@askalf/dario 6.10.6 → 6.11.1

package/README.md

@@ -64,7 +64,7 @@ Prefer Docker? `ghcr.io/askalf/dario:latest` — multi-arch (`amd64` + `arm64`),
 - **Every tool, one URL.** No per-tool keys and no second bill: anything with a base-URL setting runs on the plan you already pay for. [Per-tool setup](docs/tools.md)
 - **Either plan, either wire shape.** Your ChatGPT plan behind Claude Code and the Anthropic SDKs; Codex CLI on your Claude plan. [Two plans](docs/two-plans.md)
 - **Failover that finishes the answer.** A 429 on one plan is re-served by the other, and a stream that dies mid-answer is completed on the same model first. [Failover](docs/two-plans.md#failover-between-subscriptions)
-- **Many seats, one endpoint.** Per-model headroom routing, session-sticky prompt cache, in-flight 429 failover across every seat you hold. [The pool](docs/pool-keys-and-analytics.md)
+- **Many seats, one endpoint.** Per-model headroom routing, session-sticky prompt cache, in-flight 429 failover across every seat you hold. New conversations go to the seat with the most headroom by default; `--pool-strategy=fill-first` fills seats in alias order and `expiring-first` spends the seat whose weekly window resets soonest. The active strategy shows in the startup banner, `GET /status`, `dario doctor` and `dario accounts list`. [The pool](docs/pool-keys-and-analytics.md)
 - **One key per developer.** Named keys with a preferred seat, a model allowlist and a daily budget. [Keys](docs/pool-keys-and-analytics.md#one-key-per-developer)
 - **Knows what it saved you.** A ledger prices every request at API rates; see it in the TUI, `/analytics`, Prometheus `/metrics` and a per-request timing split. [Analytics](docs/pool-keys-and-analytics.md#what-it-would-have-cost)
 - **Tracks Claude Code on its own.** Eleven unattended watchers catch wire-shape drift and ship the fix, usually the same day. [Drift](docs/tracking-claude-code.md)

package/dist/cli.js

@@ -52,7 +52,7 @@ function readBudgetFlags(args) {
     return budget;
 }
 import { loadAllAccounts as loadAllAccountsForIdentity, regenerateClientIdentity } from './accounts.js';
-import { maskEmail, parsePoolHeadroomFloor } from './pool.js';
+import { maskEmail, parsePoolHeadroomFloor, configuredPoolRouting, describePoolStrategy } from './pool.js';
 import { realpathSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
@@ -520,11 +520,14 @@ async function proxy() {
     // `fill-first` concentrates them on the alphabetically-first eligible seat
     // until it drains to the 2% floor, then spills — primary/backup semantics,
     // alias naming (`1-main`, `2-overflow`) is the ordering knob. Sticky
-    // bindings behave identically under both.
+    // bindings behave identically under both. `expiring-first` is fill-first
+    // ordered by each seat's 7-day reset, soonest first: spend the capacity that
+    // expires soonest before touching the rest.
     const poolStrategyFromFlag = args.find((a) => a.startsWith('--pool-strategy='))?.split('=')[1];
     if (poolStrategyFromFlag !== undefined
-        && poolStrategyFromFlag !== 'headroom' && poolStrategyFromFlag !== 'fill-first') {
-        console.error(`[dario] Invalid --pool-strategy "${poolStrategyFromFlag}". Must be headroom or fill-first.`);
+        && poolStrategyFromFlag !== 'headroom' && poolStrategyFromFlag !== 'fill-first'
+        && poolStrategyFromFlag !== 'expiring-first') {
+        console.error(`[dario] Invalid --pool-strategy "${poolStrategyFromFlag}". Must be headroom, fill-first or expiring-first.`);
         process.exit(1);
     }
     const poolStrategy = poolStrategyFromFlag
@@ -1341,6 +1344,11 @@ async function accounts() {
         const loaded = await loadAllAccounts();
         const now = Date.now();
         console.log(`  Pool of ${aliases.length} (${aliases.length === 1 ? '1 account' : aliases.length + ' accounts'})`);
+        {
+            const { loadConfig } = await import('./config-file.js');
+            const routing = configuredPoolRouting(loadConfig().config.pool);
+            console.log(`  Routing: ${describePoolStrategy(routing.strategy, routing.headroomFloor)}`);
+        }
         if (aliases.length === 1) {
             console.log('  (A pool of one — add another with `dario accounts add <alias>` to load-balance.)');
         }
@@ -2171,13 +2179,15 @@ async function help() {
                              dario returns 504 "queue-timeout"
                              (default: 60000).
                              Env: DARIO_QUEUE_TIMEOUT_MS. (dario#80)
-    --pool-strategy=<headroom|fill-first>
+    --pool-strategy=<headroom|fill-first|expiring-first>
                              Where new conversations land in a multi-
                              account pool. headroom (default) spreads
                              them to the seat with the most slack;
                              fill-first concentrates them on the
                              alphabetically-first eligible seat until
-                             it drains to the 2% floor, then spills.
+                             it drains to the floor, then spills;
+                             expiring-first does the same in order of
+                             each seat's 7-day reset, soonest first.
                              Sticky bindings are unaffected.
                              Env: DARIO_POOL_STRATEGY.
     --pool-headroom-floor=<ratio|percent>

package/dist/config-file.d.ts

@@ -86,8 +86,10 @@ export interface DarioConfig {
          * most headroom; `fill-first` concentrates them on the alphabetically-
          * first eligible seat until it drains to the 2% floor, then spills to
          * the next — primary/backup semantics, alias order is the knob.
+         * `expiring-first` is fill-first ordered by each seat's 7-day reset,
+         * soonest first.
          */
-        strategy?: 'headroom' | 'fill-first';
+        strategy?: 'headroom' | 'fill-first' | 'expiring-first';
         /** Headroom at/below which a seat counts as drained — ratio 0.02..0.5 (dario#1333). */
         headroomFloor?: number;
     };

package/dist/config-file.js

@@ -308,7 +308,8 @@ function sanitize(parsed) {
     }
     if (isPlainObject(parsed.pool)) {
         out.pool = {};
-        if (parsed.pool.strategy === 'headroom' || parsed.pool.strategy === 'fill-first') {
+        if (parsed.pool.strategy === 'headroom' || parsed.pool.strategy === 'fill-first'
+            || parsed.pool.strategy === 'expiring-first') {
             out.pool.strategy = parsed.pool.strategy;
         }
         if (typeof parsed.pool.headroomFloor === 'number' && Number.isFinite(parsed.pool.headroomFloor)) {

package/dist/doctor-core.js

@@ -1132,8 +1132,13 @@ export async function runChecks(opts = {}) {
             // (v5.0): it confirms the sole account is eligible, not rejected.
             if (aliases.length >= 1) {
                 try {
-                    const { AccountPool } = await import('./pool.js');
-                    const pool = new AccountPool();
+                    const { AccountPool, configuredPoolRouting, describePoolStrategy } = await import('./pool.js');
+                    const { loadConfig } = await import('./config-file.js');
+                    // The preview must use the strategy the proxy will run, not the
+                    // default: `new AccountPool()` here always predicted a max-headroom
+                    // pick, which is the wrong seat on a fill-first pool.
+                    const routing = configuredPoolRouting(loadConfig().config.pool);
+                    const pool = new AccountPool(routing.strategy, routing.headroomFloor);
                     for (const acc of loaded) {
                         pool.add(acc.alias, {
                             accessToken: acc.accessToken,
@@ -1148,9 +1153,10 @@ export async function runChecks(opts = {}) {
                     checks.push({
                         status: 'info',
                         label: 'Pool routing',
-                        detail: next
-                            ? `next: ${next.alias}  (max-headroom select; ${ps.healthy}/${ps.accounts} healthy)`
-                            : `no eligible account — all rejected or near-expiry (${ps.exhausted}/${ps.accounts} exhausted)`,
+                        detail: (next
+                            ? `next: ${next.alias}  (${ps.healthy}/${ps.accounts} healthy)`
+                            : `no eligible account — all rejected or near-expiry (${ps.exhausted}/${ps.accounts} exhausted)`)
+                            + ` · ${describePoolStrategy(routing.strategy, routing.headroomFloor)} (env/config; a running proxy's --pool-strategy flag shows in GET /status)`,
                     });
                 }
                 catch (err) {

package/dist/pool.d.ts

@@ -33,6 +33,14 @@ export interface RateLimitSnapshot {
      * were on the response.
      */
     perModel7d: Record<string, number>;
+    /**
+     * Epoch SECONDS the seat's own 7-day window resets at, from
+     * `anthropic-ratelimit-unified-7d-reset`; 0 when the response did not carry
+     * it. Distinct from `reset`, which is the representative claim's reset (on
+     * most responses the five-hour one). `expiring-first` orders seats by it:
+     * capacity that expires soonest is spent first.
+     */
+    reset7d?: number;
     overageUtil: number;
     claim: string;
     reset: number;
@@ -361,6 +369,10 @@ export declare function isProbeable(account: PoolAccount, now?: number, family?:
  */
 export declare function accountAction(account: PoolAccount, now?: number): 'none' | 'wait' | 'regrant';
 export interface PoolStatus {
+    /** The routing strategy in force for new conversations. */
+    strategy: PoolStrategy;
+    /** Headroom at/below which a seat counts as drained (ratio). */
+    headroomFloor: number;
     accounts: number;
     healthy: number;
     exhausted: number;
@@ -385,7 +397,18 @@ export interface PoolStatus {
  * pick the fill order. Sticky bindings behave identically in both modes;
  * strategy only decides where UNBOUND (new) conversations land.
  */
-export type PoolStrategy = 'headroom' | 'fill-first';
+export type PoolStrategy = 'headroom' | 'fill-first' | 'expiring-first';
+/**
+ * `expiring-first` — fill-first, ordered by WHEN each seat's capacity expires
+ * instead of by alias: new conversations fill the seat whose 7-day window
+ * resets soonest until it drains to the floor, then spill to the next-soonest.
+ * Subscription capacity is use-it-or-lose-it; spending the soonest-expiring
+ * first is what gets the most of it used. Fleet box, 2026-09-22: seat pro1 got
+ * a fresh limit reset expiring in ~50h while login's window had ~70h left, and
+ * alias-ordered fill-first kept every new conversation on login. A seat with
+ * no 7d reading yet (or whose window has already rolled) goes last; ties break
+ * by alias. Sticky bindings behave identically.
+ */
 /**
  * Resolve the pool strategy from an explicit value (CLI flag / config file,
  * already precedence-merged by the caller) with `DARIO_POOL_STRATEGY` as
@@ -394,6 +417,27 @@ export type PoolStrategy = 'headroom' | 'fill-first';
  * in this codebase (see resolveSessionRotationConfig).
  */
 export declare function resolvePoolStrategy(explicit?: string | null, env?: NodeJS.ProcessEnv): PoolStrategy;
+/**
+ * One line saying where new conversations go, for every surface that names the
+ * strategy (startup banner, `dario doctor`, `dario accounts list`). The running
+ * strategy used to be invisible: the banner printed it only when it was NOT the
+ * default, and nothing else reported it, so a deployment whose compose file
+ * overrode the default ran that way unnoticed (fleet box, 2026-09-22).
+ */
+export declare function describePoolStrategy(strategy: PoolStrategy, floor?: number): string;
+/**
+ * The strategy and floor a proxy started with no flags would run with, for
+ * commands that do not run the proxy (`doctor`, `accounts list`): env first,
+ * then the config file, then the defaults — the proxy's own order minus the
+ * CLI flag, which only the running process knows (GET /status reports it).
+ */
+export declare function configuredPoolRouting(file: {
+    strategy?: string;
+    headroomFloor?: number;
+} | undefined, env?: NodeJS.ProcessEnv): {
+    strategy: PoolStrategy;
+    headroomFloor: number;
+};
 /**
  * Which wire buckets bind which model family, when the wire does not say it
  * by name. `7d_sonnet` names its family; `7d_oi` does not — it is the plan's
@@ -550,8 +594,14 @@ export declare function parsePoolHeadroomFloor(value: string | number | null | u
  * default, matching `resolvePoolStrategy`.
  */
 export declare function resolvePoolHeadroomFloor(explicit?: string | number | null, env?: NodeJS.ProcessEnv): number;
+/**
+ * The 7-day reset `expiring-first` orders by, in epoch ms: the seat's own
+ * reading while it is still ahead of `now`, else +Infinity (never read, or the
+ * window has rolled and the next reset is unknown), which sorts it last.
+ */
+export declare function seatExpiry(account: PoolAccount, now?: number): number;
 export declare class AccountPool {
-    private readonly strategy;
+    readonly strategy: PoolStrategy;
     /** Headroom at/below which a seat counts as drained — see DEFAULT_POOL_HEADROOM_FLOOR. */
     readonly headroomFloor: number;
     private accounts;

package/dist/pool.js

@@ -400,6 +400,17 @@ export function accountAction(account, now = Date.now()) {
         return 'wait';
     return 'none';
 }
+/**
+ * `expiring-first` — fill-first, ordered by WHEN each seat's capacity expires
+ * instead of by alias: new conversations fill the seat whose 7-day window
+ * resets soonest until it drains to the floor, then spill to the next-soonest.
+ * Subscription capacity is use-it-or-lose-it; spending the soonest-expiring
+ * first is what gets the most of it used. Fleet box, 2026-09-22: seat pro1 got
+ * a fresh limit reset expiring in ~50h while login's window had ~70h left, and
+ * alias-ordered fill-first kept every new conversation on login. A seat with
+ * no 7d reading yet (or whose window has already rolled) goes last; ties break
+ * by alias. Sticky bindings behave identically.
+ */
 /**
  * Resolve the pool strategy from an explicit value (CLI flag / config file,
  * already precedence-merged by the caller) with `DARIO_POOL_STRATEGY` as
@@ -412,11 +423,41 @@ export function resolvePoolStrategy(explicit, env = process.env) {
         if (typeof c !== 'string')
             continue;
         const s = c.trim().toLowerCase();
-        if (s === 'headroom' || s === 'fill-first')
+        if (s === 'headroom' || s === 'fill-first' || s === 'expiring-first')
             return s;
     }
     return 'headroom';
 }
+/**
+ * One line saying where new conversations go, for every surface that names the
+ * strategy (startup banner, `dario doctor`, `dario accounts list`). The running
+ * strategy used to be invisible: the banner printed it only when it was NOT the
+ * default, and nothing else reported it, so a deployment whose compose file
+ * overrode the default ran that way unnoticed (fleet box, 2026-09-22).
+ */
+export function describePoolStrategy(strategy, floor = DEFAULT_POOL_HEADROOM_FLOOR) {
+    const pct = `${Math.round(floor * 100)}% floor`;
+    switch (strategy) {
+        case 'fill-first':
+            return `fill-first — new conversations fill the alphabetically-first seat until the ${pct}, then spill`;
+        case 'expiring-first':
+            return `expiring-first — new conversations fill the seat whose 7-day window resets soonest until the ${pct}, then spill`;
+        default:
+            return `headroom (default) — new conversations go to the seat with the most headroom; ${pct}`;
+    }
+}
+/**
+ * The strategy and floor a proxy started with no flags would run with, for
+ * commands that do not run the proxy (`doctor`, `accounts list`): env first,
+ * then the config file, then the defaults — the proxy's own order minus the
+ * CLI flag, which only the running process knows (GET /status reports it).
+ */
+export function configuredPoolRouting(file, env = process.env) {
+    return {
+        strategy: resolvePoolStrategy(env.DARIO_POOL_STRATEGY ?? file?.strategy, env),
+        headroomFloor: resolvePoolHeadroomFloor(env.DARIO_POOL_HEADROOM_FLOOR ?? file?.headroomFloor, env),
+    };
+}
 /**
  * Match `anthropic-ratelimit-unified-7d_<family>-utilization`. Generic on
  * `<family>` so a future `7d_opus` / `7d_haiku` (or anything Anthropic
@@ -534,6 +575,7 @@ export function parseRateLimits(headers, family) {
         status: get('status') || 'unknown',
         util5h: parseFloat(get('5h-utilization')) || 0,
         util7d: parseFloat(get('7d-utilization')) || 0,
+        reset7d: parseInt(get('7d-reset'), 10) || 0,
         perModel7d,
         overageUtil: parseFloat(get('overage-utilization')) || 0,
         claim: get('representative-claim') || 'unknown',
@@ -797,6 +839,23 @@ function pickMaxHeadroom(accounts, family) {
 // readdir whose order the OS doesn't guarantee, and the operator can control
 // alias names but not readdir. Returns null when every candidate is at/below
 // the floor so the caller can fall back to max-headroom.
+/**
+ * The 7-day reset `expiring-first` orders by, in epoch ms: the seat's own
+ * reading while it is still ahead of `now`, else +Infinity (never read, or the
+ * window has rolled and the next reset is unknown), which sorts it last.
+ */
+export function seatExpiry(account, now = Date.now()) {
+    const r = (account.rateLimit.reset7d ?? 0) * 1000;
+    return r > now ? r : Number.POSITIVE_INFINITY;
+}
+function pickExpiringFirst(accounts, family, floor = DEFAULT_POOL_HEADROOM_FLOOR, now = Date.now()) {
+    const order = [...accounts].sort((a, b) => (seatExpiry(a, now) - seatExpiry(b, now)) || (a.alias < b.alias ? -1 : a.alias > b.alias ? 1 : 0));
+    for (const a of order) {
+        if (computeHeadroom(a.rateLimit, family) > floor)
+            return a;
+    }
+    return null;
+}
 function pickFillFirst(accounts, family, floor = DEFAULT_POOL_HEADROOM_FLOOR) {
     let best = null;
     for (const a of accounts) {
@@ -932,8 +991,10 @@ export class AccountPool {
         const all = [...this.accounts.values()];
         const eligible = all.filter(a => isAccountEligible(a, now, family));
         if (eligible.length > 0) {
-            if (this.strategy === 'fill-first') {
-                const first = pickFillFirst(eligible, family, this.headroomFloor);
+            if (this.strategy === 'fill-first' || this.strategy === 'expiring-first') {
+                const first = this.strategy === 'fill-first'
+                    ? pickFillFirst(eligible, family, this.headroomFloor)
+                    : pickExpiringFirst(eligible, family, this.headroomFloor, now);
                 if (first)
                     return first;
                 // Every eligible account is at/below the floor — the terminal state
@@ -1099,8 +1160,10 @@ export class AccountPool {
             // after a 429 is the next alias in line, not the max-headroom seat —
             // otherwise a single failover would defeat the concentration the
             // strategy exists to provide.
-            if (this.strategy === 'fill-first') {
-                const first = pickFillFirst(eligible, family, this.headroomFloor);
+            if (this.strategy === 'fill-first' || this.strategy === 'expiring-first') {
+                const first = this.strategy === 'fill-first'
+                    ? pickFillFirst(eligible, family, this.headroomFloor)
+                    : pickExpiringFirst(eligible, family, this.headroomFloor, now);
                 if (first)
                     return first;
             }
@@ -1120,7 +1183,12 @@ export class AccountPool {
         const account = this.accounts.get(alias);
         if (!account)
             return;
-        account.rateLimit = withParkedBuckets(account.rateLimit, withBoundBuckets(account.rateLimit, snapshot), snapshot.updatedAt || Date.now());
+        const at = snapshot.updatedAt || Date.now();
+        // A reading without the 7d-reset header does not un-learn it while it is
+        // still ahead: expiring-first would otherwise send the seat to the back.
+        const prevReset7d = account.rateLimit.reset7d ?? 0;
+        const next = !snapshot.reset7d && prevReset7d * 1000 > at ? { ...snapshot, reset7d: prevReset7d } : snapshot;
+        account.rateLimit = withParkedBuckets(account.rateLimit, withBoundBuckets(account.rateLimit, next), at);
         account.adoptedFrom = undefined;
         account.requestCount++;
     }
@@ -1226,6 +1294,8 @@ export class AccountPool {
         const avgHeadroom = headrooms.length > 0 ? headrooms.reduce((a, b) => a + b, 0) / headrooms.length : 0;
         const best = this.select();
         return {
+            strategy: this.strategy,
+            headroomFloor: this.headroomFloor,
             accounts: all.length,
             healthy: healthy.length,
             exhausted: all.length - healthy.length,

package/dist/proxy.js

@@ -13,7 +13,7 @@ import { CC_TOOL_DEFINITIONS_UNADVERTISABLE, CC_TEMPLATE_PROMPT_BYTES, resolveMa
 import { stampCch, hasCchSeed } from './cch.js';
 import { foldTiming, timingHeaders, timingLogFields } from './timing.js';
 import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion } from './live-fingerprint.js';
-import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, activeParkedBuckets, reconcilePoolAccounts, resolvePoolStrategy, resolvePoolHeadroomFloor, DEFAULT_POOL_HEADROOM_FLOOR, utilFreshness, rateLimitWindow, accountAction, accountPeers, distinctAccounts, describeRejection, maskEmail, isAccountEligible } from './pool.js';
+import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, activeParkedBuckets, reconcilePoolAccounts, resolvePoolStrategy, resolvePoolHeadroomFloor, describePoolStrategy, DEFAULT_POOL_HEADROOM_FLOOR, utilFreshness, rateLimitWindow, accountAction, accountPeers, distinctAccounts, describeRejection, maskEmail, isAccountEligible } from './pool.js';
 import { backfillIdentity } from './accounts.js';
 import { PoolSync, DEFAULT_POOL_SYNC_INTERVAL_MS } from './pool-sync.js';
 import { Analytics, billingBucketFromClaim, costOfTokens, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, CODEX_CLAIM } from './analytics.js';
@@ -1521,9 +1521,9 @@ export async function startProxy(opts = {}) {
     if (opts.poolSharedState && !poolSync) {
         console.error('[dario] --pool-shared-state needs DARIO_REFRESH_LOCK_URL (the lock service carries the shared state) — running with this instance\'s own state');
     }
-    if (poolStrategy !== 'headroom') {
-        console.log(`  Pool strategy: ${poolStrategy} (new conversations fill the alphabetically-first seat, spill at the 2% floor)`);
-    }
+    // Always named, the default included: a deployment that overrides the
+    // default should be visible at a glance, and one that does not should say so.
+    console.log(`  Pool strategy: ${describePoolStrategy(poolStrategy, pool.headroomFloor)}`);
     if (poolSync) {
         console.log(`  Pool shared state: on (instance ${poolSync.instance}, via ${lockUrl}, pulling peers every ${poolSync.intervalMs}ms; fails open)`);
         poolSync.start();
@@ -2679,7 +2679,14 @@ export async function startProxy(opts = {}) {
             // Version for auto-update checks (#640) — /status is key-gated (loopback
             // or DARIO_API_KEY), so no public-disclosure concern like /health has.
             res.writeHead(200, JSON_HEADERS);
-            res.end(JSON.stringify({ version: darioVersion(), ...s }));
+            res.end(JSON.stringify({
+                version: darioVersion(),
+                ...s,
+                // The routing the running process uses — the only surface that can
+                // report a --pool-strategy flag (doctor and `accounts list` read env
+                // and config). null with no pool.
+                pool: pool.size > 0 ? { strategy: pool.strategy, headroomFloor: pool.headroomFloor, accounts: pool.size } : null,
+            }));
             return;
         }
         // Pool status endpoint — shows loaded accounts, headroom, and the

package/dist/tui/tabs/config.js

@@ -38,7 +38,7 @@ const FIELDS = [
     { path: 'thinkTime.maxMs', label: 'Think-time cap (ms)', type: 'number', hint: 'upper bound for the whole formula' },
     { path: 'sessionStart.minMs', label: 'Session-start min', type: 'number', hint: 'first-request delay floor' },
     { path: 'sessionStart.jitterMs', label: 'Session-start jitter', type: 'number' },
-    { path: 'pool.strategy', label: 'Pool strategy', type: 'string', hint: '"headroom" (default) or "fill-first"' },
+    { path: 'pool.strategy', label: 'Pool strategy', type: 'string', hint: '"headroom" (default), "expiring-first" or "fill-first"' },
     // ── Overage-guard (v4.1, dario#288) ─────────────────────────
     { path: 'overageGuard.enabled', label: 'Overage-guard', type: 'bool', hint: 'halt proxy on any representative-claim=overage' },
     { path: 'overageGuard.behavior', label: 'Overage behavior', type: 'string', hint: '"halt" (default) or "warn"' },
@@ -271,7 +271,7 @@ function commitEdit(state) {
  */
 const STRING_ENUMS = {
     'overageGuard.behavior': ['halt', 'warn'],
-    'pool.strategy': ['headroom', 'fill-first'],
+    'pool.strategy': ['headroom', 'fill-first', 'expiring-first'],
 };
 function doSave(state) {
     try {

package/docs/commands.md

@@ -51,7 +51,7 @@ This page is the per-flag reference. For environment variables grouped by task
 | `--session-rotate-jitter=<ms>` / `DARIO_SESSION_JITTER_MS` | Jitter sampled once per session at creation — hides the exact idle floor. (v3.28) | `0` |
 | `--session-max-age=<ms>` / `DARIO_SESSION_MAX_AGE_MS` | Hard ceiling on a session-id's lifetime regardless of activity. (v3.28) | off |
 | `--session-per-client` / `DARIO_SESSION_PER_CLIENT=1` | Split session-id registry by a per-client header so multi-UI fan-out doesn't collapse onto one id. (v3.28) | off |
-| `--pool-strategy=<headroom\|fill-first>` / `DARIO_POOL_STRATEGY` | Where new conversations land in a multi-account pool. `headroom` spreads them to the seat with the most slack; `fill-first` concentrates them on the alphabetically-first eligible seat until it drains to the 2% floor, then spills to the next — primary/backup semantics, alias naming (`1-main`, `2-overflow`) picks the fill order. Sticky bindings behave identically under both. See [Multi-account pool](./multi-account-pool.md#routing-strategy). | `headroom` |
+| `--pool-strategy=<headroom\|fill-first\|expiring-first>` / `DARIO_POOL_STRATEGY` | Where new conversations land in a multi-account pool. `headroom` spreads them to the seat with the most slack; `fill-first` concentrates them on the alphabetically-first eligible seat until it drains to the floor, then spills to the next — primary/backup semantics, alias naming (`1-main`, `2-overflow`) picks the fill order; `expiring-first` does the same in order of each seat's 7-day reset, soonest first, so capacity that expires soonest is spent first. Sticky bindings behave identically under all three. See [Multi-account pool](./multi-account-pool.md#routing-strategy). | `headroom` |
 | `--pool-fallback=<models>` / `DARIO_POOL_FALLBACK` / config `poolFallback.model` | Strictly opt-in. When every pool seat is drained or in auth cool-down (at selection, or mid-flight on a 429 with no peer left), serve the request as `<model>` from whichever provider can, instead of surfacing the 429/503. Accepts a **chain** — `gpt-5.6-sol,claude-sonnet-5` — read left to right, each provider taking the first entry it can serve. A Codex/ChatGPT subscription that lists the model is preferred (no per-token cost) and works on **both** wire shapes; otherwise a configured openai-compat backend, which is still OpenAI-path only (no Messages translation on that route). A chain also makes failover **symmetric**: a rate-limited or failing subscription hands the request back to the Claude pool. Only a 429/5xx fails over — a 400 surfaces, since a bad request would just reproduce itself elsewhere. Every substituted response carries `x-dario-pool-fallback: <model>` — never silent. Needs a Codex account (`dario add altman`) or a backend (`dario backend add …`); `dario doctor` reports it as INERT with neither. Empty pool still 503s (setup error, not traffic to re-bill). Empty flag value disables, overriding env + config. See [Pool-exhausted fallback](./multi-account-pool.md#pool-exhausted-fallback). | off |
 | `--system-prompt=<verbatim\|partial\|aggressive\|filepath>` / `DARIO_SYSTEM_PROMPT` | System-prompt mode for outbound CC-shaped requests. `partial` strips behavioral constraints (Tone-and-style, Text-output, scope/verbosity/comment bullets) for ~1.2–2.8× output capability on open-ended work. `aggressive` adds prompt-level RLHF restatement removal (<3% over partial — alignment is RLHF-trained). `<filepath>` fully replaces the slot with file contents. Empirically validated as unfingerprinted by the billing classifier — see [`system-prompt.md`](./system-prompt.md) and [`research/system-prompt-classifier-study.md`](./research/system-prompt-classifier-study.md). (v3.34) | `verbatim` |
 | `--upstream-proxy=<url>` / `--via=<url>` / `DARIO_UPSTREAM_PROXY` | Route dario's outbound fetches (api.anthropic.com, OpenAI-compat backends, OAuth) through an HTTP/HTTPS proxy. Pair with the HTTP proxy mode of a VPN provider (Mullvad, AirVPN), a corporate proxy, privoxy/Tor, etc. Localhost calls bypass. Requires Bun runtime; SOCKS5 not supported. Full provider matrix + setup in [`vpn-routing.md`](./vpn-routing.md). (v3.35) | unset |

package/docs/multi-account-pool.md

@@ -29,7 +29,9 @@ Two situations where that beats spreading:
 - **Primary/backup seats.** A `z-backup` account stays completely untouched — fresh 5h and 7d windows — until `a-main` is actually drained. Headroom spreading would nibble at both from the first request.
 - **Cache concentration.** Every fresh conversation lands where the prompt-cache pressure already is, so the spill seat's windows are fully fresh when the primary hits its wall.
 
-Alias order is the operator's knob: name seats `1-main` / `2-overflow` to pick the fill order. Strategy only decides where **unbound** conversations land — sticky bindings (below) behave identically in both modes, and a conversation bound to a seat stays there until that seat is rejected, expiring, or under the floor.
+Alias order is the operator's knob: name seats `1-main` / `2-overflow` to pick the fill order. Strategy only decides where **unbound** conversations land — sticky bindings (below) behave identically in every mode, and a conversation bound to a seat stays there until that seat is rejected, expiring, or under the floor.
+
+`--pool-strategy=expiring-first` is fill-first ordered by **when each seat's capacity expires** instead of by alias: new conversations fill the seat whose 7-day window resets soonest (`anthropic-ratelimit-unified-7d-reset`) until it drains to the floor, then spill to the next-soonest; failover follows the same order. Subscription capacity is use-it-or-lose-it, so this is the order that gets the most of it used — the case it was built for is a seat that just got a limit reset, or joined the pool mid-week, sitting beside one whose window has days left. A seat with no 7-day reading yet, or whose window has already rolled, goes last; ties break by alias, so a pool with no readings behaves exactly like fill-first.
 
 ## Session stickiness
 

package/docs/pool-keys-and-analytics.md

@@ -21,7 +21,7 @@ Three things it does that a round-robin doesn't:
 
 <img src="../.github/readme/pool.jpg" alt="Three pooled seats, work, personal and side, each with a headroom bar. dario routes the request to the seat with the most headroom." width="100%">
 
-`--pool-strategy=fill-first` concentrates new conversations on one seat until it drains, for primary/backup setups. `--pool-headroom-floor=5%` (env `DARIO_POOL_HEADROOM_FLOOR`, config `pool.headroomFloor`; default 2%) moves the line at which a seat counts as drained: a sticky session rebinds off it and new conversations skip it once its headroom is at or below the floor, so a seat that answers with API errors in its last percent is left alone before the 429, not at it. Refresh tokens expire about 28 days after the original grant regardless of rotation, so every seat's grant age is tracked and surfaced in `dario accounts list`, `dario doctor` and `GET /accounts` before it becomes a silent outage. Provision over HTTP with the headless [admin API](admin-api.md); pin one request to one seat with `dario accounts check <alias>` (admin API required: `DARIO_ADMIN=1` and a `DARIO_ADMIN_TOKEN`). Internals and the live `/accounts` + `/analytics` endpoints: [multi-account-pool.md](multi-account-pool.md); covered end-to-end by [`test/pool-e2e.mjs`](../test/pool-e2e.mjs).
+`--pool-strategy=fill-first` concentrates new conversations on one seat until it drains, for primary/backup setups; `--pool-strategy=expiring-first` fills in order of each seat's 7-day reset, soonest first, so capacity that expires soonest is spent first. `--pool-headroom-floor=5%` (env `DARIO_POOL_HEADROOM_FLOOR`, config `pool.headroomFloor`; default 2%) moves the line at which a seat counts as drained: a sticky session rebinds off it and new conversations skip it once its headroom is at or below the floor, so a seat that answers with API errors in its last percent is left alone before the 429, not at it. Refresh tokens expire about 28 days after the original grant regardless of rotation, so every seat's grant age is tracked and surfaced in `dario accounts list`, `dario doctor` and `GET /accounts` before it becomes a silent outage. Provision over HTTP with the headless [admin API](admin-api.md); pin one request to one seat with `dario accounts check <alias>` (admin API required: `DARIO_ADMIN=1` and a `DARIO_ADMIN_TOKEN`). Internals and the live `/accounts` + `/analytics` endpoints: [multi-account-pool.md](multi-account-pool.md); covered end-to-end by [`test/pool-e2e.mjs`](../test/pool-e2e.mjs).
 
 ## One key per developer
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.10.6",
+  "version": "6.11.1",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {