@askalf/dario 6.20.3 → 6.22.0

package/dist/codex-account-sync.d.ts

@@ -0,0 +1,28 @@
+/**
+ * ChatGPT seats in the shared account registry (`--pool-shared-accounts`). The
+ * sync and its rules are account-sync.ts; this is where these records live and
+ * how to read them.
+ *
+ *   POST /codex-accounts/list            {}                -> { accounts, removed }
+ *   POST /codex-accounts/<alias>/put     { credentials }   -> { stored }
+ *   POST /codex-accounts/<alias>/remove  { removedAt }     -> { removed }
+ *
+ * The seats need no refresh lock (getFreshCodexAccount says why: two refreshes
+ * of one token both succeed), so each replica refreshes on its own and the
+ * later expiry wins here. Nothing holds a seat in memory either, since the
+ * proxy reads the files on every request, so a sync only has to write the file:
+ * there is no pool to attach.
+ *
+ * Credentials only. A seat's usage readings and cool-downs stay per instance.
+ */
+import { type AccountRegistry, type AccountSyncStore, type SharedRemovalResult } from './account-sync.js';
+import { type CodexAccountCredentials } from './codex-accounts.js';
+export declare const codexAccountFileStore: AccountSyncStore<CodexAccountCredentials>;
+/** A registry record complete enough to serve from, stored under its own alias. */
+export declare function isCodexRegistryRecord(alias: string, rec: unknown): rec is CodexAccountCredentials;
+export declare const CODEX_REGISTRY: AccountRegistry<CodexAccountCredentials>;
+/** removeAccountEverywhere for a ChatGPT seat, for `dario codex remove`. */
+export declare function removeCodexAccountEverywhere(baseUrl: string, token: string, alias: string, opts?: {
+    store?: AccountSyncStore<CodexAccountCredentials>;
+    removedAt?: number;
+}): Promise<SharedRemovalResult>;

package/dist/codex-account-sync.js

@@ -0,0 +1,54 @@
+/**
+ * ChatGPT seats in the shared account registry (`--pool-shared-accounts`). The
+ * sync and its rules are account-sync.ts; this is where these records live and
+ * how to read them.
+ *
+ *   POST /codex-accounts/list            {}                -> { accounts, removed }
+ *   POST /codex-accounts/<alias>/put     { credentials }   -> { stored }
+ *   POST /codex-accounts/<alias>/remove  { removedAt }     -> { removed }
+ *
+ * The seats need no refresh lock (getFreshCodexAccount says why: two refreshes
+ * of one token both succeed), so each replica refreshes on its own and the
+ * later expiry wins here. Nothing holds a seat in memory either, since the
+ * proxy reads the files on every request, so a sync only has to write the file:
+ * there is no pool to attach.
+ *
+ * Credentials only. A seat's usage readings and cool-downs stay per instance.
+ */
+import { removeAccountEverywhere } from './account-sync.js';
+import { extractChatGPTAccountId } from './codex-backend.js';
+import { isValidCodexAlias, loadAllCodexAccounts, localCodexAccountRemovals, removeSharedCodexAccount, saveSharedCodexAccount, } from './codex-accounts.js';
+export const codexAccountFileStore = {
+    loadAll: loadAllCodexAccounts,
+    save: saveSharedCodexAccount,
+    remove: removeSharedCodexAccount,
+    localRemovals: localCodexAccountRemovals,
+};
+/** A registry record complete enough to serve from, stored under its own alias. */
+export function isCodexRegistryRecord(alias, rec) {
+    const r = rec;
+    return !!r && typeof r === 'object' && r.alias === alias && isValidCodexAlias(alias)
+        && typeof r.accessToken === 'string' && r.accessToken.length > 0
+        && typeof r.refreshToken === 'string' && r.refreshToken.length > 0
+        && typeof r.expiresAt === 'number' && Number.isFinite(r.expiresAt);
+}
+// Enough of the account id to tell two apart in a log, and no more.
+function describeSeat(c) {
+    const id = extractChatGPTAccountId(c.idToken);
+    return id ? `ChatGPT account ending ${id.slice(-6)}` : 'ChatGPT seat';
+}
+export const CODEX_REGISTRY = {
+    path: '/codex-accounts',
+    noun: 'codex account',
+    store: codexAccountFileStore,
+    isRecord: isCodexRegistryRecord,
+    describe: describeSeat,
+    differ: (a, b) => {
+        const x = extractChatGPTAccountId(a.idToken), y = extractChatGPTAccountId(b.idToken);
+        return !!x && !!y && x !== y;
+    },
+};
+/** removeAccountEverywhere for a ChatGPT seat, for `dario codex remove`. */
+export function removeCodexAccountEverywhere(baseUrl, token, alias, opts = {}) {
+    return removeAccountEverywhere(baseUrl, token, alias, { ...opts, registry: CODEX_REGISTRY });
+}

package/dist/codex-accounts.d.ts

@@ -5,6 +5,12 @@ export interface CodexAccountCredentials {
     refreshToken: string;
     expiresAt: number;
     idToken?: string;
+    /**
+     * When this login was made, epoch ms. A refresh keeps it. The shared registry
+     * orders logins by it and weighs them against removals; a seat stored before
+     * it existed has none, which reads as older than any removal.
+     */
+    grantedAt?: number;
 }
 export declare function listCodexAccountAliases(): Promise<string[]>;
 export declare function hasAnyCodexAccount(nowMs?: number): Promise<boolean>;
@@ -19,7 +25,33 @@ export declare function _resetCodexPresenceCacheForTest(): void;
 export declare function loadCodexAccount(alias: string): Promise<CodexAccountCredentials | null>;
 export declare function loadAllCodexAccounts(): Promise<CodexAccountCredentials[]>;
 export declare function saveCodexAccount(creds: CodexAccountCredentials): Promise<void>;
+/** The seat files this process has removed, alias to epoch ms. */
+export declare function localCodexAccountRemovals(): ReadonlyMap<string, number>;
 export declare function removeCodexAccount(alias: string): Promise<boolean>;
+/**
+ * Write a record read from the shared registry, inside the alias's write chain.
+ * Skipped when this process removed the file at or after `fetchedAt`, since the
+ * registry was read before that removal, and when the file already holds
+ * credentials at least as new that outlive `removedAt`. `replaced` is the record
+ * the write overwrote.
+ */
+export declare function saveSharedCodexAccount(creds: CodexAccountCredentials, opts: {
+    fetchedAt: number;
+    removedAt?: number;
+}): Promise<{
+    saved: boolean;
+    replaced?: CodexAccountCredentials;
+}>;
+/**
+ * Remove a seat file because the shared registry holds a removal made at
+ * `removedAt`, inside the alias's write chain. A file granted after the removal
+ * is a later login and is kept. Not recorded in localCodexAccountRemovals:
+ * publishing it again under a later time would remove a login a peer made
+ * between the two.
+ */
+export declare function removeSharedCodexAccount(alias: string, removedAt: number): Promise<boolean>;
+/** Whether `alias` could name a seat file: the registry never hands the disk anything else. */
+export declare function isValidCodexAlias(alias: string): boolean;
 export declare function getCodexAccountsDir(): string;
 export declare function startAddCodexAccount(alias: string): Promise<{
     authorizeUrl: string;

package/dist/codex-accounts.js

@@ -8,12 +8,17 @@
  * getFreshCodexAccount comment below). Request routing lives in
  * provider-adapter.ts + codex-backend.ts; this module owns credentials on
  * disk and the selection/refresh in front of them.
+ *
+ * With --pool-shared-accounts the files also sync through a registry of their
+ * own (codex-account-sync.ts). The only thing that shares with accounts.ts is
+ * how two records order: credentialsAreNewer and grantedAfter.
  */
 import { readFile, mkdir, readdir, unlink } from 'node:fs/promises';
 import { join, basename } from 'node:path';
 import { homedir } from 'node:os';
 import { randomBytes } from 'node:crypto';
 import { generateCodexPKCE, buildCodexAuthorizeUrl, exchangeCodexAuthorizationCode, refreshCodexAccessToken, CodexRefreshError, } from './codex-oauth.js';
+import { credentialsAreNewer, grantedAfter } from './accounts.js';
 import { durableWriteFile } from './durable-write.js';
 import { ProviderCooldowns } from './provider-cooldown.js';
 import { codexHeadroom, codexLongWindowResetAt } from './codex-usage.js';
@@ -100,29 +105,108 @@ export async function loadAllCodexAccounts() {
     const loaded = await Promise.all(aliases.map(a => loadCodexAccount(a)));
     return loaded.filter((a) => a !== null);
 }
-export async function saveCodexAccount(creds) {
-    const path = safeAliasPath(creds.alias);
-    if (!path)
-        throw new Error(`invalid codex account alias: ${creds.alias}`);
+// One write at a time per alias: a refresh, a login, a removal and the shared
+// registry all write the same file, and the registry's check of what the file
+// holds has to see the last write rather than race it.
+const codexWrites = new Map();
+function serializeCodexWrite(alias, fn) {
+    const next = (codexWrites.get(alias) ?? Promise.resolve()).then(fn);
+    const tail = next.catch(() => { });
+    codexWrites.set(alias, tail);
+    void tail.then(() => { if (codexWrites.get(alias) === tail)
+        codexWrites.delete(alias); });
+    return next;
+}
+async function writeCodexFile(path, creds) {
     await ensureDir();
     await durableWriteFile(path, JSON.stringify(creds, null, 2), 0o600);
     // An account stored in THIS process (`dario codex add` in a running admin
-    // path, or a test) must not be hidden by a negative cache entry taken
-    // moments earlier.
+    // path, the shared registry, or a test) must not be hidden by a negative
+    // cache entry taken moments earlier.
     codexAbsentUntil = 0;
 }
+export async function saveCodexAccount(creds) {
+    const path = safeAliasPath(creds.alias);
+    if (!path)
+        throw new Error(`invalid codex account alias: ${creds.alias}`);
+    await serializeCodexWrite(creds.alias, () => writeCodexFile(path, creds));
+}
+// When this process removed each seat file, epoch ms, set inside the alias's
+// write chain. The shared registry publishes these as removal markers, so a
+// registry read already out when the file went cannot bring it back.
+const localCodexRemovals = new Map();
+/** The seat files this process has removed, alias to epoch ms. */
+export function localCodexAccountRemovals() {
+    return new Map(localCodexRemovals);
+}
 export async function removeCodexAccount(alias) {
     const path = safeAliasPath(alias);
     if (!path)
         return false;
-    try {
-        await unlink(path);
-        refreshFailures.delete(alias);
-        return true;
-    }
-    catch {
+    return serializeCodexWrite(alias, async () => {
+        try {
+            await unlink(path);
+            localCodexRemovals.set(alias, Date.now());
+            refreshFailures.delete(alias);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/**
+ * Write a record read from the shared registry, inside the alias's write chain.
+ * Skipped when this process removed the file at or after `fetchedAt`, since the
+ * registry was read before that removal, and when the file already holds
+ * credentials at least as new that outlive `removedAt`. `replaced` is the record
+ * the write overwrote.
+ */
+export async function saveSharedCodexAccount(creds, opts) {
+    const path = safeAliasPath(creds.alias);
+    if (!path)
+        return { saved: false };
+    return serializeCodexWrite(creds.alias, async () => {
+        const removedHere = localCodexRemovals.get(creds.alias);
+        if (removedHere !== undefined && removedHere >= opts.fetchedAt)
+            return { saved: false };
+        const current = await loadCodexAccount(creds.alias);
+        if (current && grantedAfter(current, opts.removedAt) && !credentialsAreNewer(creds, current))
+            return { saved: false };
+        await writeCodexFile(path, creds);
+        // New credentials: a failure remembered against the old ones says nothing about these.
+        refreshFailures.delete(creds.alias);
+        return { saved: true, replaced: current ?? undefined };
+    });
+}
+/**
+ * Remove a seat file because the shared registry holds a removal made at
+ * `removedAt`, inside the alias's write chain. A file granted after the removal
+ * is a later login and is kept. Not recorded in localCodexAccountRemovals:
+ * publishing it again under a later time would remove a login a peer made
+ * between the two.
+ */
+export async function removeSharedCodexAccount(alias, removedAt) {
+    const path = safeAliasPath(alias);
+    if (!path)
         return false;
-    }
+    return serializeCodexWrite(alias, async () => {
+        const current = await loadCodexAccount(alias);
+        if (!current || grantedAfter(current, removedAt))
+            return false;
+        try {
+            await unlink(path);
+            refreshFailures.delete(alias);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/** Whether `alias` could name a seat file: the registry never hands the disk anything else. */
+export function isValidCodexAlias(alias) {
+    return safeAliasPath(alias) !== null;
 }
 export function getCodexAccountsDir() {
     return CODEX_ACCOUNTS_DIR;
@@ -150,6 +234,7 @@ export async function completeAddCodexAccount(alias, code, codeVerifier) {
         refreshToken: tokens.refreshToken,
         expiresAt: tokens.expiresAt,
         idToken: tokens.idToken,
+        grantedAt: Date.now(),
     };
     await saveCodexAccount(creds);
     // Freshly minted credentials — whatever the old ones failed with is history.
@@ -174,8 +259,39 @@ export async function refreshCodexAccount(creds) {
         expiresAt: tokens.expiresAt,
         idToken: tokens.idToken,
     };
-    await saveCodexAccount(updated);
-    return updated;
+    return commitCodexRefresh(creds, updated);
+}
+/** A refresh finished for a seat whose file has gone: a removal, here or on another instance. */
+class CodexSeatRemovedError extends Error {
+    constructor(alias) {
+        super(`codex account ${alias} was removed while it refreshed`);
+        this.name = 'CodexSeatRemovedError';
+    }
+}
+/**
+ * Save what a refresh returned and answer with the credentials that survive.
+ * The token request takes seconds, and in that time the shared registry can
+ * write a newer login or remove the seat, or a peer's later refresh can land.
+ * So the result is weighed against the file inside this process's write chain
+ * for the alias: a file that changed to another login, or to a later expiry of this one, stands,
+ * and a file that has gone is not brought back. A file that did not change takes
+ * the result whatever its expiry: a forced refresh replaces a token the backend
+ * refused, which may have looked good for longer than the new one.
+ */
+async function commitCodexRefresh(before, updated) {
+    const path = safeAliasPath(before.alias);
+    if (!path)
+        throw new Error(`invalid codex account alias: ${before.alias}`);
+    return serializeCodexWrite(before.alias, async () => {
+        const current = await loadCodexAccount(before.alias);
+        if (!current)
+            throw new CodexSeatRemovedError(before.alias);
+        const changed = current.refreshToken !== before.refreshToken || current.accessToken !== before.accessToken;
+        if (changed && (current.grantedAt !== before.grantedAt || credentialsAreNewer(current, updated)))
+            return current;
+        await writeCodexFile(path, updated);
+        return updated;
+    });
 }
 /**
  * A refresh this process is not going to attempt right now: either the last one
@@ -289,8 +405,10 @@ function noteRefreshRecovered(alias) {
  * What's left is purely an efficiency concern — N concurrent requests arriving
  * on an expiring token shouldn't fire N identical refresh calls. One in-memory
  * promise per alias collapses them. If a second dario process refreshes the same
- * account at the same time, both simply succeed; last writer wins on disk and
- * the other process's token stays valid until its own expiry.
+ * account at the same time, both simply succeed, and the other process's token
+ * stays valid until its own expiry. Within one process commitCodexRefresh keeps
+ * the later expiry on disk. Two processes sharing a directory have no write chain
+ * in common, so there the last writer wins, which costs nothing for that reason.
  */
 const inflightRefresh = new Map();
 /**
@@ -339,6 +457,11 @@ async function refreshNow(creds) {
         return fresh;
     })
         .catch((err) => {
+        // Nothing failed upstream, so nothing is remembered against the alias: a
+        // later login under it starts clean.
+        if (err instanceof CodexSeatRemovedError) {
+            throw new CodexCredentialsUnavailableError(creds.alias, { at: Date.now(), status: 0, message: err.message });
+        }
         throw new CodexCredentialsUnavailableError(creds.alias, noteRefreshFailure(creds.alias, err));
     })
         .finally(() => {

package/dist/proxy.js

@@ -21,6 +21,7 @@ import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCo
 import { backfillIdentity } from './accounts.js';
 import { PoolSync, DEFAULT_POOL_SYNC_INTERVAL_MS } from './pool-sync.js';
 import { AccountSync, DEFAULT_ACCOUNT_SYNC_INTERVAL_MS } from './account-sync.js';
+import { CODEX_REGISTRY } from './codex-account-sync.js';
 import { Analytics, billingBucketFromClaim, costOfTokensFailClosed, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, thinkingTokensFromUsage, CODEX_CLAIM, CREDITS_CLAIM } from './analytics.js';
 import { Ledger, resolveLedgerPath, ledgerDisabledByEnv } from './ledger.js';
 import { renderPrometheus } from './metrics.js';
@@ -1538,7 +1539,21 @@ export async function startProxy(opts = {}) {
     // already-running proxy is picked up without a restart — `dario login`
     // restarts the proxy by convention, `dario codex add` does not. The
     // credentials themselves are re-read per request too (they rotate on
-    // refresh).
+    // refresh). So a sync only has to write the file, and the first one runs
+    // here: a replica whose only seat is a peer's still boots.
+    // The seats need no Claude login, so --no-claude-auth leaves this on.
+    const lockUrl = process.env['DARIO_REFRESH_LOCK_URL'];
+    const codexAccountSync = opts.poolSharedAccounts && lockUrl
+        ? new AccountSync({
+            baseUrl: lockUrl,
+            token: process.env['DARIO_REFRESH_LOCK_TOKEN'] ?? '',
+            intervalMs: DEFAULT_ACCOUNT_SYNC_INTERVAL_MS,
+            log: (line) => console.error(line),
+            registry: CODEX_REGISTRY,
+        })
+        : null;
+    if (codexAccountSync)
+        await codexAccountSync.syncOnce();
     const startupCodexAliases = await listCodexAccountAliases();
     if (startupCodexAliases.length > 0) {
         console.log(`  Codex accounts: ${startupCodexAliases.join(', ')} → ${CODEX_BACKEND_BASE_URL}`);
@@ -1659,8 +1674,8 @@ export async function startProxy(opts = {}) {
     // Shared account registry (account-sync.ts): opt-in, rides the refresh-lock
     // service, fails open. Merged before the pool loads, so a replica that
     // boots with an empty accounts directory starts with its peers' accounts.
-    // Claude seats only, so not under --no-claude-auth.
-    const lockUrl = process.env['DARIO_REFRESH_LOCK_URL'];
+    // Claude seats, so not under --no-claude-auth; ChatGPT seats have their own
+    // above.
     const accountSync = opts.poolSharedAccounts && lockUrl && !opts.noClaudeAuth
         ? new AccountSync({
             baseUrl: lockUrl,
@@ -1673,7 +1688,7 @@ export async function startProxy(opts = {}) {
         console.error('[dario] --pool-shared-accounts needs DARIO_REFRESH_LOCK_URL (the lock service holds the registry); serving the accounts on this instance\'s disk only');
     }
     else if (opts.poolSharedAccounts && opts.noClaudeAuth) {
-        console.error('[dario] --pool-shared-accounts is off under --no-claude-auth: the registry holds Claude seats, and this instance loads none');
+        console.error('[dario] --pool-shared-accounts shares ChatGPT seats only under --no-claude-auth: this instance loads no Claude seats');
     }
     if (accountSync)
         await accountSync.syncOnce();
@@ -2506,6 +2521,10 @@ export async function startProxy(opts = {}) {
         console.log(`  Pool shared accounts: on (via ${lockUrl}, syncing every ${accountSync.intervalMs / 1000}s; fails open)`);
         accountSync.start();
     }
+    if (codexAccountSync) {
+        console.log(`  Pool shared ChatGPT seats: on (via ${lockUrl}, syncing every ${codexAccountSync.intervalMs / 1000}s; fails open)`);
+        codexAccountSync.start();
+    }
     const ERR_UNAUTH = JSON.stringify({ error: 'Unauthorized', message: 'Invalid or missing API key' });
     const ERR_FORBIDDEN = JSON.stringify({ error: 'Forbidden', message: 'Path not allowed. Supported paths: POST /v1/messages, POST /v1/messages/count_tokens, POST /v1/chat/completions, GET /v1/models' });
     const ERR_METHOD = JSON.stringify({ error: 'Method not allowed' });
@@ -2995,10 +3014,16 @@ export async function startProxy(opts = {}) {
                 // through the store the live proxy authenticates from, so a key made
                 // here works on the next request.
                 keys: keyStore,
+                // Logins started and not yet completed ride the shared registry's
+                // service, so a login started on one replica completes on another.
+                sharedLogins: accountSync ?? codexAccountSync,
                 onCodexAccountsChanged: async () => {
                     // A ChatGPT seat came or went over HTTP (dario#1009): forget the
                     // "no codex account" answer so the next request routes to it.
                     resetCodexPresenceCache();
+                    // Publish the change now rather than at the next interval.
+                    if (codexAccountSync)
+                        void codexAccountSync.syncOnce();
                     if (verbose)
                         console.log('[dario] admin: codex accounts changed — re-read on the next request');
                 },
@@ -3245,6 +3270,7 @@ export async function startProxy(opts = {}) {
                 sharedState: poolSync ? poolSync.status() : null,
                 // Shared account registry (account-sync.ts), null when off.
                 sharedAccounts: accountSync ? accountSync.status() : null,
+                sharedCodexAccounts: codexAccountSync ? codexAccountSync.status() : null,
                 accounts,
             }));
             return;
@@ -6910,6 +6936,7 @@ export async function startProxy(opts = {}) {
         clearInterval(refreshInterval);
         poolSync?.stop();
         accountSync?.stop();
+        codexAccountSync?.stop();
         // Stop accepting connections now; responses already streaming keep going.
         // Tokens and what the ledger already holds are written while the drain
         // waits. The ledger, the key store and the request log close only after

package/docs/admin-api.md

@@ -78,7 +78,8 @@ Pending-login mechanics, for scripting against it:
   different login attempt.
 - An expired or unknown alias gets `410` — start a new login.
 - The PKCE verifier and state never touch disk and are never returned to the
-  client.
+  client. With `--pool-shared-accounts` on they are also held by the shared
+  service until the login completes, is replaced or lapses; see below.
 
 ## Endpoint reference
 
@@ -131,6 +132,25 @@ one instance this way provisions them all, and a new replica starts with the
 accounts already in the registry. `GET /accounts` then carries a
 `sharedAccounts` block with the sync's state.
 
+**Behind a load balancer, `/start` and `/complete` can land on different
+instances.** With the same switch on, a pending login is published to the shared
+service too, for both Claude and ChatGPT logins, and `/complete` reads it from
+there. The mechanics above hold fleet-wide: 10 minutes, single-use (of two
+instances completing at once, one gets `200` and the other `410`; a
+`/start` that replaces the login in between leaves the new one for its own
+paste), one per alias, at most 64 per engine. A generated default alias skips
+one pending on another instance, and the service creates it only if no live
+login holds it, so two instances starting at once get different aliases (if
+all 8 candidates it tries are taken it answers `409`). If the service does not answer when a login starts, it is
+kept on that instance only and logged (never the verifier or state); a
+`/complete` that lands elsewhere gets the usual `410`, so retry it through
+the instance that started it or start again. A login completes once: a retry
+after it gets `410` too, wherever it lands. The instance that completes a ChatGPT
+login publishes the seat, and the others have it within a sync. An instance that
+already holds a seat under the alias refuses with `409`, without consuming the
+login, so `DELETE /admin/codex/accounts/<alias>` first to replace one. With the switch off, pending logins stay in the process that started
+them, so send `/start` and `/complete` to the same instance.
+
 ## Pinning a request to one seat
 
 `x-dario-account: <alias>` on `POST /v1/messages` (or `/v1/chat/completions`) routes that one request to the named pool account with **no failover**: no headroom selection, no sticky rebinding, no peer retry on 401/429, no Codex leg. The upstream status comes back as-is. It is the primitive behind `dario accounts check <alias>` — the answer to "does this seat serve Sonnet right now?" without copying a credential anywhere or restarting anything.

package/docs/multi-instance.md

@@ -119,7 +119,7 @@ It fails open like the lock: an unreachable service is one log line per outage a
 
 ## Sharing the account list
 
-Without it, each instance serves the accounts in its own `~/.dario/accounts/`. With `--pool-shared-accounts` the instances keep one account list in the same lock service: a replica that starts with an empty accounts directory (a second pod on a fresh volume) starts with its peers' accounts, and an account added or removed on one instance is added or removed on all of them.
+Without it, each instance serves the accounts in its own `~/.dario/accounts/`. With `--pool-shared-accounts` the instances keep one account list in the same lock service: a replica that starts with an empty accounts directory (a second pod on a fresh volume) starts with its peers' accounts, and an account added or removed on one instance is added or removed on all of them. ChatGPT seats in `~/.dario/codex-accounts/` are shared the same way, in a registry of their own.
 
 ```
 DARIO_REFRESH_LOCK_URL=http://<lock-host>:8080
@@ -131,6 +131,7 @@ Set it on every instance. It works with or without `--pool-shared-state`.
 
 - **At startup**, before the pool loads, an instance reads the registry and merges it with its accounts directory. Per alias the newer record wins: a newer login first, then, for the same login, the later expiry. Accounts only this instance holds are published; accounts only the registry holds are written to this instance's accounts directory. The pool then loads from that directory as usual, so `/health` is ready as soon as a peer has an account.
 - **Every 15 seconds** after that it merges again, and updates the running pool too: a new account joins it, newer credentials replace older ones, and a removed account leaves it. A `dario accounts add`, an admin API login or a token refresh on one instance reaches the others within one sync. An admin API login or removal is published straight away, and the other instances apply it on their next sync.
+- **Admin API logins complete on any instance.** A login started with `POST /admin/login/start` (or `/admin/codex/login/start`) is also published to the service for its 10 minutes, so `/complete` can land on a different replica behind the load balancer. It is single-use across the fleet, and is removed from the service when it completes or is replaced. A lapsed login is never served; the Worker deletes it at its lapse by an alarm, and Redis deletes it on the next start after the lapse or when the hash expires at the newest lapse of any login in it, at most an hour past its own. If the service does not answer at `/start`, that login stays on the instance that started it, with a log line that names the alias only. During an outage a login found only on the service cannot complete; this instance completes one only if it still holds its own copy, and only one overlapping call gets it. An instance keeps at most 64 pending logins: copies of logins the service holds give way to new starts, logins kept here alone do not. Without the switch, send both calls to the same instance.
 - **A removal leaves a marker** in the registry. The marker beats every login made before the removal, so an instance that was offline and still holds the old file deletes it instead of publishing it back. That holds for the `login` account taken from `credentials.json` at startup too: an instance whose login was removed starts without it instead of serving it. A login made after the removal beats the marker, and the account comes back everywhere.
 - **`dario accounts remove <alias>`** publishes the removal first and deletes the file only once the service has taken it. If the service cannot be reached it removes nothing and says so, since the other instances would put the account straight back. A login made after the removal stays, in the registry or in the file here, and the command says so; run it again to remove that login too. If the file here can't be deleted, the command says so and exits non-zero, and this instance keeps serving the account until the file goes.
 
@@ -138,12 +139,13 @@ The proxy says it is on at startup (`Pool shared accounts: on (via …, syncing
 
 Before turning it on:
 
+- **The service also holds the PKCE verifier and state of a login in progress,** for its 10 minutes, and in Redis possibly up to an hour past that (see above). They are secrets, stored as the account records are, and a caller holding `DARIO_REFRESH_LOCK_TOKEN` can complete that login.
 - **The registry holds every seat's credentials, refresh tokens included, and they do not expire there.** That is what lets a new replica start with no files. Guard the lock service like the accounts directory itself: a real random `DARIO_REFRESH_LOCK_TOKEN`, the service on a private network, and a Redis that nothing else uses. Anyone who can read that Redis or the Durable Object can use every subscription in the pool.
 - **Aliases are one namespace across all instances.** Two instances that each log a different subscription in under the same alias (`login`, most often) keep only the newer login, and the instance whose account was replaced logs it loudly: `account "login" here was ... and is now ...; aliases are shared across instances, so give each subscription its own alias`. Give each subscription its own alias.
 - **Clocks have to agree.** The newer login and removal rules compare wall-clock times taken on different machines. Run NTP; Kubernetes nodes do by default.
-- **Claude seats only.** ChatGPT accounts stay per instance, and the switch is off under `--no-claude-auth`.
+- **ChatGPT seats share their credentials, not their state.** A seat's login reaches every instance and a removal leaves them all, under the same rules as a Claude account, and `dario codex remove` publishes first in the same way. Each instance still reads a seat's usage and keeps its cool-downs on its own, so one instance can pick a seat another has just found rate limited. The seats need no refresh lock: two refreshes of one token both succeed, so each instance refreshes on its own and the later expiry wins. Aliases are a namespace per engine, so `rama` can be a Claude account and a ChatGPT seat. Within an engine the rule above holds: replicas with different subscriptions under one alias keep only the newer login, and until now each replica's default was `altman-1`, so check before turning this on. Under `--no-claude-auth` only the ChatGPT seats sync. A seat stored before this version has no grant time, so it orders by expiry until its next login, and a removal covers it whenever it was made. An instance that already holds a seat under an alias answers `409` to a login for it, and leaves the login unconsumed.
 - **It fails open.** With the service unreachable, each instance serves the accounts on its own disk and logs once per outage. A removal made while it is down is published when it answers again; if the instance restarts before then, that removal is lost and the account comes back from the registry, so remove it again.
-- **Upgrade the lock service.** The `/accounts/*` endpoints are new: rebuild the Redis image or redeploy the Worker. An older service answers 404, which an instance logs as the service being unreachable and then serves its own disk, so nothing breaks, but nothing is shared either.
+- **Upgrade the lock service.** The `/accounts/*` endpoints are new: rebuild the Redis image or redeploy the Worker. An older service answers 404, which an instance logs as the service being unreachable and then serves its own disk, so nothing breaks, but nothing is shared either. The `/logins/*` endpoints for pending admin API logins arrived after `/accounts/*`; on a service without them an instance keeps its pending logins to itself and logs it. The `/codex-accounts/*` endpoints came later still; on a service without them the ChatGPT seats stay per instance, and the instance logs the service as unreachable for them while its Claude accounts sync as usual.
 
 ## Proving it works on your own setup
 
@@ -172,7 +174,7 @@ Anthropic's token endpoint is the one mocked part, and only that — hammering t
 
 Everything above is as far as dario goes today: shared credentials through the lock, shared rate-limit readings and sticky bindings through `--pool-shared-state`, and a shared account list through `--pool-shared-accounts`, all eventually consistent and all failing open. Without `--pool-shared-accounts` the account list is per instance too, and copying the account files to every instance is safe with the refresh lock on: the copies share one refresh token, and whichever instance refreshes first hands the result to the others ([#1733](https://github.com/askalf/dario/issues/1733)). Without the lock, copies race exactly as described in section 1. Three things are still per instance:
 
-- **ChatGPT seats.** The Codex accounts have their own refresh flow and usage windows; neither the lock nor the shared state covers them.
+- **ChatGPT seat state.** `--pool-shared-accounts` shares their credentials, but each instance keeps its own usage readings and cool-downs.
 - **The ledger.** Each instance writes its own file, so `dario usage` and `/analytics` show that instance's share of the spend.
 - **The overage guard's halt**, which each instance tracks on its own.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.20.3",
+  "version": "6.22.0",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, opt-in failover when one hits its limit, and a ledger of what each plan absorbed.",
   "type": "module",
   "bin": {