@askalf/dario 6.8.16 → 6.8.17

package/dist/cli.js

@@ -479,6 +479,11 @@ async function proxy() {
     // user waits at the cap while everyone else keeps flowing. 0 = off.
     const maxConcurrentPerConsumer = parsePositiveIntFlag('--max-concurrent-per-consumer=')
         ?? parsePositiveIntEnv(process.env['DARIO_MAX_CONCURRENT_PER_CONSUMER']);
+    // --shutdown-grace=MS — how long SIGTERM waits for in-flight requests to
+    // finish before the process exits (default 90000). A container recreate
+    // used to sever every streaming response after five seconds. dario#1370.
+    const shutdownGraceMs = parsePositiveIntFlag('--shutdown-grace=')
+        ?? parsePositiveIntEnv(process.env['DARIO_SHUTDOWN_GRACE_MS']);
     // --pool-strategy=headroom|fill-first — where UNBOUND (new) conversations
     // land. `headroom` (default) spreads them to the seat with the most slack;
     // `fill-first` concentrates them on the alphabetically-first eligible seat
@@ -704,7 +709,7 @@ async function proxy() {
         console.error(`[dario] Override (not recommended): pass --unsafe-no-auth if you have out-of-band network controls and accept the risk.`);
         process.exit(1);
     }
-    await startProxy({ port, host, verbose, verboseBodies, model, fastModel, noClaudeAuth, analyticsToken, passthrough, preserveTools, hybridTools, mergeTools, noAutoDetect, strictTls, pacingMinMs, pacingJitterMs, thinkTimeBaseMs, thinkTimePerTokenMs, thinkTimeJitterMs, thinkTimeMaxMs, sessionStartMinMs, sessionStartJitterMs, stealth, drainOnClose, sessionIdleRotateMs, sessionRotateJitterMs, sessionMaxAgeMs, sessionPerClient, preserveOrchestrationTags, noLiveCapture, strictTemplate, maxConcurrent, maxQueued, queueTimeoutMs, maxConcurrentPerConsumer, poolStrategy, poolHeadroomFloor, poolSharedState, poolSharedStateIntervalMs, effort, maxTokens, poolFallbackModel, modelAliases, logFile, passthroughBetas, skipFields, systemPrompt, overageGuardEnabled, overageGuardBehavior, overageGuardCooldownMs, overageGuardNotifyOs, honorClientThinking, preserveOutputFormat, midstreamContinue, ledger, keys, keysPath });
+    await startProxy({ port, host, verbose, verboseBodies, model, fastModel, noClaudeAuth, analyticsToken, passthrough, preserveTools, hybridTools, mergeTools, noAutoDetect, strictTls, pacingMinMs, pacingJitterMs, thinkTimeBaseMs, thinkTimePerTokenMs, thinkTimeJitterMs, thinkTimeMaxMs, sessionStartMinMs, sessionStartJitterMs, stealth, drainOnClose, sessionIdleRotateMs, sessionRotateJitterMs, sessionMaxAgeMs, sessionPerClient, preserveOrchestrationTags, noLiveCapture, strictTemplate, maxConcurrent, maxQueued, queueTimeoutMs, maxConcurrentPerConsumer, shutdownGraceMs, poolStrategy, poolHeadroomFloor, poolSharedState, poolSharedStateIntervalMs, effort, maxTokens, poolFallbackModel, modelAliases, logFile, passthroughBetas, skipFields, systemPrompt, overageGuardEnabled, overageGuardBehavior, overageGuardCooldownMs, overageGuardNotifyOs, honorClientThinking, preserveOutputFormat, midstreamContinue, ledger, keys, keysPath });
 }
 /**
  * `dario keys` — named keys for a shared dario (v6.8, dario#1318). One
@@ -2074,6 +2079,12 @@ async function help() {
                              as --strict-tls: make the unsafe state
                              require intent. Env: DARIO_STRICT_TEMPLATE=1.
                              (v3.30.8, dario#77)
+    --shutdown-grace=MS      How long SIGTERM waits for in-flight requests
+                             to finish before exiting (default: 90000).
+                             The listener closes at once. Set the
+                             container's stop grace above it, or Docker
+                             SIGKILLs the drain. Env:
+                             DARIO_SHUTDOWN_GRACE_MS. (dario#1370)
     --max-concurrent=N       Max in-flight requests across the WHOLE proxy,
                              not per seat (default: 10; a pool defaults to
                              10 per seat). Past it, requests wait in dario.

package/dist/proxy.d.ts

@@ -395,6 +395,12 @@ interface ProxyOptions {
     poolSharedState?: boolean;
     /** How often to pull peers' readings, ms. Default 2000. */
     poolSharedStateIntervalMs?: number;
+    /**
+     * How long a SIGTERM waits for in-flight requests to finish before the
+     * process exits. Default 90s. The listener closes at once, so nothing new
+     * is accepted while the wait runs. dario#1370.
+     */
+    shutdownGraceMs?: number;
     /** Max concurrent in-flight requests. Default 10. dario#80. */
     maxConcurrent?: number;
     /** Max requests buffered waiting for a concurrency slot. Default 128. dario#80. */

package/dist/proxy.js

@@ -51,6 +51,7 @@ import { listCodexAccountAliases, loadAllCodexAccounts, codexAccountNeedsRefresh
 import { route as routeProvider } from './provider-adapter.js';
 import { selectPoolFallbackModels } from './pool-fallback-tier.js';
 import { RequestQueue, QueueFullError, QueueTimeoutError, DEFAULT_MAX_CONCURRENT, DEFAULT_MAX_QUEUED, DEFAULT_QUEUE_TIMEOUT_MS, resolveMaxConcurrent } from './request-queue.js';
+import { waitForIdle, DEFAULT_SHUTDOWN_GRACE_MS } from './shutdown-drain.js';
 import { redactSecrets } from './redact.js';
 import { BAKED_BASE_MODELS, withLongContextVariants, buildOpenAIModelsList, getModelCatalog, getCachedBases, resolveAliasAgainst, prewarmModelCatalog, retryModelCatalogNow, isSuspendedModel } from './model-catalog.js';
 import { classifyUpstreamRejection, diagnosticSnippet, POOL_PARKED } from './upstream-rejection.js';
@@ -5761,15 +5762,17 @@ export async function startProxy(opts = {}) {
         poolSync?.stop();
         if (logFileStream)
             logFileStream.end();
-        // Flush tokens first (best-effort, bounded), then close the server. The
-        // flush is fire-and-forget under the same 5s force-exit guard below so a
-        // hung fsync can't wedge shutdown.
         keyStore?.close();
-        void Promise.all([flushPoolTokens(), ledger?.close()]).finally(() => {
-            server.close(() => process.exit(0));
-        });
-        // Force exit after 5s if connections (or the flush) don't complete.
-        setTimeout(() => process.exit(0), 5000).unref();
+        // Stop accepting connections now; responses already streaming keep going.
+        // Then flush tokens (best-effort), drain what is in flight up to the
+        // grace, and exit. The force-exit guard sits past the grace so a stream
+        // that never ends cannot wedge shutdown, and a hung fsync cannot either.
+        server.close();
+        const graceMs = opts.shutdownGraceMs ?? DEFAULT_SHUTDOWN_GRACE_MS;
+        void Promise.all([flushPoolTokens(), ledger?.close()])
+            .then(() => waitForIdle(() => queue.snapshot().active, { graceMs }))
+            .finally(() => process.exit(0));
+        setTimeout(() => process.exit(0), graceMs + 5000).unref();
     };
     process.on('SIGINT', shutdown);
     process.on('SIGTERM', shutdown);

package/dist/shutdown-drain.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Shutdown drain (dario#1370).
+ *
+ * A SIGTERM used to give in-flight requests five seconds and then exit. The
+ * fleet's agent runs are one long streamed response each, so a container
+ * recreate — every within-minor autodeploy of a bot release — severed every
+ * run that was in flight: three dropped executions in one night, each
+ * re-armed a quarter of an hour later with its spend gone.
+ *
+ * `waitForIdle` is the wait `shutdown` now does between closing the listener
+ * and exiting: poll the in-flight count until it reaches zero or the grace
+ * runs out. It is pure over its inputs — the count, the clock and the sleep
+ * are injected — so the policy is tested without a server or real timers.
+ */
+/** How long a SIGTERM waits for in-flight requests by default. */
+export declare const DEFAULT_SHUTDOWN_GRACE_MS = 90000;
+/** How often the drain re-reads the in-flight count. */
+export declare const SHUTDOWN_POLL_MS = 250;
+export interface DrainOptions {
+    /** Longest the drain waits before giving up on the remaining requests. */
+    graceMs: number;
+    /** Poll interval; defaults to SHUTDOWN_POLL_MS. */
+    pollMs?: number;
+    /** Clock and sleep, injectable for tests. */
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+    /** Where the drain narrates; defaults to console.log. */
+    log?: (line: string) => void;
+}
+export interface DrainResult {
+    /** True when the in-flight count reached zero within the grace. */
+    drained: boolean;
+    /** How long the drain waited. */
+    waitedMs: number;
+    /** In-flight requests left when the drain returned. */
+    remaining: number;
+}
+/**
+ * Wait until `getActive()` reports no in-flight request, or `graceMs` has
+ * passed. Logs once when it starts waiting and once when it stops, never per
+ * poll, so a long drain is two lines rather than a scroll.
+ */
+export declare function waitForIdle(getActive: () => number, opts: DrainOptions): Promise<DrainResult>;

package/dist/shutdown-drain.js

@@ -0,0 +1,48 @@
+/**
+ * Shutdown drain (dario#1370).
+ *
+ * A SIGTERM used to give in-flight requests five seconds and then exit. The
+ * fleet's agent runs are one long streamed response each, so a container
+ * recreate — every within-minor autodeploy of a bot release — severed every
+ * run that was in flight: three dropped executions in one night, each
+ * re-armed a quarter of an hour later with its spend gone.
+ *
+ * `waitForIdle` is the wait `shutdown` now does between closing the listener
+ * and exiting: poll the in-flight count until it reaches zero or the grace
+ * runs out. It is pure over its inputs — the count, the clock and the sleep
+ * are injected — so the policy is tested without a server or real timers.
+ */
+/** How long a SIGTERM waits for in-flight requests by default. */
+export const DEFAULT_SHUTDOWN_GRACE_MS = 90_000;
+/** How often the drain re-reads the in-flight count. */
+export const SHUTDOWN_POLL_MS = 250;
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Wait until `getActive()` reports no in-flight request, or `graceMs` has
+ * passed. Logs once when it starts waiting and once when it stops, never per
+ * poll, so a long drain is two lines rather than a scroll.
+ */
+export async function waitForIdle(getActive, opts) {
+    const pollMs = Math.max(1, opts.pollMs ?? SHUTDOWN_POLL_MS);
+    const now = opts.now ?? Date.now;
+    const sleep = opts.sleep ?? defaultSleep;
+    const log = opts.log ?? ((line) => console.log(line));
+    let active = getActive();
+    if (active <= 0)
+        return { drained: true, waitedMs: 0, remaining: 0 };
+    const started = now();
+    log(`[dario] draining ${active} in-flight request(s) before exit (up to ${Math.round(opts.graceMs / 1000)}s)`);
+    for (;;) {
+        await sleep(pollMs);
+        active = getActive();
+        const waitedMs = now() - started;
+        if (active <= 0) {
+            log(`[dario] drained after ${(waitedMs / 1000).toFixed(1)}s`);
+            return { drained: true, waitedMs, remaining: 0 };
+        }
+        if (waitedMs >= opts.graceMs) {
+            log(`[dario] still ${active} in flight after ${Math.round(waitedMs / 1000)}s; exiting`);
+            return { drained: false, waitedMs, remaining: active };
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.8.16",
+  "version": "6.8.17",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {