@askalf/dario 6.12.6 → 6.12.8

package/dist/analytics.d.ts

@@ -249,6 +249,28 @@ export declare function providerOfModel(model: string): PricingProvider;
  * repeated `[` backtrack quadratically (200k of them held the event loop ~25s).
  */
 export declare function pricingRateFor(model: string, atMs: number): Rate;
+/** True when `model` has a row of its own in PRICING or OPENAI_PRICING, rather than a fallback's. */
+export declare function hasPublishedRate(model: string): boolean;
+/**
+ * The highest rate either price list carries, bucket by bucket (intro rates
+ * included). An upper bound on what any listed model bills, for pricing a
+ * model that has no row of its own where a low estimate would let spend
+ * through.
+ */
+export declare function highestPublishedRate(): Rate;
+/**
+ * costOfTokens for an upper bound (the key-budget reservation): a model with
+ * no published rate is priced at highestPublishedRate, never at the
+ * sonnet-4-6 / gpt-5.6-terra fallback, which is cheaper than fable, astra
+ * and every opus. Matched case-insensitively, as the Claude path lowercases
+ * the model it sends.
+ */
+export declare function costOfTokensFailClosed(model: string, atMs: number, t: {
+    inputTokens: number;
+    outputTokens: number;
+    cacheReadTokens: number;
+    cacheCreateTokens: number;
+}): number;
 /**
  * USD the four token buckets would bill at `model`'s rate in effect at `atMs`.
  * The ledger prices its per-day rows through this too, so a pricing

package/dist/analytics.js

@@ -287,7 +287,7 @@ export function providerOfModel(model) {
  * repeated `[` backtrack quadratically (200k of them held the event loop ~25s).
  */
 export function pricingRateFor(model, atMs) {
-    const baseModel = model.replace(/\[[^[\]]*\]$/, '').replace(/:[a-z]+$/i, '').replace(/-\d{8}$/, '');
+    const baseModel = pricingBaseModel(model);
     if (providerOfModel(baseModel) === 'openai') {
         const rate = OPENAI_PRICING[baseModel] ?? OPENAI_PRICING[OPENAI_FALLBACK_MODEL];
         return { ...rate };
@@ -299,6 +299,49 @@ export function pricingRateFor(model, atMs) {
     }
     return { input: entry.input, output: entry.output, cacheRead: entry.cacheRead, cacheCreate: entry.cacheCreate };
 }
+/** The id a price list is keyed by: context tag, effort suffix and date stamp removed. */
+function pricingBaseModel(model) {
+    return model.replace(/\[[^[\]]*\]$/, '').replace(/:[a-z]+$/i, '').replace(/-\d{8}$/, '');
+}
+/** True when `model` has a row of its own in PRICING or OPENAI_PRICING, rather than a fallback's. */
+export function hasPublishedRate(model) {
+    const base = pricingBaseModel(model);
+    return Object.hasOwn(PRICING, base) || Object.hasOwn(OPENAI_PRICING, base);
+}
+/**
+ * The highest rate either price list carries, bucket by bucket (intro rates
+ * included). An upper bound on what any listed model bills, for pricing a
+ * model that has no row of its own where a low estimate would let spend
+ * through.
+ */
+export function highestPublishedRate() {
+    const rates = [...Object.values(OPENAI_PRICING)];
+    for (const e of Object.values(PRICING)) {
+        rates.push(e);
+        if (e.intro)
+            rates.push(e.intro);
+    }
+    return {
+        input: Math.max(...rates.map((r) => r.input)),
+        output: Math.max(...rates.map((r) => r.output)),
+        cacheRead: Math.max(...rates.map((r) => r.cacheRead)),
+        cacheCreate: Math.max(...rates.map((r) => r.cacheCreate)),
+    };
+}
+/**
+ * costOfTokens for an upper bound (the key-budget reservation): a model with
+ * no published rate is priced at highestPublishedRate, never at the
+ * sonnet-4-6 / gpt-5.6-terra fallback, which is cheaper than fable, astra
+ * and every opus. Matched case-insensitively, as the Claude path lowercases
+ * the model it sends.
+ */
+export function costOfTokensFailClosed(model, atMs, t) {
+    const id = model.toLowerCase();
+    if (hasPublishedRate(id))
+        return costOfTokens(id, atMs, t);
+    const p = highestPublishedRate();
+    return ((t.inputTokens * p.input) + (t.outputTokens * p.output) + (t.cacheReadTokens * p.cacheRead) + (t.cacheCreateTokens * p.cacheCreate)) / 1_000_000;
+}
 /**
  * USD the four token buckets would bill at `model`'s rate in effect at `atMs`.
  * The ledger prices its per-day rows through this too, so a pricing

package/dist/cc-template.d.ts

@@ -79,6 +79,30 @@ export declare const CC_NATIVE_NAMES: Set<string>;
  *  a CC session with an MCP server attached. Like CC_NATIVE_NAMES, these
  *  identity-map and skip TOOL_MAP entirely. */
 export declare function isMcpToolName(name: unknown): boolean;
+/** Server segment of the MCP-shaped name a client tool outside Claude Code's
+ *  set is carried under on a Claude Code-shaped request: `submit_review` goes
+ *  out as `mcp__client__submit_review`. Every tool real Claude Code sends
+ *  beyond its built-ins is named `mcp__<server>__<tool>`, so a bare foreign
+ *  name next to Claude Code's tools is a shape it never produces. */
+export declare const CLIENT_TOOL_MCP_PREFIX = "mcp__client__";
+/**
+ * A client tool that cannot go out on a Claude Code-shaped request: not a
+ * custom tool with an input_schema (an Anthropic-defined tool such as
+ * `computer_20251124` keeps its fixed name and cannot be renamed), or a name
+ * that does not fit Anthropic's tool-name limit once MCP-shaped. The proxy
+ * answers 400 naming each tool; dropping one would leave the model unable to
+ * call a tool the client declared.
+ */
+export declare class UnsupportedClientToolError extends Error {
+    readonly tools: ReadonlyArray<{
+        name: string;
+        reason: string;
+    }>;
+    constructor(tools: Array<{
+        name: string;
+        reason: string;
+    }>);
+}
 /** CC's static system prompt (~25KB). The shared base — baked from a non-Fable
  *  model (Opus). CC ships some models a larger, model-specific prompt; see
  *  CC_SYSTEM_PROMPT_FABLE / systemPromptForModel. */
@@ -302,10 +326,15 @@ export declare function detectTextToolClient(systemText: string): string | null;
  *   floor ([memory_store, db_query]). Before this, those 2-tool surfaces fell
  *   under a len<3 guard and got round-robined onto CC fallback slots, which
  *   silently corrupts every call (the model upstream never sees the real tool).
- * - Mixed surface (some tools map): require 3+ tools AND ≥80% unmapped. The 80%
- *   leaves room for a non-CC client that legitimately reuses 1-2 of TOOL_MAP's
- *   bash/grep/read aliases; the 3-tool floor avoids mis-flagging a partial CC
- *   load (1-2 tools, some mapped) mid-handshake — those stay null and remap.
+ * - A foreign tool, no CC-native name, and an alias that shares a CC tool's
+ *   name (`grep`, `bash`): non-CC at any ratio. Claude Code declares its own
+ *   tools by their exact names, so such a surface is some other client's, and
+ *   its own schemas are what it parses; remap would put its aliases through
+ *   TOOL_MAP's argument translation. A surface that names no CC tool gets the
+ *   full template instead and stays in remap, fallback slots visible.
+ * - Mixed surface otherwise: require 3+ tools AND ≥80% unmapped. The 80% leaves
+ *   room for a non-CC client that legitimately reuses 1-2 of TOOL_MAP's
+ *   aliases; the 3-tool floor keeps a 1-2 tool partial CC load in remap.
  */
 export declare function detectNonCCByTools(clientTools: Array<Record<string, unknown>> | undefined): string | null;
 /**
@@ -564,6 +593,7 @@ export declare function buildCCRequest(clientBody: Record<string, unknown>, bill
     body: Record<string, unknown>;
     toolMap: Map<string, ToolMapping>;
     unmappedTools: string[];
+    carriedAsMcp?: string[];
     detectedClient?: string;
     genuineCC?: boolean;
 };

package/dist/cc-template.js

@@ -76,6 +76,9 @@ export const CC_TEMPLATE_PROMPT_BYTES = (() => {
 })();
 /** Every name the bundle knows — including one whose definition is not advertisable (dario#1376). */
 export const CC_NATIVE_NAMES_UNION = new Set(TEMPLATE.tools.map((t) => String(t.name)));
+/** Lowercased names of the advertisable non-MCP CC tools: the set buildCCRequest
+ *  matches a client declaration against, case-insensitively, when it advertises. */
+const CC_TOOL_NAMES_LOWER = new Set(CC_TOOL_DEFINITIONS_UNION.filter((t) => !isMcpToolName(t.name)).map((t) => t.name.toLowerCase()));
 /** CC's own tool names, EXACT case ("Read", "Bash", "Agent", …). A CC client's
  *  tools identity-map to themselves and OVERRIDE TOOL_MAP — whose lowercase
  *  cross-client aliases ('read' → {path}/{filePath}) would otherwise mistranslate
@@ -99,6 +102,33 @@ export const CC_NATIVE_NAMES = new Set(CC_TOOL_DEFINITIONS.map((t) => String(t.n
 export function isMcpToolName(name) {
     return typeof name === 'string' && name.startsWith('mcp__');
 }
+/** Server segment of the MCP-shaped name a client tool outside Claude Code's
+ *  set is carried under on a Claude Code-shaped request: `submit_review` goes
+ *  out as `mcp__client__submit_review`. Every tool real Claude Code sends
+ *  beyond its built-ins is named `mcp__<server>__<tool>`, so a bare foreign
+ *  name next to Claude Code's tools is a shape it never produces. */
+export const CLIENT_TOOL_MCP_PREFIX = 'mcp__client__';
+/** Anthropic's limit on a tool name. The MCP-shaped name has to fit it. */
+const TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]{1,64}$/;
+/**
+ * A client tool that cannot go out on a Claude Code-shaped request: not a
+ * custom tool with an input_schema (an Anthropic-defined tool such as
+ * `computer_20251124` keeps its fixed name and cannot be renamed), or a name
+ * that does not fit Anthropic's tool-name limit once MCP-shaped. The proxy
+ * answers 400 naming each tool; dropping one would leave the model unable to
+ * call a tool the client declared.
+ */
+export class UnsupportedClientToolError extends Error {
+    tools;
+    constructor(tools) {
+        super(`dario cannot carry ${tools.length === 1 ? 'this client tool' : 'these client tools'} on a Claude Code-shaped request: `
+            + tools.map((t) => `"${t.name}" (${t.reason})`).join('; ')
+            + '. Declare each as a custom tool with an input_schema and a name of at most '
+            + `${64 - CLIENT_TOOL_MCP_PREFIX.length} characters, or run dario with --preserve-tools to forward your tools verbatim.`);
+        this.name = 'UnsupportedClientToolError';
+        this.tools = tools;
+    }
+}
 /** CC's static system prompt (~25KB). The shared base — baked from a non-Fable
  *  model (Opus). CC ships some models a larger, model-specific prompt; see
  *  CC_SYSTEM_PROMPT_FABLE / systemPromptForModel. */
@@ -666,15 +696,22 @@ export function detectTextToolClient(systemText) {
  *   floor ([memory_store, db_query]). Before this, those 2-tool surfaces fell
  *   under a len<3 guard and got round-robined onto CC fallback slots, which
  *   silently corrupts every call (the model upstream never sees the real tool).
- * - Mixed surface (some tools map): require 3+ tools AND ≥80% unmapped. The 80%
- *   leaves room for a non-CC client that legitimately reuses 1-2 of TOOL_MAP's
- *   bash/grep/read aliases; the 3-tool floor avoids mis-flagging a partial CC
- *   load (1-2 tools, some mapped) mid-handshake — those stay null and remap.
+ * - A foreign tool, no CC-native name, and an alias that shares a CC tool's
+ *   name (`grep`, `bash`): non-CC at any ratio. Claude Code declares its own
+ *   tools by their exact names, so such a surface is some other client's, and
+ *   its own schemas are what it parses; remap would put its aliases through
+ *   TOOL_MAP's argument translation. A surface that names no CC tool gets the
+ *   full template instead and stays in remap, fallback slots visible.
+ * - Mixed surface otherwise: require 3+ tools AND ≥80% unmapped. The 80% leaves
+ *   room for a non-CC client that legitimately reuses 1-2 of TOOL_MAP's
+ *   aliases; the 3-tool floor keeps a 1-2 tool partial CC load in remap.
  */
 export function detectNonCCByTools(clientTools) {
     if (!clientTools || clientTools.length === 0)
         return null;
     let unmapped = 0;
+    let native = false;
+    let sharesCCName = false;
     for (const tool of clientTools) {
         const rawName = tool.name || '';
         // A tool is "foreign" only if dario can neither map it (TOOL_MAP, by
@@ -693,7 +730,13 @@ export function detectNonCCByTools(clientTools) {
         // verbatim rather than falling back to the full CC template.
         // Union set, not the host-filtered one: a win32 client's PowerShell is
         // native regardless of the platform dario itself runs on (v4.8.136).
-        if (!TOOL_MAP[rawName.toLowerCase()] && !CC_NATIVE_NAMES_UNION.has(rawName) && !isMcpToolName(rawName))
+        if (CC_NATIVE_NAMES_UNION.has(rawName)) {
+            native = true;
+            continue;
+        }
+        if (CC_TOOL_NAMES_LOWER.has(rawName.toLowerCase()))
+            sharesCCName = true;
+        if (!TOOL_MAP[rawName.toLowerCase()] && !isMcpToolName(rawName))
             unmapped++;
     }
     const ratio = unmapped / clientTools.length;
@@ -702,6 +745,11 @@ export function detectNonCCByTools(clientTools) {
     // genuinely foreign client hits it.
     if (ratio === 1)
         return 'unknown-non-cc';
+    // Claude Code declares its own tools by their exact names. A foreign tool
+    // next to an alias sharing a CC tool's name, with no exact-case CC name, is
+    // another client's surface: its tools go out as declared.
+    if (unmapped > 0 && !native && sharesCCName)
+        return 'unknown-non-cc';
     // Mixed surface: only flag once there are enough tools to be confident.
     if (clientTools.length >= 3 && ratio >= 0.8)
         return 'unknown-non-cc';
@@ -1845,13 +1893,18 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
     // the fingerprint risk on their own account.
     const activeToolMap = new Map();
     const unmappedTools = [];
+    // CC tools a declared client tool maps onto (identity or TOOL_MAP alias, not
+    // the round-robin fallback slots). Read by the advertise step below.
+    const claimedCC = new Set();
+    // Client tools outside CC's set, under their MCP-shaped names, advertised
+    // after the MCP tools by the step below.
+    const mcpShapedTools = [];
     if (clientTools && !effectivePreserveTools && !effectiveMergeTools) {
         // Two passes so the unmapped-tool distributor can avoid colliding with
         // CC tools the client already uses directly. Without this, a client
         // sending both `WebSearch` and some unmapped tool like `memory_get`
         // could have both forward-map to `WebSearch`, and the reverse map would
         // then rewrite real `WebSearch` responses to the collided client name.
-        const claimedCC = new Set();
         for (const tool of clientTools) {
             const name = (tool.name || '').toLowerCase();
             // A CC client's OWN tools map to THEMSELVES (identity), and this OVERRIDES
@@ -1906,7 +1959,18 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
         //   wants {action: "run"}). Better to let the model not see those tools
         //   than to pretend they exist and corrupt every call. Users needing
         //   every client tool to actually work must use --preserve-tools.
+        //
+        // - A declaration that names a CC tool: the advertise step sends only the
+        //   CC tools the client declared, so a fallback slot is never on the wire
+        //   and a round-robined tool would be invisible to the model. Each
+        //   unmapped tool goes out instead the way real CC sends a tool beyond its
+        //   built-ins: the client's own definition under an `mcp__<server>__<tool>`
+        //   name, arguments untouched, renamed back on the response. A tool that
+        //   cannot be carried that way fails the request with its name.
         const CC_FALLBACK_TOOLS = ['Bash', 'Read', 'Grep', 'Glob', 'WebSearch', 'WebFetch'];
+        const namesCCTool = clientTools.some((t) => typeof t.name === 'string' && !isMcpToolName(t.name) && CC_TOOL_NAMES_LOWER.has(t.name.toLowerCase()));
+        const declaredNames = new Set(clientTools.map((t) => t.name));
+        const uncarried = [];
         for (const tool of clientTools) {
             const name = (tool.name || '').toLowerCase();
             if (CC_NATIVE_NAMES_UNION.has(tool.name) || isMcpToolName(tool.name) || TOOL_MAP[name])
@@ -1914,6 +1978,28 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
             unmappedTools.push(tool.name);
             if (opts.hybridTools)
                 continue; // dropped — see comment above
+            if (namesCCTool) {
+                const clientName = typeof tool.name === 'string' ? tool.name : '';
+                const wireName = `${CLIENT_TOOL_MCP_PREFIX}${clientName}`;
+                const toolType = tool.type;
+                if (!clientName) {
+                    uncarried.push({ name: String(tool.name ?? ''), reason: 'no name' });
+                }
+                else if ((toolType !== undefined && toolType !== 'custom') || !isAdvertisableToolDefinition(tool)) {
+                    uncarried.push({ name: clientName, reason: 'not a custom tool with an input_schema' });
+                }
+                else if (!TOOL_NAME_PATTERN.test(wireName)) {
+                    uncarried.push({ name: clientName, reason: `${wireName} is not a valid tool name of at most 64 characters` });
+                }
+                else if (declaredNames.has(wireName)) {
+                    uncarried.push({ name: clientName, reason: `the client also declares ${wireName}` });
+                }
+                else {
+                    activeToolMap.set(clientName, { ccTool: wireName, translateArgs: (a) => a, translateBack: (a) => a });
+                    mcpShapedTools.push({ ...tool, name: wireName });
+                }
+                continue;
+            }
             // Default mode: round-robin distribution. Exclude CC tools the client
             // already uses so we never create a two-client-names-to-one-CC-tool
             // collision. If every fallback is claimed (rare: client already uses 6+
@@ -1944,6 +2030,8 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
                 reverseScore: 0,
             });
         }
+        if (uncarried.length > 0)
+            throw new UnsupportedClientToolError(uncarried);
     }
     // ── Remap tool_use and tool_result references in message history ──
     // Skip in preserveTools mode — leave conversation history untouched.
@@ -2117,7 +2205,14 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
             // whole request with 400 "tools: Tool names must be unique". MCP
             // schemas are operator-supplied; the client's declaration is the only
             // authoritative source, never the template.
-            const availableCC = CC_TOOL_DEFINITIONS_UNION.filter((t) => !isMcpToolName(t.name) && clientToolNames.has(t.name.toLowerCase()));
+            const namedCC = CC_TOOL_DEFINITIONS_UNION.filter((t) => !isMcpToolName(t.name) && clientToolNames.has(t.name.toLowerCase()));
+            // Once the declaration names any CC tool, every alias also declares the
+            // CC tool it maps onto (`read_file` declares Read): advertising only the
+            // name matches would leave the model unable to call the other mapped
+            // tools. A declaration that names no CC tool keeps the full template.
+            const availableCC = namedCC.length > 0
+                ? CC_TOOL_DEFINITIONS_UNION.filter((t) => !isMcpToolName(t.name) && (clientToolNames.has(t.name.toLowerCase()) || claimedCC.has(t.name)))
+                : namedCC;
             const mcpTools = clientTools.filter((t) => isMcpToolName(t.name));
             // A CC-native name the bundle knows but cannot advertise (dario#1376:
             // `advisor` captured with an empty schema) is still identity-mapped
@@ -2125,8 +2220,10 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
             // verbatim, as MCP tools do. The client's schema is what its parser
             // expects back in any case.
             const clientOwnNative = clientTools.filter((t) => typeof t.name === 'string' && CC_TOOL_DEFINITIONS_UNADVERTISABLE.has(t.name) && isAdvertisableToolDefinition(t));
-            ccRequest.tools = availableCC.length > 0 || mcpTools.length > 0 || clientOwnNative.length > 0
-                ? dedupeToolsByName([...availableCC, ...clientOwnNative, ...mcpTools])
+            // Client tools outside CC's set follow the MCP tools, under the
+            // MCP-shaped names the tool map gave them.
+            ccRequest.tools = availableCC.length > 0 || mcpTools.length > 0 || clientOwnNative.length > 0 || mcpShapedTools.length > 0
+                ? dedupeToolsByName([...availableCC, ...clientOwnNative, ...mcpTools, ...mcpShapedTools])
                 : CC_TOOL_DEFINITIONS;
         }
     }
@@ -2259,7 +2356,10 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
     // to match that. Future CC releases that reshuffle or add a field are then
     // picked up by the next live refresh without a dario release.
     const orderedBody = orderBodyForOutbound(ccRequest);
-    return { body: orderedBody, toolMap: activeToolMap, unmappedTools, detectedClient };
+    // Client names of the unmapped tools that went out MCP-shaped (the rest of
+    // unmappedTools rode fallback slots or, in hybrid mode, were dropped).
+    const carriedAsMcp = unmappedTools.filter((n) => activeToolMap.get(n)?.ccTool === `${CLIENT_TOOL_MCP_PREFIX}${n}`);
+    return { body: orderedBody, toolMap: activeToolMap, unmappedTools, carriedAsMcp, detectedClient };
 }
 /**
  * Build the CC-name → {clientName, mapping} reverse lookup used by both

package/dist/cli.js

@@ -536,8 +536,9 @@ async function proxy() {
         ?? fileCfg.pool?.strategy;
     // --pool-headroom-floor=<ratio|percent> — the headroom at/below which a seat
     // counts as drained: sticky sessions rebind off it and new conversations
-    // skip it. Default 2%; dario#1333 asked to leave a seat alone at 95% used
-    // rather than ride it into the 429.
+    // skip it. Setting the floor makes it a hard stop; the implicit 2% default
+    // stays a routing preference. dario#1333 asked to leave a seat alone at 95%
+    // used rather than ride it into the 429.
     const poolHeadroomFloorFromFlag = args.find((a) => a.startsWith('--pool-headroom-floor='))?.split('=')[1];
     if (poolHeadroomFloorFromFlag !== undefined && parsePoolHeadroomFloor(poolHeadroomFloorFromFlag) === null) {
         console.error(`[dario] Invalid --pool-headroom-floor "${poolHeadroomFloorFromFlag}". Use a ratio or percent between 2% and 50% (e.g. 0.05 or 5%).`);
@@ -2203,8 +2204,9 @@ async function help() {
     --pool-headroom-floor=<ratio|percent>
                              Headroom at or below which a seat counts as
                              drained: a sticky session rebinds off it and
-                             new conversations skip it. 0.05 or 5%;
-                             default 2%, max 50%. Use it when your seats
+                             new conversations skip it. Setting this makes
+                             the floor a hard stop. 0.05 or 5%; implicit
+                             default 2% is a preference, max 50%. Use it when your seats
                              answer with API errors in the last percent
                              of a window (dario#1333).
                              Env: DARIO_POOL_HEADROOM_FLOOR;

package/dist/codex-usage.d.ts

@@ -38,7 +38,11 @@ export declare function parseCodexUsageHeaders(h: HeaderReader, now?: number): C
 export declare function parseCodexUsageEndpoint(body: unknown, now?: number): CodexUsage | null;
 /** How often an IDLE seat is re-read from /wham/usage. A seat that is serving is read from every answer and never polled. */
 export declare const DEFAULT_CODEX_USAGE_POLL_MS: number;
-/** `DARIO_CODEX_USAGE_POLL_MS`: unset/garbage → default, `0` → off, anything else floored at one minute. */
+/**
+ * `DARIO_CODEX_USAGE_POLL_MS`: unset/garbage → default, `0` → off, anything
+ * else floored at one minute and capped at the longest interval a timer can
+ * hold (timer-ms.ts), since a larger one fires every millisecond.
+ */
 export declare function resolveCodexUsagePollMs(raw: string | undefined): number;
 /** Record a reading for a seat. A newer reading replaces an older one; an older one never replaces a newer one. */
 export declare function recordCodexUsage(alias: string, usage: CodexUsage): void;

package/dist/codex-usage.js

@@ -8,6 +8,7 @@
  * which slot is which. Pure and memory-only, so codex-accounts and
  * codex-backend can both import it without a cycle.
  */
+import { clampTimerMs } from './timer-ms.js';
 function finite(raw) {
     if (raw === null || raw === undefined || raw === '')
         return null;
@@ -77,7 +78,11 @@ export function parseCodexUsageEndpoint(body, now = Date.now()) {
 }
 /** How often an IDLE seat is re-read from /wham/usage. A seat that is serving is read from every answer and never polled. */
 export const DEFAULT_CODEX_USAGE_POLL_MS = 30 * 60 * 1000;
-/** `DARIO_CODEX_USAGE_POLL_MS`: unset/garbage → default, `0` → off, anything else floored at one minute. */
+/**
+ * `DARIO_CODEX_USAGE_POLL_MS`: unset/garbage → default, `0` → off, anything
+ * else floored at one minute and capped at the longest interval a timer can
+ * hold (timer-ms.ts), since a larger one fires every millisecond.
+ */
 export function resolveCodexUsagePollMs(raw) {
     if (raw === undefined || raw.trim() === '')
         return DEFAULT_CODEX_USAGE_POLL_MS;
@@ -86,7 +91,7 @@ export function resolveCodexUsagePollMs(raw) {
         return DEFAULT_CODEX_USAGE_POLL_MS;
     if (n === 0)
         return 0;
-    return Math.max(60_000, Math.round(n));
+    return clampTimerMs(Math.max(60_000, Math.round(n)));
 }
 const readings = new Map();
 /** Record a reading for a seat. A newer reading replaces an older one; an older one never replaces a newer one. */

package/dist/doctor-core.js

@@ -23,6 +23,7 @@ import { describeTemplate, detectDrift, checkCCCompat, findInstalledCC, missingV
 import { detectCCOAuthConfig } from './cc-oauth-detect.js';
 import { runAuthorizeProbe } from './cc-authorize-probe.js';
 import { MIGRATED_LOGIN_ALIAS } from './accounts.js';
+import { clampTimerMs } from './timer-ms.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /**
  * Decide what `doctor` should say about pool-exhaustion failover, from
@@ -1138,7 +1139,7 @@ export async function runChecks(opts = {}) {
                     // default: `new AccountPool()` here always predicted a max-headroom
                     // pick, which is the wrong seat on a fill-first pool.
                     const routing = configuredPoolRouting(loadConfig().config.pool);
-                    const pool = new AccountPool(routing.strategy, routing.headroomFloor);
+                    const pool = new AccountPool(routing.strategy, routing.headroomFloorExplicit ? routing.headroomFloor : undefined);
                     for (const acc of loaded) {
                         pool.add(acc.alias, {
                             accessToken: acc.accessToken,
@@ -1454,7 +1455,7 @@ function suggestAuthFix(result) {
  * proxy, does not log, does not persist.
  */
 export async function runAuthCheck(opts = {}) {
-    const timeoutMs = opts.timeoutMs ?? 30_000;
+    const timeoutMs = clampTimerMs(opts.timeoutMs ?? 30_000);
     const expected = opts.expectedKey ?? process.env.DARIO_API_KEY ?? '';
     if (!expected) {
         return {

package/dist/keys.d.ts

@@ -83,10 +83,12 @@ export declare const BUDGET_DEFAULT_MAX_TOKENS = 8192;
 export declare const EMPTY_RESERVATION: KeyBudgetReservation;
 /**
  * The reservation for one request, from what is known before it is sent.
- * `priceOf` is analytics' costOfTokens, injected so this module stays free of
- * the pricing table (the ledger injects the same way).
+ * `priceOf` is analytics' costOfTokensFailClosed on the proxy path, injected
+ * so this module stays free of the pricing table (the ledger injects the same
+ * way). `model` is what the request will be billed as; when routing could
+ * still bill it as one of several, pass them all and the costliest prices it.
  */
-export declare function requestBudgetReservation(model: string, bodyBytes: number, maxTokens: number | null | undefined, priceOf: (model: string, atMs: number, cell: {
+export declare function requestBudgetReservation(model: string | readonly string[], bodyBytes: number, maxTokens: number | null | undefined, priceOf: (model: string, atMs: number, cell: {
     requests: number;
     inputTokens: number;
     outputTokens: number;

package/dist/keys.js

@@ -44,15 +44,19 @@ export const BUDGET_DEFAULT_MAX_TOKENS = 8_192;
 export const EMPTY_RESERVATION = { count: 0, usd: 0, tokens: 0 };
 /**
  * The reservation for one request, from what is known before it is sent.
- * `priceOf` is analytics' costOfTokens, injected so this module stays free of
- * the pricing table (the ledger injects the same way).
+ * `priceOf` is analytics' costOfTokensFailClosed on the proxy path, injected
+ * so this module stays free of the pricing table (the ledger injects the same
+ * way). `model` is what the request will be billed as; when routing could
+ * still bill it as one of several, pass them all and the costliest prices it.
  */
 export function requestBudgetReservation(model, bodyBytes, maxTokens, priceOf, now = Date.now(), 
 /** Bytes dario adds to the prompt beyond the client's body (the template's system prompt and tools). */
 extraPromptBytes = 0) {
     const inputTokens = Math.ceil((Math.max(0, bodyBytes) + Math.max(0, extraPromptBytes)) / BUDGET_BYTES_PER_TOKEN);
     const outputTokens = Number.isFinite(maxTokens) && maxTokens > 0 ? Math.ceil(maxTokens) : BUDGET_DEFAULT_MAX_TOKENS;
-    const usd = priceOf(model, now, { requests: 1, inputTokens: 0, outputTokens, cacheReadTokens: 0, cacheCreateTokens: inputTokens });
+    const cell = { requests: 1, inputTokens: 0, outputTokens, cacheReadTokens: 0, cacheCreateTokens: inputTokens };
+    const models = typeof model === 'string' ? [model] : model.length > 0 ? model : [''];
+    const usd = Math.max(...models.map((m) => priceOf(m, now, cell)));
     return { count: 1, usd: Number.isFinite(usd) ? usd : 0, tokens: inputTokens + outputTokens };
 }
 export function addReservation(a, b) {

package/dist/overage-guard.js

@@ -34,6 +34,7 @@
  */
 import { EventEmitter } from 'node:events';
 import { isNonSubscriptionBilling } from './analytics.js';
+import { clampTimerMs } from './timer-ms.js';
 export class OverageGuard extends EventEmitter {
     opts;
     halted = null;
@@ -44,7 +45,8 @@ export class OverageGuard extends EventEmitter {
         // /analytics/stream + TUI tabs each register a listener; the in-proc
         // event listeners ceiling matches the Analytics class's choice.
         this.setMaxListeners(100);
-        this.opts = opts;
+        // The cooldown is a timer's delay; capped so a huge one cannot fire after 1 ms (timer-ms.ts).
+        this.opts = { ...opts, cooldownMs: clampTimerMs(opts.cooldownMs) };
     }
     /**
      * Subscribe to an Analytics instance. Every record whose claim is a

package/dist/pool-sync.js

@@ -28,6 +28,7 @@
  */
 import { randomUUID } from 'node:crypto';
 import { describeRateLimitSnapshot, rateLimitWindowPassed } from './pool.js';
+import { clampTimerMs } from './timer-ms.js';
 export const DEFAULT_POOL_SYNC_INTERVAL_MS = 2_000;
 /** A peer reading older than this describes windows that have long rolled. */
 export const SHARED_SEAT_MAX_AGE_MS = 6 * 3_600_000;
@@ -66,7 +67,7 @@ export class PoolSync {
         this.baseUrl = opts.baseUrl.replace(/\/+$/, '');
         this.token = opts.token;
         this.instance = opts.instance ?? randomUUID();
-        this.intervalMs = Math.max(200, opts.intervalMs ?? DEFAULT_POOL_SYNC_INTERVAL_MS);
+        this.intervalMs = clampTimerMs(Math.max(200, opts.intervalMs ?? DEFAULT_POOL_SYNC_INTERVAL_MS));
         this.stickyTtlMs = opts.stickyTtlMs ?? 6 * 3_600_000;
         this.log = opts.log ?? ((line) => console.error(line));
     }

package/dist/pool.d.ts

@@ -437,6 +437,7 @@ export declare function configuredPoolRouting(file: {
 } | undefined, env?: NodeJS.ProcessEnv): {
     strategy: PoolStrategy;
     headroomFloor: number;
+    headroomFloorExplicit: boolean;
 };
 /**
  * Which wire buckets bind which model family, when the wire does not say it
@@ -602,8 +603,6 @@ export declare function resolvePoolHeadroomFloor(explicit?: string | number | nu
 export declare function seatExpiry(account: PoolAccount, now?: number): number;
 export declare class AccountPool {
     readonly strategy: PoolStrategy;
-    /** Headroom at/below which a seat counts as drained — see DEFAULT_POOL_HEADROOM_FLOOR. */
-    readonly headroomFloor: number;
     private accounts;
     private queue;
     private queueMaxSize;
@@ -611,9 +610,11 @@ export declare class AccountPool {
     private drainTimer;
     private sticky;
     private lastStickyCleanup;
-    constructor(strategy?: PoolStrategy, 
     /** Headroom at/below which a seat counts as drained — see DEFAULT_POOL_HEADROOM_FLOOR. */
-    headroomFloor?: number);
+    readonly headroomFloor: number;
+    /** Only an explicitly configured floor is a hard stop; the implicit 2% remains a preference. */
+    readonly hardHeadroomFloor: boolean;
+    constructor(strategy?: PoolStrategy, headroomFloor?: number);
     add(alias: string, opts: {
         accessToken: string;
         refreshToken: string;
@@ -729,6 +730,8 @@ export declare class AccountPool {
     adoptSnapshot(alias: string, snapshot: RateLimitSnapshot, rejected: boolean, from: string): boolean;
     updateTokens(alias: string, accessToken: string, refreshToken: string, expiresAt: number): void;
     get(alias: string): PoolAccount | undefined;
+    /** Whether a preferred (but not pinned) seat may bypass normal pool ordering. */
+    canPrefer(account: PoolAccount, now?: number, family?: string | null): boolean;
     all(): PoolAccount[];
     status(): PoolStatus;
     /**