@askalf/dario 6.12.25 → 6.12.26

package/dist/accounts.js

@@ -526,7 +526,7 @@ export async function addAccountViaOAuth(alias) {
                     grantedAt: Date.now(),
                     ...profileFields(profile),
                 };
-                await saveAccount(creds);
+                await saveGrantedAccount(creds);
                 resolve(creds);
             }
             catch (err) {
@@ -663,7 +663,7 @@ export async function completeAddAccount(alias, code, codeVerifier, state) {
         grantedAt: Date.now(),
         ...profileFields(profile),
     };
-    await saveAccount(creds);
+    await saveGrantedAccount(creds);
     return creds;
 }
 export function getAccountsDir() {
@@ -935,3 +935,22 @@ export async function mirrorLoginToCredentials(refreshed) {
     });
     return 'mirrored';
 }
+/**
+ * Save an account that an OAuth grant has just produced.
+ *
+ * A grant on the `login` alias is mirrored to credentials.json at once.
+ * mirrorLoginToCredentials otherwise runs only when the pool next refreshes
+ * the seat, which is hours away after a grant, and until then every other
+ * reader of credentials.json (a co-resident Claude Code, a runner that borrows
+ * the file) holds the token of the grant that was just replaced. After a
+ * re-grant of a dead seat that token is refused upstream.
+ *
+ * Best-effort, like the mirror after a refresh: the account is already saved,
+ * and a mirror that fails must not fail the grant.
+ */
+async function saveGrantedAccount(creds) {
+    await saveAccount(creds);
+    await mirrorLoginToCredentials(creds).catch((err) => {
+        console.error(`[dario] could not mirror the granted ${creds.alias} token to credentials.json: ${err instanceof Error ? err.message : err}`);
+    });
+}

package/docs/drift-monitor.md

@@ -128,6 +128,59 @@ alongside but is not required. A red required check leaves the PR open
 with the bot branch preserved. A shape rebake (exit 2) changes the wire-shape
 contract, so a human reviews compat-test + the diff before merging.
 
+## The rebake PR
+
+On exit 2 the watcher bakes, checks the new bundle against upstream, and opens a
+`bot/template-rebake-*` PR. Three things about that PR come from the bake itself
+and not from the `--check` log:
+
+- **What changes.** `scripts/rebake-release-prep.mjs` diffs the bundle on the
+  base branch against the baked one (`describeBundleChange` in
+  `scripts/drift-report.mjs`) and writes both the CHANGELOG entry and the PR's
+  list from it. `--check` compares tool names and header order; the bake writes
+  the whole capture, so tool text and header values move with it. Those texts
+  say what the bundle holds. What a request carries also depends on the proxy,
+  which prefers a fresh live capture, sets some headers itself and manages some
+  beta flags per request.
+- **Validation.** `scripts/rebake-upstream-check.mjs` starts the checkout's
+  proxy in code (`scripts/_rebake-probe-proxy.mjs`), with the bundle as its
+  only template and the proxy's own defaults for building a request: the
+  caller's `DARIO_*` and `ANTHROPIC_*` variables and `~/.dario/config.json`
+  take no part. It sends one request for the base model and for each
+  prompt-variant family. Each request declares, by name, the bundled tools
+  whose definitions the request builder uses, so the rebuilt request carries
+  those definitions and the bundled prompt for its model. The proxy records
+  the `/v1/messages` requests it sends upstream, and the
+  script reads that record: a request that lacks the bundled prompt or a
+  declared tool's bundled definition makes the run an error, not a verdict. A
+  request passes when upstream answers 200 and bills it to the subscription,
+  and fails when upstream rejects it or bills it elsewhere. The proxy can send
+  a request again, on another seat or changed after upstream refused part of
+  it, and the last answer is the one judged. A probe the proxy did not answer
+  is an error too, and so is one the proxy answered itself for a reason that
+  is not about a seat.
+  The script borrows the subscription credential read-only
+  (`DARIO_NO_TOKEN_REFRESH=1`). A PR is opened only with a verdict, pass or
+  fail: the result is in the PR body and on the bundle's commit as the
+  `rebake/upstream` status, and a failed check adds the `upstream-check-failed`
+  label. When upstream did not judge a request (it refused the borrowed
+  token, rate-limited, failed or did not answer), or the proxy had no seat to
+  send one with (a borrowed token inside its expiry margin, or a seat inside a
+  rate-limit window), no PR is opened and the next run bakes and checks again.
+  On an error the watcher's job fails.
+- **Freshness.** A bake is a snapshot, and Claude Code's remote configuration
+  moves under a fixed version. An open rebake PR older than two hours is checked
+  against live on every watcher run, with its own bundle as the baseline. It is
+  closed, with what the check reported, when two captures in a row report drift
+  and neither is the #881 residue. A fresh bake follows when live also differs
+  from master; when live has returned to master's shape there is nothing to
+  bake. While such a PR is open each run makes one more capture pass, and a
+  second when the first reports drift.
+
+The bundle is captured from Claude Code and scrubbed by the bake. The prompts
+and tool descriptions in it are Claude Code's wording and are not edited for
+style in review: a change to them comes from a bake.
+
 ## Setting up the self-hosted runner
 
 Any dedicated Linux host works. Hetzner / DO / EC2 / etc. The runner needs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.12.25",
+  "version": "6.12.26",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {
@@ -87,7 +87,7 @@
     "node": ">=18.0.0"
   },
   "devDependencies": {
-    "@types/node": "^26.6.2",
+    "@types/node": "^26.6.4",
     "tsx": "^4.23.15",
     "typescript": "^5.7.0"
   }