@askalf/dario 6.0.0 → 6.0.2

package/README.md

@@ -177,7 +177,7 @@ That is a **chain**, read left to right, and each provider takes the first entry
 
 A single-entry chain is one-way and means what it always meant, so an existing config is unaffected. Failover is entirely opt-in: without `--pool-fallback`, a drained pool still returns its honest 429/503.
 
-The Claude entry must be a real `claude-*` model id. "Not a GPT model" is not the same as "the pool can serve it", and swapping in a typo would trade a recoverable 429 for an unrecoverable 404 — so an entry that doesn't look like an Anthropic model is ignored and the error surfaces honestly.
+The Claude entry has to be a model the pool can actually serve. "Not a GPT model" is not the same thing, and swapping in a typo would trade a recoverable 429 for an unrecoverable 404 — so each entry is checked positively against the live model catalog and skipped if it fails, letting the real error surface. Canonical ids (`claude-sonnet-5`), long-context variants (`claude-sonnet-5[1m]`), catalog shorthands (`opus`, `sonnet1m`) and explicit provider prefixes (`claude:opus`, `anthropic:sonnet`) all qualify.
 
 Only a **429 or 5xx** fails over. A 400 surfaces to you, because a bad request that fails over just reproduces itself on the other provider and buries the real cause.
 
@@ -303,7 +303,7 @@ The split isn't live, but it was announced once on short notice and could return
 
 | Signal | Status |
 |---|---|
-| Source | **~29k** lines of TypeScript across **58** files — auditable in a weekend (v5 removed shim; the pool is the one code path) |
+| Source | **~29k** lines of TypeScript across **59** files — auditable in a weekend (v5 removed shim; the pool is the one code path) |
 | Dependencies | **0 runtime.** Verify: `npm ls --production` |
 | Provenance | Every release [SLSA-attested](https://www.npmjs.com/package/@askalf/dario) via GitHub Actions + Sigstore |
 | Scanning | [CodeQL](https://github.com/askalf/dario/actions/workflows/codeql.yml) on every push and weekly |

package/dist/analytics.d.ts

@@ -63,6 +63,8 @@ export declare function billingBucketFromClaim(claim: string | null | undefined)
  * non-subscription billing classification or the `unknown` sentinel below.
  */
 export declare const SUBSCRIPTION_CLAIMS: ReadonlySet<string>;
+/** The claim the proxy stamps on codex-engine requests (see above). */
+export declare const CODEX_CLAIM = "chatgpt_subscription";
 /**
  * One-line per-request usage summary for verbose (-v / -vv) logs.
  *

package/dist/analytics.js

@@ -35,6 +35,7 @@ export function billingBucketFromClaim(claim) {
         // (30-min cooldown loops) exactly when the weekly window tightens.
         case 'five_hour_overage_included':
         case 'seven_day_overage_included':
+        case 'chatgpt_subscription':
             return 'subscription';
         case 'five_hour_fallback':
         case 'seven_day_fallback':
@@ -61,7 +62,15 @@ export const SUBSCRIPTION_CLAIMS = new Set([
     'seven_day_fallback',
     'five_hour_overage_included',
     'seven_day_overage_included',
+    // The codex engine: a request served from a ChatGPT-subscription account
+    // (dario#1009). There is no Anthropic claim header on that path; the proxy
+    // stamps this one. It is subscription billing — the user's ChatGPT plan —
+    // so it must be recognised here, or the overage guard reads it as
+    // pay-as-you-go and halts the proxy after the first GPT request.
+    'chatgpt_subscription',
 ]);
+/** The claim the proxy stamps on codex-engine requests (see above). */
+export const CODEX_CLAIM = 'chatgpt_subscription';
 /**
  * One-line per-request usage summary for verbose (-v / -vv) logs.
  *

package/dist/claude-model.d.ts

@@ -0,0 +1,12 @@
+/** Maps a bare name to a canonical id, or returns it unchanged. */
+export type ModelResolver = (model: string) => string;
+/**
+ * The canonical id the Claude pool would serve `model` as, or null when it
+ * cannot serve it. `bases` is the catalog base set — `getCachedBases()` at a
+ * call site, a fixture in a test. `resolve` is the alias pipeline; the default
+ * knows only catalog family shorthands, so pass the proxy's full resolver
+ * (operator aliases + pinned aliases) where one exists.
+ */
+export declare function resolveClaudeServable(model: string, bases?: readonly string[], resolve?: ModelResolver): string | null;
+/** Whether the Claude pool can serve `model`. See resolveClaudeServable. */
+export declare function isClaudeServableModel(model: string, bases?: readonly string[], resolve?: ModelResolver): boolean;

package/dist/claude-model.js

@@ -0,0 +1,70 @@
+/**
+ * "Can the Claude pool actually serve this model name?" — the positive test
+ * the reverse half of failover needs, and WHAT it resolves to.
+ *
+ * Chain selection used to answer this by elimination: anything absent from the
+ * Codex slugs was handed to the Claude pool. That is not a capability test, it
+ * is a default, and it is wrong for every name that belongs to neither
+ * provider. `--pool-fallback=gpt-5.6-sol,gpt-4o` on a rate-limited
+ * subscription re-pointed the request at Anthropic as `gpt-4o` and turned a
+ * 429 into a 400 — and a typo'd slug (`claude-sonnet-6`, `gtp-5.6-sol`) did
+ * the same, silently, because a misspelling is also "absent from the slugs".
+ * A discovery outage makes it worse: `getCodexModelSlugs` degrades to an EMPTY
+ * set, at which point elimination calls EVERY chain entry Claude-servable.
+ *
+ * So the rule is positive, in two steps that mirror the request path:
+ *
+ *   1. RESOLVE the entry the way a request model is resolved — an explicit
+ *      `claude:` / `anthropic:` prefix is stripped, then operator
+ *      `--model-alias` values, pinned aliases (`opus48`) and catalog family
+ *      shorthands (`opus`, `sonnet1m`) map to a canonical id. The caller
+ *      supplies that resolver so classification and forwarding cannot
+ *      disagree.
+ *   2. VALIDATE the resolved id against the catalog base set. A `claude-`
+ *      prefix on its own proves nothing — `claude-sonnet-6` has the prefix and
+ *      does not exist — so the id (sans `[1m]`) must be a base the pool can
+ *      forward. An explicit provider prefix can force the route; it cannot
+ *      make an unknown model servable.
+ *
+ * The RESOLVED id is what the caller swaps into the body. The swap happens
+ * after the proxy's own alias pass, so returning the entry as written would
+ * send an alias upstream raw and Anthropic would 400 it.
+ *
+ * Pure over the base set it is handed, so the whole selection stays testable
+ * without a socket. `bases` defaults to the baked catalog, never to empty: a
+ * cold catalog must still admit real ids, and must still refuse typos.
+ */
+import { BAKED_BASE_MODELS, resolveAliasAgainst } from './model-catalog.js';
+/** Provider prefixes that force the Claude path (mirrors proxy.ts's PROVIDER_PREFIXES). */
+const CLAUDE_PREFIXES = new Set(['claude', 'anthropic']);
+/**
+ * The canonical id the Claude pool would serve `model` as, or null when it
+ * cannot serve it. `bases` is the catalog base set — `getCachedBases()` at a
+ * call site, a fixture in a test. `resolve` is the alias pipeline; the default
+ * knows only catalog family shorthands, so pass the proxy's full resolver
+ * (operator aliases + pinned aliases) where one exists.
+ */
+export function resolveClaudeServable(model, bases = BAKED_BASE_MODELS, resolve) {
+    let m = model.trim().toLowerCase();
+    if (!m)
+        return null;
+    const idx = m.indexOf(':');
+    if (idx > 0) {
+        const prefix = m.slice(0, idx);
+        // A recognized non-Claude prefix is a definite NO, not a fall-through to
+        // the name test below — `openai:claude-sonnet-5` is the operator pointing
+        // somewhere else on purpose.
+        if (!CLAUDE_PREFIXES.has(prefix))
+            return null;
+        m = m.slice(idx + 1);
+        if (!m)
+            return null;
+    }
+    const resolved = (resolve ? resolve(m) : (resolveAliasAgainst(m, bases) ?? m)).trim().toLowerCase();
+    const base = resolved.endsWith('[1m]') ? resolved.slice(0, -4) : resolved;
+    return bases.some((b) => b.toLowerCase() === base) ? resolved : null;
+}
+/** Whether the Claude pool can serve `model`. See resolveClaudeServable. */
+export function isClaudeServableModel(model, bases = BAKED_BASE_MODELS, resolve) {
+    return resolveClaudeServable(model, bases, resolve) !== null;
+}

package/dist/codex-backend.d.ts

@@ -23,6 +23,7 @@
  */
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { CodexAccountCredentials } from './codex-accounts.js';
+import { type ModelResolver } from './claude-model.js';
 export declare const CODEX_BACKEND_BASE_URL: string;
 /**
  * Client version sent on the model-discovery call. The backend REQUIRES the
@@ -46,6 +47,22 @@ export declare function fetchCodexModels(creds: CodexAccountCredentials, fetchIm
  * "route nothing here by name". An explicit `codex:`/`chatgpt:` prefix still
  * routes, so discovery being down never makes the engine unusable.
  */
+/** What the proxy learns from one forwarded codex request — enough for an
+ *  analytics row and a log line. Reported once per request, on every exit
+ *  that answered the client; a DECLINE (deferred to the Claude pool) reports
+ *  nothing, since the Claude path records what it then serves. */
+export interface CodexForwardOutcome {
+    status: number;
+    latencyMs: number;
+    inputTokens: number;
+    outputTokens: number;
+    stream: boolean;
+    model: string;
+    alias: string;
+}
+/** The cached slug list for an alias WITHOUT fetching. For the admin surface:
+ *  a status read must never cost an upstream call or a token refresh. */
+export declare function peekCodexModelSlugs(alias: string): readonly string[] | null;
 export declare function getCodexModelSlugs(creds: CodexAccountCredentials, fetchImpl?: typeof fetch): Promise<readonly string[]>;
 /**
  * Whether a request naming `model` should be served from the subscription: the
@@ -69,7 +86,7 @@ export declare function isCodexModel(model: string, slugs: readonly string[]): b
  * written before this release behave identically.
  */
 export declare function pickCodexFallback(models: readonly string[], slugs: readonly string[]): string | null;
-export declare function pickClaudeFallback(models: readonly string[], slugs: readonly string[]): string | null;
+export declare function pickClaudeFallback(models: readonly string[], slugs: readonly string[], bases?: readonly string[], resolve?: ModelResolver): string | null;
 /**
  * Pull `chatgpt_account_id` out of the id_token's `https://api.openai.com/auth`
  * claim. Payload only — this is reading our own token for a routing header, not
@@ -125,6 +142,14 @@ export declare function createResponsesTranslator(model: string): {
     chunk(line: string): string | null;
     /** True when the upstream stream terminated as a FAILURE. */
     didFail(): boolean;
+    /** Token usage from the terminal event, or null if none arrived. Read by
+     *  the proxy to record the request in analytics — before this, codex
+     *  requests were invisible to /analytics and the request log entirely. */
+    usage(): {
+        prompt_tokens: number;
+        completion_tokens: number;
+        total_tokens: number;
+    } | null;
     /** Everything seen so far, as one non-streaming chat.completion body. */
     complete(): Record<string, unknown>;
 };
@@ -179,4 +204,4 @@ export declare function buildCodexHeaders(creds: CodexAccountCredentials): Recor
  * testable without network (test/codex-backend.mjs), matching the pattern
  * test/codex-oauth.mjs already uses.
  */
-export declare function forwardToCodex(req: IncomingMessage, res: ServerResponse, body: Buffer, creds: CodexAccountCredentials, corsOrigin: string, securityHeaders: Record<string, string>, upstreamTimeoutMs: number, verbose: boolean, shape?: CodexRequestShape, fetchImpl?: typeof fetch, deferOnUnavailable?: boolean): Promise<boolean>;
+export declare function forwardToCodex(req: IncomingMessage, res: ServerResponse, body: Buffer, creds: CodexAccountCredentials, corsOrigin: string, securityHeaders: Record<string, string>, upstreamTimeoutMs: number, verbose: boolean, shape?: CodexRequestShape, fetchImpl?: typeof fetch, deferOnUnavailable?: boolean, onDone?: (outcome: CodexForwardOutcome) => void): Promise<boolean>;

package/dist/codex-backend.js

@@ -1,4 +1,6 @@
 import { anthropicToResponsesRequest, createResponsesSSEParser, formatResponsesAnthropicSSE, createAnthropicMessageAssembler, responsesStreamToAnthropicSSE, } from './anthropic-responses-translate.js';
+import { resolveClaudeServable } from './claude-model.js';
+import { BAKED_BASE_MODELS } from './model-catalog.js';
 export const CODEX_BACKEND_BASE_URL = process.env.DARIO_CODEX_BASE_URL || 'https://chatgpt.com/backend-api/codex';
 /** Originator string the codex CLI identifies itself with. */
 const CODEX_ORIGINATOR = 'codex_cli_rs';
@@ -59,12 +61,12 @@ export async function fetchCodexModels(creds, fetchImpl = fetch) {
     }
     return slugs;
 }
-/**
- * Cached {@link fetchCodexModels}, keyed by account alias. Never throws — an
- * unreachable backend yields the last known set, or an empty one, which means
- * "route nothing here by name". An explicit `codex:`/`chatgpt:` prefix still
- * routes, so discovery being down never makes the engine unusable.
- */
+/** The cached slug list for an alias WITHOUT fetching. For the admin surface:
+ *  a status read must never cost an upstream call or a token refresh. */
+export function peekCodexModelSlugs(alias) {
+    const hit = modelCache.get(alias);
+    return hit ? hit.slugs : null;
+}
 export async function getCodexModelSlugs(creds, fetchImpl = fetch) {
     const hit = modelCache.get(creds.alias);
     if (hit && Date.now() - hit.fetchedAt < hit.ttlMs)
@@ -109,21 +111,36 @@ export function isCodexModel(model, slugs) {
 export function pickCodexFallback(models, slugs) {
     return models.find(m => isCodexModel(m, slugs)) ?? null;
 }
-export function pickClaudeFallback(models, slugs) {
+export function pickClaudeFallback(models, slugs, bases = BAKED_BASE_MODELS, resolve) {
     // "Not a codex slug" is NOT the same as "the Claude pool can serve it". A
     // typo, a retired model, or an entry meant for some third provider would all
     // pass that test, and the request would be swapped to a model Anthropic 404s
     // on — trading a recoverable 429 for an unrecoverable 404, which is strictly
     // worse than not failing over at all.
     //
-    // So require it to look like an Anthropic model. Every model the pool serves
-    // is `claude-*`; anything else means the chain has no Claude entry and the
-    // codex error surfaces honestly. Failing CLOSED is the right direction here.
+    // v6.0.0 shipped this as `/^claude/i`, which was the right DIRECTION (fail
+    // closed) and the wrong TEST. It rejected `anthropic:opus`, where the operator
+    // named the provider explicitly, and every catalog shorthand (`opus`,
+    // `sonnet1m`) — so a legitimate chain entry silently never failed over, which
+    // is the same class of quiet wrongness it was written to prevent. It also did
+    // nothing about the case where discovery degrades and `slugs` arrives EMPTY,
+    // at which point elimination calls every entry Claude-servable.
     //
-    // Known limitation: a `--model-alias` that resolves to a Claude model is not
-    // accepted, because aliases resolve later in the request path than this. Name
-    // the real model id in the chain.
-    return models.find(m => !isCodexModel(m, slugs) && /^claude/i.test(m)) ?? null;
+    // `isClaudeServableModel` is the positive capability test instead, resolved
+    // against the live catalog, so aliases work and the limitation the old comment
+    // documented as accepted is simply gone.
+    //
+    // Returns the RESOLVED canonical id, not the entry as written: the caller
+    // swaps it into the body after the proxy's own alias pass has already run,
+    // so an alias returned raw would reach Anthropic unresolved and 400.
+    for (const m of models) {
+        if (isCodexModel(m, slugs))
+            continue;
+        const resolved = resolveClaudeServable(m, bases, resolve);
+        if (resolved)
+            return resolved;
+    }
+    return null;
 }
 /**
  * Pull `chatgpt_account_id` out of the id_token's `https://api.openai.com/auth`
@@ -386,6 +403,12 @@ export function createResponsesTranslator(model) {
         didFail() {
             return failed;
         },
+        /** Token usage from the terminal event, or null if none arrived. Read by
+         *  the proxy to record the request in analytics — before this, codex
+         *  requests were invisible to /analytics and the request log entirely. */
+        usage() {
+            return usage;
+        },
         /** Everything seen so far, as one non-streaming chat.completion body. */
         complete() {
             const calls = [...toolCalls.values()].sort((a, b) => a.index - b.index);
@@ -481,9 +504,23 @@ export function buildCodexHeaders(creds) {
  * testable without network (test/codex-backend.mjs), matching the pattern
  * test/codex-oauth.mjs already uses.
  */
-export async function forwardToCodex(req, res, body, creds, corsOrigin, securityHeaders, upstreamTimeoutMs, verbose, shape = 'openai', fetchImpl = fetch, deferOnUnavailable = false) {
+export async function forwardToCodex(req, res, body, creds, corsOrigin, securityHeaders, upstreamTimeoutMs, verbose, shape = 'openai', fetchImpl = fetch, deferOnUnavailable = false, onDone) {
     void req;
     const isAnthropic = shape === 'anthropic';
+    // Reported exactly once, on every exit that answered the client. Without
+    // this the proxy had no idea a codex request happened: no analytics row, no
+    // log line, no per-account count.
+    const startedAt = Date.now();
+    let reported = false;
+    const report = (status, usage, stream, model) => {
+        if (reported || !onDone)
+            return;
+        reported = true;
+        try {
+            onDone({ status, latencyMs: Date.now() - startedAt, inputTokens: usage?.input ?? 0, outputTokens: usage?.output ?? 0, stream, model, alias: creds.alias });
+        }
+        catch { /* a reporting failure must never break a served request */ }
+    };
     // An Anthropic-shape error body is {type,error{type,message}}; an OpenAI one
     // is {error}. A client SDK reads its own shape, so errors follow the request.
     const errBody = (message, extra = {}) => JSON.stringify(isAnthropic
@@ -496,6 +533,7 @@ export async function forwardToCodex(req, res, body, creds, corsOrigin, security
     catch {
         res.writeHead(400, { 'Content-Type': 'application/json', ...securityHeaders });
         res.end(errBody(`Codex backend requires a JSON ${isAnthropic ? 'messages' : 'chat/completions'} body`));
+        report(400, null, false, '');
         return true;
     }
     const clientWantsStream = parsed.stream === true;
@@ -532,6 +570,7 @@ export async function forwardToCodex(req, res, body, creds, corsOrigin, security
             }
             res.writeHead(upstream.status, { 'Content-Type': 'application/json', ...securityHeaders });
             res.end(errBody('Upstream Codex backend error', { status: upstream.status, account: creds.alias }));
+            report(upstream.status, null, clientWantsStream, model);
             return true;
         }
         // OpenAI shape: one stateful line-in/line-out translator (unchanged).
@@ -625,6 +664,7 @@ export async function forwardToCodex(req, res, body, creds, corsOrigin, security
                 console.error(`[dario] codex backend (${creds.alias}) response failed: ${detail}`);
             res.writeHead(502, { 'Content-Type': 'application/json', ...securityHeaders });
             res.end(errBody(`Codex backend response failed: ${detail}`, { account: creds.alias }));
+            report(502, null, clientWantsStream, model);
             return true;
         }
         if (isAnthropic) {
@@ -654,6 +694,16 @@ export async function forwardToCodex(req, res, body, creds, corsOrigin, security
             });
             res.end(JSON.stringify(translator.complete()));
         }
+        // Token usage rides the terminal Responses event on either shape. A stream
+        // that failed upstream still ended as 200 on the wire (the client saw the
+        // failure event); analytics must count it as the 502 it was.
+        {
+            const tr = terminalResponse;
+            const usage = isAnthropic
+                ? (tr?.usage ? { input: Number(tr.usage.input_tokens ?? 0), output: Number(tr.usage.output_tokens ?? 0) } : null)
+                : (() => { const u = translator.usage(); return u ? { input: u.prompt_tokens, output: u.completion_tokens } : null; })();
+            report(upstreamFailed ? 502 : 200, usage, clientWantsStream, model);
+        }
         return true;
     }
     catch (err) {
@@ -685,6 +735,7 @@ export async function forwardToCodex(req, res, body, creds, corsOrigin, security
             }
             catch { /* already closed */ }
         }
+        report(502, null, clientWantsStream, model);
         return true;
     }
     finally {

package/dist/proxy.js

@@ -13,16 +13,16 @@ import { buildCCRequest, applyCcPromptCaching, isGenuineCCClient, parseEffortSuf
 import { stampCch, hasCchSeed } from './cch.js';
 import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion } from './live-fingerprint.js';
 import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reconcilePoolAccounts, resolvePoolStrategy, utilFreshness } from './pool.js';
-import { Analytics, billingBucketFromClaim, formatUsageLogLine, SUBSCRIPTION_CLAIMS } from './analytics.js';
+import { Analytics, billingBucketFromClaim, formatUsageLogLine, SUBSCRIPTION_CLAIMS, CODEX_CLAIM } from './analytics.js';
 import { OverageGuard, buildHaltErrorBody } from './overage-guard.js';
 import { notify as osNotify } from './notify.js';
 import { loadAllAccounts, loadAccount, saveAccount, refreshAccountToken, resyncLoginFromCredentialsIfStale, ensureLoginCredentialsInPool, mirrorLoginToCredentials } from './accounts.js';
 import { handleAdminRequest } from './admin-api.js';
 import { createTokenBucket } from './rate-limit.js';
 import { getOpenAIBackend, isOpenAIModel, forwardToOpenAI } from './openai-backend.js';
-import { forwardToCodex, getCodexModelSlugs, pickCodexFallback, pickClaudeFallback, CODEX_BACKEND_BASE_URL } from './codex-backend.js';
+import { forwardToCodex, getCodexModelSlugs, peekCodexModelSlugs, pickCodexFallback, pickClaudeFallback, CODEX_BACKEND_BASE_URL } from './codex-backend.js';
 import { readCompareTarget, teeResponse, runCompare, writeCompareRecord, COMPARE_RESULT_HEADER } from './compare.js';
-import { listCodexAccountAliases, hasAnyCodexAccount, selectCodexAccount, getFreshCodexAccount } from './codex-accounts.js';
+import { listCodexAccountAliases, loadAllCodexAccounts, codexAccountNeedsRefresh, hasAnyCodexAccount, selectCodexAccount, getFreshCodexAccount } from './codex-accounts.js';
 import { route as routeProvider } from './provider-adapter.js';
 import { RequestQueue, QueueFullError, QueueTimeoutError, DEFAULT_MAX_CONCURRENT, DEFAULT_MAX_QUEUED, DEFAULT_QUEUE_TIMEOUT_MS } from './request-queue.js';
 import { redactSecrets } from './redact.js';
@@ -1324,6 +1324,9 @@ export async function startProxy(opts = {}) {
     // : null` — that gated the /analytics endpoint, but burn-rate /
     // per-request visibility is useful for a pool of one too.
     const analytics = new Analytics();
+    // Per-alias request counts for GET /codex — the pool has requestCount per
+    // account; the codex accounts had nothing until now.
+    const codexRequestCounts = new Map();
     // Overage-guard (v4.1, dario#288). Resolved from opts with built-in
     // defaults (enabled=true, behavior='halt', cooldown=30min, notifyOs=true)
     // so an opts-less proxy still gets protection. The notifier is wired
@@ -2105,6 +2108,29 @@ export async function startProxy(opts = {}) {
         }
         // Analytics endpoint — rolling-window summary + burn-rate snapshot.
         // Always-on as of v4 (pre-v4 this was gated to pool mode).
+        // The codex engine, for the admin surface. Key-gated like /accounts. Reads
+        // only what is already on disk and in the model cache: no upstream call,
+        // no token refresh, and no token in the answer — a status read must never
+        // spend or expose a credential.
+        if (urlPath === '/codex' && req.method === 'GET') {
+            const now = Date.now();
+            const stored = await loadAllCodexAccounts();
+            const accounts = stored.map((a) => ({
+                alias: a.alias,
+                expiresAt: a.expiresAt,
+                expiresInMs: Math.max(0, a.expiresAt - now),
+                needsRefresh: codexAccountNeedsRefresh(a),
+                models: peekCodexModelSlugs(a.alias) ?? [],
+                requestCount: codexRequestCounts.get(a.alias) ?? 0,
+            }));
+            res.writeHead(200, JSON_HEADERS);
+            res.end(JSON.stringify({
+                backend: CODEX_BACKEND_BASE_URL,
+                requests: [...codexRequestCounts.values()].reduce((n, c) => n + c, 0),
+                accounts,
+            }));
+            return;
+        }
         if (urlPath === '/analytics' && req.method === 'GET') {
             res.writeHead(200, JSON_HEADERS);
             // `queue` rides along the summary (dario#905): request-queue.ts always
@@ -2680,9 +2706,42 @@ export async function startProxy(opts = {}) {
                         // and pick the request back up on the Claude path below. Before
                         // this, a rate-limited ChatGPT plan was terminal for a gpt-bound
                         // request even with an idle Claude pool sitting right beside it.
-                        const claudeTarget = pickClaudeFallback(poolFallbackModels, codexModels);
+                        // Resolve chain entries exactly as a request model is resolved —
+                        // operator --model-alias first, then pinned + catalog aliases — so
+                        // `backup` or `opus48` in the chain works the way it does on a
+                        // request, and the classifier validates the id that would actually
+                        // be forwarded.
+                        const claudeTarget = pickClaudeFallback(poolFallbackModels, codexModels, getCachedBases(), (m) => resolveClaudeAlias(applyModelAlias(m, modelAliases) ?? m));
                         const canDefer = claudeTarget !== null && pool.size > 0 && !upstreamApiKey;
-                        const served = await forwardToCodex(req, res, body, codexCreds, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, isOpenAI ? 'openai' : 'anthropic', fetch, canDefer);
+                        const codexReq = requestCount;
+                        const served = await forwardToCodex(req, res, body, codexCreds, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, isOpenAI ? 'openai' : 'anthropic', fetch, canDefer, 
+                        // Before this hook a codex request left no trace: nothing in
+                        // /analytics, nothing in the request log, no per-account count.
+                        // The dock (and anyone reading /analytics) saw a proxy that
+                        // served GPT all day and reported zero of it. A decline (the
+                        // request handed to the Claude pool) reports nothing here; the
+                        // Claude path records what it then serves.
+                        (o) => {
+                            codexRequestCounts.set(o.alias, (codexRequestCounts.get(o.alias) ?? 0) + 1);
+                            analytics.record({
+                                timestamp: Date.now(),
+                                account: o.alias,
+                                model: o.model || rawModel || 'codex',
+                                inputTokens: o.inputTokens, outputTokens: o.outputTokens,
+                                cacheReadTokens: 0, cacheCreateTokens: 0, thinkingTokens: 0,
+                                // No Anthropic rate-limit headers on this path; the claim
+                                // names the engine and is subscription billing, so the
+                                // overage guard (#288) leaves it alone.
+                                claim: CODEX_CLAIM, util5h: 0, util7d: 0, overageUtil: 0,
+                                latencyMs: o.latencyMs, status: o.status, isStream: o.stream, isOpenAI,
+                            });
+                            writeLogLine(logFileStream, {
+                                ts: new Date().toISOString(), req: codexReq,
+                                method: req.method ?? '', path: urlPath, model: o.model || rawModel || undefined,
+                                status: o.status, latency_ms: o.latencyMs, in_tokens: o.inputTokens, out_tokens: o.outputTokens,
+                                claim: CODEX_CLAIM, bucket: 'subscription', account: o.alias, stream: o.stream,
+                            });
+                        });
                         if (served)
                             return;
                         const swapped = buildPoolFallbackBody(body, claudeTarget);

package/docs/multi-account-pool.md

@@ -59,7 +59,7 @@ Neither subscription hitting its ceiling can take the deployment down on its own
 Deliberate limits:
 
 - **Only a 429 or 5xx fails over.** A 400 surfaces to the client. A bad request that fails over just reproduces itself on the other provider and buries the real cause.
-- **The Claude entry must be a real `claude-*` id.** "Not a codex slug" would also match a typo or a model meant for a third provider, and swapping that in trades a recoverable 429 for an unrecoverable 404. Anything that doesn't look like an Anthropic model is ignored — failing closed. A `--model-alias` is not accepted here; name the real id.
+- **The Claude entry is validated positively, against the live catalog.** "Not a codex slug" would also match a typo, or a model meant for a third provider, and swapping that in trades a recoverable 429 for an unrecoverable 404. Worse, when model discovery degrades the codex slug list arrives EMPTY, at which point elimination would call *every* entry Claude-servable. So each entry is tested for what it is rather than what it isn't: canonical ids, `[1m]` variants, catalog shorthands (`opus`, `sonnet1m`) and explicit `claude:` / `anthropic:` prefixes all qualify; anything else is skipped and the real error surfaces.
 - **The api-key backend is still OpenAI-shape only.** There is no Messages translation on that route. A Codex account has one, which is why it is preferred.
 - **Never silent.** Every substituted response carries `x-dario-pool-fallback: <model>`. A quietly swapped model is exactly the surprise this project exists to avoid.
 - **Empty pool still errors.** A pool with zero accounts is a setup mistake (`dario login` never ran); that returns the usual 503 rather than silently re-billing every request to another provider.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.0.0",
+  "version": "6.0.2",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {