@askalf/dario 6.4.0 → 6.5.0

package/dist/codex-accounts.d.ts

@@ -61,14 +61,88 @@ export declare function _resetCodexRefreshFailuresForTest(): void;
  * a misleading "run `dario login`" answer to the client.
  */
 export declare function getFreshCodexAccount(creds: CodexAccountCredentials): Promise<CodexAccountCredentials>;
+/** Record that `alias` declined, for as long as the upstream asked. */
+export declare function noteCodexDecline(alias: string, retryAfterMs?: number | null): number;
+/** A seat that just served is not rate-limited — clear it. */
+export declare function clearCodexDecline(alias: string): void;
+/** Ms until `alias` is askable again; 0 when it is askable now. */
+export declare function codexCooldownRemainingMs(alias: string): number;
+/** Test seam — forget every cool-down and binding. */
+export declare function _resetCodexPoolForTest(): void;
+/** The alias currently bound to a conversation, or null. */
+export declare function codexStickyAliasFor(key: string | null | undefined): string | null;
 /**
- * Pick the account to serve a request. Single account is the expected case (one
- * ChatGPT subscription); with several, `DARIO_CODEX_ACCOUNT` names one and
- * otherwise the first alphabetically wins. No rotation/least-recently-used
- * balancing — a subscription is per-seat, so spreading load across seats is the
- * user's decision to make explicitly, not something to do implicitly.
+ * Move a conversation onto `alias`, the codex mirror of pool.rebindSticky.
+ *
+ * Selection binds a conversation to the seat it picked; mid-request failover
+ * then moves it, and without this the binding still names the seat that just
+ * declined — the next turn would read a stale binding, find it cooling, and
+ * re-pick from scratch. A null key is accepted so the caller does not have to
+ * guard: a request with no hashable first user message has no conversation to
+ * bind.
+ */
+export declare function rebindCodexSticky(key: string | null | undefined, alias: string): void;
+/**
+ * Choose a ChatGPT seat for this request.
+ *
+ * Order, most specific first:
+ *   1. an explicitly named alias (`x-dario-account`, DARIO_CODEX_ACCOUNT) — a
+ *      pin is an instruction, so it is honoured even while cooling; the caller
+ *      asked for that seat and gets its answer, 429 included.
+ *   2. the seat this conversation is already bound to, unless it is cooling.
+ *   3. the first seat alphabetically that is not cooling — deterministic, so a
+ *      given conversation lands on the same seat across a restart and keeps its
+ *      prompt cache.
+ *   4. null when every seat is cooling. The caller answers from that rather
+ *      than spending a request that can only 429 again.
+ */
+export declare function selectCodexAccount(preferredAlias?: string, opts?: {
+    stickyKey?: string | null;
+}): Promise<CodexAccountCredentials | null>;
+/**
+ * The next askable seat that this request has NOT already tried.
+ *
+ * Mid-flight failover: a seat that 429s during a request hands the SAME
+ * request to a peer rather than failing it. Without this the pool only helps
+ * the request AFTER the one that discovered the limit — the discovering
+ * request still failed, every time a window rolled over.
+ *
+ * `tried` is per-request, so a seat already attempted here is never revisited
+ * inside the same request even if its cool-down has not landed yet. That is
+ * the codex mirror of the Claude pool's selectExcluding, and it is what makes
+ * the loop terminate: every pass adds a seat, so it is bounded by pool size.
+ *
+ * Stickiness is deliberately NOT consulted. The bound seat is the one that
+ * just declined; re-offering it would loop, and a conversation whose seat has
+ * gone away is better served elsewhere than not at all.
+ */
+export declare function selectCodexAccountExcluding(tried: ReadonlySet<string>): Promise<CodexAccountCredentials | null>;
+/** Every seat is cooling — the fail-fast condition, for the caller's message. */
+/**
+ * Are ALL of these aliases cooling, right now?
+ *
+ * Synchronous on purpose. The provider-wide cool-down is written from this
+ * answer, and an `await` between deciding and writing is a window another
+ * in-flight request can use: the last-limited-seat request observes every seat
+ * cooling, a peer then succeeds on a just-recovered seat and calls
+ * clearCodexDecline, and the delayed continuation re-cools the whole provider
+ * against a pool that is healthy again. canAttempt('codex') then short-circuits
+ * and the healthy seat is skipped until the stale window expires — the exact
+ * single-seat outage this pool exists to prevent, reintroduced by the
+ * bookkeeping meant to prevent it.
+ *
+ * Re-checking inside the continuation narrows that window; it does not close
+ * it, because the re-check is itself another await. Taking the alias list first
+ * and then deciding-and-writing with no suspension point between them closes it
+ * outright: JS runs that callback as one unit, so nothing can interleave.
+ *
+ * The alias list may be a tick stale, which is harmless — a seat added in that
+ * window is not cooling, so "all cooled" is false on the next decline anyway.
  */
-export declare function selectCodexAccount(preferredAlias?: string): Promise<CodexAccountCredentials | null>;
+export declare function allAliasesCooled(aliases: readonly string[]): boolean;
+export declare function allCodexAccountsCooled(): Promise<boolean>;
+/** Longest remaining cool-down across every seat, for a `retry-after`. */
+export declare function codexPoolRetryAfterMs(): Promise<number>;
 /**
  * Parse whatever the user pastes back after authorizing.
  *

package/dist/codex-accounts.js

@@ -15,6 +15,7 @@ import { homedir } from 'node:os';
 import { randomBytes } from 'node:crypto';
 import { generateCodexPKCE, buildCodexAuthorizeUrl, exchangeCodexAuthorizationCode, refreshCodexAccessToken, CodexRefreshError, } from './codex-oauth.js';
 import { durableWriteFile } from './durable-write.js';
+import { ProviderCooldowns } from './provider-cooldown.js';
 const DARIO_DIR = join(homedir(), '.dario');
 const CODEX_ACCOUNTS_DIR = join(DARIO_DIR, 'codex-accounts');
 /** Same alias charset/traversal guard as accounts.ts's safeAliasPath. */
@@ -298,7 +299,105 @@ export async function getFreshCodexAccount(creds) {
  * balancing — a subscription is per-seat, so spreading load across seats is the
  * user's decision to make explicitly, not something to do implicitly.
  */
-export async function selectCodexAccount(preferredAlias) {
+/**
+ * Per-seat cool-downs and conversation stickiness for the ChatGPT pool
+ * (dario#1244 follow-up).
+ *
+ * Until now selectCodexAccount returned `sort()[0]` — the alphabetically FIRST
+ * account, every time. `dario add altman` will happily store a dozen seats and
+ * dario would use exactly one of them. That is why the account-wide 429 on
+ * 2026-09-07 took the whole GPT lane down: a second seat sat there, healthy and
+ * unreachable, while every request failed over to Claude.
+ *
+ * Reuses ProviderCooldowns keyed by ALIAS rather than by provider name. It is
+ * already the right shape — arbitrary string key, injectable clock, entries
+ * dropped on read — so the pool needs no second cool-down implementation.
+ *
+ * ROTATION IS PER-CONVERSATION, NOT PER-REQUEST, and that is the whole design.
+ * The Codex prompt cache is scoped to the serving account: a conversation that
+ * builds a prefix on seat A reads nothing from it on seat B, and measured cache
+ * share on this lane is 59% in production against a 73% controlled ceiling.
+ * Rotating per request would trade a rate-limit problem for a cache problem and
+ * come out behind. So a conversation binds to a seat and stays there until that
+ * seat actually declines.
+ *
+ * Deliberately NOT headroom routing like the Claude pool. Claude responds with
+ * `anthropic-ratelimit-*` headers on every response, so that pool can read
+ * utilisation before it picks. The Codex backend states nothing until it 429s —
+ * the only signal is the decline itself plus its `retry-after` — so this is
+ * fill-first with cool-down eviction, which is what the available signal
+ * supports. If the backend ever starts reporting utilisation, this is where
+ * headroom would go.
+ */
+let codexCooldowns = new ProviderCooldowns();
+/** conversation sticky key -> alias. Bounded; swept when it exceeds the cap. */
+const codexSticky = new Map();
+const CODEX_STICKY_MAX = 500;
+/** Record that `alias` declined, for as long as the upstream asked. */
+export function noteCodexDecline(alias, retryAfterMs) {
+    return codexCooldowns.note(alias, retryAfterMs);
+}
+/** A seat that just served is not rate-limited — clear it. */
+export function clearCodexDecline(alias) {
+    codexCooldowns.clear(alias);
+}
+/** Ms until `alias` is askable again; 0 when it is askable now. */
+export function codexCooldownRemainingMs(alias) {
+    return codexCooldowns.remainingMs(alias);
+}
+/** Test seam — forget every cool-down and binding. */
+export function _resetCodexPoolForTest() {
+    codexSticky.clear();
+    // A fresh instance rather than clearing per alias: the previous version
+    // emptied the sticky map first and then iterated it, so it cleared nothing
+    // and cool-downs leaked between test cases.
+    codexCooldowns = new ProviderCooldowns();
+}
+/** The alias currently bound to a conversation, or null. */
+export function codexStickyAliasFor(key) {
+    return key ? codexSticky.get(key) ?? null : null;
+}
+function bindCodexSticky(key, alias) {
+    if (codexSticky.size >= CODEX_STICKY_MAX && !codexSticky.has(key)) {
+        // Oldest-first eviction: Map preserves insertion order, so the first key is
+        // the least recently bound. Losing a binding costs one cache miss, never
+        // correctness, so a cheap sweep beats an LRU.
+        const oldest = codexSticky.keys().next().value;
+        if (oldest !== undefined)
+            codexSticky.delete(oldest);
+    }
+    codexSticky.set(key, alias);
+}
+/**
+ * Move a conversation onto `alias`, the codex mirror of pool.rebindSticky.
+ *
+ * Selection binds a conversation to the seat it picked; mid-request failover
+ * then moves it, and without this the binding still names the seat that just
+ * declined — the next turn would read a stale binding, find it cooling, and
+ * re-pick from scratch. A null key is accepted so the caller does not have to
+ * guard: a request with no hashable first user message has no conversation to
+ * bind.
+ */
+export function rebindCodexSticky(key, alias) {
+    if (!key)
+        return;
+    bindCodexSticky(key, alias);
+}
+/**
+ * Choose a ChatGPT seat for this request.
+ *
+ * Order, most specific first:
+ *   1. an explicitly named alias (`x-dario-account`, DARIO_CODEX_ACCOUNT) — a
+ *      pin is an instruction, so it is honoured even while cooling; the caller
+ *      asked for that seat and gets its answer, 429 included.
+ *   2. the seat this conversation is already bound to, unless it is cooling.
+ *   3. the first seat alphabetically that is not cooling — deterministic, so a
+ *      given conversation lands on the same seat across a restart and keeps its
+ *      prompt cache.
+ *   4. null when every seat is cooling. The caller answers from that rather
+ *      than spending a request that can only 429 again.
+ */
+export async function selectCodexAccount(preferredAlias, opts) {
     const alias = preferredAlias || process.env.DARIO_CODEX_ACCOUNT;
     if (alias) {
         const one = await loadCodexAccount(alias);
@@ -308,7 +407,83 @@ export async function selectCodexAccount(preferredAlias) {
     const all = await loadAllCodexAccounts();
     if (all.length === 0)
         return null;
-    return [...all].sort((a, b) => a.alias.localeCompare(b.alias))[0];
+    const byAlias = [...all].sort((a, b) => a.alias.localeCompare(b.alias));
+    const key = opts?.stickyKey ?? null;
+    if (key) {
+        const bound = codexSticky.get(key);
+        if (bound && !codexCooldowns.isCooled(bound)) {
+            const hit = byAlias.find((c) => c.alias === bound);
+            // A binding to a seat that has since been removed falls through to a
+            // fresh pick rather than failing the request.
+            if (hit)
+                return hit;
+            codexSticky.delete(key);
+        }
+    }
+    const free = byAlias.find((c) => !codexCooldowns.isCooled(c.alias));
+    if (!free)
+        return null;
+    if (key)
+        bindCodexSticky(key, free.alias);
+    return free;
+}
+/**
+ * The next askable seat that this request has NOT already tried.
+ *
+ * Mid-flight failover: a seat that 429s during a request hands the SAME
+ * request to a peer rather than failing it. Without this the pool only helps
+ * the request AFTER the one that discovered the limit — the discovering
+ * request still failed, every time a window rolled over.
+ *
+ * `tried` is per-request, so a seat already attempted here is never revisited
+ * inside the same request even if its cool-down has not landed yet. That is
+ * the codex mirror of the Claude pool's selectExcluding, and it is what makes
+ * the loop terminate: every pass adds a seat, so it is bounded by pool size.
+ *
+ * Stickiness is deliberately NOT consulted. The bound seat is the one that
+ * just declined; re-offering it would loop, and a conversation whose seat has
+ * gone away is better served elsewhere than not at all.
+ */
+export async function selectCodexAccountExcluding(tried) {
+    const all = await loadAllCodexAccounts();
+    if (all.length === 0)
+        return null;
+    return [...all]
+        .sort((a, b) => a.alias.localeCompare(b.alias))
+        .find((c) => !tried.has(c.alias) && !codexCooldowns.isCooled(c.alias)) ?? null;
+}
+/** Every seat is cooling — the fail-fast condition, for the caller's message. */
+/**
+ * Are ALL of these aliases cooling, right now?
+ *
+ * Synchronous on purpose. The provider-wide cool-down is written from this
+ * answer, and an `await` between deciding and writing is a window another
+ * in-flight request can use: the last-limited-seat request observes every seat
+ * cooling, a peer then succeeds on a just-recovered seat and calls
+ * clearCodexDecline, and the delayed continuation re-cools the whole provider
+ * against a pool that is healthy again. canAttempt('codex') then short-circuits
+ * and the healthy seat is skipped until the stale window expires — the exact
+ * single-seat outage this pool exists to prevent, reintroduced by the
+ * bookkeeping meant to prevent it.
+ *
+ * Re-checking inside the continuation narrows that window; it does not close
+ * it, because the re-check is itself another await. Taking the alias list first
+ * and then deciding-and-writing with no suspension point between them closes it
+ * outright: JS runs that callback as one unit, so nothing can interleave.
+ *
+ * The alias list may be a tick stale, which is harmless — a seat added in that
+ * window is not cooling, so "all cooled" is false on the next decline anyway.
+ */
+export function allAliasesCooled(aliases) {
+    return aliases.length > 0 && aliases.every((a) => codexCooldowns.isCooled(a));
+}
+export async function allCodexAccountsCooled() {
+    return allAliasesCooled(await listCodexAccountAliases());
+}
+/** Longest remaining cool-down across every seat, for a `retry-after`. */
+export async function codexPoolRetryAfterMs() {
+    const aliases = await listCodexAccountAliases();
+    return aliases.reduce((max, a) => Math.max(max, codexCooldowns.remainingMs(a)), 0);
 }
 /**
  * Parse whatever the user pastes back after authorizing.

package/dist/codex-backend.d.ts

@@ -48,6 +48,9 @@ export interface CodexForwardOutcome {
 export interface CodexDecline {
     status: number;
     retryAfterMs: number | null;
+    /** The seat that declined. Without it a caller can cool the provider but
+     *  not the account, which is the whole point of a pool. */
+    alias: string;
 }
 /** The cached slug list for an alias WITHOUT fetching. For the admin surface:
  *  a status read must never cost an upstream call or a token refresh. */
@@ -275,7 +278,16 @@ export declare function buildCodexHeaders(creds: CodexAccountCredentials): Recor
  * into a buffered response object is not built yet. A non-streaming client
  * gets a 400 saying so.
  */
-export declare function forwardResponsesToCodex(res: ServerResponse, body: Record<string, unknown>, creds: CodexAccountCredentials, corsOrigin: string, securityHeaders: Record<string, string>, upstreamTimeoutMs: number, verbose: boolean, fetchImpl?: typeof fetch, onDone?: (outcome: CodexForwardOutcome) => void): Promise<boolean>;
+export declare function forwardResponsesToCodex(res: ServerResponse, body: Record<string, unknown>, creds: CodexAccountCredentials, corsOrigin: string, securityHeaders: Record<string, string>, upstreamTimeoutMs: number, verbose: boolean, fetchImpl?: typeof fetch, onDone?: (outcome: CodexForwardOutcome) => void, 
+/** Mirrors forwardToCodex. A 429 or 5xx is the SEAT saying no, and the
+ *  caller needs to know which seat and for how long — without it the pool
+ *  cannot cool a limited seat on this path, so selection hands the same
+ *  rate-limited account back on every following request. */
+onDecline?: (info: CodexDecline) => void, 
+/** When true a decline returns false WITHOUT writing, so the caller can
+ *  retry the request on a healthy peer. False keeps the old behaviour: the
+ *  upstream error is written through as the backend sent it. */
+deferOnUnavailable?: boolean): Promise<boolean>;
 /**
  * Serve a request from a stored Codex account, in either client wire shape.
  *

package/dist/codex-backend.js

@@ -759,7 +759,16 @@ export function buildCodexHeaders(creds) {
  * into a buffered response object is not built yet. A non-streaming client
  * gets a 400 saying so.
  */
-export async function forwardResponsesToCodex(res, body, creds, corsOrigin, securityHeaders, upstreamTimeoutMs, verbose, fetchImpl = fetch, onDone) {
+export async function forwardResponsesToCodex(res, body, creds, corsOrigin, securityHeaders, upstreamTimeoutMs, verbose, fetchImpl = fetch, onDone, 
+/** Mirrors forwardToCodex. A 429 or 5xx is the SEAT saying no, and the
+ *  caller needs to know which seat and for how long — without it the pool
+ *  cannot cool a limited seat on this path, so selection hands the same
+ *  rate-limited account back on every following request. */
+onDecline, 
+/** When true a decline returns false WITHOUT writing, so the caller can
+ *  retry the request on a healthy peer. False keeps the old behaviour: the
+ *  upstream error is written through as the backend sent it. */
+deferOnUnavailable = false) {
     const startedAt = Date.now();
     const model = String(body.model ?? '');
     let reported = false;
@@ -804,6 +813,23 @@ export async function forwardResponsesToCodex(res, body, creds, corsOrigin, secu
             const detail = await upstream.text().catch(() => '');
             if (verbose)
                 console.error(`[dario] codex backend ${upstream.status}: ${detail.slice(0, 300)}`);
+            // Same rule as the Messages path: a 429 or a 5xx is the seat declining,
+            // and that is true whether or not anything is waiting to take over.
+            const unavailable = upstream.status === 429 || upstream.status >= 500;
+            if (unavailable) {
+                try {
+                    onDecline?.({ status: upstream.status, retryAfterMs: parseRetryAfterMs(upstream.headers.get('retry-after')), alias: creds.alias });
+                }
+                catch { /* a reporting failure must never break a request */ }
+            }
+            if (deferOnUnavailable && unavailable) {
+                if (verbose)
+                    console.log(`[dario] codex account ${creds.alias} unavailable (${upstream.status}) — deferring`);
+                // Nothing written, so the caller is free to retry this same request
+                // on a peer. Reporting nothing here matches forwardToCodex: a
+                // declined attempt is not a served request.
+                return false;
+            }
             if (!clientGone) {
                 res.writeHead(upstream.status, { 'Content-Type': 'application/json', ...securityHeaders });
                 // The backend's own error body, already in the client's shape.
@@ -1048,16 +1074,25 @@ midstream) {
             // own fault (a bad body, an unsupported parameter) is NOT: failing over
             // would just reproduce it somewhere else and hide the real error.
             const unavailable = upstream.status === 429 || upstream.status >= 500;
+            // The seat said no, and that is true whether or not a fallback exists
+            // to defer to. Recording it outside the defer branch is what lets the
+            // POOL rotate on a deployment with no --pool-fallback configured: with
+            // the notice inside the branch, a 429 went straight to the client and
+            // the seat was never cooled, so selection returned the same limited
+            // account forever (found writing the proxy-level test for #1288).
+            if (unavailable) {
+                try {
+                    onDecline?.({ status: upstream.status, retryAfterMs: parseRetryAfterMs(upstream.headers.get('retry-after')), alias: creds.alias });
+                }
+                catch { /* a reporting failure must never break a request */ }
+            }
             if (deferOnUnavailable && unavailable) {
                 console.log(`[dario] codex account ${creds.alias} unavailable (${upstream.status}) — deferring to the next provider`);
                 // A decline is the only exit that tells the caller nothing was served,
                 // and until now it carried no WHY: a 429 and a 503 were the same false.
                 // The chain needs the status (to cool a rate limit but not an outage)
                 // and the upstream's own `retry-after` (to cool it for the right long).
-                try {
-                    onDecline?.({ status: upstream.status, retryAfterMs: parseRetryAfterMs(upstream.headers.get('retry-after')) });
-                }
-                catch { /* a reporting failure must never break a declined request */ }
+                // (the decline was already recorded above, for both exits)
                 return false;
             }
             res.writeHead(upstream.status, { 'Content-Type': 'application/json', ...securityHeaders });
@@ -1251,7 +1286,7 @@ midstream) {
             // status 0: no HTTP status ever arrived. Reported so the caller can tell
             // an outage from a rate limit — an unreachable backend is not quota.
             try {
-                onDecline?.({ status: 0, retryAfterMs: null });
+                onDecline?.({ status: 0, retryAfterMs: null, alias: creds.alias });
             }
             catch { /* as above */ }
             return false;

package/dist/proxy.js

@@ -31,7 +31,7 @@ import { responsesRequestToAnthropic, unsupportedOnClaudeError, ResponsesRequest
 import { isClaudeServableModel } from './claude-model.js';
 import { MODEL_UNROUTABLE } from './upstream-rejection.js';
 import { readCompareTarget, teeResponse, runCompare, writeCompareRecord, COMPARE_RESULT_HEADER } from './compare.js';
-import { listCodexAccountAliases, loadAllCodexAccounts, codexAccountNeedsRefresh, hasAnyCodexAccount, selectCodexAccount, getFreshCodexAccount, getCodexRefreshFailure, CodexCredentialsUnavailableError } from './codex-accounts.js';
+import { listCodexAccountAliases, loadAllCodexAccounts, codexAccountNeedsRefresh, hasAnyCodexAccount, selectCodexAccount, selectCodexAccountExcluding, rebindCodexSticky, getFreshCodexAccount, noteCodexDecline, clearCodexDecline, allAliasesCooled, getCodexRefreshFailure, CodexCredentialsUnavailableError } from './codex-accounts.js';
 import { route as routeProvider } from './provider-adapter.js';
 import { selectPoolFallbackModels } from './pool-fallback-tier.js';
 import { RequestQueue, QueueFullError, QueueTimeoutError, DEFAULT_MAX_CONCURRENT, DEFAULT_MAX_QUEUED, DEFAULT_QUEUE_TIMEOUT_MS } from './request-queue.js';
@@ -163,6 +163,30 @@ function extractFirstUserMessage(body) {
     }
     return '';
 }
+/**
+ * The conversation key for Codex seat stickiness, from raw request bytes.
+ *
+ * The same hash the Claude pool binds on (computeStickyKey over the first user
+ * message), so a conversation stays on one ChatGPT seat across turns and keeps
+ * the prompt-cache prefix it built there — rotating per request would trade a
+ * rate-limit problem for a cache problem.
+ *
+ * Null for a body that is not a JSON object or carries no user message; those
+ * requests bypass stickiness rather than sharing one bucket. Used by the two
+ * codex entries that hold no parsed body of their own (the pool-exhausted
+ * fallback and the mid-stream continuation target).
+ */
+function codexStickyKeyForBody(body) {
+    try {
+        const parsed = JSON.parse(body.toString('utf-8'));
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+            return null;
+        return computeStickyKey(extractFirstUserMessage(parsed));
+    }
+    catch {
+        return null;
+    }
+}
 // Session ID behavior:
 //   v3.18 rotated per request — which was itself a fingerprint. Real CC
 //   rotates roughly once per conversation, not per call. A user who has
@@ -1999,6 +2023,47 @@ export async function startProxy(opts = {}) {
     function checkAuth(req) {
         return authenticateRequest(req.headers, apiKeyBuf);
     }
+    /**
+     * A ChatGPT seat declined. Cool the SEAT, and the provider only once every
+     * seat is cooling.
+     *
+     * One handler for every codex forward — both wire shapes and the
+     * Claude-to-Codex fallback. It was two hand-copied copies, and that is
+     * precisely how the native Responses path ended up cooling nothing while
+     * the translated path cooled correctly: a third call site inherits this by
+     * construction rather than by someone remembering to copy it.
+     *
+     * Closes over nothing per-request, which is what makes one copy possible.
+     */
+    const codexOnDecline = (d) => {
+        // Cool the PROVIDER (is the codex lane usable at all) and the SEAT
+        // that actually declined (which ChatGPT account said no, and for how
+        // long). Before the seat half existed, selectCodexAccount returned the
+        // alphabetically-first account every time, so one 429'd seat took the
+        // whole lane down while its healthy peers sat unreachable.
+        if (d.status !== 429)
+            return;
+        // A 429 is a SEAT-level condition, so cool the seat unconditionally.
+        // The provider is only cooled once EVERY seat is cooling.
+        //
+        // Cooling the provider on any single 429 defeats the pool: the routing
+        // gate short-circuits on canAttempt('codex'), so the next request never
+        // reaches selectCodexAccount to find the healthy peer — the exact
+        // single-seat outage this change exists to remove (caught in review of
+        // #1288). Dropping provider cooling altogether is equally wrong the other
+        // way: on a single-seat deployment nothing would fail fast, and every
+        // request would re-hammer a seat already known to be limited instead of
+        // falling through to Claude. All-seats-cooled is the condition that means
+        // what the provider cool-down was always trying to say.
+        noteCodexDecline(d.alias, d.retryAfterMs);
+        void listCodexAccountAliases().then((aliases) => {
+            // Decide and write in the SAME tick — see allAliasesCooled. An await
+            // between the two lets a concurrent success clear a seat in the gap,
+            // and the late write then cools a pool that has recovered.
+            if (allAliasesCooled(aliases))
+                providerCooldowns.note('codex', d.retryAfterMs);
+        }).catch(() => { });
+    };
     /**
      * Serve a pool-exhausted request from the ChatGPT subscription (v6.0.0).
      *
@@ -2025,50 +2090,101 @@ export async function startProxy(opts = {}) {
             return false;
         if (!(await hasAnyCodexAccount().catch(() => false)))
             return false;
-        const stored = await selectCodexAccount().catch(() => null);
+        // Sticky on the CONVERSATION, not on this fallback hop: a conversation
+        // that reaches the subscription twice lands on the same seat both times,
+        // so the second turn reads the prefix the first one paid to create.
+        const stickyKey = codexStickyKeyForBody(body);
+        const stored = await selectCodexAccount(undefined, { stickyKey }).catch(() => null);
         if (!stored)
             return false;
-        let creds;
+        let seat;
         try {
-            creds = await getFreshCodexAccount(stored);
+            seat = await getFreshCodexAccount(stored);
         }
         catch {
             return false;
         }
-        const slugs = await getCodexModelSlugs(creds).catch(() => []);
-        const fallbackPick = pickCodexFallback(fallbackModels, slugs);
-        if (!fallbackPick)
-            return false;
-        const fallbackModel = fallbackPick.model;
-        const fallbackBody = buildPoolFallbackBody(body, fallbackModel);
-        if (!fallbackBody)
-            return false;
-        console.log(`[dario] #${requestCount} ${why} → codex account ${creds.alias} as ${fallbackModel}`);
-        requestCount++;
-        attempted.add('codex');
         // If an api-key backend could ALSO serve this request, let the subscription
         // decline a 429/5xx rather than answer with it, and report not-served so the
-        // caller falls through to that backend. This helper's contract has always
-        // said it declines so the caller can continue; it just never exercised the
-        // mechanism it was built on, so a rate-limited subscription ended the chain
-        // with a healthy backend sitting unused beside it.
+        // caller falls through to that backend.
         //
-        // With NO next option, do not defer: the real upstream error is more useful
-        // to the client than replacing it with a generic 503.
+        // With NO next option and no peer, do not defer: the real upstream error is
+        // more useful to the client than replacing it with a generic 503.
         const hasNextOption = openaiBackend !== null && shape === 'openai';
-        const served = await forwardToCodex(req, res, fallbackBody, creds, corsOrigin, { ...SECURITY_HEADERS, 'x-dario-pool-fallback': fallbackModel }, upstreamTimeoutMs, verbose, shape, fetch, hasNextOption, undefined, 
-        // Only a rate limit cools the provider. A 5xx or a transport failure is
-        // an outage, not quota — cooling it would park a provider that may be
-        // back on the next request, which is the opposite of the fix.
-        (d) => { if (d.status === 429)
-            providerCooldowns.note('codex', d.retryAfterMs); }, 
-        // The mirror of the Claude side (dario#1161): an operator who writes
-        // `--pool-fallback=gpt-5.6-terra:high` is choosing the effort the
-        // failover runs at, so the entry's own suffix reaches the request rather
-        // than the failover quietly running at the backend default.
-        effortForCodex(fallbackPick.effort));
-        if (served)
+        // The next seat that could serve one of these fallback models, excluding
+        // everything already tried. `peek` is the cached read, so the scan costs no
+        // upstream call; a seat whose model list is unknown is still worth a try.
+        //
+        // Scans rather than testing one candidate: with mixed model availability
+        // across seats, the alphabetically-next peer may be the one that lists none
+        // of the fallback models while a later one lists one.
+        const nextFallbackPeer = async (tried) => {
+            const skipped = new Set(tried);
+            for (;;) {
+                const candidate = await selectCodexAccountExcluding(skipped).catch(() => null);
+                if (!candidate)
+                    return null;
+                const peerSlugs = peekCodexModelSlugs(candidate.alias);
+                if (!peerSlugs || pickCodexFallback(fallbackModels, peerSlugs))
+                    return candidate;
+                skipped.add(candidate.alias);
+            }
+        };
+        // Mid-flight seat failover on the CLAUDE-TO-CODEX route, the same as the
+        // primary Codex route has. Without it this route selected one seat and
+        // stopped: a 429 from that seat was written to the client while a healthy
+        // peer sat unused, so the pool helped every route except this one (caught
+        // in review of #1288). The fallback model is re-picked per seat because
+        // pickCodexFallback reads that SEAT's slugs — peers need not list the same
+        // model, and the one that answers may answer as a different one.
+        //
+        // Terminates by construction: every pass adds a seat to `tried`, and
+        // nextFallbackPeer never returns one already in it.
+        const tried = new Set();
+        let served = false;
+        while (seat) {
+            tried.add(seat.alias);
+            const slugs = await getCodexModelSlugs(seat).catch(() => []);
+            const fallbackPick = pickCodexFallback(fallbackModels, slugs);
+            // Resolved BEFORE the attempt: it decides whether this attempt may defer,
+            // and becomes the seat to retry on if it declines.
+            const peer = await nextFallbackPeer(tried);
+            if (!fallbackPick) {
+                // This seat lists none of the fallback models. That used to end the
+                // attempt outright; a peer may still list one.
+                if (!peer)
+                    return false;
+                seat = await getFreshCodexAccount(peer).catch(() => peer);
+                continue;
+            }
+            const fallbackModel = fallbackPick.model;
+            const fallbackBody = buildPoolFallbackBody(body, fallbackModel);
+            if (!fallbackBody)
+                return false;
+            console.log(`[dario] #${requestCount} ${why} → codex account ${seat.alias} as ${fallbackModel}`);
+            requestCount++;
+            // Marked only once an attempt is actually being made. Marking it before
+            // the guards above would tell the rest of the request that codex had been
+            // tried when it had not, suppressing a later legitimate attempt.
+            attempted.add('codex');
+            served = await forwardToCodex(req, res, fallbackBody, seat, corsOrigin, { ...SECURITY_HEADERS, 'x-dario-pool-fallback': fallbackModel }, upstreamTimeoutMs, verbose, shape, fetch, hasNextOption || peer !== null, undefined, codexOnDecline, 
+            // The mirror of the Claude side (dario#1161): an operator who writes
+            // `--pool-fallback=gpt-5.6-terra:high` is choosing the effort the
+            // failover runs at, so the entry's own suffix reaches the request rather
+            // than the failover quietly running at the backend default.
+            effortForCodex(fallbackPick.effort));
+            if (served || !peer)
+                break;
+            console.log(`[dario] codex seat ${seat.alias} declined — retrying this fallback on ${peer.alias}`);
+            // The conversation follows the request. Its binding still names the seat
+            // that just declined; leaving it there would send the next turn back to a
+            // cooling seat and re-pick from scratch.
+            rebindCodexSticky(stickyKey, peer.alias);
+            seat = await getFreshCodexAccount(peer).catch(() => peer);
+        }
+        if (served) {
             providerCooldowns.clear('codex');
+        }
         return served;
     };
     /**
@@ -3027,7 +3143,10 @@ export async function startProxy(opts = {}) {
                     return null;
                 if (!(await hasAnyCodexAccount().catch(() => false)))
                     return null;
-                const stored = await selectCodexAccount().catch(() => null);
+                // The CLIENT's bytes rather than the rewritten `body`: a resume is the
+                // same conversation as the request that died mid-stream, so it must
+                // hash to the same key and land on the seat that conversation holds.
+                const stored = await selectCodexAccount(undefined, { stickyKey: codexStickyKeyForBody(clientBodyBytes) }).catch(() => null);
                 if (!stored)
                     return null;
                 let creds;
@@ -3328,8 +3447,17 @@ export async function startProxy(opts = {}) {
                     // account, rather than letting the throw escape into the JSON-peek
                     // catch below and disappear (DEV-179a412f).
                     let codexUnavailable = null;
+                    // Conversation -> seat binding for the codex lane, the mirror of the
+                    // Claude pool's stickyKey below. It belongs HERE because this is
+                    // where the seat is CHOSEN: without a key every turn independently
+                    // re-picks "the first seat not cooling", so a lower-alias seat that
+                    // frees up mid-conversation silently moves the conversation off the
+                    // seat holding its prompt-cache prefix (caught in review of #1288).
+                    // `parsedBody` is the object the invalid-body guard already parsed,
+                    // so this costs no second JSON.parse.
+                    const codexStickyKey = parsedBody ? computeStickyKey(extractFirstUserMessage(parsedBody)) : null;
                     if (await hasAnyCodexAccount()) {
-                        const stored = await selectCodexAccount();
+                        const stored = await selectCodexAccount(undefined, { stickyKey: codexStickyKey });
                         if (stored) {
                             try {
                                 codexCreds = await getFreshCodexAccount(stored);
@@ -3466,14 +3594,22 @@ export async function startProxy(opts = {}) {
                                 },
                             })
                             : null;
-                        // Before this hook a codex request left no trace: nothing in
-                        // /analytics, nothing in the request log, no per-account count.
-                        // The dock (and anyone reading /analytics) saw a proxy that
-                        // served GPT all day and reported zero of it. A decline (the
-                        // request handed to the Claude pool) reports nothing here; the
-                        // Claude path records what it then serves.
+                        // Reporting is one function for BOTH codex shapes below: the Responses
+                        // passthrough and the translated Messages path record the same row, so a
+                        // GPT request looks the same in /analytics whichever shape asked for it.
+                        //
+                        // Before this hook a codex request left no trace: nothing in /analytics,
+                        // nothing in the request log, no per-account count. The dock (and anyone
+                        // reading /analytics) saw a proxy that served GPT all day and reported
+                        // zero of it. A decline (the request handed to the Claude pool) reports
+                        // nothing here; the Claude path records what it then serves.
                         const codexOnDone = (o) => {
                             codexRequestCounts.set(o.alias, (codexRequestCounts.get(o.alias) ?? 0) + 1);
+                            // A seat that actually SERVED is not rate-limited. Keyed on a 2xx,
+                            // never on forwardToCodex returning true — that means "I wrote a
+                            // response", which is equally true when it wrote the upstream 429.
+                            if (o.status >= 200 && o.status < 300)
+                                clearCodexDecline(o.alias);
                             analytics.record({
                                 timestamp: Date.now(),
                                 consumer,
@@ -3502,24 +3638,83 @@ export async function startProxy(opts = {}) {
                                     cacheReadTokens: o.cacheReadTokens, cacheCreateTokens: o.cacheCreateTokens,
                                 }, consumer));
                         };
-                        // A Responses client on a ChatGPT-subscription model: the backend
-                        // speaks that shape natively, so the body goes through as written
-                        // (model resolved) and the SSE comes back untouched — no round
-                        // trip through the Messages shape, which cannot carry the newest
-                        // Codex CLI request features. Answers on the raw response: these
-                        // bytes are already in the client's shape.
-                        const served = codexAvailable && (isResponses && responsesBodyRaw
-                            ? await forwardResponsesToCodex(rawRes, { ...responsesBodyRaw, model: rawModel }, codexCreds, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, codexFetch, codexOnDone)
-                            : await forwardToCodex(req, res, body, codexCreds, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, isOpenAI ? 'openai' : 'anthropic', codexFetch, canDefer, codexOnDone, 
-                            // Cool codex on a rate limit only — a 5xx or an unreachable backend
-                            // is an outage, and parking a provider for that would keep it out
-                            // of the chain while it was already coming back.
-                            (d) => { if (d.status === 429)
-                                providerCooldowns.note('codex', d.retryAfterMs); }, 
-                            // dario#1260 — the effort named by the model-name suffix stripped
-                            // above. Undefined for every request that did not name one, which
-                            // leaves the outbound body exactly as it was.
-                            effortForCodex(requestEffort), codexGuard));
+                        // Mid-flight seat failover. A 429 lands BEFORE any body is written —
+                        // forwardToCodex only returns false on the decline path — so the same
+                        // request can be handed to a healthy peer instead of failing. Without
+                        // this the pool only helps the request AFTER the one that discovered the
+                        // limit; the discovering request still failed, every window rollover.
+                        //
+                        // `deferOnUnavailable` is widened to `canDefer || a peer exists`: without
+                        // that, a decline with no Claude fallback configured writes the 429 to the
+                        // client and returns true, and there is nothing left to retry onto.
+                        //
+                        // Terminates by construction: every pass adds a seat to `codexTried`, and
+                        // selectCodexAccountExcluding never returns a seat already in it.
+                        let served = false;
+                        if (codexAvailable) {
+                            const codexTried = new Set();
+                            let codexSeat = codexCreds;
+                            while (codexSeat) {
+                                codexTried.add(codexSeat.alias);
+                                // Resolved BEFORE the attempt: it decides whether this attempt may
+                                // defer, and becomes the seat to retry on if it declines.
+                                // A peer that demonstrably does not list this model cannot serve it;
+                                // trying it would trade a 429 for a 400. peek is the cached read, so
+                                // this never costs an upstream call — an unknown list still gets a try.
+                                //
+                                // Scanning rather than testing one candidate: with mixed model
+                                // availability across seats, the alphabetically-next peer may be the
+                                // one that cannot serve this model while a later one can. Stopping at
+                                // the first incompatible candidate left `codexPeer` null and abandoned
+                                // a usable seat — with no Claude fallback the declining seat's 429 went
+                                // straight to the client (caught in review of #1288). `peerTried` is
+                                // seeded from `codexTried` and grows every pass, so this terminates.
+                                let codexPeer = null;
+                                const peerTried = new Set(codexTried);
+                                for (;;) {
+                                    const candidate = await selectCodexAccountExcluding(peerTried).catch(() => null);
+                                    if (!candidate)
+                                        break;
+                                    const peerSlugs = rawModel ? peekCodexModelSlugs(candidate.alias) : null;
+                                    if (!peerSlugs || isCodexModel(rawModel, peerSlugs)) {
+                                        codexPeer = candidate;
+                                        break;
+                                    }
+                                    peerTried.add(candidate.alias);
+                                }
+                                // A Responses client on a ChatGPT-subscription model: the backend speaks
+                                // that shape natively, so the body goes through as written (model
+                                // resolved) and the SSE comes back untouched — no round trip through the
+                                // Messages shape, which cannot carry the newest Codex CLI request
+                                // features. Answers on the raw response: these bytes are already in the
+                                // client's shape.
+                                //
+                                // It sits INSIDE the retry loop, on the same seat sequence and the same
+                                // defer condition as the translated path. Outside it, a 429 on this shape
+                                // cooled nothing: selection handed the same limited seat back on every
+                                // following request and a healthy peer was never reached — the single-seat
+                                // outage this change exists to remove, surviving on the one shape Codex
+                                // CLI actually speaks (caught in review of #1288).
+                                if (isResponses && responsesBodyRaw) {
+                                    served = await forwardResponsesToCodex(rawRes, { ...responsesBodyRaw, model: rawModel }, codexSeat, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, codexFetch, codexOnDone, codexOnDecline, canDefer || codexPeer !== null);
+                                }
+                                else {
+                                    served = await forwardToCodex(req, res, body, codexSeat, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, isOpenAI ? 'openai' : 'anthropic', codexFetch, canDefer || codexPeer !== null, codexOnDone, codexOnDecline, 
+                                    // dario#1260 — the effort named by the model-name suffix stripped
+                                    // above. Undefined for every request that did not name one, which
+                                    // leaves the outbound body exactly as it was.
+                                    effortForCodex(requestEffort), codexGuard);
+                                }
+                                if (served || !codexPeer)
+                                    break;
+                                console.log(`[dario] codex seat ${codexSeat.alias} declined — retrying this request on ${codexPeer.alias}`);
+                                // The conversation follows the request. Its binding still names
+                                // the seat that just declined; leaving it there would send the
+                                // next turn back to a cooling seat and re-pick from scratch.
+                                rebindCodexSticky(codexStickyKey, codexPeer.alias);
+                                codexSeat = await getFreshCodexAccount(codexPeer).catch(() => codexPeer);
+                            }
+                        }
                         if (served) {
                             // A provider that just served is not rate-limited.
                             providerCooldowns.clear('codex');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.4.0",
+  "version": "6.5.0",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {