@askalf/dario 6.20.3 → 6.21.0

package/dist/account-sync.d.ts

@@ -19,6 +19,10 @@
  * made after it, so the instances' clocks must agree (NTP) to well under the
  * time between a removal and a later login.
  *
+ * Admin API logins that are started but not yet completed ride the same
+ * service (`/logins/<claude|codex>/...`, see SharedPendingLogins below), so
+ * a login started on one replica completes on another.
+ *
  * Every call fails open: with the service unreachable an instance serves the
  * accounts on its own disk, logging once per outage. The registry holds
  * every seat's full credentials, refresh tokens included, with no expiry, so
@@ -41,6 +45,38 @@ export interface AccountSyncStore {
     localRemovals(): ReadonlyMap<string, number>;
 }
 export declare const accountFileStore: AccountSyncStore;
+/** A started, not yet completed admin API login: the PKCE secrets and when they lapse. */
+export interface SharedLogin {
+    codeVerifier: string;
+    state: string;
+    expiresAt: number;
+}
+/** Which engine's pending logins: they are separate namespaces, as the seats are. */
+export type LoginEngine = 'claude' | 'codex';
+/**
+ * Pending admin API logins held on the shared service, so any instance can
+ * complete one that another started. The verifier and state are secrets and
+ * are stored as the registry stores credentials. 'failed' is the service
+ * not answering or not knowing the endpoint (an older service); the caller
+ * then keeps the login on this instance only.
+ */
+export interface SharedPendingLogins {
+    /**
+     * Publish a login for `alias`, replacing any other. 'full' when the service already holds its cap of other aliases.
+     * With `create`, a live login under the alias is left alone and the answer is 'taken'.
+     */
+    put(engine: LoginEngine, alias: string, login: SharedLogin, ttlMs: number, create?: boolean): Promise<'stored' | 'full' | 'taken' | 'failed'>;
+    /** The login for `alias`, null when the service holds none (or it lapsed). Does not consume it. */
+    get(engine: LoginEngine, alias: string): Promise<SharedLogin | null | 'failed'>;
+    /**
+     * Delete the login for `alias` whose state is `state`, and only that one. True when this call removed
+     * it live; false when none was there, it lapsed, or another login has replaced it (another instance
+     * completed or restarted it first), which the caller must treat as lost.
+     */
+    remove(engine: LoginEngine, alias: string, state: string): Promise<boolean | 'failed'>;
+    /** The aliases with a pending login on any instance. */
+    aliases(engine: LoginEngine): Promise<string[] | 'failed'>;
+}
 /** What one sync changed on this instance, handed to the running proxy. */
 export interface AccountSyncChange {
     /** Records the pool lacks or holds older credentials for. */
@@ -128,7 +164,7 @@ export declare function removeAccountEverywhere(baseUrl: string, token: string,
     store?: AccountSyncStore;
     removedAt?: number;
 }): Promise<SharedRemovalResult>;
-export declare class AccountSync {
+export declare class AccountSync implements SharedPendingLogins {
     readonly intervalMs: number;
     private readonly baseUrl;
     private readonly token;
@@ -162,6 +198,12 @@ export declare class AccountSync {
      * login the sync just removed.
      */
     removalOf(alias: string): number | undefined;
+    private loginPath;
+    private loginFailed;
+    put(engine: LoginEngine, alias: string, login: SharedLogin, ttlMs: number, create?: boolean): Promise<'stored' | 'full' | 'taken' | 'failed'>;
+    get(engine: LoginEngine, alias: string): Promise<SharedLogin | null | 'failed'>;
+    remove(engine: LoginEngine, alias: string, state: string): Promise<boolean | 'failed'>;
+    aliases(engine: LoginEngine): Promise<string[] | 'failed'>;
     /** One sync. Null when the registry could not be read; never throws. */
     syncOnce(): Promise<AccountSyncChange | null>;
     private run;

package/dist/account-sync.js

@@ -19,6 +19,10 @@
  * made after it, so the instances' clocks must agree (NTP) to well under the
  * time between a removal and a later login.
  *
+ * Admin API logins that are started but not yet completed ride the same
+ * service (`/logins/<claude|codex>/...`, see SharedPendingLogins below), so
+ * a login started on one replica completes on another.
+ *
  * Every call fails open: with the service unreachable an instance serves the
  * accounts on its own disk, logging once per outage. The registry holds
  * every seat's full credentials, refresh tokens included, with no expiry, so
@@ -34,6 +38,18 @@ export const accountFileStore = {
     remove: removeSharedAccount,
     localRemovals: localAccountRemovals,
 };
+function parseSharedLogin(raw) {
+    const r = raw;
+    if (!r || typeof r !== 'object')
+        return null;
+    if (typeof r.codeVerifier !== 'string' || r.codeVerifier.length === 0)
+        return null;
+    if (typeof r.state !== 'string' || r.state.length === 0)
+        return null;
+    if (typeof r.expiresAt !== 'number' || !Number.isFinite(r.expiresAt))
+        return null;
+    return { codeVerifier: r.codeVerifier, state: r.state, expiresAt: r.expiresAt };
+}
 export const DEFAULT_ACCOUNT_SYNC_INTERVAL_MS = 15_000;
 const CALL_TIMEOUT_MS = 3_000;
 /** The latest removal of `alias` either side knows of, or undefined. */
@@ -203,6 +219,42 @@ export class AccountSync {
     removalOf(alias) {
         return removalTime(alias, this.markers, this.store.localRemovals());
     }
+    loginPath(engine, alias, action) {
+        return `/logins/${engine}/${encodeURIComponent(alias)}/${action}`;
+    }
+    // Never logs the login: the line carries the alias and the transport error only.
+    loginFailed(what, alias) {
+        this.log(`[dario] shared accounts: could not ${what} the pending login for "${alias}" on the service (${this.stats.lastError ?? 'no answer'}); using this instance's copy`);
+        return 'failed';
+    }
+    async put(engine, alias, login, ttlMs, create = false) {
+        const out = await this.call(this.loginPath(engine, alias, 'put'), create ? { login, ttlMs, create: true } : { login, ttlMs });
+        if (!out)
+            return this.loginFailed('publish', alias);
+        if (out.stored === true)
+            return 'stored';
+        if (out.full === true)
+            return 'full';
+        return out.taken === true ? 'taken' : this.loginFailed('publish', alias);
+    }
+    async get(engine, alias) {
+        const out = await this.call(this.loginPath(engine, alias, 'get'), {});
+        if (!out)
+            return this.loginFailed('read', alias);
+        return parseSharedLogin(out.login);
+    }
+    async remove(engine, alias, state) {
+        const out = await this.call(this.loginPath(engine, alias, 'remove'), { state });
+        if (!out)
+            return this.loginFailed('remove', alias);
+        return out.removed === true;
+    }
+    async aliases(engine) {
+        const out = await this.call(`/logins/${engine}/list`, {});
+        if (!out)
+            return 'failed';
+        return Array.isArray(out.aliases) ? out.aliases.filter((a) => typeof a === 'string') : [];
+    }
     /** One sync. Null when the registry could not be read; never throws. */
     syncOnce() {
         if (this.queued)

package/dist/admin-api.d.ts

@@ -77,6 +77,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { CodexSeatState } from './codex-accounts.js';
 import { type CodexUsageView } from './codex-usage.js';
+import type { SharedPendingLogins } from './account-sync.js';
 import { type KeyStore } from './keys.js';
 /** Persisted account metadata surfaced by `GET /admin/accounts`. */
 export interface AdminAccountRecord {
@@ -226,6 +227,13 @@ export interface AdminDeps {
      * off on this proxy; the routes answer 404.
      */
     keys?: KeyStore | null;
+    /**
+     * The shared account registry's pending-login store (account-sync.ts), set
+     * when `--pool-shared-accounts` is on. A login started here is also
+     * published there, so any instance can complete it. Absent: pending logins
+     * live in this process only.
+     */
+    sharedLogins?: SharedPendingLogins | null;
 }
 /**
  * Handle an `/admin/*` request. Returns `true` if it owned the request (matched

package/dist/admin-api.js

@@ -49,6 +49,104 @@ const pendingLogins = new Map();
 // The ChatGPT seats' pending logins live apart: an alias may name a Claude
 // seat and a ChatGPT seat at once (the stores are separate directories).
 const pendingCodexLogins = new Map();
+const PENDING_FULL = 'too many pending logins; complete or wait for one to expire';
+const NO_PENDING = 'no pending login for that alias (unknown or expired): start a new login';
+const NO_PENDING_CODEX = 'no pending codex login for that alias (unknown or expired): start a new login';
+const DEFAULT_ALIAS_TRIES = 8;
+/**
+ * Publish a new pending login on the shared service when one is configured.
+ * 'failed' (the service did not answer or does not know the endpoint) leaves
+ * the login in this process only, which is what a single instance has always
+ * done. The service holds the MAX_PENDING cap for the whole fleet; 'full'
+ * means it is reached. `create` (a generated alias) refuses to replace a
+ * live login another instance published under it: 'taken'.
+ */
+async function publishPending(engine, alias, login, deps, create) {
+    if (!deps.sharedLogins)
+        return 'local';
+    return deps.sharedLogins.put(engine, alias, { codeVerifier: login.codeVerifier, state: login.state, expiresAt: login.expiresAt }, PENDING_TTL_MS, create);
+}
+/** Aliases with a login pending on any instance, so a generated default does not take another instance's. */
+async function sharedAliases(engine, deps) {
+    if (!deps.sharedLogins)
+        return [];
+    const out = await deps.sharedLogins.aliases(engine);
+    return out === 'failed' ? [] : out;
+}
+/**
+ * The pending login for `alias`. With the shared service on, the service is
+ * the source of truth when it answers: a login another instance started is
+ * found there, and one another instance already completed is gone from it
+ * even though this process still holds a copy, which is dropped. This
+ * process's own copy answers when the service does not, and when the login
+ * was never published.
+ */
+async function findPending(engine, map, alias, deps) {
+    const own = map.get(alias);
+    if (!deps.sharedLogins)
+        return { p: own, viaService: false };
+    const got = await deps.sharedLogins.get(engine, alias);
+    if (got === 'failed')
+        return { p: own, viaService: false };
+    if (got)
+        return { p: got, viaService: true };
+    if (own?.shared) {
+        if (map.get(alias) === own)
+            map.delete(alias);
+        return { p: undefined, viaService: false };
+    }
+    return { p: own, viaService: false };
+}
+/**
+ * Take the login found for `alias`: single-use, so false means a concurrent
+ * completion or a restart got there first and the caller must not exchange.
+ * The lookup awaits, so taking this process's copy is a synchronous check
+ * that the map still holds the very login the lookup returned (deleting by
+ * alias alone would delete a login started since). A published login is then
+ * deleted on the service by its state, which answers true to one of two
+ * instances. A definite false from the service is always a lost claim. When
+ * the service does not answer, the claim stands only for the caller that took
+ * an unconsumed copy held here; a login found on the service alone cannot be
+ * claimed during an outage.
+ */
+async function claimPending(engine, map, alias, found, deps) {
+    const p = found.p;
+    const own = map.get(alias);
+    // This process still holds this very login; taking it here is synchronous, so only one caller gets it.
+    const mine = found.viaService ? own?.state === p.state : own === p;
+    if (!found.viaService && !mine)
+        return false;
+    if (mine)
+        map.delete(alias);
+    if (!deps.sharedLogins || !(found.viaService || own?.shared))
+        return true;
+    const removed = await deps.sharedLogins.remove(engine, alias, p.state);
+    if (removed === 'failed')
+        return mine;
+    return removed;
+}
+/** Room for `alias` in the map. A shared copy is only this instance's fallback, since the service holds the login and its cap, so the oldest one gives way; logins kept here alone do not. */
+function makeRoom(map, alias) {
+    if (map.has(alias) || map.size < MAX_PENDING)
+        return true;
+    for (const [k, v] of map) {
+        if (v.shared) {
+            map.delete(k);
+            return true;
+        }
+    }
+    return false;
+}
+/** Forget a login that was found but lapsed, here and on the service, by identity. */
+async function dropPending(engine, map, alias, found, deps) {
+    const p = found.p;
+    if (!p)
+        return;
+    if (map.get(alias) === p || (found.viaService && map.get(alias)?.state === p.state))
+        map.delete(alias);
+    if (deps.sharedLogins && (found.viaService || p.shared))
+        await deps.sharedLogins.remove(engine, alias, p.state);
+}
 function prunePending(now) {
     for (const map of [pendingLogins, pendingCodexLogins]) {
         for (const [id, p] of map) {
@@ -65,6 +163,25 @@ function nextDefaultAlias(taken, prefix = 'account') {
             return candidate; // taken is finite → always terminates
     }
 }
+function takenResult(alias) {
+    return { ok: false, status: 409, error: `alias "${alias}" has a login pending on another instance; try again or pass an "alias"`, taken: true };
+}
+/**
+ * Start a login under a generated alias. The shared service creates it only
+ * if no live login holds it, so two instances picking the same default at
+ * once cannot replace each other's; the loser takes the next candidate.
+ */
+async function startDefaultLogin(start, taken, prefix) {
+    let last = takenResult(nextDefaultAlias(taken, prefix));
+    for (let i = 0; i < DEFAULT_ALIAS_TRIES; i++) {
+        const alias = nextDefaultAlias(taken, prefix);
+        last = await start(alias);
+        if (last.ok || !last.taken)
+            return last;
+        taken.add(alias);
+    }
+    return last;
+}
 /**
  * Core of `/admin/login/start`, factored out so `/admin/login/start-needed`
  * (#913) can drive the same PKCE-start + pending-login-registration + audit
@@ -73,15 +190,19 @@ function nextDefaultAlias(taken, prefix = 'account') {
  * caller looping over many aliases can skip one bad alias without aborting
  * the rest.
  */
-async function doStartLogin(alias, now, deps, remote) {
+async function doStartLogin(alias, now, deps, remote, create = false) {
     // Only a brand-new alias grows the map; a repeat start replaces in place.
-    if (!pendingLogins.has(alias) && pendingLogins.size >= MAX_PENDING) {
-        return { ok: false, status: 429, error: 'too many pending logins; complete or wait for one to expire' };
-    }
+    if (!makeRoom(pendingLogins, alias))
+        return { ok: false, status: 429, error: PENDING_FULL };
     try {
         const { authorizeUrl, codeVerifier, state } = await startAddAccount(alias);
         const expiresAt = now + PENDING_TTL_MS;
-        pendingLogins.set(alias, { codeVerifier, state, expiresAt });
+        const published = await publishPending('claude', alias, { codeVerifier, state, expiresAt }, deps, create);
+        if (published === 'full')
+            return { ok: false, status: 429, error: PENDING_FULL };
+        if (published === 'taken')
+            return takenResult(alias);
+        pendingLogins.set(alias, { codeVerifier, state, expiresAt, shared: published === 'stored' });
         deps.audit?.({ action: 'login_start', ok: true, status: 200, alias, remote });
         return { ok: true, alias, authorizeUrl, expiresAt };
     }
@@ -100,10 +221,11 @@ async function doStartLogin(alias, now, deps, remote) {
 async function doCompleteLogin(alias, rawCode, now, deps, remote) {
     if (!alias || !rawCode)
         return { ok: false, status: 400, error: 'missing "alias" or "code"' };
-    const p = pendingLogins.get(alias);
+    const found = await findPending('claude', pendingLogins, alias, deps);
+    const p = found.p;
     if (!p || p.expiresAt <= now) {
-        pendingLogins.delete(alias);
-        return { ok: false, status: 410, error: 'no pending login for that alias (unknown or expired) — start a new login' };
+        await dropPending('claude', pendingLogins, alias, found, deps);
+        return { ok: false, status: 410, error: NO_PENDING };
     }
     // Accept "code#state" or a bare code; verify the embedded state if present.
     const { code, state: pastedState } = parseManualPaste(rawCode);
@@ -112,7 +234,11 @@ async function doCompleteLogin(alias, rawCode, now, deps, remote) {
     if (pastedState && pastedState !== p.state) {
         return { ok: false, status: 400, error: 'state mismatch — code is from a different login attempt' };
     }
-    pendingLogins.delete(alias); // single-use, regardless of exchange outcome
+    // Single-use, regardless of exchange outcome.
+    if (!(await claimPending('claude', pendingLogins, alias, found, deps))) {
+        // Completed or replaced since the lookup. A replacement is left for its own paste.
+        return { ok: false, status: 410, error: NO_PENDING };
+    }
     try {
         const creds = await completeAddAccount(alias, code, p.codeVerifier, p.state);
         await deps.onAccountsChanged?.();
@@ -125,17 +251,21 @@ async function doCompleteLogin(alias, rawCode, now, deps, remote) {
         return { ok: false, status: 400, error: message };
     }
 }
-async function doStartCodexLogin(alias, now, deps, remote) {
-    if (!pendingCodexLogins.has(alias) && pendingCodexLogins.size >= MAX_PENDING) {
-        return { ok: false, status: 429, error: 'too many pending logins; complete or wait for one to expire' };
-    }
+async function doStartCodexLogin(alias, now, deps, remote, create = false) {
+    if (!makeRoom(pendingCodexLogins, alias))
+        return { ok: false, status: 429, error: PENDING_FULL };
     if ((await listCodexAccountAliases()).includes(alias)) {
         return { ok: false, status: 409, error: `codex account "${alias}" already exists — DELETE /admin/codex/accounts/${alias} first` };
     }
     try {
         const { authorizeUrl, codeVerifier, state } = await startAddCodexAccount(alias);
         const expiresAt = now + PENDING_TTL_MS;
-        pendingCodexLogins.set(alias, { codeVerifier, state, expiresAt });
+        const published = await publishPending('codex', alias, { codeVerifier, state, expiresAt }, deps, create);
+        if (published === 'full')
+            return { ok: false, status: 429, error: PENDING_FULL };
+        if (published === 'taken')
+            return takenResult(alias);
+        pendingCodexLogins.set(alias, { codeVerifier, state, expiresAt, shared: published === 'stored' });
         deps.audit?.({ action: 'login_start', ok: true, status: 200, alias, remote, engine: 'codex' });
         return { ok: true, alias, authorizeUrl, expiresAt };
     }
@@ -146,10 +276,11 @@ async function doStartCodexLogin(alias, now, deps, remote) {
 async function doCompleteCodexLogin(alias, rawCode, now, deps, remote) {
     if (!alias || !rawCode)
         return { ok: false, status: 400, error: 'missing "alias" or "code"' };
-    const p = pendingCodexLogins.get(alias);
+    const found = await findPending('codex', pendingCodexLogins, alias, deps);
+    const p = found.p;
     if (!p || p.expiresAt <= now) {
-        pendingCodexLogins.delete(alias);
-        return { ok: false, status: 410, error: 'no pending codex login for that alias (unknown or expired) — start a new login' };
+        await dropPending('codex', pendingCodexLogins, alias, found, deps);
+        return { ok: false, status: 410, error: NO_PENDING_CODEX };
     }
     // The whole redirect URL (what the CLI asks the user to paste) or a bare code; the
     // state in a URL is checked against the login it was printed for, as the CLI does.
@@ -159,7 +290,17 @@ async function doCompleteCodexLogin(alias, rawCode, now, deps, remote) {
     if (pastedState !== null && pastedState !== p.state) {
         return { ok: false, status: 400, error: 'state mismatch — the redirect is from a different login attempt' };
     }
-    pendingCodexLogins.delete(alias); // single-use, regardless of exchange outcome
+    // ChatGPT seats are per instance, and the login may have been started on one that lacks this
+    // alias. Checked here, before the claim, so nothing is consumed and the login still completes
+    // on an instance without the seat.
+    if ((await listCodexAccountAliases()).includes(alias)) {
+        return { ok: false, status: 409, error: `codex account "${alias}" already exists on this instance: DELETE /admin/codex/accounts/${alias} first` };
+    }
+    // Single-use, regardless of exchange outcome.
+    if (!(await claimPending('codex', pendingCodexLogins, alias, found, deps))) {
+        // Completed or replaced since the lookup. A replacement is left for its own paste.
+        return { ok: false, status: 410, error: NO_PENDING_CODEX };
+    }
     try {
         const creds = await completeAddCodexAccount(alias, code, p.codeVerifier);
         await deps.onCodexAccountsChanged?.();
@@ -335,15 +476,22 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
             }
             const body = await readJsonBody(req);
             let alias = typeof body.alias === 'string' ? body.alias.trim() : '';
+            let result;
             // Alias is optional: a headless caller can omit it and get a generated,
             // non-colliding default (account-1, account-2, …) back in the response to
             // thread into /complete. Explicit aliases still win for named setups.
             if (!alias) {
                 const records = await (deps.listAccounts ?? defaultListAccounts)();
-                const taken = new Set([...records.map((r) => r.alias), ...pendingLogins.keys()]);
-                alias = nextDefaultAlias(taken);
+                const taken = new Set([...records.map((r) => r.alias), ...pendingLogins.keys(), ...(await sharedAliases('claude', deps))]);
+                const made = await startDefaultLogin((a) => doStartLogin(a, now, deps, remote, true), taken);
+                if (!made.ok) {
+                    send(res, made.status, { error: made.error });
+                    return true;
+                }
+                alias = made.alias;
+                result = made;
             }
-            const result = await doStartLogin(alias, now, deps, remote);
+            result ??= await doStartLogin(alias, now, deps, remote);
             if (!result.ok) {
                 send(res, result.status, { error: result.error });
                 return true;
@@ -364,11 +512,18 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
             }
             const body = await readJsonBody(req);
             let alias = typeof body.alias === 'string' ? body.alias.trim() : '';
+            let result;
             if (!alias) {
-                const taken = new Set([...(await listCodexAccountAliases()), ...pendingCodexLogins.keys()]);
-                alias = nextDefaultAlias(taken, 'altman');
+                const taken = new Set([...(await listCodexAccountAliases()), ...pendingCodexLogins.keys(), ...(await sharedAliases('codex', deps))]);
+                const made = await startDefaultLogin((a) => doStartCodexLogin(a, now, deps, remote, true), taken, 'altman');
+                if (!made.ok) {
+                    send(res, made.status, { error: made.error });
+                    return true;
+                }
+                alias = made.alias;
+                result = made;
             }
-            const result = await doStartCodexLogin(alias, now, deps, remote);
+            result ??= await doStartCodexLogin(alias, now, deps, remote);
             if (!result.ok) {
                 send(res, result.status, { error: result.error });
                 return true;

package/dist/proxy.js

@@ -2995,6 +2995,9 @@ export async function startProxy(opts = {}) {
                 // through the store the live proxy authenticates from, so a key made
                 // here works on the next request.
                 keys: keyStore,
+                // Logins started and not yet completed ride the shared registry's
+                // service, so a login started on one replica completes on another.
+                sharedLogins: accountSync,
                 onCodexAccountsChanged: async () => {
                     // A ChatGPT seat came or went over HTTP (dario#1009): forget the
                     // "no codex account" answer so the next request routes to it.

package/docs/admin-api.md

@@ -78,7 +78,8 @@ Pending-login mechanics, for scripting against it:
   different login attempt.
 - An expired or unknown alias gets `410` — start a new login.
 - The PKCE verifier and state never touch disk and are never returned to the
-  client.
+  client. With `--pool-shared-accounts` on they are also held by the shared
+  service until the login completes, is replaced or lapses; see below.
 
 ## Endpoint reference
 
@@ -131,6 +132,25 @@ one instance this way provisions them all, and a new replica starts with the
 accounts already in the registry. `GET /accounts` then carries a
 `sharedAccounts` block with the sync's state.
 
+**Behind a load balancer, `/start` and `/complete` can land on different
+instances.** With the same switch on, a pending login is published to the shared
+service too, for both Claude and ChatGPT logins, and `/complete` reads it from
+there. The mechanics above hold fleet-wide: 10 minutes, single-use (of two
+instances completing at once, one gets `200` and the other `410`; a
+`/start` that replaces the login in between leaves the new one for its own
+paste), one per alias, at most 64 per engine. A generated default alias skips
+one pending on another instance, and the service creates it only if no live
+login holds it, so two instances starting at once get different aliases (if
+all 8 candidates it tries are taken it answers `409`). If the service does not answer when a login starts, it is
+kept on that instance only and logged (never the verifier or state); a
+`/complete` that lands elsewhere gets the usual `410`, so retry it through
+the instance that started it or start again. A ChatGPT seat is not part of the
+shared registry, so the instance that completes the login is the one that holds
+the seat. That instance refuses with `409` if it already holds a seat under
+the alias, without consuming the login, so complete it on an instance that
+does not (or `DELETE /admin/codex/accounts/<alias>` there first). With the switch off, pending logins stay in the process that started
+them, so send `/start` and `/complete` to the same instance.
+
 ## Pinning a request to one seat
 
 `x-dario-account: <alias>` on `POST /v1/messages` (or `/v1/chat/completions`) routes that one request to the named pool account with **no failover**: no headroom selection, no sticky rebinding, no peer retry on 401/429, no Codex leg. The upstream status comes back as-is. It is the primitive behind `dario accounts check <alias>` — the answer to "does this seat serve Sonnet right now?" without copying a credential anywhere or restarting anything.

package/docs/multi-instance.md

@@ -131,6 +131,7 @@ Set it on every instance. It works with or without `--pool-shared-state`.
 
 - **At startup**, before the pool loads, an instance reads the registry and merges it with its accounts directory. Per alias the newer record wins: a newer login first, then, for the same login, the later expiry. Accounts only this instance holds are published; accounts only the registry holds are written to this instance's accounts directory. The pool then loads from that directory as usual, so `/health` is ready as soon as a peer has an account.
 - **Every 15 seconds** after that it merges again, and updates the running pool too: a new account joins it, newer credentials replace older ones, and a removed account leaves it. A `dario accounts add`, an admin API login or a token refresh on one instance reaches the others within one sync. An admin API login or removal is published straight away, and the other instances apply it on their next sync.
+- **Admin API logins complete on any instance.** A login started with `POST /admin/login/start` (or `/admin/codex/login/start`) is also published to the service for its 10 minutes, so `/complete` can land on a different replica behind the load balancer. It is single-use across the fleet, and is removed from the service when it completes or is replaced. A lapsed login is never served; the Worker deletes it at its lapse by an alarm, and Redis deletes it on the next start after the lapse or when the hash expires at the newest lapse of any login in it, at most an hour past its own. If the service does not answer at `/start`, that login stays on the instance that started it, with a log line that names the alias only. During an outage a login found only on the service cannot complete; this instance completes one only if it still holds its own copy, and only one overlapping call gets it. An instance keeps at most 64 pending logins: copies of logins the service holds give way to new starts, logins kept here alone do not. Without the switch, send both calls to the same instance.
 - **A removal leaves a marker** in the registry. The marker beats every login made before the removal, so an instance that was offline and still holds the old file deletes it instead of publishing it back. That holds for the `login` account taken from `credentials.json` at startup too: an instance whose login was removed starts without it instead of serving it. A login made after the removal beats the marker, and the account comes back everywhere.
 - **`dario accounts remove <alias>`** publishes the removal first and deletes the file only once the service has taken it. If the service cannot be reached it removes nothing and says so, since the other instances would put the account straight back. A login made after the removal stays, in the registry or in the file here, and the command says so; run it again to remove that login too. If the file here can't be deleted, the command says so and exits non-zero, and this instance keeps serving the account until the file goes.
 
@@ -138,12 +139,13 @@ The proxy says it is on at startup (`Pool shared accounts: on (via …, syncing
 
 Before turning it on:
 
+- **The service also holds the PKCE verifier and state of a login in progress,** for its 10 minutes, and in Redis possibly up to an hour past that (see above). They are secrets, stored as the account records are, and a caller holding `DARIO_REFRESH_LOCK_TOKEN` can complete that login.
 - **The registry holds every seat's credentials, refresh tokens included, and they do not expire there.** That is what lets a new replica start with no files. Guard the lock service like the accounts directory itself: a real random `DARIO_REFRESH_LOCK_TOKEN`, the service on a private network, and a Redis that nothing else uses. Anyone who can read that Redis or the Durable Object can use every subscription in the pool.
 - **Aliases are one namespace across all instances.** Two instances that each log a different subscription in under the same alias (`login`, most often) keep only the newer login, and the instance whose account was replaced logs it loudly: `account "login" here was ... and is now ...; aliases are shared across instances, so give each subscription its own alias`. Give each subscription its own alias.
 - **Clocks have to agree.** The newer login and removal rules compare wall-clock times taken on different machines. Run NTP; Kubernetes nodes do by default.
-- **Claude seats only.** ChatGPT accounts stay per instance, and the switch is off under `--no-claude-auth`.
+- **Claude seats only.** ChatGPT accounts stay per instance, and the switch is off under `--no-claude-auth`. A ChatGPT login started over the admin API can still complete on another instance, but the seat is then held by the instance that completed it. An instance that already holds a seat under that alias answers `409` and leaves the login unconsumed, so it can complete on another instance.
 - **It fails open.** With the service unreachable, each instance serves the accounts on its own disk and logs once per outage. A removal made while it is down is published when it answers again; if the instance restarts before then, that removal is lost and the account comes back from the registry, so remove it again.
-- **Upgrade the lock service.** The `/accounts/*` endpoints are new: rebuild the Redis image or redeploy the Worker. An older service answers 404, which an instance logs as the service being unreachable and then serves its own disk, so nothing breaks, but nothing is shared either.
+- **Upgrade the lock service.** The `/accounts/*` endpoints are new: rebuild the Redis image or redeploy the Worker. An older service answers 404, which an instance logs as the service being unreachable and then serves its own disk, so nothing breaks, but nothing is shared either. The `/logins/*` endpoints for pending admin API logins arrived after `/accounts/*`; on a service without them an instance keeps its pending logins to itself and logs it.
 
 ## Proving it works on your own setup
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.20.3",
+  "version": "6.21.0",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, opt-in failover when one hits its limit, and a ledger of what each plan absorbed.",
   "type": "module",
   "bin": {