@askalf/dario 6.10.5 → 6.11.0

package/dist/cli.js

@@ -520,11 +520,14 @@ async function proxy() {
     // `fill-first` concentrates them on the alphabetically-first eligible seat
     // until it drains to the 2% floor, then spills — primary/backup semantics,
     // alias naming (`1-main`, `2-overflow`) is the ordering knob. Sticky
-    // bindings behave identically under both.
+    // bindings behave identically under both. `expiring-first` is fill-first
+    // ordered by each seat's 7-day reset, soonest first: spend the capacity that
+    // expires soonest before touching the rest.
     const poolStrategyFromFlag = args.find((a) => a.startsWith('--pool-strategy='))?.split('=')[1];
     if (poolStrategyFromFlag !== undefined
-        && poolStrategyFromFlag !== 'headroom' && poolStrategyFromFlag !== 'fill-first') {
-        console.error(`[dario] Invalid --pool-strategy "${poolStrategyFromFlag}". Must be headroom or fill-first.`);
+        && poolStrategyFromFlag !== 'headroom' && poolStrategyFromFlag !== 'fill-first'
+        && poolStrategyFromFlag !== 'expiring-first') {
+        console.error(`[dario] Invalid --pool-strategy "${poolStrategyFromFlag}". Must be headroom, fill-first or expiring-first.`);
         process.exit(1);
     }
     const poolStrategy = poolStrategyFromFlag
@@ -2171,13 +2174,15 @@ async function help() {
                              dario returns 504 "queue-timeout"
                              (default: 60000).
                              Env: DARIO_QUEUE_TIMEOUT_MS. (dario#80)
-    --pool-strategy=<headroom|fill-first>
+    --pool-strategy=<headroom|fill-first|expiring-first>
                              Where new conversations land in a multi-
                              account pool. headroom (default) spreads
                              them to the seat with the most slack;
                              fill-first concentrates them on the
                              alphabetically-first eligible seat until
-                             it drains to the 2% floor, then spills.
+                             it drains to the floor, then spills;
+                             expiring-first does the same in order of
+                             each seat's 7-day reset, soonest first.
                              Sticky bindings are unaffected.
                              Env: DARIO_POOL_STRATEGY.
     --pool-headroom-floor=<ratio|percent>

package/dist/config-file.d.ts

@@ -86,8 +86,10 @@ export interface DarioConfig {
          * most headroom; `fill-first` concentrates them on the alphabetically-
          * first eligible seat until it drains to the 2% floor, then spills to
          * the next — primary/backup semantics, alias order is the knob.
+         * `expiring-first` is fill-first ordered by each seat's 7-day reset,
+         * soonest first.
          */
-        strategy?: 'headroom' | 'fill-first';
+        strategy?: 'headroom' | 'fill-first' | 'expiring-first';
         /** Headroom at/below which a seat counts as drained — ratio 0.02..0.5 (dario#1333). */
         headroomFloor?: number;
     };

package/dist/config-file.js

@@ -308,7 +308,8 @@ function sanitize(parsed) {
     }
     if (isPlainObject(parsed.pool)) {
         out.pool = {};
-        if (parsed.pool.strategy === 'headroom' || parsed.pool.strategy === 'fill-first') {
+        if (parsed.pool.strategy === 'headroom' || parsed.pool.strategy === 'fill-first'
+            || parsed.pool.strategy === 'expiring-first') {
             out.pool.strategy = parsed.pool.strategy;
         }
         if (typeof parsed.pool.headroomFloor === 'number' && Number.isFinite(parsed.pool.headroomFloor)) {

package/dist/pool.d.ts

@@ -33,6 +33,14 @@ export interface RateLimitSnapshot {
      * were on the response.
      */
     perModel7d: Record<string, number>;
+    /**
+     * Epoch SECONDS the seat's own 7-day window resets at, from
+     * `anthropic-ratelimit-unified-7d-reset`; 0 when the response did not carry
+     * it. Distinct from `reset`, which is the representative claim's reset (on
+     * most responses the five-hour one). `expiring-first` orders seats by it:
+     * capacity that expires soonest is spent first.
+     */
+    reset7d?: number;
     overageUtil: number;
     claim: string;
     reset: number;
@@ -385,7 +393,18 @@ export interface PoolStatus {
  * pick the fill order. Sticky bindings behave identically in both modes;
  * strategy only decides where UNBOUND (new) conversations land.
  */
-export type PoolStrategy = 'headroom' | 'fill-first';
+export type PoolStrategy = 'headroom' | 'fill-first' | 'expiring-first';
+/**
+ * `expiring-first` — fill-first, ordered by WHEN each seat's capacity expires
+ * instead of by alias: new conversations fill the seat whose 7-day window
+ * resets soonest until it drains to the floor, then spill to the next-soonest.
+ * Subscription capacity is use-it-or-lose-it; spending the soonest-expiring
+ * first is what gets the most of it used. Fleet box, 2026-09-22: seat pro1 got
+ * a fresh limit reset expiring in ~50h while login's window had ~70h left, and
+ * alias-ordered fill-first kept every new conversation on login. A seat with
+ * no 7d reading yet (or whose window has already rolled) goes last; ties break
+ * by alias. Sticky bindings behave identically.
+ */
 /**
  * Resolve the pool strategy from an explicit value (CLI flag / config file,
  * already precedence-merged by the caller) with `DARIO_POOL_STRATEGY` as
@@ -550,6 +569,12 @@ export declare function parsePoolHeadroomFloor(value: string | number | null | u
  * default, matching `resolvePoolStrategy`.
  */
 export declare function resolvePoolHeadroomFloor(explicit?: string | number | null, env?: NodeJS.ProcessEnv): number;
+/**
+ * The 7-day reset `expiring-first` orders by, in epoch ms: the seat's own
+ * reading while it is still ahead of `now`, else +Infinity (never read, or the
+ * window has rolled and the next reset is unknown), which sorts it last.
+ */
+export declare function seatExpiry(account: PoolAccount, now?: number): number;
 export declare class AccountPool {
     private readonly strategy;
     /** Headroom at/below which a seat counts as drained — see DEFAULT_POOL_HEADROOM_FLOOR. */

package/dist/pool.js

@@ -319,7 +319,15 @@ export function familyParkedOnBuckets(rl, family, now = Date.now()) {
 }
 /** `next` with the parked buckets `prev` still holds carried forward (see `RateLimitSnapshot.parkedBuckets`). */
 export function withParkedBuckets(prev, next, now = Date.now()) {
-    const parked = activeParkedBuckets(prev, now);
+    // A reading that MEASURED a parked bucket below the threshold is that bucket's
+    // own answer: it has room again before its stated reset (a limit reset on the
+    // account, a plan upgrade), so its park lifts. A reading without the bucket's
+    // header (an Opus 200 carries no 7d_oi) says nothing about it and keeps it.
+    // Fleet box, 2026-09-22: pro1's oi was reset by the operator; a pinned Fable
+    // 200 read 7d_oi 0.0 allowed, and the park still held Fable off pro1 until the
+    // 429's reset three days out.
+    const parked = activeParkedBuckets(prev, now)
+        .filter((b) => !(b in next.perModel7d && next.perModel7d[b] < 0.99));
     if (parked.length === 0)
         return next;
     return { ...next, parkedBuckets: parked, parkedBucketsUntil: prev.parkedBucketsUntil };
@@ -392,6 +400,17 @@ export function accountAction(account, now = Date.now()) {
         return 'wait';
     return 'none';
 }
+/**
+ * `expiring-first` — fill-first, ordered by WHEN each seat's capacity expires
+ * instead of by alias: new conversations fill the seat whose 7-day window
+ * resets soonest until it drains to the floor, then spill to the next-soonest.
+ * Subscription capacity is use-it-or-lose-it; spending the soonest-expiring
+ * first is what gets the most of it used. Fleet box, 2026-09-22: seat pro1 got
+ * a fresh limit reset expiring in ~50h while login's window had ~70h left, and
+ * alias-ordered fill-first kept every new conversation on login. A seat with
+ * no 7d reading yet (or whose window has already rolled) goes last; ties break
+ * by alias. Sticky bindings behave identically.
+ */
 /**
  * Resolve the pool strategy from an explicit value (CLI flag / config file,
  * already precedence-merged by the caller) with `DARIO_POOL_STRATEGY` as
@@ -404,7 +423,7 @@ export function resolvePoolStrategy(explicit, env = process.env) {
         if (typeof c !== 'string')
             continue;
         const s = c.trim().toLowerCase();
-        if (s === 'headroom' || s === 'fill-first')
+        if (s === 'headroom' || s === 'fill-first' || s === 'expiring-first')
             return s;
     }
     return 'headroom';
@@ -526,6 +545,7 @@ export function parseRateLimits(headers, family) {
         status: get('status') || 'unknown',
         util5h: parseFloat(get('5h-utilization')) || 0,
         util7d: parseFloat(get('7d-utilization')) || 0,
+        reset7d: parseInt(get('7d-reset'), 10) || 0,
         perModel7d,
         overageUtil: parseFloat(get('overage-utilization')) || 0,
         claim: get('representative-claim') || 'unknown',
@@ -789,6 +809,23 @@ function pickMaxHeadroom(accounts, family) {
 // readdir whose order the OS doesn't guarantee, and the operator can control
 // alias names but not readdir. Returns null when every candidate is at/below
 // the floor so the caller can fall back to max-headroom.
+/**
+ * The 7-day reset `expiring-first` orders by, in epoch ms: the seat's own
+ * reading while it is still ahead of `now`, else +Infinity (never read, or the
+ * window has rolled and the next reset is unknown), which sorts it last.
+ */
+export function seatExpiry(account, now = Date.now()) {
+    const r = (account.rateLimit.reset7d ?? 0) * 1000;
+    return r > now ? r : Number.POSITIVE_INFINITY;
+}
+function pickExpiringFirst(accounts, family, floor = DEFAULT_POOL_HEADROOM_FLOOR, now = Date.now()) {
+    const order = [...accounts].sort((a, b) => (seatExpiry(a, now) - seatExpiry(b, now)) || (a.alias < b.alias ? -1 : a.alias > b.alias ? 1 : 0));
+    for (const a of order) {
+        if (computeHeadroom(a.rateLimit, family) > floor)
+            return a;
+    }
+    return null;
+}
 function pickFillFirst(accounts, family, floor = DEFAULT_POOL_HEADROOM_FLOOR) {
     let best = null;
     for (const a of accounts) {
@@ -924,8 +961,10 @@ export class AccountPool {
         const all = [...this.accounts.values()];
         const eligible = all.filter(a => isAccountEligible(a, now, family));
         if (eligible.length > 0) {
-            if (this.strategy === 'fill-first') {
-                const first = pickFillFirst(eligible, family, this.headroomFloor);
+            if (this.strategy === 'fill-first' || this.strategy === 'expiring-first') {
+                const first = this.strategy === 'fill-first'
+                    ? pickFillFirst(eligible, family, this.headroomFloor)
+                    : pickExpiringFirst(eligible, family, this.headroomFloor, now);
                 if (first)
                     return first;
                 // Every eligible account is at/below the floor — the terminal state
@@ -1091,8 +1130,10 @@ export class AccountPool {
             // after a 429 is the next alias in line, not the max-headroom seat —
             // otherwise a single failover would defeat the concentration the
             // strategy exists to provide.
-            if (this.strategy === 'fill-first') {
-                const first = pickFillFirst(eligible, family, this.headroomFloor);
+            if (this.strategy === 'fill-first' || this.strategy === 'expiring-first') {
+                const first = this.strategy === 'fill-first'
+                    ? pickFillFirst(eligible, family, this.headroomFloor)
+                    : pickExpiringFirst(eligible, family, this.headroomFloor, now);
                 if (first)
                     return first;
             }
@@ -1112,7 +1153,12 @@ export class AccountPool {
         const account = this.accounts.get(alias);
         if (!account)
             return;
-        account.rateLimit = withParkedBuckets(account.rateLimit, withBoundBuckets(account.rateLimit, snapshot), snapshot.updatedAt || Date.now());
+        const at = snapshot.updatedAt || Date.now();
+        // A reading without the 7d-reset header does not un-learn it while it is
+        // still ahead: expiring-first would otherwise send the seat to the back.
+        const prevReset7d = account.rateLimit.reset7d ?? 0;
+        const next = !snapshot.reset7d && prevReset7d * 1000 > at ? { ...snapshot, reset7d: prevReset7d } : snapshot;
+        account.rateLimit = withParkedBuckets(account.rateLimit, withBoundBuckets(account.rateLimit, next), at);
         account.adoptedFrom = undefined;
         account.requestCount++;
     }

package/dist/proxy.js

@@ -1522,7 +1522,8 @@ export async function startProxy(opts = {}) {
         console.error('[dario] --pool-shared-state needs DARIO_REFRESH_LOCK_URL (the lock service carries the shared state) — running with this instance\'s own state');
     }
     if (poolStrategy !== 'headroom') {
-        console.log(`  Pool strategy: ${poolStrategy} (new conversations fill the alphabetically-first seat, spill at the 2% floor)`);
+        const order = poolStrategy === 'expiring-first' ? 'the seat whose 7-day window resets soonest' : 'the alphabetically-first seat';
+        console.log(`  Pool strategy: ${poolStrategy} (new conversations fill ${order}, spill at the ${Math.round(pool.headroomFloor * 100)}% floor)`);
     }
     if (poolSync) {
         console.log(`  Pool shared state: on (instance ${poolSync.instance}, via ${lockUrl}, pulling peers every ${poolSync.intervalMs}ms; fails open)`);

package/dist/tui/tabs/config.js

@@ -38,7 +38,7 @@ const FIELDS = [
     { path: 'thinkTime.maxMs', label: 'Think-time cap (ms)', type: 'number', hint: 'upper bound for the whole formula' },
     { path: 'sessionStart.minMs', label: 'Session-start min', type: 'number', hint: 'first-request delay floor' },
     { path: 'sessionStart.jitterMs', label: 'Session-start jitter', type: 'number' },
-    { path: 'pool.strategy', label: 'Pool strategy', type: 'string', hint: '"headroom" (default) or "fill-first"' },
+    { path: 'pool.strategy', label: 'Pool strategy', type: 'string', hint: '"headroom" (default), "expiring-first" or "fill-first"' },
     // ── Overage-guard (v4.1, dario#288) ─────────────────────────
     { path: 'overageGuard.enabled', label: 'Overage-guard', type: 'bool', hint: 'halt proxy on any representative-claim=overage' },
     { path: 'overageGuard.behavior', label: 'Overage behavior', type: 'string', hint: '"halt" (default) or "warn"' },
@@ -271,7 +271,7 @@ function commitEdit(state) {
  */
 const STRING_ENUMS = {
     'overageGuard.behavior': ['halt', 'warn'],
-    'pool.strategy': ['headroom', 'fill-first'],
+    'pool.strategy': ['headroom', 'fill-first', 'expiring-first'],
 };
 function doSave(state) {
     try {

package/docs/commands.md

@@ -51,7 +51,7 @@ This page is the per-flag reference. For environment variables grouped by task
 | `--session-rotate-jitter=<ms>` / `DARIO_SESSION_JITTER_MS` | Jitter sampled once per session at creation — hides the exact idle floor. (v3.28) | `0` |
 | `--session-max-age=<ms>` / `DARIO_SESSION_MAX_AGE_MS` | Hard ceiling on a session-id's lifetime regardless of activity. (v3.28) | off |
 | `--session-per-client` / `DARIO_SESSION_PER_CLIENT=1` | Split session-id registry by a per-client header so multi-UI fan-out doesn't collapse onto one id. (v3.28) | off |
-| `--pool-strategy=<headroom\|fill-first>` / `DARIO_POOL_STRATEGY` | Where new conversations land in a multi-account pool. `headroom` spreads them to the seat with the most slack; `fill-first` concentrates them on the alphabetically-first eligible seat until it drains to the 2% floor, then spills to the next — primary/backup semantics, alias naming (`1-main`, `2-overflow`) picks the fill order. Sticky bindings behave identically under both. See [Multi-account pool](./multi-account-pool.md#routing-strategy). | `headroom` |
+| `--pool-strategy=<headroom\|fill-first\|expiring-first>` / `DARIO_POOL_STRATEGY` | Where new conversations land in a multi-account pool. `headroom` spreads them to the seat with the most slack; `fill-first` concentrates them on the alphabetically-first eligible seat until it drains to the floor, then spills to the next — primary/backup semantics, alias naming (`1-main`, `2-overflow`) picks the fill order; `expiring-first` does the same in order of each seat's 7-day reset, soonest first, so capacity that expires soonest is spent first. Sticky bindings behave identically under all three. See [Multi-account pool](./multi-account-pool.md#routing-strategy). | `headroom` |
 | `--pool-fallback=<models>` / `DARIO_POOL_FALLBACK` / config `poolFallback.model` | Strictly opt-in. When every pool seat is drained or in auth cool-down (at selection, or mid-flight on a 429 with no peer left), serve the request as `<model>` from whichever provider can, instead of surfacing the 429/503. Accepts a **chain** — `gpt-5.6-sol,claude-sonnet-5` — read left to right, each provider taking the first entry it can serve. A Codex/ChatGPT subscription that lists the model is preferred (no per-token cost) and works on **both** wire shapes; otherwise a configured openai-compat backend, which is still OpenAI-path only (no Messages translation on that route). A chain also makes failover **symmetric**: a rate-limited or failing subscription hands the request back to the Claude pool. Only a 429/5xx fails over — a 400 surfaces, since a bad request would just reproduce itself elsewhere. Every substituted response carries `x-dario-pool-fallback: <model>` — never silent. Needs a Codex account (`dario add altman`) or a backend (`dario backend add …`); `dario doctor` reports it as INERT with neither. Empty pool still 503s (setup error, not traffic to re-bill). Empty flag value disables, overriding env + config. See [Pool-exhausted fallback](./multi-account-pool.md#pool-exhausted-fallback). | off |
 | `--system-prompt=<verbatim\|partial\|aggressive\|filepath>` / `DARIO_SYSTEM_PROMPT` | System-prompt mode for outbound CC-shaped requests. `partial` strips behavioral constraints (Tone-and-style, Text-output, scope/verbosity/comment bullets) for ~1.2–2.8× output capability on open-ended work. `aggressive` adds prompt-level RLHF restatement removal (<3% over partial — alignment is RLHF-trained). `<filepath>` fully replaces the slot with file contents. Empirically validated as unfingerprinted by the billing classifier — see [`system-prompt.md`](./system-prompt.md) and [`research/system-prompt-classifier-study.md`](./research/system-prompt-classifier-study.md). (v3.34) | `verbatim` |
 | `--upstream-proxy=<url>` / `--via=<url>` / `DARIO_UPSTREAM_PROXY` | Route dario's outbound fetches (api.anthropic.com, OpenAI-compat backends, OAuth) through an HTTP/HTTPS proxy. Pair with the HTTP proxy mode of a VPN provider (Mullvad, AirVPN), a corporate proxy, privoxy/Tor, etc. Localhost calls bypass. Requires Bun runtime; SOCKS5 not supported. Full provider matrix + setup in [`vpn-routing.md`](./vpn-routing.md). (v3.35) | unset |

package/docs/integrations/cordon.md

@@ -24,8 +24,8 @@ services:
     expose: ["3456"]
 
   cordon:
-    # multi-arch, Sigstore-attested: gh attestation verify oci://ghcr.io/askalf/cordon:v0.2.0 --repo askalf/cordon
-    image: ghcr.io/askalf/cordon:v0.2.0
+    # multi-arch, Sigstore-attested: gh attestation verify oci://ghcr.io/askalf/cordon:v0.3.0 --repo askalf/cordon
+    image: ghcr.io/askalf/cordon:v0.3.0
     environment:
       ANTHROPIC_BASE: http://dario:3456
       OPENAI_BASE: http://dario:3456

package/docs/multi-account-pool.md

@@ -29,7 +29,9 @@ Two situations where that beats spreading:
 - **Primary/backup seats.** A `z-backup` account stays completely untouched — fresh 5h and 7d windows — until `a-main` is actually drained. Headroom spreading would nibble at both from the first request.
 - **Cache concentration.** Every fresh conversation lands where the prompt-cache pressure already is, so the spill seat's windows are fully fresh when the primary hits its wall.
 
-Alias order is the operator's knob: name seats `1-main` / `2-overflow` to pick the fill order. Strategy only decides where **unbound** conversations land — sticky bindings (below) behave identically in both modes, and a conversation bound to a seat stays there until that seat is rejected, expiring, or under the floor.
+Alias order is the operator's knob: name seats `1-main` / `2-overflow` to pick the fill order. Strategy only decides where **unbound** conversations land — sticky bindings (below) behave identically in every mode, and a conversation bound to a seat stays there until that seat is rejected, expiring, or under the floor.
+
+`--pool-strategy=expiring-first` is fill-first ordered by **when each seat's capacity expires** instead of by alias: new conversations fill the seat whose 7-day window resets soonest (`anthropic-ratelimit-unified-7d-reset`) until it drains to the floor, then spill to the next-soonest; failover follows the same order. Subscription capacity is use-it-or-lose-it, so this is the order that gets the most of it used — the case it was built for is a seat that just got a limit reset, or joined the pool mid-week, sitting beside one whose window has days left. A seat with no 7-day reading yet, or whose window has already rolled, goes last; ties break by alias, so a pool with no readings behaves exactly like fill-first.
 
 ## Session stickiness
 

package/docs/pool-keys-and-analytics.md

@@ -21,7 +21,7 @@ Three things it does that a round-robin doesn't:
 
 <img src="../.github/readme/pool.jpg" alt="Three pooled seats, work, personal and side, each with a headroom bar. dario routes the request to the seat with the most headroom." width="100%">
 
-`--pool-strategy=fill-first` concentrates new conversations on one seat until it drains, for primary/backup setups. `--pool-headroom-floor=5%` (env `DARIO_POOL_HEADROOM_FLOOR`, config `pool.headroomFloor`; default 2%) moves the line at which a seat counts as drained: a sticky session rebinds off it and new conversations skip it once its headroom is at or below the floor, so a seat that answers with API errors in its last percent is left alone before the 429, not at it. Refresh tokens expire about 28 days after the original grant regardless of rotation, so every seat's grant age is tracked and surfaced in `dario accounts list`, `dario doctor` and `GET /accounts` before it becomes a silent outage. Provision over HTTP with the headless [admin API](admin-api.md); pin one request to one seat with `dario accounts check <alias>` (admin API required: `DARIO_ADMIN=1` and a `DARIO_ADMIN_TOKEN`). Internals and the live `/accounts` + `/analytics` endpoints: [multi-account-pool.md](multi-account-pool.md); covered end-to-end by [`test/pool-e2e.mjs`](../test/pool-e2e.mjs).
+`--pool-strategy=fill-first` concentrates new conversations on one seat until it drains, for primary/backup setups; `--pool-strategy=expiring-first` fills in order of each seat's 7-day reset, soonest first, so capacity that expires soonest is spent first. `--pool-headroom-floor=5%` (env `DARIO_POOL_HEADROOM_FLOOR`, config `pool.headroomFloor`; default 2%) moves the line at which a seat counts as drained: a sticky session rebinds off it and new conversations skip it once its headroom is at or below the floor, so a seat that answers with API errors in its last percent is left alone before the 429, not at it. Refresh tokens expire about 28 days after the original grant regardless of rotation, so every seat's grant age is tracked and surfaced in `dario accounts list`, `dario doctor` and `GET /accounts` before it becomes a silent outage. Provision over HTTP with the headless [admin API](admin-api.md); pin one request to one seat with `dario accounts check <alias>` (admin API required: `DARIO_ADMIN=1` and a `DARIO_ADMIN_TOKEN`). Internals and the live `/accounts` + `/analytics` endpoints: [multi-account-pool.md](multi-account-pool.md); covered end-to-end by [`test/pool-e2e.mjs`](../test/pool-e2e.mjs).
 
 ## One key per developer
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.10.5",
+  "version": "6.11.0",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {