@askalf/dario 6.18.4 → 6.19.1

package/dist/proxy.js

@@ -20,6 +20,7 @@ import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion }
 import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, activeParkedBuckets, reconcilePoolAccounts, resolvePoolStrategy, resolvePoolHeadroomFloor, parsePoolHeadroomFloor, describePoolStrategy, utilFreshness, rateLimitWindow, accountAction, accountPeers, distinctAccounts, describeRejection, maskEmail } from './pool.js';
 import { backfillIdentity } from './accounts.js';
 import { PoolSync, DEFAULT_POOL_SYNC_INTERVAL_MS } from './pool-sync.js';
+import { AccountSync, DEFAULT_ACCOUNT_SYNC_INTERVAL_MS } from './account-sync.js';
 import { Analytics, billingBucketFromClaim, costOfTokensFailClosed, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, CODEX_CLAIM, CREDITS_CLAIM } from './analytics.js';
 import { Ledger, resolveLedgerPath, ledgerDisabledByEnv } from './ledger.js';
 import { renderPrometheus } from './metrics.js';
@@ -29,7 +30,7 @@ import { OverageGuard, buildHaltErrorBody } from './overage-guard.js';
 import { notify as osNotify } from './notify.js';
 import { grantAge, grantThresholds, worstGrantLevel, describeGrantAge } from './refresh-grant.js';
 import { resolveSeatPin, SEAT_PIN_HEADER, SEAT_PIN_TOKEN_HEADER } from './seat-pin.js';
-import { loadAllAccounts, loadAccount, saveAccount, refreshAccountToken, resyncLoginFromCredentialsIfStale, ensureLoginCredentialsInPool, mirrorLoginToCredentials, withObservedOrganization } from './accounts.js';
+import { loadAllAccounts, loadAccount, saveAccount, refreshAccountToken, adoptSharedCredentials, credentialsAreNewer, grantedAfter, localAccountRemovals, resyncLoginFromCredentialsIfStale, ensureLoginCredentialsInPool, MIGRATED_LOGIN_ALIAS, mirrorLoginToCredentials, withObservedOrganization } from './accounts.js';
 import { handleAdminRequest } from './admin-api.js';
 import { createTokenBucket } from './rate-limit.js';
 import { getOpenAIBackend, isOpenAIModel, forwardToOpenAI, isMiniMaxBackend, MINIMAX_MODELS } from './openai-backend.js';
@@ -1654,6 +1655,27 @@ export async function startProxy(opts = {}) {
     // with zero accounts and returns a clean 503 until one is added via
     // POST /admin/login/*, taking effect with no restart (see onAccountsChanged).
     const adminEnabled = process.env.DARIO_ADMIN === '1';
+    // Shared account registry (account-sync.ts): opt-in, rides the refresh-lock
+    // service, fails open. Merged before the pool loads, so a replica that
+    // boots with an empty accounts directory starts with its peers' accounts.
+    // Claude seats only, so not under --no-claude-auth.
+    const lockUrl = process.env['DARIO_REFRESH_LOCK_URL'];
+    const accountSync = opts.poolSharedAccounts && lockUrl && !opts.noClaudeAuth
+        ? new AccountSync({
+            baseUrl: lockUrl,
+            token: process.env['DARIO_REFRESH_LOCK_TOKEN'] ?? '',
+            intervalMs: DEFAULT_ACCOUNT_SYNC_INTERVAL_MS,
+            log: (line) => console.error(line),
+        })
+        : null;
+    if (opts.poolSharedAccounts && !lockUrl) {
+        console.error('[dario] --pool-shared-accounts needs DARIO_REFRESH_LOCK_URL (the lock service holds the registry); serving the accounts on this instance\'s disk only');
+    }
+    else if (opts.poolSharedAccounts && opts.noClaudeAuth) {
+        console.error('[dario] --pool-shared-accounts is off under --no-claude-auth: the registry holds Claude seats, and this instance loads none');
+    }
+    if (accountSync)
+        await accountSync.syncOnce();
     const accountsList = await loadAllAccounts();
     const poolStrategy = resolvePoolStrategy(opts.poolStrategy);
     const poolHeadroomFloor = resolvePoolHeadroomFloor(opts.poolHeadroomFloor);
@@ -1681,9 +1703,39 @@ export async function startProxy(opts = {}) {
             }
         }
     };
+    // Take a peer instance's newer credentials for this seat from the refresh
+    // lock service before deciding whether to refresh it (dario#1733). Without
+    // this, a replica kept serving and refreshing with the pair it loaded, and
+    // its refresh token had been rotated away by the peer's last refresh. A
+    // no-op without DARIO_REFRESH_LOCK_URL, and never fatal: the refresh
+    // decision below still runs on what the seat already has.
+    const adoptPeerCredentials = async (alias) => {
+        const seat = pool.get(alias);
+        if (!seat)
+            return;
+        const shared = await adoptSharedCredentials(seat).catch(() => null);
+        if (!shared)
+            return;
+        // The seat can move on while the lock service answers (a login, a
+        // refresh, a removal); replace it only if it is still there and older.
+        const live = pool.get(alias);
+        if (!live || !credentialsAreNewer(shared, live))
+            return;
+        // add(), not updateTokens(): a newer grant carries its own grantedAt, and
+        // add() is what starts a re-granted seat's live state fresh.
+        pool.add(alias, {
+            accessToken: shared.accessToken, refreshToken: shared.refreshToken, expiresAt: shared.expiresAt,
+            deviceId: shared.deviceId, accountUuid: shared.accountUuid, grantedAt: shared.grantedAt,
+            organizationId: shared.organizationId, accountId: shared.accountId, accountEmail: shared.accountEmail,
+            rateLimitTier: shared.rateLimitTier, seatTier: shared.seatTier,
+        });
+        await mirrorLoginToCredentials(shared).catch((err) => {
+            console.error(`[dario] login→credentials.json mirror failed (peer credentials) for ${alias}: ${err instanceof Error ? err.message : err}`);
+        });
+        console.error(`[dario] Adopted credentials another instance refreshed for account ${alias}.`);
+    };
     // Shared pool state across instances (docs/multi-instance.md): opt-in,
     // rides the refresh-lock service, fails open. Off → byte-identical to before.
-    const lockUrl = process.env['DARIO_REFRESH_LOCK_URL'];
     const poolSync = opts.poolSharedState && lockUrl
         ? new PoolSync(pool, {
             baseUrl: lockUrl,
@@ -1819,7 +1871,9 @@ export async function startProxy(opts = {}) {
         // token (invalid_grant) just logs and leaves the account expired; the auth
         // gate below then surfaces it. Skipped in --no-claude-auth mode.
         if (!opts.noClaudeAuth) {
-            await Promise.all(pool.all().map(async (acc) => {
+            await Promise.all(pool.all().map(async (seat) => {
+                await adoptPeerCredentials(seat.alias);
+                const acc = pool.get(seat.alias) ?? seat;
                 if (acc.expiresAt >= Date.now() + 45 * 60 * 1000)
                     return;
                 try {
@@ -1890,7 +1944,9 @@ export async function startProxy(opts = {}) {
         if (opts.noClaudeAuth)
             return; // never touch the Claude token in OpenAI-only mode
         watchGrants();
-        for (const acc of pool.all()) {
+        for (const seat of pool.all()) {
+            await adoptPeerCredentials(seat.alias);
+            const acc = pool.get(seat.alias) ?? seat;
             if (acc.expiresAt < Date.now() + 45 * 60 * 1000) {
                 try {
                     const saved = await loadAccount(acc.alias);
@@ -1948,7 +2004,15 @@ export async function startProxy(opts = {}) {
             console.error('[dario] Not authenticated. Run `dario login` first.');
             process.exit(1);
         }
-        const recovered = await ensureLoginCredentialsInPool();
+        // The startup sync deletes the login seat when the shared account
+        // registry removed it. Restoring it here from credentials.json would
+        // serve a removed account until the next sync deleted it again, on every
+        // restart, so a login granted before the removal stays out.
+        const loginRemovedAt = accountSync?.removalOf(MIGRATED_LOGIN_ALIAS);
+        const recovered = await ensureLoginCredentialsInPool(MIGRATED_LOGIN_ALIAS, { removedAt: loginRemovedAt });
+        if (!recovered && loginRemovedAt !== undefined) {
+            console.error('[dario] shared accounts: not restoring the `login` account from credentials.json: it was removed from the shared account registry after that login. This instance starts with no accounts and takes them from the registry as they are added.');
+        }
         if (recovered) {
             const acc = await loadAccount(recovered);
             if (acc) {
@@ -1970,9 +2034,9 @@ export async function startProxy(opts = {}) {
         }
     }
     if (pool.size === 0) {
-        // Reached only under admin bootstrap or api-key mode (the not-authenticated
-        // case exited above). Report the empty pool plainly instead of
-        // Math.min([]) === Infinity.
+        // Reached only under admin bootstrap, api-key mode, or a login the shared
+        // account registry removed (the not-authenticated case exited above).
+        // Report the empty pool plainly instead of Math.min([]) === Infinity.
         if (adminEnabled) {
             console.warn('[dario] Starting with no accounts (admin mode). Add one via POST /admin/login/start; LLM requests return 503 until then.');
         }
@@ -2399,6 +2463,48 @@ export async function startProxy(opts = {}) {
     else {
         prewarmModelCatalog(catalogDeps);
     }
+    if (accountSync) {
+        // Every sync after the startup one updates the live pool as well as the
+        // accounts directory. Seat by seat, never reconcilePoolAccounts: a whole
+        // reload from disk would also put back a file's older tokens over a seat
+        // that refreshed since the sync read it.
+        accountSync.attach((alias) => pool.get(alias), async ({ records, removed }) => {
+            const before = pool.size;
+            for (const rec of records) {
+                // This loop awaits between seats, so an admin removal can land
+                // after the sync checked its records; it wins over a record
+                // granted before it.
+                if (!grantedAfter(rec, localAccountRemovals().get(rec.alias)))
+                    continue;
+                const live = pool.get(rec.alias);
+                if (live && !credentialsAreNewer(rec, live))
+                    continue;
+                pool.add(rec.alias, {
+                    accessToken: rec.accessToken, refreshToken: rec.refreshToken, expiresAt: rec.expiresAt,
+                    deviceId: rec.deviceId, accountUuid: rec.accountUuid, grantedAt: rec.grantedAt,
+                    organizationId: rec.organizationId, accountId: rec.accountId, accountEmail: rec.accountEmail,
+                    rateLimitTier: rec.rateLimitTier, seatTier: rec.seatTier,
+                });
+                await mirrorLoginToCredentials(rec).catch((err) => {
+                    console.error(`[dario] login→credentials.json mirror failed (shared accounts) for ${rec.alias}: ${err instanceof Error ? err.message : err}`);
+                });
+                // The registry lags a peer's refresh by up to one sync; the lock
+                // service holds the rotation itself.
+                await adoptPeerCredentials(rec.alias);
+            }
+            for (const { alias, removedAt } of removed) {
+                const live = pool.get(alias);
+                // A seat granted after the removal is a later login and stays.
+                if (live && !grantedAfter(live, removedAt))
+                    pool.remove(alias);
+            }
+            announceSameAccounts();
+            if (before === 0 && pool.size > 0)
+                retryModelCatalogNow(catalogDeps);
+        });
+        console.log(`  Pool shared accounts: on (via ${lockUrl}, syncing every ${accountSync.intervalMs / 1000}s; fails open)`);
+        accountSync.start();
+    }
     const ERR_UNAUTH = JSON.stringify({ error: 'Unauthorized', message: 'Invalid or missing API key' });
     const ERR_FORBIDDEN = JSON.stringify({ error: 'Forbidden', message: 'Path not allowed. Supported paths: POST /v1/messages, POST /v1/messages/count_tokens, POST /v1/chat/completions, GET /v1/models' });
     const ERR_METHOD = JSON.stringify({ error: 'Method not allowed' });
@@ -2907,6 +3013,10 @@ export async function startProxy(opts = {}) {
                         // waiting out the retry window (#636).
                         if (size > 0)
                             retryModelCatalogNow(catalogDeps);
+                        // Publish the change now rather than at the next interval; each
+                        // peer applies it on its own next sync.
+                        if (accountSync)
+                            void accountSync.syncOnce();
                     }
                     catch (err) {
                         console.error(`[dario] admin: pool hot-reload failed: ${err instanceof Error ? err.message : err}`);
@@ -3129,6 +3239,8 @@ export async function startProxy(opts = {}) {
                 distinctAccounts: distinctAccounts(pool.all()),
                 // Shared pool state (pool-sync.ts) — null when off.
                 sharedState: poolSync ? poolSync.status() : null,
+                // Shared account registry (account-sync.ts), null when off.
+                sharedAccounts: accountSync ? accountSync.status() : null,
                 accounts,
             }));
             return;
@@ -6763,6 +6875,7 @@ export async function startProxy(opts = {}) {
         clearInterval(presenceInterval);
         clearInterval(refreshInterval);
         poolSync?.stop();
+        accountSync?.stop();
         // Stop accepting connections now; responses already streaming keep going.
         // Tokens and what the ledger already holds are written while the drain
         // waits. The ledger, the key store and the request log close only after

package/docs/admin-api.md

@@ -122,6 +122,14 @@ pool view; a headless operator needs only the admin token to watch headroom.
 Completing a login for an alias that is already in the pool re-grants it: the
 seat starts fresh — no carried-over rejection, cool-down or identity.
 
+With `--pool-shared-accounts` on (see
+[Sharing the account list](./multi-instance.md#sharing-the-account-list)), a
+login or removal made here is published to the shared registry at once, and
+every other instance takes it on its next sync, within 15 seconds. Provisioning
+one instance this way provisions them all, and a new replica starts with the
+accounts already in the registry. `GET /accounts` then carries a
+`sharedAccounts` block with the sync's state.
+
 ## Pinning a request to one seat
 
 `x-dario-account: <alias>` on `POST /v1/messages` (or `/v1/chat/completions`) routes that one request to the named pool account with **no failover**: no headroom selection, no sticky rebinding, no peer retry on 401/429, no Codex leg. The upstream status comes back as-is. It is the primitive behind `dario accounts check <alias>` — the answer to "does this seat serve Sonnet right now?" without copying a credential anywhere or restarting anything.

package/docs/configuration.md

@@ -67,6 +67,7 @@ Halts the proxy when an upstream response reports `representative-claim: overage
 | `DARIO_REFRESH_LOCK_TOKEN` | — | unset | bearer for the lock service |
 | `DARIO_POOL_SHARED_STATE` | `--pool-shared-state` | off | share rate-limit readings and sticky bindings with the other instances through the lock service; fails open |
 | `DARIO_POOL_SHARED_STATE_INTERVAL_MS` | `--pool-shared-state-interval=MS` | `2000` | how often to pull peers' readings |
+| `DARIO_POOL_SHARED_ACCOUNTS` | `--pool-shared-accounts` | off | keep one list of Claude accounts across the instances through the lock service, merged at startup and every 15s, so a new replica starts with its peers' accounts and adds and removals reach every instance; the registry holds every seat's credentials; fails open ([details](./multi-instance.md#sharing-the-account-list)) |
 
 ## Template fidelity
 

package/docs/docker.md

@@ -169,6 +169,21 @@ readinessProbe:
 > [admin API](./admin-api.md). Provision before relying on readiness, or use a
 > long-window `startupProbe` around the bootstrap.
 
+A Service routes only to ready pods, so the admin API of a pod that is not
+ready yet cannot be reached through it. Two ways in that leave the probes as
+they are:
+
+- `kubectl port-forward pod/<pod> 3456:3456` connects to the pod itself,
+  ready or not, and the admin calls above work against `localhost:3456`.
+- A second Service for the admin calls with `publishNotReadyAddresses: true`
+  keeps routing to pods that are not ready. Keep it cluster-internal: it
+  reaches a pod before it has an account, which is the point.
+
+With more than one replica, `--pool-shared-accounts` (below) removes the
+bootstrap from every pod after the first: a pod that starts with an empty
+accounts directory loads its peers' accounts before the pool starts, and
+reports ready as soon as they do.
+
 ## Kubernetes example
 
 ```yaml
@@ -202,7 +217,7 @@ spec:
           volumeMounts:
             - { name: config, mountPath: /home/dario/.dario }
           livenessProbe:
-            httpGet: { path: /health, port: 3456 }
+            httpGet: { path: /livez, port: 3456 }
             periodSeconds: 30
           readinessProbe:
             httpGet: { path: /health, port: 3456 }
@@ -224,9 +239,25 @@ spec:
   ports: [{ port: 3456, targetPort: 3456 }]
 ```
 
-Replicas should stay at `1` — dario's OAuth refresh races on a single
-credentials file. For HA, run multiple dario instances each with their own
-account in a [multi-account pool](./multi-account-pool.md).
+Keep `replicas: 1` unless the replicas share a refresh lock: OAuth refresh
+tokens are single use, and two pods holding the same account without one
+race to refresh it. For more than one replica, run the
+[refresh lock](./multi-instance.md#turning-the-refresh-lock-on) and, so a new
+pod starts with the others' accounts and an account added or removed on one
+pod reaches every pod,
+[`--pool-shared-accounts`](./multi-instance.md#sharing-the-account-list):
+
+```yaml
+          env:
+            - { name: DARIO_REFRESH_LOCK_URL, value: "http://dario-refresh-lock:8080" }
+            - { name: DARIO_REFRESH_LOCK_TOKEN, valueFrom: { secretKeyRef: { name: dario-lock, key: token } } }
+            - { name: DARIO_POOL_SHARED_ACCOUNTS, value: "1" }
+            - { name: DARIO_POOL_SHARED_STATE, value: "1" }
+```
+
+The registry holds every seat's credentials, so the lock service and its Redis
+need the same care as the accounts volume; see
+[Sharing the account list](./multi-instance.md#sharing-the-account-list).
 
 ## Image updates
 

package/docs/multi-instance.md

@@ -20,6 +20,8 @@ Two instances holding the same account both notice the token is near expiry, and
 
 A plain mutex does not fix this. The loser waits, acquires the lock, and then refreshes with a token that is *already* stale — it just loses more slowly. The fix is that the loser **adopts the winner's fresh credentials** instead of attempting its own. That is what dario's refresh lock does.
 
+The handoff has to outlast the gap between replicas, not just the race. Each instance checks its tokens every 15 minutes on its own phase, so the second one can come back well after the first refreshed. The lock service keeps the latest credentials for 30 days, and every instance reads them at startup and on each tick before deciding to refresh. Until [#1733](https://github.com/askalf/dario/issues/1733) that window was five minutes, and a replica that came back later refreshed with a dead token.
+
 ### 2. Rate-limit accounting — **solved with shared state**
 
 `pool.ts` keeps `accounts: Map<string, PoolAccount>` in process memory, and updates it only from rate-limit headers on responses *that instance* saw.
@@ -88,9 +90,13 @@ Not suitable for airgapped deployments, and it adds an internet dependency to a
 
 ### It fails open, deliberately
 
-Any lock-service error — bad response, network failure, timeout — and dario proceeds with its own refresh exactly as if no lock were configured.
+On any lock-service error (bad response, network failure, timeout), dario first waits if it can. While the access token still has more than 20 minutes left, the refresh is put off to a later tick, because refreshing alone is what can strand a peer. Inside 20 minutes dario refreshes on its own, exactly as if no lock were configured.
+
+The lock is resilience layered on top of dario's job, not a new dependency dario's core function needs. An outage of your Redis must not stop your proxy serving traffic. The cost of that choice is that an outage lasting into a token's last 20 minutes puts you back to the plain race, so do not treat the lock as a hard guarantee.
 
-The lock is resilience layered on top of dario's job, not a new dependency dario's core function needs. An outage of your Redis must not stop your proxy serving traffic. The cost of that choice is that during a lock outage you are back to the plain race, so do not treat the lock as a hard guarantee.
+### Upgrading the lock service
+
+The 30-day handoff and the `/peek` endpoint live in the lock service, so rebuild the Redis image or redeploy the Worker along with the dario upgrade. In either order nothing breaks: a new dario against an old service gets a 404 from `/peek` and treats it as nothing to adopt, and an old dario against a new service still gets the longer handoff on `/acquire`.
 
 ---
 
@@ -111,6 +117,34 @@ The proxy says what it is doing at startup (`Pool shared state: on (instance …
 
 It fails open like the lock: an unreachable service is one log line per outage and each instance carries on with its own state until the service answers again.
 
+## Sharing the account list
+
+Without it, each instance serves the accounts in its own `~/.dario/accounts/`. With `--pool-shared-accounts` the instances keep one account list in the same lock service: a replica that starts with an empty accounts directory (a second pod on a fresh volume) starts with its peers' accounts, and an account added or removed on one instance is added or removed on all of them.
+
+```
+DARIO_REFRESH_LOCK_URL=http://<lock-host>:8080
+DARIO_REFRESH_LOCK_TOKEN=<shared secret>
+DARIO_POOL_SHARED_ACCOUNTS=1         # or: dario proxy --pool-shared-accounts
+```
+
+Set it on every instance. It works with or without `--pool-shared-state`.
+
+- **At startup**, before the pool loads, an instance reads the registry and merges it with its accounts directory. Per alias the newer record wins: a newer login first, then, for the same login, the later expiry. Accounts only this instance holds are published; accounts only the registry holds are written to this instance's accounts directory. The pool then loads from that directory as usual, so `/health` is ready as soon as a peer has an account.
+- **Every 15 seconds** after that it merges again, and updates the running pool too: a new account joins it, newer credentials replace older ones, and a removed account leaves it. A `dario accounts add`, an admin API login or a token refresh on one instance reaches the others within one sync. An admin API login or removal is published straight away, and the other instances apply it on their next sync.
+- **A removal leaves a marker** in the registry. The marker beats every login made before the removal, so an instance that was offline and still holds the old file deletes it instead of publishing it back. That holds for the `login` account taken from `credentials.json` at startup too: an instance whose login was removed starts without it instead of serving it. A login made after the removal beats the marker, and the account comes back everywhere.
+- **`dario accounts remove <alias>`** publishes the removal first and deletes the file only once the service has taken it. If the service cannot be reached it removes nothing and says so, since the other instances would put the account straight back. A login made after the removal stays, in the registry or in the file here, and the command says so; run it again to remove that login too. If the file here can't be deleted, the command says so and exits non-zero, and this instance keeps serving the account until the file goes.
+
+The proxy says it is on at startup (`Pool shared accounts: on (via …, syncing every 15s; fails open)`), and `GET /accounts` carries a `sharedAccounts` block: the last sync and the last good one, how many accounts and removal markers the registry holds, the files this instance saved and removed from it, the accounts and removals it published, and errors. Each change is logged: `added account "work" (wo***@example.com) from the registry`, `removed account "spare"; it was removed on another instance`, `published account "home" to the registry`.
+
+Before turning it on:
+
+- **The registry holds every seat's credentials, refresh tokens included, and they do not expire there.** That is what lets a new replica start with no files. Guard the lock service like the accounts directory itself: a real random `DARIO_REFRESH_LOCK_TOKEN`, the service on a private network, and a Redis that nothing else uses. Anyone who can read that Redis or the Durable Object can use every subscription in the pool.
+- **Aliases are one namespace across all instances.** Two instances that each log a different subscription in under the same alias (`login`, most often) keep only the newer login, and the instance whose account was replaced logs it loudly: `account "login" here was ... and is now ...; aliases are shared across instances, so give each subscription its own alias`. Give each subscription its own alias.
+- **Clocks have to agree.** The newer login and removal rules compare wall-clock times taken on different machines. Run NTP; Kubernetes nodes do by default.
+- **Claude seats only.** ChatGPT accounts stay per instance, and the switch is off under `--no-claude-auth`.
+- **It fails open.** With the service unreachable, each instance serves the accounts on its own disk and logs once per outage. A removal made while it is down is published when it answers again; if the instance restarts before then, that removal is lost and the account comes back from the registry, so remove it again.
+- **Upgrade the lock service.** The `/accounts/*` endpoints are new: rebuild the Redis image or redeploy the Worker. An older service answers 404, which an instance logs as the service being unreachable and then serves its own disk, so nothing breaks, but nothing is shared either.
+
 ## Proving it works on your own setup
 
 Do not take the above on trust. `test/integration/dual-instance-race.mjs` runs the real scenario: **two genuinely separate `node` processes**, each with its own isolated `~/.dario`, sharing nothing but the lock service, both racing to refresh the same account at the same instant.
@@ -136,7 +170,7 @@ Anthropic's token endpoint is the one mocked part, and only that — hammering t
 
 ## If you need true HA
 
-Everything above is as far as dario goes today: shared credentials through the lock, and shared rate-limit readings and sticky bindings through `--pool-shared-state`, both eventually consistent and both failing open. Three things are still per instance:
+Everything above is as far as dario goes today: shared credentials through the lock, shared rate-limit readings and sticky bindings through `--pool-shared-state`, and a shared account list through `--pool-shared-accounts`, all eventually consistent and all failing open. Without `--pool-shared-accounts` the account list is per instance too, and copying the account files to every instance is safe with the refresh lock on: the copies share one refresh token, and whichever instance refreshes first hands the result to the others ([#1733](https://github.com/askalf/dario/issues/1733)). Without the lock, copies race exactly as described in section 1. Three things are still per instance:
 
 - **ChatGPT seats.** The Codex accounts have their own refresh flow and usage windows; neither the lock nor the shared state covers them.
 - **The ledger.** Each instance writes its own file, so `dario usage` and `/analytics` show that instance's share of the spend.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.18.4",
+  "version": "6.19.1",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, opt-in failover when one hits its limit, and a ledger of what each plan absorbed.",
   "type": "module",
   "bin": {