@askalf/dario 6.0.33 → 6.0.34

package/dist/pool.js

@@ -94,6 +94,61 @@ function formatDurationMs(ms) {
     const m = totalMins % 60;
     return h > 0 ? `${h}h ${m}m` : `${m}m`;
 }
+/**
+ * The identity of the rate-limit window a reading was measured against:
+ * its representative claim plus its reset second, or null when the reading
+ * states no live window (no reset, a reset that has passed, or no claim).
+ *
+ * Two seats that report the same key are one subscription under two aliases
+ * (dario#1244, "a few have the same issue"): two independent windows all but
+ * never share a reset second, and two readings of one window always do. The
+ * organization id is deliberately NOT part of the key — several seats can
+ * share an organization and still have their own windows — the window itself
+ * is the fact that matters for headroom.
+ */
+export function windowKey(rl, now) {
+    if (!(rl.reset > 0) || rl.reset * 1000 <= now)
+        return null;
+    if (!rl.claim || rl.claim === 'unknown')
+        return null;
+    return `${rl.claim}@${rl.reset}`;
+}
+/** For every seat, the other aliases whose last reading names the same live window. */
+export function windowPeers(accounts, now) {
+    const byKey = new Map();
+    for (const a of accounts) {
+        const k = windowKey(a.rateLimit, now);
+        if (!k)
+            continue;
+        const list = byKey.get(k);
+        if (list)
+            list.push(a.alias);
+        else
+            byKey.set(k, [a.alias]);
+    }
+    const out = new Map();
+    for (const a of accounts) {
+        const k = windowKey(a.rateLimit, now);
+        out.set(a.alias, k ? (byKey.get(k) ?? []).filter((alias) => alias !== a.alias) : []);
+    }
+    return out;
+}
+/**
+ * How many windows the pool really has: each measured live window once, and
+ * each seat without a live reading as its own (nothing says otherwise yet).
+ */
+export function distinctWindows(accounts, now) {
+    const keys = new Set();
+    let unmeasured = 0;
+    for (const a of accounts) {
+        const k = windowKey(a.rateLimit, now);
+        if (k)
+            keys.add(k);
+        else
+            unmeasured++;
+    }
+    return keys.size + unmeasured;
+}
 /**
  * Cool-down schedule after auth failures. First failure: 60s. Each
  * consecutive failure doubles the window up to 30 minutes. Cleared
@@ -373,6 +428,8 @@ export class AccountPool {
             refreshToken: opts.refreshToken,
             expiresAt: opts.expiresAt,
             grantedAt: opts.grantedAt ?? keep?.grantedAt,
+            organizationId: opts.organizationId ?? keep?.organizationId,
+            adoptedFrom: keep?.adoptedFrom,
             identity: keep?.identity ?? {
                 deviceId: opts.deviceId,
                 accountUuid: opts.accountUuid,
@@ -598,6 +655,7 @@ export class AccountPool {
         if (!account)
             return;
         account.rateLimit = snapshot;
+        account.adoptedFrom = undefined;
         account.requestCount++;
     }
     /**
@@ -614,10 +672,37 @@ export class AccountPool {
         const now = snapshot.updatedAt || Date.now();
         const wasParked = account.rateLimit.status === 'rejected' && !rateLimitWindowPassed(account.rateLimit, now);
         account.rateLimit = { ...snapshot, status: 'rejected' };
+        account.adoptedFrom = undefined;
         account.rejectedCount++;
         account.lastRejectedAt = now;
         return !wasParked;
     }
+    /**
+     * Record the organization a response said this seat belongs to. Returns
+     * true when it is news — the first observation, or a change (an alias
+     * re-granted on another organization) — so the caller persists it once.
+     */
+    noteOrganization(alias, organizationId) {
+        const account = this.accounts.get(alias);
+        if (!account || !organizationId || account.organizationId === organizationId)
+            return false;
+        account.organizationId = organizationId;
+        return true;
+    }
+    /**
+     * Take a peer instance's reading of `alias` (pool-sync.ts): its snapshot
+     * replaces ours, `rejected` parks the seat on it. Counters are left alone
+     * — a request the peer served or a 429 it took are the peer's facts — and
+     * `adoptedFrom` records whose reading this is. False for an unknown alias.
+     */
+    adoptSnapshot(alias, snapshot, rejected, from) {
+        const account = this.accounts.get(alias);
+        if (!account)
+            return false;
+        account.rateLimit = rejected ? { ...snapshot, status: 'rejected' } : { ...snapshot };
+        account.adoptedFrom = from;
+        return true;
+    }
     updateTokens(alias, accessToken, refreshToken, expiresAt) {
         const account = this.accounts.get(alias);
         if (!account)
@@ -737,6 +822,7 @@ export function reconcilePoolAccounts(pool, accounts) {
             deviceId: a.deviceId,
             accountUuid: a.accountUuid,
             grantedAt: a.grantedAt,
+            organizationId: a.organizationId,
         });
     }
     for (const existing of pool.all()) {

package/dist/proxy.d.ts

@@ -345,12 +345,25 @@ interface ProxyOptions {
      * `--pool-strategy` / `DARIO_POOL_STRATEGY` / config `pool.strategy`.
      */
     poolStrategy?: string;
+    /**
+     * Share rate-limit readings and sticky bindings with other instances
+     * through the refresh-lock service (pool-sync.ts). Needs
+     * `DARIO_REFRESH_LOCK_URL` / `DARIO_REFRESH_LOCK_TOKEN`. Off by default.
+     */
+    poolSharedState?: boolean;
+    /** How often to pull peers' readings, ms. Default 2000. */
+    poolSharedStateIntervalMs?: number;
     /** Max concurrent in-flight requests. Default 10. dario#80. */
     maxConcurrent?: number;
     /** Max requests buffered waiting for a concurrency slot. Default 128. dario#80. */
     maxQueued?: number;
     /** Max ms a queued request waits before it times out with 504. Default 60000. dario#80. */
     queueTimeoutMs?: number;
+    /**
+     * Max in-flight requests per consumer (`x-dario-consumer` header). A
+     * consumer at its cap waits while others keep flowing. 0 / unset = off.
+     */
+    maxConcurrentPerConsumer?: number;
     /**
      * Max ms before the upstream fetch is aborted. Default 300000 (5 min,
      * matching the Anthropic SDK). Injectable so tests can exercise the
@@ -545,6 +558,7 @@ export interface ProxyLogEntry {
     claim?: string;
     bucket?: string;
     account?: string;
+    consumer?: string;
     client?: string;
     preserve_tools?: boolean;
     stream?: boolean;

package/dist/proxy.js

@@ -12,13 +12,14 @@ import { darioVersion } from './version.js';
 import { buildCCRequest, applyCcPromptCaching, isGenuineCCClient, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, forwardClientCCIdentityHeaders, isMcpToolName, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
 import { stampCch, hasCchSeed } from './cch.js';
 import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion } from './live-fingerprint.js';
-import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, reconcilePoolAccounts, resolvePoolStrategy, utilFreshness, rateLimitWindow, describeRateLimitSnapshot } from './pool.js';
-import { Analytics, billingBucketFromClaim, formatUsageLogLine, SUBSCRIPTION_CLAIMS, CODEX_CLAIM } from './analytics.js';
+import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, reconcilePoolAccounts, resolvePoolStrategy, utilFreshness, rateLimitWindow, describeRateLimitSnapshot, windowPeers, distinctWindows } from './pool.js';
+import { PoolSync, DEFAULT_POOL_SYNC_INTERVAL_MS } from './pool-sync.js';
+import { Analytics, billingBucketFromClaim, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, CODEX_CLAIM } from './analytics.js';
 import { OverageGuard, buildHaltErrorBody } from './overage-guard.js';
 import { notify as osNotify } from './notify.js';
 import { grantAge, grantThresholds, worstGrantLevel, describeGrantAge } from './refresh-grant.js';
 import { resolveSeatPin, SEAT_PIN_HEADER, SEAT_PIN_TOKEN_HEADER } from './seat-pin.js';
-import { loadAllAccounts, loadAccount, saveAccount, refreshAccountToken, resyncLoginFromCredentialsIfStale, ensureLoginCredentialsInPool, mirrorLoginToCredentials } from './accounts.js';
+import { loadAllAccounts, loadAccount, saveAccount, refreshAccountToken, resyncLoginFromCredentialsIfStale, ensureLoginCredentialsInPool, mirrorLoginToCredentials, withObservedOrganization } from './accounts.js';
 import { handleAdminRequest } from './admin-api.js';
 import { createTokenBucket } from './rate-limit.js';
 import { getOpenAIBackend, isOpenAIModel, forwardToOpenAI } from './openai-backend.js';
@@ -1328,9 +1329,45 @@ export async function startProxy(opts = {}) {
     const accountsList = await loadAllAccounts();
     const poolStrategy = resolvePoolStrategy(opts.poolStrategy);
     const pool = new AccountPool(poolStrategy);
+    // Two aliases reporting one window are one subscription counted twice
+    // (dario#1244). Said once per pair, when the second reading arrives; the
+    // listings carry it permanently as `sharesWindowWith`.
+    const announcedWindowPairs = new Set();
+    const announceWindowPeers = (alias) => {
+        const now = Date.now();
+        const seat = pool.get(alias);
+        if (!seat)
+            return;
+        for (const peer of windowPeers(pool.all(), now).get(alias) ?? []) {
+            const pair = [alias, peer].sort().join('|');
+            if (announcedWindowPairs.has(pair))
+                continue;
+            announcedWindowPairs.add(pair);
+            const windows = distinctWindows(pool.all(), now);
+            console.error(`[dario] seats "${alias}" and "${peer}" report the same ${seat.rateLimit.claim} window (resets ${new Date(seat.rateLimit.reset * 1000).toISOString()}) — one subscription under two aliases; the pool has ${windows} distinct window${windows === 1 ? '' : 's'} across ${pool.size} seats`);
+        }
+    };
+    // Shared pool state across instances (docs/multi-instance.md): opt-in,
+    // rides the refresh-lock service, fails open. Off → byte-identical to before.
+    const lockUrl = process.env['DARIO_REFRESH_LOCK_URL'];
+    const poolSync = opts.poolSharedState && lockUrl
+        ? new PoolSync(pool, {
+            baseUrl: lockUrl,
+            token: process.env['DARIO_REFRESH_LOCK_TOKEN'] ?? '',
+            intervalMs: opts.poolSharedStateIntervalMs ?? DEFAULT_POOL_SYNC_INTERVAL_MS,
+            log: (line) => console.error(line),
+        })
+        : null;
+    if (opts.poolSharedState && !poolSync) {
+        console.error('[dario] --pool-shared-state needs DARIO_REFRESH_LOCK_URL (the lock service carries the shared state) — running with this instance\'s own state');
+    }
     if (poolStrategy !== 'headroom') {
         console.log(`  Pool strategy: ${poolStrategy} (new conversations fill the alphabetically-first seat, spill at the 2% floor)`);
     }
+    if (poolSync) {
+        console.log(`  Pool shared state: on (instance ${poolSync.instance}, via ${lockUrl}, pulling peers every ${poolSync.intervalMs}ms; fails open)`);
+        poolSync.start();
+    }
     // Per-model rate-limit bucket families seen during this proxy run. First-
     // sight is logged once when verbose so a new Anthropic bucket (e.g. an
     // eventual `7d_opus`) doesn't slip past unnoticed. Pure observability —
@@ -1398,6 +1435,7 @@ export async function startProxy(opts = {}) {
                 deviceId: acc.deviceId,
                 accountUuid: acc.accountUuid,
                 grantedAt: acc.grantedAt,
+                organizationId: acc.organizationId,
             });
         }
         // Startup self-heal (dario#790): eagerly refresh any account whose access
@@ -1418,7 +1456,9 @@ export async function startProxy(opts = {}) {
                     const saved = await loadAccount(acc.alias);
                     if (!saved)
                         return;
-                    const refreshed = await refreshAccountToken(saved);
+                    // The refresh's write carries the organization the seat was
+                    // observed on (dario#1244) — the one write that touches the record.
+                    const refreshed = await refreshAccountToken(withObservedOrganization(saved, acc.organizationId));
                     pool.updateTokens(acc.alias, refreshed.accessToken, refreshed.refreshToken, refreshed.expiresAt);
                     // Mirror a refreshed `login` token back to credentials.json so the
                     // legacy file (and `dario doctor`) tracks the pool store (#808).
@@ -1470,7 +1510,9 @@ export async function startProxy(opts = {}) {
                     const saved = await loadAccount(acc.alias);
                     if (!saved)
                         continue;
-                    const refreshed = await refreshAccountToken(saved);
+                    // The refresh's write carries the organization the seat was
+                    // observed on (dario#1244) — the one write that touches the record.
+                    const refreshed = await refreshAccountToken(withObservedOrganization(saved, acc.organizationId));
                     pool.updateTokens(acc.alias, refreshed.accessToken, refreshed.refreshToken, refreshed.expiresAt);
                     // Mirror a refreshed `login` token back to credentials.json so the
                     // legacy file (and `dario doctor`) tracks the pool store (#808).
@@ -1515,6 +1557,7 @@ export async function startProxy(opts = {}) {
                     deviceId: acc.deviceId,
                     accountUuid: acc.accountUuid,
                     grantedAt: acc.grantedAt,
+                    organizationId: acc.organizationId,
                 });
             }
         }
@@ -1616,6 +1659,7 @@ export async function startProxy(opts = {}) {
         maxConcurrent: opts.maxConcurrent ?? DEFAULT_MAX_CONCURRENT,
         maxQueued: opts.maxQueued ?? DEFAULT_MAX_QUEUED,
         queueTimeoutMs: opts.queueTimeoutMs ?? DEFAULT_QUEUE_TIMEOUT_MS,
+        maxConcurrentPerConsumer: opts.maxConcurrentPerConsumer ?? 0,
     });
     const upstreamTimeoutMs = opts.upstreamTimeoutMs ?? UPSTREAM_TIMEOUT_MS;
     // Cache context-1m beta availability. Set false once per account after the
@@ -2093,6 +2137,7 @@ export async function startProxy(opts = {}) {
                 // just persisted metadata — the same snapshot GET /accounts exposes.
                 poolStatus: () => {
                     const snapNow = Date.now();
+                    const peers = windowPeers(pool.all(), snapNow);
                     const snap = new Map();
                     for (const a of pool.all()) {
                         snap.set(a.alias, {
@@ -2108,6 +2153,9 @@ export async function startProxy(opts = {}) {
                             requestCount: a.requestCount,
                             rejectedCount: a.rejectedCount,
                             lastRejectedAt: a.lastRejectedAt ?? null,
+                            organizationId: a.organizationId ?? null,
+                            sharesWindowWith: peers.get(a.alias) ?? [],
+                            readingFrom: a.adoptedFrom ?? null,
                             // Raw streak, not just the cooldown boolean: a single 401 also
                             // shows `auth-cooldown` for 60s, indistinguishable from a
                             // genuinely dead refresh token by that field alone. The magnitude
@@ -2179,6 +2227,7 @@ export async function startProxy(opts = {}) {
         // the `dario accounts` CLI, not HTTP.
         if (urlPath === '/accounts' && req.method === 'GET') {
             const now = Date.now();
+            const peers = windowPeers(pool.all(), now);
             const accounts = pool.all().map(a => {
                 const inCooldown = isInAuthCooldown(a, now);
                 const cooldownMs = inCooldown && a.lastAuthFailureAt
@@ -2214,6 +2263,14 @@ export async function startProxy(opts = {}) {
                     // parked seat no longer reads as one that was never called.
                     rejectedCount: a.rejectedCount,
                     lastRejectedAt: a.lastRejectedAt ?? null,
+                    // Which organization the token belongs to, and which other seats
+                    // report the same live window — one subscription under several
+                    // aliases (dario#1244).
+                    organizationId: a.organizationId ?? null,
+                    sharesWindowWith: peers.get(a.alias) ?? [],
+                    // Whose reading this is: a peer instance's id (shared pool state)
+                    // or null for this instance's own.
+                    readingFrom: a.adoptedFrom ?? null,
                     expiresInMs: Math.max(0, a.expiresAt - now),
                     // Refresh-token grant age (refresh-grant.ts): the wall a token
                     // refresh cannot move. null fields = grant date unknown.
@@ -2236,6 +2293,11 @@ export async function startProxy(opts = {}) {
                 mode: 'pool',
                 ...pool.status(),
                 stickyBindings: pool.stickyCount(),
+                // Windows the pool really has: each measured window once, each
+                // unmeasured seat as its own.
+                distinctWindows: distinctWindows(pool.all(), now),
+                // Shared pool state (pool-sync.ts) — null when off.
+                sharedState: poolSync ? poolSync.status() : null,
                 accounts,
             }));
             return;
@@ -2462,12 +2524,19 @@ export async function startProxy(opts = {}) {
             res.end(JSON.stringify(buildHaltErrorBody(state)));
             return;
         }
+        // Who this request is for (dario#1244 follow-up). An `x-dario-consumer`
+        // header names the consumer for both the per-consumer concurrency cap and
+        // attribution. Without one, attribution falls back to a hash of the
+        // body's user id once the body is parsed; the cap needs the name before
+        // the slot is taken, so only the header gates.
+        const consumerFromHeaders = consumerFromHeader(req.headers[CONSUMER_HEADER]);
+        let consumer = consumerFromHeaders;
         // Proxy to Anthropic (with concurrency control). The bounded queue
         // replaces the v3.30.x-and-earlier unbounded semaphore — dario#80. A
         // queue-full condition returns an explicit 429 with a `"queue-full"`
         // marker in the body; a queue-timeout returns 504 with `"queue-timeout"`.
         try {
-            await queue.acquire();
+            await queue.acquire(consumerFromHeaders);
         }
         catch (err) {
             if (err instanceof QueueFullError) {
@@ -2757,8 +2826,11 @@ export async function startProxy(opts = {}) {
                         const v = JSON.parse(text);
                         if (v === null || typeof v !== 'object' || Array.isArray(v))
                             invalid = 'request body must be a JSON object';
-                        else
+                        else {
                             parsedBody = v;
+                            if (!consumer)
+                                consumer = consumerFromBody(parsedBody);
+                        }
                     }
                     catch (err) {
                         invalid = `request body is not valid JSON: ${err instanceof Error ? err.message : String(err)}`;
@@ -3055,6 +3127,7 @@ export async function startProxy(opts = {}) {
                             codexRequestCounts.set(o.alias, (codexRequestCounts.get(o.alias) ?? 0) + 1);
                             analytics.record({
                                 timestamp: Date.now(),
+                                consumer,
                                 account: o.alias,
                                 model: o.model || rawModel || 'codex',
                                 inputTokens: o.inputTokens, outputTokens: o.outputTokens,
@@ -3072,13 +3145,13 @@ export async function startProxy(opts = {}) {
                                 method: req.method ?? '', path: urlPath, model: o.model || rawModel || undefined,
                                 status: o.status, latency_ms: o.latencyMs, in_tokens: o.inputTokens, out_tokens: o.outputTokens,
                                 cache_read: o.cacheReadTokens, cache_create: o.cacheCreateTokens,
-                                claim: CODEX_CLAIM, bucket: 'subscription', account: o.alias, stream: o.stream,
+                                claim: CODEX_CLAIM, bucket: 'subscription', account: o.alias, consumer, stream: o.stream,
                             });
                             if (verbose)
                                 console.log(formatUsageLogLine(codexReq, {
                                     inputTokens: o.inputTokens, outputTokens: o.outputTokens,
                                     cacheReadTokens: o.cacheReadTokens, cacheCreateTokens: o.cacheCreateTokens,
-                                }));
+                                }, consumer));
                         }, 
                         // Cool codex on a rate limit only — a 5xx or an unreachable backend
                         // is an outage, and parking a provider for that would keep it out
@@ -3332,7 +3405,20 @@ export async function startProxy(opts = {}) {
                         // Rotating off mid-session costs cache-create on every turn.
                         stickyKey = computeStickyKey(userMsg);
                         if (stickyKey && !pinnedAccount) {
+                            // Shared state (pool-sync.ts): a conversation a peer instance
+                            // already bound lands on the same seat here, so its prompt
+                            // cache is read rather than rewritten. Only consulted when this
+                            // instance holds no binding of its own; a binding made here is
+                            // published for the peers.
+                            const hadLocalBinding = pool.stickyAliasFor(stickyKey) !== null;
+                            if (poolSync && !hadLocalBinding) {
+                                const peerAlias = await poolSync.lookupSticky(stickyKey);
+                                if (peerAlias)
+                                    pool.rebindSticky(stickyKey, peerAlias);
+                            }
                             const preferred = pool.selectSticky(stickyKey, modelFamily(requestModel));
+                            if (poolSync && preferred && !hadLocalBinding)
+                                poolSync.bindSticky(stickyKey, preferred.alias);
                             if (preferred && preferred.alias !== poolAccount?.alias) {
                                 poolAccount = preferred;
                                 accessToken = preferred.accessToken;
@@ -3746,6 +3832,14 @@ export async function startProxy(opts = {}) {
                     else {
                         pool.updateRateLimits(poolAccount.alias, snapshot);
                     }
+                    // Which organization answered (dario#1244). Held in the pool at
+                    // once; written to the seat's record by its next token refresh —
+                    // the write that already exists — so nothing here races a refresh.
+                    const organizationId = upstream.headers.get('anthropic-organization-id');
+                    if (organizationId)
+                        pool.noteOrganization(poolAccount.alias, organizationId);
+                    announceWindowPeers(poolAccount.alias);
+                    poolSync?.reportSeat(poolAccount.alias);
                     // First-sight detector for per-model rate-limit buckets. Anthropic
                     // ships these unannounced — e.g. `7d_sonnet-utilization` appeared
                     // around 2026-04-25 — and verbose-mode users want a heads-up the
@@ -4021,6 +4115,7 @@ export async function startProxy(opts = {}) {
                                 headers['Authorization'] = `Bearer ${accessToken}`;
                                 headers['x-claude-code-session-id'] = resolveOutboundSession(nextAccount, clientSessionKey).sessionId;
                                 pool.rebindSticky(stickyKey, nextAccount.alias);
+                                poolSync?.bindSticky(stickyKey, nextAccount.alias);
                                 peekedBody = null;
                                 continue dispatchLoop;
                             }
@@ -4068,6 +4163,7 @@ export async function startProxy(opts = {}) {
                             const rl = poolAccount?.rateLimit ?? parseRateLimits(upstream.headers);
                             analytics.record({
                                 timestamp: Date.now(),
+                                consumer,
                                 account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
                                 model: requestModel,
                                 inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0, thinkingTokens: 0,
@@ -4121,6 +4217,7 @@ export async function startProxy(opts = {}) {
                         headers['Authorization'] = `Bearer ${accessToken}`;
                         headers['x-claude-code-session-id'] = resolveOutboundSession(nextAccount, clientSessionKey).sessionId;
                         pool.rebindSticky(stickyKey, nextAccount.alias);
+                        poolSync?.bindSticky(stickyKey, nextAccount.alias);
                         continue dispatchLoop;
                     }
                     // No peer available — forward the saved generic-403 bytes when the
@@ -4154,6 +4251,7 @@ export async function startProxy(opts = {}) {
                             headers['Authorization'] = `Bearer ${accessToken}`;
                             headers['x-claude-code-session-id'] = resolveOutboundSession(nextAccount, clientSessionKey).sessionId;
                             pool.rebindSticky(stickyKey, nextAccount.alias);
+                            poolSync?.bindSticky(stickyKey, nextAccount.alias);
                             continue dispatchLoop;
                         }
                     }
@@ -4189,6 +4287,7 @@ export async function startProxy(opts = {}) {
                         const rl = poolAccount?.rateLimit ?? parseRateLimits(upstream.headers);
                         analytics.record({
                             timestamp: Date.now(),
+                            consumer,
                             account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
                             model: requestModel,
                             inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0, thinkingTokens: 0,
@@ -4446,6 +4545,7 @@ export async function startProxy(opts = {}) {
                     const rl = poolAccount?.rateLimit ?? parseRateLimits(upstream.headers);
                     analytics.record({
                         timestamp: Date.now(),
+                        consumer,
                         account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
                         model: requestModel,
                         inputTokens: streamInputTokens, outputTokens: streamOutputTokens,
@@ -4465,6 +4565,7 @@ export async function startProxy(opts = {}) {
                     claim: poolAccount?.rateLimit.claim,
                     bucket: poolAccount ? billingBucketFromClaim(poolAccount.rateLimit.claim) : undefined,
                     account: poolAccount?.alias,
+                    consumer,
                     client: detectedClientForLog,
                     preserve_tools: preserveToolsEffective,
                     stream: true,
@@ -4473,7 +4574,7 @@ export async function startProxy(opts = {}) {
                     console.log(formatUsageLogLine(requestCount, {
                         inputTokens: streamInputTokens, outputTokens: streamOutputTokens,
                         cacheReadTokens: streamCacheReadTokens, cacheCreateTokens: streamCacheCreateTokens,
-                    }));
+                    }, consumer));
             }
             else {
                 // Buffer and forward
@@ -4512,6 +4613,7 @@ export async function startProxy(opts = {}) {
                         const rl = poolAccount?.rateLimit ?? parseRateLimits(upstream.headers);
                         analytics.record({
                             timestamp: Date.now(),
+                            consumer,
                             account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
                             model: bufferedUsage.model || requestModel,
                             inputTokens: bufferedUsage.inputTokens, outputTokens: bufferedUsage.outputTokens,
@@ -4533,12 +4635,13 @@ export async function startProxy(opts = {}) {
                     claim: poolAccount?.rateLimit.claim,
                     bucket: poolAccount ? billingBucketFromClaim(poolAccount.rateLimit.claim) : undefined,
                     account: poolAccount?.alias,
+                    consumer,
                     client: detectedClientForLog,
                     preserve_tools: preserveToolsEffective,
                     stream: false,
                 });
                 if (verbose && bufferedUsage)
-                    console.log(formatUsageLogLine(requestCount, bufferedUsage));
+                    console.log(formatUsageLogLine(requestCount, bufferedUsage, consumer));
                 if (verbose)
                     console.log(`[dario] #${requestCount} ${upstream.status}`);
             }
@@ -4550,6 +4653,7 @@ export async function startProxy(opts = {}) {
                 ts: new Date().toISOString(), req: requestCount,
                 method: req.method ?? '', path: urlPath,
                 model: requestModel || undefined,
+                consumer,
                 client: detectedClientForLog,
                 preserve_tools: preserveToolsEffective,
             };
@@ -4590,7 +4694,7 @@ export async function startProxy(opts = {}) {
                 clearTimeout(upstreamTimeout);
             if (onClientClose !== null)
                 req.off('close', onClientClose);
-            queue.release();
+            queue.release(consumerFromHeaders);
         }
     });
     server.on('error', async (err) => {
@@ -4819,6 +4923,7 @@ export async function startProxy(opts = {}) {
         console.log('\n[dario] Shutting down...');
         clearInterval(presenceInterval);
         clearInterval(refreshInterval);
+        poolSync?.stop();
         if (logFileStream)
             logFileStream.end();
         // Flush tokens first (best-effort, bounded), then close the server. The

package/dist/request-queue.d.ts

@@ -52,6 +52,10 @@ export interface QueueState {
  */
 export interface QueueSnapshot extends QueueState {
     stalledSince: number | null;
+    /** Per-consumer in-flight ceiling (`--max-concurrent-per-consumer`); 0 = off. */
+    maxConcurrentPerConsumer: number;
+    /** Distinct consumers with a request in flight right now. */
+    consumersActive: number;
 }
 export type AdmitDecision = {
     action: 'admit';
@@ -63,6 +67,14 @@ export type AdmitDecision = {
 };
 /** Pure admission decision — no side effects, no clock dep. */
 export declare function decideAdmit(state: QueueState): AdmitDecision;
+/**
+ * Pure per-consumer gate (dario#1244 follow-up — a team gateway where one
+ * heavy user could hold every slot). A consumer already holding `cap` slots
+ * waits even when the queue has room: `enqueue` if it does, `reject` if
+ * not. Returns null when the gate does not apply (cap off, or the consumer
+ * is under it), so `decideAdmit` decides as before.
+ */
+export declare function decideConsumerAdmit(activeForConsumer: number, cap: number, state: QueueState): AdmitDecision | null;
 /** Pure timeout check — separated so tests can pass an explicit clock. */
 export declare function isQueueEntryExpired(enqueuedAt: number, now: number, timeoutMs: number): boolean;
 export declare class QueueFullError extends Error {
@@ -75,6 +87,13 @@ export interface RequestQueueOptions {
     maxConcurrent?: number;
     maxQueued?: number;
     queueTimeoutMs?: number;
+    /**
+     * In-flight ceiling per consumer (see `acquire(consumer)`). 0 / unset =
+     * off. A consumer at its cap waits in the queue; its waiters never block
+     * another consumer's — `release` admits the first waiter whose consumer
+     * is under the cap, not the first waiter.
+     */
+    maxConcurrentPerConsumer?: number;
     /**
      * Whether timeout timers are `unref`'d so they don't by themselves keep
      * the Node event loop alive. Default `true` — appropriate for the proxy,
@@ -95,8 +114,10 @@ export declare class RequestQueue {
     readonly maxConcurrent: number;
     readonly maxQueued: number;
     readonly queueTimeoutMs: number;
+    readonly maxConcurrentPerConsumer: number;
     readonly unrefTimers: boolean;
     private active;
+    private activeByConsumer;
     private queue;
     private readonly now;
     private stalledSince;
@@ -111,15 +132,24 @@ export declare class RequestQueue {
      * `release()` refreshes it, by clearing first (see there).
      */
     private updateStall;
+    /** A consumer is under its cap when there is no cap, no consumer, or room. */
+    private underCap;
+    private admit;
     /**
      * Acquire a concurrency slot. Resolves when admitted; throws
      * `QueueFullError` when the queue is at its `maxQueued` cap, throws
      * `QueueTimeoutError` when a queued request waited longer than
-     * `queueTimeoutMs`.
+     * `queueTimeoutMs`. `consumer` names who the request is for: with a
+     * per-consumer cap set, a consumer at its cap waits even while slots are
+     * free, and `release(consumer)` must be called with the same name.
+     */
+    acquire(consumer?: string): Promise<void>;
+    /**
+     * Release a slot. The first queued entry whose consumer is under its cap is
+     * admitted — FIFO among the admissible, so a capped consumer's waiters do
+     * not hold up anyone else's; they get in when that consumer releases.
      */
-    acquire(): Promise<void>;
-    /** Release a slot. The next queued entry (if any) is admitted in FIFO order. */
-    release(): void;
+    release(consumer?: string): void;
     /** Snapshot of queue state — exposed for /health + /analytics + tests. */
     snapshot(): QueueSnapshot;
 }