@askalf/dario 6.0.33 → 6.0.35

package/dist/proxy.js

@@ -12,13 +12,14 @@ import { darioVersion } from './version.js';
 import { buildCCRequest, applyCcPromptCaching, isGenuineCCClient, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, forwardClientCCIdentityHeaders, isMcpToolName, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
 import { stampCch, hasCchSeed } from './cch.js';
 import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion } from './live-fingerprint.js';
-import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, reconcilePoolAccounts, resolvePoolStrategy, utilFreshness, rateLimitWindow, describeRateLimitSnapshot } from './pool.js';
-import { Analytics, billingBucketFromClaim, formatUsageLogLine, SUBSCRIPTION_CLAIMS, CODEX_CLAIM } from './analytics.js';
+import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, reconcilePoolAccounts, resolvePoolStrategy, utilFreshness, rateLimitWindow, describeRateLimitSnapshot, windowPeers, distinctWindows, accountAction } from './pool.js';
+import { PoolSync, DEFAULT_POOL_SYNC_INTERVAL_MS } from './pool-sync.js';
+import { Analytics, billingBucketFromClaim, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, CODEX_CLAIM } from './analytics.js';
 import { OverageGuard, buildHaltErrorBody } from './overage-guard.js';
 import { notify as osNotify } from './notify.js';
 import { grantAge, grantThresholds, worstGrantLevel, describeGrantAge } from './refresh-grant.js';
 import { resolveSeatPin, SEAT_PIN_HEADER, SEAT_PIN_TOKEN_HEADER } from './seat-pin.js';
-import { loadAllAccounts, loadAccount, saveAccount, refreshAccountToken, resyncLoginFromCredentialsIfStale, ensureLoginCredentialsInPool, mirrorLoginToCredentials } from './accounts.js';
+import { loadAllAccounts, loadAccount, saveAccount, refreshAccountToken, resyncLoginFromCredentialsIfStale, ensureLoginCredentialsInPool, mirrorLoginToCredentials, withObservedOrganization } from './accounts.js';
 import { handleAdminRequest } from './admin-api.js';
 import { createTokenBucket } from './rate-limit.js';
 import { getOpenAIBackend, isOpenAIModel, forwardToOpenAI } from './openai-backend.js';
@@ -32,7 +33,7 @@ import { selectPoolFallbackModels } from './pool-fallback-tier.js';
 import { RequestQueue, QueueFullError, QueueTimeoutError, DEFAULT_MAX_CONCURRENT, DEFAULT_MAX_QUEUED, DEFAULT_QUEUE_TIMEOUT_MS } from './request-queue.js';
 import { redactSecrets } from './redact.js';
 import { BAKED_BASE_MODELS, withLongContextVariants, buildOpenAIModelsList, getModelCatalog, getCachedBases, resolveAliasAgainst, prewarmModelCatalog, retryModelCatalogNow, isSuspendedModel } from './model-catalog.js';
-import { classifyUpstreamRejection, diagnosticSnippet } from './upstream-rejection.js';
+import { classifyUpstreamRejection, diagnosticSnippet, POOL_PARKED } from './upstream-rejection.js';
 import { ProviderCooldowns, canAttempt, allProvidersCooled, cooldownRetryAfterMs, parseRetryAfterMs, ALL_PROVIDERS_RATE_LIMITED, } from './provider-cooldown.js';
 const ANTHROPIC_API = 'https://api.anthropic.com';
 const DEFAULT_PORT = 3456;
@@ -1328,9 +1329,45 @@ export async function startProxy(opts = {}) {
     const accountsList = await loadAllAccounts();
     const poolStrategy = resolvePoolStrategy(opts.poolStrategy);
     const pool = new AccountPool(poolStrategy);
+    // Two aliases reporting one window are one subscription counted twice
+    // (dario#1244). Said once per pair, when the second reading arrives; the
+    // listings carry it permanently as `sharesWindowWith`.
+    const announcedWindowPairs = new Set();
+    const announceWindowPeers = (alias) => {
+        const now = Date.now();
+        const seat = pool.get(alias);
+        if (!seat)
+            return;
+        for (const peer of windowPeers(pool.all(), now).get(alias) ?? []) {
+            const pair = [alias, peer].sort().join('|');
+            if (announcedWindowPairs.has(pair))
+                continue;
+            announcedWindowPairs.add(pair);
+            const windows = distinctWindows(pool.all(), now);
+            console.error(`[dario] seats "${alias}" and "${peer}" report the same ${seat.rateLimit.claim} window (resets ${new Date(seat.rateLimit.reset * 1000).toISOString()}) — one subscription under two aliases; the pool has ${windows} distinct window${windows === 1 ? '' : 's'} across ${pool.size} seats`);
+        }
+    };
+    // Shared pool state across instances (docs/multi-instance.md): opt-in,
+    // rides the refresh-lock service, fails open. Off → byte-identical to before.
+    const lockUrl = process.env['DARIO_REFRESH_LOCK_URL'];
+    const poolSync = opts.poolSharedState && lockUrl
+        ? new PoolSync(pool, {
+            baseUrl: lockUrl,
+            token: process.env['DARIO_REFRESH_LOCK_TOKEN'] ?? '',
+            intervalMs: opts.poolSharedStateIntervalMs ?? DEFAULT_POOL_SYNC_INTERVAL_MS,
+            log: (line) => console.error(line),
+        })
+        : null;
+    if (opts.poolSharedState && !poolSync) {
+        console.error('[dario] --pool-shared-state needs DARIO_REFRESH_LOCK_URL (the lock service carries the shared state) — running with this instance\'s own state');
+    }
     if (poolStrategy !== 'headroom') {
         console.log(`  Pool strategy: ${poolStrategy} (new conversations fill the alphabetically-first seat, spill at the 2% floor)`);
     }
+    if (poolSync) {
+        console.log(`  Pool shared state: on (instance ${poolSync.instance}, via ${lockUrl}, pulling peers every ${poolSync.intervalMs}ms; fails open)`);
+        poolSync.start();
+    }
     // Per-model rate-limit bucket families seen during this proxy run. First-
     // sight is logged once when verbose so a new Anthropic bucket (e.g. an
     // eventual `7d_opus`) doesn't slip past unnoticed. Pure observability —
@@ -1398,6 +1435,7 @@ export async function startProxy(opts = {}) {
                 deviceId: acc.deviceId,
                 accountUuid: acc.accountUuid,
                 grantedAt: acc.grantedAt,
+                organizationId: acc.organizationId,
             });
         }
         // Startup self-heal (dario#790): eagerly refresh any account whose access
@@ -1418,7 +1456,9 @@ export async function startProxy(opts = {}) {
                     const saved = await loadAccount(acc.alias);
                     if (!saved)
                         return;
-                    const refreshed = await refreshAccountToken(saved);
+                    // The refresh's write carries the organization the seat was
+                    // observed on (dario#1244) — the one write that touches the record.
+                    const refreshed = await refreshAccountToken(withObservedOrganization(saved, acc.organizationId));
                     pool.updateTokens(acc.alias, refreshed.accessToken, refreshed.refreshToken, refreshed.expiresAt);
                     // Mirror a refreshed `login` token back to credentials.json so the
                     // legacy file (and `dario doctor`) tracks the pool store (#808).
@@ -1470,7 +1510,9 @@ export async function startProxy(opts = {}) {
                     const saved = await loadAccount(acc.alias);
                     if (!saved)
                         continue;
-                    const refreshed = await refreshAccountToken(saved);
+                    // The refresh's write carries the organization the seat was
+                    // observed on (dario#1244) — the one write that touches the record.
+                    const refreshed = await refreshAccountToken(withObservedOrganization(saved, acc.organizationId));
                     pool.updateTokens(acc.alias, refreshed.accessToken, refreshed.refreshToken, refreshed.expiresAt);
                     // Mirror a refreshed `login` token back to credentials.json so the
                     // legacy file (and `dario doctor`) tracks the pool store (#808).
@@ -1515,6 +1557,7 @@ export async function startProxy(opts = {}) {
                     deviceId: acc.deviceId,
                     accountUuid: acc.accountUuid,
                     grantedAt: acc.grantedAt,
+                    organizationId: acc.organizationId,
                 });
             }
         }
@@ -1612,10 +1655,14 @@ export async function startProxy(opts = {}) {
         overlayTemplateHeaderValues(staticHeaders, CC_TEMPLATE.header_values);
     }
     let requestCount = 0;
+    // dario#1244: the "pool parked" line is logged on the transition into the
+    // state, not on every request that arrives while it holds.
+    let poolParkedAnnounced = false;
     const queue = new RequestQueue({
         maxConcurrent: opts.maxConcurrent ?? DEFAULT_MAX_CONCURRENT,
         maxQueued: opts.maxQueued ?? DEFAULT_MAX_QUEUED,
         queueTimeoutMs: opts.queueTimeoutMs ?? DEFAULT_QUEUE_TIMEOUT_MS,
+        maxConcurrentPerConsumer: opts.maxConcurrentPerConsumer ?? 0,
     });
     const upstreamTimeoutMs = opts.upstreamTimeoutMs ?? UPSTREAM_TIMEOUT_MS;
     // Cache context-1m beta availability. Set false once per account after the
@@ -2093,6 +2140,7 @@ export async function startProxy(opts = {}) {
                 // just persisted metadata — the same snapshot GET /accounts exposes.
                 poolStatus: () => {
                     const snapNow = Date.now();
+                    const peers = windowPeers(pool.all(), snapNow);
                     const snap = new Map();
                     for (const a of pool.all()) {
                         snap.set(a.alias, {
@@ -2105,9 +2153,13 @@ export async function startProxy(opts = {}) {
                             ...rateLimitWindow(a.rateLimit, snapNow),
                             claim: a.rateLimit.claim,
                             status: reportedAccountStatus(a, snapNow),
+                            action: accountAction(a, snapNow),
                             requestCount: a.requestCount,
                             rejectedCount: a.rejectedCount,
                             lastRejectedAt: a.lastRejectedAt ?? null,
+                            organizationId: a.organizationId ?? null,
+                            sharesWindowWith: peers.get(a.alias) ?? [],
+                            readingFrom: a.adoptedFrom ?? null,
                             // Raw streak, not just the cooldown boolean: a single 401 also
                             // shows `auth-cooldown` for 60s, indistinguishable from a
                             // genuinely dead refresh token by that field alone. The magnitude
@@ -2179,6 +2231,7 @@ export async function startProxy(opts = {}) {
         // the `dario accounts` CLI, not HTTP.
         if (urlPath === '/accounts' && req.method === 'GET') {
             const now = Date.now();
+            const peers = windowPeers(pool.all(), now);
             const accounts = pool.all().map(a => {
                 const inCooldown = isInAuthCooldown(a, now);
                 const cooldownMs = inCooldown && a.lastAuthFailureAt
@@ -2209,11 +2262,21 @@ export async function startProxy(opts = {}) {
                     ...rateLimitWindow(a.rateLimit, now),
                     claim: a.rateLimit.claim,
                     status: reportedAccountStatus(a, now),
+                    // The one-word next step: none · wait · regrant (dario#1244).
+                    action: accountAction(a, now),
                     requestCount: a.requestCount,
                     // 429s answered — the attempts requestCount does not count, so a
                     // parked seat no longer reads as one that was never called.
                     rejectedCount: a.rejectedCount,
                     lastRejectedAt: a.lastRejectedAt ?? null,
+                    // Which organization the token belongs to, and which other seats
+                    // report the same live window — one subscription under several
+                    // aliases (dario#1244).
+                    organizationId: a.organizationId ?? null,
+                    sharesWindowWith: peers.get(a.alias) ?? [],
+                    // Whose reading this is: a peer instance's id (shared pool state)
+                    // or null for this instance's own.
+                    readingFrom: a.adoptedFrom ?? null,
                     expiresInMs: Math.max(0, a.expiresAt - now),
                     // Refresh-token grant age (refresh-grant.ts): the wall a token
                     // refresh cannot move. null fields = grant date unknown.
@@ -2236,6 +2299,11 @@ export async function startProxy(opts = {}) {
                 mode: 'pool',
                 ...pool.status(),
                 stickyBindings: pool.stickyCount(),
+                // Windows the pool really has: each measured window once, each
+                // unmeasured seat as its own.
+                distinctWindows: distinctWindows(pool.all(), now),
+                // Shared pool state (pool-sync.ts) — null when off.
+                sharedState: poolSync ? poolSync.status() : null,
                 accounts,
             }));
             return;
@@ -2462,12 +2530,19 @@ export async function startProxy(opts = {}) {
             res.end(JSON.stringify(buildHaltErrorBody(state)));
             return;
         }
+        // Who this request is for (dario#1244 follow-up). An `x-dario-consumer`
+        // header names the consumer for both the per-consumer concurrency cap and
+        // attribution. Without one, attribution falls back to a hash of the
+        // body's user id once the body is parsed; the cap needs the name before
+        // the slot is taken, so only the header gates.
+        const consumerFromHeaders = consumerFromHeader(req.headers[CONSUMER_HEADER]);
+        let consumer = consumerFromHeaders;
         // Proxy to Anthropic (with concurrency control). The bounded queue
         // replaces the v3.30.x-and-earlier unbounded semaphore — dario#80. A
         // queue-full condition returns an explicit 429 with a `"queue-full"`
         // marker in the body; a queue-timeout returns 504 with `"queue-timeout"`.
         try {
-            await queue.acquire();
+            await queue.acquire(consumerFromHeaders);
         }
         catch (err) {
             if (err instanceof QueueFullError) {
@@ -2556,6 +2631,31 @@ export async function startProxy(opts = {}) {
             //
             // Shared because two callers must agree: the selector, and the dispatch
             // below for a request the selector DEFERRED but no provider could serve.
+            /**
+             * Every seat in the pool is parked inside a live window (dario#1244).
+             * The old fallback re-probed the earliest-reset seat on every request:
+             * one upstream round trip per request that could only 429,
+             * `rejectedCount` climbing by one each time — 500 on one seat inside a
+             * single window on the reporter's gateway — and the client waiting on a
+             * verdict dario already held. Answer it here: 429, `retry-after` at the
+             * earliest reset, the marker in the same channel the other rejection
+             * classes use, and nothing sent upstream.
+             */
+            const writePoolParked = (untilMs) => {
+                const retryAfterSec = Math.max(1, Math.ceil((untilMs - Date.now()) / 1000));
+                res.writeHead(429, {
+                    ...JSON_HEADERS,
+                    'retry-after': String(retryAfterSec),
+                    'x-dario-upstream-rejection': POOL_PARKED,
+                });
+                res.end(JSON.stringify({
+                    error: {
+                        type: 'rate_limit_error',
+                        message: `All ${pool.size} pool seat${pool.size === 1 ? '' : 's'} are over their rate-limit windows; the earliest resets in ${retryAfterSec}s. Nothing was sent upstream.`,
+                    },
+                    reason: POOL_PARKED,
+                }));
+            };
             const writePoolUnavailable = () => {
                 res.writeHead(503, JSON_HEADERS);
                 res.end(JSON.stringify(pool.size === 0
@@ -2669,6 +2769,20 @@ export async function startProxy(opts = {}) {
                     return true;
                 }
                 poolAccount = pool.select();
+                if (poolAccount)
+                    poolParkedAnnounced = false;
+                // Every seat parked inside a live window (dario#1244): cool the
+                // provider to the earliest reset so a fallback chain sees the Claude
+                // half as what it is, say so once, and — unless a fallback is armed —
+                // answer the client here instead of spending a probe that can only 429.
+                const parkedUntil = poolAccount ? null : pool.parkedUntil();
+                if (parkedUntil !== null) {
+                    providerCooldowns.note('claude', parkedUntil - Date.now());
+                    if (!poolParkedAnnounced) {
+                        poolParkedAnnounced = true;
+                        console.error(`[dario] #${requestCount} pool parked: all ${pool.size} seats are over their rate-limit windows, earliest resets in ${Math.max(1, Math.ceil((parkedUntil - Date.now()) / 60000))}m — answering 429 locally until then, nothing sent upstream`);
+                    }
+                }
                 if (!poolAccount) {
                     // Pool-exhausted fallback: when armed, the pool HAS accounts (all
                     // drained / cooling), and the client speaks OpenAI shape, defer —
@@ -2694,7 +2808,10 @@ export async function startProxy(opts = {}) {
                     // see, not traffic to quietly re-bill somewhere else.
                     const fallbackViable = poolFallbackModels.length > 0 && pool.size > 0;
                     if (!fallbackViable) {
-                        writePoolUnavailable();
+                        if (parkedUntil !== null)
+                            writePoolParked(parkedUntil);
+                        else
+                            writePoolUnavailable();
                         return false;
                     }
                 }
@@ -2757,8 +2874,11 @@ export async function startProxy(opts = {}) {
                         const v = JSON.parse(text);
                         if (v === null || typeof v !== 'object' || Array.isArray(v))
                             invalid = 'request body must be a JSON object';
-                        else
+                        else {
                             parsedBody = v;
+                            if (!consumer)
+                                consumer = consumerFromBody(parsedBody);
+                        }
                     }
                     catch (err) {
                         invalid = `request body is not valid JSON: ${err instanceof Error ? err.message : String(err)}`;
@@ -3055,6 +3175,7 @@ export async function startProxy(opts = {}) {
                             codexRequestCounts.set(o.alias, (codexRequestCounts.get(o.alias) ?? 0) + 1);
                             analytics.record({
                                 timestamp: Date.now(),
+                                consumer,
                                 account: o.alias,
                                 model: o.model || rawModel || 'codex',
                                 inputTokens: o.inputTokens, outputTokens: o.outputTokens,
@@ -3072,13 +3193,13 @@ export async function startProxy(opts = {}) {
                                 method: req.method ?? '', path: urlPath, model: o.model || rawModel || undefined,
                                 status: o.status, latency_ms: o.latencyMs, in_tokens: o.inputTokens, out_tokens: o.outputTokens,
                                 cache_read: o.cacheReadTokens, cache_create: o.cacheCreateTokens,
-                                claim: CODEX_CLAIM, bucket: 'subscription', account: o.alias, stream: o.stream,
+                                claim: CODEX_CLAIM, bucket: 'subscription', account: o.alias, consumer, stream: o.stream,
                             });
                             if (verbose)
                                 console.log(formatUsageLogLine(codexReq, {
                                     inputTokens: o.inputTokens, outputTokens: o.outputTokens,
                                     cacheReadTokens: o.cacheReadTokens, cacheCreateTokens: o.cacheCreateTokens,
-                                }));
+                                }, consumer));
                         }, 
                         // Cool codex on a rate limit only — a 5xx or an unreachable backend
                         // is an outage, and parking a provider for that would keep it out
@@ -3222,6 +3343,13 @@ export async function startProxy(opts = {}) {
             // would fall through to the Claude path with no account and an empty
             // bearer token, turning a clean 503 into a confusing upstream 401.
             if (!upstreamApiKey && !poolAccount) {
+                // A fallback was armed but nothing could serve, and the pool itself is
+                // parked: the exact reset beats a cool-down estimate (dario#1244).
+                const parkedNow = pool.parkedUntil();
+                if (parkedNow !== null) {
+                    writePoolParked(parkedNow);
+                    return;
+                }
                 // A chain where every entry is cooling is a rate limit, not a
                 // misconfiguration — say so in the machine-readable way, once.
                 if (allProvidersCooled(poolFallbackModels.length > 0 ? ['codex', 'claude'] : ['claude'], providerCooldowns)) {
@@ -3332,7 +3460,20 @@ export async function startProxy(opts = {}) {
                         // Rotating off mid-session costs cache-create on every turn.
                         stickyKey = computeStickyKey(userMsg);
                         if (stickyKey && !pinnedAccount) {
+                            // Shared state (pool-sync.ts): a conversation a peer instance
+                            // already bound lands on the same seat here, so its prompt
+                            // cache is read rather than rewritten. Only consulted when this
+                            // instance holds no binding of its own; a binding made here is
+                            // published for the peers.
+                            const hadLocalBinding = pool.stickyAliasFor(stickyKey) !== null;
+                            if (poolSync && !hadLocalBinding) {
+                                const peerAlias = await poolSync.lookupSticky(stickyKey);
+                                if (peerAlias)
+                                    pool.rebindSticky(stickyKey, peerAlias);
+                            }
                             const preferred = pool.selectSticky(stickyKey, modelFamily(requestModel));
+                            if (poolSync && preferred && !hadLocalBinding)
+                                poolSync.bindSticky(stickyKey, preferred.alias);
                             if (preferred && preferred.alias !== poolAccount?.alias) {
                                 poolAccount = preferred;
                                 accessToken = preferred.accessToken;
@@ -3746,6 +3887,14 @@ export async function startProxy(opts = {}) {
                     else {
                         pool.updateRateLimits(poolAccount.alias, snapshot);
                     }
+                    // Which organization answered (dario#1244). Held in the pool at
+                    // once; written to the seat's record by its next token refresh —
+                    // the write that already exists — so nothing here races a refresh.
+                    const organizationId = upstream.headers.get('anthropic-organization-id');
+                    if (organizationId)
+                        pool.noteOrganization(poolAccount.alias, organizationId);
+                    announceWindowPeers(poolAccount.alias);
+                    poolSync?.reportSeat(poolAccount.alias);
                     // First-sight detector for per-model rate-limit buckets. Anthropic
                     // ships these unannounced — e.g. `7d_sonnet-utilization` appeared
                     // around 2026-04-25 — and verbose-mode users want a heads-up the
@@ -4021,6 +4170,7 @@ export async function startProxy(opts = {}) {
                                 headers['Authorization'] = `Bearer ${accessToken}`;
                                 headers['x-claude-code-session-id'] = resolveOutboundSession(nextAccount, clientSessionKey).sessionId;
                                 pool.rebindSticky(stickyKey, nextAccount.alias);
+                                poolSync?.bindSticky(stickyKey, nextAccount.alias);
                                 peekedBody = null;
                                 continue dispatchLoop;
                             }
@@ -4068,6 +4218,7 @@ export async function startProxy(opts = {}) {
                             const rl = poolAccount?.rateLimit ?? parseRateLimits(upstream.headers);
                             analytics.record({
                                 timestamp: Date.now(),
+                                consumer,
                                 account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
                                 model: requestModel,
                                 inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0, thinkingTokens: 0,
@@ -4121,6 +4272,7 @@ export async function startProxy(opts = {}) {
                         headers['Authorization'] = `Bearer ${accessToken}`;
                         headers['x-claude-code-session-id'] = resolveOutboundSession(nextAccount, clientSessionKey).sessionId;
                         pool.rebindSticky(stickyKey, nextAccount.alias);
+                        poolSync?.bindSticky(stickyKey, nextAccount.alias);
                         continue dispatchLoop;
                     }
                     // No peer available — forward the saved generic-403 bytes when the
@@ -4154,6 +4306,7 @@ export async function startProxy(opts = {}) {
                             headers['Authorization'] = `Bearer ${accessToken}`;
                             headers['x-claude-code-session-id'] = resolveOutboundSession(nextAccount, clientSessionKey).sessionId;
                             pool.rebindSticky(stickyKey, nextAccount.alias);
+                            poolSync?.bindSticky(stickyKey, nextAccount.alias);
                             continue dispatchLoop;
                         }
                     }
@@ -4189,6 +4342,7 @@ export async function startProxy(opts = {}) {
                         const rl = poolAccount?.rateLimit ?? parseRateLimits(upstream.headers);
                         analytics.record({
                             timestamp: Date.now(),
+                            consumer,
                             account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
                             model: requestModel,
                             inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0, thinkingTokens: 0,
@@ -4446,6 +4600,7 @@ export async function startProxy(opts = {}) {
                     const rl = poolAccount?.rateLimit ?? parseRateLimits(upstream.headers);
                     analytics.record({
                         timestamp: Date.now(),
+                        consumer,
                         account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
                         model: requestModel,
                         inputTokens: streamInputTokens, outputTokens: streamOutputTokens,
@@ -4465,6 +4620,7 @@ export async function startProxy(opts = {}) {
                     claim: poolAccount?.rateLimit.claim,
                     bucket: poolAccount ? billingBucketFromClaim(poolAccount.rateLimit.claim) : undefined,
                     account: poolAccount?.alias,
+                    consumer,
                     client: detectedClientForLog,
                     preserve_tools: preserveToolsEffective,
                     stream: true,
@@ -4473,7 +4629,7 @@ export async function startProxy(opts = {}) {
                     console.log(formatUsageLogLine(requestCount, {
                         inputTokens: streamInputTokens, outputTokens: streamOutputTokens,
                         cacheReadTokens: streamCacheReadTokens, cacheCreateTokens: streamCacheCreateTokens,
-                    }));
+                    }, consumer));
             }
             else {
                 // Buffer and forward
@@ -4512,6 +4668,7 @@ export async function startProxy(opts = {}) {
                         const rl = poolAccount?.rateLimit ?? parseRateLimits(upstream.headers);
                         analytics.record({
                             timestamp: Date.now(),
+                            consumer,
                             account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
                             model: bufferedUsage.model || requestModel,
                             inputTokens: bufferedUsage.inputTokens, outputTokens: bufferedUsage.outputTokens,
@@ -4533,12 +4690,13 @@ export async function startProxy(opts = {}) {
                     claim: poolAccount?.rateLimit.claim,
                     bucket: poolAccount ? billingBucketFromClaim(poolAccount.rateLimit.claim) : undefined,
                     account: poolAccount?.alias,
+                    consumer,
                     client: detectedClientForLog,
                     preserve_tools: preserveToolsEffective,
                     stream: false,
                 });
                 if (verbose && bufferedUsage)
-                    console.log(formatUsageLogLine(requestCount, bufferedUsage));
+                    console.log(formatUsageLogLine(requestCount, bufferedUsage, consumer));
                 if (verbose)
                     console.log(`[dario] #${requestCount} ${upstream.status}`);
             }
@@ -4550,6 +4708,7 @@ export async function startProxy(opts = {}) {
                 ts: new Date().toISOString(), req: requestCount,
                 method: req.method ?? '', path: urlPath,
                 model: requestModel || undefined,
+                consumer,
                 client: detectedClientForLog,
                 preserve_tools: preserveToolsEffective,
             };
@@ -4590,7 +4749,7 @@ export async function startProxy(opts = {}) {
                 clearTimeout(upstreamTimeout);
             if (onClientClose !== null)
                 req.off('close', onClientClose);
-            queue.release();
+            queue.release(consumerFromHeaders);
         }
     });
     server.on('error', async (err) => {
@@ -4819,6 +4978,7 @@ export async function startProxy(opts = {}) {
         console.log('\n[dario] Shutting down...');
         clearInterval(presenceInterval);
         clearInterval(refreshInterval);
+        poolSync?.stop();
         if (logFileStream)
             logFileStream.end();
         // Flush tokens first (best-effort, bounded), then close the server. The

package/dist/request-queue.d.ts

@@ -52,6 +52,10 @@ export interface QueueState {
  */
 export interface QueueSnapshot extends QueueState {
     stalledSince: number | null;
+    /** Per-consumer in-flight ceiling (`--max-concurrent-per-consumer`); 0 = off. */
+    maxConcurrentPerConsumer: number;
+    /** Distinct consumers with a request in flight right now. */
+    consumersActive: number;
 }
 export type AdmitDecision = {
     action: 'admit';
@@ -63,6 +67,14 @@ export type AdmitDecision = {
 };
 /** Pure admission decision — no side effects, no clock dep. */
 export declare function decideAdmit(state: QueueState): AdmitDecision;
+/**
+ * Pure per-consumer gate (dario#1244 follow-up — a team gateway where one
+ * heavy user could hold every slot). A consumer already holding `cap` slots
+ * waits even when the queue has room: `enqueue` if it does, `reject` if
+ * not. Returns null when the gate does not apply (cap off, or the consumer
+ * is under it), so `decideAdmit` decides as before.
+ */
+export declare function decideConsumerAdmit(activeForConsumer: number, cap: number, state: QueueState): AdmitDecision | null;
 /** Pure timeout check — separated so tests can pass an explicit clock. */
 export declare function isQueueEntryExpired(enqueuedAt: number, now: number, timeoutMs: number): boolean;
 export declare class QueueFullError extends Error {
@@ -75,6 +87,13 @@ export interface RequestQueueOptions {
     maxConcurrent?: number;
     maxQueued?: number;
     queueTimeoutMs?: number;
+    /**
+     * In-flight ceiling per consumer (see `acquire(consumer)`). 0 / unset =
+     * off. A consumer at its cap waits in the queue; its waiters never block
+     * another consumer's — `release` admits the first waiter whose consumer
+     * is under the cap, not the first waiter.
+     */
+    maxConcurrentPerConsumer?: number;
     /**
      * Whether timeout timers are `unref`'d so they don't by themselves keep
      * the Node event loop alive. Default `true` — appropriate for the proxy,
@@ -95,8 +114,10 @@ export declare class RequestQueue {
     readonly maxConcurrent: number;
     readonly maxQueued: number;
     readonly queueTimeoutMs: number;
+    readonly maxConcurrentPerConsumer: number;
     readonly unrefTimers: boolean;
     private active;
+    private activeByConsumer;
     private queue;
     private readonly now;
     private stalledSince;
@@ -111,15 +132,24 @@ export declare class RequestQueue {
      * `release()` refreshes it, by clearing first (see there).
      */
     private updateStall;
+    /** A consumer is under its cap when there is no cap, no consumer, or room. */
+    private underCap;
+    private admit;
     /**
      * Acquire a concurrency slot. Resolves when admitted; throws
      * `QueueFullError` when the queue is at its `maxQueued` cap, throws
      * `QueueTimeoutError` when a queued request waited longer than
-     * `queueTimeoutMs`.
+     * `queueTimeoutMs`. `consumer` names who the request is for: with a
+     * per-consumer cap set, a consumer at its cap waits even while slots are
+     * free, and `release(consumer)` must be called with the same name.
+     */
+    acquire(consumer?: string): Promise<void>;
+    /**
+     * Release a slot. The first queued entry whose consumer is under its cap is
+     * admitted — FIFO among the admissible, so a capped consumer's waiters do
+     * not hold up anyone else's; they get in when that consumer releases.
      */
-    acquire(): Promise<void>;
-    /** Release a slot. The next queued entry (if any) is admitted in FIFO order. */
-    release(): void;
+    release(consumer?: string): void;
     /** Snapshot of queue state — exposed for /health + /analytics + tests. */
     snapshot(): QueueSnapshot;
 }