@askalf/dario 6.8.10 → 6.8.11

package/dist/admin-api.d.ts

@@ -75,6 +75,7 @@
  * against it.
  */
 import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { CodexSeatState } from './codex-accounts.js';
 import { type KeyStore } from './keys.js';
 /** Persisted account metadata surfaced by `GET /admin/accounts`. */
 export interface AdminAccountRecord {
@@ -150,9 +151,10 @@ export interface AdminAccountLive {
 }
 /** An audited admin action — see `AdminDeps.audit`. Never carries secrets. */
 /** One stored ChatGPT seat as `GET /admin/codex/accounts` reports it. */
-export interface AdminCodexAccountRecord {
+export interface AdminCodexAccountRecord extends CodexSeatState {
     alias: string;
     expiresAt: number;
+    /** The clock's opinion. `status` is the proxy's (dario#1343). */
     needsRefresh: boolean;
 }
 export interface AdminAuditEvent {

package/dist/admin-api.js

@@ -1,7 +1,7 @@
 import { maskEmail } from './pool.js';
 import { timingSafeEqual } from 'node:crypto';
 import { startAddAccount, completeAddAccount, removeAccount, listAccountAliases, loadAccount, } from './accounts.js';
-import { startAddCodexAccount, completeAddCodexAccount, removeCodexAccount, loadAllCodexAccounts, listCodexAccountAliases, codexAccountNeedsRefresh, parseCodexManualPaste, } from './codex-accounts.js';
+import { startAddCodexAccount, completeAddCodexAccount, removeCodexAccount, loadAllCodexAccounts, listCodexAccountAliases, codexAccountNeedsRefresh, codexSeatStatus, parseCodexManualPaste, } from './codex-accounts.js';
 import { parseManualPaste } from './oauth.js';
 import { grantAge } from './refresh-grant.js';
 import { createKey, revokeKey, rotateKey, parseExpiry, publicKey, KEY_NAME_RE } from './keys.js';
@@ -153,7 +153,7 @@ async function doCompleteCodexLogin(alias, rawCode, now, deps, remote) {
 async function listCodexAccountRecords() {
     const all = await loadAllCodexAccounts();
     return all
-        .map((a) => ({ alias: a.alias, expiresAt: a.expiresAt, needsRefresh: codexAccountNeedsRefresh(a) }))
+        .map((a) => ({ alias: a.alias, expiresAt: a.expiresAt, needsRefresh: codexAccountNeedsRefresh(a), ...codexSeatStatus(a.alias) }))
         .sort((x, y) => x.alias.localeCompare(y.alias));
 }
 /** On-disk account inventory — the default `AdminDeps.listAccounts`. */

package/dist/cli.d.ts

@@ -144,6 +144,28 @@ export interface LivePayload {
  * them, so a legacy payload can be driven straight through it in a test.
  */
 export declare function formatLiveAccountsListing(payload: LivePayload, port: number, now: number): string[];
+/**
+ * `dario accounts list --live` — the running proxy's view of the pool
+ * (dario#1244): status with its countdown, the reading and its age, 429s
+ * answered, the organization, and which seats share a window. The on-disk
+ * listing knows none of that. Returns false when no proxy answered, so the
+ * caller falls back to the on-disk listing.
+ */
+/** One seat as `GET /codex` reports it — the fields the live listing prints. */
+export interface LiveCodexSeat {
+    alias: string;
+    expiresInMs: number;
+    requestCount: number;
+    status: 'ok' | 'cooling' | 'refresh-failed';
+    cooldownRemainingMs: number;
+    lastRefreshError: {
+        at: number;
+        status: number;
+        message: string;
+    } | null;
+}
+/** Lines for `dario codex list --live` — pure, so the shape is testable without a proxy. */
+export declare function formatLiveCodexListing(accounts: readonly LiveCodexSeat[], port: number): string[];
 /**
  * Decide whether this module is being invoked as the CLI entry point or
  * imported as a library. Pure, exported for tests; the file-bottom uses

package/dist/cli.js

@@ -1134,13 +1134,67 @@ export function formatLiveAccountsListing(payload, port, now) {
     lines.push('');
     return lines;
 }
+/** Lines for `dario codex list --live` — pure, so the shape is testable without a proxy. */
+export function formatLiveCodexListing(accounts, port) {
+    const out = ['', `  dario — Codex accounts (live, from http://127.0.0.1:${port}/codex)`, '  ───────────────────────────────────────', ''];
+    if (accounts.length === 0) {
+        out.push('  No Codex accounts.', '');
+        return out;
+    }
+    for (const a of accounts) {
+        const mins = Math.floor(Math.max(0, a.expiresInMs) / 60000);
+        const expiry = a.expiresInMs > 0 ? `${mins}m` : 'expired';
+        let state;
+        if (a.status === 'refresh-failed') {
+            const e = a.lastRefreshError;
+            state = `refresh-failed (${e ? `${e.status}: ${e.message}` : 'token endpoint refused'}) — re-add the seat`;
+        }
+        else if (a.status === 'cooling') {
+            state = `cooling ${Math.ceil(a.cooldownRemainingMs / 1000)}s — the backend declined it; selection skips it until then`;
+        }
+        else {
+            state = 'ok';
+        }
+        out.push(`    ${a.alias.padEnd(20)} ${state}`);
+        out.push(`    ${''.padEnd(20)} token expires in ${expiry}, ${a.requestCount} request${a.requestCount === 1 ? '' : 's'} served`);
+    }
+    out.push('');
+    return out;
+}
 /**
- * `dario accounts list --live` — the running proxy's view of the pool
- * (dario#1244): status with its countdown, the reading and its age, 429s
- * answered, the organization, and which seats share a window. The on-disk
- * listing knows none of that. Returns false when no proxy answered, so the
- * caller falls back to the on-disk listing.
+ * `dario codex list --live` — the running proxy's view of each seat (dario#1343):
+ * what it will do with it, not what the clock says. The on-disk listing cannot
+ * know that a seat is cooling or that its refresh was refused; only the process
+ * that tried does. Returns false when no proxy answered, so the caller falls
+ * back to the on-disk listing.
  */
+async function codexListLive() {
+    const { loadConfig } = await import('./config-file.js');
+    const fileCfg = loadConfig().config;
+    const portArg = args.find(a => a.startsWith('--port='));
+    const port = (portArg ? parseInt(portArg.split('=')[1], 10) : undefined)
+        ?? (process.env['DARIO_PORT'] ? parseInt(process.env['DARIO_PORT'], 10) : undefined)
+        ?? fileCfg.port ?? 3456;
+    const headers = {};
+    if (process.env['DARIO_API_KEY'])
+        headers['x-api-key'] = process.env['DARIO_API_KEY'];
+    let payload = null;
+    try {
+        const res = await fetch(`http://127.0.0.1:${port}/codex`, { headers, signal: AbortSignal.timeout(3000) });
+        if (res.ok)
+            payload = await res.json();
+        else
+            console.log(`  (proxy on http://127.0.0.1:${port} answered ${res.status} to /codex — showing the on-disk listing)`);
+    }
+    catch (err) {
+        console.log(`  (no proxy on http://127.0.0.1:${port}: ${err instanceof Error ? err.message : String(err)} — showing the on-disk listing)`);
+    }
+    if (!payload || !Array.isArray(payload.accounts))
+        return false;
+    for (const line of formatLiveCodexListing(payload.accounts, port))
+        console.log(line);
+    return true;
+}
 async function accountsListLive() {
     const { loadConfig } = await import('./config-file.js');
     const fileCfg = loadConfig().config;
@@ -1444,6 +1498,10 @@ async function accounts() {
  */
 async function codex() {
     const sub = args[1];
+    if ((!sub || sub === 'list') && args.includes('--live')) {
+        if (await codexListLive())
+            return;
+    }
     if (!sub || sub === 'list') {
         const aliases = await listCodexAccountAliases();
         console.log('');
@@ -1467,6 +1525,8 @@ async function codex() {
             console.log(`    ${a.alias.padEnd(20)} token expires in ${expiry}`);
         }
         console.log('');
+        console.log('  (what the proxy will do with each seat — cooling, refresh refused — is `dario codex list --live` on a running proxy)');
+        console.log('');
         return;
     }
     if (sub === 'add') {

package/dist/codex-accounts.d.ts

@@ -51,8 +51,36 @@ export interface CodexRefreshFailure {
     message: string;
 }
 /** Last remembered refresh failure for an alias, or null. Read-only view for
- *  the admin surface (`GET /codex`) — never triggers an upstream call. */
-export declare function getCodexRefreshFailure(alias: string): CodexRefreshFailure | null;
+ *  the admin surface (`GET /codex`) — never triggers an upstream call.
+ *
+ *  Remembered means the proxy would still refuse to retry: the same
+ *  `now < retryAt` test `refreshNow` applies. Past that instant the next
+ *  request will try the token endpoint again, so the failure is no longer what
+ *  the proxy will do with the seat and must not be reported as such (review on
+ *  dario#1343: the old read returned the entry until something overwrote it,
+ *  which could tell an operator to re-add a seat that was about to recover).
+ *  The expired entry is dropped here so every reader agrees. */
+export declare function getCodexRefreshFailure(alias: string, now?: number): CodexRefreshFailure | null;
+export type CodexSeatStatus = 'ok' | 'cooling' | 'refresh-failed';
+export interface CodexSeatState {
+    /** What the proxy will do with this seat right now. */
+    status: CodexSeatStatus;
+    /** ms until a declined seat is offered again; 0 when it is not cooling. */
+    cooldownRemainingMs: number;
+    /** The last token-endpoint rejection still remembered (about a minute), or null. */
+    lastRefreshError: CodexRefreshFailure | null;
+}
+/**
+ * The seat as the proxy sees it, not as the clock sees it (dario#1343). A stored
+ * token can be a day from its stated expiry while the backend rejects every
+ * request made with it; `expiresAt` alone reported such a seat as healthy for
+ * six hours. Two in-memory facts say otherwise: a refresh the token endpoint
+ * refused (the seat needs re-adding), and a cool-down after the backend
+ * declined it (selection is skipping it). Read from memory only — no request,
+ * no refresh, no credential in the answer. An alias the proxy has never touched
+ * reads `ok`, which is the truth: nothing is known against it.
+ */
+export declare function codexSeatStatus(alias: string, now?: number): CodexSeatState;
 /** Test seam — forget every remembered failure. */
 export declare function _resetCodexRefreshFailuresForTest(): void;
 /**

package/dist/codex-accounts.js

@@ -205,10 +205,40 @@ export class CodexCredentialsUnavailableError extends Error {
 const REFRESH_FAILURE_TTL_MS = 60 * 1000;
 const refreshFailures = new Map();
 /** Last remembered refresh failure for an alias, or null. Read-only view for
- *  the admin surface (`GET /codex`) — never triggers an upstream call. */
-export function getCodexRefreshFailure(alias) {
+ *  the admin surface (`GET /codex`) — never triggers an upstream call.
+ *
+ *  Remembered means the proxy would still refuse to retry: the same
+ *  `now < retryAt` test `refreshNow` applies. Past that instant the next
+ *  request will try the token endpoint again, so the failure is no longer what
+ *  the proxy will do with the seat and must not be reported as such (review on
+ *  dario#1343: the old read returned the entry until something overwrote it,
+ *  which could tell an operator to re-add a seat that was about to recover).
+ *  The expired entry is dropped here so every reader agrees. */
+export function getCodexRefreshFailure(alias, now = Date.now()) {
     const hit = refreshFailures.get(alias);
-    return hit ? { at: hit.at, status: hit.status, message: hit.message } : null;
+    if (!hit)
+        return null;
+    if (now >= hit.retryAt) {
+        refreshFailures.delete(alias);
+        return null;
+    }
+    return { at: hit.at, status: hit.status, message: hit.message };
+}
+/**
+ * The seat as the proxy sees it, not as the clock sees it (dario#1343). A stored
+ * token can be a day from its stated expiry while the backend rejects every
+ * request made with it; `expiresAt` alone reported such a seat as healthy for
+ * six hours. Two in-memory facts say otherwise: a refresh the token endpoint
+ * refused (the seat needs re-adding), and a cool-down after the backend
+ * declined it (selection is skipping it). Read from memory only — no request,
+ * no refresh, no credential in the answer. An alias the proxy has never touched
+ * reads `ok`, which is the truth: nothing is known against it.
+ */
+export function codexSeatStatus(alias, now = Date.now()) {
+    const lastRefreshError = getCodexRefreshFailure(alias, now);
+    const cooldownRemainingMs = codexCooldownRemainingMs(alias);
+    const status = lastRefreshError ? 'refresh-failed' : cooldownRemainingMs > 0 ? 'cooling' : 'ok';
+    return { status, cooldownRemainingMs, lastRefreshError };
 }
 /** Test seam — forget every remembered failure. */
 export function _resetCodexRefreshFailuresForTest() {

package/dist/live-fingerprint.d.ts

@@ -496,7 +496,7 @@ export declare function detectDrift(t: TemplateData, installedOverride?: string
  */
 export declare const SUPPORTED_CC_RANGE: {
     readonly min: "1.0.0";
-    readonly maxTested: "2.1.275";
+    readonly maxTested: "2.1.276";
 };
 /**
  * Compare two dotted-numeric version strings. Returns negative if `a<b`,

package/dist/live-fingerprint.js

@@ -1194,7 +1194,7 @@ export function detectDrift(t, installedOverride) {
  */
 export const SUPPORTED_CC_RANGE = {
     min: '1.0.0',
-    maxTested: '2.1.275',
+    maxTested: '2.1.276',
 };
 /**
  * Compare two dotted-numeric version strings. Returns negative if `a<b`,

package/dist/proxy.js

@@ -45,7 +45,7 @@ import { responsesRequestToAnthropic, unsupportedOnClaudeError, ResponsesRequest
 import { isClaudeServableModel } from './claude-model.js';
 import { MODEL_UNROUTABLE } from './upstream-rejection.js';
 import { readCompareTarget, teeResponse, runCompare, writeCompareRecord, COMPARE_RESULT_HEADER } from './compare.js';
-import { listCodexAccountAliases, loadAllCodexAccounts, codexAccountNeedsRefresh, hasAnyCodexAccount, selectCodexAccount, selectCodexAccountExcluding, rebindCodexSticky, getFreshCodexAccount, noteCodexDecline, clearCodexDecline, allAliasesCooled, getCodexRefreshFailure, CodexCredentialsUnavailableError, resetCodexPresenceCache } from './codex-accounts.js';
+import { listCodexAccountAliases, loadAllCodexAccounts, codexAccountNeedsRefresh, hasAnyCodexAccount, selectCodexAccount, selectCodexAccountExcluding, rebindCodexSticky, getFreshCodexAccount, noteCodexDecline, clearCodexDecline, allAliasesCooled, CodexCredentialsUnavailableError, resetCodexPresenceCache, codexSeatStatus, } from './codex-accounts.js';
 import { route as routeProvider } from './provider-adapter.js';
 import { selectPoolFallbackModels } from './pool-fallback-tier.js';
 import { RequestQueue, QueueFullError, QueueTimeoutError, DEFAULT_MAX_CONCURRENT, DEFAULT_MAX_QUEUED, DEFAULT_QUEUE_TIMEOUT_MS, resolveMaxConcurrent } from './request-queue.js';
@@ -2649,11 +2649,13 @@ export async function startProxy(opts = {}) {
                 needsRefresh: codexAccountNeedsRefresh(a),
                 models: peekCodexModelSlugs(a.alias) ?? [],
                 requestCount: codexRequestCounts.get(a.alias) ?? 0,
-                // Why an account that LOOKS present is serving nothing: the last
-                // token-endpoint rejection, remembered in-process for a minute
-                // (DEV-179a412f). Read from memory only — a status read never spends
-                // or exposes a credential, so there is no token in {at,status,message}.
-                lastRefreshError: getCodexRefreshFailure(a.alias),
+                // Why an account that LOOKS present is serving nothing (dario#1343):
+                // `status` is what the proxy will do with the seat, `cooldownRemainingMs`
+                // how long selection skips it after the backend declined it, and
+                // `lastRefreshError` the token-endpoint rejection remembered in-process
+                // for a minute (DEV-179a412f). Read from memory only — a status read
+                // never spends or exposes a credential, so there is no token in any of it.
+                ...codexSeatStatus(a.alias),
             }));
             res.writeHead(200, JSON_HEADERS);
             res.end(JSON.stringify({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.8.10",
+  "version": "6.8.11",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {