@askalf/dario 6.0.37 → 6.0.39

package/dist/proxy.js

@@ -12,7 +12,8 @@ import { darioVersion } from './version.js';
 import { buildCCRequest, applyCcPromptCaching, isGenuineCCClient, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, forwardClientCCIdentityHeaders, isMcpToolName, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
 import { stampCch, hasCchSeed } from './cch.js';
 import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion } from './live-fingerprint.js';
-import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, reconcilePoolAccounts, resolvePoolStrategy, utilFreshness, rateLimitWindow, describeRateLimitSnapshot, windowPeers, distinctWindows, accountAction } from './pool.js';
+import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, reconcilePoolAccounts, resolvePoolStrategy, utilFreshness, rateLimitWindow, accountAction, accountPeers, distinctAccounts, describeRejection, maskEmail } from './pool.js';
+import { backfillIdentity } from './accounts.js';
 import { PoolSync, DEFAULT_POOL_SYNC_INTERVAL_MS } from './pool-sync.js';
 import { Analytics, billingBucketFromClaim, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, CODEX_CLAIM } from './analytics.js';
 import { OverageGuard, buildHaltErrorBody } from './overage-guard.js';
@@ -23,7 +24,8 @@ import { loadAllAccounts, loadAccount, saveAccount, refreshAccountToken, resyncL
 import { handleAdminRequest } from './admin-api.js';
 import { createTokenBucket } from './rate-limit.js';
 import { getOpenAIBackend, isOpenAIModel, forwardToOpenAI } from './openai-backend.js';
-import { forwardToCodex, getCodexModelSlugs, peekCodexModelSlugs, pickCodexFallback, pickClaudeTarget, CODEX_BACKEND_BASE_URL } from './codex-backend.js';
+import { forwardToCodex, getCodexModelSlugs, peekCodexModelSlugs, isCodexModel, pickCodexFallback, pickClaudeTarget, CODEX_BACKEND_BASE_URL } from './codex-backend.js';
+import { effortForCodex } from './effort.js';
 import { isClaudeServableModel } from './claude-model.js';
 import { MODEL_UNROUTABLE } from './upstream-rejection.js';
 import { readCompareTarget, teeResponse, runCompare, writeCompareRecord, COMPARE_RESULT_HEADER } from './compare.js';
@@ -1329,22 +1331,23 @@ export async function startProxy(opts = {}) {
     const accountsList = await loadAllAccounts();
     const poolStrategy = resolvePoolStrategy(opts.poolStrategy);
     const pool = new AccountPool(poolStrategy);
-    // Two aliases reporting one window are one subscription counted twice
-    // (dario#1244). Said once per pair, when the second reading arrives; the
-    // listings carry it permanently as `sharesWindowWith`.
-    const announcedWindowPairs = new Set();
-    const announceWindowPeers = (alias) => {
-        const now = Date.now();
-        const seat = pool.get(alias);
-        if (!seat)
-            return;
-        for (const peer of windowPeers(pool.all(), now).get(alias) ?? []) {
-            const pair = [alias, peer].sort().join('|');
-            if (announcedWindowPairs.has(pair))
-                continue;
-            announcedWindowPairs.add(pair);
-            const windows = distinctWindows(pool.all(), now);
-            console.error(`[dario] seats "${alias}" and "${peer}" report the same ${seat.rateLimit.claim} window (resets ${new Date(seat.rateLimit.reset * 1000).toISOString()}) — one subscription under two aliases; the pool has ${windows} distinct window${windows === 1 ? '' : 's'} across ${pool.size} seats`);
+    // Two aliases that are one account (same OAuth account uuid) are one
+    // subscription counted twice (dario#1244). Said once per pair, from what the
+    // records know at load and after any reconcile; the listings carry it
+    // permanently as `sameAccountAs` / `sharesWindowWith`. Identity, not the
+    // reset-second inference this replaced (dario#1263).
+    const announcedAccountPairs = new Set();
+    const announceSameAccounts = () => {
+        const peers = accountPeers(pool.all());
+        for (const seat of pool.all()) {
+            for (const peer of peers.get(seat.alias) ?? []) {
+                const pair = [seat.alias, peer].sort().join('|');
+                if (announcedAccountPairs.has(pair))
+                    continue;
+                announcedAccountPairs.add(pair);
+                const who = seat.accountEmail ? ` (${maskEmail(seat.accountEmail)})` : '';
+                console.error(`[dario] seats "${seat.alias}" and "${peer}" are the same account${who} — one subscription under two aliases; ${distinctAccounts(pool.all())} distinct accounts across ${pool.size} seats`);
+            }
         }
     };
     // Shared pool state across instances (docs/multi-instance.md): opt-in,
@@ -1436,8 +1439,13 @@ export async function startProxy(opts = {}) {
                 accountUuid: acc.accountUuid,
                 grantedAt: acc.grantedAt,
                 organizationId: acc.organizationId,
+                accountId: acc.accountId,
+                accountEmail: acc.accountEmail,
+                rateLimitTier: acc.rateLimitTier,
+                seatTier: acc.seatTier,
             });
         }
+        announceSameAccounts();
         // Startup self-heal (dario#790): eagerly refresh any account whose access
         // token is already expired or within the 45-min refresh window BEFORE the
         // proxy starts serving. On a container recreate after >8h uptime the
@@ -1460,6 +1468,22 @@ export async function startProxy(opts = {}) {
                     // observed on (dario#1244) — the one write that touches the record.
                     const refreshed = await refreshAccountToken(withObservedOrganization(saved, acc.organizationId));
                     pool.updateTokens(acc.alias, refreshed.accessToken, refreshed.refreshToken, refreshed.expiresAt);
+                    // Identity back-fill (dario#1263): a record from before accountId learns
+                    // who it is on its first refresh under this release — one GET through
+                    // this proxy's fetch, never fatal — and the running seat is reconciled so
+                    // the listings and the same-account line know at once.
+                    if (!refreshed.accountId) {
+                        const identified = await backfillIdentity(refreshed, fetch).catch(() => null);
+                        if (identified?.accountId) {
+                            pool.add(acc.alias, {
+                                accessToken: identified.accessToken, refreshToken: identified.refreshToken, expiresAt: identified.expiresAt,
+                                deviceId: identified.deviceId, accountUuid: identified.accountUuid, grantedAt: identified.grantedAt,
+                                organizationId: identified.organizationId, accountId: identified.accountId, accountEmail: identified.accountEmail,
+                                rateLimitTier: identified.rateLimitTier, seatTier: identified.seatTier,
+                            });
+                            announceSameAccounts();
+                        }
+                    }
                     // Mirror a refreshed `login` token back to credentials.json so the
                     // legacy file (and `dario doctor`) tracks the pool store (#808).
                     await mirrorLoginToCredentials(refreshed).catch((err) => {
@@ -1514,6 +1538,22 @@ export async function startProxy(opts = {}) {
                     // observed on (dario#1244) — the one write that touches the record.
                     const refreshed = await refreshAccountToken(withObservedOrganization(saved, acc.organizationId));
                     pool.updateTokens(acc.alias, refreshed.accessToken, refreshed.refreshToken, refreshed.expiresAt);
+                    // Identity back-fill (dario#1263): a record from before accountId learns
+                    // who it is on its first refresh under this release — one GET through
+                    // this proxy's fetch, never fatal — and the running seat is reconciled so
+                    // the listings and the same-account line know at once.
+                    if (!refreshed.accountId) {
+                        const identified = await backfillIdentity(refreshed, fetch).catch(() => null);
+                        if (identified?.accountId) {
+                            pool.add(acc.alias, {
+                                accessToken: identified.accessToken, refreshToken: identified.refreshToken, expiresAt: identified.expiresAt,
+                                deviceId: identified.deviceId, accountUuid: identified.accountUuid, grantedAt: identified.grantedAt,
+                                organizationId: identified.organizationId, accountId: identified.accountId, accountEmail: identified.accountEmail,
+                                rateLimitTier: identified.rateLimitTier, seatTier: identified.seatTier,
+                            });
+                            announceSameAccounts();
+                        }
+                    }
                     // Mirror a refreshed `login` token back to credentials.json so the
                     // legacy file (and `dario doctor`) tracks the pool store (#808).
                     await mirrorLoginToCredentials(refreshed).catch((err) => {
@@ -1558,7 +1598,12 @@ export async function startProxy(opts = {}) {
                     accountUuid: acc.accountUuid,
                     grantedAt: acc.grantedAt,
                     organizationId: acc.organizationId,
+                    accountId: acc.accountId,
+                    accountEmail: acc.accountEmail,
+                    rateLimitTier: acc.rateLimitTier,
+                    seatTier: acc.seatTier,
                 });
+                announceSameAccounts();
             }
         }
     }
@@ -1945,9 +1990,10 @@ export async function startProxy(opts = {}) {
             return false;
         }
         const slugs = await getCodexModelSlugs(creds).catch(() => []);
-        const fallbackModel = pickCodexFallback(fallbackModels, slugs);
-        if (!fallbackModel)
+        const fallbackPick = pickCodexFallback(fallbackModels, slugs);
+        if (!fallbackPick)
             return false;
+        const fallbackModel = fallbackPick.model;
         const fallbackBody = buildPoolFallbackBody(body, fallbackModel);
         if (!fallbackBody)
             return false;
@@ -1969,7 +2015,12 @@ export async function startProxy(opts = {}) {
         // an outage, not quota — cooling it would park a provider that may be
         // back on the next request, which is the opposite of the fix.
         (d) => { if (d.status === 429)
-            providerCooldowns.note('codex', d.retryAfterMs); });
+            providerCooldowns.note('codex', d.retryAfterMs); }, 
+        // The mirror of the Claude side (dario#1161): an operator who writes
+        // `--pool-fallback=gpt-5.6-terra:high` is choosing the effort the
+        // failover runs at, so the entry's own suffix reaches the request rather
+        // than the failover quietly running at the backend default.
+        effortForCodex(fallbackPick.effort));
         if (served)
             providerCooldowns.clear('codex');
         return served;
@@ -2140,7 +2191,7 @@ export async function startProxy(opts = {}) {
                 // just persisted metadata — the same snapshot GET /accounts exposes.
                 poolStatus: () => {
                     const snapNow = Date.now();
-                    const peers = windowPeers(pool.all(), snapNow);
+                    const peers = accountPeers(pool.all());
                     const snap = new Map();
                     for (const a of pool.all()) {
                         snap.set(a.alias, {
@@ -2159,6 +2210,11 @@ export async function startProxy(opts = {}) {
                             lastRejectedAt: a.lastRejectedAt ?? null,
                             organizationId: a.organizationId ?? null,
                             sharesWindowWith: peers.get(a.alias) ?? [],
+                            sameAccountAs: peers.get(a.alias) ?? [],
+                            accountId: a.accountId ?? null,
+                            accountEmail: maskEmail(a.accountEmail),
+                            rateLimitTier: a.rateLimitTier ?? null,
+                            seatTier: a.seatTier ?? null,
                             readingFrom: a.adoptedFrom ?? null,
                             // Raw streak, not just the cooldown boolean: a single 401 also
                             // shows `auth-cooldown` for 60s, indistinguishable from a
@@ -2231,7 +2287,7 @@ export async function startProxy(opts = {}) {
         // the `dario accounts` CLI, not HTTP.
         if (urlPath === '/accounts' && req.method === 'GET') {
             const now = Date.now();
-            const peers = windowPeers(pool.all(), now);
+            const peers = accountPeers(pool.all());
             const accounts = pool.all().map(a => {
                 const inCooldown = isInAuthCooldown(a, now);
                 const cooldownMs = inCooldown && a.lastAuthFailureAt
@@ -2269,11 +2325,17 @@ export async function startProxy(opts = {}) {
                     // parked seat no longer reads as one that was never called.
                     rejectedCount: a.rejectedCount,
                     lastRejectedAt: a.lastRejectedAt ?? null,
-                    // Which organization the token belongs to, and which other seats
-                    // report the same live window — one subscription under several
-                    // aliases (dario#1244).
+                    // Which organization the token belongs to, who the token IS (OAuth
+                    // account uuid, masked email), and which other seats are the same
+                    // account — one subscription under several aliases (dario#1244,
+                    // #1263: identity, not a shared reset second).
                     organizationId: a.organizationId ?? null,
                     sharesWindowWith: peers.get(a.alias) ?? [],
+                    sameAccountAs: peers.get(a.alias) ?? [],
+                    accountId: a.accountId ?? null,
+                    accountEmail: maskEmail(a.accountEmail),
+                    rateLimitTier: a.rateLimitTier ?? null,
+                    seatTier: a.seatTier ?? null,
                     // Whose reading this is: a peer instance's id (shared pool state)
                     // or null for this instance's own.
                     readingFrom: a.adoptedFrom ?? null,
@@ -2299,9 +2361,11 @@ export async function startProxy(opts = {}) {
                 mode: 'pool',
                 ...pool.status(),
                 stickyBindings: pool.stickyCount(),
-                // Windows the pool really has: each measured window once, each
-                // unmeasured seat as its own.
-                distinctWindows: distinctWindows(pool.all(), now),
+                // Accounts the pool really has: each identified account once, each
+                // not-yet-identified seat as its own. `distinctWindows` keeps its name
+                // for readers of the older payload; an account is its windows.
+                distinctWindows: distinctAccounts(pool.all()),
+                distinctAccounts: distinctAccounts(pool.all()),
                 // Shared pool state (pool-sync.ts) — null when off.
                 sharedState: poolSync ? poolSync.status() : null,
                 accounts,
@@ -3066,9 +3130,9 @@ export async function startProxy(opts = {}) {
             if (body.length > 0) {
                 try {
                     const peek = (parsedBody ?? {}); // parsed once by the invalid-body guard; `body` is re-serialized from it
-                    const rawModel = (peek.model || '').toString();
-                    const requestPoolFallbackModels = selectPoolFallbackModels(poolFallbackSpec, rawModel);
-                    const requestPoolFallbackModel = requestPoolFallbackModels[0] ?? null;
+                    // Reassignable: the codex effort-suffix strip below rewrites it, and
+                    // every routing decision after that point must see the stripped name.
+                    let rawModel = (peek.model || '').toString();
                     // Credentials are re-read per request (not cached at startup) because
                     // a refresh rotates them on disk; getFreshCodexAccount refreshes when
                     // inside the expiry buffer, collapsing concurrent refreshes per alias.
@@ -3105,6 +3169,43 @@ export async function startProxy(opts = {}) {
                             }
                         }
                     }
+                    // dario#1260 — an effort suffix on a CODEX model (`gpt-5.6-terra:high`).
+                    // The two strip sites further up deliberately leave OpenAI-shaped names
+                    // alone: an openai-compat backend may serve a model whose real id ends
+                    // in `-high`/`-low`, and stripping there would rewrite a legitimate
+                    // name against a catalog this proxy cannot see. Codex is the one
+                    // provider that publishes its routable set, so here — and only here —
+                    // the ambiguity is decidable: strip when the name as written matches no
+                    // slug and the stripped name matches one.
+                    //
+                    // That guard is what makes this strictly additive. The only requests
+                    // whose routing changes are the ones that answer 400 `model_unroutable`
+                    // today, because a name that already routes is never re-read.
+                    //
+                    // Placed HERE rather than beside its siblings because `codexModels` is
+                    // THIS request's account's list, resolved just above; the suffix cannot
+                    // be told apart from a real id without it.
+                    if (rawModel && codexModels.length > 0 && !isCodexModel(rawModel, codexModels)) {
+                        const eff = parseEffortSuffix(rawModel);
+                        if (eff.effort && isCodexModel(eff.model, codexModels)) {
+                            if (verbose)
+                                console.log(`[dario] effort suffix: ${rawModel} → model ${eff.model} (codex, effort: ${eff.effort})`);
+                            requestEffort = eff.effort;
+                            rawModel = eff.model;
+                            // The suffix must not survive into the outbound body: the backend
+                            // 400s on a slug it does not list, which is the very failure this
+                            // fixes. `body` is re-serialized from `parsedBody` exactly as the
+                            // alias and provider-prefix blocks above do.
+                            peek.model = eff.model;
+                            body = Buffer.from(JSON.stringify(parsedBody));
+                        }
+                    }
+                    // Chosen AFTER the strip above, not before it: a per-model fallback
+                    // spec is keyed on the model being routed, and keying it on a name
+                    // still carrying a dario-side effort suffix would miss the operator's
+                    // own entry for that model and fall back to the unscoped chain.
+                    const requestPoolFallbackModels = selectPoolFallbackModels(poolFallbackSpec, rawModel);
+                    const requestPoolFallbackModel = requestPoolFallbackModels[0] ?? null;
                     const decision = routeProvider({
                         isOpenAIPath: isOpenAI,
                         model: rawModel,
@@ -3205,7 +3306,11 @@ export async function startProxy(opts = {}) {
                         // is an outage, and parking a provider for that would keep it out
                         // of the chain while it was already coming back.
                         (d) => { if (d.status === 429)
-                            providerCooldowns.note('codex', d.retryAfterMs); });
+                            providerCooldowns.note('codex', d.retryAfterMs); }, 
+                        // dario#1260 — the effort named by the model-name suffix stripped
+                        // above. Undefined for every request that did not name one, which
+                        // leaves the outbound body exactly as it was.
+                        effortForCodex(requestEffort));
                         if (served) {
                             // A provider that just served is not rate-limited.
                             providerCooldowns.clear('codex');
@@ -3872,7 +3977,9 @@ export async function startProxy(opts = {}) {
                 // returns status='rejected' on 429, which makes the next `select()` call
                 // route traffic away from this account until it resets.
                 if (poolAccount) {
-                    const snapshot = parseRateLimits(upstream.headers);
+                    // The family is what lets a bucket the wire does not name by family
+                    // (`7d_oi`) be learned as binding THIS request's model (dario#1262).
+                    const snapshot = parseRateLimits(upstream.headers, modelFamily(requestModel));
                     if (upstream.status === 429) {
                         // Say so the moment a seat leaves rotation. With a peer to fail
                         // over to the client sees 200, and nothing else named the seat,
@@ -3881,7 +3988,7 @@ export async function startProxy(opts = {}) {
                         // those repeats are verbose-only.
                         const parked = pool.markRejected(poolAccount.alias, snapshot);
                         if (parked || verbose) {
-                            console.error(`[dario] #${requestCount} rate limited (429) on account "${poolAccount.alias}": ${describeRateLimitSnapshot(snapshot)} — parked until the window rolls`);
+                            console.error(`[dario] #${requestCount} rate limited (429) on account "${poolAccount.alias}": ${describeRejection(pool.get(poolAccount.alias)?.rateLimit ?? snapshot)}`);
                         }
                     }
                     else {
@@ -3893,7 +4000,6 @@ export async function startProxy(opts = {}) {
                     const organizationId = upstream.headers.get('anthropic-organization-id');
                     if (organizationId)
                         pool.noteOrganization(poolAccount.alias, organizationId);
-                    announceWindowPeers(poolAccount.alias);
                     poolSync?.reportSeat(poolAccount.alias);
                     // First-sight detector for per-model rate-limit buckets. Anthropic
                     // ships these unannounced — e.g. `7d_sonnet-utilization` appeared

package/docs/admin-api.md

@@ -104,9 +104,7 @@ rejection lifts), representative `claim` (e.g. `five_hour`), routing
 `status`, `request_count` (requests served), `rejected_count` /
 `last_rejected_at` (429s answered — a 429 serves nothing, so it is not a
 request), `organization_id` (the organization the token belongs to, learned
-from its responses and written to the record with its next refresh), `shares_window_with` (aliases whose last
-reading names the same live window — one subscription under several aliases,
-see [One subscription under two aliases](./multi-account-pool.md#one-subscription-under-two-aliases)),
+from its responses and written to the record with its next refresh), `account_id` / `account_email` (who the token is, from its OAuth profile at grant time; the email masked), `same_account_as` (aliases that are the same account — one subscription under several aliases; `shares_window_with` is the same list under its older name, see [One subscription under two aliases](./multi-account-pool.md#one-subscription-under-two-aliases)), `rate_limit_tier` / `seat_tier` when the profile stated them,
 and `consecutive_auth_failures`. What each `status` means and what
 to do about it: [Reading a seat's `status`](./multi-account-pool.md#reading-a-seats-status).
 It's the admin-token-gated equivalent of the proxy-key-gated `GET /accounts`

package/docs/commands.md

@@ -16,6 +16,7 @@ This page is the per-flag reference. For environment variables grouped by task
 | `dario refresh` | Force an immediate Claude token refresh |
 | `dario logout` | Delete stored Claude credentials |
 | `dario accounts check <alias> [--models=a,b]` | Read-only, in-place seat probe: one tiny request per model, pinned to that seat through the running proxy (`x-dario-account` + `x-dario-admin-token`, needs `DARIO_ADMIN=1`). A pinned request never fails over, so the upstream status is the seat's own answer. |
+| `dario accounts identity [--fresh <alias>...\|--all]` | Which client identity each seat presents in `metadata.user_id`, where it came from, and which seats share one across different accounts; `--fresh` gives the named seats their own (the running proxy presents it on the next request). See [Client identity](./multi-account-pool.md#client-identity-what-a-seat-presents-as). |
 | `dario accounts list` / `add <alias>` / `remove <alias>` | Multi-account pool management. `add <alias>` on a fresh pool auto back-fills your existing `dario login` credentials as `login`, so your first `add` trips the 2+ pool threshold on its own — see [Multi-account pool mode](./multi-account-pool.md). |
 | `dario backend list` / `add <name> --key=<key> [--base-url=<url>]` / `remove <name>` | OpenAI-compat backend management |
 | `dario subagent install` / `remove` / `status` | CC sub-agent lifecycle. See [sub-agent hook](./sub-agent.md). |

package/docs/configuration.md

@@ -74,6 +74,39 @@ Off by default, each one a deliberate divergence from what real CC sends.
 | `DARIO_EFFORT` | `--effort=` | Forces a reasoning-effort level. Can flip requests to overage billing — watch `-v` logs for representative-claim changes ([`#87`](https://github.com/askalf/dario/issues/87)). |
 | `DARIO_MAX_TOKENS` | `--max-tokens=` | Anthropic enforces the per-model ceiling server-side, so too-high values return a clean 400 ([`#88`](https://github.com/askalf/dario/issues/88)). |
 
+### Per-request effort, by model name
+
+`DARIO_EFFORT` is process-wide: it applies to every caller, Claude and Codex
+alike. A client that has no way to set `output_config.effort` can instead name
+the level in the model itself, and only that request changes:
+
+```
+claude-opus-4-8:high      colon form
+claude-opus-4-8-high      hyphen form, for Cursor, which rewrites colons
+gpt-5.6-terra:high        a Codex model, same two spellings
+```
+
+Levels a suffix may name: `low`, `medium`, `high`, `xhigh`, `max`, and dario's
+own `ultracode`, which reaches a Codex backend as `max`. On the Codex path the
+level is sent as `reasoning.effort`; on the Claude path as
+`output_config.effort`.
+
+`client` is a valid `DARIO_EFFORT` value but deliberately **not** a suffix. It
+means "leave the client's own choice alone", so naming it in a model would be a
+no-op, and accepting it would let a model genuinely named `...-client` be
+stripped to a name the backend does not list.
+
+The suffix is only read when the name as written matches no model the provider
+lists, so a real model id that happens to end in an effort word is routed
+exactly as written and never re-read. A `--pool-fallback` chain entry may carry
+one too, which sets the effort the failover request runs at.
+
+Effort is not free. Measured through dario on one prompt with only the level
+changing: `low` returned 1,982 output tokens in 18s, `high` 3,947 in 35s, and
+`max` 11,160 in 100s. Reasoning is billed as output, so `max` is a real cost
+increase on every request that names it, and on a long agent loop it can push a
+run into its own timeout.
+
 ## Pacing
 
 Only meaningful with stealth, and all default to 0 (off) except the cap. See [`wire-fidelity.md`](./wire-fidelity.md).

package/docs/multi-account-pool.md

@@ -98,10 +98,12 @@ curl http://localhost:3456/analytics    # per-account / per-model stats, burn ra
 | `status` | What it means | What to do |
 |---|---|---|
 | `allowed` | The seat's last response was a 200 with headroom. `util5h` / `util7d` are that response's reading — a ratio against 1.0, so `0.42` is 42% — `lastObservedAt` / `utilAgeMs` say how old it is, `resetAt` / `resetInMs` when its representative window rolls. | Nothing. |
-| `rejected` | The seat's last response was a 429: the organization behind its token is over the window named by `claim` (`five_hour`, `seven_day`, …). `util5h: 1.04` is 104% of the five-hour window, not 1%. `rejectedCount` / `lastRejectedAt` say the seat was tried — a 429 serves nothing, so `requestCount` does not move — and `resetInMs` says how long it stays parked. Requests route around it; it returns on its own when the window rolls. | Nothing — the window clears itself. If the reading surprises you (your usage page for that account says 0%), the token belongs to a different organization than the page you are looking at, or to the same organization as another seat: the reading is Anthropic's own, taken on that token. `dario accounts check <alias>` asks the seat directly. |
+| `rejected` | The seat's last response was a 429 **that named an exhausted window**: `claim` says which (`five_hour`, `seven_day`, …) and the reading is at or past the 1.0 threshold — `util5h: 1.04` is 104% of the five-hour window, not 1%. `rejectedCount` / `lastRejectedAt` say the seat was tried — a 429 serves nothing, so `requestCount` does not move — and `resetInMs` says how long it stays parked. Requests route around it; it returns on its own when the window rolls. | Nothing — the window clears itself. If the reading surprises you (your usage page for that account says 0%), the token belongs to a different organization than the page you are looking at, or to the same organization as another seat: the reading is Anthropic's own, taken on that token. `dario accounts check <alias>` asks the seat directly. |
 | `unknown` | No current observation: a seat that has served nothing yet, or a rejection whose window has rolled (`resetInMs: 0`) and that nothing has measured since. | Nothing; the next request measures it. |
 | `auth-cooldown` | Upstream answered 401/403 or `invalid_grant`. `consecutiveAuthFailures` tells a blip (1) from a dead refresh token (a streak); the cool-down doubles with the streak, from 1 minute to 30. | A streak means re-grant the seat — `dario accounts remove` + `add`, or the admin login flow under the same alias. A new grant starts the seat fresh: no carried-over cool-down, rejection or identity. See [Refresh-token grant age](#refresh-token-grant-age) for the 28-day wall behind most streaks. |
 
+**A 429 that names no exhausted window is not a parking.** A rejection whose headers show no claim, or a claim with utilization nowhere near 1.0 (`5h 0%, 7d 0%, claim unknown`), is a refusal of some other kind — concurrency, an account-level lock, a monthly credit — and the `reset` it states is not this seat's window rolling. Until 6.0.39 the status code alone decided, and a seat on the fleet box was parked for 546 hours on exactly that reading. Such a seat now cools for the response's own `retry-after` (or one minute) and stays probeable; the log says so: `429 without an exhausted window (5h 0%, 7d 0%, claim unknown; stated reset in 546h 49m not honoured) — cooling 1m, seat stays probeable`.
+
 **When every seat is parked.** A pool whose seats are all `rejected` inside live windows does not probe them again: dario answers the request itself with `429`, `retry-after` set to the earliest reset, `x-dario-upstream-rejection: pool_parked`, and nothing sent upstream. One log line marks the transition (`pool parked: all 6 seats are over their rate-limit windows, earliest resets in 21m`). Before 6.0.35 every such request re-probed the earliest-reset seat, so `rejectedCount` on that seat grew by one per request — a seat reading `rejected_count: 500` next to `request_count: 1` was that, not a seat that needed a re-login. With a `--pool-fallback` armed, the request goes to the fallback instead, as before.
 
 The proxy logs every parking as it happens, once per window: `rate limited (429) on account "spare": 5h 104%, 7d 25%, claim five_hour, resets in 37m — parked until the window rolls`. The re-probes the all-exhausted fallback makes of an already-parked seat are logged only under `-v`.
@@ -110,16 +112,33 @@ The proxy logs every parking as it happens, once per window: `rate limited (429)
 
 ## One subscription under two aliases
 
-A pool of six is only six windows if the six tokens belong to six subscriptions. Two aliases granted from the same account — or from two accounts on one organization that share a plan — share one five-hour and one seven-day window, and the pool counts that window twice: both seats look like headroom, the busier one fills the window for both, and the other 429s on its first request with the same reading (the #1244 report).
+A pool of six is only six accounts if the six tokens belong to six accounts. Two aliases granted from the same account share one set of windows and one set of limits — the pool routes on real headroom either way, and the duplicate simply parks on the first 429 until the window rolls, but the operator should know.
+
+dario knows it from the token itself. At grant time (`dario accounts add`, the admin login, the keychain import, the `login` back-fill) it reads the token's OAuth profile and records the **account uuid** — plus the masked email and the organization's tier fields — on the seat's record. A record written before this exists is filled in on its next token refresh.
+
+- **`accountId`** / **`accountEmail`** — who the token is. Two seats with the same `accountId` are the same account, full stop.
+- **`sameAccountAs`** (and `sharesWindowWith`, the same list under its original name) — the other aliases that are this account.
+- **`organizationId`** — the `anthropic-organization-id` the seat's responses carry. Several accounts can share an organization (a Team) and still have their own windows: *organization* is not *account*.
+
+Until 6.0.38, `sharesWindowWith` was **inferred**: two seats whose last readings named the same window (`claim@reset`) were called one subscription, on the assumption that independent windows never share a reset second. They do — Anthropic aligns the five-hour reset to a 20-minute grid, so a window has 15 possible reset seconds and a pool of 18 seats collides by pigeonhole. That inference told an operator seven independent colleagues were one subscription (dario#1263). It is gone; nothing is claimed that the token did not say.
+
+Both facts are on `GET /accounts` (`distinctAccounts` — and `distinctWindows`, kept for readers of the older payload — count the accounts the pool really has), on `GET /admin/accounts` as `account_id` / `account_email` / `same_account_as`, in `dario accounts list --live`, and on the `Accounts` row of `dario doctor`. The proxy also says it once per pair at start-up: `seats "busy" and "twin" are the same account (ma***@example.com)`.
 
-Two facts make this visible:
+## Client identity: what a seat presents as
 
-- **`organizationId`** — the `anthropic-organization-id` every response carries, learned the first time a seat serves and written to its record with the seat's next token refresh. It is what to compare with the organization behind the usage page you are looking at: a reading that surprises you is usually a token on a different organization.
-- **`sharesWindowWith`** — the other aliases whose last reading names the same live window (same representative claim, same reset second). Two independent windows all but never share a reset second; two readings of one window always do. This is the fact that matters for headroom, and it is deliberately not derived from the organization: seats on one organization can still have their own windows.
+Every request carries `metadata.user_id` — a client identity (`device_id`, `account_uuid`) that Claude Code derives from its install, and that Anthropic ties the bearer token to. dario stores one per seat.
 
-Both are on `GET /accounts` (`distinctWindows` at the top counts the windows the pool really has), on `GET /admin/accounts` as `organization_id` / `shares_window_with`, in `dario accounts list --live`, and in `dario doctor` (the `Organizations` row, from the ids on the records — so up to one refresh behind the running proxy). The proxy also says it once, when the second reading arrives: `seats "twin" and "busy" report the same five_hour window (resets 2026-09-07T13:12:00.000Z) — one subscription under two aliases; the pool has 2 distinct windows across 3 seats`.
+Before 6.0.39 every add path copied the **machine's** Claude Code identity into every alias when Claude Code was installed. On a machine running a pool of colleagues' tokens that meant eighteen different accounts all presenting one identity (dario#1244). Whether that alone changes what Anthropic counts is not established — it is hygiene, not a diagnosis — but a seat should present the account it belongs to.
+
+Now a new alias takes the local Claude Code identity only when no other alias holds it, or when the holder is proven (same `accountId`) to be the same account; otherwise the alias gets its own, exactly as a machine without Claude Code always did. Existing seats are not rewritten behind your back. To see what each seat presents, and which seats share one identity across different accounts:
+
+```
+dario accounts identity                      # per-seat report
+dario accounts identity --fresh <alias>...   # give these seats their own
+dario accounts identity --fresh --all
+```
 
-What to do about it: nothing is broken — the pool routes on real headroom either way, and the duplicate seat simply parks on the first 429 until the window rolls. If the second alias was meant to be a second subscription, re-grant it while signed in to the right account.
+The running proxy presents a rewritten identity on the seat's next request; no restart. `dario doctor` warns on the `Client identity` row when seats share one across different accounts.
 
 ## Consumers: who a request is for
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.0.37",
+  "version": "6.0.39",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {