@askalf/dario 6.15.0 → 6.17.0

package/dist/analytics.d.ts

@@ -92,11 +92,17 @@ export declare function continuationStats(records: readonly RequestRecord[]): Co
  * - `api`                  — pure API key billing, no subscription involved
  * - `unknown`              — header absent or unparseable (non-200 responses, stream aborts)
  *
+ * A sixth, `credits`, is stamped by the proxy rather than read from a header:
+ * a request the credits rung of the failover chain served on the Console key
+ * in DARIO_CREDITS_API_KEY (credits-rung.ts). Anthropic sends no claim header
+ * on an API key request, and "the operator's own credits rung" is a different
+ * fact from "an unexpected API bill", so it gets its own bucket.
+ *
  * Exposed in `/analytics` summaries and in verbose per-request logs so
  * users can see at a glance which bucket their traffic is actually hitting.
  * See #34 for background.
  */
-export type BillingBucket = 'subscription' | 'subscription_fallback' | 'extra_usage' | 'api' | 'unknown';
+export type BillingBucket = 'subscription' | 'subscription_fallback' | 'extra_usage' | 'api' | 'credits' | 'unknown';
 /**
  * Map the raw `representative-claim` header value to a human-friendly
  * billing bucket. Pure function; no state; safe to call from any context.
@@ -112,6 +118,14 @@ export declare function billingBucketFromClaim(claim: string | null | undefined)
 export declare const SUBSCRIPTION_CLAIMS: ReadonlySet<string>;
 /** The claim the proxy stamps on codex-engine requests (see above). */
 export declare const CODEX_CLAIM = "chatgpt_subscription";
+/**
+ * The claim the proxy stamps on a request the credits rung served
+ * (credits-rung.ts). Not a subscription claim: the request was billed at API
+ * rates against the monthly credit balance, so it lands in its own bucket and
+ * the ledger files it as metered. The overage guard leaves it alone, because
+ * the rung is a chain entry the operator wrote, not a billing surprise.
+ */
+export declare const CREDITS_CLAIM = "anthropic_credits";
 /**
  * One-line per-request usage summary for verbose (-v / -vv) logs.
  *
@@ -282,6 +296,12 @@ export declare function costOfTokens(model: string, atMs: number, t: {
     cacheReadTokens: number;
     cacheCreateTokens: number;
 }): number;
+/**
+ * Request counts per five-minute bin over the window, oldest bin first; the
+ * newest bin is the one `now` falls in. Records outside the window are left
+ * out, so the bins sum to the window's request count.
+ */
+export declare function binByFiveMinutes(records: RequestRecord[], now: number, windowMinutes: number): number[];
 export declare class Analytics extends EventEmitter {
     private records;
     private maxRecords;
@@ -408,6 +428,8 @@ export interface AnalyticsSummary {
     window: WindowStats & {
         minutes: number;
         requests: number;
+        /** Requests per five-minute bin across the window, oldest first (twelve for the default hour). */
+        perFiveMinutes: number[];
     };
     allTime: WindowStats & {
         requests: number;
@@ -423,7 +445,10 @@ export interface AnalyticsSummary {
     };
     predictions: {
         estimatedExhaustionMinutes: number | null;
+        /** Input and output tokens per minute across the window; cache reads and writes are not in it. */
         tokenBurnRate: number;
+        /** Every kind per minute: input, output, cache reads and cache writes. */
+        totalTokenBurnRate: number;
         costBurnRate: number;
     };
 }

package/dist/analytics.js

@@ -69,6 +69,8 @@ export function billingBucketFromClaim(claim) {
             return 'extra_usage';
         case 'api':
             return 'api';
+        case CREDITS_CLAIM:
+            return 'credits';
         default:
             return 'unknown';
     }
@@ -96,6 +98,14 @@ export const SUBSCRIPTION_CLAIMS = new Set([
 ]);
 /** The claim the proxy stamps on codex-engine requests (see above). */
 export const CODEX_CLAIM = 'chatgpt_subscription';
+/**
+ * The claim the proxy stamps on a request the credits rung served
+ * (credits-rung.ts). Not a subscription claim: the request was billed at API
+ * rates against the monthly credit balance, so it lands in its own bucket and
+ * the ledger files it as metered. The overage guard leaves it alone, because
+ * the rung is a chain entry the operator wrote, not a billing surprise.
+ */
+export const CREDITS_CLAIM = 'anthropic_credits';
 /**
  * One-line per-request usage summary for verbose (-v / -vv) logs.
  *
@@ -189,6 +199,12 @@ export function consumerFromBody(body) {
 export function isNonSubscriptionBilling(claim) {
     if (!claim || claim === NO_BILLING_CLAIM)
         return false;
+    // The credits rung is metered billing the operator configured by name in
+    // the failover chain and armed with a key; the guard exists for billing
+    // nobody asked for. The claim is still not a subscription claim, so the
+    // bucket math and the ledger keep treating it as paid.
+    if (claim === CREDITS_CLAIM)
+        return false;
     return !SUBSCRIPTION_CLAIMS.has(claim);
 }
 /**
@@ -363,6 +379,22 @@ function estimateCost(record) {
     // estimates each side correctly rather than repricing history at today's rate.
     return costOfTokens(record.model, record.timestamp, record);
 }
+/**
+ * Request counts per five-minute bin over the window, oldest bin first; the
+ * newest bin is the one `now` falls in. Records outside the window are left
+ * out, so the bins sum to the window's request count.
+ */
+export function binByFiveMinutes(records, now, windowMinutes) {
+    const n = Math.max(1, Math.ceil(windowMinutes / 5));
+    const bins = new Array(n).fill(0);
+    for (const r of records) {
+        const age = now - r.timestamp;
+        if (age < 0 || age >= n * 300_000)
+            continue;
+        bins[n - 1 - Math.floor(age / 300_000)]++;
+    }
+    return bins;
+}
 export class Analytics extends EventEmitter {
     records = [];
     maxRecords;
@@ -426,13 +458,18 @@ export class Analytics extends EventEmitter {
         };
     }
     summary(windowMinutes = 60) {
-        const cutoff = Date.now() - windowMinutes * 60_000;
+        const now = Date.now();
+        const cutoff = now - windowMinutes * 60_000;
         const recent = this.records.filter(r => r.timestamp >= cutoff);
         const allTime = this.records;
         return {
             window: {
                 minutes: windowMinutes,
                 requests: recent.length,
+                // The dashboard's sparkline and its "vs prior 30 min" figure need the
+                // whole window; /analytics/stream replays only the last 50 records,
+                // which would show an hour of steady traffic as a late surge.
+                perFiveMinutes: binByFiveMinutes(recent, now, windowMinutes),
                 ...this.computeStats(recent),
             },
             allTime: {
@@ -459,6 +496,7 @@ export class Analytics extends EventEmitter {
                     subscription_fallback: 0,
                     extra_usage: 0,
                     api: 0,
+                    credits: 0,
                     unknown: 0,
                 },
                 subscriptionPercent: 0,
@@ -478,6 +516,7 @@ export class Analytics extends EventEmitter {
             subscription_fallback: 0,
             extra_usage: 0,
             api: 0,
+            credits: 0,
             unknown: 0,
         };
         for (const r of records) {
@@ -601,24 +640,31 @@ export class Analytics extends EventEmitter {
     }
     predict(records) {
         if (records.length < 3) {
-            return { estimatedExhaustionMinutes: null, tokenBurnRate: 0, costBurnRate: 0 };
+            return { estimatedExhaustionMinutes: null, tokenBurnRate: 0, totalTokenBurnRate: 0, costBurnRate: 0 };
         }
         const sorted = [...records].sort((a, b) => a.timestamp - b.timestamp);
         const first = sorted[0];
         const last = sorted[sorted.length - 1];
         const durationMin = (last.timestamp - first.timestamp) / 60_000;
         if (durationMin < 1) {
-            return { estimatedExhaustionMinutes: null, tokenBurnRate: 0, costBurnRate: 0 };
+            return { estimatedExhaustionMinutes: null, tokenBurnRate: 0, totalTokenBurnRate: 0, costBurnRate: 0 };
         }
         const totalTokens = sorted.reduce((s, r) => s + r.inputTokens + r.outputTokens, 0);
+        // Every kind the provider counts, for a reader asking "how many tokens a
+        // minute": on a cached prompt the cache reads dwarf input and output.
+        // thinkingTokens is an estimate carved out of outputTokens, not a kind of
+        // its own, so adding it would count that output twice.
+        const allTokens = sorted.reduce((s, r) => s + r.inputTokens + r.outputTokens + r.cacheReadTokens + r.cacheCreateTokens, 0);
         const totalCost = sorted.reduce((s, r) => s + estimateCost(r), 0);
         const tokenBurnRate = totalTokens / durationMin;
+        const totalTokenBurnRate = allTokens / durationMin;
         const costBurnRate = (totalCost / durationMin) * 60;
         const currentUtil = last.util5h;
         if (currentUtil >= 0.95) {
             return {
                 estimatedExhaustionMinutes: 0,
                 tokenBurnRate: Math.round(tokenBurnRate),
+                totalTokenBurnRate: Math.round(totalTokenBurnRate),
                 costBurnRate: Math.round(costBurnRate * 100) / 100,
             };
         }
@@ -627,6 +673,7 @@ export class Analytics extends EventEmitter {
             return {
                 estimatedExhaustionMinutes: null,
                 tokenBurnRate: Math.round(tokenBurnRate),
+                totalTokenBurnRate: Math.round(totalTokenBurnRate),
                 costBurnRate: Math.round(costBurnRate * 100) / 100,
             };
         }
@@ -634,6 +681,7 @@ export class Analytics extends EventEmitter {
         return {
             estimatedExhaustionMinutes: Math.round(minutesToExhaustion),
             tokenBurnRate: Math.round(tokenBurnRate),
+            totalTokenBurnRate: Math.round(totalTokenBurnRate),
             costBurnRate: Math.round(costBurnRate * 100) / 100,
         };
     }

package/dist/body-identity.d.ts

@@ -0,0 +1,25 @@
+/** The three values `metadata.user_id` is built from. */
+export interface BodyIdentity {
+    deviceId: string;
+    accountUuid: string;
+    sessionId: string;
+}
+/**
+ * The `metadata.user_id` string Claude Code sends: a JSON object with
+ * device_id, account_uuid and session_id in that order. Shared by the
+ * template build and the failover rebind so both produce the same bytes.
+ */
+export declare function buildMetadataUserId(identity: BodyIdentity): string;
+/**
+ * `body` with `metadata.user_id` rebuilt for `identity`, for a request that
+ * fails over to another account. `cchVersion` is the Claude Code version to
+ * stamp cch for after the rewrite, or null where the first serialize did not
+ * stamp (DARIO_CCH=random); stampCch is itself a no-op without a seed.
+ *
+ * Returns `body` itself, the same Buffer, when there is nothing to rebind: no
+ * body, a body that is not JSON, no string `metadata.user_id`, or a user_id
+ * that already names `identity`. The body was serialized by JSON.stringify,
+ * so parse and stringify again give the same bytes apart from user_id, and
+ * user_id is replaced in place so key order is kept.
+ */
+export declare function rebindBodyIdentity(body: Buffer | undefined, identity: BodyIdentity, cchVersion: string | null): Buffer | undefined;

package/dist/body-identity.js

@@ -0,0 +1,68 @@
+/**
+ * The account identity a built Claude Code body carries, and how it moves to
+ * another seat when a request fails over mid-flight.
+ *
+ * The template build stamps `metadata.user_id` from the selected account's
+ * device_id and account_uuid plus the session id the
+ * `x-claude-code-session-id` header carries. A 429 or 401/403 failover sends
+ * the same body to a different account, so the body must name that account
+ * and the session id its header now carries; otherwise seat B is sent seat
+ * A's device_id and account_uuid and a session_id that disagrees with its own
+ * header. The cch stamp (src/cch.ts) hashes the body, user_id included, so a
+ * rewritten body is stamped again.
+ *
+ * Pure, and imports nothing that reads the filesystem, so it is unit-testable
+ * without a proxy or a ~/.dario.
+ */
+import { stampCch } from './cch.js';
+/**
+ * The `metadata.user_id` string Claude Code sends: a JSON object with
+ * device_id, account_uuid and session_id in that order. Shared by the
+ * template build and the failover rebind so both produce the same bytes.
+ */
+export function buildMetadataUserId(identity) {
+    return JSON.stringify({
+        device_id: identity.deviceId,
+        account_uuid: identity.accountUuid,
+        session_id: identity.sessionId,
+    });
+}
+/**
+ * `body` with `metadata.user_id` rebuilt for `identity`, for a request that
+ * fails over to another account. `cchVersion` is the Claude Code version to
+ * stamp cch for after the rewrite, or null where the first serialize did not
+ * stamp (DARIO_CCH=random); stampCch is itself a no-op without a seed.
+ *
+ * Returns `body` itself, the same Buffer, when there is nothing to rebind: no
+ * body, a body that is not JSON, no string `metadata.user_id`, or a user_id
+ * that already names `identity`. The body was serialized by JSON.stringify,
+ * so parse and stringify again give the same bytes apart from user_id, and
+ * user_id is replaced in place so key order is kept.
+ */
+export function rebindBodyIdentity(body, identity, cchVersion) {
+    if (!body)
+        return body;
+    let parsed;
+    try {
+        parsed = JSON.parse(body.toString('utf8'));
+    }
+    catch {
+        return body;
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        return body;
+    const metadata = parsed.metadata;
+    if (!metadata || typeof metadata !== 'object' || Array.isArray(metadata))
+        return body;
+    const meta = metadata;
+    if (typeof meta.user_id !== 'string')
+        return body;
+    const userId = buildMetadataUserId(identity);
+    if (meta.user_id === userId)
+        return body;
+    meta.user_id = userId;
+    let text = JSON.stringify(parsed);
+    if (cchVersion !== null)
+        text = stampCch(text, cchVersion);
+    return Buffer.from(text);
+}

package/dist/cc-template.js

@@ -9,6 +9,7 @@
  */
 import { loadTemplate, promptVariantsOf, VARIANT_FAMILIES, PLATFORM_ONLY_TOOLS, INTERACTIVE_ONLY_TOOLS, CONFIG_SCOPED_TOOLS, DEFERRED_TOOLS, } from './live-fingerprint.js';
 import { VALID_EFFORT_VALUES, parseEffortSuffix } from './effort.js';
+import { buildMetadataUserId } from './body-identity.js';
 // Re-exported so existing importers (scripts/capture-and-bake.mjs, the template
 // invariant tests) keep their import site. The definitions live in
 // live-fingerprint.ts because loadTemplate must apply the same superset rule to
@@ -1819,13 +1820,7 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
             }
         }
         const body = { ...clientBody, system };
-        body.metadata = {
-            user_id: JSON.stringify({
-                device_id: identity.deviceId,
-                account_uuid: identity.accountUuid,
-                session_id: identity.sessionId,
-            }),
-        };
+        body.metadata = { user_id: buildMetadataUserId(identity) };
         return { body, toolMap: new Map(), unmappedTools: [], genuineCC: true };
     }
     // ── Detect text-tool-protocol clients up-front ──
@@ -2275,13 +2270,7 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
             ccRequest.tool_choice = passed;
     }
     // Metadata
-    ccRequest.metadata = {
-        user_id: JSON.stringify({
-            device_id: identity.deviceId,
-            account_uuid: identity.accountUuid,
-            session_id: identity.sessionId,
-        }),
-    };
+    ccRequest.metadata = { user_id: buildMetadataUserId(identity) };
     ccRequest.max_tokens = resolveMaxTokens(opts.maxTokens, clientBody);
     // Model-specific fields — order: thinking, context_management, output_config
     //

package/dist/cli.d.ts

@@ -114,6 +114,13 @@ export declare function parseBooleanEnv(value: string | undefined): boolean | un
  *   Set(['thinking','env']) — value "thinking,env"        → preserve listed
  */
 export declare function resolvePreserveOrchestrationTags(args: string[], env: string | undefined): Set<string> | undefined;
+/**
+ * --upstream-timeout / DARIO_UPSTREAM_TIMEOUT_MS. The flag wins over the env
+ * var even when it is 0, and 0 then resolves to undefined so the proxy's
+ * default applies: an explicit `--upstream-timeout=0` keeps the default
+ * rather than falling through to the env value. Exported for tests.
+ */
+export declare function resolveUpstreamTimeoutMs(flag: number | undefined, env: string | undefined): number | undefined;
 /**
  * The seat shape a running proxy returns from `/accounts`.
  *

package/dist/cli.js

@@ -516,6 +516,12 @@ async function proxy() {
     // used to sever every streaming response after five seconds. dario#1370.
     const shutdownGraceMs = parsePositiveIntFlag('--shutdown-grace=')
         ?? parsePositiveIntEnv(process.env['DARIO_SHUTDOWN_GRACE_MS']);
+    // --upstream-timeout=MS: how long dario waits for upstream (default 300000).
+    // Until the response streams it caps the whole wait; once a 2xx streams it
+    // is the longest gap allowed between two chunks, so a long answer that is
+    // still sending is never cut. 0 keeps the default: an always-firing timer
+    // would fail every request.
+    const upstreamTimeoutMs = resolveUpstreamTimeoutMs(parsePositiveIntFlag('--upstream-timeout='), process.env['DARIO_UPSTREAM_TIMEOUT_MS']);
     // --pool-strategy=headroom|fill-first — where UNBOUND (new) conversations
     // land. `headroom` (default) spreads them to the seat with the most slack;
     // `fill-first` concentrates them on the alphabetically-first eligible seat
@@ -526,9 +532,9 @@ async function proxy() {
     // expires soonest before touching the rest.
     const poolStrategyFromFlag = args.find((a) => a.startsWith('--pool-strategy='))?.split('=')[1];
     if (poolStrategyFromFlag !== undefined
-        && poolStrategyFromFlag !== 'headroom' && poolStrategyFromFlag !== 'fill-first'
-        && poolStrategyFromFlag !== 'expiring-first') {
-        console.error(`[dario] Invalid --pool-strategy "${poolStrategyFromFlag}". Must be headroom, fill-first or expiring-first.`);
+        && poolStrategyFromFlag !== 'headroom' && poolStrategyFromFlag !== 'headroom-by-plan'
+        && poolStrategyFromFlag !== 'fill-first' && poolStrategyFromFlag !== 'expiring-first') {
+        console.error(`[dario] Invalid --pool-strategy "${poolStrategyFromFlag}". Must be headroom, headroom-by-plan, fill-first or expiring-first.`);
         process.exit(1);
     }
     const poolStrategy = poolStrategyFromFlag
@@ -786,7 +792,7 @@ async function proxy() {
         console.error(`[dario] Override (not recommended): pass --unsafe-no-auth if you have out-of-band network controls and accept the risk.`);
         process.exit(1);
     }
-    await startProxy({ port, host, verbose, verboseBodies, model, fastModel, noClaudeAuth, analyticsToken, passthrough, preserveTools, hybridTools, mergeTools, noAutoDetect, strictTls, pacingMinMs, pacingJitterMs, thinkTimeBaseMs, thinkTimePerTokenMs, thinkTimeJitterMs, thinkTimeMaxMs, sessionStartMinMs, sessionStartJitterMs, stealth, drainOnClose, sessionIdleRotateMs, sessionRotateJitterMs, sessionMaxAgeMs, sessionPerClient, preserveOrchestrationTags, noLiveCapture, strictTemplate, maxConcurrent, maxQueued, queueTimeoutMs, maxConcurrentPerConsumer, shutdownGraceMs, poolStrategy, poolHeadroomFloor, poolSharedState, poolSharedStateIntervalMs, effort, maxTokens, poolFallbackModel, familyFallback, modelAliases, logFile, passthroughBetas, skipFields, systemPrompt, overageGuardEnabled, overageGuardBehavior, overageGuardCooldownMs, overageGuardNotifyOs, honorClientThinking, preserveOutputFormat, midstreamContinue, ledger, keys, keysPath, keySockets: keySockets.length > 0 ? keySockets : undefined });
+    await startProxy({ port, host, verbose, verboseBodies, model, fastModel, noClaudeAuth, analyticsToken, passthrough, preserveTools, hybridTools, mergeTools, noAutoDetect, strictTls, pacingMinMs, pacingJitterMs, thinkTimeBaseMs, thinkTimePerTokenMs, thinkTimeJitterMs, thinkTimeMaxMs, sessionStartMinMs, sessionStartJitterMs, stealth, drainOnClose, sessionIdleRotateMs, sessionRotateJitterMs, sessionMaxAgeMs, sessionPerClient, preserveOrchestrationTags, noLiveCapture, strictTemplate, maxConcurrent, maxQueued, queueTimeoutMs, maxConcurrentPerConsumer, shutdownGraceMs, upstreamTimeoutMs, poolStrategy, poolHeadroomFloor, poolSharedState, poolSharedStateIntervalMs, effort, maxTokens, poolFallbackModel, familyFallback, modelAliases, logFile, passthroughBetas, skipFields, systemPrompt, overageGuardEnabled, overageGuardBehavior, overageGuardCooldownMs, overageGuardNotifyOs, honorClientThinking, preserveOutputFormat, midstreamContinue, ledger, keys, keysPath, keySockets: keySockets.length > 0 ? keySockets : undefined });
 }
 /**
  * `dario keys` — named keys for a shared dario (v6.8, dario#1318). One
@@ -1208,6 +1214,16 @@ function parsePreserveTagsValue(value) {
         return new Set(['*']);
     return new Set(trimmed.split(',').map(s => s.trim()).filter(Boolean));
 }
+/**
+ * --upstream-timeout / DARIO_UPSTREAM_TIMEOUT_MS. The flag wins over the env
+ * var even when it is 0, and 0 then resolves to undefined so the proxy's
+ * default applies: an explicit `--upstream-timeout=0` keeps the default
+ * rather than falling through to the env value. Exported for tests.
+ */
+export function resolveUpstreamTimeoutMs(flag, env) {
+    const ms = flag ?? parsePositiveIntEnv(env);
+    return ms === 0 ? undefined : ms;
+}
 function parsePositiveIntFlag(prefix) {
     const found = args.find(a => a.startsWith(prefix));
     if (!found)
@@ -2212,6 +2228,12 @@ async function help() {
                              container's stop grace above it, or Docker
                              SIGKILLs the drain. Env:
                              DARIO_SHUTDOWN_GRACE_MS. (dario#1370)
+    --upstream-timeout=MS    How long dario waits on upstream (default:
+                             300000). Until the response streams it caps
+                             the whole wait; while a 2xx streams it is
+                             the longest gap between two chunks, so a
+                             live stream is never cut. 0 keeps the
+                             default. Env: DARIO_UPSTREAM_TIMEOUT_MS.
     --max-concurrent=N       Max in-flight requests across the WHOLE proxy,
                              not per seat (default: 10; a pool defaults to
                              10 per seat). Past it, requests wait in dario.
@@ -2239,11 +2261,13 @@ async function help() {
                              dario returns 504 "queue-timeout"
                              (default: 60000).
                              Env: DARIO_QUEUE_TIMEOUT_MS. (dario#80)
-    --pool-strategy=<headroom|fill-first|expiring-first>
+    --pool-strategy=<headroom|headroom-by-plan|fill-first|expiring-first>
                              Where new conversations land in a multi-
                              account pool. headroom (default) spreads
                              them to the seat with the most slack;
-                             fill-first concentrates them on the
+                             headroom-by-plan (opt-in) counts each
+                             seat's slack by plan size (Max Nx = N,
+                             Pro = 1); fill-first concentrates them on the
                              alphabetically-first eligible seat until
                              it drains to the floor, then spills;
                              expiring-first does the same in order of
@@ -2270,6 +2294,15 @@ async function help() {
                              Needs one of those configured. Empty value
                              disables. Env: DARIO_POOL_FALLBACK. Config:
                              poolFallback.model.
+                             An entry written credits:<model> is a rung on
+                             the API credits a Max plan includes: with
+                             DARIO_CREDITS_API_KEY set (env only, never a
+                             flag) the request goes to the Claude API on
+                             that key as <model>, both wire shapes, after
+                             every seat and subscription rung; /analytics
+                             and the dashboard file it under credits, the
+                             ledger counts it as metered. Without the key
+                             the entry is inert and dario doctor says so.
     --family-fallback=<family=model,...>
                              When every pool seat is parked for a model
                              family, serve its requests as <model> on the
@@ -3174,12 +3207,16 @@ if (isDirectEntry) {
     if (!('Bun' in globalThis) && !process.env.DARIO_NO_BUN) {
         try {
             const { execFileSync, spawn } = await import('node:child_process');
+            const { forwardSignals, relaunchExitCode } = await import('./relaunch-signals.js');
             execFileSync('bun', ['--version'], { stdio: 'ignore', timeout: 3000 });
             const child = spawn('bun', ['run', ...process.argv.slice(1)], {
                 stdio: 'inherit',
                 env: { ...process.env, DARIO_NO_BUN: '1' },
             });
-            child.on('exit', (code) => process.exit(code ?? 0));
+            // The child owns the graceful shutdown; as PID 1 in a container this
+            // process would otherwise drop SIGTERM and docker stop would SIGKILL both.
+            forwardSignals(child);
+            child.on('exit', (code, signal) => process.exit(relaunchExitCode(code, signal)));
             // Prevent this process from continuing
             await new Promise(() => { });
         }

package/dist/codex-backend.js

@@ -29,6 +29,7 @@ import { resolveClaudeTarget } from './claude-model.js';
 import { parseEffortSuffix } from './effort.js';
 import { BAKED_BASE_MODELS } from './model-catalog.js';
 import { parseRetryAfterMs } from './provider-cooldown.js';
+import { upstreamDeadline } from './upstream-deadline.js';
 import { noteCodexUsageHeaders, parseCodexUsageEndpoint, recordCodexUsage, codexUsageFor } from './codex-usage.js';
 export const CODEX_BACKEND_BASE_URL = process.env.DARIO_CODEX_BASE_URL || 'https://chatgpt.com/backend-api/codex';
 /** The usage endpoint the Codex CLI's /status reads, beside the Responses base. */
@@ -914,7 +915,8 @@ timing) {
             abort.abort();
     } };
     res.on('close', onClientClose);
-    const timeout = setTimeout(() => abort.abort(), upstreamTimeoutMs);
+    // Caps the wait until headers, then the gap between chunks of the 2xx body.
+    const timeout = upstreamDeadline(upstreamTimeoutMs, () => abort.abort());
     let usage = null;
     try {
         if (verbose)
@@ -962,6 +964,7 @@ timing) {
             return true;
         }
         res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', 'Connection': 'keep-alive', 'Access-Control-Allow-Origin': corsOrigin, ...securityHeaders, ...splitHeaders() });
+        timeout.streaming();
         const reader = upstream.body.getReader();
         const decoder = new TextDecoder();
         let tail = '';
@@ -969,6 +972,7 @@ timing) {
         try {
             while (true) {
                 const { done, value } = await reader.read();
+                timeout.touch();
                 if (done)
                     break;
                 if (clientGone)
@@ -1033,7 +1037,7 @@ timing) {
         return true;
     }
     finally {
-        clearTimeout(timeout);
+        timeout.clear();
         res.removeListener('close', onClientClose);
     }
 }
@@ -1196,7 +1200,9 @@ timing) {
     // Usage seen so far, so a stream the client abandoned still reports what the
     // subscription already spent. Populated once the translators exist.
     let usageSoFar = () => null;
-    const timeout = setTimeout(() => abort.abort(), upstreamTimeoutMs);
+    // Caps the wait until headers, then the gap between chunks of the 2xx body:
+    // the backend always streams, so a long answer is never cut mid-way.
+    const timeout = upstreamDeadline(upstreamTimeoutMs, () => abort.abort());
     try {
         if (verbose)
             console.log(`[dario] → codex backend: ${target} (model: ${model})`);
@@ -1324,11 +1330,13 @@ timing) {
         }
         let buffered = '';
         if (upstream.body) {
+            timeout.streaming();
             const reader = upstream.body.getReader();
             const decoder = new TextDecoder();
             try {
                 while (true) {
                     const { done, value } = await reader.read();
+                    timeout.touch();
                     if (done)
                         break;
                     // The abort above normally makes this read reject; a stream that
@@ -1484,7 +1492,7 @@ timing) {
         return true;
     }
     finally {
-        clearTimeout(timeout);
+        timeout.clear();
         res.removeListener('close', onClientClose);
     }
 }

package/dist/config-file.d.ts

@@ -89,7 +89,7 @@ export interface DarioConfig {
          * `expiring-first` is fill-first ordered by each seat's 7-day reset,
          * soonest first.
          */
-        strategy?: 'headroom' | 'fill-first' | 'expiring-first';
+        strategy?: 'headroom' | 'headroom-by-plan' | 'fill-first' | 'expiring-first';
         /** Headroom at/below which a seat counts as drained — ratio 0.02..0.5 (dario#1333). */
         headroomFloor?: number;
     };

package/dist/config-file.js

@@ -309,8 +309,8 @@ function sanitize(parsed) {
     }
     if (isPlainObject(parsed.pool)) {
         out.pool = {};
-        if (parsed.pool.strategy === 'headroom' || parsed.pool.strategy === 'fill-first'
-            || parsed.pool.strategy === 'expiring-first') {
+        if (parsed.pool.strategy === 'headroom' || parsed.pool.strategy === 'headroom-by-plan'
+            || parsed.pool.strategy === 'fill-first' || parsed.pool.strategy === 'expiring-first') {
             out.pool.strategy = parsed.pool.strategy;
         }
         if (typeof parsed.pool.headroomFloor === 'number' && Number.isFinite(parsed.pool.headroomFloor)) {

package/dist/credits-rung.d.ts

@@ -0,0 +1,72 @@
+/**
+ * The credits rung of the failover chain.
+ *
+ * Since October 2026 a Max plan includes monthly Claude API credits ($100 on
+ * Max 5x, $200 on Max 20x). They are spent through a Console API key of the
+ * organization the plan is linked to, not through the seat's own five-hour
+ * and weekly windows, so until now the only ways to spend them through dario
+ * were ANTHROPIC_UPSTREAM_API_KEY (the whole Claude backend on the key, pool
+ * bypassed) or an OpenAI-compat backend pointed at Anthropic's compatibility
+ * layer, which Anthropic describes as a layer for testing models.
+ *
+ * A chain entry written `credits:<model>` names the key as a rung. When every
+ * seat is drained or cooling and no subscription rung can serve, the request
+ * goes to api.anthropic.com on the Messages path as a plain API request: the
+ * client's own body with the model swapped, `x-api-key`, no Claude Code
+ * template and no OAuth beta. Both wire shapes work, because the Claude path
+ * already translates OpenAI-shape requests and responses. The response says
+ * `x-dario-pool-fallback: credits:<model>`; the rolling window, `/metrics`
+ * and the dashboard file the request under its own billing bucket, `credits`,
+ * next to extra usage and API key; the persistent ledger counts it in its
+ * metered total, as spent; and the overage guard does not halt on it: a rung
+ * the operator configured is not a surprise bill.
+ *
+ * The key comes from DARIO_CREDITS_API_KEY only, never a flag, so it never
+ * lands in argv. The rung is opt-in twice: the entry must be in the chain AND
+ * the key must be set. Without the key the entry is inert, the proxy says so
+ * at startup and `dario doctor` says so in its Failover line.
+ *
+ * Where it sits: a subscription rung (a Codex account that lists an entry)
+ * always goes first, because the plan is the thing dario exists to spend.
+ * Among the metered rungs, this one and the openai-compat backend, the
+ * chain's own left-to-right order decides.
+ */
+import { type ClaudeTarget, type ModelResolver } from './claude-model.js';
+export declare const CREDITS_PREFIX = "credits:";
+/** The analytics `account` of a request the credits rung served. */
+export declare const ACCOUNT_KEY_CREDITS = "__credits__";
+/** The value of `x-dario-pool-fallback` on a response the rung served. */
+export declare function creditsFallbackMarker(model: string): string;
+export declare function isCreditsEntry(entry: string): boolean;
+/** The model half of a `credits:<model>` entry as written; null for any other entry. */
+export declare function creditsEntryModel(entry: string): string | null;
+/** Every credits entry's model as written, in chain order. */
+export declare function creditsEntries(chain: readonly string[]): string[];
+/** The chain without its credits entries: what the subscription and openai-compat rungs read. */
+export declare function withoutCreditsEntries(chain: readonly string[]): string[];
+/**
+ * True when the credits rung is asked before the openai-compat backend: the
+ * first credits entry precedes every plain entry, or there is no plain entry.
+ * False when the chain has no credits entry at all.
+ */
+export declare function creditsBeforePlain(chain: readonly string[]): boolean;
+/**
+ * The first credits entry the Claude catalog can serve, resolved exactly like
+ * a Claude chain entry: aliases (`credits:sonnet`), a provider prefix
+ * (`credits:anthropic:claude-opus-5`) and an effort suffix spelled the way a
+ * Claude entry spells it (`credits:claude:opus:high`, `credits:claude-opus-5-high`)
+ * all work, and a name the catalog does not list is skipped rather than sent, so
+ * a typo cannot trade a recoverable 429 for a 404 billed to the key.
+ */
+export declare function pickCreditsTarget(chain: readonly string[], bases?: readonly string[], resolve?: ModelResolver): ClaudeTarget | null;
+/**
+ * Outbound headers for a credits request: the headers a plain API client
+ * sends and nothing of Claude Code's identity. The client's own betas go
+ * through minus the OAuth flag, which an API key request must not carry.
+ */
+export declare function creditsHeaders(key: string, clientBeta: string | undefined, anthropicVersion?: string): Record<string, string>;
+/**
+ * One phrase for the startup line and `dario doctor`, or null when the chain
+ * names no credits entry.
+ */
+export declare function describeCreditsRung(chain: readonly string[], hasKey: boolean): string | null;