@askalf/dario 6.0.0 → 6.0.1

package/dist/analytics.d.ts

@@ -63,6 +63,8 @@ export declare function billingBucketFromClaim(claim: string | null | undefined)
  * non-subscription billing classification or the `unknown` sentinel below.
  */
 export declare const SUBSCRIPTION_CLAIMS: ReadonlySet<string>;
+/** The claim the proxy stamps on codex-engine requests (see above). */
+export declare const CODEX_CLAIM = "chatgpt_subscription";
 /**
  * One-line per-request usage summary for verbose (-v / -vv) logs.
  *

package/dist/analytics.js

@@ -35,6 +35,7 @@ export function billingBucketFromClaim(claim) {
         // (30-min cooldown loops) exactly when the weekly window tightens.
         case 'five_hour_overage_included':
         case 'seven_day_overage_included':
+        case 'chatgpt_subscription':
             return 'subscription';
         case 'five_hour_fallback':
         case 'seven_day_fallback':
@@ -61,7 +62,15 @@ export const SUBSCRIPTION_CLAIMS = new Set([
     'seven_day_fallback',
     'five_hour_overage_included',
     'seven_day_overage_included',
+    // The codex engine: a request served from a ChatGPT-subscription account
+    // (dario#1009). There is no Anthropic claim header on that path; the proxy
+    // stamps this one. It is subscription billing — the user's ChatGPT plan —
+    // so it must be recognised here, or the overage guard reads it as
+    // pay-as-you-go and halts the proxy after the first GPT request.
+    'chatgpt_subscription',
 ]);
+/** The claim the proxy stamps on codex-engine requests (see above). */
+export const CODEX_CLAIM = 'chatgpt_subscription';
 /**
  * One-line per-request usage summary for verbose (-v / -vv) logs.
  *

package/dist/codex-backend.d.ts

@@ -46,6 +46,22 @@ export declare function fetchCodexModels(creds: CodexAccountCredentials, fetchIm
  * "route nothing here by name". An explicit `codex:`/`chatgpt:` prefix still
  * routes, so discovery being down never makes the engine unusable.
  */
+/** What the proxy learns from one forwarded codex request — enough for an
+ *  analytics row and a log line. Reported once per request, on every exit
+ *  that answered the client; a DECLINE (deferred to the Claude pool) reports
+ *  nothing, since the Claude path records what it then serves. */
+export interface CodexForwardOutcome {
+    status: number;
+    latencyMs: number;
+    inputTokens: number;
+    outputTokens: number;
+    stream: boolean;
+    model: string;
+    alias: string;
+}
+/** The cached slug list for an alias WITHOUT fetching. For the admin surface:
+ *  a status read must never cost an upstream call or a token refresh. */
+export declare function peekCodexModelSlugs(alias: string): readonly string[] | null;
 export declare function getCodexModelSlugs(creds: CodexAccountCredentials, fetchImpl?: typeof fetch): Promise<readonly string[]>;
 /**
  * Whether a request naming `model` should be served from the subscription: the
@@ -125,6 +141,14 @@ export declare function createResponsesTranslator(model: string): {
     chunk(line: string): string | null;
     /** True when the upstream stream terminated as a FAILURE. */
     didFail(): boolean;
+    /** Token usage from the terminal event, or null if none arrived. Read by
+     *  the proxy to record the request in analytics — before this, codex
+     *  requests were invisible to /analytics and the request log entirely. */
+    usage(): {
+        prompt_tokens: number;
+        completion_tokens: number;
+        total_tokens: number;
+    } | null;
     /** Everything seen so far, as one non-streaming chat.completion body. */
     complete(): Record<string, unknown>;
 };
@@ -179,4 +203,4 @@ export declare function buildCodexHeaders(creds: CodexAccountCredentials): Recor
  * testable without network (test/codex-backend.mjs), matching the pattern
  * test/codex-oauth.mjs already uses.
  */
-export declare function forwardToCodex(req: IncomingMessage, res: ServerResponse, body: Buffer, creds: CodexAccountCredentials, corsOrigin: string, securityHeaders: Record<string, string>, upstreamTimeoutMs: number, verbose: boolean, shape?: CodexRequestShape, fetchImpl?: typeof fetch, deferOnUnavailable?: boolean): Promise<boolean>;
+export declare function forwardToCodex(req: IncomingMessage, res: ServerResponse, body: Buffer, creds: CodexAccountCredentials, corsOrigin: string, securityHeaders: Record<string, string>, upstreamTimeoutMs: number, verbose: boolean, shape?: CodexRequestShape, fetchImpl?: typeof fetch, deferOnUnavailable?: boolean, onDone?: (outcome: CodexForwardOutcome) => void): Promise<boolean>;

package/dist/codex-backend.js

@@ -59,12 +59,12 @@ export async function fetchCodexModels(creds, fetchImpl = fetch) {
     }
     return slugs;
 }
-/**
- * Cached {@link fetchCodexModels}, keyed by account alias. Never throws — an
- * unreachable backend yields the last known set, or an empty one, which means
- * "route nothing here by name". An explicit `codex:`/`chatgpt:` prefix still
- * routes, so discovery being down never makes the engine unusable.
- */
+/** The cached slug list for an alias WITHOUT fetching. For the admin surface:
+ *  a status read must never cost an upstream call or a token refresh. */
+export function peekCodexModelSlugs(alias) {
+    const hit = modelCache.get(alias);
+    return hit ? hit.slugs : null;
+}
 export async function getCodexModelSlugs(creds, fetchImpl = fetch) {
     const hit = modelCache.get(creds.alias);
     if (hit && Date.now() - hit.fetchedAt < hit.ttlMs)
@@ -386,6 +386,12 @@ export function createResponsesTranslator(model) {
         didFail() {
             return failed;
         },
+        /** Token usage from the terminal event, or null if none arrived. Read by
+         *  the proxy to record the request in analytics — before this, codex
+         *  requests were invisible to /analytics and the request log entirely. */
+        usage() {
+            return usage;
+        },
         /** Everything seen so far, as one non-streaming chat.completion body. */
         complete() {
             const calls = [...toolCalls.values()].sort((a, b) => a.index - b.index);
@@ -481,9 +487,23 @@ export function buildCodexHeaders(creds) {
  * testable without network (test/codex-backend.mjs), matching the pattern
  * test/codex-oauth.mjs already uses.
  */
-export async function forwardToCodex(req, res, body, creds, corsOrigin, securityHeaders, upstreamTimeoutMs, verbose, shape = 'openai', fetchImpl = fetch, deferOnUnavailable = false) {
+export async function forwardToCodex(req, res, body, creds, corsOrigin, securityHeaders, upstreamTimeoutMs, verbose, shape = 'openai', fetchImpl = fetch, deferOnUnavailable = false, onDone) {
     void req;
     const isAnthropic = shape === 'anthropic';
+    // Reported exactly once, on every exit that answered the client. Without
+    // this the proxy had no idea a codex request happened: no analytics row, no
+    // log line, no per-account count.
+    const startedAt = Date.now();
+    let reported = false;
+    const report = (status, usage, stream, model) => {
+        if (reported || !onDone)
+            return;
+        reported = true;
+        try {
+            onDone({ status, latencyMs: Date.now() - startedAt, inputTokens: usage?.input ?? 0, outputTokens: usage?.output ?? 0, stream, model, alias: creds.alias });
+        }
+        catch { /* a reporting failure must never break a served request */ }
+    };
     // An Anthropic-shape error body is {type,error{type,message}}; an OpenAI one
     // is {error}. A client SDK reads its own shape, so errors follow the request.
     const errBody = (message, extra = {}) => JSON.stringify(isAnthropic
@@ -496,6 +516,7 @@ export async function forwardToCodex(req, res, body, creds, corsOrigin, security
     catch {
         res.writeHead(400, { 'Content-Type': 'application/json', ...securityHeaders });
         res.end(errBody(`Codex backend requires a JSON ${isAnthropic ? 'messages' : 'chat/completions'} body`));
+        report(400, null, false, '');
         return true;
     }
     const clientWantsStream = parsed.stream === true;
@@ -532,6 +553,7 @@ export async function forwardToCodex(req, res, body, creds, corsOrigin, security
             }
             res.writeHead(upstream.status, { 'Content-Type': 'application/json', ...securityHeaders });
             res.end(errBody('Upstream Codex backend error', { status: upstream.status, account: creds.alias }));
+            report(upstream.status, null, clientWantsStream, model);
             return true;
         }
         // OpenAI shape: one stateful line-in/line-out translator (unchanged).
@@ -625,6 +647,7 @@ export async function forwardToCodex(req, res, body, creds, corsOrigin, security
                 console.error(`[dario] codex backend (${creds.alias}) response failed: ${detail}`);
             res.writeHead(502, { 'Content-Type': 'application/json', ...securityHeaders });
             res.end(errBody(`Codex backend response failed: ${detail}`, { account: creds.alias }));
+            report(502, null, clientWantsStream, model);
             return true;
         }
         if (isAnthropic) {
@@ -654,6 +677,16 @@ export async function forwardToCodex(req, res, body, creds, corsOrigin, security
             });
             res.end(JSON.stringify(translator.complete()));
         }
+        // Token usage rides the terminal Responses event on either shape. A stream
+        // that failed upstream still ended as 200 on the wire (the client saw the
+        // failure event); analytics must count it as the 502 it was.
+        {
+            const tr = terminalResponse;
+            const usage = isAnthropic
+                ? (tr?.usage ? { input: Number(tr.usage.input_tokens ?? 0), output: Number(tr.usage.output_tokens ?? 0) } : null)
+                : (() => { const u = translator.usage(); return u ? { input: u.prompt_tokens, output: u.completion_tokens } : null; })();
+            report(upstreamFailed ? 502 : 200, usage, clientWantsStream, model);
+        }
         return true;
     }
     catch (err) {
@@ -685,6 +718,7 @@ export async function forwardToCodex(req, res, body, creds, corsOrigin, security
             }
             catch { /* already closed */ }
         }
+        report(502, null, false, '');
         return true;
     }
     finally {

package/dist/proxy.js

@@ -13,16 +13,16 @@ import { buildCCRequest, applyCcPromptCaching, isGenuineCCClient, parseEffortSuf
 import { stampCch, hasCchSeed } from './cch.js';
 import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion } from './live-fingerprint.js';
 import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reconcilePoolAccounts, resolvePoolStrategy, utilFreshness } from './pool.js';
-import { Analytics, billingBucketFromClaim, formatUsageLogLine, SUBSCRIPTION_CLAIMS } from './analytics.js';
+import { Analytics, billingBucketFromClaim, formatUsageLogLine, SUBSCRIPTION_CLAIMS, CODEX_CLAIM } from './analytics.js';
 import { OverageGuard, buildHaltErrorBody } from './overage-guard.js';
 import { notify as osNotify } from './notify.js';
 import { loadAllAccounts, loadAccount, saveAccount, refreshAccountToken, resyncLoginFromCredentialsIfStale, ensureLoginCredentialsInPool, mirrorLoginToCredentials } from './accounts.js';
 import { handleAdminRequest } from './admin-api.js';
 import { createTokenBucket } from './rate-limit.js';
 import { getOpenAIBackend, isOpenAIModel, forwardToOpenAI } from './openai-backend.js';
-import { forwardToCodex, getCodexModelSlugs, pickCodexFallback, pickClaudeFallback, CODEX_BACKEND_BASE_URL } from './codex-backend.js';
+import { forwardToCodex, getCodexModelSlugs, peekCodexModelSlugs, pickCodexFallback, pickClaudeFallback, CODEX_BACKEND_BASE_URL } from './codex-backend.js';
 import { readCompareTarget, teeResponse, runCompare, writeCompareRecord, COMPARE_RESULT_HEADER } from './compare.js';
-import { listCodexAccountAliases, hasAnyCodexAccount, selectCodexAccount, getFreshCodexAccount } from './codex-accounts.js';
+import { listCodexAccountAliases, loadAllCodexAccounts, codexAccountNeedsRefresh, hasAnyCodexAccount, selectCodexAccount, getFreshCodexAccount } from './codex-accounts.js';
 import { route as routeProvider } from './provider-adapter.js';
 import { RequestQueue, QueueFullError, QueueTimeoutError, DEFAULT_MAX_CONCURRENT, DEFAULT_MAX_QUEUED, DEFAULT_QUEUE_TIMEOUT_MS } from './request-queue.js';
 import { redactSecrets } from './redact.js';
@@ -1324,6 +1324,9 @@ export async function startProxy(opts = {}) {
     // : null` — that gated the /analytics endpoint, but burn-rate /
     // per-request visibility is useful for a pool of one too.
     const analytics = new Analytics();
+    // Per-alias request counts for GET /codex — the pool has requestCount per
+    // account; the codex accounts had nothing until now.
+    const codexRequestCounts = new Map();
     // Overage-guard (v4.1, dario#288). Resolved from opts with built-in
     // defaults (enabled=true, behavior='halt', cooldown=30min, notifyOs=true)
     // so an opts-less proxy still gets protection. The notifier is wired
@@ -2105,6 +2108,29 @@ export async function startProxy(opts = {}) {
         }
         // Analytics endpoint — rolling-window summary + burn-rate snapshot.
         // Always-on as of v4 (pre-v4 this was gated to pool mode).
+        // The codex engine, for the admin surface. Key-gated like /accounts. Reads
+        // only what is already on disk and in the model cache: no upstream call,
+        // no token refresh, and no token in the answer — a status read must never
+        // spend or expose a credential.
+        if (urlPath === '/codex' && req.method === 'GET') {
+            const now = Date.now();
+            const stored = await loadAllCodexAccounts();
+            const accounts = stored.map((a) => ({
+                alias: a.alias,
+                expiresAt: a.expiresAt,
+                expiresInMs: Math.max(0, a.expiresAt - now),
+                needsRefresh: codexAccountNeedsRefresh(a),
+                models: peekCodexModelSlugs(a.alias) ?? [],
+                requestCount: codexRequestCounts.get(a.alias) ?? 0,
+            }));
+            res.writeHead(200, JSON_HEADERS);
+            res.end(JSON.stringify({
+                backend: CODEX_BACKEND_BASE_URL,
+                requests: [...codexRequestCounts.values()].reduce((n, c) => n + c, 0),
+                accounts,
+            }));
+            return;
+        }
         if (urlPath === '/analytics' && req.method === 'GET') {
             res.writeHead(200, JSON_HEADERS);
             // `queue` rides along the summary (dario#905): request-queue.ts always
@@ -2682,7 +2708,35 @@ export async function startProxy(opts = {}) {
                         // request even with an idle Claude pool sitting right beside it.
                         const claudeTarget = pickClaudeFallback(poolFallbackModels, codexModels);
                         const canDefer = claudeTarget !== null && pool.size > 0 && !upstreamApiKey;
-                        const served = await forwardToCodex(req, res, body, codexCreds, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, isOpenAI ? 'openai' : 'anthropic', fetch, canDefer);
+                        const codexReq = requestCount;
+                        const served = await forwardToCodex(req, res, body, codexCreds, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, isOpenAI ? 'openai' : 'anthropic', fetch, canDefer, 
+                        // Before this hook a codex request left no trace: nothing in
+                        // /analytics, nothing in the request log, no per-account count.
+                        // The dock (and anyone reading /analytics) saw a proxy that
+                        // served GPT all day and reported zero of it. A decline (the
+                        // request handed to the Claude pool) reports nothing here; the
+                        // Claude path records what it then serves.
+                        (o) => {
+                            codexRequestCounts.set(o.alias, (codexRequestCounts.get(o.alias) ?? 0) + 1);
+                            analytics.record({
+                                timestamp: Date.now(),
+                                account: o.alias,
+                                model: o.model || rawModel || 'codex',
+                                inputTokens: o.inputTokens, outputTokens: o.outputTokens,
+                                cacheReadTokens: 0, cacheCreateTokens: 0, thinkingTokens: 0,
+                                // No Anthropic rate-limit headers on this path; the claim
+                                // names the engine and is subscription billing, so the
+                                // overage guard (#288) leaves it alone.
+                                claim: CODEX_CLAIM, util5h: 0, util7d: 0, overageUtil: 0,
+                                latencyMs: o.latencyMs, status: o.status, isStream: o.stream, isOpenAI,
+                            });
+                            writeLogLine(logFileStream, {
+                                ts: new Date().toISOString(), req: codexReq,
+                                method: req.method ?? '', path: urlPath, model: o.model || rawModel || undefined,
+                                status: o.status, latency_ms: o.latencyMs, in_tokens: o.inputTokens, out_tokens: o.outputTokens,
+                                claim: CODEX_CLAIM, bucket: 'subscription', account: o.alias, stream: o.stream,
+                            });
+                        });
                         if (served)
                             return;
                         const swapped = buildPoolFallbackBody(body, claudeTarget);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.0.0",
+  "version": "6.0.1",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {