@askalf/dario 6.19.2 → 6.20.1

package/dist/effort.js

@@ -52,6 +52,44 @@ export function effortForCodex(effort) {
         default: return undefined;
     }
 }
+/**
+ * Did the request name an effort of its own? Three places a client can say it:
+ * `output_config.effort` (Messages shape), `reasoning_effort` (chat completions),
+ * `reasoning.effort` (Responses). A named key's default effort fills in only when
+ * this is false, so a client that chose is never overruled by a default. The
+ * model-name suffix is checked separately by the caller (it is parsed off the
+ * model before this runs).
+ */
+export function requestNamesEffort(body) {
+    if (!body || typeof body !== 'object')
+        return false;
+    const oc = body.output_config;
+    if (oc && typeof oc === 'object' && typeof oc.effort === 'string')
+        return true;
+    if (typeof body.reasoning_effort === 'string' && body.reasoning_effort.length > 0)
+        return true;
+    const reasoning = body.reasoning;
+    if (reasoning && typeof reasoning === 'object' && typeof reasoning.effort === 'string')
+        return true;
+    return false;
+}
+/**
+ * A Responses body for the codex passthrough with `reasoning.effort` filled in.
+ * Returned as is when there is no effort to add or when the client already
+ * named one (a non-empty `reasoning.effort`); otherwise a copy carries the
+ * level and keeps every other `reasoning` field, since Codex CLI sends
+ * `summary` there. The passthrough forwards the client's body as written, so
+ * this is the only place a suffix or a key default can reach that route.
+ */
+export function withResponsesEffort(body, effort) {
+    if (!effort)
+        return body;
+    const r = body.reasoning;
+    const existing = r !== null && typeof r === 'object' && !Array.isArray(r) ? r : {};
+    if (typeof existing.effort === 'string' && existing.effort.length > 0)
+        return body;
+    return { ...body, reasoning: { ...existing, effort } };
+}
 export function parseEffortSuffix(model) {
     for (const e of SUFFIX_EFFORTS) {
         for (const sep of [':', '-']) {

package/dist/keys.d.ts

@@ -3,6 +3,14 @@ export declare const KEY_PREFIX = "dk_";
 /** Same charset as a pool alias — a key name is printed next to one. */
 export declare const KEY_NAME_RE: RegExp;
 export declare const KEYS_FLUSH_DELAY_MS = 3000;
+/**
+ * The effort levels a named key may carry as its default: the wire-valid set,
+ * and nothing that means "ask the client" (`client`) or names a client mode
+ * (`ultracode`). Applied per request when the request named no effort itself.
+ */
+export type KeyEffort = 'low' | 'medium' | 'high' | 'xhigh' | 'max';
+export declare const KEY_EFFORT_VALUES: ReadonlyArray<KeyEffort>;
+export declare function isKeyEffort(v: unknown): v is KeyEffort;
 export interface KeyRecord {
     /** Stable short id (8 hex), for logs and rotation; never the secret. */
     id: string;
@@ -23,6 +31,12 @@ export interface KeyRecord {
     models?: string[];
     /** Daily caps, UTC day, enforced from the ledger (dario#1318 follow-up). Absent = unlimited. */
     budget?: KeyBudget;
+    /**
+     * Default effort for this key's requests when the request names none itself
+     * (no model-name suffix, no effort field in the body). Absent = the proxy's
+     * usual resolution. The operator's --effort pin still wins over it.
+     */
+    effort?: KeyEffort;
 }
 /**
  * A key's daily budget. Both caps are per UTC day and both are read from the
@@ -126,6 +140,8 @@ export declare function budgetVerdict(budget: KeyBudget, usage: KeyBudgetUsage,
 export declare function budgetHeaders(v: KeyBudgetVerdict, keyName: string): Record<string, string>;
 /** Replace (or clear, with null) a key's budget. Null result: no such key. */
 export declare function setKeyBudget(file: KeysFile, name: string, budget: KeyBudget | null): KeyRecord | null;
+/** Set or clear a key's default effort. Returns null when there is no such key; throws on a level outside KEY_EFFORT_VALUES. */
+export declare function setKeyEffort(file: KeysFile, name: string, effort: KeyEffort | string | null): KeyRecord | null;
 export interface KeysFile {
     version: number;
     keys: KeyRecord[];
@@ -161,6 +177,8 @@ export interface CreateKeyOptions {
     budget?: KeyBudget;
     /** Absolute expiry, epoch ms. */
     expiresAt?: number;
+    /** Default effort; one of KEY_EFFORT_VALUES, validated. */
+    effort?: string;
     now?: number;
 }
 /** Mint a key. Returns the record (stored) and the secret (shown once). Mutates `file`. */
@@ -203,6 +221,8 @@ export interface KeyPublic {
         usd_per_day: number | null;
         tokens_per_day: number | null;
     } | null;
+    /** Default effort, or null when the key has none. */
+    effort: KeyEffort | null;
 }
 export declare function publicKey(k: KeyRecord, now?: number): KeyPublic;
 /** `--expires=30d` / `12h` / `2026-12-31` → epoch ms, or null when unparseable. */

package/dist/keys.js

@@ -37,6 +37,10 @@ export const KEY_PREFIX = 'dk_';
 export const KEY_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_\-.]{0,63}$/;
 export const KEYS_FLUSH_DELAY_MS = 3_000;
 const SECRET_BYTES = 24;
+export const KEY_EFFORT_VALUES = ['low', 'medium', 'high', 'xhigh', 'max'];
+export function isKeyEffort(v) {
+    return typeof v === 'string' && KEY_EFFORT_VALUES.includes(v);
+}
 /** A conservative bytes-per-token for the reservation: prose is ~4, code and CJK are lower. */
 export const BUDGET_BYTES_PER_TOKEN = 3;
 /** Reserved output when the client sends no max_tokens / max_completion_tokens / max_output_tokens. */
@@ -166,6 +170,20 @@ export function setKeyBudget(file, name, budget) {
         delete k.budget;
     return k;
 }
+/** Set or clear a key's default effort. Returns null when there is no such key; throws on a level outside KEY_EFFORT_VALUES. */
+export function setKeyEffort(file, name, effort) {
+    const k = file.keys.find((x) => x.name === name);
+    if (!k)
+        return null;
+    if (effort === null || effort === undefined || effort === '') {
+        delete k.effort;
+        return k;
+    }
+    if (!isKeyEffort(effort))
+        throw new Error(`invalid effort "${effort}": one of ${KEY_EFFORT_VALUES.join(', ')}`);
+    k.effort = effort;
+    return k;
+}
 export function keysPathFor(home = homedir()) {
     return join(home, '.dario', 'keys.json');
 }
@@ -239,6 +257,9 @@ export function parseKeysFile(text) {
             }
             catch { /* a malformed cap is dropped, never a reason to refuse the whole file */ }
         }
+        // A default effort outside the wire-valid set is dropped, like a malformed cap.
+        if (isKeyEffort(k.effort))
+            rec.effort = k.effort;
         seen.add(rec.name);
         keys.push(rec);
     }
@@ -294,6 +315,11 @@ export function createKey(file, name, opts = {}) {
     const budget = normalizeBudget(opts.budget);
     if (budget)
         record.budget = budget;
+    if (opts.effort !== undefined && opts.effort !== '') {
+        if (!isKeyEffort(opts.effort))
+            throw new Error(`invalid effort "${opts.effort}": one of ${KEY_EFFORT_VALUES.join(', ')}`);
+        record.effort = opts.effort;
+    }
     if (opts.expiresAt !== undefined) {
         if (!Number.isFinite(opts.expiresAt) || opts.expiresAt <= (opts.now ?? Date.now()))
             throw new Error('expiry must be in the future');
@@ -371,7 +397,7 @@ export function keyAllowsModel(k, model) {
 export function publicKey(k, now = Date.now()) {
     const status = k.disabled ? 'revoked' : k.expires && Date.parse(k.expires) <= now ? 'expired' : 'active';
     const budget = k.budget ? { usd_per_day: k.budget.usdPerDay ?? null, tokens_per_day: k.budget.tokensPerDay ?? null } : null;
-    return { id: k.id, name: k.name, created: k.created, last_used: k.lastUsed ?? null, status, expires: k.expires ?? null, seat: k.seat ?? null, budget, models: k.models ?? [] };
+    return { id: k.id, name: k.name, created: k.created, last_used: k.lastUsed ?? null, status, expires: k.expires ?? null, seat: k.seat ?? null, budget, effort: k.effort ?? null, models: k.models ?? [] };
 }
 /** `--expires=30d` / `12h` / `2026-12-31` → epoch ms, or null when unparseable. */
 export function parseExpiry(value, now = Date.now()) {

package/dist/ledger.d.ts

@@ -38,6 +38,12 @@ export interface LedgerCell {
     outputTokens: number;
     cacheReadTokens: number;
     cacheCreateTokens: number;
+    /**
+     * Thinking tokens INSIDE outputTokens, a share and never an addition (the
+     * model's reasoning is billed as output). Counted from the usage block the
+     * backend returns; rows written before the field existed read as 0.
+     */
+    thinkingTokens: number;
 }
 export type LedgerRow = Partial<Record<LedgerBucket, LedgerCell>>;
 export interface LedgerFile {
@@ -67,6 +73,9 @@ export interface LedgerConsumerSummary {
     outputTokens: number;
     cacheReadTokens: number;
     cacheCreateTokens: number;
+    /** Of outputTokens, how many were thinking; and what that thinking would have cost at the model's output rate (both buckets). */
+    thinkingTokens: number;
+    thinkingCost: number;
     recent: {
         today: number;
         last7d: number;
@@ -84,6 +93,8 @@ export interface LedgerModelSummary {
     outputTokens: number;
     cacheReadTokens: number;
     cacheCreateTokens: number;
+    /** Of the covered outputTokens, how many were thinking. */
+    thinkingTokens: number;
     /** API-equivalent cost of this model's covered traffic, USD. */
     apiEquivalentCost: number;
     /** What this model's metered traffic cost at list price, USD. */
@@ -106,13 +117,16 @@ export interface LedgerSummary {
     apiEquivalentCost: number;
     /** What metered traffic (API key, paid overage) actually cost at list price, USD. */
     meteredCost: number;
-    /** Covered token totals. */
+    /** Covered token totals. `thinking` is the share of `output` that was reasoning. */
     tokens: {
         input: number;
         output: number;
         cacheRead: number;
         cacheCreate: number;
+        thinking: number;
     };
+    /** The part of apiEquivalentCost that paid for thinking: covered thinking tokens at each model's output rate, USD. */
+    thinkingCost: number;
     perProvider: Record<PricingProvider, {
         requests: number;
         apiEquivalentCost: number;
@@ -238,6 +252,8 @@ export declare function shortModelName(model: string): string;
  * to match the rest of that command's output.
  */
 export declare function formatLedgerSummary(s: LedgerSummary): string[];
+/** Thinking as a whole percent of output; 0 when there was no output. */
+export declare function thinkingPercent(thinking: number, output: number): number;
 /**
  * `dario usage --by-key`: the lifetime number per consumer, biggest first.
  * A consumer is a named key's name, an `x-dario-consumer` header, or the

package/dist/ledger.js

@@ -52,7 +52,7 @@ export function resolveLedgerPath(port, env = process.env) {
 export function ledgerDisabledByEnv(env = process.env) {
     return ['0', 'false', 'no', 'off'].includes((env['DARIO_LEDGER'] ?? '').toLowerCase());
 }
-const emptyCell = () => ({ requests: 0, inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0 });
+const emptyCell = () => ({ requests: 0, inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0, thinkingTokens: 0 });
 export function emptyLedger(now = Date.now()) {
     const iso = new Date(now).toISOString();
     return { version: LEDGER_VERSION, since: iso, updated: iso, days: {} };
@@ -90,6 +90,17 @@ function isCell(v) {
     return ['requests', 'inputTokens', 'outputTokens', 'cacheReadTokens', 'cacheCreateTokens']
         .every((k) => typeof c[k] === 'number' && Number.isFinite(c[k]) && c[k] >= 0);
 }
+/**
+ * A cell as read from disk, with the fields added after the file was written
+ * filled in: `thinkingTokens` is 0 on rows older than the field (and never
+ * above the output count it is a share of).
+ */
+function cleanCell(c) {
+    const raw = c.thinkingTokens;
+    const thinking = typeof raw === 'number' && Number.isFinite(raw) && raw >= 0 ? Math.min(raw, c.outputTokens) : 0;
+    return { requests: c.requests, inputTokens: c.inputTokens, outputTokens: c.outputTokens,
+        cacheReadTokens: c.cacheReadTokens, cacheCreateTokens: c.cacheCreateTokens, thinkingTokens: thinking };
+}
 /**
  * Parse a ledger file's text, keeping only well-formed rows. A file that is
  * not a ledger at all throws; the caller moves it aside and starts fresh.
@@ -109,9 +120,9 @@ export function parseLedger(text) {
                 continue;
             const r = {};
             if (isCell(row.covered))
-                r.covered = { ...row.covered };
+                r.covered = cleanCell(row.covered);
             if (isCell(row.metered))
-                r.metered = { ...row.metered };
+                r.metered = cleanCell(row.metered);
             if (r.covered || r.metered)
                 clean[model] = r;
         }
@@ -136,9 +147,9 @@ export function parseLedger(text) {
                         continue;
                     const r = {};
                     if (isCell(row.covered))
-                        r.covered = { ...row.covered };
+                        r.covered = cleanCell(row.covered);
                     if (isCell(row.metered))
-                        r.metered = { ...row.metered };
+                        r.metered = cleanCell(row.metered);
                     if (r.covered || r.metered)
                         clean[model] = r;
                 }
@@ -160,6 +171,8 @@ function addCell(row, bucket, record) {
     cell.outputTokens += record.outputTokens;
     cell.cacheReadTokens += record.cacheReadTokens;
     cell.cacheCreateTokens += record.cacheCreateTokens;
+    const thinking = Number.isFinite(record.thinkingTokens) && record.thinkingTokens > 0 ? record.thinkingTokens : 0;
+    cell.thinkingTokens = (cell.thinkingTokens ?? 0) + Math.min(thinking, record.outputTokens);
 }
 /** Add one record's tokens to the file in place. Returns false when it was not counted. */
 export function addToLedger(file, record) {
@@ -203,13 +216,14 @@ export function summarizeLedgerConsumers(file, now = Date.now()) {
     for (const [day, byConsumer] of Object.entries(file.consumers ?? {})) {
         const at = dayMs(day);
         for (const [consumer, models] of Object.entries(byConsumer)) {
-            const c = (out[consumer] ??= { requests: 0, apiEquivalentCost: 0, meteredCost: 0, inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0, recent: { today: 0, last7d: 0, last30d: 0 }, lastDay: day, models: [], _models: {} });
+            const c = (out[consumer] ??= { requests: 0, apiEquivalentCost: 0, meteredCost: 0, inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0, thinkingTokens: 0, thinkingCost: 0, recent: { today: 0, last7d: 0, last30d: 0 }, lastDay: day, models: [], _models: {} });
             if (day > c.lastDay)
                 c.lastDay = day;
             for (const [model, row] of Object.entries(models)) {
                 if (row.covered) {
                     const cost = costOfTokens(model, at, row.covered);
                     c.apiEquivalentCost += cost;
+                    c.thinkingCost += costOfTokens(model, at, thinkingOnly(row.covered));
                     c.requests += row.covered.requests;
                     addTokens(c, row.covered);
                     c._models[model] = (c._models[model] ?? 0) + row.covered.requests;
@@ -222,6 +236,7 @@ export function summarizeLedgerConsumers(file, now = Date.now()) {
                 }
                 if (row.metered) {
                     c.meteredCost += costOfTokens(model, at, row.metered);
+                    c.thinkingCost += costOfTokens(model, at, thinkingOnly(row.metered));
                     c.requests += row.metered.requests;
                     addTokens(c, row.metered);
                     c._models[model] = (c._models[model] ?? 0) + row.metered.requests;
@@ -239,6 +254,8 @@ export function summarizeLedgerConsumers(file, now = Date.now()) {
             outputTokens: c.outputTokens,
             cacheReadTokens: c.cacheReadTokens,
             cacheCreateTokens: c.cacheCreateTokens,
+            thinkingTokens: c.thinkingTokens,
+            thinkingCost: round(c.thinkingCost),
             recent: { today: round(c.recent.today), last7d: round(c.recent.last7d), last30d: round(c.recent.last30d) },
             lastDay: c.lastDay,
             models: Object.entries(c._models).sort((a, b) => b[1] - a[1]).map(([m]) => m),
@@ -276,6 +293,11 @@ function addTokens(into, cell) {
     into.outputTokens += cell.outputTokens;
     into.cacheReadTokens += cell.cacheReadTokens;
     into.cacheCreateTokens += cell.cacheCreateTokens;
+    into.thinkingTokens += cell.thinkingTokens ?? 0;
+}
+/** The cell's thinking alone, shaped for the price list: output tokens and nothing else. */
+function thinkingOnly(cell) {
+    return { inputTokens: 0, outputTokens: cell.thinkingTokens ?? 0, cacheReadTokens: 0, cacheCreateTokens: 0 };
 }
 // Round BEFORE choosing the unit. Picking the unit on the raw value and
 // rounding afterwards let 999_600 print as "1000k": once the rounded
@@ -305,32 +327,36 @@ export function summarizeLedger(file, path, now = Date.now()) {
         anthropic: { requests: 0, apiEquivalentCost: 0 },
         openai: { requests: 0, apiEquivalentCost: 0 },
     };
-    const tokens = { input: 0, output: 0, cacheRead: 0, cacheCreate: 0 };
+    const tokens = { input: 0, output: 0, cacheRead: 0, cacheCreate: 0, thinking: 0 };
     let requests = 0;
     let covered = 0;
     let metered = 0;
+    let thinkingCost = 0;
     const recent = { today: 0, last7d: 0, last30d: 0 };
     for (const [day, models] of Object.entries(file.days)) {
         const at = dayMs(day);
         for (const [model, row] of Object.entries(models)) {
             const m = (perModel[model] ??= {
                 provider: providerOfModel(model), requests: 0,
-                inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0,
+                inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0, thinkingTokens: 0,
                 apiEquivalentCost: 0, meteredCost: 0,
             });
             if (row.covered) {
                 const cost = costOfTokens(model, at, row.covered);
                 covered += cost;
+                thinkingCost += costOfTokens(model, at, thinkingOnly(row.covered));
                 m.apiEquivalentCost += cost;
                 m.requests += row.covered.requests;
                 m.inputTokens += row.covered.inputTokens;
                 m.outputTokens += row.covered.outputTokens;
                 m.cacheReadTokens += row.covered.cacheReadTokens;
                 m.cacheCreateTokens += row.covered.cacheCreateTokens;
+                m.thinkingTokens += row.covered.thinkingTokens ?? 0;
                 tokens.input += row.covered.inputTokens;
                 tokens.output += row.covered.outputTokens;
                 tokens.cacheRead += row.covered.cacheReadTokens;
                 tokens.cacheCreate += row.covered.cacheCreateTokens;
+                tokens.thinking += row.covered.thinkingTokens ?? 0;
                 perProvider[m.provider].requests += row.covered.requests;
                 perProvider[m.provider].apiEquivalentCost += cost;
                 requests += row.covered.requests;
@@ -364,6 +390,7 @@ export function summarizeLedger(file, path, now = Date.now()) {
         apiEquivalentCost: round(covered),
         meteredCost: round(metered),
         tokens,
+        thinkingCost: round(thinkingCost),
         perProvider,
         perModel,
         recent: { today: round(recent.today), last7d: round(recent.last7d), last30d: round(recent.last30d) },
@@ -559,8 +586,14 @@ export function formatLedgerSummary(s) {
     lines.push(`    Today ${formatUsd(s.recent.today)} · Last 7d ${formatUsd(s.recent.last7d)} · Last 30d ${formatUsd(s.recent.last30d)}`);
     if (s.meteredCost > 0)
         lines.push(`    Paid per token on top (API key / extra usage): ${formatUsd(s.meteredCost)}`);
+    if (s.tokens.thinking > 0)
+        lines.push(`    Thinking: ${formatTokenCount(s.tokens.thinking)} of ${formatTokenCount(s.tokens.output)} output tokens (${thinkingPercent(s.tokens.thinking, s.tokens.output)}%) · ${formatUsd(s.thinkingCost)} of the number above`);
     return lines;
 }
+/** Thinking as a whole percent of output; 0 when there was no output. */
+export function thinkingPercent(thinking, output) {
+    return output > 0 ? Math.round((100 * thinking) / output) : 0;
+}
 /**
  * `dario usage --by-key`: the lifetime number per consumer, biggest first.
  * A consumer is a named key's name, an `x-dario-consumer` header, or the
@@ -576,7 +609,8 @@ export function formatLedgerConsumers(s, limit = 20) {
     for (const [consumer, c] of entries.slice(0, limit)) {
         const models = c.models.slice(0, 2).map(shortModelName).join(', ');
         lines.push(`    ${consumer.slice(0, width).padEnd(width)} ${formatUsd(c.apiEquivalentCost).padStart(9)} · ${formatUsd(c.recent.today).padStart(8)} · ${formatUsd(c.recent.last7d).padStart(8)} · ${formatUsd(c.recent.last30d).padStart(8)}   ${c.requests.toLocaleString('en-US')} req${c.requests === 1 ? '' : 's'}${models ? `, ${models}` : ''}${c.meteredCost > 0 ? `, ${formatUsd(c.meteredCost)} metered` : ''}`);
-        lines.push(`    ${' '.repeat(width)} in ${formatTokenCount(c.inputTokens)} · out ${formatTokenCount(c.outputTokens)} · cache read ${formatTokenCount(c.cacheReadTokens)} · cache write ${formatTokenCount(c.cacheCreateTokens)}`);
+        const thinking = c.thinkingTokens > 0 ? ` · thinking ${formatTokenCount(c.thinkingTokens)} (${thinkingPercent(c.thinkingTokens, c.outputTokens)}% of out, ${formatUsd(c.thinkingCost)})` : '';
+        lines.push(`    ${' '.repeat(width)} in ${formatTokenCount(c.inputTokens)} · out ${formatTokenCount(c.outputTokens)} · cache read ${formatTokenCount(c.cacheReadTokens)} · cache write ${formatTokenCount(c.cacheCreateTokens)}${thinking}`);
     }
     if (entries.length > limit)
         lines.push(`    … and ${entries.length - limit} more`);

package/dist/live-fingerprint.js

@@ -451,7 +451,7 @@ export function loadTemplate(_options) {
         // Stale cache: prefer whichever of the live cache and the bundled
         // snapshot was captured more recently — do NOT blindly keep the cache.
         // A frozen live cache must not shadow a newer bundled template, which is
-        // exactly what happens in a no-CC deployment (e.g. the Hetzner container):
+        // exactly what happens in a no-CC deployment (e.g. a container deploy):
         // the async refresh can never run there, so the cache stays pinned at its
         // last capture while shipped releases move the bundle ahead. Without this
         // comparison, every bundled-template update is silently ignored until the
@@ -1069,7 +1069,7 @@ const STATIC_HEADER_EXCLUDE = new Set([
     // Found 2026-07-25: the bundled template had been baked on Windows for
     // several releases (#820/#828/#840/#849/#851 -> x-stainless-os: Windows,
     // 30 tools incl. PowerShell), while cc-drift-template-watch runs its live
-    // capture every 30 min on the Linux Hetzner runner. So the Linux box served
+    // capture every 30 min on a Linux self-hosted runner. So the Linux box served
     // `x-stainless-os: Windows`, and the watch saw permanent drift against a
     // bundle it could never match -- auto-rebaking to Linux (#852), which the next
     // Windows-side bake (#854) would flip straight back. Excluding these ends

package/dist/proxy.js

@@ -21,7 +21,7 @@ import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCo
 import { backfillIdentity } from './accounts.js';
 import { PoolSync, DEFAULT_POOL_SYNC_INTERVAL_MS } from './pool-sync.js';
 import { AccountSync, DEFAULT_ACCOUNT_SYNC_INTERVAL_MS } from './account-sync.js';
-import { Analytics, billingBucketFromClaim, costOfTokensFailClosed, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, CODEX_CLAIM, CREDITS_CLAIM } from './analytics.js';
+import { Analytics, billingBucketFromClaim, costOfTokensFailClosed, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, thinkingTokensFromUsage, CODEX_CLAIM, CREDITS_CLAIM } from './analytics.js';
 import { Ledger, resolveLedgerPath, ledgerDisabledByEnv } from './ledger.js';
 import { renderPrometheus } from './metrics.js';
 import { renderSpendDonuts, renderAnalyticsView, analyticsUiPage } from './donuts.js';
@@ -36,7 +36,8 @@ import { createTokenBucket } from './rate-limit.js';
 import { getOpenAIBackend, isOpenAIModel, forwardToOpenAI, isMiniMaxBackend, MINIMAX_MODELS } from './openai-backend.js';
 import { forwardToCodex, forwardResponsesToCodex, getCodexModelSlugs, peekCodexModelSlugs, isCodexModel, pickCodexFallback, pickClaudeTarget, CODEX_BACKEND_BASE_URL } from './codex-backend.js';
 import { formatCacheTraceLine } from './cache-trace.js';
-import { effortForCodex } from './effort.js';
+import { effortForCodex, requestNamesEffort, withResponsesEffort } from './effort.js';
+import { thinkingToReasoningEffort } from './anthropic-responses-translate.js';
 import { MidstreamGuard, guardFor, loopbackBaseFor, chaosCutFetch, chaosCutState, CONTINUATION_HEADER, CONTINUATION_OF_HEADER, MAX_CONTINUATION_DEPTH, continuationDepth, continuationOfRequest } from './midstream.js';
 /**
  * The continuation fields for a request's analytics row, from its guard.
@@ -2609,7 +2610,10 @@ export async function startProxy(opts = {}) {
             inputTokens: o.inputTokens, outputTokens: o.outputTokens,
             // Anthropic convention, like every other row: inputTokens is
             // net of the cached prefix, which sits in cacheReadTokens.
-            cacheReadTokens: o.cacheReadTokens, cacheCreateTokens: o.cacheCreateTokens, thinkingTokens: 0,
+            cacheReadTokens: o.cacheReadTokens, cacheCreateTokens: o.cacheCreateTokens,
+            // The backend's reasoning tokens, counted inside outputTokens exactly as
+            // Claude's thinking is, so the ledger's thinking share covers both.
+            thinkingTokens: o.reasoningTokens,
             // No Anthropic rate-limit headers on this path; the claim
             // names the engine and is subscription billing, so the
             // overage guard (#288) leaves it alone.
@@ -2646,7 +2650,7 @@ export async function startProxy(opts = {}) {
      * account, an unreadable one, or a `poolFallbackModel` that account does not
      * list all mean "not mine to serve".
      *
-     * Works for BOTH wire shapes, which is the point: forge's agents and Claude
+     * Works for BOTH wire shapes, which is the point: SDK-engine agents and Claude
      * Code speak Anthropic, and before v5.5.87 they had nowhere to fail over to
      * and simply went dark when the Claude pool filled. The substituted model is
      * announced on `x-dario-pool-fallback` exactly as the api-key path does —
@@ -2788,7 +2792,7 @@ export async function startProxy(opts = {}) {
      * versions of this logic, and v6.0.0 wired the fallback into only ONE of
      * them. The other kept returning the raw upstream 429 — and that unwired
      * site is the one reached by every non-passthrough request, i.e. everything
-     * except a literal Claude Code CLI session, forge's SDK Engine included.
+     * except a literal Claude Code CLI session, SDK-engine clients included.
      * That is what left the whole fleet unable to fail over during the live
      * outage on 2026-08-30 while `dario doctor` reported failover armed.
      *
@@ -4351,6 +4355,26 @@ export async function startProxy(opts = {}) {
             // Nothing below is allowed to depend on it: the tee only observes bytes
             // already on their way out, the comparison is never awaited by the
             // request, and every failure path resolves rather than throws.
+            // A named key's default effort (`dario keys create --effort=low`) fills in
+            // when nobody named one: no suffix on the model, no effort field in the
+            // body. --effort / DARIO_EFFORT keeps winning over it, as it does over the
+            // client, and a client that set its own effort is never overruled by a
+            // default. Why this knob is per key: a reasoning model at its default
+            // effort can spend most of its output thinking on work that did not need
+            // it, and the lane that needs the cap is one consumer, not the proxy.
+            // A Responses client names its effort in `reasoning.effort`, which the
+            // translation above turns into a model suffix, so the raw body is read too.
+            const keyDefaultEffort = requestAuth.key?.effort && !requestNamesEffort(parsedBody) && !requestNamesEffort(responsesBodyRaw)
+                ? requestAuth.key.effort : undefined;
+            // The pin outranks a key default only when it names a level. `client`
+            // means "leave the client's choice alone", and a key default exists only
+            // when the client chose nothing, so under `client` the default applies.
+            const pinnedEffort = opts.effort === 'client' && keyDefaultEffort ? undefined : opts.effort;
+            // On the Codex translated route a client's thinking budget IS its effort
+            // choice (it becomes `reasoning.effort` there), so a key default must not
+            // replace it. The proxy pin has never reached the Codex backend.
+            const codexKeyEffort = keyDefaultEffort && thinkingToReasoningEffort(parsedBody?.thinking) === undefined
+                ? keyDefaultEffort : undefined;
             const compareTarget = readCompareTarget(req.headers);
             if (compareTarget) {
                 const compareShape = isOpenAI ? 'openai' : 'anthropic';
@@ -4670,14 +4694,18 @@ export async function startProxy(opts = {}) {
                                 // outage this change exists to remove, surviving on the one shape Codex
                                 // CLI actually speaks (caught in review of #1288).
                                 if (isResponses && responsesBodyRaw) {
-                                    served = await forwardResponsesToCodex(rawRes, { ...responsesBodyRaw, model: rawModel }, codexSeat, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, codexFetch, codexOnDone, codexOnDecline, canDefer || codexPeer !== null, { queueMs, arrivedAt });
+                                    served = await forwardResponsesToCodex(
+                                    // The body as written, plus `reasoning.effort` from the model-name
+                                    // suffix or the named key's default when the client set none.
+                                    rawRes, withResponsesEffort({ ...responsesBodyRaw, model: rawModel }, effortForCodex(requestEffort ?? keyDefaultEffort)), codexSeat, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, codexFetch, codexOnDone, codexOnDecline, canDefer || codexPeer !== null, { queueMs, arrivedAt });
                                 }
                                 else {
                                     served = await forwardToCodex(req, res, body, codexSeat, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, isOpenAI ? 'openai' : 'anthropic', codexFetch, canDefer || codexPeer !== null, codexOnDone, codexOnDecline, 
                                     // dario#1260 — the effort named by the model-name suffix stripped
-                                    // above. Undefined for every request that did not name one, which
-                                    // leaves the outbound body exactly as it was.
-                                    effortForCodex(requestEffort), codexGuard, { queueMs, arrivedAt });
+                                    // above, else the named key's default unless the client's thinking
+                                    // budget already picks one. Undefined for every request that has
+                                    // neither, which leaves the outbound body exactly as it was.
+                                    effortForCodex(requestEffort ?? codexKeyEffort), codexGuard, { queueMs, arrivedAt });
                                 }
                                 if (served || !codexPeer)
                                     break;
@@ -4978,7 +5006,7 @@ export async function startProxy(opts = {}) {
                     sanitizeMessages(client, opts.preserveOrchestrationTags);
                     const r = (isOpenAI ? openaiToAnthropic(client, target.model) : { ...client, model: target.model });
                     r.model = stripContext1mTag(typeof r.model === 'string' ? r.model : target.model);
-                    const effort = requestEffort ?? opts.effort;
+                    const effort = requestEffort ?? pinnedEffort ?? keyDefaultEffort;
                     if (effort) {
                         const oc = (r.output_config && typeof r.output_config === 'object' && !Array.isArray(r.output_config))
                             ? { ...r.output_config }
@@ -5128,7 +5156,7 @@ export async function startProxy(opts = {}) {
                                 hybridTools: opts.hybridTools ?? false,
                                 mergeTools: opts.mergeTools ?? false,
                                 noAutoDetect: opts.noAutoDetect ?? false,
-                                effort: requestEffort ?? opts.effort,
+                                effort: requestEffort ?? pinnedEffort ?? keyDefaultEffort,
                                 maxTokens: opts.maxTokens,
                                 systemPrompt: opts.systemPrompt,
                                 skipFields,
@@ -6210,6 +6238,9 @@ export async function startProxy(opts = {}) {
                 let streamCacheReadTokens = 0;
                 let streamCacheCreateTokens = 0;
                 let streamThinkingChars = 0;
+                // The billed count from message_delta's usage.output_tokens_details,
+                // when upstream sends it; the chars/4 estimate above is the fallback.
+                let streamThinkingTokens;
                 const analyticsDecoder = analytics ? new TextDecoder() : null;
                 let analyticsBuffer = '';
                 // Stream SSE chunks through
@@ -6317,6 +6348,9 @@ export async function startProxy(opts = {}) {
                                         const u = e.usage;
                                         if (u?.output_tokens)
                                             streamOutputTokens = u.output_tokens;
+                                        const billedThinking = thinkingTokensFromUsage(u);
+                                        if (billedThinking !== undefined)
+                                            streamThinkingTokens = billedThinking;
                                     }
                                     else if (e.type === 'content_block_delta') {
                                         // Mirror the non-streaming parseUsage thinking-token
@@ -6422,7 +6456,7 @@ export async function startProxy(opts = {}) {
                         model: requestModel,
                         inputTokens: streamInputTokens, outputTokens: streamOutputTokens,
                         cacheReadTokens: streamCacheReadTokens, cacheCreateTokens: streamCacheCreateTokens,
-                        thinkingTokens: Math.round(streamThinkingChars / 4),
+                        thinkingTokens: streamThinkingTokens ?? Math.round(streamThinkingChars / 4),
                         claim: claimNow(rl), util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
                         latencyMs: Date.now() - startTime, status: upstream.status, isStream: true, isOpenAI, timing: timingNow(),
                         continuation: continuationOf(guard, requestDepth),

package/docs/admin-api.md

@@ -94,8 +94,9 @@ All endpoints accept the token as `authorization: Bearer <token>` or
 | `GET /admin/accounts` | — | `{ accounts: [...], count }` |
 | `DELETE /admin/accounts/<alias>` | — | `{ alias, removed }` (`404` if no such alias) |
 | `GET /admin/keys` | — | `{ keys: [...], count, path }` — every named key, hashes excluded (v6.8) |
-| `POST /admin/keys` | `{ "name": string, "seat"?: string, "models"?: string[] \| "a,b", "expires"?: "30d" \| ISO }` | `201 { key, secret }` — the secret once; `409` if the name exists |
+| `POST /admin/keys` | `{ "name": string, "seat"?: string, "models"?: string[] \| "a,b", "expires"?: "30d" \| ISO, "effort"?: "low" \| "medium" \| "high" \| "xhigh" \| "max" }` | `201 { key, secret }`, the secret shown once; `409` if the name exists |
 | `POST /admin/keys/<name>/rotate` | — | `{ key, secret }` — a new secret, the old one dead at once (`404` if unknown) |
+| `POST /admin/keys/<name>/effort` | `{ "effort": "low" \| "medium" \| "high" \| "xhigh" \| "max" \| null }` | `{ key }` (`404` if unknown); null or absent clears the default |
 | `DELETE /admin/keys/<name>` | — | `{ name, revoked }` — refused from now on, kept in the list (`404` if unknown) |
 
 The three `/admin/keys` mutations edit the same `~/.dario/keys.json` that

package/docs/configuration.md

@@ -93,9 +93,10 @@ Off by default, each one a deliberate divergence from what real CC sends.
 
 ### Per-request effort, by model name
 
-`DARIO_EFFORT` is process-wide: it applies to every caller, Claude and Codex
-alike. A client that has no way to set `output_config.effort` can instead name
-the level in the model itself, and only that request changes:
+`DARIO_EFFORT` is process-wide: it applies to every caller on the Claude path
+(it does not reach the Codex backend; a suffix or a key default does). A
+client that has no way to set `output_config.effort` can instead name the
+level in the model itself, and only that request changes:
 
 ```
 claude-opus-4-8:high      colon form
@@ -118,6 +119,12 @@ lists, so a real model id that happens to end in an effort word is routed
 exactly as written and never re-read. A `--pool-fallback` chain entry may carry
 one too, which sets the effort the failover request runs at.
 
+A named key can carry a default as well (`dario keys create <name> --effort=low`,
+`dario keys effort <name> low`). It applies when the request names no effort of
+its own: below the suffix, the operator pin and the client's own field, above
+the `high` fallback. On the Codex path it is added to the Responses body Codex
+CLI sends as well. See [keys.md](keys.md#default-effort).
+
 Effort is not free. Measured through dario on one prompt with only the level
 changing: `low` returned 1,982 output tokens in 18s, `high` 3,947 in 35s, and
 `max` 11,160 in 100s. Reasoning is billed as output, so `max` is a real cost

package/docs/drift-monitor.md

@@ -219,7 +219,7 @@ sudo npm i -g @anthropic-ai/claude-code @askalf/dario
 #    URL back into the SSH session.
 #
 #    SHARE the credential with any other CC clients that auto-refresh
-#    (e.g. a platform dario container running 24/7). Just run the standard
+#    (e.g. a dario container running 24/7). Just run the standard
 #    `dario login --manual` against /root/.claude/.credentials.json and let
 #    that long-running refresh authority keep the token fresh. The workflows
 #    read whatever's current at fire time and never attempt a refresh from
@@ -235,7 +235,7 @@ sudo npm i -g @anthropic-ai/claude-code @askalf/dario
 #
 #    Sharing with a 24/7 refresh authority (typical setup: the docker-stack
 #    dario container) fixes that. The race the isolation was protecting
-#    against is rare in practice — platform dario refreshes proactively
+#    against is rare in practice: a long-running dario refreshes proactively
 #    when the access token has ~1h life remaining, so workflow runs hit a
 #    fresh token and don't need to refresh themselves.
 dario login --manual
@@ -332,13 +332,13 @@ Workflows that exercise live `dario proxy` paths (compat-test, billing canary, f
 | `cc-billing-classifier-canary.yml` | daily 06:30 UTC | daily | 1 small haiku request |
 | `compat-test-self-hosted.yml` | per qualifying PR | per qualifying PR | ~11 small requests |
 
-**Cron scheduler reality.** GitHub Actions' free-tier cron scheduler is best-effort, not guaranteed. The class-B watcher declares `*/30 * * * *` but in practice GitHub honors it every 2-4 hours on this repo. The liveness alarm (added v4.4.2) has its threshold set to 8h (raised from 3h in v4.7.1) to absorb this skew — anything past that is signal, not scheduler noise. If you need a tighter SLA (sub-hour), self-host the runner *and* the cron driver (e.g. a cron entry on the same Hetzner box invoking `gh workflow run` directly).
+**Cron scheduler reality.** GitHub Actions' free-tier cron scheduler is best-effort, not guaranteed. The class-B watcher declares `*/30 * * * *` but in practice GitHub honors it every 2-4 hours on this repo. The liveness alarm (added v4.4.2) has its threshold set to 8h (raised from 3h in v4.7.1) to absorb this skew; anything past that is signal, not scheduler noise. If you need a tighter SLA (sub-hour), self-host the runner *and* the cron driver (e.g. a cron entry on the same host invoking `gh workflow run` directly).
 
 At steady state, this is comfortably inside Pro/Max headroom. The failure mode to watch for is **batched firing** — manually re-triggering the same workflow several times in a single hour, or PRs landing in rapid succession that each fire compat-test. We tripped this during the v4.6.x rollout: a half-dozen manual re-runs in a 2-hour window 429'd the runner credential. Pro/Max accounts have per-hour rate caps as well as per-5h / per-7d pools, and the per-hour cap is what surfaces first.
 
 If the runner credential is rate-limited and a workflow run reports 429s across the board, the right diagnosis order is: (a) check `claude --print` directly — if it 429s, the credential pool is dry, just wait an hour; (b) check the credential is still on a subscription account (`dario doctor`); (c) check workflow cadence assumptions haven't changed.
 
-The runner shares its OAuth credential with any other long-running CC client on the box (typically the platform dario container, which auto-refreshes 24/7). Sharing is intentional: a workflow that fires sparsely cannot keep its own refresh token alive — Anthropic invalidates idle refresh tokens, and `invalid_grant` then breaks every subsequent run. Letting a 24/7 refresh authority own the token rotation eliminates that failure mode at the cost of competing for the same Pro/Max headroom. With current cadence (drift-template-watch every 30 min + compat per PR + canary daily), runner-side burn on the shared account is a manageable fraction of the headroom available on a Max plan; reducing cadence further is a knob if a particular workload needs more of it.
+The runner shares its OAuth credential with any other long-running CC client on the box (typically a long-running dario container, which auto-refreshes 24/7). Sharing is intentional: a workflow that fires sparsely cannot keep its own refresh token alive: Anthropic invalidates idle refresh tokens, and `invalid_grant` then breaks every subsequent run. Letting a 24/7 refresh authority own the token rotation eliminates that failure mode at the cost of competing for the same Pro/Max headroom. With current cadence (drift-template-watch every 30 min + compat per PR + canary daily), runner-side burn on the shared account is a manageable fraction of the headroom available on a Max plan; reducing cadence further is a knob if a particular workload needs more of it.
 
 ## Why a self-hosted runner