@askalf/dario 6.8.7 → 6.8.9

package/dist/admin-api.d.ts

@@ -14,6 +14,13 @@
  *   GET    /admin/accounts                                       -> { accounts: [...], count }
  *   DELETE /admin/accounts/<alias>                               -> { alias, removed }
  *
+ * The same four for a ChatGPT (altman) seat (dario#1009) — a headless proxy
+ * could add a Claude seat over HTTP but a ChatGPT one only from a terminal:
+ *   POST   /admin/codex/login/start     { alias? }              -> { alias, authorize_url, expires_at, instructions }
+ *   POST   /admin/codex/login/complete  { alias, code }         -> { alias, status, expires_at }   (code = the redirect URL or the bare code)
+ *   GET    /admin/codex/accounts                                -> { accounts: [{ alias, expiresAt, needsRefresh }], count }
+ *   DELETE /admin/codex/accounts/<alias>                        -> { alias, removed }
+ *
  * The login flow mirrors `dario accounts add --manual` (PKCE + manual paste):
  * `/start` returns the authorize URL the operator opens in a browser; they POST
  * the code Anthropic displays back to `/complete`. The PKCE verifier + state
@@ -142,8 +149,16 @@ export interface AdminAccountLive {
     consecutiveAuthFailures: number;
 }
 /** An audited admin action — see `AdminDeps.audit`. Never carries secrets. */
+/** One stored ChatGPT seat as `GET /admin/codex/accounts` reports it. */
+export interface AdminCodexAccountRecord {
+    alias: string;
+    expiresAt: number;
+    needsRefresh: boolean;
+}
 export interface AdminAuditEvent {
     action: 'login_start' | 'login_complete' | 'account_remove' | 'auth_reject' | 'rate_limited' | 'key_create' | 'key_revoke' | 'key_rotate';
+    /** Which engine's credentials the event touched; absent means Claude, the only engine before codex joined (dario#1009). */
+    engine?: 'codex';
     ok: boolean;
     status: number;
     /** Account alias, when the action targets one. */
@@ -164,6 +179,8 @@ export interface AdminDeps {
      * the change routable by the time the client sees its 200.
      */
     onAccountsChanged?: () => void | Promise<void>;
+    /** A ChatGPT seat was added or removed over HTTP — the proxy drops its "no codex account" cache so the next request routes. */
+    onCodexAccountsChanged?: () => void | Promise<void>;
     /**
      * Persisted-account inventory (alias, scopes, token expiry). Defaults to the
      * on-disk store at `~/.dario/accounts`; injectable for tests.

package/dist/admin-api.js

@@ -1,12 +1,14 @@
 import { maskEmail } from './pool.js';
 import { timingSafeEqual } from 'node:crypto';
 import { startAddAccount, completeAddAccount, removeAccount, listAccountAliases, loadAccount, } from './accounts.js';
+import { startAddCodexAccount, completeAddCodexAccount, removeCodexAccount, loadAllCodexAccounts, listCodexAccountAliases, codexAccountNeedsRefresh, parseCodexManualPaste, } from './codex-accounts.js';
 import { parseManualPaste } from './oauth.js';
 import { grantAge } from './refresh-grant.js';
 import { createKey, revokeKey, rotateKey, parseExpiry, publicKey, KEY_NAME_RE } from './keys.js';
 const PENDING_TTL_MS = 10 * 60_000;
 const MAX_PENDING = 64; // backstop against unbounded growth (distinct aliases)
 const ACCOUNTS_PREFIX = '/admin/accounts/';
+const CODEX_ACCOUNTS_PREFIX = '/admin/codex/accounts/';
 const KEYS_PREFIX = '/admin/keys/';
 /**
  * `consecutiveAuthFailures` floor for `/admin/login/start-needed` to treat an
@@ -23,16 +25,21 @@ const NEEDS_LOGIN_THRESHOLD = 3;
 const MAX_BATCH_ITEMS = 64;
 // Keyed by account alias — one pending login per alias (#599).
 const pendingLogins = new Map();
+// The ChatGPT seats' pending logins live apart: an alias may name a Claude
+// seat and a ChatGPT seat at once (the stores are separate directories).
+const pendingCodexLogins = new Map();
 function prunePending(now) {
-    for (const [id, p] of pendingLogins) {
-        if (p.expiresAt <= now)
-            pendingLogins.delete(id);
+    for (const map of [pendingLogins, pendingCodexLogins]) {
+        for (const [id, p] of map) {
+            if (p.expiresAt <= now)
+                map.delete(id);
+        }
     }
 }
 /** First `account-<n>` not already taken by an existing account or pending login. */
-function nextDefaultAlias(taken) {
+function nextDefaultAlias(taken, prefix = 'account') {
     for (let n = 1;; n++) {
-        const candidate = `account-${n}`;
+        const candidate = `${prefix}-${n}`;
         if (!taken.has(candidate))
             return candidate; // taken is finite → always terminates
     }
@@ -97,6 +104,58 @@ async function doCompleteLogin(alias, rawCode, now, deps, remote) {
         return { ok: false, status: 400, error: message };
     }
 }
+async function doStartCodexLogin(alias, now, deps, remote) {
+    if (!pendingCodexLogins.has(alias) && pendingCodexLogins.size >= MAX_PENDING) {
+        return { ok: false, status: 429, error: 'too many pending logins; complete or wait for one to expire' };
+    }
+    if ((await listCodexAccountAliases()).includes(alias)) {
+        return { ok: false, status: 409, error: `codex account "${alias}" already exists — DELETE /admin/codex/accounts/${alias} first` };
+    }
+    try {
+        const { authorizeUrl, codeVerifier, state } = await startAddCodexAccount(alias);
+        const expiresAt = now + PENDING_TTL_MS;
+        pendingCodexLogins.set(alias, { codeVerifier, state, expiresAt });
+        deps.audit?.({ action: 'login_start', ok: true, status: 200, alias, remote, engine: 'codex' });
+        return { ok: true, alias, authorizeUrl, expiresAt };
+    }
+    catch (err) {
+        return { ok: false, status: 400, error: err.message };
+    }
+}
+async function doCompleteCodexLogin(alias, rawCode, now, deps, remote) {
+    if (!alias || !rawCode)
+        return { ok: false, status: 400, error: 'missing "alias" or "code"' };
+    const p = pendingCodexLogins.get(alias);
+    if (!p || p.expiresAt <= now) {
+        pendingCodexLogins.delete(alias);
+        return { ok: false, status: 410, error: 'no pending codex login for that alias (unknown or expired) — start a new login' };
+    }
+    // The whole redirect URL (what the CLI asks the user to paste) or a bare code; the
+    // state in a URL is checked against the login it was printed for, as the CLI does.
+    const { code, state: pastedState } = parseCodexManualPaste(rawCode);
+    if (!code)
+        return { ok: false, status: 400, error: 'no authorization code found in "code" (paste the whole redirect URL)' };
+    if (pastedState !== null && pastedState !== p.state) {
+        return { ok: false, status: 400, error: 'state mismatch — the redirect is from a different login attempt' };
+    }
+    pendingCodexLogins.delete(alias); // single-use, regardless of exchange outcome
+    try {
+        const creds = await completeAddCodexAccount(alias, code, p.codeVerifier);
+        await deps.onCodexAccountsChanged?.();
+        deps.audit?.({ action: 'login_complete', ok: true, status: 200, alias: creds.alias, remote, engine: 'codex' });
+        return { ok: true, alias: creds.alias, expiresAt: creds.expiresAt };
+    }
+    catch (err) {
+        deps.audit?.({ action: 'login_complete', ok: false, status: 400, alias, remote, engine: 'codex' });
+        return { ok: false, status: 400, error: err.message };
+    }
+}
+async function listCodexAccountRecords() {
+    const all = await loadAllCodexAccounts();
+    return all
+        .map((a) => ({ alias: a.alias, expiresAt: a.expiresAt, needsRefresh: codexAccountNeedsRefresh(a) }))
+        .sort((x, y) => x.alias.localeCompare(y.alias));
+}
 /** On-disk account inventory — the default `AdminDeps.listAccounts`. */
 async function defaultListAccounts() {
     const aliases = await listAccountAliases();
@@ -177,6 +236,7 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
     const method = req.method ?? 'GET';
     const remote = req.socket?.remoteAddress;
     const isAccountDelete = method === 'DELETE' && urlPath.startsWith(ACCOUNTS_PREFIX) && urlPath.length > ACCOUNTS_PREFIX.length;
+    const isCodexAccountDelete = method === 'DELETE' && urlPath.startsWith(CODEX_ACCOUNTS_PREFIX) && urlPath.length > CODEX_ACCOUNTS_PREFIX.length;
     // Named keys (dario#1318): `/admin/keys`, `/admin/keys/<name>`,
     // `/admin/keys/<name>/rotate`. The name is validated after auth so a
     // malformed one is a 400 to a caller who holds the token, not a route miss.
@@ -191,6 +251,10 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
         urlPath === '/admin/login/complete' ||
         urlPath === '/admin/accounts' ||
         urlPath === '/admin/keys' ||
+        urlPath === '/admin/codex/login/start' ||
+        urlPath === '/admin/codex/login/complete' ||
+        urlPath === '/admin/codex/accounts' ||
+        isCodexAccountDelete ||
         isAccountDelete ||
         isKeyRotate ||
         isKeyRevoke;
@@ -224,6 +288,7 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
     // blanket pre-parse token here would let a single HTTP request move N
     // accounts' credentials for the price of one throttle token.
     const isMutation = urlPath === '/admin/login/start' || isAccountDelete
+        || urlPath === '/admin/codex/login/start' || isCodexAccountDelete
         || (urlPath === '/admin/keys' && method === 'POST') || isKeyRotate || isKeyRevoke;
     if (isMutation) {
         const wait = deps.rateLimit?.('mutation') ?? 0;
@@ -264,6 +329,80 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
             });
             return true;
         }
+        // POST /admin/codex/login/start  { alias? }  — a ChatGPT (altman) seat, headless (dario#1009)
+        if (urlPath === '/admin/codex/login/start') {
+            if (method !== 'POST') {
+                send(res, 405, { error: 'Method not allowed (use POST)' });
+                return true;
+            }
+            const body = await readJsonBody(req);
+            let alias = typeof body.alias === 'string' ? body.alias.trim() : '';
+            if (!alias) {
+                const taken = new Set([...(await listCodexAccountAliases()), ...pendingCodexLogins.keys()]);
+                alias = nextDefaultAlias(taken, 'altman');
+            }
+            const result = await doStartCodexLogin(alias, now, deps, remote);
+            if (!result.ok) {
+                send(res, result.status, { error: result.error });
+                return true;
+            }
+            send(res, 200, {
+                alias: result.alias,
+                authorize_url: result.authorizeUrl,
+                expires_at: new Date(result.expiresAt).toISOString(),
+                instructions: `Open authorize_url and log in with the ChatGPT account. The browser lands on a localhost page that does not load — that is expected. POST { "alias": "${result.alias}", "code": "<the whole address bar of that page>" } to /admin/codex/login/complete.`,
+            });
+            return true;
+        }
+        // POST /admin/codex/login/complete  { alias, code }
+        if (urlPath === '/admin/codex/login/complete') {
+            if (method !== 'POST') {
+                send(res, 405, { error: 'Method not allowed (use POST)' });
+                return true;
+            }
+            const body = await readJsonBody(req);
+            const alias = typeof body.alias === 'string' ? body.alias.trim() : '';
+            const rawCode = typeof body.code === 'string' ? body.code : '';
+            const wait = deps.rateLimit?.('mutation') ?? 0;
+            if (wait > 0) {
+                sendThrottled(res, wait, 'mutation', deps.audit, remote, alias || undefined);
+                return true;
+            }
+            const result = await doCompleteCodexLogin(alias, rawCode, now, deps, remote);
+            if (!result.ok) {
+                send(res, result.status, { error: result.error });
+                return true;
+            }
+            send(res, 200, { alias: result.alias, status: 'added', expires_at: new Date(result.expiresAt).toISOString() });
+            return true;
+        }
+        // GET /admin/codex/accounts
+        if (urlPath === '/admin/codex/accounts') {
+            if (method !== 'GET') {
+                send(res, 405, { error: 'Method not allowed (use GET)' });
+                return true;
+            }
+            const accounts = await listCodexAccountRecords();
+            send(res, 200, { accounts, count: accounts.length });
+            return true;
+        }
+        // DELETE /admin/codex/accounts/<alias>
+        if (isCodexAccountDelete) {
+            let alias;
+            try {
+                alias = decodeURIComponent(urlPath.slice(CODEX_ACCOUNTS_PREFIX.length));
+            }
+            catch {
+                send(res, 400, { error: 'malformed alias' });
+                return true;
+            }
+            const removed = await removeCodexAccount(alias);
+            if (removed)
+                await deps.onCodexAccountsChanged?.();
+            deps.audit?.({ action: 'account_remove', ok: removed, status: removed ? 200 : 404, alias, remote, engine: 'codex' });
+            send(res, removed ? 200 : 404, removed ? { alias, removed: true } : { error: `no codex account "${alias}"` });
+            return true;
+        }
         // POST /admin/login/start-needed  { threshold? }  (#913)
         // Bulk-starts a login for every live pool account whose consecutive auth
         // failures have crossed `threshold` (default NEEDS_LOGIN_THRESHOLD) — the
@@ -529,4 +668,5 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
 /** Test-only: clear the pending-login map between cases. */
 export function _resetAdminStateForTest() {
     pendingLogins.clear();
+    pendingCodexLogins.clear();
 }

package/dist/codex-accounts.d.ts

@@ -7,7 +7,13 @@ export interface CodexAccountCredentials {
 }
 export declare function listCodexAccountAliases(): Promise<string[]>;
 export declare function hasAnyCodexAccount(nowMs?: number): Promise<boolean>;
-/** Drop the negative cache so a test doesn't have to sleep out its TTL. */
+/**
+ * Drop the negative cache: a seat was just added or removed by something other
+ * than the CLI (the admin API, dario#1009), so the next request must ask the
+ * directory again instead of trusting a 30 s old "none".
+ */
+export declare function resetCodexPresenceCache(): void;
+/** Test alias — kept so existing tests need not change. */
 export declare function _resetCodexPresenceCacheForTest(): void;
 export declare function loadCodexAccount(alias: string): Promise<CodexAccountCredentials | null>;
 export declare function loadAllCodexAccounts(): Promise<CodexAccountCredentials[]>;
@@ -61,6 +67,15 @@ export declare function _resetCodexRefreshFailuresForTest(): void;
  * a misleading "run `dario login`" answer to the client.
  */
 export declare function getFreshCodexAccount(creds: CodexAccountCredentials): Promise<CodexAccountCredentials>;
+/**
+ * Refresh REGARDLESS of the clock, for the one caller that knows better than
+ * the clock does: the backend answered 401 on a token dario still believes in
+ * (dario#1338 shape, 2026-09-17 — a stored token valid for another day, every
+ * request on the seat rejected for six hours because nothing ever asked for a
+ * new one). Same single-flight and same failure cool-down as the clock path:
+ * a dead refresh token must not become a token-endpoint storm, one per request.
+ */
+export declare function forceRefreshCodexAccount(creds: CodexAccountCredentials): Promise<CodexAccountCredentials>;
 /** Record that `alias` declined, for as long as the upstream asked. */
 export declare function noteCodexDecline(alias: string, retryAfterMs?: number | null): number;
 /** A seat that just served is not rate-limited — clear it. */

package/dist/codex-accounts.js

@@ -69,10 +69,18 @@ export async function hasAnyCodexAccount(nowMs = Date.now()) {
     codexAbsentUntil = present ? 0 : nowMs + CODEX_PRESENCE_NEGATIVE_TTL_MS;
     return present;
 }
-/** Drop the negative cache so a test doesn't have to sleep out its TTL. */
-export function _resetCodexPresenceCacheForTest() {
+/**
+ * Drop the negative cache: a seat was just added or removed by something other
+ * than the CLI (the admin API, dario#1009), so the next request must ask the
+ * directory again instead of trusting a 30 s old "none".
+ */
+export function resetCodexPresenceCache() {
     codexAbsentUntil = 0;
 }
+/** Test alias — kept so existing tests need not change. */
+export function _resetCodexPresenceCacheForTest() {
+    resetCodexPresenceCache();
+}
 export async function loadCodexAccount(alias) {
     const path = safeAliasPath(alias);
     if (!path)
@@ -271,6 +279,21 @@ export async function getFreshCodexAccount(creds) {
         noteRefreshRecovered(creds.alias);
         return creds;
     }
+    return refreshNow(creds);
+}
+/**
+ * Refresh REGARDLESS of the clock, for the one caller that knows better than
+ * the clock does: the backend answered 401 on a token dario still believes in
+ * (dario#1338 shape, 2026-09-17 — a stored token valid for another day, every
+ * request on the seat rejected for six hours because nothing ever asked for a
+ * new one). Same single-flight and same failure cool-down as the clock path:
+ * a dead refresh token must not become a token-endpoint storm, one per request.
+ */
+export async function forceRefreshCodexAccount(creds) {
+    return refreshNow(creds);
+}
+/** The refresh itself: one in flight per alias, and a remembered failure short-circuits. */
+async function refreshNow(creds) {
     const existing = inflightRefresh.get(creds.alias);
     if (existing)
         return existing;

package/dist/codex-backend.d.ts

@@ -278,6 +278,30 @@ export declare function buildCodexHeaders(creds: CodexAccountCredentials): Recor
  * into a buffered response object is not built yet. A non-streaming client
  * gets a 400 saying so.
  */
+/**
+ * Is this status the backend saying the CREDENTIAL is no good, rather than the
+ * request or the quota? 401 and 403 both arrive that way from the Responses
+ * API — a revoked session, a token rotated by another client, an account whose
+ * plan changed underneath us.
+ */
+export declare function isCodexAuthFailure(status: number): boolean;
+/**
+ * One forced refresh after an auth failure, then the caller retries once.
+ *
+ * `getFreshCodexAccount` refreshes on the CLOCK, so a token dario believes in
+ * is never re-fetched no matter how many times upstream rejects it. On
+ * 2026-09-17 that took the fleet's only fallback seat down for six hours: the
+ * stored token was valid until the next day, the backend answered 401 to every
+ * request, and each one was handed to the client unchanged — no refresh, no
+ * cool-down, no failover.
+ *
+ * Returns the fresh credentials when a retry is worth making, or null when it
+ * is not: no refresh token to spend, the refresh failed (its own cool-down then
+ * governs — the seat is reported unavailable and the chain moves on), or the
+ * token came back byte-identical, in which case retrying only reproduces the
+ * same 401.
+ */
+export declare function refreshAfterCodexAuthFailure(creds: CodexAccountCredentials, verbose: boolean): Promise<CodexAccountCredentials | null>;
 export declare function forwardResponsesToCodex(res: ServerResponse, body: Record<string, unknown>, creds: CodexAccountCredentials, corsOrigin: string, securityHeaders: Record<string, string>, upstreamTimeoutMs: number, verbose: boolean, fetchImpl?: typeof fetch, onDone?: (outcome: CodexForwardOutcome) => void, 
 /** Mirrors forwardToCodex. A 429 or 5xx is the SEAT saying no, and the
  *  caller needs to know which seat and for how long — without it the pool

package/dist/codex-backend.js

@@ -22,6 +22,7 @@
  * translation in both directions, including SSE.
  */
 import { createHash } from 'node:crypto';
+import { forceRefreshCodexAccount } from './codex-accounts.js';
 import { anthropicToResponsesRequest, anthropicUsageFromResponses, createResponsesSSEParser, formatResponsesAnthropicSSE, createAnthropicMessageAssembler, responsesStreamToAnthropicSSE, } from './anthropic-responses-translate.js';
 import { resolveClaudeTarget } from './claude-model.js';
 import { parseEffortSuffix } from './effort.js';
@@ -759,6 +760,48 @@ export function buildCodexHeaders(creds) {
  * into a buffered response object is not built yet. A non-streaming client
  * gets a 400 saying so.
  */
+/**
+ * Is this status the backend saying the CREDENTIAL is no good, rather than the
+ * request or the quota? 401 and 403 both arrive that way from the Responses
+ * API — a revoked session, a token rotated by another client, an account whose
+ * plan changed underneath us.
+ */
+export function isCodexAuthFailure(status) {
+    return status === 401 || status === 403;
+}
+/**
+ * One forced refresh after an auth failure, then the caller retries once.
+ *
+ * `getFreshCodexAccount` refreshes on the CLOCK, so a token dario believes in
+ * is never re-fetched no matter how many times upstream rejects it. On
+ * 2026-09-17 that took the fleet's only fallback seat down for six hours: the
+ * stored token was valid until the next day, the backend answered 401 to every
+ * request, and each one was handed to the client unchanged — no refresh, no
+ * cool-down, no failover.
+ *
+ * Returns the fresh credentials when a retry is worth making, or null when it
+ * is not: no refresh token to spend, the refresh failed (its own cool-down then
+ * governs — the seat is reported unavailable and the chain moves on), or the
+ * token came back byte-identical, in which case retrying only reproduces the
+ * same 401.
+ */
+export async function refreshAfterCodexAuthFailure(creds, verbose) {
+    if (!creds.refreshToken)
+        return null;
+    try {
+        const fresh = await forceRefreshCodexAccount(creds);
+        if (fresh.accessToken === creds.accessToken)
+            return null;
+        if (verbose)
+            console.log(`[dario] codex account ${creds.alias}: upstream rejected a stored token — refreshed, retrying once`);
+        return fresh;
+    }
+    catch (err) {
+        console.warn(`[dario] codex account ${creds.alias}: upstream rejected its token and the refresh failed `
+            + `(${err instanceof Error ? err.message : String(err)}) — re-add the seat with \`dario add altman ${creds.alias}\``);
+        return null;
+    }
+}
 export async function forwardResponsesToCodex(res, body, creds, corsOrigin, securityHeaders, upstreamTimeoutMs, verbose, fetchImpl = fetch, onDone, 
 /** Mirrors forwardToCodex. A 429 or 5xx is the SEAT saying no, and the
  *  caller needs to know which seat and for how long — without it the pool
@@ -808,14 +851,26 @@ deferOnUnavailable = false) {
     try {
         if (verbose)
             console.log(`[dario] → codex backend (responses passthrough): ${target} (model: ${model})`);
-        const upstream = await fetchImpl(target, { method: 'POST', headers: buildCodexHeaders(creds), body: JSON.stringify(upstreamBody), signal: abort.signal });
+        let activeCreds = creds;
+        let upstream = await fetchImpl(target, { method: 'POST', headers: buildCodexHeaders(activeCreds), body: JSON.stringify(upstreamBody), signal: abort.signal });
+        if (isCodexAuthFailure(upstream.status)) {
+            await upstream.text().catch(() => ''); // release the rejected response before retrying
+            const fresh = await refreshAfterCodexAuthFailure(activeCreds, verbose);
+            if (fresh) {
+                activeCreds = fresh;
+                upstream = await fetchImpl(target, { method: 'POST', headers: buildCodexHeaders(activeCreds), body: JSON.stringify(upstreamBody), signal: abort.signal });
+            }
+        }
         if (!upstream.ok || !upstream.body) {
             const detail = await upstream.text().catch(() => '');
             if (verbose)
                 console.error(`[dario] codex backend ${upstream.status}: ${detail.slice(0, 300)}`);
             // Same rule as the Messages path: a 429 or a 5xx is the seat declining,
-            // and that is true whether or not anything is waiting to take over.
-            const unavailable = upstream.status === 429 || upstream.status >= 500;
+            // and that is true whether or not anything is waiting to take over. An
+            // auth failure that survived the forced refresh above joins them: the
+            // seat cannot serve until someone re-adds it, so cool it and let the
+            // chain move on instead of handing the client a 401 it cannot act on.
+            const unavailable = upstream.status === 429 || upstream.status >= 500 || isCodexAuthFailure(upstream.status);
             if (unavailable) {
                 try {
                     onDecline?.({ status: upstream.status, retryAfterMs: parseRetryAfterMs(upstream.headers.get('retry-after')), alias: creds.alias });
@@ -1050,12 +1105,28 @@ midstream) {
     try {
         if (verbose)
             console.log(`[dario] → codex backend: ${target} (model: ${model})`);
-        const upstream = await fetchImpl(target, {
+        let activeCreds = creds;
+        let upstream = await fetchImpl(target, {
             method: 'POST',
-            headers: buildCodexHeaders(creds),
+            headers: buildCodexHeaders(activeCreds),
             body: JSON.stringify(scrubbed),
             signal: abort.signal,
         });
+        // An auth failure on a token the clock still trusts: refresh it once and
+        // ask again, before any of the decline/report machinery below runs.
+        if (isCodexAuthFailure(upstream.status)) {
+            await upstream.text().catch(() => ''); // release the rejected response before retrying
+            const fresh = await refreshAfterCodexAuthFailure(activeCreds, verbose);
+            if (fresh) {
+                activeCreds = fresh;
+                upstream = await fetchImpl(target, {
+                    method: 'POST',
+                    headers: buildCodexHeaders(activeCreds),
+                    body: JSON.stringify(scrubbed),
+                    signal: abort.signal,
+                });
+            }
+        }
         if (!upstream.ok) {
             const detail = await upstream.text().catch(() => '');
             if (verbose)
@@ -1073,7 +1144,12 @@ midstream) {
             // cue to fail over, not something to hand the client. A 4xx that is our
             // own fault (a bad body, an unsupported parameter) is NOT: failing over
             // would just reproduce it somewhere else and hide the real error.
-            const unavailable = upstream.status === 429 || upstream.status >= 500;
+            // An auth failure that survived the forced refresh above counts as the
+            // seat declining, not as the client's error: nothing the caller sends
+            // will fix a revoked token, and a 401 relayed to Claude Code reads as an
+            // outage (2026-09-17, six hours of it). Cooling it also stops selection
+            // from handing the same dead seat the next request.
+            const unavailable = upstream.status === 429 || upstream.status >= 500 || isCodexAuthFailure(upstream.status);
             // The seat said no, and that is true whether or not a fallback exists
             // to defer to. Recording it outside the defer branch is what lets the
             // POOL rotate on a deployment with no --pool-fallback configured: with

package/dist/ledger.d.ts

@@ -62,6 +62,11 @@ export interface LedgerConsumerSummary {
     requests: number;
     apiEquivalentCost: number;
     meteredCost: number;
+    /** Lifetime tokens, both buckets — what the cost is made of (dario#1318: "100k output can't be $24"; it was the input and cache-write side). */
+    inputTokens: number;
+    outputTokens: number;
+    cacheReadTokens: number;
+    cacheCreateTokens: number;
     recent: {
         today: number;
         last7d: number;
@@ -150,6 +155,8 @@ export declare function addToLedger(file: LedgerFile, record: RequestRecord): bo
 export declare function pruneLedger(file: LedgerFile, maxDays?: number): void;
 /** The per-consumer split of a file, priced the same way as the headline. */
 export declare function summarizeLedgerConsumers(file: LedgerFile, now?: number): Record<string, LedgerConsumerSummary>;
+/** `1234` → `1.2k`, `1234567` → `1.2M`; below a thousand, the number itself. */
+export declare function formatTokenCount(n: number): string;
 export declare function summarizeLedger(file: LedgerFile, path: string, now?: number): LedgerSummary;
 /**
  * Read a ledger file for display without a running proxy (`dario usage`

package/dist/ledger.js

@@ -198,7 +198,7 @@ export function summarizeLedgerConsumers(file, now = Date.now()) {
     for (const [day, byConsumer] of Object.entries(file.consumers ?? {})) {
         const at = dayMs(day);
         for (const [consumer, models] of Object.entries(byConsumer)) {
-            const c = (out[consumer] ??= { requests: 0, apiEquivalentCost: 0, meteredCost: 0, recent: { today: 0, last7d: 0, last30d: 0 }, lastDay: day, models: [], _models: {} });
+            const c = (out[consumer] ??= { requests: 0, apiEquivalentCost: 0, meteredCost: 0, inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0, recent: { today: 0, last7d: 0, last30d: 0 }, lastDay: day, models: [], _models: {} });
             if (day > c.lastDay)
                 c.lastDay = day;
             for (const [model, row] of Object.entries(models)) {
@@ -206,6 +206,7 @@ export function summarizeLedgerConsumers(file, now = Date.now()) {
                     const cost = costOfTokens(model, at, row.covered);
                     c.apiEquivalentCost += cost;
                     c.requests += row.covered.requests;
+                    addTokens(c, row.covered);
                     c._models[model] = (c._models[model] ?? 0) + row.covered.requests;
                     if (day === today)
                         c.recent.today += cost;
@@ -217,6 +218,7 @@ export function summarizeLedgerConsumers(file, now = Date.now()) {
                 if (row.metered) {
                     c.meteredCost += costOfTokens(model, at, row.metered);
                     c.requests += row.metered.requests;
+                    addTokens(c, row.metered);
                     c._models[model] = (c._models[model] ?? 0) + row.metered.requests;
                 }
             }
@@ -228,6 +230,10 @@ export function summarizeLedgerConsumers(file, now = Date.now()) {
             requests: c.requests,
             apiEquivalentCost: round(c.apiEquivalentCost),
             meteredCost: round(c.meteredCost),
+            inputTokens: c.inputTokens,
+            outputTokens: c.outputTokens,
+            cacheReadTokens: c.cacheReadTokens,
+            cacheCreateTokens: c.cacheCreateTokens,
             recent: { today: round(c.recent.today), last7d: round(c.recent.last7d), last30d: round(c.recent.last30d) },
             lastDay: c.lastDay,
             models: Object.entries(c._models).sort((a, b) => b[1] - a[1]).map(([m]) => m),
@@ -235,6 +241,28 @@ export function summarizeLedgerConsumers(file, now = Date.now()) {
     }
     return result;
 }
+function addTokens(into, cell) {
+    into.inputTokens += cell.inputTokens;
+    into.outputTokens += cell.outputTokens;
+    into.cacheReadTokens += cell.cacheReadTokens;
+    into.cacheCreateTokens += cell.cacheCreateTokens;
+}
+// Round BEFORE choosing the unit. Picking the unit on the raw value and
+// rounding afterwards let 999_600 print as "1000k": once the rounded
+// thousands reach the next unit, the number belongs in that unit.
+function scaleTokenCount(value, unit) {
+    const oneDecimal = Math.round(value * 10) / 10;
+    return oneDecimal >= 10 ? `${Math.round(value)}${unit}` : `${oneDecimal.toFixed(1)}${unit}`;
+}
+/** `1234` → `1.2k`, `1234567` → `1.2M`; below a thousand, the number itself. */
+export function formatTokenCount(n) {
+    if (n < 1_000)
+        return String(n);
+    const thousands = n / 1_000;
+    if (thousands >= 1_000 || Math.round(thousands) >= 1_000)
+        return scaleTokenCount(n / 1_000_000, 'M');
+    return scaleTokenCount(thousands, 'k');
+}
 // Six places, not the window's four: a handful of gpt-5.6-luna requests is
 // real money in the millionths and "$0 for 2 requests" reads as free.
 const round = (usd) => Math.round(usd * 1_000_000) / 1_000_000;
@@ -475,11 +503,12 @@ export function formatLedgerConsumers(s, limit = 20) {
     if (entries.length === 0)
         return ['  By key: no request named a consumer yet (create keys with `dario keys create <name>`).'];
     const lines = [];
-    lines.push(`  By key (${entries.length} consumer${entries.length === 1 ? '' : 's'}; API-equivalent, lifetime · today · 7d · 30d):`);
+    lines.push(`  By key (${entries.length} consumer${entries.length === 1 ? '' : 's'}; API-equivalent, lifetime · today · 7d · 30d; then the tokens behind the lifetime number):`);
     const width = Math.min(24, Math.max(...entries.map(([c]) => c.length)));
     for (const [consumer, c] of entries.slice(0, limit)) {
         const models = c.models.slice(0, 2).map(shortModelName).join(', ');
         lines.push(`    ${consumer.slice(0, width).padEnd(width)} ${formatUsd(c.apiEquivalentCost).padStart(9)} · ${formatUsd(c.recent.today).padStart(8)} · ${formatUsd(c.recent.last7d).padStart(8)} · ${formatUsd(c.recent.last30d).padStart(8)}   ${c.requests.toLocaleString('en-US')} req${c.requests === 1 ? '' : 's'}${models ? `, ${models}` : ''}${c.meteredCost > 0 ? `, ${formatUsd(c.meteredCost)} metered` : ''}`);
+        lines.push(`    ${' '.repeat(width)} in ${formatTokenCount(c.inputTokens)} · out ${formatTokenCount(c.outputTokens)} · cache read ${formatTokenCount(c.cacheReadTokens)} · cache write ${formatTokenCount(c.cacheCreateTokens)}`);
     }
     if (entries.length > limit)
         lines.push(`    … and ${entries.length - limit} more`);

package/dist/live-fingerprint.d.ts

@@ -496,7 +496,7 @@ export declare function detectDrift(t: TemplateData, installedOverride?: string
  */
 export declare const SUPPORTED_CC_RANGE: {
     readonly min: "1.0.0";
-    readonly maxTested: "2.1.273";
+    readonly maxTested: "2.1.275";
 };
 /**
  * Compare two dotted-numeric version strings. Returns negative if `a<b`,

package/dist/live-fingerprint.js

@@ -1194,7 +1194,7 @@ export function detectDrift(t, installedOverride) {
  */
 export const SUPPORTED_CC_RANGE = {
     min: '1.0.0',
-    maxTested: '2.1.273',
+    maxTested: '2.1.275',
 };
 /**
  * Compare two dotted-numeric version strings. Returns negative if `a<b`,

package/dist/proxy.js

@@ -45,7 +45,7 @@ import { responsesRequestToAnthropic, unsupportedOnClaudeError, ResponsesRequest
 import { isClaudeServableModel } from './claude-model.js';
 import { MODEL_UNROUTABLE } from './upstream-rejection.js';
 import { readCompareTarget, teeResponse, runCompare, writeCompareRecord, COMPARE_RESULT_HEADER } from './compare.js';
-import { listCodexAccountAliases, loadAllCodexAccounts, codexAccountNeedsRefresh, hasAnyCodexAccount, selectCodexAccount, selectCodexAccountExcluding, rebindCodexSticky, getFreshCodexAccount, noteCodexDecline, clearCodexDecline, allAliasesCooled, getCodexRefreshFailure, CodexCredentialsUnavailableError } from './codex-accounts.js';
+import { listCodexAccountAliases, loadAllCodexAccounts, codexAccountNeedsRefresh, hasAnyCodexAccount, selectCodexAccount, selectCodexAccountExcluding, rebindCodexSticky, getFreshCodexAccount, noteCodexDecline, clearCodexDecline, allAliasesCooled, getCodexRefreshFailure, CodexCredentialsUnavailableError, resetCodexPresenceCache } from './codex-accounts.js';
 import { route as routeProvider } from './provider-adapter.js';
 import { selectPoolFallbackModels } from './pool-fallback-tier.js';
 import { RequestQueue, QueueFullError, QueueTimeoutError, DEFAULT_MAX_CONCURRENT, DEFAULT_MAX_QUEUED, DEFAULT_QUEUE_TIMEOUT_MS } from './request-queue.js';
@@ -2394,6 +2394,13 @@ export async function startProxy(opts = {}) {
                 // through the store the live proxy authenticates from, so a key made
                 // here works on the next request.
                 keys: keyStore,
+                onCodexAccountsChanged: async () => {
+                    // A ChatGPT seat came or went over HTTP (dario#1009): forget the
+                    // "no codex account" answer so the next request routes to it.
+                    resetCodexPresenceCache();
+                    if (verbose)
+                        console.log('[dario] admin: codex accounts changed — re-read on the next request');
+                },
                 onAccountsChanged: async () => {
                     // Hot-reload the live pool from disk so accounts added / removed via
                     // the admin API take effect immediately — no proxy restart (#599).

package/docs/admin-api.md

@@ -258,3 +258,16 @@ one-liner for interactive setups and is never required on the admin path. See
 [`docs/multi-account-pool.md`](./multi-account-pool.md) for how the pool
 routes, and [`docs/docker.md`](./docker.md) for the container deployment this
 API was built for.
+
+## A ChatGPT (altman) seat, headless
+
+The same flow for a ChatGPT Plus/Pro seat, for a proxy that never sees a terminal — a k8s pod, a CI runner (dario#1009). `dario add altman` needs someone at a prompt; these four do not. The browser lands on a `localhost` page that does not load, which is expected: the whole address bar of that page is the code.
+
+| Method + path | Body | Returns |
+|---|---|---|
+| `POST /admin/codex/login/start` | `{ "alias"?: string }` | `{ alias, authorize_url, expires_at, instructions }` — default alias `altman-1`, `altman-2`, … ; `409` if the alias already holds a seat |
+| `POST /admin/codex/login/complete` | `{ "alias": string, "code": string }` — the redirect URL, or the bare code | `{ alias, status: "added", expires_at }` |
+| `GET /admin/codex/accounts` | — | `{ accounts: [{ alias, expiresAt, needsRefresh }], count }` |
+| `DELETE /admin/codex/accounts/<alias>` | — | `{ alias, removed }` (`404` if no such alias) |
+
+A running proxy serves the new seat on its next request; nothing restarts. Same token, same rate limits, same audit log — codex events carry `engine: "codex"`. The seat is stored where the CLI stores it (`~/.dario/codex-accounts/<alias>.json`), so `dario codex list` and `dario codex remove` see it too.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.8.7",
+  "version": "6.8.9",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {