a
+ * pool of 18 seats is GUARANTEED collisions. That heuristic told an operator
+ * seven independent colleagues were one subscription. `accountId` is the
+ * account uuid the OAuth grant belongs to (accounts.ts, `fetchOAuthProfile`);
+ * two seats with the same one are the same account, full stop, and two
+ * seats without one are simply not yet identified — never guessed.
  */
-export function windowKey(rl, now) {
-    if (!(rl.reset > 0) || rl.reset * 1000 <= now)
-        return null;
-    if (!rl.claim || rl.claim === 'unknown')
-        return null;
-    return `${rl.claim}@${rl.reset}`;
-}
-/** For every seat, the other aliases whose last reading names the same live window. */
-export function windowPeers(accounts, now) {
-    const byKey = new Map();
+export function accountPeers(accounts) {
+    const byId = new Map();
     for (const a of accounts) {
-        const k = windowKey(a.rateLimit, now);
-        if (!k)
+        if (!a.accountId)
             continue;
-        const list = byKey.get(k);
+        const list = byId.get(a.accountId);
         if (list)
             list.push(a.alias);
         else
-            byKey.set(k, [a.alias]);
+            byId.set(a.accountId, [a.alias]);
     }
     const out = new Map();
     for (const a of accounts) {
-        const k = windowKey(a.rateLimit, now);
-        out.set(a.alias, k ? (byKey.get(k) ?? []).filter((alias) => alias !== a.alias) : []);
+        out.set(a.alias, a.accountId ? (byId.get(a.accountId) ?? []).filter((alias) => alias !== a.alias) : []);
     }
     return out;
 }
 /**
- * How many windows the pool really has: each measured live window once, and
- * each seat without a live reading as its own (nothing says otherwise yet).
+ * How many accounts the pool really has: each identified account once, and
+ * each seat not yet identified as its own (nothing says otherwise).
  */
-export function distinctWindows(accounts, now) {
-    const keys = new Set();
-    let unmeasured = 0;
+export function distinctAccounts(accounts) {
+    const ids = new Set();
+    let unidentified = 0;
     for (const a of accounts) {
-        const k = windowKey(a.rateLimit, now);
-        if (k)
-            keys.add(k);
+        if (a.accountId)
+            ids.add(a.accountId);
         else
-            unmeasured++;
+            unidentified++;
     }
-    return keys.size + unmeasured;
+    return ids.size + unidentified;
 }
 /**
  * Cool-down schedule after auth failures. First failure: 60s. Each
@@ -212,6 +225,10 @@ export const TOKEN_EXPIRY_MARGIN_MS = 30_000;
  * would push a genuinely throttled account back into rotation.
  */
 export function rateLimitWindowPassed(rl, now = Date.now()) {
+    // A rejection that named no exhausted window is over when its cool-down is:
+    // the stated reset was never this seat's window (see RateLimitSnapshot.exhausted).
+    if (rl.exhausted === false)
+        return !(rl.cooldownUntil !== undefined && now < rl.cooldownUntil);
     return rl.reset > 0 && rl.reset * 1000 <= now;
 }
 /**
@@ -259,7 +276,44 @@ export function isAccountEligible(account, now = Date.now()) {
  */
 export function isParkedInLiveWindow(account, now = Date.now()) {
     const rl = account.rateLimit;
-    return rl.status === 'rejected' && rl.reset > 0 && rl.reset * 1000 > now;
+    // A non-exhausted rejection is never "parked in a live window": its reset
+    // was not this seat's window, and once its cool-down passes asking is the
+    // way back (the all-exhausted branch may probe it even sooner).
+    return rl.status === 'rejected' && rl.exhausted !== false && rl.reset > 0 && rl.reset * 1000 > now;
+}
+/**
+ * A seat rejected by a 429 that named no exhausted window, still inside the
+ * cool-down that rejection earned (see `RateLimitSnapshot.exhausted`). It is
+ * deliberately NOT "parked in a live window" — the reset it stated was never
+ * this seat's window — but it is equally not askable yet: the upstream said
+ * retry after N, and asking sooner is the retry storm the cool-down exists to
+ * prevent (dario#1264 review).
+ */
+export function isCoolingAfterRejection(account, now = Date.now()) {
+    const rl = account.rateLimit;
+    return rl.status === 'rejected' && rl.exhausted === false
+        && rl.cooldownUntil !== undefined && now < rl.cooldownUntil;
+}
+/**
+ * Whether the router may send this seat a request RIGHT NOW, for reasons that
+ * expire on their own: an auth cool-down, a live rate-limit window, or the
+ * cool-down a non-window 429 earned.
+ *
+ * ONE predicate, filtered on by both fallback paths (the all-exhausted branch
+ * in `select()` and the mid-flight `selectExcluding()`). They carried the
+ * condition inline and independently, so `isCoolingAfterRejection` was added to
+ * neither — a seat that had just answered `retry-after: 17` could be retried
+ * inside the same client request. Caught in review on #1264; the shape of the
+ * bug is why this is a named predicate rather than two copies of a filter.
+ *
+ * Note this is NOT `isAccountEligible`: eligibility also refuses an expired
+ * token, which no amount of waiting fixes and which these paths handle
+ * separately.
+ */
+export function isProbeable(account, now = Date.now()) {
+    return !isInAuthCooldown(account, now)
+        && !isParkedInLiveWindow(account, now)
+        && !isCoolingAfterRejection(account, now);
 }
 /**
  * The operator's next step for one seat, next to `status` on both listings
@@ -299,10 +353,70 @@ export function resolvePoolStrategy(explicit, env = process.env) {
  * normalized to lowercase to match `modelFamily()` output.
  */
 const PER_MODEL_7D_HEADER = /^anthropic-ratelimit-unified-7d_([a-z0-9-]+)-utilization$/i;
+/** `…-7d_<bucket>-status`: `rejected` names the bucket that refused this request. */
+const PER_MODEL_7D_STATUS_HEADER = /^anthropic-ratelimit-unified-7d_([a-z0-9-]+)-status$/i;
+/**
+ * Which wire buckets bind which model family, when the wire does not say it
+ * by name. `7d_sonnet` names its family; `7d_oi` does not — it is the plan's
+ * INCLUDED-OVERAGE credit, and it is what Fable's weekly allowance is metered
+ * on (dario#1262):
+ *
+ *   - 2026-07-05, live Max account: Fable drew `representative-claim:
+ *     seven_day_overage_included` at 7d 82% with `7d_oi` at 99%, served at $0;
+ *     at `7d_oi` ≥ 1.0 Fable answered a hard 429 (`7d_oi-status: rejected`,
+ *     `7d_oi-surpassed-threshold: 1.0`) while Opus kept serving.
+ *   - 2026-09-08 (#1262): a Fable response at `7d 0.63, 7d_oi 0.98` — headroom
+ *     read 0.37 against a seat two points from refusal.
+ *
+ * So for Fable, `oi` IS the binding weekly bucket, under a name that is not
+ * "fable". This seed makes that true from the first response. Bindings for
+ * other families are LEARNED per account from the wire (see
+ * `parseRateLimits`): a response whose claim is `*_overage_included`, or a 429
+ * whose `7d_<bucket>-status` is `rejected`, proves that bucket binds the family
+ * that request was for. Nothing here maps a family to `oi` by assumption:
+ * a seat drawing on included overage for Opus is bound by `oi` for Opus
+ * exactly when its responses say so.
+ */
+export const WIRE_BUCKET_BINDINGS = {
+    oi: ['fable'],
+};
+/** Parse `retry-after`: delta-seconds or an HTTP date; null when absent or unreadable. */
+export function parseRetryAfterMs(value, now = Date.now()) {
+    if (!value)
+        return null;
+    const secs = Number(value);
+    if (Number.isFinite(secs) && secs >= 0)
+        return Math.round(secs * 1000);
+    const at = Date.parse(value);
+    return Number.isFinite(at) ? Math.max(0, at - now) : null;
+}
+/** Union of two readings' learned bindings, per family, order-preserving. */
+export function mergeBoundBuckets(prev, next) {
+    if (!prev)
+        return next;
+    if (!next)
+        return prev;
+    const out = {};
+    for (const src of [prev, next]) {
+        for (const [family, buckets] of Object.entries(src)) {
+            const list = out[family] ?? (out[family] = []);
+            for (const b of buckets)
+                if (!list.includes(b))
+                    list.push(b);
+        }
+    }
+    return out;
+}
+/** `next` with everything the account had already learned carried forward. */
+export function withBoundBuckets(prev, next) {
+    const merged = mergeBoundBuckets(prev.boundBuckets, next.boundBuckets);
+    return merged ? { ...next, boundBuckets: merged } : next;
+}
 /** Parse an Anthropic response's rate-limit headers into a snapshot. */
-export function parseRateLimits(headers) {
+export function parseRateLimits(headers, family) {
     const get = (key) => headers.get(`anthropic-ratelimit-unified-${key}`) ?? '';
     const perModel7d = {};
+    const rejectedBuckets = [];
     // Iterate the full header set — `headers.get` only retrieves known
     // keys, but Anthropic can add new `7d_<family>-utilization` shapes
     // unannounced. Scanning the iterator means the parser is automatically
@@ -316,7 +430,28 @@ export function parseRateLimits(headers) {
         const m = k.match(PER_MODEL_7D_HEADER);
         if (m && m[1]) {
             perModel7d[m[1].toLowerCase()] = parseFloat(v) || 0;
+            continue;
         }
+        const st = k.match(PER_MODEL_7D_STATUS_HEADER);
+        if (st && st[1] && v.trim().toLowerCase() === 'rejected')
+            rejectedBuckets.push(st[1].toLowerCase());
+    }
+    const claim = get('representative-claim') || 'unknown';
+    // What THIS response proved about which bucket binds the request's family
+    // (see WIRE_BUCKET_BINDINGS). Only with a family to attribute to, and only
+    // on the wire's own say-so: an overage-included claim means the request was
+    // metered on `oi`; a bucket that reports itself rejected is the one that
+    // refused this family.
+    let boundBuckets;
+    if (family) {
+        const bound = [];
+        if (/_overage_included$/.test(claim) && perModel7d['oi'] !== undefined)
+            bound.push('oi');
+        for (const b of rejectedBuckets)
+            if (perModel7d[b] !== undefined && !bound.includes(b))
+                bound.push(b);
+        if (bound.length > 0)
+            boundBuckets = { [family]: bound };
     }
     return {
         status: get('status') || 'unknown',
@@ -328,8 +463,30 @@ export function parseRateLimits(headers) {
         reset: parseInt(get('reset')) || 0,
         fallbackPct: parseFloat(get('fallback-percentage')) || 0,
         updatedAt: Date.now(),
+        retryAfterMs: parseRetryAfterMs(headers.get('retry-after')),
+        ...(boundBuckets ? { boundBuckets } : {}),
     };
 }
+/**
+ * Does this 429 say a rate-limit WINDOW is over? True only when the reading
+ * itself shows one: a utilization at or past the 1.0 threshold on any window
+ * or bucket (the unified headers are a ratio against
+ * `surpassed-threshold: 1.0`, so `1.02` is 102%; every live rejection observed
+ * has read 1.00–1.06). A 429 with a claim but 30% used, or with no claim and
+ * 0% used, is a refusal of some other kind — concurrency, an account-level
+ * lock, a monthly credit — and its stated `reset` is not the moment this
+ * seat's window rolls. 0.99 rather than 1 absorbs float formatting.
+ */
+export function isWindowRejection(rl) {
+    // Utilization alone decides. The representative claim names WHICH window,
+    // and a real rejection carries one, but its absence must not turn a 104%
+    // reading into a mere cool-down — under-parking a genuinely exhausted seat
+    // re-probes it every minute, which is the loop #1254 removed.
+    const utils = [rl.util5h, rl.util7d, ...Object.values(rl.perModel7d)];
+    return utils.some((u) => u >= 0.99);
+}
+/** Cool-down for a 429 that named no exhausted window, when it stated no `retry-after`. */
+export const NON_WINDOW_REJECTION_COOLDOWN_MS = 60_000;
 /**
  * Extract the model family (`opus` / `sonnet` / `haiku` / `fable`) from a
  * request's model id. Used to look up the per-model 7d bucket in
@@ -368,16 +525,34 @@ export function modelFamily(modelId) {
  * isn't represented in the snapshot (e.g. account hasn't seen a Sonnet
  * request yet so `7d_sonnet` is unknown), headroom is computed from the
  * unified buckets only — best-effort, populated on the next response.
+ *
+ * A bucket counts for a family when it names the family (`7d_sonnet`), when
+ * `WIRE_BUCKET_BINDINGS` says it binds the family (`7d_oi` → fable, dario#1262),
+ * or when this account's responses have shown it does (`boundBuckets`).
  */
 export function computeHeadroom(snapshot, family) {
     const utils = [snapshot.util5h, snapshot.util7d];
     if (family) {
-        const perModel = snapshot.perModel7d[family];
-        if (perModel !== undefined)
-            utils.push(perModel);
+        for (const bucket of bucketsBindingFamily(snapshot, family)) {
+            const util = snapshot.perModel7d[bucket];
+            if (util !== undefined)
+                utils.push(util);
+        }
     }
     return 1 - Math.max(...utils);
 }
+/** Every bucket name that binds `family` for this reading — by name, by seed, or as learned. */
+export function bucketsBindingFamily(snapshot, family) {
+    const out = [family];
+    for (const [bucket, families] of Object.entries(WIRE_BUCKET_BINDINGS)) {
+        if (families.includes(family) && !out.includes(bucket))
+            out.push(bucket);
+    }
+    for (const bucket of snapshot.boundBuckets?.[family] ?? [])
+        if (!out.includes(bucket))
+            out.push(bucket);
+    return out;
+}
 const STICKY_IDLE_TTL_MS = 6 * 60 * 60 * 1000; // reap a binding 6h after its LAST use, not its creation
 const STICKY_MAX_ENTRIES = 2_000; // lazy cleanup cap
 const STICKY_CLEANUP_INTERVAL_MS = 30_000; // amortize the O(n) TTL/orphan sweep
@@ -454,12 +629,22 @@ export class AccountPool {
             expiresAt: opts.expiresAt,
             grantedAt: opts.grantedAt ?? keep?.grantedAt,
             organizationId: opts.organizationId ?? keep?.organizationId,
+            accountId: opts.accountId ?? keep?.accountId,
+            accountEmail: opts.accountEmail ?? keep?.accountEmail,
+            rateLimitTier: opts.rateLimitTier ?? keep?.rateLimitTier,
+            seatTier: opts.seatTier ?? keep?.seatTier,
             adoptedFrom: keep?.adoptedFrom,
-            identity: keep?.identity ?? {
-                deviceId: opts.deviceId,
-                accountUuid: opts.accountUuid,
-                sessionId: randomUUID(),
-            },
+            // The record's client identity is authoritative: `dario accounts identity
+            // --fresh` rewrites it on disk, and the running seat must present the new
+            // one on its next request rather than the old one until a restart. The
+            // session id is the seat's own and is kept.
+            identity: keep?.identity && keep.identity.deviceId === opts.deviceId && keep.identity.accountUuid === opts.accountUuid
+                ? keep.identity
+                : {
+                    deviceId: opts.deviceId,
+                    accountUuid: opts.accountUuid,
+                    sessionId: keep?.identity?.sessionId ?? randomUUID(),
+                },
             rateLimit: keep?.rateLimit ?? { ...EMPTY_SNAPSHOT },
             requestCount: keep?.requestCount ?? 0,
             rejectedCount: keep?.rejectedCount ?? 0,
@@ -554,7 +739,7 @@ export class AccountPool {
         // What is left — a rejection with no stated reset (nothing to expire, so
         // asking is the only way back) or an expiring token — is tried least-used
         // first, as before.
-        const probeable = all.filter(a => !isInAuthCooldown(a, now) && !isParkedInLiveWindow(a, now));
+        const probeable = all.filter(a => isProbeable(a, now));
         if (probeable.length === 0)
             return null;
         return probeable.reduce((a, b) => a.requestCount < b.requestCount ? a : b);
@@ -572,13 +757,22 @@ export class AccountPool {
         if (this.accounts.size === 0)
             return null;
         const all = [...this.accounts.values()];
-        if (!all.every(a => isParkedInLiveWindow(a, now)))
+        // A seat cooling after a non-window 429 counts here: it is over a rate
+        // limit of some kind and it comes back on its own, which is exactly what
+        // this answer means. Without it a pool of cooling seats reported "not
+        // parked", fell past the local-429, and spent a probe that could only
+        // 429 again (dario#1264 review). An auth cool-down or an expired token
+        // still does NOT count — those are not rate limits and must not be
+        // reported, or cooled, as if they were.
+        if (!all.every(a => isParkedInLiveWindow(a, now) || isCoolingAfterRejection(a, now)))
             return null;
-        return Math.min(...all.map(a => a.rateLimit.reset * 1000));
+        return Math.min(...all.map(a => isParkedInLiveWindow(a, now)
+            ? a.rateLimit.reset * 1000
+            : a.rateLimit.cooldownUntil ?? now));
     }
-    /** Seats currently parked inside a live window (dario#1244). */
+    /** Seats a rate limit is currently keeping out of rotation (dario#1244, #1264). */
     parkedCount(now = Date.now()) {
-        return [...this.accounts.values()].filter(a => isParkedInLiveWindow(a, now)).length;
+        return [...this.accounts.values()].filter(a => isParkedInLiveWindow(a, now) || isCoolingAfterRejection(a, now)).length;
     }
     /**
      * Select with session stickiness. If `stickyKey` is already bound to a
@@ -699,7 +893,7 @@ export class AccountPool {
         // parked inside a live window is not one of them — on the dario#1244
         // gateway every request walked all six parked seats, six guaranteed 429s
         // a request. Cool-downs are skipped for the same reason.
-        const probeable = candidates.filter(a => !isInAuthCooldown(a, now) && !isParkedInLiveWindow(a, now));
+        const probeable = candidates.filter(a => isProbeable(a, now));
         if (probeable.length > 0) {
             return probeable.reduce((a, b) => a.requestCount < b.requestCount ? a : b);
         }
@@ -709,7 +903,7 @@ export class AccountPool {
         const account = this.accounts.get(alias);
         if (!account)
             return;
-        account.rateLimit = snapshot;
+        account.rateLimit = withBoundBuckets(account.rateLimit, snapshot);
         account.adoptedFrom = undefined;
         account.requestCount++;
     }
@@ -726,7 +920,22 @@ export class AccountPool {
             return false;
         const now = snapshot.updatedAt || Date.now();
         const wasParked = account.rateLimit.status === 'rejected' && !rateLimitWindowPassed(account.rateLimit, now);
-        account.rateLimit = { ...snapshot, status: 'rejected' };
+        // The status code says "no"; the headers say WHY. Only a 429 that names an
+        // exhausted window is parked until that window's reset. Any other 429 —
+        // no claim, or a claim with utilization nowhere near the threshold — is
+        // not this seat's window rolling, whatever `reset` it states (the fleet box
+        // parked a seat for 546 hours on `5h 0%, 7d 0%, claim unknown`). It cools for
+        // the upstream's own `retry-after`, or a minute, and stays probeable.
+        const exhausted = isWindowRejection(snapshot);
+        const merged = withBoundBuckets(account.rateLimit, snapshot);
+        account.rateLimit = exhausted
+            ? { ...merged, status: 'rejected', exhausted: true }
+            : {
+                ...merged,
+                status: 'rejected',
+                exhausted: false,
+                cooldownUntil: now + (snapshot.retryAfterMs ?? NON_WINDOW_REJECTION_COOLDOWN_MS),
+            };
         account.adoptedFrom = undefined;
         account.rejectedCount++;
         account.lastRejectedAt = now;
@@ -754,7 +963,8 @@ export class AccountPool {
         const account = this.accounts.get(alias);
         if (!account)
             return false;
-        account.rateLimit = rejected ? { ...snapshot, status: 'rejected' } : { ...snapshot };
+        const merged = withBoundBuckets(account.rateLimit, snapshot);
+        account.rateLimit = rejected ? { ...merged, status: 'rejected' } : { ...merged };
         account.adoptedFrom = from;
         return true;
     }