@askalf/dario 6.15.0 → 6.17.0

package/dist/proxy.js

@@ -13,15 +13,16 @@ import { getServingProbe } from './serving-probe.js';
 import { darioVersion } from './version.js';
 import { CC_TOOL_DEFINITIONS_UNADVERTISABLE, CC_TEMPLATE_PROMPT_BYTES, resolveMaxTokens, buildCCRequest, applyCcPromptCaching, isGenuineCCClient, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, forwardClientCCIdentityHeaders, isMcpToolName, UnsupportedClientToolError, CLIENT_TOOL_MCP_PREFIX, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
 import { stampCch, hasCchSeed } from './cch.js';
+import { rebindBodyIdentity } from './body-identity.js';
 import { foldTiming, timingHeaders, timingLogFields } from './timing.js';
 import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion } from './live-fingerprint.js';
 import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, activeParkedBuckets, reconcilePoolAccounts, resolvePoolStrategy, resolvePoolHeadroomFloor, parsePoolHeadroomFloor, describePoolStrategy, utilFreshness, rateLimitWindow, accountAction, accountPeers, distinctAccounts, describeRejection, maskEmail } from './pool.js';
 import { backfillIdentity } from './accounts.js';
 import { PoolSync, DEFAULT_POOL_SYNC_INTERVAL_MS } from './pool-sync.js';
-import { Analytics, billingBucketFromClaim, costOfTokensFailClosed, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, CODEX_CLAIM } from './analytics.js';
+import { Analytics, billingBucketFromClaim, costOfTokensFailClosed, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, CODEX_CLAIM, CREDITS_CLAIM } from './analytics.js';
 import { Ledger, resolveLedgerPath, ledgerDisabledByEnv } from './ledger.js';
 import { renderPrometheus } from './metrics.js';
-import { renderSpendDonuts, renderAnalyticsView, ANALYTICS_UI_SHELL } from './donuts.js';
+import { renderSpendDonuts, renderAnalyticsView, analyticsUiPage } from './donuts.js';
 import { KeyStore, keyAllowsModel, resolveKeysPath, looksLikeNamedKey, budgetVerdict, budgetHeaders, requestBudgetReservation, addReservation, subtractReservation, EMPTY_RESERVATION } from './keys.js';
 import { OverageGuard, buildHaltErrorBody } from './overage-guard.js';
 import { notify as osNotify } from './notify.js';
@@ -55,10 +56,12 @@ import { codexUsageView, resolveCodexUsagePollMs } from './codex-usage.js';
 import { seedStaleCodexUsage } from './codex-backend.js';
 import { route as routeProvider } from './provider-adapter.js';
 import { selectPoolFallbackModels } from './pool-fallback-tier.js';
+import { ACCOUNT_KEY_CREDITS, creditsBeforePlain, creditsEntries, creditsFallbackMarker, creditsHeaders, describeCreditsRung, pickCreditsTarget, withoutCreditsEntries } from './credits-rung.js';
 import { parseFamilyFallback, familyFallbackModel, describeFamilyFallback } from './family-fallback.js';
 import { RequestQueue, QueueFullError, QueueTimeoutError, DEFAULT_MAX_CONCURRENT, DEFAULT_MAX_QUEUED, DEFAULT_QUEUE_TIMEOUT_MS, resolveMaxConcurrent } from './request-queue.js';
 import { waitForIdle, drainThenClose, shutdownTimers, DEFAULT_SHUTDOWN_GRACE_MS } from './shutdown-drain.js';
 import { clampTimerMs } from './timer-ms.js';
+import { upstreamDeadline } from './upstream-deadline.js';
 import { redactSecrets } from './redact.js';
 import { BAKED_BASE_MODELS, withLongContextVariants, buildOpenAIModelsList, getModelCatalog, getCachedBases, resolveAliasAgainst, prewarmModelCatalog, retryModelCatalogNow, isSuspendedModel } from './model-catalog.js';
 import { classifyUpstreamRejection, diagnosticSnippet, POOL_PARKED } from './upstream-rejection.js';
@@ -66,7 +69,9 @@ import { ProviderCooldowns, canAttempt, allProvidersCooled, cooldownRetryAfterMs
 const ANTHROPIC_API = 'https://api.anthropic.com';
 const DEFAULT_PORT = 3456;
 const MAX_BODY_BYTES = 10 * 1024 * 1024; // 10 MB — generous for large prompts, prevents abuse
-const UPSTREAM_TIMEOUT_MS = 300_000; // 5 min — matches Anthropic SDK default
+// Until the response streams: the whole wait. While a 2xx streams: the longest
+// gap between two chunks (src/upstream-deadline.ts). 5 min, as in the Anthropic SDK.
+const UPSTREAM_TIMEOUT_MS = 300_000;
 const BODY_READ_TIMEOUT_MS = 30_000; // 30s — prevents slow-loris on body reads
 const DEFAULT_HOST = '127.0.0.1';
 // A host is "loopback" if it's one of the well-known localhost literals.
@@ -1345,6 +1350,9 @@ export async function startProxy(opts = {}) {
     const upstreamFetch = chaosCut && chaosState ? chaosCutFetch(opts.fetchImpl ?? fetch, chaosCut, chaosState) : (opts.fetchImpl ?? fetch);
     const codexFetch = chaosCut && chaosState ? chaosCutFetch(fetch, chaosCut, chaosState) : fetch;
     const upstreamApiKey = (opts.upstreamApiKey ?? process.env.ANTHROPIC_UPSTREAM_API_KEY ?? '').trim();
+    // The credits rung's key (credits-rung.ts). Read once here; whether it is
+    // ever used depends on the chain naming a `credits:<model>` entry.
+    const creditsApiKey = (opts.creditsApiKey ?? process.env.DARIO_CREDITS_API_KEY ?? '').trim();
     if (upstreamApiKey)
         console.error('[dario] upstream auth: per-token API key (x-api-key) — OAuth/Max + account pool bypassed');
     else if (ignoreCcCredentials())
@@ -1551,17 +1559,37 @@ export async function startProxy(opts = {}) {
         }
     };
     if (poolFallbackModel) {
+        // The rungs in the order they are asked: the subscription first, then the
+        // metered rungs (the credits key and the openai-compat backend) in the
+        // chain's own order. A `credits:` entry is not a model the other rungs
+        // can serve, so their model is the first plain entry.
+        const plainFallbackModel = withoutCreditsEntries(poolFallbackModels)[0] ?? null;
+        const creditsLine = describeCreditsRung(poolFallbackModels, creditsApiKey.length > 0);
+        const creditsArmed = creditsLine !== null && creditsApiKey.length > 0;
         const targets = [];
-        if (startupCodexAliases.length > 0)
-            targets.push(`codex subscription (${startupCodexAliases.join(', ')}) — both wire shapes`);
-        if (openaiBackend)
-            targets.push(`${openaiBackend.name} — OpenAI shape only`);
+        if (startupCodexAliases.length > 0 && plainFallbackModel)
+            targets.push(`codex subscription (${startupCodexAliases.join(', ')}) as ${plainFallbackModel}, both wire shapes`);
+        const metered = [];
+        if (openaiBackend && plainFallbackModel)
+            metered.push(`${openaiBackend.name} as ${plainFallbackModel}, OpenAI shape only`);
+        if (creditsArmed) {
+            if (creditsBeforePlain(poolFallbackModels))
+                metered.unshift(creditsLine);
+            else
+                metered.push(creditsLine);
+        }
+        targets.push(...metered);
         if (targets.length > 0) {
-            console.log(`  Pool fallback: exhausted-pool requests → ${targets.join(', then ')} as ${poolFallbackModel} (marked x-dario-pool-fallback)`);
+            console.log(`  Pool fallback: exhausted-pool requests → ${targets.join(', then ')} (marked x-dario-pool-fallback)`);
         }
         else {
-            console.warn('[dario] --pool-fallback is set but there is nothing to fall back TO — add a Codex account (`dario codex add …`) or an OpenAI-compat backend (`dario backend add …`). Fallback is inert.');
+            console.warn('[dario] --pool-fallback is set but there is nothing to fall back TO: add a Codex account (`dario codex add …`), an OpenAI-compat backend (`dario backend add …`), or a credits:<model> entry with DARIO_CREDITS_API_KEY set. Fallback is inert.');
         }
+        if (creditsLine && !creditsArmed)
+            console.warn(`[dario] --pool-fallback ${creditsLine}`);
+    }
+    else if (creditsApiKey) {
+        console.warn('[dario] DARIO_CREDITS_API_KEY is set but no --pool-fallback entry names credits:<model>, so nothing spends it');
     }
     // Family fallback (strictly opt-in, family-fallback.ts). Bad entries are
     // dropped with a warning; the rest still apply.
@@ -2475,7 +2503,9 @@ export async function startProxy(opts = {}) {
         //
         // With NO next option and no peer, do not defer: the real upstream error is
         // more useful to the client than replacing it with a generic 503.
-        const hasNextOption = openaiBackend !== null && shape === 'openai';
+        // An armed credits rung is a next option on both wire shapes.
+        const hasNextOption = (openaiBackend !== null && shape === 'openai')
+            || (creditsApiKey.length > 0 && creditsEntries(fallbackModels).length > 0);
         // The next seat that could serve one of these fallback models, excluding
         // everything already tried. `peek` is the cached read, so the scan costs no
         // upstream call; a seat whose model list is unknown is still worth a try.
@@ -2573,21 +2603,37 @@ export async function startProxy(opts = {}) {
      * bug structurally impossible to reintroduce: a future third call site gets
      * this by construction, not by remembering to copy six lines correctly.
      */
-    const attemptPoolFallbackOn429 = async (req, res, body, isOpenAI, attempted, timing) => {
-        if (await tryCodexPoolFallback(req, res, body, selectPoolFallbackForBody(body), isOpenAI ? 'openai' : 'anthropic', 'pool exhausted mid-flight (429, no peer)', attempted, timing)) {
-            return true;
+    const attemptPoolFallbackOn429 = async (req, res, body, isOpenAI, attempted, timing, 
+    /**
+     * Re-arm THIS request on the credits rung (credits-rung.ts): returns true
+     * once the request is re-pointed at the key, and the caller re-enters its
+     * dispatch loop. Absent on a site that cannot re-dispatch.
+     */
+    armCredits) => {
+        const chain = selectPoolFallbackForBody(body);
+        if (await tryCodexPoolFallback(req, res, body, chain, isOpenAI ? 'openai' : 'anthropic', 'pool exhausted mid-flight (429, no peer)', attempted, timing)) {
+            return 'served';
         }
-        const fallbackModel = selectPoolFallbackForBody(body)[0] ?? null;
-        if (isOpenAI && fallbackModel && openaiBackend) {
-            const fallbackBody = buildPoolFallbackBody(body, fallbackModel);
+        // The metered rungs, in the chain's own order. The credits rung is never
+        // asked twice in one request: a 429 from the key falls through to the
+        // openai-compat backend or to the honest 429.
+        const plainModel = withoutCreditsEntries(chain)[0] ?? null;
+        const creditsFirst = creditsBeforePlain(chain);
+        const tryCredits = () => armCredits !== undefined && !attempted.has('credits') && armCredits();
+        if (creditsFirst && tryCredits())
+            return 'credits';
+        if (isOpenAI && plainModel && openaiBackend) {
+            const fallbackBody = buildPoolFallbackBody(body, plainModel);
             if (fallbackBody) {
-                console.log(`[dario] #${requestCount} pool exhausted mid-flight (429, no peer) → ${openaiBackend.name} as ${fallbackModel}`);
+                console.log(`[dario] #${requestCount} pool exhausted mid-flight (429, no peer) → ${openaiBackend.name} as ${plainModel}`);
                 requestCount++;
-                await forwardToOpenAI(req, res, fallbackBody, openaiBackend, corsOrigin, { ...SECURITY_HEADERS, 'x-dario-pool-fallback': fallbackModel }, upstreamTimeoutMs, verbose);
-                return true;
+                await forwardToOpenAI(req, res, fallbackBody, openaiBackend, corsOrigin, { ...SECURITY_HEADERS, 'x-dario-pool-fallback': plainModel }, upstreamTimeoutMs, verbose);
+                return 'served';
             }
         }
-        return false;
+        if (!creditsFirst && tryCredits())
+            return 'credits';
+        return 'none';
     };
     const server = createServer(async (req, res) => {
         // The request's first stamp (src/timing.ts): every split below is
@@ -2825,11 +2871,12 @@ export async function startProxy(opts = {}) {
             if (handled)
                 return;
         }
-        // The dashboard shell carries no data, so it needs no credential: it is
-        // the page that ASKS for the token and then fetches /analytics/view.
+        // The dashboard page carries no data, so it needs no credential: it asks
+        // for the token, then reads /analytics, /accounts, /codex, /health, the
+        // ledger and the keys with it and tails /analytics/stream (donuts.ts).
         if (urlPath === '/analytics/ui' && req.method === 'GET') {
             res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', ...SECURITY_HEADERS });
-            res.end(ANALYTICS_UI_SHELL);
+            res.end(analyticsUiPage());
             return;
         }
         // Read-only analytics token: accepted on the read-only surfaces only, and
@@ -3009,7 +3056,11 @@ export async function startProxy(opts = {}) {
             // `queue` rides along the summary (dario#905): request-queue.ts always
             // documented snapshot() as "exposed for /analytics", but it was never
             // actually wired in, so slot exhaustion was invisible from outside.
-            res.end(JSON.stringify({ ...analytics.summary(), queue: queue.snapshot(), lifetime: ledger ? ledger.summary() : null, budgets: keyBudgetsSnapshot() }));
+            // `overage` is the halt state for every reader of this route (the
+            // dashboard, dario#1734): the stream replays a halt only while one is
+            // in force and the analytics token cannot read /admin/resume, so a
+            // viewer that saw the halt and missed the resume resyncs from here.
+            res.end(JSON.stringify({ ...analytics.summary(), queue: queue.snapshot(), overage: { halted: overageGuard.isHalted(), state: overageGuard.state() }, lifetime: ledger ? ledger.summary() : null, budgets: keyBudgetsSnapshot() }));
             return;
         }
         // Prometheus text exposition of the same state (dario#1341). A view, not
@@ -3048,7 +3099,9 @@ export async function startProxy(opts = {}) {
             return;
         }
         // The ledger's per-day table, for anyone charting it. `lifetime` on
-        // /analytics is the summary; this is the data behind it.
+        // /analytics is the summary; this is the data behind it. `priced` is the
+        // same rows as USD at each day's rate (ledger.ts), so a reader, the
+        // dashboard first, never needs a price list of its own.
         if (urlPath === '/analytics/ledger' && req.method === 'GET') {
             if (!ledger) {
                 res.writeHead(404, JSON_HEADERS);
@@ -3056,7 +3109,7 @@ export async function startProxy(opts = {}) {
                 return;
             }
             res.writeHead(200, JSON_HEADERS);
-            res.end(JSON.stringify({ path: ledger.path, ...ledger.snapshot() }));
+            res.end(JSON.stringify({ path: ledger.path, ...ledger.snapshot(), priced: ledger.priced() }));
             return;
         }
         // Analytics live stream — SSE of new RequestRecord JSON, one event
@@ -3368,6 +3421,17 @@ export async function startProxy(opts = {}) {
             // form gives the declared type without seeding a narrowing.
             let poolAccount = null;
             let accessToken = '';
+            // Set when the credits rung (credits-rung.ts) is serving this request:
+            // the Claude path then runs on the key instead of a seat. The same `as`
+            // form as poolAccount, for the same narrowing reason.
+            let creditsRung = null;
+            // The account an analytics record names: the seat, the credits rung, or
+            // the api-key slot. A function because a mid-flight 429 can move the
+            // request from a seat to the credits rung after the first attempt.
+            const accountKeyNow = () => creditsRung ? ACCOUNT_KEY_CREDITS : (poolAccount?.alias ?? ACCOUNT_KEY_APIKEY);
+            // The claim a record carries: Anthropic sends none on an API key
+            // request, so the credits rung stamps its own, as the codex engine does.
+            const claimNow = (rl) => creditsRung ? CREDITS_CLAIM : rl.claim;
             // Providers this ONE request has already asked. Paired with the
             // process-wide cool-downs: the set stops a revisit inside the request,
             // the cool-downs stop the next request repeating the discovery.
@@ -3571,7 +3635,11 @@ export async function startProxy(opts = {}) {
                     //
                     // An EMPTY pool still 503s: that's a setup error the operator needs to
                     // see, not traffic to quietly re-bill somewhere else.
-                    const fallbackViable = poolFallbackModels.length > 0 && pool.size > 0;
+                    // A chain whose only entries are credits rungs without the key is
+                    // inert and defers nothing: the honest 429/503 stands.
+                    const chainCanServe = withoutCreditsEntries(poolFallbackModels).length > 0
+                        || (creditsApiKey.length > 0 && creditsEntries(poolFallbackModels).length > 0);
+                    const fallbackViable = chainCanServe && pool.size > 0;
                     if (!fallbackViable) {
                         if (parkedUntil !== null)
                             writePoolParked(parkedUntil);
@@ -3697,7 +3765,9 @@ export async function startProxy(opts = {}) {
                 const onClose = () => { if (!res.writableEnded)
                     abort.abort(); };
                 res.on('close', onClose);
-                const timer = setTimeout(() => abort.abort(), upstreamTimeoutMs);
+                // The loopback leg is timed like the request it replaces: until
+                // headers, then by the gap between chunks of a 2xx body.
+                const timer = upstreamDeadline(upstreamTimeoutMs, () => abort.abort());
                 try {
                     const leg = await fetch(`${loopbackBase}${isOpenAI ? '/v1/chat/completions' : '/v1/messages'}`, {
                         method: 'POST',
@@ -3714,9 +3784,12 @@ export async function startProxy(opts = {}) {
                     responseHeaders['x-dario-family-fallback'] = fromModel;
                     res.writeHead(leg.status, responseHeaders);
                     if (leg.body) {
+                        if (leg.ok)
+                            timer.streaming();
                         const reader = leg.body.getReader();
                         while (true) {
                             const { done, value } = await reader.read();
+                            timer.touch();
                             if (done)
                                 break;
                             if (!res.write(value))
@@ -3737,7 +3810,7 @@ export async function startProxy(opts = {}) {
                     }
                 }
                 finally {
-                    clearTimeout(timer);
+                    timer.clear();
                     res.off('close', onClose);
                 }
                 return true;
@@ -4547,6 +4620,30 @@ export async function startProxy(opts = {}) {
             }
             if (!selectPoolAccount())
                 return;
+            // The credits rung (credits-rung.ts): re-point THIS request at the key
+            // as the first `credits:<model>` entry the catalog can serve. False when
+            // the chain names no such entry, the key is unset, the request is pinned
+            // to a seat, or the rung already answered this request. The response is
+            // marked here, before any byte of the answer, and the Claude path below
+            // then runs on the key: `x-api-key`, the client's own body, no template.
+            const armCreditsRung = (why) => {
+                if (!creditsApiKey || creditsRung || pinnedAccount || attemptedProviders.has('credits'))
+                    return false;
+                const target = pickCreditsTarget(selectPoolFallbackForBody(body), getCachedBases(), (m) => resolveClaudeAlias(applyModelAlias(m, modelAliases) ?? m));
+                if (!target)
+                    return false;
+                attemptedProviders.add('credits');
+                creditsRung = target;
+                poolAccount = null;
+                accessToken = '';
+                requestModel = target.model;
+                requestFamily = modelFamily(target.model);
+                if (target.effort)
+                    requestEffort = target.effort;
+                res.setHeader('x-dario-pool-fallback', creditsFallbackMarker(target.model));
+                console.log(`[dario] #${requestCount} ${why} → API credits as ${target.model}${target.effort ? ` (effort: ${target.effort})` : ''} (x-api-key)`);
+                return true;
+            };
             // Pool-exhausted fallback dispatch. In OAuth mode poolAccount can only
             // be null here when the selection above deferred to this path (armed
             // fallback + drained pool + OpenAI-shape request): swap the model and
@@ -4574,19 +4671,34 @@ export async function startProxy(opts = {}) {
             // that was ~2% of dario's own CPU on every request that never took the
             // branch (scripts/bench-overhead.mjs profile, v6.9.2). Resolved only
             // when the branch can be taken.
-            const fallbackModel = (!upstreamApiKey && !poolAccount && openaiBackend && isOpenAI)
-                ? (selectPoolFallbackForBody(body)[0] ?? null)
-                : null;
-            if (!upstreamApiKey && !poolAccount && fallbackModel && openaiBackend && isOpenAI) {
-                const fallbackBody = buildPoolFallbackBody(body, fallbackModel);
-                if (!fallbackBody) {
-                    writePoolUnavailable();
+            //
+            // The metered rungs come after the subscription, in the chain's own
+            // order: the credits rung (both wire shapes, since it rides the Claude
+            // path) and the openai-compat backend (OpenAI shape only). A `credits:`
+            // entry is no model for that backend, so its model is the first plain
+            // entry.
+            if (!upstreamApiKey && !poolAccount && !pinnedAccount) {
+                const chainForBody = selectPoolFallbackForBody(body);
+                const plainModel = withoutCreditsEntries(chainForBody)[0] ?? null;
+                const openaiCanServe = openaiBackend !== null && isOpenAI && plainModel !== null;
+                const creditsFirst = creditsBeforePlain(chainForBody);
+                if (creditsFirst && armCreditsRung('pool exhausted')) {
+                    // Served below, on the key.
+                }
+                else if (openaiCanServe) {
+                    const fallbackBody = buildPoolFallbackBody(body, plainModel);
+                    if (!fallbackBody) {
+                        writePoolUnavailable();
+                        return;
+                    }
+                    console.log(`[dario] #${requestCount} pool exhausted, /v1/chat/completions → ${openaiBackend.name} as ${plainModel}`);
+                    requestCount++;
+                    await forwardToOpenAI(req, res, fallbackBody, openaiBackend, corsOrigin, { ...SECURITY_HEADERS, 'x-dario-pool-fallback': plainModel }, upstreamTimeoutMs, verbose);
                     return;
                 }
-                console.log(`[dario] #${requestCount} pool exhausted — /v1/chat/completions → ${openaiBackend.name} as ${fallbackModel}`);
-                requestCount++;
-                await forwardToOpenAI(req, res, fallbackBody, openaiBackend, corsOrigin, { ...SECURITY_HEADERS, 'x-dario-pool-fallback': fallbackModel }, upstreamTimeoutMs, verbose);
-                return;
+                else if (!creditsFirst) {
+                    armCreditsRung('pool exhausted');
+                }
             }
             // Deferred at selection because a fallback was armed, but nothing could
             // actually serve it — no Codex account lists the model, and either there
@@ -4594,7 +4706,7 @@ export async function startProxy(opts = {}) {
             // with the truth the selector used to give. Without this the request
             // would fall through to the Claude path with no account and an empty
             // bearer token, turning a clean 503 into a confusing upstream 401.
-            if (!upstreamApiKey && !poolAccount) {
+            if (!upstreamApiKey && !poolAccount && !creditsRung) {
                 // A fallback was armed but nothing could serve, and the pool itself is
                 // parked: the exact reset beats a cool-down estimate (dario#1244).
                 const parkedNow = pool.parkedUntil(Date.now(), requestFamily);
@@ -4631,6 +4743,10 @@ export async function startProxy(opts = {}) {
             // Outbound session id resolved once — either inside the template build
             // (so body metadata matches) or below for passthrough (no body build).
             let preBodySessionId;
+            // True once the template build has written dario's metadata.user_id
+            // into finalBody. Only such a body names the selected account, so only
+            // it is rebound when a failover switches accounts (see switchAccount).
+            let bodyIdentityOwned = false;
             // Request context for hybrid-mode field injection (#33). Built once
             // per request from incoming headers so the reverse mapper can fill
             // client-declared fields like `sessionId` that CC's schema doesn't
@@ -4645,7 +4761,49 @@ export async function startProxy(opts = {}) {
                 userId: req.headers['x-user-id'],
                 timestamp: new Date().toISOString(),
             } : undefined;
-            if (body.length > 0) {
+            // The credits rung sends the client's own body as a plain API request:
+            // sanitized, translated when OpenAI-shaped, the model swapped for the
+            // rung's, the effort the entry named applied when the client set none.
+            // No Claude Code template, identity or cch stamp: those make a request
+            // look like Claude Code's for the OAuth gate, and an API key request
+            // would be billed for every byte of them for nothing.
+            const thinCreditsBody = (target) => {
+                try {
+                    const parsed = JSON.parse(body.toString());
+                    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+                        return null;
+                    const client = parsed;
+                    sanitizeMessages(client, opts.preserveOrchestrationTags);
+                    const r = (isOpenAI ? openaiToAnthropic(client, target.model) : { ...client, model: target.model });
+                    r.model = stripContext1mTag(typeof r.model === 'string' ? r.model : target.model);
+                    const effort = requestEffort ?? opts.effort;
+                    if (effort) {
+                        const oc = (r.output_config && typeof r.output_config === 'object' && !Array.isArray(r.output_config))
+                            ? { ...r.output_config }
+                            : {};
+                        if (typeof oc.effort !== 'string') {
+                            oc.effort = effort;
+                            r.output_config = oc;
+                        }
+                    }
+                    return Buffer.from(JSON.stringify(r));
+                }
+                catch {
+                    return null;
+                }
+            };
+            if (creditsRung) {
+                const thin = thinCreditsBody(creditsRung);
+                if (!thin) {
+                    console.log(`[dario] #${requestCount} credits rung: the request body could not be re-pointed at ${creditsRung.model}`);
+                    writePoolUnavailable();
+                    return;
+                }
+                finalBody = thin;
+                // The client's own tool names go out and come back untouched.
+                preserveToolsEffective = true;
+            }
+            else if (body.length > 0) {
                 try {
                     // Reuse the object parsed for provider-prefix detection above — the same
                     // bytes, so re-parsing is wasted work on large bodies (#642-audit). Falls
@@ -4876,6 +5034,7 @@ export async function startProxy(opts = {}) {
                         for (const key of Object.keys(r))
                             delete r[key];
                         Object.assign(r, ccBody);
+                        bodyIdentityOwned = true;
                         // `X[1m]` is a client-side LABEL, never a valid wire id — real CC
                         // sends the BASE model id plus the `context-1m-2025-08-07` beta
                         // (live capture 2026-06-09, CC v2.1.170 with --model
@@ -4964,7 +5123,12 @@ export async function startProxy(opts = {}) {
             // Beta headers
             const clientBeta = req.headers['anthropic-beta'];
             let beta;
-            if (passthrough || isCountTokens) {
+            if (creditsRung) {
+                // A plain API request: the client's betas minus the OAuth flag go out
+                // in creditsHeaders below; nothing of the template's set applies.
+                beta = '';
+            }
+            else if (passthrough || isCountTokens) {
                 // Passthrough (and thin count_tokens): only add oauth beta,
                 // forward client betas as-is — no template beta set.
                 beta = 'oauth-2025-04-20';
@@ -4978,7 +5142,7 @@ export async function startProxy(opts = {}) {
                 // context-1m requires Extra Usage — if it 400s, we auto-retry without
                 // it, and cache the rejection so subsequent requests on this account
                 // skip context-1m entirely (dario#36).
-                const acctKey = poolAccount?.alias ?? ACCOUNT_KEY_APIKEY;
+                const acctKey = accountKeyNow();
                 const skipContext1m = context1mUnavailable.has(acctKey);
                 // Model-conditional betas (fable fallback-credit; [1m] context-1m),
                 // mirroring real CC — see betaForModel. betaWithoutContext1m still
@@ -5036,7 +5200,7 @@ export async function startProxy(opts = {}) {
             // (below) does not re-pace on the peer: the retry is the rare path, and
             // holding it for a floor would stack a second wait on a request that
             // has already been refused once.
-            const seatClock = pacingClocks.seat(poolAccount?.alias ?? ACCOUNT_KEY_APIKEY);
+            const seatClock = pacingClocks.seat(accountKeyNow());
             const nowForPacing = Date.now();
             const pacingDelay = computePacingDelay(nowForPacing, seatClock.lastRequestTime, pacingCfg);
             const thinkDelay = thinkTimeEnabled
@@ -5082,12 +5246,16 @@ export async function startProxy(opts = {}) {
             const forwardedIdentity = (passthrough || genuineCCRequest)
                 ? forwardClientCCIdentityHeaders(req.headers)
                 : {};
-            const headers = {
+            const clientAnthropicVersion = passthrough ? (req.headers['anthropic-version'] || '2023-06-01') : '2023-06-01';
+            // On the credits rung the outbound set is a plain API client's
+            // (credits-rung.ts): the key, the version, the client's betas minus the
+            // OAuth flag. Nothing of Claude Code's identity or session.
+            const headers = creditsRung ? creditsHeaders(creditsApiKey, clientBeta, clientAnthropicVersion) : {
                 ...staticHeaders,
                 ...forwardedIdentity,
                 ...upstreamAuthHeaders(upstreamApiKey, accessToken),
                 'x-claude-code-session-id': outboundSessionId,
-                'anthropic-version': passthrough ? (req.headers['anthropic-version'] || '2023-06-01') : '2023-06-01',
+                'anthropic-version': clientAnthropicVersion,
                 'anthropic-beta': beta,
                 // Prefer the client's own when passthrough forwarded one: a genuine CC
                 // request already carries a real request id, and synthesising over it
@@ -5101,17 +5269,19 @@ export async function startProxy(opts = {}) {
             // upstream fetch so Anthropic stops generating (and billing) a
             // response nobody will read. With `--drain-on-close` set, we
             // instead keep the reader spinning to consume the full SSE — see
-            // src/stream-drain.ts for the fingerprint rationale. The 5-minute
-            // upstream timeout shares the same controller, so a hung upstream
-            // still gets cut off regardless of drain mode.
+            // src/stream-drain.ts for the fingerprint rationale. The upstream
+            // timeout shares the same controller, so a hung upstream still gets
+            // cut off regardless of drain mode: it caps the wait until headers,
+            // then the gap between chunks once a 2xx streams.
             const upstreamAbort = new AbortController();
             let clientDisconnected = false;
-            upstreamTimeout = setTimeout(() => {
+            const deadline = upstreamDeadline(upstreamTimeoutMs, () => {
                 if (!upstreamAbort.signal.aborted) {
                     upstreamAbortReason = 'timeout';
                     upstreamAbort.abort();
                 }
-            }, upstreamTimeoutMs);
+            });
+            upstreamTimeout = deadline;
             onClientClose = () => {
                 const action = decideOnClientClose(res.writableEnded, upstreamAbort.signal.aborted, drainOnClose);
                 if (action === 'abort') {
@@ -5157,12 +5327,56 @@ export async function startProxy(opts = {}) {
             // combination with headroom -- opus-4-1 needs 2.
             const MAX_RECOVERY_PASSES = 4;
             let recoveryPasses = 0;
+            // Move the request to a peer seat: auth, session header, the body's
+            // metadata.user_id and the sticky binding all name `next`. The session
+            // id is resolved once so the header and the body carry the same value
+            // (the same rule as the first build), and the body's device_id and
+            // account_uuid are next's, not the rejected seat's. A body dario did not
+            // build (passthrough, count_tokens) is the client's and is left alone.
+            const switchAccount = (next) => {
+                triedAliases.add(next.alias);
+                poolAccount = next;
+                accessToken = next.accessToken;
+                headers['Authorization'] = `Bearer ${accessToken}`;
+                const sessionId = resolveOutboundSession(next, clientSessionKey).sessionId;
+                headers['x-claude-code-session-id'] = sessionId;
+                if (bodyIdentityOwned) {
+                    finalBody = rebindBodyIdentity(finalBody, { deviceId: next.identity.deviceId, accountUuid: next.identity.accountUuid, sessionId }, process.env.DARIO_CCH !== 'random' ? cliVersion : null);
+                }
+                pool.rebindSticky(stickyKey, next.alias);
+                poolSync?.bindSticky(stickyKey, next.alias);
+            };
+            // Mid-flight move to the credits rung (credits-rung.ts): a 429 with no
+            // peer seat left, and the chain names a credits entry the key can serve.
+            // The request is rebuilt as a plain API request and the headers are
+            // replaced in place, because the loop head re-derives the outbound set
+            // from `headers` on every pass; the caller then re-enters the loop.
+            const rearmOnCredits = () => {
+                if (!armCreditsRung('pool exhausted mid-flight (429, no peer)'))
+                    return false;
+                const thin = thinCreditsBody(creditsRung);
+                if (!thin) {
+                    console.log(`[dario] #${requestCount} credits rung: the request body could not be re-pointed at ${creditsRung.model}`);
+                    creditsRung = null;
+                    res.removeHeader('x-dario-pool-fallback');
+                    return false;
+                }
+                finalBody = thin;
+                ccToolMap = null;
+                preserveToolsEffective = true;
+                bodyIdentityOwned = false;
+                for (const k of Object.keys(headers))
+                    delete headers[k];
+                Object.assign(headers, creditsHeaders(creditsApiKey, clientBeta, clientAnthropicVersion));
+                return true;
+            };
             dispatchLoop: while (true) {
                 // Reorder outbound headers to match CC's captured header sequence
                 // when the live template recorded one. No-op on bundled-only installs.
                 // Skipped in passthrough mode — passthrough means "don't shape the
                 // request to look like CC," and reordering is a form of shaping.
-                const outboundHeaders = passthrough ? headers : orderHeadersForOutbound(headers);
+                // Skipped on the credits rung too: a plain API request has no CC order.
+                const outboundHeaders = (passthrough || creditsRung) ? headers : orderHeadersForOutbound(headers);
                 fetchStartedAt ??= Date.now();
                 upstream = await upstreamFetch(targetBase, {
                     method: req.method ?? 'POST',
@@ -5252,7 +5466,7 @@ export async function startProxy(opts = {}) {
                         }
                     }
                     if (betaRejectedFlags.length > 0 && recoveryPasses < MAX_RECOVERY_PASSES) {
-                        const acctKey = poolAccount?.alias ?? ACCOUNT_KEY_APIKEY;
+                        const acctKey = accountKeyNow();
                         let set = unavailableBetas.get(acctKey);
                         if (!set) {
                             set = new Set();
@@ -5465,7 +5679,7 @@ export async function startProxy(opts = {}) {
                     else if (isLongContextError && recoveryPasses < MAX_RECOVERY_PASSES) {
                         // Cache the rejection so future requests on this account skip
                         // context-1m up front instead of re-paying the 400/429 round-trip.
-                        const acctKey = poolAccount?.alias ?? ACCOUNT_KEY_APIKEY;
+                        const acctKey = accountKeyNow();
                         const firstRejection = !context1mUnavailable.has(acctKey);
                         context1mUnavailable.add(acctKey);
                         if (verbose && firstRejection)
@@ -5496,13 +5710,7 @@ export async function startProxy(opts = {}) {
                         if (poolAccount) {
                             const nextAccount = pool.selectExcluding(triedAliases, modelFamily(requestModel));
                             if (nextAccount) {
-                                triedAliases.add(nextAccount.alias);
-                                poolAccount = nextAccount;
-                                accessToken = nextAccount.accessToken;
-                                headers['Authorization'] = `Bearer ${accessToken}`;
-                                headers['x-claude-code-session-id'] = resolveOutboundSession(nextAccount, clientSessionKey).sessionId;
-                                pool.rebindSticky(stickyKey, nextAccount.alias);
-                                poolSync?.bindSticky(stickyKey, nextAccount.alias);
+                                switchAccount(nextAccount);
                                 peekedBody = null;
                                 continue dispatchLoop;
                             }
@@ -5520,12 +5728,20 @@ export async function startProxy(opts = {}) {
                         // The Claude half is out of quota for this request AND for the next
                         // one — cool it here, honouring the upstream `retry-after` when it
                         // sent one, so the following request does not re-walk the chain.
-                        if (await familyFallbackOn429(upstream))
+                        if (!creditsRung && await familyFallbackOn429(upstream))
                             return;
                         attemptedProviders.add('claude');
-                        providerCooldowns.note('claude', parseRetryAfterMs(upstream.headers.get('retry-after')));
-                        if (!pinnedAccount && await attemptPoolFallbackOn429(req, res, body, isOpenAI, attemptedProviders, { queueMs, arrivedAt })) {
-                            return;
+                        // A 429 from the credits key is the key's limit, not the pool's.
+                        if (!creditsRung)
+                            providerCooldowns.note('claude', parseRetryAfterMs(upstream.headers.get('retry-after')));
+                        if (!pinnedAccount) {
+                            const outcome = await attemptPoolFallbackOn429(req, res, body, isOpenAI, attemptedProviders, { queueMs, arrivedAt }, rearmOnCredits);
+                            if (outcome === 'served')
+                                return;
+                            if (outcome === 'credits') {
+                                peekedBody = null;
+                                continue dispatchLoop;
+                            }
                         }
                         if (allProvidersCooled(['codex', 'claude'], providerCooldowns)) {
                             writeAllProvidersRateLimited(['codex', 'claude']);
@@ -5553,10 +5769,10 @@ export async function startProxy(opts = {}) {
                             analytics.record({
                                 timestamp: Date.now(),
                                 consumer,
-                                account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
+                                account: accountKeyNow(),
                                 model: requestModel,
                                 inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0, thinkingTokens: 0,
-                                claim: rl.claim, util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
+                                claim: claimNow(rl), util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
                                 latencyMs: Date.now() - startTime, status: 429, isStream: false, isOpenAI, timing: timingNow(),
                             });
                         }
@@ -5580,6 +5796,9 @@ export async function startProxy(opts = {}) {
                         }
                         const rejection = classifyUpstreamRejection(upstream.status, peekedBody);
                         responseHeaders['x-dario-upstream-rejection'] = rejection.marker;
+                        if (creditsRung) {
+                            console.error(`[dario] #${requestCount} credits rung refused (${upstream.status}, ${rejection.marker}) as ${creditsRung.model}: the key may be out of credits or not linked to the plan's organization; the upstream error is forwarded`);
+                        }
                         requestCount++;
                         res.writeHead(upstream.status, responseHeaders);
                         res.end(peekedBody);
@@ -5593,6 +5812,12 @@ export async function startProxy(opts = {}) {
                 // headers, so headroom math sees a healthy idle account. Mark the
                 // cool-down here, try the next-best account, fall through to the
                 // normal forwarding only if no peer is available.
+                // On the credits rung there is no seat to cool and no peer to try: a
+                // 401/403 from the key is the key's own answer and is forwarded as is
+                // (the forwarder below reuses the body the classifier read).
+                if (creditsRung && (upstream.status === 401 || upstream.status === 403)) {
+                    console.error(`[dario] #${requestCount} credits rung refused (${upstream.status}) as ${creditsRung.model}: the key was not accepted (invalid, revoked, or without permission for the model); the upstream error is forwarded`);
+                }
                 if (poolAccount && (upstream.status === 401 || upstream.status === 403)) {
                     pool.markAuthFailure(poolAccount.alias);
                     if (verbose) {
@@ -5600,13 +5825,7 @@ export async function startProxy(opts = {}) {
                     }
                     const nextAccount = pool.selectExcluding(triedAliases, modelFamily(requestModel));
                     if (nextAccount) {
-                        triedAliases.add(nextAccount.alias);
-                        poolAccount = nextAccount;
-                        accessToken = nextAccount.accessToken;
-                        headers['Authorization'] = `Bearer ${accessToken}`;
-                        headers['x-claude-code-session-id'] = resolveOutboundSession(nextAccount, clientSessionKey).sessionId;
-                        pool.rebindSticky(stickyKey, nextAccount.alias);
-                        poolSync?.bindSticky(stickyKey, nextAccount.alias);
+                        switchAccount(nextAccount);
                         continue dispatchLoop;
                     }
                     // No peer available — forward the saved generic-403 bytes when the
@@ -5634,13 +5853,7 @@ export async function startProxy(opts = {}) {
                     if (poolAccount) {
                         const nextAccount = pool.selectExcluding(triedAliases, modelFamily(requestModel));
                         if (nextAccount) {
-                            triedAliases.add(nextAccount.alias);
-                            poolAccount = nextAccount;
-                            accessToken = nextAccount.accessToken;
-                            headers['Authorization'] = `Bearer ${accessToken}`;
-                            headers['x-claude-code-session-id'] = resolveOutboundSession(nextAccount, clientSessionKey).sessionId;
-                            pool.rebindSticky(stickyKey, nextAccount.alias);
-                            poolSync?.bindSticky(stickyKey, nextAccount.alias);
+                            switchAccount(nextAccount);
                             continue dispatchLoop;
                         }
                     }
@@ -5650,12 +5863,21 @@ export async function startProxy(opts = {}) {
                     // into body. See attemptPoolFallbackOn429's doc comment for why this
                     // is one shared function rather than an inline copy.
                     // Same bookkeeping as the other mid-flight site — see there.
-                    if (await familyFallbackOn429(upstream))
+                    if (!creditsRung && await familyFallbackOn429(upstream))
                         return;
                     attemptedProviders.add('claude');
-                    providerCooldowns.note('claude', parseRetryAfterMs(upstream.headers.get('retry-after')));
-                    if (!pinnedAccount && await attemptPoolFallbackOn429(req, res, body, isOpenAI, attemptedProviders, { queueMs, arrivedAt })) {
-                        return;
+                    // A 429 from the credits key is the key's limit, not the pool's.
+                    if (!creditsRung)
+                        providerCooldowns.note('claude', parseRetryAfterMs(upstream.headers.get('retry-after')));
+                    if (!pinnedAccount) {
+                        const outcome = await attemptPoolFallbackOn429(req, res, body, isOpenAI, attemptedProviders, { queueMs, arrivedAt }, rearmOnCredits);
+                        if (outcome === 'served')
+                            return;
+                        if (outcome === 'credits') {
+                            // This site has not read the 429's body; release it before the retry.
+                            void upstream.body?.cancel().catch(() => { });
+                            continue dispatchLoop;
+                        }
                     }
                     if (allProvidersCooled(['codex', 'claude'], providerCooldowns)) {
                         writeAllProvidersRateLimited(['codex', 'claude']);
@@ -5679,10 +5901,10 @@ export async function startProxy(opts = {}) {
                         analytics.record({
                             timestamp: Date.now(),
                             consumer,
-                            account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
+                            account: accountKeyNow(),
                             model: requestModel,
                             inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0, thinkingTokens: 0,
-                            claim: rl.claim, util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
+                            claim: claimNow(rl), util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
                             latencyMs: Date.now() - startTime, status: 429, isStream: false, isOpenAI, timing: timingNow(),
                         });
                     }
@@ -5716,6 +5938,11 @@ export async function startProxy(opts = {}) {
                     responseHeaders[key] = value;
                 }
             }
+            // A classified rejection that reached the plain forwarder (no seat to
+            // fail over from) is marked the way the seat branches mark theirs.
+            if (peekedBody !== null && upstream.status >= 400) {
+                responseHeaders['x-dario-upstream-rejection'] = classifyUpstreamRejection(upstream.status, peekedBody).marker;
+            }
             requestCount++;
             // Log billing classification on first request or in verbose mode.
             //
@@ -5732,7 +5959,10 @@ export async function startProxy(opts = {}) {
             const billingClaim = upstream.headers.get('anthropic-ratelimit-unified-representative-claim');
             const overageUtil = upstream.headers.get('anthropic-ratelimit-unified-overage-utilization');
             if (requestCount === 1 || verbose) {
-                if (billingClaim) {
+                if (creditsRung) {
+                    console.log(`[dario] #${requestCount} billing: credits (${CREDITS_CLAIM}, x-api-key as ${creditsRung.model})`);
+                }
+                else if (billingClaim) {
                     let overagePct;
                     if (overageUtil !== null) {
                         overagePct = `${Math.round(parseFloat(overageUtil) * 100)}%`;
@@ -5839,11 +6069,17 @@ export async function startProxy(opts = {}) {
                 // parking this handler forever and leaking its queue slot — the
                 // dario#905 wedge. See waitForClientDrain in src/stream-drain.ts.
                 const waitForDrain = () => waitForClientDrain(res, upstreamAbort.signal);
+                // A 2xx stream is timed by the gap between chunks from here, so a
+                // long answer is not cut while it still streams. An error body keeps
+                // the headers-phase cap.
+                if (upstream.status >= 200 && upstream.status < 300)
+                    deadline.streaming();
                 try {
                     let buffer = '';
                     const MAX_LINE_LENGTH = 1_000_000; // 1MB max per SSE line
                     while (true) {
                         const { done, value } = await reader.read();
+                        deadline.touch();
                         if (done) {
                             upstreamDoneAt = Date.now();
                             break;
@@ -5973,19 +6209,19 @@ export async function startProxy(opts = {}) {
                 // would read, and using their (often zero) output_tokens would
                 // pin think time to baseMs+jitter on the next request needlessly.
                 if (upstream.status >= 200 && upstream.status < 300) {
-                    pacingClocks.noteResponse(poolAccount?.alias ?? ACCOUNT_KEY_APIKEY, Date.now(), streamOutputTokens);
+                    pacingClocks.noteResponse(accountKeyNow(), Date.now(), streamOutputTokens);
                 }
                 {
                     const rl = poolAccount?.rateLimit ?? parseRateLimits(upstream.headers);
                     analytics.record({
                         timestamp: Date.now(),
                         consumer,
-                        account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
+                        account: accountKeyNow(),
                         model: requestModel,
                         inputTokens: streamInputTokens, outputTokens: streamOutputTokens,
                         cacheReadTokens: streamCacheReadTokens, cacheCreateTokens: streamCacheCreateTokens,
                         thinkingTokens: Math.round(streamThinkingChars / 4),
-                        claim: rl.claim, util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
+                        claim: claimNow(rl), util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
                         latencyMs: Date.now() - startTime, status: upstream.status, isStream: true, isOpenAI, timing: timingNow(),
                         continuation: continuationOf(guard, requestDepth),
                     });
@@ -5997,9 +6233,9 @@ export async function startProxy(opts = {}) {
                     status: upstream.status, latency_ms: Date.now() - startTime, ...timingLogFields(timingNow()),
                     in_tokens: streamInputTokens, out_tokens: streamOutputTokens,
                     cache_read: streamCacheReadTokens, cache_create: streamCacheCreateTokens,
-                    claim: poolAccount?.rateLimit.claim,
-                    bucket: poolAccount ? billingBucketFromClaim(poolAccount.rateLimit.claim) : undefined,
-                    account: poolAccount?.alias,
+                    claim: creditsRung ? CREDITS_CLAIM : poolAccount?.rateLimit.claim,
+                    bucket: creditsRung ? 'credits' : (poolAccount ? billingBucketFromClaim(poolAccount.rateLimit.claim) : undefined),
+                    account: creditsRung ? ACCOUNT_KEY_CREDITS : poolAccount?.alias,
                     consumer,
                     client: detectedClientForLog,
                     preserve_tools: preserveToolsEffective,
@@ -6014,8 +6250,13 @@ export async function startProxy(opts = {}) {
                     }, consumer));
             }
             else {
-                // Buffer and forward
-                let responseBody = await upstream.text();
+                // Buffer and forward. A 400/402/403 body the rejection classifier
+                // already read is in peekedBody and the stream is consumed; reading
+                // it again would hand the client an empty body with the right
+                // status. Only responses no branch above handled reach here: a
+                // non-billing 403 with no seat to fail over from (the credits rung,
+                // ANTHROPIC_UPSTREAM_API_KEY), a generic 400 or 402.
+                let responseBody = peekedBody ?? await upstream.text();
                 upstreamDoneAt = Date.now();
                 // Reverse tool name mapping so client sees original names
                 if (ccToolMap)
@@ -6043,7 +6284,7 @@ export async function startProxy(opts = {}) {
                 // tokens when the body wasn't JSON or had no usage block — base +
                 // jitter still apply but the per-token component is 0.
                 if (upstream.status >= 200 && upstream.status < 300) {
-                    pacingClocks.noteResponse(poolAccount?.alias ?? ACCOUNT_KEY_APIKEY, Date.now(), bufferedUsage?.outputTokens ?? 0);
+                    pacingClocks.noteResponse(accountKeyNow(), Date.now(), bufferedUsage?.outputTokens ?? 0);
                 }
                 if (bufferedUsage) {
                     try {
@@ -6051,12 +6292,12 @@ export async function startProxy(opts = {}) {
                         analytics.record({
                             timestamp: Date.now(),
                             consumer,
-                            account: poolAccount?.alias ?? ACCOUNT_KEY_APIKEY,
+                            account: accountKeyNow(),
                             model: bufferedUsage.model || requestModel,
                             inputTokens: bufferedUsage.inputTokens, outputTokens: bufferedUsage.outputTokens,
                             cacheReadTokens: bufferedUsage.cacheReadTokens, cacheCreateTokens: bufferedUsage.cacheCreateTokens,
                             thinkingTokens: bufferedUsage.thinkingTokens,
-                            claim: rl.claim, util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
+                            claim: claimNow(rl), util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
                             latencyMs: Date.now() - startTime, status: upstream.status, isStream: false, isOpenAI, timing: timingNow(),
                         });
                     }
@@ -6069,9 +6310,9 @@ export async function startProxy(opts = {}) {
                     status: upstream.status, latency_ms: Date.now() - startTime, ...timingLogFields(timingNow()),
                     in_tokens: bufferedUsage?.inputTokens, out_tokens: bufferedUsage?.outputTokens,
                     cache_read: bufferedUsage?.cacheReadTokens, cache_create: bufferedUsage?.cacheCreateTokens,
-                    claim: poolAccount?.rateLimit.claim,
-                    bucket: poolAccount ? billingBucketFromClaim(poolAccount.rateLimit.claim) : undefined,
-                    account: poolAccount?.alias,
+                    claim: creditsRung ? CREDITS_CLAIM : poolAccount?.rateLimit.claim,
+                    bucket: creditsRung ? 'credits' : (poolAccount ? billingBucketFromClaim(poolAccount.rateLimit.claim) : undefined),
+                    account: creditsRung ? ACCOUNT_KEY_CREDITS : poolAccount?.alias,
                     consumer,
                     client: detectedClientForLog,
                     preserve_tools: preserveToolsEffective,
@@ -6128,7 +6369,7 @@ export async function startProxy(opts = {}) {
             // setup happens after the body-read phase, so on fast-path errors
             // (413, body read timeout) these may still be null — guard accordingly.
             if (upstreamTimeout !== null)
-                clearTimeout(upstreamTimeout);
+                upstreamTimeout.clear();
             if (onClientClose !== null)
                 req.off('close', onClientClose);
             releaseQueueSlot();
@@ -6421,8 +6662,13 @@ export async function startProxy(opts = {}) {
             catch { /* best-effort flush — never block shutdown on it */ }
         }));
     };
-    // Graceful shutdown
+    // Graceful shutdown. Runs once: a Ctrl+C in a terminal reaches the Bun child
+    // directly and again through the relaunch wrapper's forwarding.
+    let shuttingDown = false;
     const shutdown = () => {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
         console.log('\n[dario] Shutting down...');
         clearInterval(presenceInterval);
         clearInterval(refreshInterval);