@askalf/dario 6.0.37 → 6.0.39

package/dist/accounts.d.ts

@@ -15,7 +15,26 @@ export interface AccountCredentials {
      * on a fresh grant.
      */
     organizationId?: string;
+    /**
+     * The Anthropic account uuid this grant belongs to, from the OAuth profile
+     * (`fetchOAuthProfile`) at grant time — or, for a record from before this
+     * field, on its next token refresh. THE fact that says whether two aliases
+     * are one subscription (dario#1244, #1263); everything else was inference.
+     */
+    accountId?: string;
+    /** Email on that account. Masked on every listing (`maskEmail`); stored whole. */
+    accountEmail?: string;
+    /** `organization.organization_type` / `rate_limit_tier` / `seat_tier` from the same profile. */
+    organizationType?: string;
+    rateLimitTier?: string;
+    seatTier?: string;
+    /**
+     * Where `deviceId`/`accountUuid` came from: the machine's Claude Code identity,
+     * or generated for this alias. Absent on records written before this field.
+     */
+    identityFrom?: IdentitySource;
 }
+export type IdentitySource = 'claude-code' | 'generated';
 export declare function listAccountAliases(): Promise<string[]>;
 export declare function loadAccount(alias: string): Promise<AccountCredentials | null>;
 export declare function loadAllAccounts(): Promise<AccountCredentials[]>;
@@ -37,8 +56,76 @@ export declare function detectClaudeIdentity(): Promise<{
     deviceId: string;
     accountUuid: string;
 } | null>;
+/**
+ * The OAuth profile behind an access token. This is what an Anthropic
+ * subscription token can say about itself, and dario never asked (#1263):
+ * the account uuid, its email, the organization uuid and tier fields. Probed
+ * 2026-09-08 with a live token — `account.uuid`, `account.email`,
+ * `organization.uuid`, `organization.rate_limit_tier`, `organization.seat_tier`
+ * are all present. Read-only, one GET, and it is the one fact that settles
+ * "are these two aliases the same subscription" without guessing.
+ */
+export declare const OAUTH_PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
+export interface OAuthProfile {
+    accountId: string;
+    accountEmail?: string;
+    organizationId?: string;
+    organizationType?: string;
+    rateLimitTier?: string;
+    seatTier?: string;
+}
+/**
+ * Fetch the profile for `accessToken`. Null on ANY failure — a non-2xx, a
+ * timeout, a body without an account uuid — because identity is a nicety
+ * layered on a grant that already succeeded; a profile outage must never
+ * turn a working login into a failed one.
+ */
+export declare function fetchOAuthProfile(accessToken: string, fetchImpl?: typeof fetch): Promise<OAuthProfile | null>;
+/** The record fields a profile fills in; nothing when there is no profile. */
+export declare function profileFields(profile: OAuthProfile | null): Partial<AccountCredentials>;
+/**
+ * Which client identity a NEW alias presents in `metadata.user_id`.
+ *
+ * Every add path used to copy the machine's Claude Code identity into every
+ * alias when one was installed. On a machine running a pool of colleagues'
+ * tokens that meant 18 different OAuth accounts all presenting ONE
+ * `device_id`/`account_uuid` (dario#1244, 2026-09-08) — and Anthropic ties what
+ * it sees to that identity (doctor-core.ts, identity drift: the bearer is
+ * cross-validated against it). The startup banner says as much: "requests
+ * may be billed as Extra Usage" without one.
+ *
+ * Rule: the local Claude Code identity belongs to the account it was granted
+ * to. A new alias takes it only when no other alias holds it, or when the
+ * holder is PROVEN to be the same account (same OAuth `accountId`). Otherwise
+ * the alias gets its own — the same fresh identity a machine without Claude
+ * Code has always produced, which the fleet box runs every seat on.
+ */
+export declare function chooseClientIdentity(existing: readonly AccountCredentials[], profile: OAuthProfile | null, local?: {
+    deviceId: string;
+    accountUuid: string;
+} | null): Promise<{
+    deviceId: string;
+    accountUuid: string;
+    identityFrom: IdentitySource;
+}>;
+/**
+ * Give each named alias its own client identity (`dario accounts identity
+ * --fresh`). Tokens, organization and account identity are untouched — only
+ * `deviceId`/`accountUuid` change, and the running proxy presents the new pair on
+ * the seat's next request (pool.add takes a changed on-disk identity).
+ * Returns the aliases rewritten; an unknown alias is skipped, not an error.
+ */
+export declare function regenerateClientIdentity(aliases: readonly string[]): Promise<string[]>;
 /** Refresh an account's OAuth token using dario's auto-detected CC OAuth config. */
 export declare function refreshAccountToken(creds: AccountCredentials): Promise<AccountCredentials>;
+/**
+ * Fill in `accountId` (and the profile's other fields) on a record that predates
+ * them, from one profile GET; saves and returns the record, unchanged when
+ * nothing could be learned. Kept OUT of the token refresh itself so the
+ * refresh stays a single, sequenced token exchange — a caller with a mocked
+ * or injected fetch sees exactly the calls it always did (dario#1263).
+ */
+export declare function backfillIdentity(creds: AccountCredentials, fetchImpl?: typeof fetch): Promise<AccountCredentials>;
 /** Test-only — inspect the in-flight map. Production code has no business peeking. */
 export declare function _accountRefreshesInFlightSizeForTest(): number;
 /**

package/dist/accounts.js

@@ -135,6 +135,125 @@ export async function detectClaudeIdentity() {
     }
     return null;
 }
+/**
+ * The OAuth profile behind an access token. This is what an Anthropic
+ * subscription token can say about itself, and dario never asked (#1263):
+ * the account uuid, its email, the organization uuid and tier fields. Probed
+ * 2026-09-08 with a live token — `account.uuid`, `account.email`,
+ * `organization.uuid`, `organization.rate_limit_tier`, `organization.seat_tier`
+ * are all present. Read-only, one GET, and it is the one fact that settles
+ * "are these two aliases the same subscription" without guessing.
+ */
+export const OAUTH_PROFILE_URL = 'https://api.anthropic.com/api/oauth/profile';
+/**
+ * Fetch the profile for `accessToken`. Null on ANY failure — a non-2xx, a
+ * timeout, a body without an account uuid — because identity is a nicety
+ * layered on a grant that already succeeded; a profile outage must never
+ * turn a working login into a failed one.
+ */
+export async function fetchOAuthProfile(accessToken, fetchImpl = fetch) {
+    try {
+        const res = await fetchImpl(OAUTH_PROFILE_URL, {
+            method: 'GET',
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: 'application/json',
+                'anthropic-beta': 'oauth-2025-04-20',
+            },
+            signal: AbortSignal.timeout(8_000),
+        });
+        if (!res.ok)
+            return null;
+        const data = await res.json();
+        const uuid = data.account?.uuid;
+        if (typeof uuid !== 'string' || uuid.length === 0)
+            return null;
+        const str = (v) => (typeof v === 'string' && v.length > 0 ? v : undefined);
+        const profile = { accountId: uuid };
+        const email = str(data.account?.email);
+        if (email)
+            profile.accountEmail = email;
+        const org = str(data.organization?.uuid);
+        if (org)
+            profile.organizationId = org;
+        const orgType = str(data.organization?.organization_type);
+        if (orgType)
+            profile.organizationType = orgType;
+        const tier = str(data.organization?.rate_limit_tier);
+        if (tier)
+            profile.rateLimitTier = tier;
+        const seat = str(data.organization?.seat_tier);
+        if (seat)
+            profile.seatTier = seat;
+        return profile;
+    }
+    catch {
+        return null;
+    }
+}
+/** The record fields a profile fills in; nothing when there is no profile. */
+export function profileFields(profile) {
+    if (!profile)
+        return {};
+    const out = { accountId: profile.accountId };
+    if (profile.accountEmail)
+        out.accountEmail = profile.accountEmail;
+    if (profile.organizationId)
+        out.organizationId = profile.organizationId;
+    if (profile.organizationType)
+        out.organizationType = profile.organizationType;
+    if (profile.rateLimitTier)
+        out.rateLimitTier = profile.rateLimitTier;
+    if (profile.seatTier)
+        out.seatTier = profile.seatTier;
+    return out;
+}
+/**
+ * Which client identity a NEW alias presents in `metadata.user_id`.
+ *
+ * Every add path used to copy the machine's Claude Code identity into every
+ * alias when one was installed. On a machine running a pool of colleagues'
+ * tokens that meant 18 different OAuth accounts all presenting ONE
+ * `device_id`/`account_uuid` (dario#1244, 2026-09-08) — and Anthropic ties what
+ * it sees to that identity (doctor-core.ts, identity drift: the bearer is
+ * cross-validated against it). The startup banner says as much: "requests
+ * may be billed as Extra Usage" without one.
+ *
+ * Rule: the local Claude Code identity belongs to the account it was granted
+ * to. A new alias takes it only when no other alias holds it, or when the
+ * holder is PROVEN to be the same account (same OAuth `accountId`). Otherwise
+ * the alias gets its own — the same fresh identity a machine without Claude
+ * Code has always produced, which the fleet box runs every seat on.
+ */
+export async function chooseClientIdentity(existing, profile, local) {
+    const cc = local === undefined ? await detectClaudeIdentity() : local;
+    if (cc && (cc.deviceId || cc.accountUuid)) {
+        const holder = existing.find((a) => a.deviceId === cc.deviceId && a.accountUuid === cc.accountUuid);
+        const sameAccount = holder !== undefined && profile !== null
+            && typeof holder.accountId === 'string' && holder.accountId === profile.accountId;
+        if (!holder || sameAccount)
+            return { deviceId: cc.deviceId, accountUuid: cc.accountUuid, identityFrom: 'claude-code' };
+    }
+    return { deviceId: randomUUID(), accountUuid: randomUUID(), identityFrom: 'generated' };
+}
+/**
+ * Give each named alias its own client identity (`dario accounts identity
+ * --fresh`). Tokens, organization and account identity are untouched — only
+ * `deviceId`/`accountUuid` change, and the running proxy presents the new pair on
+ * the seat's next request (pool.add takes a changed on-disk identity).
+ * Returns the aliases rewritten; an unknown alias is skipped, not an error.
+ */
+export async function regenerateClientIdentity(aliases) {
+    const done = [];
+    for (const alias of aliases) {
+        const acc = await loadAccount(alias);
+        if (!acc)
+            continue;
+        await saveAccount({ ...acc, deviceId: randomUUID(), accountUuid: randomUUID(), identityFrom: 'generated' });
+        done.push(alias);
+    }
+    return done;
+}
 // Per-alias single-flight map: if a refresh is in flight for an alias,
 // concurrent callers share the same promise instead of issuing parallel
 // refresh_token requests. The pool's 15-min background timer is the only
@@ -290,6 +409,23 @@ async function doRefreshAccountToken(creds) {
     await saveAccount(updated);
     return updated;
 }
+/**
+ * Fill in `accountId` (and the profile's other fields) on a record that predates
+ * them, from one profile GET; saves and returns the record, unchanged when
+ * nothing could be learned. Kept OUT of the token refresh itself so the
+ * refresh stays a single, sequenced token exchange — a caller with a mocked
+ * or injected fetch sees exactly the calls it always did (dario#1263).
+ */
+export async function backfillIdentity(creds, fetchImpl = fetch) {
+    if (creds.accountId)
+        return creds;
+    const profile = await fetchOAuthProfile(creds.accessToken, fetchImpl);
+    if (!profile)
+        return creds;
+    const updated = { ...creds, ...profileFields(profile) };
+    await saveAccount(updated);
+    return updated;
+}
 /** Test-only — inspect the in-flight map. Production code has no business peeking. */
 export function _accountRefreshesInFlightSizeForTest() {
     return accountRefreshesInFlight.size;
@@ -373,11 +509,11 @@ export async function addAccountViaOAuth(alias) {
                     throw new Error(`Token exchange failed (${tokenRes.status}): ${redactSecrets(body.slice(0, 200))}`);
                 }
                 const tokens = await tokenRes.json();
-                // Prefer CC identity if installed; otherwise generate fresh IDs.
-                const identity = (await detectClaudeIdentity()) ?? {
-                    deviceId: randomUUID(),
-                    accountUuid: randomUUID(),
-                };
+                // Who this token is (one GET, never fatal), then which client identity
+                // the alias presents — see chooseClientIdentity.
+                const profile = await fetchOAuthProfile(tokens.access_token);
+                const others = (await loadAllAccounts()).filter((a) => a.alias !== alias);
+                const identity = await chooseClientIdentity(others, profile);
                 const creds = {
                     alias,
                     accessToken: tokens.access_token,
@@ -386,7 +522,9 @@ export async function addAccountViaOAuth(alias) {
                     scopes: tokens.scope?.split(' ') ?? cfg.scopes.split(' '),
                     deviceId: identity.deviceId,
                     accountUuid: identity.accountUuid,
+                    identityFrom: identity.identityFrom,
                     grantedAt: Date.now(),
+                    ...profileFields(profile),
                 };
                 await saveAccount(creds);
                 resolve(creds);
@@ -510,10 +648,9 @@ export async function completeAddAccount(alias, code, codeVerifier, state) {
         throw new Error(`Token exchange failed (${tokenRes.status}): ${redactSecrets(body.slice(0, 200))}`);
     }
     const tokens = await tokenRes.json();
-    const identity = (await detectClaudeIdentity()) ?? {
-        deviceId: randomUUID(),
-        accountUuid: randomUUID(),
-    };
+    const profile = await fetchOAuthProfile(tokens.access_token);
+    const others = (await loadAllAccounts()).filter((a) => a.alias !== alias);
+    const identity = await chooseClientIdentity(others, profile);
     const creds = {
         alias,
         accessToken: tokens.access_token,
@@ -522,7 +659,9 @@ export async function completeAddAccount(alias, code, codeVerifier, state) {
         scopes: tokens.scope?.split(' ') ?? cfg.scopes.split(' '),
         deviceId: identity.deviceId,
         accountUuid: identity.accountUuid,
+        identityFrom: identity.identityFrom,
         grantedAt: Date.now(),
+        ...profileFields(profile),
     };
     await saveAccount(creds);
     return creds;
@@ -583,12 +722,10 @@ export async function addAccountFromKeychain(alias, target) {
     if (!oauth?.accessToken || !oauth?.refreshToken) {
         throw new KeychainImportError(`Keychain entry "${chosen.target}" is missing accessToken/refreshToken — re-authenticate Claude Code.`, 'empty');
     }
-    // Same identity preference as addAccountViaOAuth — prefer CC identity if
-    // installed; otherwise generate fresh IDs.
-    const identity = (await detectClaudeIdentity()) ?? {
-        deviceId: randomUUID(),
-        accountUuid: randomUUID(),
-    };
+    // Same profile-and-policy as addAccountViaOAuth — see chooseClientIdentity.
+    const profile = await fetchOAuthProfile(oauth.accessToken);
+    const others = (await loadAllAccounts()).filter((a) => a.alias !== alias);
+    const identity = await chooseClientIdentity(others, profile);
     const creds = {
         alias,
         accessToken: oauth.accessToken,
@@ -597,7 +734,9 @@ export async function addAccountFromKeychain(alias, target) {
         scopes: oauth.scopes ?? ['user:inference'],
         deviceId: identity.deviceId,
         accountUuid: identity.accountUuid,
+        identityFrom: identity.identityFrom,
         grantedAt: oauth.grantedAt,
+        ...profileFields(profile),
     };
     await saveAccount(creds);
     return creds;
@@ -645,10 +784,12 @@ export async function ensureLoginCredentialsInPool(alias = MIGRATED_LOGIN_ALIAS)
     const tok = creds?.claudeAiOauth;
     if (!tok?.accessToken || !tok?.refreshToken)
         return null;
-    const identity = (await detectClaudeIdentity()) ?? {
-        deviceId: randomUUID(),
-        accountUuid: randomUUID(),
-    };
+    // The login seat IS the machine's Claude Code account, so its identity is
+    // the local one when there is one — the policy in chooseClientIdentity
+    // exists for the OTHER aliases.
+    const cc = await detectClaudeIdentity();
+    const identity = cc ?? { deviceId: randomUUID(), accountUuid: randomUUID() };
+    const profile = await fetchOAuthProfile(tok.accessToken);
     await saveAccount({
         alias,
         accessToken: tok.accessToken,
@@ -657,7 +798,9 @@ export async function ensureLoginCredentialsInPool(alias = MIGRATED_LOGIN_ALIAS)
         scopes: tok.scopes ?? [],
         deviceId: identity.deviceId,
         accountUuid: identity.accountUuid,
+        identityFrom: cc ? 'claude-code' : 'generated',
         grantedAt: tok.grantedAt,
+        ...profileFields(profile),
     });
     return alias;
 }

package/dist/admin-api.d.ts

@@ -115,8 +115,21 @@ export interface AdminAccountLive {
     lastRejectedAt: number | null;
     /** Organization observed on this seat's responses, or `null` if none yet (dario#1244). */
     organizationId: string | null;
-    /** Other aliases whose last reading names the same live window — one subscription under several aliases. */
+    /**
+     * Other aliases that are the SAME Anthropic account (same OAuth account
+     * uuid) — one subscription under several aliases (dario#1244). Kept under
+     * its original name for readers of the older payload; `sameAccountAs` is the
+     * same list. Until 6.0.38 this was inferred from a shared reset second,
+     * which Anthropic's 20-minute reset grid makes meaningless (dario#1263).
+     */
     sharesWindowWith: string[];
+    sameAccountAs?: string[];
+    /** OAuth account uuid behind the seat's token, or null until identified. */
+    accountId?: string | null;
+    /** Masked email on that account, or null. */
+    accountEmail?: string | null;
+    rateLimitTier?: string | null;
+    seatTier?: string | null;
     /** Peer instance whose reading this seat currently carries (shared pool state), or `null` for this instance's own. */
     readingFrom: string | null;
     /**

package/dist/admin-api.js

@@ -1,3 +1,4 @@
+import { maskEmail } from './pool.js';
 import { timingSafeEqual } from 'node:crypto';
 import { startAddAccount, completeAddAccount, removeAccount, listAccountAliases, loadAccount, } from './accounts.js';
 import { parseManualPaste } from './oauth.js';
@@ -362,6 +363,10 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
                     // From the record (written with the seat's last token refresh), so
                     // it is known without a live pool entry.
                     organization_id: r.organizationId ?? null,
+                    // Identity from the record (grant-time OAuth profile); the live
+                    // block below repeats it when the seat is in the running pool.
+                    account_id: r.accountId ?? null,
+                    account_email: maskEmail(r.accountEmail),
                     // Inline the running pool's live status when this account is in it.
                     ...(l ? {
                         util5h: l.util5h,
@@ -375,6 +380,11 @@ export async function handleAdminRequest(req, res, urlPath, deps) {
                         reset_in_ms: l.resetInMs ?? null,
                         ...(l.organizationId ? { organization_id: l.organizationId } : {}),
                         shares_window_with: l.sharesWindowWith ?? [],
+                        same_account_as: l.sameAccountAs ?? l.sharesWindowWith ?? [],
+                        ...(l.accountId ? { account_id: l.accountId } : {}),
+                        ...(l.accountEmail ? { account_email: l.accountEmail } : {}),
+                        ...(l.rateLimitTier ? { rate_limit_tier: l.rateLimitTier } : {}),
+                        ...(l.seatTier ? { seat_tier: l.seatTier } : {}),
                         reading_from: l.readingFrom ?? null,
                         claim: l.claim,
                         status: l.status,

package/dist/anthropic-responses-translate.d.ts

@@ -221,7 +221,14 @@ export type ResponsesToolChoice = 'auto' | 'none' | 'required' | {
     name: string;
 };
 export interface ResponsesReasoningConfig {
-    effort?: 'low' | 'medium' | 'high';
+    /**
+     * The backend accepts more levels than the thinking-budget mapping can
+     * produce: probed 2026-08-29 against a live account, `none, minimal, low,
+     * medium, high, xhigh, max` are all valid and `ultra` 400s. The wider set
+     * is reachable only when a caller names an effort outright (dario#1260);
+     * `thinkingToReasoningEffort` still only ever yields low/medium/high.
+     */
+    effort?: 'none' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh' | 'max';
     summary?: 'auto' | 'concise' | 'detailed';
 }
 export interface ResponsesRequest {
@@ -338,9 +345,13 @@ export interface ResponsesResponse {
  * (max_output_tokens caps reasoning + output combined on the Responses API).
  */
 export declare const REASONING_HEADROOM: {
+    readonly none: 0;
+    readonly minimal: 6000;
     readonly low: 12000;
     readonly medium: 25000;
     readonly high: 50000;
+    readonly xhigh: 80000;
+    readonly max: 120000;
 };
 /** gpt-5.x / o-series output ceiling (tokens). */
 export declare const RESPONSES_MAX_OUTPUT_CAP = 128000;
@@ -352,6 +363,14 @@ export interface AnthropicToResponsesOptions {
      * Pass `null` to omit `summary` entirely.
      */
     reasoningSummary?: 'auto' | 'concise' | 'detailed' | null;
+    /**
+     * Force `reasoning.effort`, overriding whatever `thinking.budget_tokens`
+     * would have implied. Set from a model-name effort suffix on the Codex
+     * route (dario#1260, `gpt-5.6-terra:high`), which is the only way an
+     * Anthropic-shape caller can choose an effort the budget thresholds cannot
+     * express. Unset means the existing thinking-derived behaviour, unchanged.
+     */
+    effort?: ResponsesReasoningConfig['effort'];
     /**
      * `store`. Default false — dario is stateless and keeps no server-side
      * conversation. Set true only if a caller wants OpenAI-side retention.

package/dist/anthropic-responses-translate.js

@@ -312,7 +312,17 @@ function translateToolChoice(choice) {
  * client's intended visible-output budget survives on a reasoning model
  * (max_output_tokens caps reasoning + output combined on the Responses API).
  */
-export const REASONING_HEADROOM = { low: 12000, medium: 25000, high: 50000 };
+export const REASONING_HEADROOM = {
+    none: 0, minimal: 6000, low: 12000, medium: 25000, high: 50000,
+    // dario#1260 widened the reachable levels beyond what the thinking-budget
+    // mapping produces. xhigh and max reason MUCH harder — measured through
+    // dario on one identical prompt, same model, only the level changing:
+    // low 1,982 output tokens, high 3,947, max 11,160. Reserve above the trend
+    // rather than on it: under-reserving is the failure this table exists to
+    // prevent (reasoning eats the whole budget, status incomplete, empty turn),
+    // and both values are clamped by RESPONSES_MAX_OUTPUT_CAP anyway.
+    xhigh: 80000, max: 120000,
+};
 /** gpt-5.x / o-series output ceiling (tokens). */
 export const RESPONSES_MAX_OUTPUT_CAP = 128000;
 /**
@@ -376,7 +386,10 @@ export function anthropicToResponsesRequest(body, targetModel, options = {}) {
     if (body.tool_choice?.disable_parallel_tool_use === true && out.tools) {
         out.parallel_tool_calls = false;
     }
-    const effort = thinkingToReasoningEffort(body.thinking);
+    // An explicitly named effort wins over the thinking-budget mapping: the
+    // caller asked for a level, not a budget, and the thresholds cannot express
+    // xhigh or max at all.
+    const effort = options.effort ?? thinkingToReasoningEffort(body.thinking);
     if (effort) {
         out.reasoning = { effort };
         const summary = options.reasoningSummary === undefined ? 'auto' : options.reasoningSummary;

package/dist/cli.d.ts

@@ -130,6 +130,9 @@ export interface LiveSeat {
     organizationId?: string | null;
     sharesWindowWith?: string[];
     grantedAt?: number | null;
+    sameAccountAs?: string[];
+    accountId?: string | null;
+    accountEmail?: string | null;
 }
 export interface LivePayload {
     mode?: string;
@@ -165,3 +168,11 @@ export declare function formatLiveAccountsListing(payload: LivePayload, port: nu
  * guard from #137 (v3.31.15).
  */
 export declare function isMainEntry(argv1: string | undefined | null, moduleHref: string, realpath?: (p: string) => string): boolean;
+/**
+ * `dario accounts identity` — which client identity each seat presents in
+ * `metadata.user_id`, where it came from, and which seats share one across
+ * DIFFERENT accounts (dario#1244, 2026-09-08). `--fresh <alias>...` / `--all`
+ * rewrites the named seats' identity; the running proxy presents the new one
+ * on each seat's next request, no restart.
+ */
+export declare function runAccountsIdentity(args: string[]): Promise<void>;

package/dist/cli.js

@@ -17,6 +17,8 @@
 // just want `parsePositiveIntEnv`) doesn't trigger a Bun relaunch or any
 // other startup side effect.
 import { unlink } from 'node:fs/promises';
+import { loadAllAccounts as loadAllAccountsForIdentity, regenerateClientIdentity } from './accounts.js';
+import { maskEmail } from './pool.js';
 import { realpathSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
@@ -915,7 +917,7 @@ export function formatLiveAccountsListing(payload, port, now) {
     lines.push('  ────────────────');
     lines.push('');
     const windows = typeof payload.distinctWindows === 'number' ? payload.distinctWindows : seats.length;
-    lines.push(`  Pool of ${seats.length} (${seats.length === 1 ? '1 seat' : seats.length + ' seats'} on ${windows} distinct window${windows === 1 ? '' : 's'})`);
+    lines.push(`  Pool of ${seats.length} (${seats.length === 1 ? '1 seat' : seats.length + ' seats'} on ${windows} distinct account${windows === 1 ? '' : 's'})`);
     lines.push('');
     for (const s of seats) {
         const alias = typeof s.alias === 'string' ? s.alias : '(unnamed)';
@@ -932,7 +934,11 @@ export function formatLiveAccountsListing(payload, port, now) {
             `429s ${num(s.rejectedCount)}`,
             ...(next ? [next] : []),
             typeof s.organizationId === 'string' && s.organizationId ? `org ${s.organizationId.slice(0, 8)}…` : 'org not yet observed',
-            ...(Array.isArray(s.sharesWindowWith) && s.sharesWindowWith.length > 0 ? [`shares its window with ${s.sharesWindowWith.join(', ')}`] : []),
+            ...(typeof s.accountEmail === 'string' && s.accountEmail ? [`account ${s.accountEmail}`] : []),
+            ...((() => {
+                const same = Array.isArray(s.sameAccountAs) ? s.sameAccountAs : Array.isArray(s.sharesWindowWith) ? s.sharesWindowWith : [];
+                return same.length > 0 ? [`same account as ${same.join(', ')}`] : [];
+            })()),
         ];
         lines.push(`    ${''.padEnd(20)} ${facts.join('  ·  ')}`);
         lines.push(`    ${''.padEnd(20)} ${describeGrantAge(grantAge(typeof s.grantedAt === 'number' ? s.grantedAt : undefined, now))}`);
@@ -1232,8 +1238,12 @@ async function accounts() {
         }
         return;
     }
+    if (sub === 'identity') {
+        await runAccountsIdentity(args);
+        return;
+    }
     console.error(`[dario] Unknown accounts subcommand: ${sub}`);
-    console.error('Usage: dario accounts [list|add <alias>|check <alias>|remove <alias>]');
+    console.error('Usage: dario accounts [list|add <alias>|check <alias>|remove <alias>|identity [--fresh <alias>...|--all]]');
     process.exit(1);
 }
 /**
@@ -2571,3 +2581,70 @@ if (isDirectEntry) {
         process.exit(1);
     });
 }
+/**
+ * `dario accounts identity` — which client identity each seat presents in
+ * `metadata.user_id`, where it came from, and which seats share one across
+ * DIFFERENT accounts (dario#1244, 2026-09-08). `--fresh <alias>...` / `--all`
+ * rewrites the named seats' identity; the running proxy presents the new one
+ * on each seat's next request, no restart.
+ */
+export async function runAccountsIdentity(args) {
+    const fresh = args.includes('--fresh');
+    const all = args.includes('--all');
+    const named = args.slice(2).filter((a) => !a.startsWith('--'));
+    const accounts = await loadAllAccountsForIdentity();
+    if (fresh) {
+        const targets = all ? accounts.map((a) => a.alias) : named;
+        if (targets.length === 0) {
+            console.error('');
+            console.error('  Usage: dario accounts identity --fresh <alias> [<alias>...]   or   --fresh --all');
+            console.error('');
+            process.exit(1);
+        }
+        const done = await regenerateClientIdentity(targets);
+        for (const alias of done)
+            console.log(`[dario] "${alias}": fresh client identity written — the running proxy presents it on the seat's next request.`);
+        const missing = targets.filter((t) => !done.includes(t));
+        for (const alias of missing)
+            console.error(`[dario] No account "${alias}" found.`);
+        if (missing.length > 0)
+            process.exit(1);
+        return;
+    }
+    console.log('');
+    console.log('  dario — Client identity per seat');
+    console.log('  ────────────────');
+    console.log('');
+    const byIdentity = new Map();
+    for (const a of accounts) {
+        const k = `${a.deviceId}|${a.accountUuid}`;
+        const list = byIdentity.get(k);
+        if (list)
+            list.push(a.alias);
+        else
+            byIdentity.set(k, [a.alias]);
+    }
+    for (const a of accounts) {
+        const source = a.identityFrom ?? (a.deviceId ? 'unrecorded' : 'none');
+        const who = a.accountEmail ? maskEmail(a.accountEmail) : a.accountId ? `${a.accountId.slice(0, 8)}…` : 'not yet identified';
+        const shared = (byIdentity.get(`${a.deviceId}|${a.accountUuid}`) ?? []).filter((x) => x !== a.alias);
+        const sharedNote = shared.length > 0 ? `  ·  same client identity as ${shared.join(', ')}` : '';
+        console.log(`    ${a.alias.padEnd(20)} identity ${source.padEnd(11)} device ${(a.deviceId || '(empty)').slice(0, 8)}…  account ${who}${sharedNote}`);
+    }
+    const spanning = [...byIdentity.values()].filter((aliases) => {
+        if (aliases.length < 2)
+            return false;
+        const ids = new Set(aliases.map((al) => accounts.find((a) => a.alias === al)?.accountId));
+        return ids.size > 1 || ids.has(undefined);
+    });
+    console.log('');
+    if (spanning.length > 0) {
+        console.log(`  ⚠ ${spanning.length} client identit${spanning.length === 1 ? 'y is' : 'ies are'} shared across different (or unidentified) accounts.`);
+        console.log('    Anthropic ties usage and limits to the identity it sees. Give each seat its own:');
+        console.log(`      dario accounts identity --fresh ${spanning.flat().join(' ')}`);
+    }
+    else {
+        console.log('  OK every seat presents its own client identity, or shares one only with the same account.');
+    }
+    console.log('');
+}

package/dist/codex-backend.d.ts

@@ -1,7 +1,8 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { CodexAccountCredentials } from './codex-accounts.js';
-import { type ResponsesUsage } from './anthropic-responses-translate.js';
+import { type ResponsesReasoningConfig, type ResponsesUsage } from './anthropic-responses-translate.js';
 import { type ModelResolver, type ClaudeTarget } from './claude-model.js';
+import { type EffortValue } from './effort.js';
 export declare const CODEX_BACKEND_BASE_URL: string;
 /**
  * Client version sent on the model-discovery call. The backend REQUIRES the
@@ -72,7 +73,13 @@ export declare function isCodexModel(model: string, slugs: readonly string[]): b
  * own. A single-entry chain keeps the pre-6.0 meaning exactly, so configs
  * written before this release behave identically.
  */
-export declare function pickCodexFallback(models: readonly string[], slugs: readonly string[]): string | null;
+export interface CodexTarget {
+    /** The slug as the account lists it — what goes in the outbound body. */
+    model: string;
+    /** Effort the entry declared through a `:high`-style suffix, if any. */
+    effort?: EffortValue;
+}
+export declare function pickCodexFallback(models: readonly string[], slugs: readonly string[]): CodexTarget | null;
 export declare function pickClaudeFallback(models: readonly string[], slugs: readonly string[], bases?: readonly string[], resolve?: ModelResolver): string | null;
 /**
  * {@link pickClaudeFallback} with the effort the winning entry asked for.
@@ -276,4 +283,10 @@ export declare function buildCodexHeaders(creds: CodexAccountCredentials): Recor
  * testable without network (test/codex-backend.mjs), matching the pattern
  * test/codex-oauth.mjs already uses.
  */
-export declare function forwardToCodex(req: IncomingMessage, res: ServerResponse, body: Buffer, creds: CodexAccountCredentials, corsOrigin: string, securityHeaders: Record<string, string>, upstreamTimeoutMs: number, verbose: boolean, shape?: CodexRequestShape, fetchImpl?: typeof fetch, deferOnUnavailable?: boolean, onDone?: (outcome: CodexForwardOutcome) => void, onDecline?: (info: CodexDecline) => void): Promise<boolean>;
+export declare function forwardToCodex(req: IncomingMessage, res: ServerResponse, body: Buffer, creds: CodexAccountCredentials, corsOrigin: string, securityHeaders: Record<string, string>, upstreamTimeoutMs: number, verbose: boolean, shape?: CodexRequestShape, fetchImpl?: typeof fetch, deferOnUnavailable?: boolean, onDone?: (outcome: CodexForwardOutcome) => void, onDecline?: (info: CodexDecline) => void, 
+/**
+ * Effort named by a model-name suffix (dario#1260). Anthropic-shape only:
+ * a chat/completions caller sets `reasoning_effort` itself and that already
+ * translates. Undefined leaves the request exactly as it was.
+ */
+effort?: ResponsesReasoningConfig['effort']): Promise<boolean>;