@askalf/dario 6.12.6 → 6.12.8

package/dist/pool.js

@@ -453,9 +453,11 @@ export function describePoolStrategy(strategy, floor = DEFAULT_POOL_HEADROOM_FLO
  * CLI flag, which only the running process knows (GET /status reports it).
  */
 export function configuredPoolRouting(file, env = process.env) {
+    const floorCandidate = env.DARIO_POOL_HEADROOM_FLOOR ?? file?.headroomFloor;
     return {
         strategy: resolvePoolStrategy(env.DARIO_POOL_STRATEGY ?? file?.strategy, env),
-        headroomFloor: resolvePoolHeadroomFloor(env.DARIO_POOL_HEADROOM_FLOOR ?? file?.headroomFloor, env),
+        headroomFloor: resolvePoolHeadroomFloor(floorCandidate, env),
+        headroomFloorExplicit: parsePoolHeadroomFloor(floorCandidate) !== null,
     };
 }
 /**
@@ -834,11 +836,56 @@ function pickMaxHeadroom(accounts, family) {
     }
     return best;
 }
+function isAboveHeadroomFloor(headroom, floor) {
+    return headroom - floor > Number.EPSILON;
+}
+/**
+ * When a below-floor reading can retire without an upstream probe, return the
+ * first relevant reset in epoch ms. Null means at least one bucket keeping the
+ * seat below the floor has no future reset, so one request must refresh it.
+ */
+function floorParkedUntil(snapshot, family, floor, now) {
+    const rl = expireElapsedWindow(snapshot, now);
+    const limiting = (util) => !isAboveHeadroomFloor(1 - util, floor);
+    const resets = [];
+    if (limiting(rl.util5h)) {
+        const reset = rl.claim === 'five_hour' ? rl.reset * 1000 : 0;
+        if (reset <= now)
+            return null;
+        resets.push(reset);
+    }
+    if (limiting(rl.util7d)) {
+        const reset = (rl.reset7d ?? 0) * 1000 > now
+            ? (rl.reset7d ?? 0) * 1000
+            : rl.claim.startsWith('seven_day') ? rl.reset * 1000 : 0;
+        if (reset <= now)
+            return null;
+        resets.push(reset);
+    }
+    if (family) {
+        for (const bucket of bucketsBindingFamily(rl, family)) {
+            const util = rl.perModel7d[bucket];
+            if (util === undefined || !limiting(util))
+                continue;
+            const reset = (rl.reset7d ?? 0) * 1000 > now
+                ? (rl.reset7d ?? 0) * 1000
+                : rl.claim.startsWith('seven_day') ? rl.reset * 1000 : 0;
+            if (reset <= now)
+                return null;
+            resets.push(reset);
+        }
+    }
+    return resets.length > 0 ? Math.min(...resets) : null;
+}
+function pickFloorProbe(accounts, family, floor, now) {
+    const stale = accounts.filter(a => floorParkedUntil(a.rateLimit, family, floor, now) === null);
+    return stale.length > 0 ? pickMaxHeadroom(stale, family) : null;
+}
 // Fill-first pick: lexicographically-first eligible account still above the
 // headroom floor. Alias order (not insertion order) — accounts load from a
 // readdir whose order the OS doesn't guarantee, and the operator can control
 // alias names but not readdir. Returns null when every candidate is at/below
-// the floor so the caller can fall back to max-headroom.
+// the floor.
 /**
  * The 7-day reset `expiring-first` orders by, in epoch ms: the seat's own
  * reading while it is still ahead of `now`, else +Infinity (never read, or the
@@ -851,7 +898,7 @@ export function seatExpiry(account, now = Date.now()) {
 function pickExpiringFirst(accounts, family, floor = DEFAULT_POOL_HEADROOM_FLOOR, now = Date.now()) {
     const order = [...accounts].sort((a, b) => (seatExpiry(a, now) - seatExpiry(b, now)) || (a.alias < b.alias ? -1 : a.alias > b.alias ? 1 : 0));
     for (const a of order) {
-        if (computeHeadroom(a.rateLimit, family) > floor)
+        if (isAboveHeadroomFloor(computeHeadroom(a.rateLimit, family), floor))
             return a;
     }
     return null;
@@ -861,14 +908,13 @@ function pickFillFirst(accounts, family, floor = DEFAULT_POOL_HEADROOM_FLOOR) {
     for (const a of accounts) {
         if (best !== null && a.alias >= best.alias)
             continue;
-        if (computeHeadroom(a.rateLimit, family) > floor)
+        if (isAboveHeadroomFloor(computeHeadroom(a.rateLimit, family), floor))
             best = a;
     }
     return best;
 }
 export class AccountPool {
     strategy;
-    headroomFloor;
     accounts = new Map();
     queue = [];
     queueMaxSize = 50;
@@ -877,11 +923,14 @@ export class AccountPool {
     sticky = new Map();
     // Amortize the O(n) sticky TTL/orphan sweep — timestamp of the last run.
     lastStickyCleanup = 0;
-    constructor(strategy = 'headroom', 
     /** Headroom at/below which a seat counts as drained — see DEFAULT_POOL_HEADROOM_FLOOR. */
-    headroomFloor = DEFAULT_POOL_HEADROOM_FLOOR) {
+    headroomFloor;
+    /** Only an explicitly configured floor is a hard stop; the implicit 2% remains a preference. */
+    hardHeadroomFloor;
+    constructor(strategy = 'headroom', headroomFloor) {
         this.strategy = strategy;
-        this.headroomFloor = headroomFloor;
+        this.headroomFloor = headroomFloor ?? DEFAULT_POOL_HEADROOM_FLOOR;
+        this.hardHeadroomFloor = headroomFloor !== undefined;
     }
     add(alias, opts) {
         const existing = this.accounts.get(alias);
@@ -997,11 +1046,13 @@ export class AccountPool {
                     : pickExpiringFirst(eligible, family, this.headroomFloor, now);
                 if (first)
                     return first;
-                // Every eligible account is at/below the floor — the terminal state
-                // both strategies share. Fall through to max-headroom so the caller
-                // still gets the least-drained account instead of null.
             }
-            return pickMaxHeadroom(eligible, family);
+            if (!this.hardHeadroomFloor)
+                return pickMaxHeadroom(eligible, family);
+            const aboveFloor = eligible.filter(a => isAboveHeadroomFloor(computeHeadroom(a.rateLimit, family, now), this.headroomFloor));
+            return aboveFloor.length > 0
+                ? pickMaxHeadroom(aboveFloor, family)
+                : pickFloorProbe(eligible, family, this.headroomFloor, now);
         }
         // No seat is eligible. A seat parked inside a live window is not
         // re-probed: its 429 named the reset, the clock has not reached it, and a
@@ -1042,11 +1093,20 @@ export class AccountPool {
         // 429 again (dario#1264 review). An auth cool-down or an expired token
         // still does NOT count — those are not rate limits and must not be
         // reported, or cooled, as if they were.
-        if (!all.every(a => isParkedInLiveWindow(a, now, family) || isCoolingAfterRejection(a, now)))
+        const until = all.map((a) => {
+            if (isParkedInLiveWindow(a, now, family)) {
+                return isBucketScopedRejection(a.rateLimit)
+                    ? (a.rateLimit.parkedBucketsUntil ?? a.rateLimit.reset * 1000)
+                    : a.rateLimit.reset * 1000;
+            }
+            if (isCoolingAfterRejection(a, now))
+                return a.rateLimit.cooldownUntil ?? now;
+            if (this.hardHeadroomFloor && isAccountEligible(a, now, family)) {
+                return floorParkedUntil(a.rateLimit, family, this.headroomFloor, now);
+            }
             return null;
-        return Math.min(...all.map(a => isParkedInLiveWindow(a, now, family)
-            ? (isBucketScopedRejection(a.rateLimit) ? (a.rateLimit.parkedBucketsUntil ?? a.rateLimit.reset * 1000) : a.rateLimit.reset * 1000)
-            : a.rateLimit.cooldownUntil ?? now));
+        });
+        return until.every((reset) => reset !== null) ? Math.min(...until) : null;
     }
     /** Seats a rate limit is currently keeping out of rotation (dario#1244, #1264). */
     parkedCount(now = Date.now()) {
@@ -1077,7 +1137,7 @@ export class AccountPool {
             const bound = this.accounts.get(binding.alias);
             if (bound
                 && isAccountEligible(bound, now, family)
-                && computeHeadroom(bound.rateLimit, family) > this.headroomFloor) {
+                && isAboveHeadroomFloor(computeHeadroom(bound.rateLimit, family), this.headroomFloor)) {
                 // Refresh the idle timer. A session that keeps taking turns must never
                 // be reaped or rebound while active — that would strand its warm prompt
                 // cache — so the TTL is re-based to now on every hit.
@@ -1167,7 +1227,12 @@ export class AccountPool {
                 if (first)
                     return first;
             }
-            return pickMaxHeadroom(eligible, family);
+            if (!this.hardHeadroomFloor)
+                return pickMaxHeadroom(eligible, family);
+            const aboveFloor = eligible.filter(a => isAboveHeadroomFloor(computeHeadroom(a.rateLimit, family, now), this.headroomFloor));
+            return aboveFloor.length > 0
+                ? pickMaxHeadroom(aboveFloor, family)
+                : pickFloorProbe(eligible, family, this.headroomFloor, now);
         }
         // Mid-flight: the seats a 429 could still hand this request to. A seat
         // parked inside a live window is not one of them — on the dario#1244
@@ -1280,6 +1345,18 @@ export class AccountPool {
     get(alias) {
         return this.accounts.get(alias);
     }
+    /** Whether a preferred (but not pinned) seat may bypass normal pool ordering. */
+    canPrefer(account, now = Date.now(), family) {
+        if (!isAccountEligible(account, now, family))
+            return false;
+        if (!this.hardHeadroomFloor)
+            return true;
+        if (isAboveHeadroomFloor(computeHeadroom(account.rateLimit, family, now), this.headroomFloor))
+            return true;
+        // A stale below-floor reading needs one probe to refresh it; a reading
+        // with a known future reset remains hard-parked until that reset.
+        return floorParkedUntil(account.rateLimit, family, this.headroomFloor, now) === null;
+    }
     all() {
         return [...this.accounts.values()];
     }
@@ -1311,11 +1388,9 @@ export class AccountPool {
      */
     async waitForAccount() {
         const immediate = this.select();
-        if (immediate) {
-            const headroom = computeHeadroom(immediate.rateLimit);
-            if (headroom > this.headroomFloor)
-                return immediate;
-        }
+        if (immediate && (this.hardHeadroomFloor
+            || isAboveHeadroomFloor(computeHeadroom(immediate.rateLimit), this.headroomFloor)))
+            return immediate;
         if (this.queue.length >= this.queueMaxSize) {
             throw new Error('Queue full — all accounts exhausted');
         }
@@ -1355,8 +1430,10 @@ export class AccountPool {
             const account = this.select();
             if (!account)
                 break;
-            const headroom = computeHeadroom(account.rateLimit);
-            if (headroom <= this.headroomFloor)
+            // The implicit floor keeps its historical queueing behavior. In hard
+            // mode select() has already applied the floor, including stale probes.
+            if (!this.hardHeadroomFloor
+                && !isAboveHeadroomFloor(computeHeadroom(account.rateLimit), this.headroomFloor))
                 break;
             const entry = this.queue.shift();
             if (entry)

package/dist/proxy.d.ts

@@ -70,6 +70,23 @@ export declare function applyModelAlias(model: string | null | undefined, aliase
  * change is inert until the operator opts in.
  */
 export declare function selectModelOverride(incomingModel: string, modelOverride: string | null, fastModelOverride: string | null): string | null;
+/**
+ * The model ids a request can be billed as, for pricing its key-budget
+ * reservation, which runs before routing. The client's model goes through
+ * the resolution the request path applies (operator alias, provider prefix,
+ * effort suffix, family shorthand, the OpenAI-name map on the chat shape),
+ * and a server-wide --model / --fast-model override is added beside it,
+ * since routing has not yet decided whether it replaces the name. The
+ * reservation is an upper bound, so it prices the costliest of these.
+ */
+export declare function budgetModelsFor(clientModel: string, ctx: {
+    modelAliases?: Record<string, string>;
+    modelOverride: string | null;
+    fastModelOverride: string | null;
+    cliProviderOverride: 'openai' | 'claude' | 'codex' | null;
+    cliModelRaw: string | null | undefined;
+    isOpenAI: boolean;
+}): string[];
 /**
  * Rebuild an OpenAI-shape request body with the model swapped to the pool-
  * fallback target. Null when the body isn't a JSON object — the caller
@@ -419,7 +436,8 @@ interface ProxyOptions {
     /**
      * Headroom at/below which a seat counts as drained (dario#1333): a sticky
      * session rebinds off it and new conversations skip it. Ratio (`0.05`) or
-     * percent (`5%`); default 2%. Sourced from `--pool-headroom-floor` /
+     * percent (`5%`). The implicit 2% default is a routing preference; setting
+     * this option explicitly makes the floor a hard stop. Sourced from `--pool-headroom-floor` /
      * `DARIO_POOL_HEADROOM_FLOOR` / config `pool.headroomFloor`.
      */
     poolHeadroomFloor?: string | number;

package/dist/proxy.js

@@ -9,14 +9,14 @@ import { getAccessToken, getStatus, ignoreCcCredentials } from './oauth.js';
 import { buildHealthResponse, derivePoolStatus, probeRequested, shouldDiscloseHealthInternals, shouldRunServingProbe } from './health-response.js';
 import { getServingProbe } from './serving-probe.js';
 import { darioVersion } from './version.js';
-import { CC_TOOL_DEFINITIONS_UNADVERTISABLE, CC_TEMPLATE_PROMPT_BYTES, resolveMaxTokens, buildCCRequest, applyCcPromptCaching, isGenuineCCClient, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, forwardClientCCIdentityHeaders, isMcpToolName, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
+import { CC_TOOL_DEFINITIONS_UNADVERTISABLE, CC_TEMPLATE_PROMPT_BYTES, resolveMaxTokens, buildCCRequest, applyCcPromptCaching, isGenuineCCClient, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, forwardClientCCIdentityHeaders, isMcpToolName, UnsupportedClientToolError, CLIENT_TOOL_MCP_PREFIX, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
 import { stampCch, hasCchSeed } from './cch.js';
 import { foldTiming, timingHeaders, timingLogFields } from './timing.js';
 import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion } from './live-fingerprint.js';
-import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, activeParkedBuckets, reconcilePoolAccounts, resolvePoolStrategy, resolvePoolHeadroomFloor, describePoolStrategy, DEFAULT_POOL_HEADROOM_FLOOR, utilFreshness, rateLimitWindow, accountAction, accountPeers, distinctAccounts, describeRejection, maskEmail, isAccountEligible } from './pool.js';
+import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, activeParkedBuckets, reconcilePoolAccounts, resolvePoolStrategy, resolvePoolHeadroomFloor, parsePoolHeadroomFloor, describePoolStrategy, utilFreshness, rateLimitWindow, accountAction, accountPeers, distinctAccounts, describeRejection, maskEmail } from './pool.js';
 import { backfillIdentity } from './accounts.js';
 import { PoolSync, DEFAULT_POOL_SYNC_INTERVAL_MS } from './pool-sync.js';
-import { Analytics, billingBucketFromClaim, costOfTokens, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, CODEX_CLAIM } from './analytics.js';
+import { Analytics, billingBucketFromClaim, costOfTokensFailClosed, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, CODEX_CLAIM } from './analytics.js';
 import { Ledger, resolveLedgerPath, ledgerDisabledByEnv } from './ledger.js';
 import { renderPrometheus } from './metrics.js';
 import { renderSpendDonuts, renderAnalyticsView, ANALYTICS_UI_SHELL } from './donuts.js';
@@ -54,7 +54,8 @@ import { seedStaleCodexUsage } from './codex-backend.js';
 import { route as routeProvider } from './provider-adapter.js';
 import { selectPoolFallbackModels } from './pool-fallback-tier.js';
 import { RequestQueue, QueueFullError, QueueTimeoutError, DEFAULT_MAX_CONCURRENT, DEFAULT_MAX_QUEUED, DEFAULT_QUEUE_TIMEOUT_MS, resolveMaxConcurrent } from './request-queue.js';
-import { waitForIdle, DEFAULT_SHUTDOWN_GRACE_MS } from './shutdown-drain.js';
+import { waitForIdle, drainThenClose, shutdownTimers, DEFAULT_SHUTDOWN_GRACE_MS } from './shutdown-drain.js';
+import { clampTimerMs } from './timer-ms.js';
 import { redactSecrets } from './redact.js';
 import { BAKED_BASE_MODELS, withLongContextVariants, buildOpenAIModelsList, getModelCatalog, getCachedBases, resolveAliasAgainst, prewarmModelCatalog, retryModelCatalogNow, isSuspendedModel } from './model-catalog.js';
 import { classifyUpstreamRejection, diagnosticSnippet, POOL_PARKED } from './upstream-rejection.js';
@@ -302,7 +303,8 @@ const MODEL_ALIASES = {
  * that needs to Just Work.
  */
 export function resolveClaudeAlias(model) {
-    return resolveAliasAgainst(model, getCachedBases()) ?? MODEL_ALIASES[model] ?? model;
+    // Own keys only: the model is client input, and `__proto__` would read Object.prototype.
+    return resolveAliasAgainst(model, getCachedBases()) ?? (Object.hasOwn(MODEL_ALIASES, model) ? MODEL_ALIASES[model] : model);
 }
 /**
  * User-defined model aliases: client-visible name → target model.
@@ -337,7 +339,9 @@ export function parseModelAliasSpecs(specs) {
 export function applyModelAlias(model, aliases) {
     if (!aliases || !model)
         return null;
-    const target = aliases[model.trim().toLowerCase()];
+    const name = model.trim().toLowerCase();
+    // Own keys only, as in resolveClaudeAlias: the name is client input.
+    const target = Object.hasOwn(aliases, name) ? aliases[name] : undefined;
     if (target === undefined || target === model)
         return null;
     return target;
@@ -361,6 +365,36 @@ export function selectModelOverride(incomingModel, modelOverride, fastModelOverr
         return fastModelOverride;
     return modelOverride;
 }
+/**
+ * The model ids a request can be billed as, for pricing its key-budget
+ * reservation, which runs before routing. The client's model goes through
+ * the resolution the request path applies (operator alias, provider prefix,
+ * effort suffix, family shorthand, the OpenAI-name map on the chat shape),
+ * and a server-wide --model / --fast-model override is added beside it,
+ * since routing has not yet decided whether it replaces the name. The
+ * reservation is an upper bound, so it prices the costliest of these.
+ */
+export function budgetModelsFor(clientModel, ctx) {
+    const out = new Set();
+    const aliased = applyModelAlias(clientModel, ctx.modelAliases) ?? clientModel;
+    const prefix = parseProviderPrefix(aliased);
+    if (prefix) {
+        out.add(prefix.provider === 'claude' ? resolveClaudeAlias(parseEffortSuffix(prefix.model).model) : prefix.model);
+    }
+    else if (ctx.cliProviderOverride === 'openai' && ctx.cliModelRaw) {
+        out.add(ctx.cliModelRaw);
+    }
+    else {
+        const bare = isOpenAIModel(aliased) ? aliased : parseEffortSuffix(aliased).model;
+        out.add(resolveClaudeAlias(bare));
+        if (ctx.isOpenAI && Object.hasOwn(OPENAI_MODEL_MAP, bare))
+            out.add(OPENAI_MODEL_MAP[bare]);
+    }
+    const override = selectModelOverride(aliased, ctx.modelOverride, ctx.fastModelOverride);
+    if (override)
+        out.add(override);
+    return [...out];
+}
 // Provider prefix in the `model` field — `<provider>:<model>`. Forces
 // routing regardless of model-name regex. Only recognized prefixes are
 // parsed, so ollama-style `llama3:8b` (without a recognized prefix)
@@ -400,7 +434,9 @@ export function parseProviderPrefix(model) {
     if (idx <= 0)
         return null;
     const prefix = model.slice(0, idx).toLowerCase();
-    const provider = PROVIDER_PREFIXES[prefix];
+    // Own keys only: PROVIDER_PREFIXES is a plain object, so `__proto__:x` or `constructor:x` would
+    // otherwise read Object.prototype's members as a provider (found by fuzz/reject_parsers.fuzz.js).
+    const provider = Object.hasOwn(PROVIDER_PREFIXES, prefix) ? PROVIDER_PREFIXES[prefix] : undefined;
     if (!provider)
         return null;
     const stripped = model.slice(idx + 1);
@@ -1274,6 +1310,8 @@ export async function startProxy(opts = {}) {
     const toolSubLogged = new Set();
     // Same de-dup contract for the verbose-only MCP-passthrough note.
     const mcpPassthroughLogged = new Set();
+    // Same de-dup contract for the note on client tools carried MCP-shaped.
+    const mcpCarryLogged = new Set();
     // One-shot log for the genuine-CC byte-faithful passthrough path.
     let ccPassthroughLogged = false;
     // Body-dump mode: set via --verbose=2 / -vv or DARIO_LOG_BODIES=1.
@@ -1476,8 +1514,9 @@ export async function startProxy(opts = {}) {
     const accountsList = await loadAllAccounts();
     const poolStrategy = resolvePoolStrategy(opts.poolStrategy);
     const poolHeadroomFloor = resolvePoolHeadroomFloor(opts.poolHeadroomFloor);
-    const pool = new AccountPool(poolStrategy, poolHeadroomFloor);
-    if (poolHeadroomFloor !== DEFAULT_POOL_HEADROOM_FLOOR) {
+    const poolHeadroomFloorExplicit = parsePoolHeadroomFloor(opts.poolHeadroomFloor) !== null;
+    const pool = new AccountPool(poolStrategy, poolHeadroomFloorExplicit ? poolHeadroomFloor : undefined);
+    if (poolHeadroomFloorExplicit) {
         console.log(`[dario] Pool headroom floor: ${Math.round(poolHeadroomFloor * 100)}% — a seat at or below it is left alone: sticky sessions rebind off it, new conversations skip it`);
     }
     // Two aliases that are one account (same OAuth account uuid) are one
@@ -1910,7 +1949,8 @@ export async function startProxy(opts = {}) {
     else if (pool.size > 0 && opts.maxConcurrent !== undefined && opts.maxConcurrent < pool.size) {
         console.error(`[dario] --max-concurrent=${opts.maxConcurrent} is below the ${pool.size} seats in the pool. That flag is a proxy-wide ceiling on in-flight requests, not a per-seat one: at most ${opts.maxConcurrent} requests can be in flight across all ${pool.size} seats, and the rest wait in dario. (dario#1244)`);
     }
-    const upstreamTimeoutMs = opts.upstreamTimeoutMs ?? UPSTREAM_TIMEOUT_MS;
+    // Every upstream abort timer (Claude, codex, openai-compat, continuation) takes this value.
+    const upstreamTimeoutMs = clampTimerMs(opts.upstreamTimeoutMs ?? UPSTREAM_TIMEOUT_MS);
     // Cache context-1m beta availability. Set false once per account after the
     // first "long context" rejection, so we skip sending context-1m on every
     // subsequent request instead of paying the round-trip + retry cost each time.
@@ -3352,7 +3392,7 @@ export async function startProxy(opts = {}) {
                 // eligible right now, else the pool picks as usual. Failover
                 // mid-request is unchanged either way — a preference, not a pin.
                 const preferredSeat = requestAuth.key?.seat ? (pool.get(requestAuth.key.seat) ?? null) : null;
-                keySeatTaken = preferredSeat !== null && isAccountEligible(preferredSeat, Date.now(), requestFamily);
+                keySeatTaken = preferredSeat !== null && pool.canPrefer(preferredSeat, Date.now(), requestFamily);
                 poolAccount = keySeatTaken ? preferredSeat : pool.select(requestFamily);
                 if (poolAccount)
                     poolParkedAnnounced = false;
@@ -3597,13 +3637,20 @@ export async function startProxy(opts = {}) {
                     // it — bounded by what dario will SEND: the client's body plus the
                     // template's prompt (passthrough adds nothing), and the max_tokens
                     // that will go on the wire (the template pins its own default unless
-                    // --max-tokens=client; passthrough forwards the client's).
+                    // --max-tokens=client; passthrough forwards the client's). Priced at
+                    // the model it will be billed as (dario#1378): a short name or a
+                    // --model override priced as written fell back to the sonnet-4-6
+                    // rate, a third of fable's; a model with no published rate is priced
+                    // at the highest one.
                     const pb = parsedBody;
                     const clientMax = pb ? (pb.max_tokens ?? pb.max_completion_tokens ?? pb.max_output_tokens) : undefined;
                     const outboundMax = passthrough
                         ? (typeof clientMax === 'number' ? clientMax : null)
                         : resolveMaxTokens(opts.maxTokens, { max_tokens: clientMax });
-                    budgetReserved = requestBudgetReservation(typeof pb?.model === 'string' ? pb.model : '', body.length, outboundMax, costOfTokens, Date.now(), passthrough ? 0 : CC_TEMPLATE_PROMPT_BYTES);
+                    const billedAs = budgetModelsFor(typeof pb?.model === 'string' ? pb.model : '', {
+                        modelAliases, modelOverride, fastModelOverride, cliProviderOverride, cliModelRaw, isOpenAI,
+                    });
+                    budgetReserved = requestBudgetReservation(billedAs, body.length, outboundMax, costOfTokensFailClosed, Date.now(), passthrough ? 0 : CC_TEMPLATE_PROMPT_BYTES);
                     budgetInflightKey = requestAuth.key.name;
                     keyInflight.set(budgetInflightKey, addReservation(inflightNow, budgetReserved));
                 }
@@ -4449,18 +4496,38 @@ export async function startProxy(opts = {}) {
                         // resolved just above so body and header agree.
                         const idSource = poolAccount ? poolAccount.identity : identity;
                         const bodyIdentity = { deviceId: idSource.deviceId, accountUuid: idSource.accountUuid, sessionId: preBodySessionId };
-                        const { body: ccBody, toolMap, detectedClient, unmappedTools, genuineCC } = buildCCRequest(r, billingTag, CACHE_EPHEMERAL, bodyIdentity, {
-                            preserveTools: opts.preserveTools ?? false,
-                            hybridTools: opts.hybridTools ?? false,
-                            mergeTools: opts.mergeTools ?? false,
-                            noAutoDetect: opts.noAutoDetect ?? false,
-                            effort: requestEffort ?? opts.effort,
-                            maxTokens: opts.maxTokens,
-                            systemPrompt: opts.systemPrompt,
-                            skipFields,
-                            honorClientThinking: opts.honorClientThinking ?? false,
-                            preserveOutputFormat: opts.preserveOutputFormat ?? false,
-                        });
+                        let built;
+                        try {
+                            built = buildCCRequest(r, billingTag, CACHE_EPHEMERAL, bodyIdentity, {
+                                preserveTools: opts.preserveTools ?? false,
+                                hybridTools: opts.hybridTools ?? false,
+                                mergeTools: opts.mergeTools ?? false,
+                                noAutoDetect: opts.noAutoDetect ?? false,
+                                effort: requestEffort ?? opts.effort,
+                                maxTokens: opts.maxTokens,
+                                systemPrompt: opts.systemPrompt,
+                                skipFields,
+                                honorClientThinking: opts.honorClientThinking ?? false,
+                                preserveOutputFormat: opts.preserveOutputFormat ?? false,
+                            });
+                        }
+                        catch (err) {
+                            // A client tool the Claude Code-shaped request cannot carry is
+                            // refused by name. The catch around this block forwards the body
+                            // as received on any other throw, which would drop the tool.
+                            if (!(err instanceof UnsupportedClientToolError))
+                                throw err;
+                            console.log(`[dario] #${requestCount} refused: ${err.message}`);
+                            requestCount++;
+                            res.writeHead(400, JSON_HEADERS);
+                            res.end(JSON.stringify(isOpenAI || isResponses
+                                ? { error: { message: err.message, type: 'invalid_request_error', param: 'tools', code: null } }
+                                : { type: 'error', error: { type: 'invalid_request_error', message: err.message } }));
+                            return;
+                        }
+                        const { body: ccBody, toolMap, detectedClient, unmappedTools: notInToolMap, carriedAsMcp = [], genuineCC } = built;
+                        // The tools that rode a fallback slot; the MCP-shaped ones have their own note below.
+                        const unmappedTools = notInToolMap.filter((n) => !carriedAsMcp.includes(n));
                         // Prompt-cache the tools + conversation prefix (the system prompt
                         // is already cached in ccBody's system blocks). Mirrors CC's cache
                         // breakpoints so a long session doesn't re-bill them as fresh input
@@ -4515,6 +4582,15 @@ export async function startProxy(opts = {}) {
                             const more = unmappedTools.length > 5 ? `, +${unmappedTools.length - 5} more` : '';
                             console.log(`[dario] tool substitution: ${unmappedTools.length}/${totalTools} client tool${unmappedTools.length === 1 ? '' : 's'} not in TOOL_MAP — remapped onto CC fallback slots (${sample}${more}). Pass --preserve-tools to forward your schemas verbatim instead.`);
                         }
+                        // Client tools outside CC's set on a request that names CC tools go
+                        // out under MCP-shaped names with their own schemas: say so once
+                        // per client family, so the renamed names in a body dump are expected.
+                        if (carriedAsMcp.length > 0 && !preserveToolsEffective && !mcpCarryLogged.has(subKey)) {
+                            mcpCarryLogged.add(subKey);
+                            const sample = carriedAsMcp.slice(0, 5).join(', ');
+                            const more = carriedAsMcp.length > 5 ? `, +${carriedAsMcp.length - 5} more` : '';
+                            console.log(`[dario] ${carriedAsMcp.length} client tool${carriedAsMcp.length === 1 ? '' : 's'} outside Claude Code's set carried as ${CLIENT_TOOL_MCP_PREFIX}<name> with ${carriedAsMcp.length === 1 ? 'its' : 'their'} own schema${carriedAsMcp.length === 1 ? '' : 's'} (${sample}${more}); calls come back under the client's names.`);
+                        }
                         // MCP tools (mcp__<server>__<tool>) forward verbatim in default
                         // mode — real CC advertises session-attached MCP schemas as-is,
                         // so this is passthrough, not substitution. Verbose-only note so
@@ -4707,7 +4783,7 @@ export async function startProxy(opts = {}) {
             const totalDelay = Math.max(pacingDelay, thinkDelay, sessionStartDelay);
             if (totalDelay > 0) {
                 pacingMs += totalDelay;
-                await new Promise(r => setTimeout(r, totalDelay));
+                await new Promise(r => setTimeout(r, clampTimerMs(totalDelay)));
             }
             seatClock.lastRequestTime = Date.now();
             // Session ID: resolved through the rotation registry keyed by the selected
@@ -6030,19 +6106,21 @@ export async function startProxy(opts = {}) {
         clearInterval(presenceInterval);
         clearInterval(refreshInterval);
         poolSync?.stop();
-        if (logFileStream)
-            logFileStream.end();
-        keyStore?.close();
         // Stop accepting connections now; responses already streaming keep going.
-        // Then flush tokens (best-effort), drain what is in flight up to the
-        // grace, and exit. The force-exit guard sits past the grace so a stream
-        // that never ends cannot wedge shutdown, and a hung fsync cannot either.
+        // Tokens and what the ledger already holds are written while the drain
+        // waits. The ledger, the key store and the request log close only after
+        // the drain: a request that finishes inside the grace still records its
+        // spend, its key's daily total and its log line (dario#1370). The
+        // force-exit guard sits past the grace so a stream that never ends cannot
+        // wedge shutdown, and a hung fsync cannot either.
         server.close();
-        const graceMs = opts.shutdownGraceMs ?? DEFAULT_SHUTDOWN_GRACE_MS;
-        void Promise.all([flushPoolTokens(), ledger?.close()])
-            .then(() => waitForIdle(() => queue.snapshot().active, { graceMs }))
-            .finally(() => process.exit(0));
-        setTimeout(() => process.exit(0), graceMs + 5000).unref();
+        const { graceMs, forceExitMs } = shutdownTimers(opts.shutdownGraceMs ?? DEFAULT_SHUTDOWN_GRACE_MS);
+        void drainThenClose(() => waitForIdle(() => queue.snapshot().active, { graceMs }), {
+            before: [flushPoolTokens, () => ledger?.flush()],
+            after: [() => ledger?.close(), () => keyStore?.close(), () => { if (logFileStream)
+                    logFileStream.end(); }],
+        }).finally(() => process.exit(0));
+        setTimeout(() => process.exit(0), forceExitMs).unref();
     };
     process.on('SIGINT', shutdown);
     process.on('SIGTERM', shutdown);

package/dist/request-queue.js

@@ -22,6 +22,7 @@
  *
  * dario#80 (Gemini review push-back).
  */
+import { clampTimerMs } from './timer-ms.js';
 /** Pure admission decision — no side effects, no clock dep. */
 export function decideAdmit(state) {
     if (state.active < state.maxConcurrent)
@@ -94,7 +95,8 @@ export class RequestQueue {
     constructor(opts = {}) {
         this.maxConcurrent = opts.maxConcurrent ?? DEFAULT_MAX_CONCURRENT;
         this.maxQueued = opts.maxQueued ?? DEFAULT_MAX_QUEUED;
-        this.queueTimeoutMs = opts.queueTimeoutMs ?? DEFAULT_QUEUE_TIMEOUT_MS;
+        // A timer's delay: capped where Node would otherwise fire it after 1 ms (timer-ms.ts).
+        this.queueTimeoutMs = clampTimerMs(opts.queueTimeoutMs ?? DEFAULT_QUEUE_TIMEOUT_MS);
         this.maxConcurrentPerConsumer = Math.max(0, opts.maxConcurrentPerConsumer ?? 0);
         this.unrefTimers = opts.unrefTimers ?? true;
         this.now = opts.now ?? Date.now;

package/dist/serving-probe.js

@@ -3,6 +3,7 @@
  * Opt-in, trusted-callers-only, cached and single-flighted.
  */
 import { classifyUpstreamRejection, rejectionRemediation } from './upstream-rejection.js';
+import { clampTimerMs } from './timer-ms.js';
 const ANTHROPIC_MESSAGES = 'https://api.anthropic.com/v1/messages';
 const ANTHROPIC_VERSION = '2023-06-01';
 const OAUTH_BETA = 'oauth-2025-04-20';
@@ -45,7 +46,7 @@ async function runProbe(deps) {
     const f = deps.fetchImpl ?? fetch;
     const now = deps.now ?? Date.now;
     const model = deps.model ?? process.env.DARIO_PROBE_MODEL ?? DEFAULT_PROBE_MODEL;
-    const timeoutMs = deps.timeoutMs ?? envInt('DARIO_PROBE_TIMEOUT_MS', DEFAULT_PROBE_TIMEOUT_MS);
+    const timeoutMs = clampTimerMs(deps.timeoutMs ?? envInt('DARIO_PROBE_TIMEOUT_MS', DEFAULT_PROBE_TIMEOUT_MS));
     const startedAt = now();
     const ctl = new AbortController();
     const timer = setTimeout(() => ctl.abort(), timeoutMs);

package/dist/shutdown-drain.d.ts

@@ -14,6 +14,18 @@
  */
 /** How long a SIGTERM waits for in-flight requests by default. */
 export declare const DEFAULT_SHUTDOWN_GRACE_MS = 90000;
+/** How long past the grace the force-exit guard waits before exiting anyway. */
+export declare const SHUTDOWN_FORCE_EXIT_MARGIN_MS = 5000;
+/**
+ * The drain's grace and the force-exit guard's delay for a configured grace.
+ * The guard is a timer, so the grace is capped where grace plus margin still
+ * fits one (timer-ms.ts): past that the guard would fire at once and skip
+ * the drain.
+ */
+export declare function shutdownTimers(graceMs: number): {
+    graceMs: number;
+    forceExitMs: number;
+};
 /** How often the drain re-reads the in-flight count. */
 export declare const SHUTDOWN_POLL_MS = 250;
 export interface DrainOptions {
@@ -41,3 +53,17 @@ export interface DrainResult {
  * poll, so a long drain is two lines rather than a scroll.
  */
 export declare function waitForIdle(getActive: () => number, opts: DrainOptions): Promise<DrainResult>;
+/**
+ * The order `shutdown` runs its steps in: `before` and the drain start
+ * together, and `after` runs only once the drain has returned.
+ *
+ * Anything a finishing request writes to belongs in `after`. The ledger
+ * refuses rows once closed and an ended log stream drops lines, so closing
+ * either before the drain loses exactly the requests the drain waits for:
+ * the long streamed runs that finish inside the grace. A step that throws
+ * or rejects is skipped; the others still run and shutdown still exits.
+ */
+export declare function drainThenClose(drain: () => Promise<unknown>, steps: {
+    before?: Array<() => unknown>;
+    after?: Array<() => unknown>;
+}): Promise<void>;

package/dist/shutdown-drain.js

@@ -12,8 +12,21 @@
  * runs out. It is pure over its inputs — the count, the clock and the sleep
  * are injected — so the policy is tested without a server or real timers.
  */
+import { clampTimerMs, MAX_TIMER_MS } from './timer-ms.js';
 /** How long a SIGTERM waits for in-flight requests by default. */
 export const DEFAULT_SHUTDOWN_GRACE_MS = 90_000;
+/** How long past the grace the force-exit guard waits before exiting anyway. */
+export const SHUTDOWN_FORCE_EXIT_MARGIN_MS = 5_000;
+/**
+ * The drain's grace and the force-exit guard's delay for a configured grace.
+ * The guard is a timer, so the grace is capped where grace plus margin still
+ * fits one (timer-ms.ts): past that the guard would fire at once and skip
+ * the drain.
+ */
+export function shutdownTimers(graceMs) {
+    const grace = Math.min(clampTimerMs(graceMs), MAX_TIMER_MS - SHUTDOWN_FORCE_EXIT_MARGIN_MS);
+    return { graceMs: grace, forceExitMs: grace + SHUTDOWN_FORCE_EXIT_MARGIN_MS };
+}
 /** How often the drain re-reads the in-flight count. */
 export const SHUTDOWN_POLL_MS = 250;
 const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -46,3 +59,18 @@ export async function waitForIdle(getActive, opts) {
         }
     }
 }
+/**
+ * The order `shutdown` runs its steps in: `before` and the drain start
+ * together, and `after` runs only once the drain has returned.
+ *
+ * Anything a finishing request writes to belongs in `after`. The ledger
+ * refuses rows once closed and an ended log stream drops lines, so closing
+ * either before the drain loses exactly the requests the drain waits for:
+ * the long streamed runs that finish inside the grace. A step that throws
+ * or rejects is skipped; the others still run and shutdown still exits.
+ */
+export async function drainThenClose(drain, steps) {
+    const run = (fns) => Promise.all((fns ?? []).map((fn) => Promise.resolve().then(fn).catch(() => undefined)));
+    await Promise.all([run(steps.before), drain().catch(() => undefined)]);
+    await run(steps.after);
+}