@askalf/dario 6.8.8 → 6.8.9

package/dist/codex-accounts.d.ts

@@ -67,6 +67,15 @@ export declare function _resetCodexRefreshFailuresForTest(): void;
  * a misleading "run `dario login`" answer to the client.
  */
 export declare function getFreshCodexAccount(creds: CodexAccountCredentials): Promise<CodexAccountCredentials>;
+/**
+ * Refresh REGARDLESS of the clock, for the one caller that knows better than
+ * the clock does: the backend answered 401 on a token dario still believes in
+ * (dario#1338 shape, 2026-09-17 — a stored token valid for another day, every
+ * request on the seat rejected for six hours because nothing ever asked for a
+ * new one). Same single-flight and same failure cool-down as the clock path:
+ * a dead refresh token must not become a token-endpoint storm, one per request.
+ */
+export declare function forceRefreshCodexAccount(creds: CodexAccountCredentials): Promise<CodexAccountCredentials>;
 /** Record that `alias` declined, for as long as the upstream asked. */
 export declare function noteCodexDecline(alias: string, retryAfterMs?: number | null): number;
 /** A seat that just served is not rate-limited — clear it. */

package/dist/codex-accounts.js

@@ -279,6 +279,21 @@ export async function getFreshCodexAccount(creds) {
         noteRefreshRecovered(creds.alias);
         return creds;
     }
+    return refreshNow(creds);
+}
+/**
+ * Refresh REGARDLESS of the clock, for the one caller that knows better than
+ * the clock does: the backend answered 401 on a token dario still believes in
+ * (dario#1338 shape, 2026-09-17 — a stored token valid for another day, every
+ * request on the seat rejected for six hours because nothing ever asked for a
+ * new one). Same single-flight and same failure cool-down as the clock path:
+ * a dead refresh token must not become a token-endpoint storm, one per request.
+ */
+export async function forceRefreshCodexAccount(creds) {
+    return refreshNow(creds);
+}
+/** The refresh itself: one in flight per alias, and a remembered failure short-circuits. */
+async function refreshNow(creds) {
     const existing = inflightRefresh.get(creds.alias);
     if (existing)
         return existing;

package/dist/codex-backend.d.ts

@@ -278,6 +278,30 @@ export declare function buildCodexHeaders(creds: CodexAccountCredentials): Recor
  * into a buffered response object is not built yet. A non-streaming client
  * gets a 400 saying so.
  */
+/**
+ * Is this status the backend saying the CREDENTIAL is no good, rather than the
+ * request or the quota? 401 and 403 both arrive that way from the Responses
+ * API — a revoked session, a token rotated by another client, an account whose
+ * plan changed underneath us.
+ */
+export declare function isCodexAuthFailure(status: number): boolean;
+/**
+ * One forced refresh after an auth failure, then the caller retries once.
+ *
+ * `getFreshCodexAccount` refreshes on the CLOCK, so a token dario believes in
+ * is never re-fetched no matter how many times upstream rejects it. On
+ * 2026-09-17 that took the fleet's only fallback seat down for six hours: the
+ * stored token was valid until the next day, the backend answered 401 to every
+ * request, and each one was handed to the client unchanged — no refresh, no
+ * cool-down, no failover.
+ *
+ * Returns the fresh credentials when a retry is worth making, or null when it
+ * is not: no refresh token to spend, the refresh failed (its own cool-down then
+ * governs — the seat is reported unavailable and the chain moves on), or the
+ * token came back byte-identical, in which case retrying only reproduces the
+ * same 401.
+ */
+export declare function refreshAfterCodexAuthFailure(creds: CodexAccountCredentials, verbose: boolean): Promise<CodexAccountCredentials | null>;
 export declare function forwardResponsesToCodex(res: ServerResponse, body: Record<string, unknown>, creds: CodexAccountCredentials, corsOrigin: string, securityHeaders: Record<string, string>, upstreamTimeoutMs: number, verbose: boolean, fetchImpl?: typeof fetch, onDone?: (outcome: CodexForwardOutcome) => void, 
 /** Mirrors forwardToCodex. A 429 or 5xx is the SEAT saying no, and the
  *  caller needs to know which seat and for how long — without it the pool

package/dist/codex-backend.js

@@ -22,6 +22,7 @@
  * translation in both directions, including SSE.
  */
 import { createHash } from 'node:crypto';
+import { forceRefreshCodexAccount } from './codex-accounts.js';
 import { anthropicToResponsesRequest, anthropicUsageFromResponses, createResponsesSSEParser, formatResponsesAnthropicSSE, createAnthropicMessageAssembler, responsesStreamToAnthropicSSE, } from './anthropic-responses-translate.js';
 import { resolveClaudeTarget } from './claude-model.js';
 import { parseEffortSuffix } from './effort.js';
@@ -759,6 +760,48 @@ export function buildCodexHeaders(creds) {
  * into a buffered response object is not built yet. A non-streaming client
  * gets a 400 saying so.
  */
+/**
+ * Is this status the backend saying the CREDENTIAL is no good, rather than the
+ * request or the quota? 401 and 403 both arrive that way from the Responses
+ * API — a revoked session, a token rotated by another client, an account whose
+ * plan changed underneath us.
+ */
+export function isCodexAuthFailure(status) {
+    return status === 401 || status === 403;
+}
+/**
+ * One forced refresh after an auth failure, then the caller retries once.
+ *
+ * `getFreshCodexAccount` refreshes on the CLOCK, so a token dario believes in
+ * is never re-fetched no matter how many times upstream rejects it. On
+ * 2026-09-17 that took the fleet's only fallback seat down for six hours: the
+ * stored token was valid until the next day, the backend answered 401 to every
+ * request, and each one was handed to the client unchanged — no refresh, no
+ * cool-down, no failover.
+ *
+ * Returns the fresh credentials when a retry is worth making, or null when it
+ * is not: no refresh token to spend, the refresh failed (its own cool-down then
+ * governs — the seat is reported unavailable and the chain moves on), or the
+ * token came back byte-identical, in which case retrying only reproduces the
+ * same 401.
+ */
+export async function refreshAfterCodexAuthFailure(creds, verbose) {
+    if (!creds.refreshToken)
+        return null;
+    try {
+        const fresh = await forceRefreshCodexAccount(creds);
+        if (fresh.accessToken === creds.accessToken)
+            return null;
+        if (verbose)
+            console.log(`[dario] codex account ${creds.alias}: upstream rejected a stored token — refreshed, retrying once`);
+        return fresh;
+    }
+    catch (err) {
+        console.warn(`[dario] codex account ${creds.alias}: upstream rejected its token and the refresh failed `
+            + `(${err instanceof Error ? err.message : String(err)}) — re-add the seat with \`dario add altman ${creds.alias}\``);
+        return null;
+    }
+}
 export async function forwardResponsesToCodex(res, body, creds, corsOrigin, securityHeaders, upstreamTimeoutMs, verbose, fetchImpl = fetch, onDone, 
 /** Mirrors forwardToCodex. A 429 or 5xx is the SEAT saying no, and the
  *  caller needs to know which seat and for how long — without it the pool
@@ -808,14 +851,26 @@ deferOnUnavailable = false) {
     try {
         if (verbose)
             console.log(`[dario] → codex backend (responses passthrough): ${target} (model: ${model})`);
-        const upstream = await fetchImpl(target, { method: 'POST', headers: buildCodexHeaders(creds), body: JSON.stringify(upstreamBody), signal: abort.signal });
+        let activeCreds = creds;
+        let upstream = await fetchImpl(target, { method: 'POST', headers: buildCodexHeaders(activeCreds), body: JSON.stringify(upstreamBody), signal: abort.signal });
+        if (isCodexAuthFailure(upstream.status)) {
+            await upstream.text().catch(() => ''); // release the rejected response before retrying
+            const fresh = await refreshAfterCodexAuthFailure(activeCreds, verbose);
+            if (fresh) {
+                activeCreds = fresh;
+                upstream = await fetchImpl(target, { method: 'POST', headers: buildCodexHeaders(activeCreds), body: JSON.stringify(upstreamBody), signal: abort.signal });
+            }
+        }
         if (!upstream.ok || !upstream.body) {
             const detail = await upstream.text().catch(() => '');
             if (verbose)
                 console.error(`[dario] codex backend ${upstream.status}: ${detail.slice(0, 300)}`);
             // Same rule as the Messages path: a 429 or a 5xx is the seat declining,
-            // and that is true whether or not anything is waiting to take over.
-            const unavailable = upstream.status === 429 || upstream.status >= 500;
+            // and that is true whether or not anything is waiting to take over. An
+            // auth failure that survived the forced refresh above joins them: the
+            // seat cannot serve until someone re-adds it, so cool it and let the
+            // chain move on instead of handing the client a 401 it cannot act on.
+            const unavailable = upstream.status === 429 || upstream.status >= 500 || isCodexAuthFailure(upstream.status);
             if (unavailable) {
                 try {
                     onDecline?.({ status: upstream.status, retryAfterMs: parseRetryAfterMs(upstream.headers.get('retry-after')), alias: creds.alias });
@@ -1050,12 +1105,28 @@ midstream) {
     try {
         if (verbose)
             console.log(`[dario] → codex backend: ${target} (model: ${model})`);
-        const upstream = await fetchImpl(target, {
+        let activeCreds = creds;
+        let upstream = await fetchImpl(target, {
             method: 'POST',
-            headers: buildCodexHeaders(creds),
+            headers: buildCodexHeaders(activeCreds),
             body: JSON.stringify(scrubbed),
             signal: abort.signal,
         });
+        // An auth failure on a token the clock still trusts: refresh it once and
+        // ask again, before any of the decline/report machinery below runs.
+        if (isCodexAuthFailure(upstream.status)) {
+            await upstream.text().catch(() => ''); // release the rejected response before retrying
+            const fresh = await refreshAfterCodexAuthFailure(activeCreds, verbose);
+            if (fresh) {
+                activeCreds = fresh;
+                upstream = await fetchImpl(target, {
+                    method: 'POST',
+                    headers: buildCodexHeaders(activeCreds),
+                    body: JSON.stringify(scrubbed),
+                    signal: abort.signal,
+                });
+            }
+        }
         if (!upstream.ok) {
             const detail = await upstream.text().catch(() => '');
             if (verbose)
@@ -1073,7 +1144,12 @@ midstream) {
             // cue to fail over, not something to hand the client. A 4xx that is our
             // own fault (a bad body, an unsupported parameter) is NOT: failing over
             // would just reproduce it somewhere else and hide the real error.
-            const unavailable = upstream.status === 429 || upstream.status >= 500;
+            // An auth failure that survived the forced refresh above counts as the
+            // seat declining, not as the client's error: nothing the caller sends
+            // will fix a revoked token, and a 401 relayed to Claude Code reads as an
+            // outage (2026-09-17, six hours of it). Cooling it also stops selection
+            // from handing the same dead seat the next request.
+            const unavailable = upstream.status === 429 || upstream.status >= 500 || isCodexAuthFailure(upstream.status);
             // The seat said no, and that is true whether or not a fallback exists
             // to defer to. Recording it outside the defer branch is what lets the
             // POOL rotate on a deployment with no --pool-fallback configured: with

package/dist/live-fingerprint.d.ts

@@ -496,7 +496,7 @@ export declare function detectDrift(t: TemplateData, installedOverride?: string
  */
 export declare const SUPPORTED_CC_RANGE: {
     readonly min: "1.0.0";
-    readonly maxTested: "2.1.274";
+    readonly maxTested: "2.1.275";
 };
 /**
  * Compare two dotted-numeric version strings. Returns negative if `a<b`,

package/dist/live-fingerprint.js

@@ -1194,7 +1194,7 @@ export function detectDrift(t, installedOverride) {
  */
 export const SUPPORTED_CC_RANGE = {
     min: '1.0.0',
-    maxTested: '2.1.274',
+    maxTested: '2.1.275',
 };
 /**
  * Compare two dotted-numeric version strings. Returns negative if `a<b`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.8.8",
+  "version": "6.8.9",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {