@askalf/dario 6.14.0 → 6.14.1

package/dist/family-fallback.d.ts

@@ -25,6 +25,12 @@ export declare function parseFamilyFallback(spec: string | Record<string, unknow
  *
  * A `[1m]` long-context tag on the request is carried onto the target when the
  * target has none, so the switch does not shrink the context window asked for.
+ *
+ * A model name that is not printable ASCII (at most 256 characters, no spaces
+ * or control characters) is left alone: no real model is named so, and the
+ * name the client sent is echoed in the `x-dario-family-fallback` header and
+ * the log, where a line break would fail the header (setHeader throws, the
+ * request errors) or forge a log line.
  */
 export declare function familyFallbackModel(map: FamilyFallbackMap, model: string, pool: {
     parked: (family: string) => boolean;

package/dist/family-fallback.js

@@ -64,10 +64,18 @@ export function parseFamilyFallback(spec) {
  *
  * A `[1m]` long-context tag on the request is carried onto the target when the
  * target has none, so the switch does not shrink the context window asked for.
+ *
+ * A model name that is not printable ASCII (at most 256 characters, no spaces
+ * or control characters) is left alone: no real model is named so, and the
+ * name the client sent is echoed in the `x-dario-family-fallback` header and
+ * the log, where a line break would fail the header (setHeader throws, the
+ * request errors) or forge a log line.
  */
 export function familyFallbackModel(map, model, pool) {
     if (map.size === 0)
         return null;
+    if (!/^[\x21-\x7e]{1,256}$/.test(model))
+        return null;
     const family = modelFamily(model);
     if (!family)
         return null;

package/dist/pool.js

@@ -341,6 +341,14 @@ export function withParkedBuckets(prev, next, now = Date.now()) {
  */
 export function isParkedInLiveWindow(account, now = Date.now(), family) {
     const rl = account.rateLimit;
+    // A bucket the seat was parked on, carried past a reading that did not
+    // measure it (an Opus 200, or an Opus 429 that named no exhausted window,
+    // after a Fable credit 429; see withParkedBuckets): whatever the seat's
+    // status says now, the bucket's reset is still ahead and a probe for a
+    // family it binds can only 429 again. The bucket-scoped rejection itself is
+    // decided below, where a 429 with no stated reset stays probeable.
+    if (!isBucketScopedRejection(rl) && familyParkedOnBuckets(rl, family, now))
+        return true;
     // A non-exhausted rejection is never "parked in a live window": its reset
     // was not this seat's window, and once its cool-down passes asking is the
     // way back (the all-exhausted branch may probe it even sooner).
@@ -1146,7 +1154,7 @@ export class AccountPool {
         // reported, or cooled, as if they were.
         const until = all.map((a) => {
             if (isParkedInLiveWindow(a, now, family)) {
-                return isBucketScopedRejection(a.rateLimit)
+                return familyParkedOnBuckets(a.rateLimit, family, now)
                     ? (a.rateLimit.parkedBucketsUntil ?? a.rateLimit.reset * 1000)
                     : a.rateLimit.reset * 1000;
             }
@@ -1348,7 +1356,9 @@ export class AccountPool {
             : exhausted
                 ? { ...merged, status: 'rejected', exhausted: true, parkedBuckets: undefined, parkedBucketsUntil: undefined }
                 : {
-                    ...merged,
+                    // Not a window, so not this seat's buckets either: a bucket parked
+                    // before it stays parked, as across any reading that did not measure it.
+                    ...withParkedBuckets(account.rateLimit, merged, now),
                     status: 'rejected',
                     exhausted: false,
                     cooldownUntil: now + (snapshot.retryAfterMs ?? NON_WINDOW_REJECTION_COOLDOWN_MS),

package/docs/multi-account-pool.md

@@ -124,6 +124,8 @@ curl http://localhost:3456/analytics    # per-account / per-model stats, burn ra
 
 **When every seat is parked.** A pool whose seats are all `rejected` inside live windows does not probe them again: dario answers the request itself with `429`, `retry-after` set to the earliest reset, `x-dario-upstream-rejection: pool_parked`, and nothing sent upstream. One log line marks the transition (`pool parked: all 6 seats are over their rate-limit windows, earliest resets in 21m`). Before 6.0.35 every such request re-probed the earliest-reset seat, so `rejectedCount` on that seat grew by one per request — a seat reading `rejected_count: 500` next to `request_count: 1` was that, not a seat that needed a re-login. With a `--pool-fallback` armed, the request goes to the fallback instead, as before.
 
+**A seat parked on one family's bucket stays parked for it.** A seat parked on a per-model bucket counts for the families that bucket binds even after it has served another family since: an Opus `200` (or an Opus `429` that names no exhausted window) after a Fable credit `429` does not make it probeable for Fable again before the bucket resets.
+
 **Spending extra usage while the pool is parked (dario#1282).** The parked answer is decided
 from the seats' own rate-limit verdicts, before anything is sent. Disarming the overage-guard
 does **not** change it: the guard is reactive — it reads the `representative-claim` on a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.14.0",
+  "version": "6.14.1",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {