@askalf/dario 6.0.45 → 6.0.47

package/README.md

@@ -27,7 +27,7 @@
 
 <p><strong>One local endpoint. Every AI tool you own. The subscriptions you already pay for.</strong></p>
 
-<sub><code>npm i -g @askalf/dario</code> · <strong>0</strong> runtime deps · <a href="https://www.npmjs.com/package/@askalf/dario">SLSA-attested</a> every release · nothing phones home · ~32k lines you can read in a weekend · independent, unofficial, third-party (<a href="DISCLAIMER.md">DISCLAIMER.md</a>)</sub>
+<sub><code>npm i -g @askalf/dario</code> · <strong>0</strong> runtime deps · <a href="https://www.npmjs.com/package/@askalf/dario">SLSA-attested</a> every release · nothing phones home · ~33k lines you can read in a weekend · independent, unofficial, third-party (<a href="DISCLAIMER.md">DISCLAIMER.md</a>)</sub>
 
 <sub><a href="#start-in-60-seconds">Start</a> · <a href="#point-your-tools-at-it">Your tools</a> · <a href="#what-it-does-with-a-request">Routing</a> · <a href="#two-plans-one-endpoint">Two plans</a> · <a href="#many-seats-one-endpoint">Pool</a> · <a href="#it-tracks-a-moving-target">Drift</a> · <a href="#trust--transparency">Trust</a> · <a href="#will-my-account-get-suspended">Risk</a> · <a href="#commands">Commands</a> · <a href="#faq">FAQ</a> · <a href="docs/returning.md">Coming back after a while?</a></sub>
 
@@ -405,7 +405,7 @@ The split isn't live, but it was announced once on short notice and could return
 
 | Signal | Status |
 |---|---|
-| Source | **~32k** lines of TypeScript across **68** files, auditable in a weekend. One credential path since v5: the pool. |
+| Source | **~33k** lines of TypeScript across **68** files, auditable in a weekend. One credential path since v5: the pool. |
 | Dependencies | **0 runtime.** Verify: `npm ls --production` |
 | Provenance | Every release [SLSA-attested](https://www.npmjs.com/package/@askalf/dario) via GitHub Actions + Sigstore, published with OIDC trusted publishing — no long-lived npm token exists to leak |
 | Scanning | [CodeQL](https://github.com/askalf/dario/actions/workflows/codeql.yml) on every push and weekly · [ClusterFuzzLite](./.github/workflows/cflite.yml) fuzzes the SSE translator and rejection parsers weekly · [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/askalf/dario) and [Best Practices](https://www.bestpractices.dev/projects/13638) badges above are live |

package/dist/pool-fallback-tier.d.ts

@@ -1,6 +1,14 @@
 /** Backward-compatible selection of a pool-fallback target for one request.
  * A bare value or comma-separated model chain retains the legacy meaning.
- * Tier maps use `tier:model`, e.g. `haiku:gpt-5.4-mini,sonnet:gpt-5.6-terra`.
+ * Tier maps use `tier:model`, e.g. `haiku:gpt-5.6-luna,sonnet:gpt-5.6-terra`.
  * Unknown models use `default`, or the first (normally cheapest) configured tier.
+ *
+ * The Codex rungs are named for a size ladder — `sol` (sun) > `terra` (earth) >
+ * `luna` (moon) — which is why the tier tests below read model NAMES rather
+ * than any stated capability: the backend publishes a routable set and no tier
+ * metadata, so the ladder is the only signal there is. `luna` was added when
+ * codex-drift-watch reported the account-visible list as `gpt-5.5`,
+ * `gpt-5.6-luna`, `gpt-5.6-sol`, `gpt-5.6-terra`, `gpt-reserve` (dario#1272);
+ * `gpt-5.4-mini`, the previous example here, is no longer on that list.
  */
 export declare function selectPoolFallbackModels(spec: string | undefined, requestedModel: string): string[];

package/dist/pool-fallback-tier.js

@@ -1,7 +1,15 @@
 /** Backward-compatible selection of a pool-fallback target for one request.
  * A bare value or comma-separated model chain retains the legacy meaning.
- * Tier maps use `tier:model`, e.g. `haiku:gpt-5.4-mini,sonnet:gpt-5.6-terra`.
+ * Tier maps use `tier:model`, e.g. `haiku:gpt-5.6-luna,sonnet:gpt-5.6-terra`.
  * Unknown models use `default`, or the first (normally cheapest) configured tier.
+ *
+ * The Codex rungs are named for a size ladder — `sol` (sun) > `terra` (earth) >
+ * `luna` (moon) — which is why the tier tests below read model NAMES rather
+ * than any stated capability: the backend publishes a routable set and no tier
+ * metadata, so the ladder is the only signal there is. `luna` was added when
+ * codex-drift-watch reported the account-visible list as `gpt-5.5`,
+ * `gpt-5.6-luna`, `gpt-5.6-sol`, `gpt-5.6-terra`, `gpt-reserve` (dario#1272);
+ * `gpt-5.4-mini`, the previous example here, is no longer on that list.
  */
 export function selectPoolFallbackModels(spec, requestedModel) {
     const entries = (spec ?? '').trim().split(',').map((entry) => entry.trim()).filter(Boolean);
@@ -19,7 +27,7 @@ export function selectPoolFallbackModels(spec, requestedModel) {
             tiers.set(tier, model);
     }
     const model = requestedModel.toLowerCase();
-    const tier = /haiku|mini|small/.test(model) ? 'haiku'
+    const tier = /haiku|mini|small|luna/.test(model) ? 'haiku'
         : /opus|sol|large/.test(model) ? 'opus'
             : /sonnet|terra|medium/.test(model) ? 'sonnet'
                 : 'default';

package/dist/pool.d.ts

@@ -431,7 +431,47 @@ export declare function modelFamily(modelId: string | null | undefined): string
  * `WIRE_BUCKET_BINDINGS` says it binds the family (`7d_oi` → fable, dario#1262),
  * or when this account's responses have shown it does (`boundBuckets`).
  */
-export declare function computeHeadroom(snapshot: RateLimitSnapshot, family?: string | null): number;
+export declare function computeHeadroom(snapshot: RateLimitSnapshot, family?: string | null, now?: number): number;
+/**
+ * Drop a utilization reading whose own window has already rolled over
+ * (dario#1244 follow-up, 2026-09-09).
+ *
+ * `rateLimitWindowPassed` has expired *rejections* against
+ * `anthropic-ratelimit-unified-reset` since #1232. The utilization on the same
+ * snapshot never got the same treatment, and that asymmetry is a routing bug —
+ * not the reporting one `utilFreshness` describes, whose "the pool returns
+ * parked accounts to service on its own and the value corrects itself" only
+ * holds for seats that were parked.
+ *
+ * A seat that never 429'd but whose last response read `5h 99%` keeps that
+ * reading forever: `computeHeadroom` returns 0.01, under `POOL_HEADROOM_FLOOR`,
+ * so the selector skips it, `pickFillFirst` won't take it, sticky bindings
+ * rebind away from it, and `drainQueue`'s probe loop *breaks* on it. Nothing
+ * sends it a request, so `updateRateLimits` never runs, so the reading never
+ * refreshes. Unlike a rejection there is no all-exhausted fallback to rescue
+ * it, because it was never ineligible — only permanently unattractive.
+ *
+ * Reported on a nine-seat pool (dario#1244, 2026-09-09): every seat read 0.98
+ * to 1.03, so every seat sat at or under the floor and `waitForAccount` queued
+ * until it timed out — a whole pool reporting exhausted while two of its seats
+ * carried `reset_in_ms: 0` and were provably free, one having served exactly
+ * ONE request 3.7 hours earlier. `rejected_count` was 0 on all of them, which
+ * is why none of the rejection-side fixes (#1232, #1254, the 6.0.39 cool-down)
+ * reached this: every one of them requires a 429 to have happened.
+ *
+ * Only the bucket the reading's own `claim` names is dropped. `reset` states
+ * the rollover of the representative window and nothing else, so a five-hour
+ * rollover must not clear a seven-day reading — that would route traffic onto
+ * a seat whose weekly quota really is spent. A claim naming neither window
+ * (`unknown`) is left untouched: nothing identifies which bucket expired, and
+ * guessing is how a genuinely throttled seat gets pushed back into rotation.
+ *
+ * Zeroing rather than flagging is deliberate: the seat becomes an attractive
+ * candidate, is picked once, and its own response refreshes the reading. That
+ * is the same "asking is the only way back" rule `isParkedInLiveWindow`
+ * documents, and it costs no synthetic probe.
+ */
+export declare function expireElapsedWindow(snapshot: RateLimitSnapshot, now?: number): RateLimitSnapshot;
 /** Every bucket name that binds `family` for this reading — by name, by seed, or as learned. */
 export declare function bucketsBindingFamily(snapshot: RateLimitSnapshot, family: string): string[];
 export declare class AccountPool {

package/dist/pool.js

@@ -530,17 +530,74 @@ export function modelFamily(modelId) {
  * `WIRE_BUCKET_BINDINGS` says it binds the family (`7d_oi` → fable, dario#1262),
  * or when this account's responses have shown it does (`boundBuckets`).
  */
-export function computeHeadroom(snapshot, family) {
-    const utils = [snapshot.util5h, snapshot.util7d];
+export function computeHeadroom(snapshot, family, now = Date.now()) {
+    const rl = expireElapsedWindow(snapshot, now);
+    const utils = [rl.util5h, rl.util7d];
     if (family) {
-        for (const bucket of bucketsBindingFamily(snapshot, family)) {
-            const util = snapshot.perModel7d[bucket];
+        for (const bucket of bucketsBindingFamily(rl, family)) {
+            const util = rl.perModel7d[bucket];
             if (util !== undefined)
                 utils.push(util);
         }
     }
     return 1 - Math.max(...utils);
 }
+/**
+ * Drop a utilization reading whose own window has already rolled over
+ * (dario#1244 follow-up, 2026-09-09).
+ *
+ * `rateLimitWindowPassed` has expired *rejections* against
+ * `anthropic-ratelimit-unified-reset` since #1232. The utilization on the same
+ * snapshot never got the same treatment, and that asymmetry is a routing bug —
+ * not the reporting one `utilFreshness` describes, whose "the pool returns
+ * parked accounts to service on its own and the value corrects itself" only
+ * holds for seats that were parked.
+ *
+ * A seat that never 429'd but whose last response read `5h 99%` keeps that
+ * reading forever: `computeHeadroom` returns 0.01, under `POOL_HEADROOM_FLOOR`,
+ * so the selector skips it, `pickFillFirst` won't take it, sticky bindings
+ * rebind away from it, and `drainQueue`'s probe loop *breaks* on it. Nothing
+ * sends it a request, so `updateRateLimits` never runs, so the reading never
+ * refreshes. Unlike a rejection there is no all-exhausted fallback to rescue
+ * it, because it was never ineligible — only permanently unattractive.
+ *
+ * Reported on a nine-seat pool (dario#1244, 2026-09-09): every seat read 0.98
+ * to 1.03, so every seat sat at or under the floor and `waitForAccount` queued
+ * until it timed out — a whole pool reporting exhausted while two of its seats
+ * carried `reset_in_ms: 0` and were provably free, one having served exactly
+ * ONE request 3.7 hours earlier. `rejected_count` was 0 on all of them, which
+ * is why none of the rejection-side fixes (#1232, #1254, the 6.0.39 cool-down)
+ * reached this: every one of them requires a 429 to have happened.
+ *
+ * Only the bucket the reading's own `claim` names is dropped. `reset` states
+ * the rollover of the representative window and nothing else, so a five-hour
+ * rollover must not clear a seven-day reading — that would route traffic onto
+ * a seat whose weekly quota really is spent. A claim naming neither window
+ * (`unknown`) is left untouched: nothing identifies which bucket expired, and
+ * guessing is how a genuinely throttled seat gets pushed back into rotation.
+ *
+ * Zeroing rather than flagging is deliberate: the seat becomes an attractive
+ * candidate, is picked once, and its own response refreshes the reading. That
+ * is the same "asking is the only way back" rule `isParkedInLiveWindow`
+ * documents, and it costs no synthetic probe.
+ */
+export function expireElapsedWindow(snapshot, now = Date.now()) {
+    // Deliberately NOT `rateLimitWindowPassed`: that predicate answers "is this
+    // rejection over", and for a 429 that named no exhausted window it answers
+    // yes as soon as the cool-down elapses, whatever the window says. A seat
+    // 429'd at `5h 99%` (under the 1.0 threshold, so `exhausted: false`) would
+    // then have a true 99% reading zeroed a minute later and take traffic it
+    // cannot serve. Only the stated rollover retires a reading.
+    if (!(snapshot.reset > 0 && snapshot.reset * 1000 <= now))
+        return snapshot;
+    if (snapshot.claim === 'five_hour')
+        return { ...snapshot, util5h: 0 };
+    // `seven_day`, plus the overage variants that carry the same weekly window
+    // (`seven_day_overage_included`, see the overage note above).
+    if (snapshot.claim.startsWith('seven_day'))
+        return { ...snapshot, util7d: 0 };
+    return snapshot;
+}
 /** Every bucket name that binds `family` for this reading — by name, by seed, or as learned. */
 export function bucketsBindingFamily(snapshot, family) {
     const out = [family];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.0.45",
+  "version": "6.0.47",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {