@askalf/dario 6.12.6 → 6.12.7

package/dist/analytics.d.ts

@@ -249,6 +249,28 @@ export declare function providerOfModel(model: string): PricingProvider;
  * repeated `[` backtrack quadratically (200k of them held the event loop ~25s).
  */
 export declare function pricingRateFor(model: string, atMs: number): Rate;
+/** True when `model` has a row of its own in PRICING or OPENAI_PRICING, rather than a fallback's. */
+export declare function hasPublishedRate(model: string): boolean;
+/**
+ * The highest rate either price list carries, bucket by bucket (intro rates
+ * included). An upper bound on what any listed model bills, for pricing a
+ * model that has no row of its own where a low estimate would let spend
+ * through.
+ */
+export declare function highestPublishedRate(): Rate;
+/**
+ * costOfTokens for an upper bound (the key-budget reservation): a model with
+ * no published rate is priced at highestPublishedRate, never at the
+ * sonnet-4-6 / gpt-5.6-terra fallback, which is cheaper than fable, astra
+ * and every opus. Matched case-insensitively, as the Claude path lowercases
+ * the model it sends.
+ */
+export declare function costOfTokensFailClosed(model: string, atMs: number, t: {
+    inputTokens: number;
+    outputTokens: number;
+    cacheReadTokens: number;
+    cacheCreateTokens: number;
+}): number;
 /**
  * USD the four token buckets would bill at `model`'s rate in effect at `atMs`.
  * The ledger prices its per-day rows through this too, so a pricing

package/dist/analytics.js

@@ -287,7 +287,7 @@ export function providerOfModel(model) {
  * repeated `[` backtrack quadratically (200k of them held the event loop ~25s).
  */
 export function pricingRateFor(model, atMs) {
-    const baseModel = model.replace(/\[[^[\]]*\]$/, '').replace(/:[a-z]+$/i, '').replace(/-\d{8}$/, '');
+    const baseModel = pricingBaseModel(model);
     if (providerOfModel(baseModel) === 'openai') {
         const rate = OPENAI_PRICING[baseModel] ?? OPENAI_PRICING[OPENAI_FALLBACK_MODEL];
         return { ...rate };
@@ -299,6 +299,49 @@ export function pricingRateFor(model, atMs) {
     }
     return { input: entry.input, output: entry.output, cacheRead: entry.cacheRead, cacheCreate: entry.cacheCreate };
 }
+/** The id a price list is keyed by: context tag, effort suffix and date stamp removed. */
+function pricingBaseModel(model) {
+    return model.replace(/\[[^[\]]*\]$/, '').replace(/:[a-z]+$/i, '').replace(/-\d{8}$/, '');
+}
+/** True when `model` has a row of its own in PRICING or OPENAI_PRICING, rather than a fallback's. */
+export function hasPublishedRate(model) {
+    const base = pricingBaseModel(model);
+    return Object.hasOwn(PRICING, base) || Object.hasOwn(OPENAI_PRICING, base);
+}
+/**
+ * The highest rate either price list carries, bucket by bucket (intro rates
+ * included). An upper bound on what any listed model bills, for pricing a
+ * model that has no row of its own where a low estimate would let spend
+ * through.
+ */
+export function highestPublishedRate() {
+    const rates = [...Object.values(OPENAI_PRICING)];
+    for (const e of Object.values(PRICING)) {
+        rates.push(e);
+        if (e.intro)
+            rates.push(e.intro);
+    }
+    return {
+        input: Math.max(...rates.map((r) => r.input)),
+        output: Math.max(...rates.map((r) => r.output)),
+        cacheRead: Math.max(...rates.map((r) => r.cacheRead)),
+        cacheCreate: Math.max(...rates.map((r) => r.cacheCreate)),
+    };
+}
+/**
+ * costOfTokens for an upper bound (the key-budget reservation): a model with
+ * no published rate is priced at highestPublishedRate, never at the
+ * sonnet-4-6 / gpt-5.6-terra fallback, which is cheaper than fable, astra
+ * and every opus. Matched case-insensitively, as the Claude path lowercases
+ * the model it sends.
+ */
+export function costOfTokensFailClosed(model, atMs, t) {
+    const id = model.toLowerCase();
+    if (hasPublishedRate(id))
+        return costOfTokens(id, atMs, t);
+    const p = highestPublishedRate();
+    return ((t.inputTokens * p.input) + (t.outputTokens * p.output) + (t.cacheReadTokens * p.cacheRead) + (t.cacheCreateTokens * p.cacheCreate)) / 1_000_000;
+}
 /**
  * USD the four token buckets would bill at `model`'s rate in effect at `atMs`.
  * The ledger prices its per-day rows through this too, so a pricing

package/dist/cc-template.d.ts

@@ -79,6 +79,30 @@ export declare const CC_NATIVE_NAMES: Set<string>;
  *  a CC session with an MCP server attached. Like CC_NATIVE_NAMES, these
  *  identity-map and skip TOOL_MAP entirely. */
 export declare function isMcpToolName(name: unknown): boolean;
+/** Server segment of the MCP-shaped name a client tool outside Claude Code's
+ *  set is carried under on a Claude Code-shaped request: `submit_review` goes
+ *  out as `mcp__client__submit_review`. Every tool real Claude Code sends
+ *  beyond its built-ins is named `mcp__<server>__<tool>`, so a bare foreign
+ *  name next to Claude Code's tools is a shape it never produces. */
+export declare const CLIENT_TOOL_MCP_PREFIX = "mcp__client__";
+/**
+ * A client tool that cannot go out on a Claude Code-shaped request: not a
+ * custom tool with an input_schema (an Anthropic-defined tool such as
+ * `computer_20251124` keeps its fixed name and cannot be renamed), or a name
+ * that does not fit Anthropic's tool-name limit once MCP-shaped. The proxy
+ * answers 400 naming each tool; dropping one would leave the model unable to
+ * call a tool the client declared.
+ */
+export declare class UnsupportedClientToolError extends Error {
+    readonly tools: ReadonlyArray<{
+        name: string;
+        reason: string;
+    }>;
+    constructor(tools: Array<{
+        name: string;
+        reason: string;
+    }>);
+}
 /** CC's static system prompt (~25KB). The shared base — baked from a non-Fable
  *  model (Opus). CC ships some models a larger, model-specific prompt; see
  *  CC_SYSTEM_PROMPT_FABLE / systemPromptForModel. */
@@ -302,10 +326,15 @@ export declare function detectTextToolClient(systemText: string): string | null;
  *   floor ([memory_store, db_query]). Before this, those 2-tool surfaces fell
  *   under a len<3 guard and got round-robined onto CC fallback slots, which
  *   silently corrupts every call (the model upstream never sees the real tool).
- * - Mixed surface (some tools map): require 3+ tools AND ≥80% unmapped. The 80%
- *   leaves room for a non-CC client that legitimately reuses 1-2 of TOOL_MAP's
- *   bash/grep/read aliases; the 3-tool floor avoids mis-flagging a partial CC
- *   load (1-2 tools, some mapped) mid-handshake — those stay null and remap.
+ * - A foreign tool, no CC-native name, and an alias that shares a CC tool's
+ *   name (`grep`, `bash`): non-CC at any ratio. Claude Code declares its own
+ *   tools by their exact names, so such a surface is some other client's, and
+ *   its own schemas are what it parses; remap would put its aliases through
+ *   TOOL_MAP's argument translation. A surface that names no CC tool gets the
+ *   full template instead and stays in remap, fallback slots visible.
+ * - Mixed surface otherwise: require 3+ tools AND ≥80% unmapped. The 80% leaves
+ *   room for a non-CC client that legitimately reuses 1-2 of TOOL_MAP's
+ *   aliases; the 3-tool floor keeps a 1-2 tool partial CC load in remap.
  */
 export declare function detectNonCCByTools(clientTools: Array<Record<string, unknown>> | undefined): string | null;
 /**
@@ -564,6 +593,7 @@ export declare function buildCCRequest(clientBody: Record<string, unknown>, bill
     body: Record<string, unknown>;
     toolMap: Map<string, ToolMapping>;
     unmappedTools: string[];
+    carriedAsMcp?: string[];
     detectedClient?: string;
     genuineCC?: boolean;
 };

package/dist/cc-template.js

@@ -76,6 +76,9 @@ export const CC_TEMPLATE_PROMPT_BYTES = (() => {
 })();
 /** Every name the bundle knows — including one whose definition is not advertisable (dario#1376). */
 export const CC_NATIVE_NAMES_UNION = new Set(TEMPLATE.tools.map((t) => String(t.name)));
+/** Lowercased names of the advertisable non-MCP CC tools: the set buildCCRequest
+ *  matches a client declaration against, case-insensitively, when it advertises. */
+const CC_TOOL_NAMES_LOWER = new Set(CC_TOOL_DEFINITIONS_UNION.filter((t) => !isMcpToolName(t.name)).map((t) => t.name.toLowerCase()));
 /** CC's own tool names, EXACT case ("Read", "Bash", "Agent", …). A CC client's
  *  tools identity-map to themselves and OVERRIDE TOOL_MAP — whose lowercase
  *  cross-client aliases ('read' → {path}/{filePath}) would otherwise mistranslate
@@ -99,6 +102,33 @@ export const CC_NATIVE_NAMES = new Set(CC_TOOL_DEFINITIONS.map((t) => String(t.n
 export function isMcpToolName(name) {
     return typeof name === 'string' && name.startsWith('mcp__');
 }
+/** Server segment of the MCP-shaped name a client tool outside Claude Code's
+ *  set is carried under on a Claude Code-shaped request: `submit_review` goes
+ *  out as `mcp__client__submit_review`. Every tool real Claude Code sends
+ *  beyond its built-ins is named `mcp__<server>__<tool>`, so a bare foreign
+ *  name next to Claude Code's tools is a shape it never produces. */
+export const CLIENT_TOOL_MCP_PREFIX = 'mcp__client__';
+/** Anthropic's limit on a tool name. The MCP-shaped name has to fit it. */
+const TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]{1,64}$/;
+/**
+ * A client tool that cannot go out on a Claude Code-shaped request: not a
+ * custom tool with an input_schema (an Anthropic-defined tool such as
+ * `computer_20251124` keeps its fixed name and cannot be renamed), or a name
+ * that does not fit Anthropic's tool-name limit once MCP-shaped. The proxy
+ * answers 400 naming each tool; dropping one would leave the model unable to
+ * call a tool the client declared.
+ */
+export class UnsupportedClientToolError extends Error {
+    tools;
+    constructor(tools) {
+        super(`dario cannot carry ${tools.length === 1 ? 'this client tool' : 'these client tools'} on a Claude Code-shaped request: `
+            + tools.map((t) => `"${t.name}" (${t.reason})`).join('; ')
+            + '. Declare each as a custom tool with an input_schema and a name of at most '
+            + `${64 - CLIENT_TOOL_MCP_PREFIX.length} characters, or run dario with --preserve-tools to forward your tools verbatim.`);
+        this.name = 'UnsupportedClientToolError';
+        this.tools = tools;
+    }
+}
 /** CC's static system prompt (~25KB). The shared base — baked from a non-Fable
  *  model (Opus). CC ships some models a larger, model-specific prompt; see
  *  CC_SYSTEM_PROMPT_FABLE / systemPromptForModel. */
@@ -666,15 +696,22 @@ export function detectTextToolClient(systemText) {
  *   floor ([memory_store, db_query]). Before this, those 2-tool surfaces fell
  *   under a len<3 guard and got round-robined onto CC fallback slots, which
  *   silently corrupts every call (the model upstream never sees the real tool).
- * - Mixed surface (some tools map): require 3+ tools AND ≥80% unmapped. The 80%
- *   leaves room for a non-CC client that legitimately reuses 1-2 of TOOL_MAP's
- *   bash/grep/read aliases; the 3-tool floor avoids mis-flagging a partial CC
- *   load (1-2 tools, some mapped) mid-handshake — those stay null and remap.
+ * - A foreign tool, no CC-native name, and an alias that shares a CC tool's
+ *   name (`grep`, `bash`): non-CC at any ratio. Claude Code declares its own
+ *   tools by their exact names, so such a surface is some other client's, and
+ *   its own schemas are what it parses; remap would put its aliases through
+ *   TOOL_MAP's argument translation. A surface that names no CC tool gets the
+ *   full template instead and stays in remap, fallback slots visible.
+ * - Mixed surface otherwise: require 3+ tools AND ≥80% unmapped. The 80% leaves
+ *   room for a non-CC client that legitimately reuses 1-2 of TOOL_MAP's
+ *   aliases; the 3-tool floor keeps a 1-2 tool partial CC load in remap.
  */
 export function detectNonCCByTools(clientTools) {
     if (!clientTools || clientTools.length === 0)
         return null;
     let unmapped = 0;
+    let native = false;
+    let sharesCCName = false;
     for (const tool of clientTools) {
         const rawName = tool.name || '';
         // A tool is "foreign" only if dario can neither map it (TOOL_MAP, by
@@ -693,7 +730,13 @@ export function detectNonCCByTools(clientTools) {
         // verbatim rather than falling back to the full CC template.
         // Union set, not the host-filtered one: a win32 client's PowerShell is
         // native regardless of the platform dario itself runs on (v4.8.136).
-        if (!TOOL_MAP[rawName.toLowerCase()] && !CC_NATIVE_NAMES_UNION.has(rawName) && !isMcpToolName(rawName))
+        if (CC_NATIVE_NAMES_UNION.has(rawName)) {
+            native = true;
+            continue;
+        }
+        if (CC_TOOL_NAMES_LOWER.has(rawName.toLowerCase()))
+            sharesCCName = true;
+        if (!TOOL_MAP[rawName.toLowerCase()] && !isMcpToolName(rawName))
             unmapped++;
     }
     const ratio = unmapped / clientTools.length;
@@ -702,6 +745,11 @@ export function detectNonCCByTools(clientTools) {
     // genuinely foreign client hits it.
     if (ratio === 1)
         return 'unknown-non-cc';
+    // Claude Code declares its own tools by their exact names. A foreign tool
+    // next to an alias sharing a CC tool's name, with no exact-case CC name, is
+    // another client's surface: its tools go out as declared.
+    if (unmapped > 0 && !native && sharesCCName)
+        return 'unknown-non-cc';
     // Mixed surface: only flag once there are enough tools to be confident.
     if (clientTools.length >= 3 && ratio >= 0.8)
         return 'unknown-non-cc';
@@ -1845,13 +1893,18 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
     // the fingerprint risk on their own account.
     const activeToolMap = new Map();
     const unmappedTools = [];
+    // CC tools a declared client tool maps onto (identity or TOOL_MAP alias, not
+    // the round-robin fallback slots). Read by the advertise step below.
+    const claimedCC = new Set();
+    // Client tools outside CC's set, under their MCP-shaped names, advertised
+    // after the MCP tools by the step below.
+    const mcpShapedTools = [];
     if (clientTools && !effectivePreserveTools && !effectiveMergeTools) {
         // Two passes so the unmapped-tool distributor can avoid colliding with
         // CC tools the client already uses directly. Without this, a client
         // sending both `WebSearch` and some unmapped tool like `memory_get`
         // could have both forward-map to `WebSearch`, and the reverse map would
         // then rewrite real `WebSearch` responses to the collided client name.
-        const claimedCC = new Set();
         for (const tool of clientTools) {
             const name = (tool.name || '').toLowerCase();
             // A CC client's OWN tools map to THEMSELVES (identity), and this OVERRIDES
@@ -1906,7 +1959,18 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
         //   wants {action: "run"}). Better to let the model not see those tools
         //   than to pretend they exist and corrupt every call. Users needing
         //   every client tool to actually work must use --preserve-tools.
+        //
+        // - A declaration that names a CC tool: the advertise step sends only the
+        //   CC tools the client declared, so a fallback slot is never on the wire
+        //   and a round-robined tool would be invisible to the model. Each
+        //   unmapped tool goes out instead the way real CC sends a tool beyond its
+        //   built-ins: the client's own definition under an `mcp__<server>__<tool>`
+        //   name, arguments untouched, renamed back on the response. A tool that
+        //   cannot be carried that way fails the request with its name.
         const CC_FALLBACK_TOOLS = ['Bash', 'Read', 'Grep', 'Glob', 'WebSearch', 'WebFetch'];
+        const namesCCTool = clientTools.some((t) => typeof t.name === 'string' && !isMcpToolName(t.name) && CC_TOOL_NAMES_LOWER.has(t.name.toLowerCase()));
+        const declaredNames = new Set(clientTools.map((t) => t.name));
+        const uncarried = [];
         for (const tool of clientTools) {
             const name = (tool.name || '').toLowerCase();
             if (CC_NATIVE_NAMES_UNION.has(tool.name) || isMcpToolName(tool.name) || TOOL_MAP[name])
@@ -1914,6 +1978,28 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
             unmappedTools.push(tool.name);
             if (opts.hybridTools)
                 continue; // dropped — see comment above
+            if (namesCCTool) {
+                const clientName = typeof tool.name === 'string' ? tool.name : '';
+                const wireName = `${CLIENT_TOOL_MCP_PREFIX}${clientName}`;
+                const toolType = tool.type;
+                if (!clientName) {
+                    uncarried.push({ name: String(tool.name ?? ''), reason: 'no name' });
+                }
+                else if ((toolType !== undefined && toolType !== 'custom') || !isAdvertisableToolDefinition(tool)) {
+                    uncarried.push({ name: clientName, reason: 'not a custom tool with an input_schema' });
+                }
+                else if (!TOOL_NAME_PATTERN.test(wireName)) {
+                    uncarried.push({ name: clientName, reason: `${wireName} is not a valid tool name of at most 64 characters` });
+                }
+                else if (declaredNames.has(wireName)) {
+                    uncarried.push({ name: clientName, reason: `the client also declares ${wireName}` });
+                }
+                else {
+                    activeToolMap.set(clientName, { ccTool: wireName, translateArgs: (a) => a, translateBack: (a) => a });
+                    mcpShapedTools.push({ ...tool, name: wireName });
+                }
+                continue;
+            }
             // Default mode: round-robin distribution. Exclude CC tools the client
             // already uses so we never create a two-client-names-to-one-CC-tool
             // collision. If every fallback is claimed (rare: client already uses 6+
@@ -1944,6 +2030,8 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
                 reverseScore: 0,
             });
         }
+        if (uncarried.length > 0)
+            throw new UnsupportedClientToolError(uncarried);
     }
     // ── Remap tool_use and tool_result references in message history ──
     // Skip in preserveTools mode — leave conversation history untouched.
@@ -2117,7 +2205,14 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
             // whole request with 400 "tools: Tool names must be unique". MCP
             // schemas are operator-supplied; the client's declaration is the only
             // authoritative source, never the template.
-            const availableCC = CC_TOOL_DEFINITIONS_UNION.filter((t) => !isMcpToolName(t.name) && clientToolNames.has(t.name.toLowerCase()));
+            const namedCC = CC_TOOL_DEFINITIONS_UNION.filter((t) => !isMcpToolName(t.name) && clientToolNames.has(t.name.toLowerCase()));
+            // Once the declaration names any CC tool, every alias also declares the
+            // CC tool it maps onto (`read_file` declares Read): advertising only the
+            // name matches would leave the model unable to call the other mapped
+            // tools. A declaration that names no CC tool keeps the full template.
+            const availableCC = namedCC.length > 0
+                ? CC_TOOL_DEFINITIONS_UNION.filter((t) => !isMcpToolName(t.name) && (clientToolNames.has(t.name.toLowerCase()) || claimedCC.has(t.name)))
+                : namedCC;
             const mcpTools = clientTools.filter((t) => isMcpToolName(t.name));
             // A CC-native name the bundle knows but cannot advertise (dario#1376:
             // `advisor` captured with an empty schema) is still identity-mapped
@@ -2125,8 +2220,10 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
             // verbatim, as MCP tools do. The client's schema is what its parser
             // expects back in any case.
             const clientOwnNative = clientTools.filter((t) => typeof t.name === 'string' && CC_TOOL_DEFINITIONS_UNADVERTISABLE.has(t.name) && isAdvertisableToolDefinition(t));
-            ccRequest.tools = availableCC.length > 0 || mcpTools.length > 0 || clientOwnNative.length > 0
-                ? dedupeToolsByName([...availableCC, ...clientOwnNative, ...mcpTools])
+            // Client tools outside CC's set follow the MCP tools, under the
+            // MCP-shaped names the tool map gave them.
+            ccRequest.tools = availableCC.length > 0 || mcpTools.length > 0 || clientOwnNative.length > 0 || mcpShapedTools.length > 0
+                ? dedupeToolsByName([...availableCC, ...clientOwnNative, ...mcpTools, ...mcpShapedTools])
                 : CC_TOOL_DEFINITIONS;
         }
     }
@@ -2259,7 +2356,10 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
     // to match that. Future CC releases that reshuffle or add a field are then
     // picked up by the next live refresh without a dario release.
     const orderedBody = orderBodyForOutbound(ccRequest);
-    return { body: orderedBody, toolMap: activeToolMap, unmappedTools, detectedClient };
+    // Client names of the unmapped tools that went out MCP-shaped (the rest of
+    // unmappedTools rode fallback slots or, in hybrid mode, were dropped).
+    const carriedAsMcp = unmappedTools.filter((n) => activeToolMap.get(n)?.ccTool === `${CLIENT_TOOL_MCP_PREFIX}${n}`);
+    return { body: orderedBody, toolMap: activeToolMap, unmappedTools, carriedAsMcp, detectedClient };
 }
 /**
  * Build the CC-name → {clientName, mapping} reverse lookup used by both

package/dist/codex-usage.d.ts

@@ -38,7 +38,11 @@ export declare function parseCodexUsageHeaders(h: HeaderReader, now?: number): C
 export declare function parseCodexUsageEndpoint(body: unknown, now?: number): CodexUsage | null;
 /** How often an IDLE seat is re-read from /wham/usage. A seat that is serving is read from every answer and never polled. */
 export declare const DEFAULT_CODEX_USAGE_POLL_MS: number;
-/** `DARIO_CODEX_USAGE_POLL_MS`: unset/garbage → default, `0` → off, anything else floored at one minute. */
+/**
+ * `DARIO_CODEX_USAGE_POLL_MS`: unset/garbage → default, `0` → off, anything
+ * else floored at one minute and capped at the longest interval a timer can
+ * hold (timer-ms.ts), since a larger one fires every millisecond.
+ */
 export declare function resolveCodexUsagePollMs(raw: string | undefined): number;
 /** Record a reading for a seat. A newer reading replaces an older one; an older one never replaces a newer one. */
 export declare function recordCodexUsage(alias: string, usage: CodexUsage): void;

package/dist/codex-usage.js

@@ -8,6 +8,7 @@
  * which slot is which. Pure and memory-only, so codex-accounts and
  * codex-backend can both import it without a cycle.
  */
+import { clampTimerMs } from './timer-ms.js';
 function finite(raw) {
     if (raw === null || raw === undefined || raw === '')
         return null;
@@ -77,7 +78,11 @@ export function parseCodexUsageEndpoint(body, now = Date.now()) {
 }
 /** How often an IDLE seat is re-read from /wham/usage. A seat that is serving is read from every answer and never polled. */
 export const DEFAULT_CODEX_USAGE_POLL_MS = 30 * 60 * 1000;
-/** `DARIO_CODEX_USAGE_POLL_MS`: unset/garbage → default, `0` → off, anything else floored at one minute. */
+/**
+ * `DARIO_CODEX_USAGE_POLL_MS`: unset/garbage → default, `0` → off, anything
+ * else floored at one minute and capped at the longest interval a timer can
+ * hold (timer-ms.ts), since a larger one fires every millisecond.
+ */
 export function resolveCodexUsagePollMs(raw) {
     if (raw === undefined || raw.trim() === '')
         return DEFAULT_CODEX_USAGE_POLL_MS;
@@ -86,7 +91,7 @@ export function resolveCodexUsagePollMs(raw) {
         return DEFAULT_CODEX_USAGE_POLL_MS;
     if (n === 0)
         return 0;
-    return Math.max(60_000, Math.round(n));
+    return clampTimerMs(Math.max(60_000, Math.round(n)));
 }
 const readings = new Map();
 /** Record a reading for a seat. A newer reading replaces an older one; an older one never replaces a newer one. */

package/dist/doctor-core.js

@@ -23,6 +23,7 @@ import { describeTemplate, detectDrift, checkCCCompat, findInstalledCC, missingV
 import { detectCCOAuthConfig } from './cc-oauth-detect.js';
 import { runAuthorizeProbe } from './cc-authorize-probe.js';
 import { MIGRATED_LOGIN_ALIAS } from './accounts.js';
+import { clampTimerMs } from './timer-ms.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /**
  * Decide what `doctor` should say about pool-exhaustion failover, from
@@ -1454,7 +1455,7 @@ function suggestAuthFix(result) {
  * proxy, does not log, does not persist.
  */
 export async function runAuthCheck(opts = {}) {
-    const timeoutMs = opts.timeoutMs ?? 30_000;
+    const timeoutMs = clampTimerMs(opts.timeoutMs ?? 30_000);
     const expected = opts.expectedKey ?? process.env.DARIO_API_KEY ?? '';
     if (!expected) {
         return {

package/dist/keys.d.ts

@@ -83,10 +83,12 @@ export declare const BUDGET_DEFAULT_MAX_TOKENS = 8192;
 export declare const EMPTY_RESERVATION: KeyBudgetReservation;
 /**
  * The reservation for one request, from what is known before it is sent.
- * `priceOf` is analytics' costOfTokens, injected so this module stays free of
- * the pricing table (the ledger injects the same way).
+ * `priceOf` is analytics' costOfTokensFailClosed on the proxy path, injected
+ * so this module stays free of the pricing table (the ledger injects the same
+ * way). `model` is what the request will be billed as; when routing could
+ * still bill it as one of several, pass them all and the costliest prices it.
  */
-export declare function requestBudgetReservation(model: string, bodyBytes: number, maxTokens: number | null | undefined, priceOf: (model: string, atMs: number, cell: {
+export declare function requestBudgetReservation(model: string | readonly string[], bodyBytes: number, maxTokens: number | null | undefined, priceOf: (model: string, atMs: number, cell: {
     requests: number;
     inputTokens: number;
     outputTokens: number;

package/dist/keys.js

@@ -44,15 +44,19 @@ export const BUDGET_DEFAULT_MAX_TOKENS = 8_192;
 export const EMPTY_RESERVATION = { count: 0, usd: 0, tokens: 0 };
 /**
  * The reservation for one request, from what is known before it is sent.
- * `priceOf` is analytics' costOfTokens, injected so this module stays free of
- * the pricing table (the ledger injects the same way).
+ * `priceOf` is analytics' costOfTokensFailClosed on the proxy path, injected
+ * so this module stays free of the pricing table (the ledger injects the same
+ * way). `model` is what the request will be billed as; when routing could
+ * still bill it as one of several, pass them all and the costliest prices it.
  */
 export function requestBudgetReservation(model, bodyBytes, maxTokens, priceOf, now = Date.now(), 
 /** Bytes dario adds to the prompt beyond the client's body (the template's system prompt and tools). */
 extraPromptBytes = 0) {
     const inputTokens = Math.ceil((Math.max(0, bodyBytes) + Math.max(0, extraPromptBytes)) / BUDGET_BYTES_PER_TOKEN);
     const outputTokens = Number.isFinite(maxTokens) && maxTokens > 0 ? Math.ceil(maxTokens) : BUDGET_DEFAULT_MAX_TOKENS;
-    const usd = priceOf(model, now, { requests: 1, inputTokens: 0, outputTokens, cacheReadTokens: 0, cacheCreateTokens: inputTokens });
+    const cell = { requests: 1, inputTokens: 0, outputTokens, cacheReadTokens: 0, cacheCreateTokens: inputTokens };
+    const models = typeof model === 'string' ? [model] : model.length > 0 ? model : [''];
+    const usd = Math.max(...models.map((m) => priceOf(m, now, cell)));
     return { count: 1, usd: Number.isFinite(usd) ? usd : 0, tokens: inputTokens + outputTokens };
 }
 export function addReservation(a, b) {

package/dist/overage-guard.js

@@ -34,6 +34,7 @@
  */
 import { EventEmitter } from 'node:events';
 import { isNonSubscriptionBilling } from './analytics.js';
+import { clampTimerMs } from './timer-ms.js';
 export class OverageGuard extends EventEmitter {
     opts;
     halted = null;
@@ -44,7 +45,8 @@ export class OverageGuard extends EventEmitter {
         // /analytics/stream + TUI tabs each register a listener; the in-proc
         // event listeners ceiling matches the Analytics class's choice.
         this.setMaxListeners(100);
-        this.opts = opts;
+        // The cooldown is a timer's delay; capped so a huge one cannot fire after 1 ms (timer-ms.ts).
+        this.opts = { ...opts, cooldownMs: clampTimerMs(opts.cooldownMs) };
     }
     /**
      * Subscribe to an Analytics instance. Every record whose claim is a

package/dist/pool-sync.js

@@ -28,6 +28,7 @@
  */
 import { randomUUID } from 'node:crypto';
 import { describeRateLimitSnapshot, rateLimitWindowPassed } from './pool.js';
+import { clampTimerMs } from './timer-ms.js';
 export const DEFAULT_POOL_SYNC_INTERVAL_MS = 2_000;
 /** A peer reading older than this describes windows that have long rolled. */
 export const SHARED_SEAT_MAX_AGE_MS = 6 * 3_600_000;
@@ -66,7 +67,7 @@ export class PoolSync {
         this.baseUrl = opts.baseUrl.replace(/\/+$/, '');
         this.token = opts.token;
         this.instance = opts.instance ?? randomUUID();
-        this.intervalMs = Math.max(200, opts.intervalMs ?? DEFAULT_POOL_SYNC_INTERVAL_MS);
+        this.intervalMs = clampTimerMs(Math.max(200, opts.intervalMs ?? DEFAULT_POOL_SYNC_INTERVAL_MS));
         this.stickyTtlMs = opts.stickyTtlMs ?? 6 * 3_600_000;
         this.log = opts.log ?? ((line) => console.error(line));
     }

package/dist/proxy.d.ts

@@ -70,6 +70,23 @@ export declare function applyModelAlias(model: string | null | undefined, aliase
  * change is inert until the operator opts in.
  */
 export declare function selectModelOverride(incomingModel: string, modelOverride: string | null, fastModelOverride: string | null): string | null;
+/**
+ * The model ids a request can be billed as, for pricing its key-budget
+ * reservation, which runs before routing. The client's model goes through
+ * the resolution the request path applies (operator alias, provider prefix,
+ * effort suffix, family shorthand, the OpenAI-name map on the chat shape),
+ * and a server-wide --model / --fast-model override is added beside it,
+ * since routing has not yet decided whether it replaces the name. The
+ * reservation is an upper bound, so it prices the costliest of these.
+ */
+export declare function budgetModelsFor(clientModel: string, ctx: {
+    modelAliases?: Record<string, string>;
+    modelOverride: string | null;
+    fastModelOverride: string | null;
+    cliProviderOverride: 'openai' | 'claude' | 'codex' | null;
+    cliModelRaw: string | null | undefined;
+    isOpenAI: boolean;
+}): string[];
 /**
  * Rebuild an OpenAI-shape request body with the model swapped to the pool-
  * fallback target. Null when the body isn't a JSON object — the caller

package/dist/proxy.js

@@ -9,14 +9,14 @@ import { getAccessToken, getStatus, ignoreCcCredentials } from './oauth.js';
 import { buildHealthResponse, derivePoolStatus, probeRequested, shouldDiscloseHealthInternals, shouldRunServingProbe } from './health-response.js';
 import { getServingProbe } from './serving-probe.js';
 import { darioVersion } from './version.js';
-import { CC_TOOL_DEFINITIONS_UNADVERTISABLE, CC_TEMPLATE_PROMPT_BYTES, resolveMaxTokens, buildCCRequest, applyCcPromptCaching, isGenuineCCClient, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, forwardClientCCIdentityHeaders, isMcpToolName, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
+import { CC_TOOL_DEFINITIONS_UNADVERTISABLE, CC_TEMPLATE_PROMPT_BYTES, resolveMaxTokens, buildCCRequest, applyCcPromptCaching, isGenuineCCClient, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, forwardClientCCIdentityHeaders, isMcpToolName, UnsupportedClientToolError, CLIENT_TOOL_MCP_PREFIX, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
 import { stampCch, hasCchSeed } from './cch.js';
 import { foldTiming, timingHeaders, timingLogFields } from './timing.js';
 import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion } from './live-fingerprint.js';
 import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, activeParkedBuckets, reconcilePoolAccounts, resolvePoolStrategy, resolvePoolHeadroomFloor, describePoolStrategy, DEFAULT_POOL_HEADROOM_FLOOR, utilFreshness, rateLimitWindow, accountAction, accountPeers, distinctAccounts, describeRejection, maskEmail, isAccountEligible } from './pool.js';
 import { backfillIdentity } from './accounts.js';
 import { PoolSync, DEFAULT_POOL_SYNC_INTERVAL_MS } from './pool-sync.js';
-import { Analytics, billingBucketFromClaim, costOfTokens, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, CODEX_CLAIM } from './analytics.js';
+import { Analytics, billingBucketFromClaim, costOfTokensFailClosed, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, CODEX_CLAIM } from './analytics.js';
 import { Ledger, resolveLedgerPath, ledgerDisabledByEnv } from './ledger.js';
 import { renderPrometheus } from './metrics.js';
 import { renderSpendDonuts, renderAnalyticsView, ANALYTICS_UI_SHELL } from './donuts.js';
@@ -54,7 +54,8 @@ import { seedStaleCodexUsage } from './codex-backend.js';
 import { route as routeProvider } from './provider-adapter.js';
 import { selectPoolFallbackModels } from './pool-fallback-tier.js';
 import { RequestQueue, QueueFullError, QueueTimeoutError, DEFAULT_MAX_CONCURRENT, DEFAULT_MAX_QUEUED, DEFAULT_QUEUE_TIMEOUT_MS, resolveMaxConcurrent } from './request-queue.js';
-import { waitForIdle, DEFAULT_SHUTDOWN_GRACE_MS } from './shutdown-drain.js';
+import { waitForIdle, drainThenClose, shutdownTimers, DEFAULT_SHUTDOWN_GRACE_MS } from './shutdown-drain.js';
+import { clampTimerMs } from './timer-ms.js';
 import { redactSecrets } from './redact.js';
 import { BAKED_BASE_MODELS, withLongContextVariants, buildOpenAIModelsList, getModelCatalog, getCachedBases, resolveAliasAgainst, prewarmModelCatalog, retryModelCatalogNow, isSuspendedModel } from './model-catalog.js';
 import { classifyUpstreamRejection, diagnosticSnippet, POOL_PARKED } from './upstream-rejection.js';
@@ -302,7 +303,8 @@ const MODEL_ALIASES = {
  * that needs to Just Work.
  */
 export function resolveClaudeAlias(model) {
-    return resolveAliasAgainst(model, getCachedBases()) ?? MODEL_ALIASES[model] ?? model;
+    // Own keys only: the model is client input, and `__proto__` would read Object.prototype.
+    return resolveAliasAgainst(model, getCachedBases()) ?? (Object.hasOwn(MODEL_ALIASES, model) ? MODEL_ALIASES[model] : model);
 }
 /**
  * User-defined model aliases: client-visible name → target model.
@@ -337,7 +339,9 @@ export function parseModelAliasSpecs(specs) {
 export function applyModelAlias(model, aliases) {
     if (!aliases || !model)
         return null;
-    const target = aliases[model.trim().toLowerCase()];
+    const name = model.trim().toLowerCase();
+    // Own keys only, as in resolveClaudeAlias: the name is client input.
+    const target = Object.hasOwn(aliases, name) ? aliases[name] : undefined;
     if (target === undefined || target === model)
         return null;
     return target;
@@ -361,6 +365,36 @@ export function selectModelOverride(incomingModel, modelOverride, fastModelOverr
         return fastModelOverride;
     return modelOverride;
 }
+/**
+ * The model ids a request can be billed as, for pricing its key-budget
+ * reservation, which runs before routing. The client's model goes through
+ * the resolution the request path applies (operator alias, provider prefix,
+ * effort suffix, family shorthand, the OpenAI-name map on the chat shape),
+ * and a server-wide --model / --fast-model override is added beside it,
+ * since routing has not yet decided whether it replaces the name. The
+ * reservation is an upper bound, so it prices the costliest of these.
+ */
+export function budgetModelsFor(clientModel, ctx) {
+    const out = new Set();
+    const aliased = applyModelAlias(clientModel, ctx.modelAliases) ?? clientModel;
+    const prefix = parseProviderPrefix(aliased);
+    if (prefix) {
+        out.add(prefix.provider === 'claude' ? resolveClaudeAlias(parseEffortSuffix(prefix.model).model) : prefix.model);
+    }
+    else if (ctx.cliProviderOverride === 'openai' && ctx.cliModelRaw) {
+        out.add(ctx.cliModelRaw);
+    }
+    else {
+        const bare = isOpenAIModel(aliased) ? aliased : parseEffortSuffix(aliased).model;
+        out.add(resolveClaudeAlias(bare));
+        if (ctx.isOpenAI && Object.hasOwn(OPENAI_MODEL_MAP, bare))
+            out.add(OPENAI_MODEL_MAP[bare]);
+    }
+    const override = selectModelOverride(aliased, ctx.modelOverride, ctx.fastModelOverride);
+    if (override)
+        out.add(override);
+    return [...out];
+}
 // Provider prefix in the `model` field — `<provider>:<model>`. Forces
 // routing regardless of model-name regex. Only recognized prefixes are
 // parsed, so ollama-style `llama3:8b` (without a recognized prefix)
@@ -400,7 +434,9 @@ export function parseProviderPrefix(model) {
     if (idx <= 0)
         return null;
     const prefix = model.slice(0, idx).toLowerCase();
-    const provider = PROVIDER_PREFIXES[prefix];
+    // Own keys only: PROVIDER_PREFIXES is a plain object, so `__proto__:x` or `constructor:x` would
+    // otherwise read Object.prototype's members as a provider (found by fuzz/reject_parsers.fuzz.js).
+    const provider = Object.hasOwn(PROVIDER_PREFIXES, prefix) ? PROVIDER_PREFIXES[prefix] : undefined;
     if (!provider)
         return null;
     const stripped = model.slice(idx + 1);
@@ -1274,6 +1310,8 @@ export async function startProxy(opts = {}) {
     const toolSubLogged = new Set();
     // Same de-dup contract for the verbose-only MCP-passthrough note.
     const mcpPassthroughLogged = new Set();
+    // Same de-dup contract for the note on client tools carried MCP-shaped.
+    const mcpCarryLogged = new Set();
     // One-shot log for the genuine-CC byte-faithful passthrough path.
     let ccPassthroughLogged = false;
     // Body-dump mode: set via --verbose=2 / -vv or DARIO_LOG_BODIES=1.
@@ -1910,7 +1948,8 @@ export async function startProxy(opts = {}) {
     else if (pool.size > 0 && opts.maxConcurrent !== undefined && opts.maxConcurrent < pool.size) {
         console.error(`[dario] --max-concurrent=${opts.maxConcurrent} is below the ${pool.size} seats in the pool. That flag is a proxy-wide ceiling on in-flight requests, not a per-seat one: at most ${opts.maxConcurrent} requests can be in flight across all ${pool.size} seats, and the rest wait in dario. (dario#1244)`);
     }
-    const upstreamTimeoutMs = opts.upstreamTimeoutMs ?? UPSTREAM_TIMEOUT_MS;
+    // Every upstream abort timer (Claude, codex, openai-compat, continuation) takes this value.
+    const upstreamTimeoutMs = clampTimerMs(opts.upstreamTimeoutMs ?? UPSTREAM_TIMEOUT_MS);
     // Cache context-1m beta availability. Set false once per account after the
     // first "long context" rejection, so we skip sending context-1m on every
     // subsequent request instead of paying the round-trip + retry cost each time.
@@ -3597,13 +3636,20 @@ export async function startProxy(opts = {}) {
                     // it — bounded by what dario will SEND: the client's body plus the
                     // template's prompt (passthrough adds nothing), and the max_tokens
                     // that will go on the wire (the template pins its own default unless
-                    // --max-tokens=client; passthrough forwards the client's).
+                    // --max-tokens=client; passthrough forwards the client's). Priced at
+                    // the model it will be billed as (dario#1378): a short name or a
+                    // --model override priced as written fell back to the sonnet-4-6
+                    // rate, a third of fable's; a model with no published rate is priced
+                    // at the highest one.
                     const pb = parsedBody;
                     const clientMax = pb ? (pb.max_tokens ?? pb.max_completion_tokens ?? pb.max_output_tokens) : undefined;
                     const outboundMax = passthrough
                         ? (typeof clientMax === 'number' ? clientMax : null)
                         : resolveMaxTokens(opts.maxTokens, { max_tokens: clientMax });
-                    budgetReserved = requestBudgetReservation(typeof pb?.model === 'string' ? pb.model : '', body.length, outboundMax, costOfTokens, Date.now(), passthrough ? 0 : CC_TEMPLATE_PROMPT_BYTES);
+                    const billedAs = budgetModelsFor(typeof pb?.model === 'string' ? pb.model : '', {
+                        modelAliases, modelOverride, fastModelOverride, cliProviderOverride, cliModelRaw, isOpenAI,
+                    });
+                    budgetReserved = requestBudgetReservation(billedAs, body.length, outboundMax, costOfTokensFailClosed, Date.now(), passthrough ? 0 : CC_TEMPLATE_PROMPT_BYTES);
                     budgetInflightKey = requestAuth.key.name;
                     keyInflight.set(budgetInflightKey, addReservation(inflightNow, budgetReserved));
                 }
@@ -4449,18 +4495,38 @@ export async function startProxy(opts = {}) {
                         // resolved just above so body and header agree.
                         const idSource = poolAccount ? poolAccount.identity : identity;
                         const bodyIdentity = { deviceId: idSource.deviceId, accountUuid: idSource.accountUuid, sessionId: preBodySessionId };
-                        const { body: ccBody, toolMap, detectedClient, unmappedTools, genuineCC } = buildCCRequest(r, billingTag, CACHE_EPHEMERAL, bodyIdentity, {
-                            preserveTools: opts.preserveTools ?? false,
-                            hybridTools: opts.hybridTools ?? false,
-                            mergeTools: opts.mergeTools ?? false,
-                            noAutoDetect: opts.noAutoDetect ?? false,
-                            effort: requestEffort ?? opts.effort,
-                            maxTokens: opts.maxTokens,
-                            systemPrompt: opts.systemPrompt,
-                            skipFields,
-                            honorClientThinking: opts.honorClientThinking ?? false,
-                            preserveOutputFormat: opts.preserveOutputFormat ?? false,
-                        });
+                        let built;
+                        try {
+                            built = buildCCRequest(r, billingTag, CACHE_EPHEMERAL, bodyIdentity, {
+                                preserveTools: opts.preserveTools ?? false,
+                                hybridTools: opts.hybridTools ?? false,
+                                mergeTools: opts.mergeTools ?? false,
+                                noAutoDetect: opts.noAutoDetect ?? false,
+                                effort: requestEffort ?? opts.effort,
+                                maxTokens: opts.maxTokens,
+                                systemPrompt: opts.systemPrompt,
+                                skipFields,
+                                honorClientThinking: opts.honorClientThinking ?? false,
+                                preserveOutputFormat: opts.preserveOutputFormat ?? false,
+                            });
+                        }
+                        catch (err) {
+                            // A client tool the Claude Code-shaped request cannot carry is
+                            // refused by name. The catch around this block forwards the body
+                            // as received on any other throw, which would drop the tool.
+                            if (!(err instanceof UnsupportedClientToolError))
+                                throw err;
+                            console.log(`[dario] #${requestCount} refused: ${err.message}`);
+                            requestCount++;
+                            res.writeHead(400, JSON_HEADERS);
+                            res.end(JSON.stringify(isOpenAI || isResponses
+                                ? { error: { message: err.message, type: 'invalid_request_error', param: 'tools', code: null } }
+                                : { type: 'error', error: { type: 'invalid_request_error', message: err.message } }));
+                            return;
+                        }
+                        const { body: ccBody, toolMap, detectedClient, unmappedTools: notInToolMap, carriedAsMcp = [], genuineCC } = built;
+                        // The tools that rode a fallback slot; the MCP-shaped ones have their own note below.
+                        const unmappedTools = notInToolMap.filter((n) => !carriedAsMcp.includes(n));
                         // Prompt-cache the tools + conversation prefix (the system prompt
                         // is already cached in ccBody's system blocks). Mirrors CC's cache
                         // breakpoints so a long session doesn't re-bill them as fresh input
@@ -4515,6 +4581,15 @@ export async function startProxy(opts = {}) {
                             const more = unmappedTools.length > 5 ? `, +${unmappedTools.length - 5} more` : '';
                             console.log(`[dario] tool substitution: ${unmappedTools.length}/${totalTools} client tool${unmappedTools.length === 1 ? '' : 's'} not in TOOL_MAP — remapped onto CC fallback slots (${sample}${more}). Pass --preserve-tools to forward your schemas verbatim instead.`);
                         }
+                        // Client tools outside CC's set on a request that names CC tools go
+                        // out under MCP-shaped names with their own schemas: say so once
+                        // per client family, so the renamed names in a body dump are expected.
+                        if (carriedAsMcp.length > 0 && !preserveToolsEffective && !mcpCarryLogged.has(subKey)) {
+                            mcpCarryLogged.add(subKey);
+                            const sample = carriedAsMcp.slice(0, 5).join(', ');
+                            const more = carriedAsMcp.length > 5 ? `, +${carriedAsMcp.length - 5} more` : '';
+                            console.log(`[dario] ${carriedAsMcp.length} client tool${carriedAsMcp.length === 1 ? '' : 's'} outside Claude Code's set carried as ${CLIENT_TOOL_MCP_PREFIX}<name> with ${carriedAsMcp.length === 1 ? 'its' : 'their'} own schema${carriedAsMcp.length === 1 ? '' : 's'} (${sample}${more}); calls come back under the client's names.`);
+                        }
                         // MCP tools (mcp__<server>__<tool>) forward verbatim in default
                         // mode — real CC advertises session-attached MCP schemas as-is,
                         // so this is passthrough, not substitution. Verbose-only note so
@@ -4707,7 +4782,7 @@ export async function startProxy(opts = {}) {
             const totalDelay = Math.max(pacingDelay, thinkDelay, sessionStartDelay);
             if (totalDelay > 0) {
                 pacingMs += totalDelay;
-                await new Promise(r => setTimeout(r, totalDelay));
+                await new Promise(r => setTimeout(r, clampTimerMs(totalDelay)));
             }
             seatClock.lastRequestTime = Date.now();
             // Session ID: resolved through the rotation registry keyed by the selected
@@ -6030,19 +6105,21 @@ export async function startProxy(opts = {}) {
         clearInterval(presenceInterval);
         clearInterval(refreshInterval);
         poolSync?.stop();
-        if (logFileStream)
-            logFileStream.end();
-        keyStore?.close();
         // Stop accepting connections now; responses already streaming keep going.
-        // Then flush tokens (best-effort), drain what is in flight up to the
-        // grace, and exit. The force-exit guard sits past the grace so a stream
-        // that never ends cannot wedge shutdown, and a hung fsync cannot either.
+        // Tokens and what the ledger already holds are written while the drain
+        // waits. The ledger, the key store and the request log close only after
+        // the drain: a request that finishes inside the grace still records its
+        // spend, its key's daily total and its log line (dario#1370). The
+        // force-exit guard sits past the grace so a stream that never ends cannot
+        // wedge shutdown, and a hung fsync cannot either.
         server.close();
-        const graceMs = opts.shutdownGraceMs ?? DEFAULT_SHUTDOWN_GRACE_MS;
-        void Promise.all([flushPoolTokens(), ledger?.close()])
-            .then(() => waitForIdle(() => queue.snapshot().active, { graceMs }))
-            .finally(() => process.exit(0));
-        setTimeout(() => process.exit(0), graceMs + 5000).unref();
+        const { graceMs, forceExitMs } = shutdownTimers(opts.shutdownGraceMs ?? DEFAULT_SHUTDOWN_GRACE_MS);
+        void drainThenClose(() => waitForIdle(() => queue.snapshot().active, { graceMs }), {
+            before: [flushPoolTokens, () => ledger?.flush()],
+            after: [() => ledger?.close(), () => keyStore?.close(), () => { if (logFileStream)
+                    logFileStream.end(); }],
+        }).finally(() => process.exit(0));
+        setTimeout(() => process.exit(0), forceExitMs).unref();
     };
     process.on('SIGINT', shutdown);
     process.on('SIGTERM', shutdown);

package/dist/request-queue.js

@@ -22,6 +22,7 @@
  *
  * dario#80 (Gemini review push-back).
  */
+import { clampTimerMs } from './timer-ms.js';
 /** Pure admission decision — no side effects, no clock dep. */
 export function decideAdmit(state) {
     if (state.active < state.maxConcurrent)
@@ -94,7 +95,8 @@ export class RequestQueue {
     constructor(opts = {}) {
         this.maxConcurrent = opts.maxConcurrent ?? DEFAULT_MAX_CONCURRENT;
         this.maxQueued = opts.maxQueued ?? DEFAULT_MAX_QUEUED;
-        this.queueTimeoutMs = opts.queueTimeoutMs ?? DEFAULT_QUEUE_TIMEOUT_MS;
+        // A timer's delay: capped where Node would otherwise fire it after 1 ms (timer-ms.ts).
+        this.queueTimeoutMs = clampTimerMs(opts.queueTimeoutMs ?? DEFAULT_QUEUE_TIMEOUT_MS);
         this.maxConcurrentPerConsumer = Math.max(0, opts.maxConcurrentPerConsumer ?? 0);
         this.unrefTimers = opts.unrefTimers ?? true;
         this.now = opts.now ?? Date.now;

package/dist/serving-probe.js

@@ -3,6 +3,7 @@
  * Opt-in, trusted-callers-only, cached and single-flighted.
  */
 import { classifyUpstreamRejection, rejectionRemediation } from './upstream-rejection.js';
+import { clampTimerMs } from './timer-ms.js';
 const ANTHROPIC_MESSAGES = 'https://api.anthropic.com/v1/messages';
 const ANTHROPIC_VERSION = '2023-06-01';
 const OAUTH_BETA = 'oauth-2025-04-20';
@@ -45,7 +46,7 @@ async function runProbe(deps) {
     const f = deps.fetchImpl ?? fetch;
     const now = deps.now ?? Date.now;
     const model = deps.model ?? process.env.DARIO_PROBE_MODEL ?? DEFAULT_PROBE_MODEL;
-    const timeoutMs = deps.timeoutMs ?? envInt('DARIO_PROBE_TIMEOUT_MS', DEFAULT_PROBE_TIMEOUT_MS);
+    const timeoutMs = clampTimerMs(deps.timeoutMs ?? envInt('DARIO_PROBE_TIMEOUT_MS', DEFAULT_PROBE_TIMEOUT_MS));
     const startedAt = now();
     const ctl = new AbortController();
     const timer = setTimeout(() => ctl.abort(), timeoutMs);

package/dist/shutdown-drain.d.ts

@@ -14,6 +14,18 @@
  */
 /** How long a SIGTERM waits for in-flight requests by default. */
 export declare const DEFAULT_SHUTDOWN_GRACE_MS = 90000;
+/** How long past the grace the force-exit guard waits before exiting anyway. */
+export declare const SHUTDOWN_FORCE_EXIT_MARGIN_MS = 5000;
+/**
+ * The drain's grace and the force-exit guard's delay for a configured grace.
+ * The guard is a timer, so the grace is capped where grace plus margin still
+ * fits one (timer-ms.ts): past that the guard would fire at once and skip
+ * the drain.
+ */
+export declare function shutdownTimers(graceMs: number): {
+    graceMs: number;
+    forceExitMs: number;
+};
 /** How often the drain re-reads the in-flight count. */
 export declare const SHUTDOWN_POLL_MS = 250;
 export interface DrainOptions {
@@ -41,3 +53,17 @@ export interface DrainResult {
  * poll, so a long drain is two lines rather than a scroll.
  */
 export declare function waitForIdle(getActive: () => number, opts: DrainOptions): Promise<DrainResult>;
+/**
+ * The order `shutdown` runs its steps in: `before` and the drain start
+ * together, and `after` runs only once the drain has returned.
+ *
+ * Anything a finishing request writes to belongs in `after`. The ledger
+ * refuses rows once closed and an ended log stream drops lines, so closing
+ * either before the drain loses exactly the requests the drain waits for:
+ * the long streamed runs that finish inside the grace. A step that throws
+ * or rejects is skipped; the others still run and shutdown still exits.
+ */
+export declare function drainThenClose(drain: () => Promise<unknown>, steps: {
+    before?: Array<() => unknown>;
+    after?: Array<() => unknown>;
+}): Promise<void>;

package/dist/shutdown-drain.js

@@ -12,8 +12,21 @@
  * runs out. It is pure over its inputs — the count, the clock and the sleep
  * are injected — so the policy is tested without a server or real timers.
  */
+import { clampTimerMs, MAX_TIMER_MS } from './timer-ms.js';
 /** How long a SIGTERM waits for in-flight requests by default. */
 export const DEFAULT_SHUTDOWN_GRACE_MS = 90_000;
+/** How long past the grace the force-exit guard waits before exiting anyway. */
+export const SHUTDOWN_FORCE_EXIT_MARGIN_MS = 5_000;
+/**
+ * The drain's grace and the force-exit guard's delay for a configured grace.
+ * The guard is a timer, so the grace is capped where grace plus margin still
+ * fits one (timer-ms.ts): past that the guard would fire at once and skip
+ * the drain.
+ */
+export function shutdownTimers(graceMs) {
+    const grace = Math.min(clampTimerMs(graceMs), MAX_TIMER_MS - SHUTDOWN_FORCE_EXIT_MARGIN_MS);
+    return { graceMs: grace, forceExitMs: grace + SHUTDOWN_FORCE_EXIT_MARGIN_MS };
+}
 /** How often the drain re-reads the in-flight count. */
 export const SHUTDOWN_POLL_MS = 250;
 const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -46,3 +59,18 @@ export async function waitForIdle(getActive, opts) {
         }
     }
 }
+/**
+ * The order `shutdown` runs its steps in: `before` and the drain start
+ * together, and `after` runs only once the drain has returned.
+ *
+ * Anything a finishing request writes to belongs in `after`. The ledger
+ * refuses rows once closed and an ended log stream drops lines, so closing
+ * either before the drain loses exactly the requests the drain waits for:
+ * the long streamed runs that finish inside the grace. A step that throws
+ * or rejects is skipped; the others still run and shutdown still exits.
+ */
+export async function drainThenClose(drain, steps) {
+    const run = (fns) => Promise.all((fns ?? []).map((fn) => Promise.resolve().then(fn).catch(() => undefined)));
+    await Promise.all([run(steps.before), drain().catch(() => undefined)]);
+    await run(steps.after);
+}

package/dist/timer-ms.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Delays that reach setTimeout / setInterval from an operator's env var,
+ * flag, config file or startProxy option.
+ *
+ * Node keeps a timer delay in a signed 32-bit int: anything above
+ * 2^31 - 1 ms (about 24.8 days), and anything non-finite, is replaced with
+ * 1 ms and a TimeoutOverflowWarning. A "very long" setting therefore becomes
+ * the shortest one: DARIO_CODEX_USAGE_POLL_MS=3000000000 turned the idle-seat
+ * poll into a 1 ms loop of account reloads and /wham/usage calls (dario#1400),
+ * and a huge DARIO_SHUTDOWN_GRACE_MS fired the force-exit at once, skipping
+ * the drain (dario#1370). Every such delay goes through clampTimerMs first.
+ */
+/** The longest delay setTimeout and setInterval honour. */
+export declare const MAX_TIMER_MS: number;
+/**
+ * `ms` held to [0, MAX_TIMER_MS]: above the ceiling (Infinity included) it is
+ * the ceiling, the longest wait a timer can express; negative or NaN is 0.
+ */
+export declare function clampTimerMs(ms: number): number;

package/dist/timer-ms.js

@@ -0,0 +1,23 @@
+/**
+ * Delays that reach setTimeout / setInterval from an operator's env var,
+ * flag, config file or startProxy option.
+ *
+ * Node keeps a timer delay in a signed 32-bit int: anything above
+ * 2^31 - 1 ms (about 24.8 days), and anything non-finite, is replaced with
+ * 1 ms and a TimeoutOverflowWarning. A "very long" setting therefore becomes
+ * the shortest one: DARIO_CODEX_USAGE_POLL_MS=3000000000 turned the idle-seat
+ * poll into a 1 ms loop of account reloads and /wham/usage calls (dario#1400),
+ * and a huge DARIO_SHUTDOWN_GRACE_MS fired the force-exit at once, skipping
+ * the drain (dario#1370). Every such delay goes through clampTimerMs first.
+ */
+/** The longest delay setTimeout and setInterval honour. */
+export const MAX_TIMER_MS = 2 ** 31 - 1;
+/**
+ * `ms` held to [0, MAX_TIMER_MS]: above the ceiling (Infinity included) it is
+ * the ceiling, the longest wait a timer can express; negative or NaN is 0.
+ */
+export function clampTimerMs(ms) {
+    if (Number.isNaN(ms) || ms <= 0)
+        return 0;
+    return ms >= MAX_TIMER_MS ? MAX_TIMER_MS : ms;
+}

package/docs/integrations/agent-compat.md

@@ -19,12 +19,14 @@ For a one-page status table of every tool dario supports — working / inferred
 
 Text-tool clients (Cline / Kilo Code / Roo Code and forks) are auto-detected via system-prompt identity markers and automatically flipped into preserve-tools mode, because mixing CC's `tools` array with their XML protocol makes the model emit `<function_calls><invoke>` that their parsers can't read. The same identity path also catches `hands` (askalf's computer-use agent) — its tool names overlap with `TOOL_MAP` but its schemas diverge, so identity match → preserve-tools is the only correct routing. If you run dario specifically for wire-level fidelity and would rather pick `--preserve-tools` yourself, `--no-auto-detect` (v3.20.1, aka `--no-auto-preserve`) disables the heuristic — explicit operator choice then wins.
 
-Beyond the identity path, dario falls back to a **structural** check: when a request carries 3+ tools and ≥80% of them aren't in `TOOL_MAP`, that's a custom client whose tool surface has effectively no overlap with CC's, and round-robin remap onto CC fallback slots silently corrupts the calls. The structural fallback flips those requests to preserve-tools too, with `client: 'unknown-non-cc'` in the request log. This catches in-house agents and OpenClaw derivatives that we haven't added an explicit pattern for, without needing per-client maintenance. `--no-auto-detect` disables both paths.
+Beyond the identity path, dario falls back to a **structural** check: when a request carries 3+ tools and ≥80% of them aren't in `TOOL_MAP`, that's a custom client whose tool surface has effectively no overlap with CC's, and round-robin remap onto CC fallback slots silently corrupts the calls. The structural fallback flips those requests to preserve-tools too, with `client: 'unknown-non-cc'` in the request log. This catches in-house agents and OpenClaw derivatives that we haven't added an explicit pattern for, without needing per-client maintenance. A smaller surface flips too when it carries a tool outside `TOOL_MAP`, no Claude Code tool name in exact case, and a lowercase alias that shares a Claude Code tool's name (`grep`, `bash`): Claude Code names its own tools in exact case, so such a surface is another client's and goes out as declared. `--no-auto-detect` disables both paths.
 
 Platform-scoped CC natives (`PowerShell`, `Glob`, `Grep` — win32-only in CC's own tool list) map by the **client's** declaration, not the proxy host's platform (v4.8.136): a win32 CC client through a Linux-hosted dario gets their canonical definitions instead of having them dropped from the advertised array.
 
 MCP tools take a third path: anything named `mcp__<server>__<tool>` is neither remapped nor flipped to preserve — it forwards **verbatim** and its calls flow back untouched (v4.8.135). That's what real CC does with session-attached MCP servers; their schemas are operator-supplied and have no canonical template entry, so passthrough *is* the CC wire shape. Before this, a CC session with an MCP server attached had its `mcp__*` surface dropped from the advertised array and its history references round-robined onto fallback slots (`tool substitution: 28/52 client tools not in TOOL_MAP` in the live log), and two or three attached servers were enough to trip the 80% structural threshold on their own. MCP names no longer count toward that threshold.
 
+A request that names Claude Code tools and also declares a tool outside `TOOL_MAP` (`Grep`, `Read`, `submit_review`) stays in remap, and the extra tool gets the MCP treatment: it goes out as `mcp__client__<name>` with the client's own schema, after the CC tools, and the model's calls come back under the client's name. Remap advertises only the CC tools such a request declares, so the fallback slot it used to ride was never on the wire. A tool that cannot be carried that way (an Anthropic-defined tool such as `computer_20251124`, a tool with no `input_schema`, or a name longer than 51 characters) fails the request with a 400 that names it. `--preserve-tools` forwards all of them verbatim instead.
+
 If your agent's tool names aren't pre-mapped and its tools carry fields CC's schema doesn't have, there are two escape hatches: **`--preserve-tools`** (forward your schema verbatim, lose the CC wire shape) or **`--hybrid-tools`** (keep the CC wire shape, fill request-context fields from headers). See [Custom tool schemas](#custom-tool-schemas).
 
 The OpenAI-compat backend forwards tool definitions byte-for-byte and doesn't need any of this.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.12.6",
+  "version": "6.12.7",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {