@askalf/dario 6.0.32 → 6.0.34

package/dist/proxy.js

@@ -12,13 +12,14 @@ import { darioVersion } from './version.js';
 import { buildCCRequest, applyCcPromptCaching, isGenuineCCClient, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, forwardClientCCIdentityHeaders, isMcpToolName, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
 import { stampCch, hasCchSeed } from './cch.js';
 import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion } from './live-fingerprint.js';
-import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, reconcilePoolAccounts, resolvePoolStrategy, utilFreshness } from './pool.js';
-import { Analytics, billingBucketFromClaim, formatUsageLogLine, SUBSCRIPTION_CLAIMS, CODEX_CLAIM } from './analytics.js';
+import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, reconcilePoolAccounts, resolvePoolStrategy, utilFreshness, rateLimitWindow, describeRateLimitSnapshot, windowPeers, distinctWindows } from './pool.js';
+import { PoolSync, DEFAULT_POOL_SYNC_INTERVAL_MS } from './pool-sync.js';
+import { Analytics, billingBucketFromClaim, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, CODEX_CLAIM } from './analytics.js';
 import { OverageGuard, buildHaltErrorBody } from './overage-guard.js';
 import { notify as osNotify } from './notify.js';
 import { grantAge, grantThresholds, worstGrantLevel, describeGrantAge } from './refresh-grant.js';
 import { resolveSeatPin, SEAT_PIN_HEADER, SEAT_PIN_TOKEN_HEADER } from './seat-pin.js';
-import { loadAllAccounts, loadAccount, saveAccount, refreshAccountToken, resyncLoginFromCredentialsIfStale, ensureLoginCredentialsInPool, mirrorLoginToCredentials } from './accounts.js';
+import { loadAllAccounts, loadAccount, saveAccount, refreshAccountToken, resyncLoginFromCredentialsIfStale, ensureLoginCredentialsInPool, mirrorLoginToCredentials, withObservedOrganization } from './accounts.js';
 import { handleAdminRequest } from './admin-api.js';
 import { createTokenBucket } from './rate-limit.js';
 import { getOpenAIBackend, isOpenAIModel, forwardToOpenAI } from './openai-backend.js';
@@ -1328,9 +1329,45 @@ export async function startProxy(opts = {}) {
     const accountsList = await loadAllAccounts();
     const poolStrategy = resolvePoolStrategy(opts.poolStrategy);
     const pool = new AccountPool(poolStrategy);
+    // Two aliases reporting one window are one subscription counted twice
+    // (dario#1244). Said once per pair, when the second reading arrives; the
+    // listings carry it permanently as `sharesWindowWith`.
+    const announcedWindowPairs = new Set();
+    const announceWindowPeers = (alias) => {
+        const now = Date.now();
+        const seat = pool.get(alias);
+        if (!seat)
+            return;
+        for (const peer of windowPeers(pool.all(), now).get(alias) ?? []) {
+            const pair = [alias, peer].sort().join('|');
+            if (announcedWindowPairs.has(pair))
+                continue;
+            announcedWindowPairs.add(pair);
+            const windows = distinctWindows(pool.all(), now);
+            console.error(`[dario] seats "${alias}" and "${peer}" report the same ${seat.rateLimit.claim} window (resets ${new Date(seat.rateLimit.reset * 1000).toISOString()}) — one subscription under two aliases; the pool has ${windows} distinct window${windows === 1 ? '' : 's'} across ${pool.size} seats`);
+        }
+    };
+    // Shared pool state across instances (docs/multi-instance.md): opt-in,
+    // rides the refresh-lock service, fails open. Off → byte-identical to before.
+    const lockUrl = process.env['DARIO_REFRESH_LOCK_URL'];
+    const poolSync = opts.poolSharedState && lockUrl
+        ? new PoolSync(pool, {
+            baseUrl: lockUrl,
+            token: process.env['DARIO_REFRESH_LOCK_TOKEN'] ?? '',
+            intervalMs: opts.poolSharedStateIntervalMs ?? DEFAULT_POOL_SYNC_INTERVAL_MS,
+            log: (line) => console.error(line),
+        })
+        : null;
+    if (opts.poolSharedState && !poolSync) {
+        console.error('[dario] --pool-shared-state needs DARIO_REFRESH_LOCK_URL (the lock service carries the shared state) — running with this instance\'s own state');
+    }
     if (poolStrategy !== 'headroom') {
         console.log(`  Pool strategy: ${poolStrategy} (new conversations fill the alphabetically-first seat, spill at the 2% floor)`);
     }
+    if (poolSync) {
+        console.log(`  Pool shared state: on (instance ${poolSync.instance}, via ${lockUrl}, pulling peers every ${poolSync.intervalMs}ms; fails open)`);
+        poolSync.start();
+    }
     // Per-model rate-limit bucket families seen during this proxy run. First-
     // sight is logged once when verbose so a new Anthropic bucket (e.g. an
     // eventual `7d_opus`) doesn't slip past unnoticed. Pure observability —
@@ -1398,6 +1435,7 @@ export async function startProxy(opts = {}) {
                 deviceId: acc.deviceId,
                 accountUuid: acc.accountUuid,
                 grantedAt: acc.grantedAt,
+                organizationId: acc.organizationId,
             });
         }
         // Startup self-heal (dario#790): eagerly refresh any account whose access
@@ -1418,7 +1456,9 @@ export async function startProxy(opts = {}) {
                     const saved = await loadAccount(acc.alias);
                     if (!saved)
                         return;
-                    const refreshed = await refreshAccountToken(saved);
+                    // The refresh's write carries the organization the seat was
+                    // observed on (dario#1244) — the one write that touches the record.
+                    const refreshed = await refreshAccountToken(withObservedOrganization(saved, acc.organizationId));
                     pool.updateTokens(acc.alias, refreshed.accessToken, refreshed.refreshToken, refreshed.expiresAt);
                     // Mirror a refreshed `login` token back to credentials.json so the
                     // legacy file (and `dario doctor`) tracks the pool store (#808).
@@ -1470,7 +1510,9 @@ export async function startProxy(opts = {}) {
                     const saved = await loadAccount(acc.alias);
                     if (!saved)
                         continue;
-                    const refreshed = await refreshAccountToken(saved);
+                    // The refresh's write carries the organization the seat was
+                    // observed on (dario#1244) — the one write that touches the record.
+                    const refreshed = await refreshAccountToken(withObservedOrganization(saved, acc.organizationId));
                     pool.updateTokens(acc.alias, refreshed.accessToken, refreshed.refreshToken, refreshed.expiresAt);
                     // Mirror a refreshed `login` token back to credentials.json so the
                     // legacy file (and `dario doctor`) tracks the pool store (#808).
@@ -1515,6 +1557,7 @@ export async function startProxy(opts = {}) {
                     deviceId: acc.deviceId,
                     accountUuid: acc.accountUuid,
                     grantedAt: acc.grantedAt,
+                    organizationId: acc.organizationId,
                 });
             }
         }
@@ -1616,6 +1659,7 @@ export async function startProxy(opts = {}) {
         maxConcurrent: opts.maxConcurrent ?? DEFAULT_MAX_CONCURRENT,
         maxQueued: opts.maxQueued ?? DEFAULT_MAX_QUEUED,
         queueTimeoutMs: opts.queueTimeoutMs ?? DEFAULT_QUEUE_TIMEOUT_MS,
+        maxConcurrentPerConsumer: opts.maxConcurrentPerConsumer ?? 0,
     });
     const upstreamTimeoutMs = opts.upstreamTimeoutMs ?? UPSTREAM_TIMEOUT_MS;
     // Cache context-1m beta availability. Set false once per account after the
@@ -2093,6 +2137,7 @@ export async function startProxy(opts = {}) {
                 // just persisted metadata — the same snapshot GET /accounts exposes.
                 poolStatus: () => {
                     const snapNow = Date.now();
+                    const peers = windowPeers(pool.all(), snapNow);
                     const snap = new Map();
                     for (const a of pool.all()) {
                         snap.set(a.alias, {
@@ -2102,9 +2147,15 @@ export async function startProxy(opts = {}) {
                             // surface documents itself as reporting the same snapshot, so it
                             // must not be the one place a stale reading still looks current.
                             ...utilFreshness(a.rateLimit, snapNow),
+                            ...rateLimitWindow(a.rateLimit, snapNow),
                             claim: a.rateLimit.claim,
                             status: reportedAccountStatus(a, snapNow),
                             requestCount: a.requestCount,
+                            rejectedCount: a.rejectedCount,
+                            lastRejectedAt: a.lastRejectedAt ?? null,
+                            organizationId: a.organizationId ?? null,
+                            sharesWindowWith: peers.get(a.alias) ?? [],
+                            readingFrom: a.adoptedFrom ?? null,
                             // Raw streak, not just the cooldown boolean: a single 401 also
                             // shows `auth-cooldown` for 60s, indistinguishable from a
                             // genuinely dead refresh token by that field alone. The magnitude
@@ -2176,6 +2227,7 @@ export async function startProxy(opts = {}) {
         // the `dario accounts` CLI, not HTTP.
         if (urlPath === '/accounts' && req.method === 'GET') {
             const now = Date.now();
+            const peers = windowPeers(pool.all(), now);
             const accounts = pool.all().map(a => {
                 const inCooldown = isInAuthCooldown(a, now);
                 const cooldownMs = inCooldown && a.lastAuthFailureAt
@@ -2201,9 +2253,24 @@ export async function startProxy(opts = {}) {
                     util5h: a.rateLimit.util5h,
                     util7d: a.rateLimit.util7d,
                     ...utilFreshness(a.rateLimit, now),
+                    // When that window rolls (dario#1244): for a rejected seat, when
+                    // the rejection lifts. Milliseconds, like expiresInMs.
+                    ...rateLimitWindow(a.rateLimit, now),
                     claim: a.rateLimit.claim,
                     status: reportedAccountStatus(a, now),
                     requestCount: a.requestCount,
+                    // 429s answered — the attempts requestCount does not count, so a
+                    // parked seat no longer reads as one that was never called.
+                    rejectedCount: a.rejectedCount,
+                    lastRejectedAt: a.lastRejectedAt ?? null,
+                    // Which organization the token belongs to, and which other seats
+                    // report the same live window — one subscription under several
+                    // aliases (dario#1244).
+                    organizationId: a.organizationId ?? null,
+                    sharesWindowWith: peers.get(a.alias) ?? [],
+                    // Whose reading this is: a peer instance's id (shared pool state)
+                    // or null for this instance's own.
+                    readingFrom: a.adoptedFrom ?? null,
                     expiresInMs: Math.max(0, a.expiresAt - now),
                     // Refresh-token grant age (refresh-grant.ts): the wall a token
                     // refresh cannot move. null fields = grant date unknown.
@@ -2226,6 +2293,11 @@ export async function startProxy(opts = {}) {
                 mode: 'pool',
                 ...pool.status(),
                 stickyBindings: pool.stickyCount(),
+                // Windows the pool really has: each measured window once, each
+                // unmeasured seat as its own.
+                distinctWindows: distinctWindows(pool.all(), now),
+                // Shared pool state (pool-sync.ts) — null when off.
+                sharedState: poolSync ? poolSync.status() : null,
                 accounts,
             }));
             return;
@@ -2452,12 +2524,19 @@ export async function startProxy(opts = {}) {
             res.end(JSON.stringify(buildHaltErrorBody(state)));
             return;
         }
+        // Who this request is for (dario#1244 follow-up). An `x-dario-consumer`
+        // header names the consumer for both the per-consumer concurrency cap and
+        // attribution. Without one, attribution falls back to a hash of the
+        // body's user id once the body is parsed; the cap needs the name before
+        // the slot is taken, so only the header gates.
+        const consumerFromHeaders = consumerFromHeader(req.headers[CONSUMER_HEADER]);
+        let consumer = consumerFromHeaders;
         // Proxy to Anthropic (with concurrency control). The bounded queue
         // replaces the v3.30.x-and-earlier unbounded semaphore — dario#80. A
         // queue-full condition returns an explicit 429 with a `"queue-full"`
         // marker in the body; a queue-timeout returns 504 with `"queue-timeout"`.
         try {
-            await queue.acquire();
+            await queue.acquire(consumerFromHeaders);
         }
         catch (err) {
             if (err instanceof QueueFullError) {
@@ -2747,8 +2826,11 @@ export async function startProxy(opts = {}) {
                         const v = JSON.parse(text);
                         if (v === null || typeof v !== 'object' || Array.isArray(v))
                             invalid = 'request body must be a JSON object';
-                        else
+                        else {
                             parsedBody = v;
+                            if (!consumer)
+                                consumer = consumerFromBody(parsedBody);
+                        }
                     }
                     catch (err) {
                         invalid = `request body is not valid JSON: ${err instanceof Error ? err.message : String(err)}`;
@@ -3045,6 +3127,7 @@ export async function startProxy(opts = {}) {
                             codexRequestCounts.set(o.alias, (codexRequestCounts.get(o.alias) ?? 0) + 1);
                             analytics.record({
                                 timestamp: Date.now(),
+                                consumer,
                                 account: o.alias,
                                 model: o.model || rawModel || 'codex',
                                 inputTokens: o.inputTokens, outputTokens: o.outputTokens,
@@ -3062,13 +3145,13 @@ export async function startProxy(opts = {}) {
                                 method: req.method ?? '', path: urlPath, model: o.model || rawModel || undefined,
                                 status: o.status, latency_ms: o.latencyMs, in_tokens: o.inputTokens, out_tokens: o.outputTokens,
                                 cache_read: o.cacheReadTokens, cache_create: o.cacheCreateTokens,
-                                claim: CODEX_CLAIM, bucket: 'subscription', account: o.alias, stream: o.stream,
+                                claim: CODEX_CLAIM, bucket: 'subscription', account: o.alias, consumer, stream: o.stream,
                             });
                             if (verbose)
                                 console.log(formatUsageLogLine(codexReq, {
                                     inputTokens: o.inputTokens, outputTokens: o.outputTokens,
                                     cacheReadTokens: o.cacheReadTokens, cacheCreateTokens: o.cacheCreateTokens,
-                                }));
+                                }, consumer));
                         }, 
                         // Cool codex on a rate limit only — a 5xx or an unreachable backend
                         // is an outage, and parking a provider for that would keep it out
@@ -3322,7 +3405,20 @@ export async function startProxy(opts = {}) {
                         // Rotating off mid-session costs cache-create on every turn.
                         stickyKey = computeStickyKey(userMsg);
                         if (stickyKey && !pinnedAccount) {
+                            // Shared state (pool-sync.ts): a conversation a peer instance
+                            // already bound lands on the same seat here, so its prompt
+                            // cache is read rather than rewritten. Only consulted when this
+                            // instance holds no binding of its own; a binding made here is
+                            // published for the peers.
+                            const hadLocalBinding = pool.stickyAliasFor(stickyKey) !== null;
+                            if (poolSync && !hadLocalBinding) {
+                                const peerAlias = await poolSync.lookupSticky(stickyKey);
+                                if (peerAlias)
+                                    pool.rebindSticky(stickyKey, peerAlias);
+                            }
                             const preferred = pool.selectSticky(stickyKey, modelFamily(requestModel));
+                            if (poolSync && preferred && !hadLocalBinding)
+                                poolSync.bindSticky(stickyKey, preferred.alias);
                             if (preferred && preferred.alias !== poolAccount?.alias) {
                                 poolAccount = preferred;
                                 accessToken = preferred.accessToken;
@@ -3723,11 +3819,27 @@ export async function startProxy(opts = {}) {
                 if (poolAccount) {
                     const snapshot = parseRateLimits(upstream.headers);
                     if (upstream.status === 429) {
-                        pool.markRejected(poolAccount.alias, snapshot);
+                        // Say so the moment a seat leaves rotation. With a peer to fail
+                        // over to the client sees 200, and nothing else named the seat,
+                        // the reading, or when it comes back (dario#1244). Once per
+                        // parking: the all-exhausted fallback re-probes parked seats, and
+                        // those repeats are verbose-only.
+                        const parked = pool.markRejected(poolAccount.alias, snapshot);
+                        if (parked || verbose) {
+                            console.error(`[dario] #${requestCount} rate limited (429) on account "${poolAccount.alias}": ${describeRateLimitSnapshot(snapshot)} — parked until the window rolls`);
+                        }
                     }
                     else {
                         pool.updateRateLimits(poolAccount.alias, snapshot);
                     }
+                    // Which organization answered (dario#1244). Held in the pool at
+                    // once; written to the seat's record by its next token refresh —
+                    // the write that already exists — so nothing here races a refresh.
+                    const organizationId = upstream.headers.get('anthropic-organization-id');
+                    if (organizationId)
+                        pool.noteOrganization(poolAccount.alias, organizationId);
+                    announceWindowPeers(poolAccount.alias);
+                    poolSync?.reportSeat(poolAccount.alias);
                     // First-sight detector for per-model rate-limit buckets. Anthropic
                     // ships these unannounced — e.g. `7d_sonnet-utilization` appeared
                     // around 2026-04-25 — and verbose-mode users want a heads-up the
@@ -4003,6 +4115,7 @@ export async function startProxy(opts = {}) {
                                 headers['Authorization'] = `Bearer ${accessToken}`;
                                 headers['x-claude-code-session-id'] = resolveOutboundSession(nextAccount, clientSessionKey).sessionId;
                                 pool.rebindSticky(stickyKey, nextAccount.alias);
+                                poolSync?.bindSticky(stickyKey, nextAccount.alias);
                                 peekedBody = null;
                                 continue dispatchLoop;
                             }
@@ -4050,6 +4163,7 @@ export async function startProxy(opts = {}) {
                             const rl = poolAccount?.rateLimit ?? parseRateLimits(upstream.headers);
                             analytics.record({
                                 timestamp: Date.now(),
+                                consumer,
                                 account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
                                 model: requestModel,
                                 inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0, thinkingTokens: 0,
@@ -4103,6 +4217,7 @@ export async function startProxy(opts = {}) {
                         headers['Authorization'] = `Bearer ${accessToken}`;
                         headers['x-claude-code-session-id'] = resolveOutboundSession(nextAccount, clientSessionKey).sessionId;
                         pool.rebindSticky(stickyKey, nextAccount.alias);
+                        poolSync?.bindSticky(stickyKey, nextAccount.alias);
                         continue dispatchLoop;
                     }
                     // No peer available — forward the saved generic-403 bytes when the
@@ -4136,6 +4251,7 @@ export async function startProxy(opts = {}) {
                             headers['Authorization'] = `Bearer ${accessToken}`;
                             headers['x-claude-code-session-id'] = resolveOutboundSession(nextAccount, clientSessionKey).sessionId;
                             pool.rebindSticky(stickyKey, nextAccount.alias);
+                            poolSync?.bindSticky(stickyKey, nextAccount.alias);
                             continue dispatchLoop;
                         }
                     }
@@ -4171,6 +4287,7 @@ export async function startProxy(opts = {}) {
                         const rl = poolAccount?.rateLimit ?? parseRateLimits(upstream.headers);
                         analytics.record({
                             timestamp: Date.now(),
+                            consumer,
                             account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
                             model: requestModel,
                             inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0, thinkingTokens: 0,
@@ -4428,6 +4545,7 @@ export async function startProxy(opts = {}) {
                     const rl = poolAccount?.rateLimit ?? parseRateLimits(upstream.headers);
                     analytics.record({
                         timestamp: Date.now(),
+                        consumer,
                         account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
                         model: requestModel,
                         inputTokens: streamInputTokens, outputTokens: streamOutputTokens,
@@ -4447,6 +4565,7 @@ export async function startProxy(opts = {}) {
                     claim: poolAccount?.rateLimit.claim,
                     bucket: poolAccount ? billingBucketFromClaim(poolAccount.rateLimit.claim) : undefined,
                     account: poolAccount?.alias,
+                    consumer,
                     client: detectedClientForLog,
                     preserve_tools: preserveToolsEffective,
                     stream: true,
@@ -4455,7 +4574,7 @@ export async function startProxy(opts = {}) {
                     console.log(formatUsageLogLine(requestCount, {
                         inputTokens: streamInputTokens, outputTokens: streamOutputTokens,
                         cacheReadTokens: streamCacheReadTokens, cacheCreateTokens: streamCacheCreateTokens,
-                    }));
+                    }, consumer));
             }
             else {
                 // Buffer and forward
@@ -4494,6 +4613,7 @@ export async function startProxy(opts = {}) {
                         const rl = poolAccount?.rateLimit ?? parseRateLimits(upstream.headers);
                         analytics.record({
                             timestamp: Date.now(),
+                            consumer,
                             account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
                             model: bufferedUsage.model || requestModel,
                             inputTokens: bufferedUsage.inputTokens, outputTokens: bufferedUsage.outputTokens,
@@ -4515,12 +4635,13 @@ export async function startProxy(opts = {}) {
                     claim: poolAccount?.rateLimit.claim,
                     bucket: poolAccount ? billingBucketFromClaim(poolAccount.rateLimit.claim) : undefined,
                     account: poolAccount?.alias,
+                    consumer,
                     client: detectedClientForLog,
                     preserve_tools: preserveToolsEffective,
                     stream: false,
                 });
                 if (verbose && bufferedUsage)
-                    console.log(formatUsageLogLine(requestCount, bufferedUsage));
+                    console.log(formatUsageLogLine(requestCount, bufferedUsage, consumer));
                 if (verbose)
                     console.log(`[dario] #${requestCount} ${upstream.status}`);
             }
@@ -4532,6 +4653,7 @@ export async function startProxy(opts = {}) {
                 ts: new Date().toISOString(), req: requestCount,
                 method: req.method ?? '', path: urlPath,
                 model: requestModel || undefined,
+                consumer,
                 client: detectedClientForLog,
                 preserve_tools: preserveToolsEffective,
             };
@@ -4572,7 +4694,7 @@ export async function startProxy(opts = {}) {
                 clearTimeout(upstreamTimeout);
             if (onClientClose !== null)
                 req.off('close', onClientClose);
-            queue.release();
+            queue.release(consumerFromHeaders);
         }
     });
     server.on('error', async (err) => {
@@ -4801,6 +4923,7 @@ export async function startProxy(opts = {}) {
         console.log('\n[dario] Shutting down...');
         clearInterval(presenceInterval);
         clearInterval(refreshInterval);
+        poolSync?.stop();
         if (logFileStream)
             logFileStream.end();
         // Flush tokens first (best-effort, bounded), then close the server. The

package/dist/request-queue.d.ts

@@ -52,6 +52,10 @@ export interface QueueState {
  */
 export interface QueueSnapshot extends QueueState {
     stalledSince: number | null;
+    /** Per-consumer in-flight ceiling (`--max-concurrent-per-consumer`); 0 = off. */
+    maxConcurrentPerConsumer: number;
+    /** Distinct consumers with a request in flight right now. */
+    consumersActive: number;
 }
 export type AdmitDecision = {
     action: 'admit';
@@ -63,6 +67,14 @@ export type AdmitDecision = {
 };
 /** Pure admission decision — no side effects, no clock dep. */
 export declare function decideAdmit(state: QueueState): AdmitDecision;
+/**
+ * Pure per-consumer gate (dario#1244 follow-up — a team gateway where one
+ * heavy user could hold every slot). A consumer already holding `cap` slots
+ * waits even when the queue has room: `enqueue` if it does, `reject` if
+ * not. Returns null when the gate does not apply (cap off, or the consumer
+ * is under it), so `decideAdmit` decides as before.
+ */
+export declare function decideConsumerAdmit(activeForConsumer: number, cap: number, state: QueueState): AdmitDecision | null;
 /** Pure timeout check — separated so tests can pass an explicit clock. */
 export declare function isQueueEntryExpired(enqueuedAt: number, now: number, timeoutMs: number): boolean;
 export declare class QueueFullError extends Error {
@@ -75,6 +87,13 @@ export interface RequestQueueOptions {
     maxConcurrent?: number;
     maxQueued?: number;
     queueTimeoutMs?: number;
+    /**
+     * In-flight ceiling per consumer (see `acquire(consumer)`). 0 / unset =
+     * off. A consumer at its cap waits in the queue; its waiters never block
+     * another consumer's — `release` admits the first waiter whose consumer
+     * is under the cap, not the first waiter.
+     */
+    maxConcurrentPerConsumer?: number;
     /**
      * Whether timeout timers are `unref`'d so they don't by themselves keep
      * the Node event loop alive. Default `true` — appropriate for the proxy,
@@ -95,8 +114,10 @@ export declare class RequestQueue {
     readonly maxConcurrent: number;
     readonly maxQueued: number;
     readonly queueTimeoutMs: number;
+    readonly maxConcurrentPerConsumer: number;
     readonly unrefTimers: boolean;
     private active;
+    private activeByConsumer;
     private queue;
     private readonly now;
     private stalledSince;
@@ -111,15 +132,24 @@ export declare class RequestQueue {
      * `release()` refreshes it, by clearing first (see there).
      */
     private updateStall;
+    /** A consumer is under its cap when there is no cap, no consumer, or room. */
+    private underCap;
+    private admit;
     /**
      * Acquire a concurrency slot. Resolves when admitted; throws
      * `QueueFullError` when the queue is at its `maxQueued` cap, throws
      * `QueueTimeoutError` when a queued request waited longer than
-     * `queueTimeoutMs`.
+     * `queueTimeoutMs`. `consumer` names who the request is for: with a
+     * per-consumer cap set, a consumer at its cap waits even while slots are
+     * free, and `release(consumer)` must be called with the same name.
+     */
+    acquire(consumer?: string): Promise<void>;
+    /**
+     * Release a slot. The first queued entry whose consumer is under its cap is
+     * admitted — FIFO among the admissible, so a capped consumer's waiters do
+     * not hold up anyone else's; they get in when that consumer releases.
      */
-    acquire(): Promise<void>;
-    /** Release a slot. The next queued entry (if any) is admitted in FIFO order. */
-    release(): void;
+    release(consumer?: string): void;
     /** Snapshot of queue state — exposed for /health + /analytics + tests. */
     snapshot(): QueueSnapshot;
 }

package/dist/request-queue.js

@@ -30,6 +30,20 @@ export function decideAdmit(state) {
         return { action: 'enqueue' };
     return { action: 'reject', reason: 'queue-full' };
 }
+/**
+ * Pure per-consumer gate (dario#1244 follow-up — a team gateway where one
+ * heavy user could hold every slot). A consumer already holding `cap` slots
+ * waits even when the queue has room: `enqueue` if it does, `reject` if
+ * not. Returns null when the gate does not apply (cap off, or the consumer
+ * is under it), so `decideAdmit` decides as before.
+ */
+export function decideConsumerAdmit(activeForConsumer, cap, state) {
+    if (cap <= 0 || activeForConsumer < cap)
+        return null;
+    if (state.queued < state.maxQueued)
+        return { action: 'enqueue' };
+    return { action: 'reject', reason: 'queue-full' };
+}
 /** Pure timeout check — separated so tests can pass an explicit clock. */
 export function isQueueEntryExpired(enqueuedAt, now, timeoutMs) {
     return (now - enqueuedAt) > timeoutMs;
@@ -47,8 +61,10 @@ export class RequestQueue {
     maxConcurrent;
     maxQueued;
     queueTimeoutMs;
+    maxConcurrentPerConsumer;
     unrefTimers;
     active = 0;
+    activeByConsumer = new Map();
     queue = [];
     now;
     stalledSince = null;
@@ -56,6 +72,7 @@ export class RequestQueue {
         this.maxConcurrent = opts.maxConcurrent ?? DEFAULT_MAX_CONCURRENT;
         this.maxQueued = opts.maxQueued ?? DEFAULT_MAX_QUEUED;
         this.queueTimeoutMs = opts.queueTimeoutMs ?? DEFAULT_QUEUE_TIMEOUT_MS;
+        this.maxConcurrentPerConsumer = Math.max(0, opts.maxConcurrentPerConsumer ?? 0);
         this.unrefTimers = opts.unrefTimers ?? true;
         this.now = opts.now ?? Date.now;
     }
@@ -77,17 +94,32 @@ export class RequestQueue {
         if (this.stalledSince === null)
             this.stalledSince = this.now();
     }
+    /** A consumer is under its cap when there is no cap, no consumer, or room. */
+    underCap(consumer) {
+        if (!consumer || this.maxConcurrentPerConsumer <= 0)
+            return true;
+        return (this.activeByConsumer.get(consumer) ?? 0) < this.maxConcurrentPerConsumer;
+    }
+    admit(consumer) {
+        this.active++;
+        if (consumer)
+            this.activeByConsumer.set(consumer, (this.activeByConsumer.get(consumer) ?? 0) + 1);
+        this.updateStall();
+    }
     /**
      * Acquire a concurrency slot. Resolves when admitted; throws
      * `QueueFullError` when the queue is at its `maxQueued` cap, throws
      * `QueueTimeoutError` when a queued request waited longer than
-     * `queueTimeoutMs`.
+     * `queueTimeoutMs`. `consumer` names who the request is for: with a
+     * per-consumer cap set, a consumer at its cap waits even while slots are
+     * free, and `release(consumer)` must be called with the same name.
      */
-    async acquire() {
-        const decision = decideAdmit(this.snapshot());
+    async acquire(consumer) {
+        const state = this.snapshot();
+        const gated = consumer ? decideConsumerAdmit(this.activeByConsumer.get(consumer) ?? 0, this.maxConcurrentPerConsumer, state) : null;
+        const decision = gated ?? decideAdmit(state);
         if (decision.action === 'admit') {
-            this.active++;
-            this.updateStall();
+            this.admit(consumer);
             return;
         }
         if (decision.action === 'reject') {
@@ -108,19 +140,31 @@ export class RequestQueue {
             // Opt-out for tests — see `unrefTimers` comment in RequestQueueOptions.
             if (this.unrefTimers)
                 timeoutHandle.unref?.();
-            const entry = { resolve, reject, enqueuedAt, timeoutHandle };
+            const entry = { resolve, reject, enqueuedAt, timeoutHandle, consumer };
             this.queue.push(entry);
             this.updateStall();
         });
     }
-    /** Release a slot. The next queued entry (if any) is admitted in FIFO order. */
-    release() {
+    /**
+     * Release a slot. The first queued entry whose consumer is under its cap is
+     * admitted — FIFO among the admissible, so a capped consumer's waiters do
+     * not hold up anyone else's; they get in when that consumer releases.
+     */
+    release(consumer) {
         if (this.active > 0)
             this.active--;
-        const next = this.queue.shift();
-        if (next) {
+        if (consumer) {
+            const left = (this.activeByConsumer.get(consumer) ?? 0) - 1;
+            if (left <= 0)
+                this.activeByConsumer.delete(consumer);
+            else
+                this.activeByConsumer.set(consumer, left);
+        }
+        const idx = this.queue.findIndex((e) => this.underCap(e.consumer));
+        if (idx >= 0) {
+            const [next] = this.queue.splice(idx, 1);
             clearTimeout(next.timeoutHandle);
-            this.active++;
+            this.admit(next.consumer);
             next.resolve();
         }
         // A release IS turnover — the thing whose absence defines the wedge — so
@@ -139,6 +183,8 @@ export class RequestQueue {
             maxConcurrent: this.maxConcurrent,
             maxQueued: this.maxQueued,
             stalledSince: this.stalledSince,
+            maxConcurrentPerConsumer: this.maxConcurrentPerConsumer,
+            consumersActive: this.activeByConsumer.size,
         };
     }
 }

package/dist/tui/tabs/accounts.d.ts

@@ -34,6 +34,8 @@ export interface AccountsState {
         util5h?: number;
         util7d?: number;
         status?: string;
+        /** Ms until the seat's rate-limit window rolls; null/absent when unknown. */
+        resetInMs?: number | null;
     }>;
     error: string | null;
     /** Where the list came from: the running proxy's pool, the proxy's

package/dist/tui/tabs/accounts.js

@@ -98,8 +98,11 @@ export const AccountsTab = {
                 const expiresCol = pad(formatExpiry(acc.expiresAt), 14);
                 const u5 = pad(acc.util5h !== undefined ? `${Math.round(acc.util5h * 100)}%` : '—', 9);
                 const u7 = pad(acc.util7d !== undefined ? `${Math.round(acc.util7d * 100)}%` : '—', 9);
-                const statusCol = acc.status ?? '—';
-                const statusFg = statusCol === 'auth-cooldown' ? fg('yellow', statusCol) : dim(statusCol);
+                // A parked seat says for how long (dario#1244): "rejected 37m".
+                const statusCol = acc.status === 'rejected' && typeof acc.resetInMs === 'number'
+                    ? `rejected ${formatCountdown(acc.resetInMs)}`
+                    : (acc.status ?? '—');
+                const statusFg = statusCol === 'auth-cooldown' || acc.status === 'rejected' ? fg('yellow', statusCol) : dim(statusCol);
                 push('  ' + aliasCol + expiresCol + u5 + u7 + statusFg);
             }
             else {
@@ -143,6 +146,7 @@ export async function refreshAccounts(ctx) {
                         util5h: a.util5h,
                         util7d: a.util7d,
                         status: a.status,
+                        resetInMs: a.resetInMs,
                     })),
                     error: null,
                 };
@@ -177,6 +181,15 @@ async function diskFallback() {
         return { loading: false, accounts: [], error: e.message, source: 'disk' };
     }
 }
+/** `37m` / `4h59m` / `now` — how long until a parked seat's window rolls. */
+function formatCountdown(ms) {
+    if (ms <= 0)
+        return 'now';
+    const totalMins = Math.max(1, Math.round(ms / 60_000));
+    const h = Math.floor(totalMins / 60);
+    const m = totalMins % 60;
+    return h > 0 ? `${h}h${m}m` : `${m}m`;
+}
 function formatExpiry(expiresAt) {
     if (expiresAt === 0)
         return dim('—');

package/dist/tui/tabs/hits.js

@@ -225,6 +225,8 @@ export const HitsTab = {
             const r = newestFirst[state.selectedIdx];
             lines.push(truncate('  ' + brand('Selected') + dim(`  ${formatTime(r.timestamp)}`), w));
             lines.push('  ' + renderKvRow('Account', r.account, w - 4));
+            if (r.consumer)
+                lines.push('  ' + renderKvRow('Consumer', r.consumer, w - 4));
             lines.push('  ' + renderKvRow('Model', r.model, w - 4));
             lines.push('  ' + renderKvRow('Billing bucket', billingBucketFromClaim(r.claim), w - 4));
             lines.push('  ' + renderKvRow('Tokens', tokenBreakdown(r), w - 4));