@askalf/dario 6.5.0 → 6.6.1

package/dist/proxy.js

@@ -16,6 +16,7 @@ import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCo
 import { backfillIdentity } from './accounts.js';
 import { PoolSync, DEFAULT_POOL_SYNC_INTERVAL_MS } from './pool-sync.js';
 import { Analytics, billingBucketFromClaim, formatUsageLogLine, SUBSCRIPTION_CLAIMS, consumerFromHeader, consumerFromBody, CONSUMER_HEADER, CODEX_CLAIM } from './analytics.js';
+import { Ledger, resolveLedgerPath, ledgerDisabledByEnv } from './ledger.js';
 import { OverageGuard, buildHaltErrorBody } from './overage-guard.js';
 import { notify as osNotify } from './notify.js';
 import { grantAge, grantThresholds, worstGrantLevel, describeGrantAge } from './refresh-grant.js';
@@ -26,7 +27,19 @@ import { createTokenBucket } from './rate-limit.js';
 import { getOpenAIBackend, isOpenAIModel, forwardToOpenAI } from './openai-backend.js';
 import { forwardToCodex, forwardResponsesToCodex, getCodexModelSlugs, peekCodexModelSlugs, isCodexModel, pickCodexFallback, pickClaudeTarget, CODEX_BACKEND_BASE_URL } from './codex-backend.js';
 import { effortForCodex } from './effort.js';
-import { MidstreamGuard, guardFor, loopbackBaseFor, chaosCutFetch, chaosCutState, CONTINUATION_HEADER, MAX_CONTINUATION_DEPTH, continuationDepth } from './midstream.js';
+import { MidstreamGuard, guardFor, loopbackBaseFor, chaosCutFetch, chaosCutState, CONTINUATION_HEADER, CONTINUATION_OF_HEADER, MAX_CONTINUATION_DEPTH, continuationDepth, continuationOfRequest } from './midstream.js';
+/**
+ * The continuation fields for a request's analytics row, from its guard.
+ * Only the client's own request (depth 0) carries them: a resume leg is a
+ * loopback request with a guard of its own, and counting its attempt too
+ * would show one dying client stream as two. The log line still carries
+ * every leg's outcome — that is where the hop-by-hop story is read.
+ */
+function continuationOf(guard, depth) {
+    if (!guard || !guard.outcome || depth > 0)
+        return undefined;
+    return { outcome: guard.outcome, ...(guard.continuedBy ? { by: guard.continuedBy } : {}), partialChars: guard.partialChars };
+}
 import { responsesRequestToAnthropic, unsupportedOnClaudeError, ResponsesRequestError, ResponsesOut, wrapResponsesClient } from './responses-inbound.js';
 import { isClaudeServableModel } from './claude-model.js';
 import { MODEL_UNROUTABLE } from './upstream-rejection.js';
@@ -1445,6 +1458,19 @@ export async function startProxy(opts = {}) {
     // : null` — that gated the /analytics endpoint, but burn-rate /
     // per-request visibility is useful for a pool of one too.
     const analytics = new Analytics();
+    // The lifetime ledger rides the same record stream analytics emits, so
+    // every site that records a request feeds it without a second call. Off,
+    // /analytics reports `lifetime: null`.
+    const ledgerOn = opts.ledger !== false && !ledgerDisabledByEnv();
+    const ledger = ledgerOn ? await Ledger.open(resolveLedgerPath(port), (line) => console.log(line)) : null;
+    if (ledger) {
+        analytics.on('record', (r) => { ledger.add(r); });
+        if (verbose)
+            console.log(`[dario] ledger: ${ledger.path}`);
+    }
+    else {
+        console.log('[dario] ledger: disabled (--no-ledger)');
+    }
     // Per-alias request counts for GET /codex — the pool has requestCount per
     // account; the codex accounts had nothing until now.
     const codexRequestCounts = new Map();
@@ -2569,7 +2595,19 @@ export async function startProxy(opts = {}) {
             // `queue` rides along the summary (dario#905): request-queue.ts always
             // documented snapshot() as "exposed for /analytics", but it was never
             // actually wired in, so slot exhaustion was invisible from outside.
-            res.end(JSON.stringify({ ...analytics.summary(), queue: queue.snapshot() }));
+            res.end(JSON.stringify({ ...analytics.summary(), queue: queue.snapshot(), lifetime: ledger ? ledger.summary() : null }));
+            return;
+        }
+        // The ledger's per-day table, for anyone charting it. `lifetime` on
+        // /analytics is the summary; this is the data behind it.
+        if (urlPath === '/analytics/ledger' && req.method === 'GET') {
+            if (!ledger) {
+                res.writeHead(404, JSON_HEADERS);
+                res.end(JSON.stringify({ error: 'ledger disabled', hint: 'start without --no-ledger / DARIO_LEDGER=0' }));
+                return;
+            }
+            res.writeHead(200, JSON_HEADERS);
+            res.end(JSON.stringify({ path: ledger.path, ...ledger.snapshot() }));
             return;
         }
         // Analytics live stream — SSE of new RequestRecord JSON, one event
@@ -3103,6 +3141,12 @@ export async function startProxy(opts = {}) {
             // never continued itself (MAX_CONTINUATION_DEPTH).
             const requestDepth = continuationDepth(req.headers[CONTINUATION_HEADER]);
             const isContinuation = requestDepth >= MAX_CONTINUATION_DEPTH;
+            // A resume leg's log row points back at the request whose stream died
+            // (its guard's number) and says how deep it sits, so the hop-by-hop
+            // story is readable from the log alone. Empty on a client request.
+            const continuationLeg = requestDepth > 0
+                ? { continuation_depth: requestDepth, continuation_of: continuationOfRequest(req.headers[CONTINUATION_OF_HEADER]) }
+                : {};
             /**
              * First hop: the SAME model again, through the front door. The pool
              * picks a seat (sticky binding keeps the prompt cache warm), and if the
@@ -3624,6 +3668,7 @@ export async function startProxy(opts = {}) {
                                 // overage guard (#288) leaves it alone.
                                 claim: CODEX_CLAIM, util5h: 0, util7d: 0, overageUtil: 0,
                                 latencyMs: o.latencyMs, status: o.status, isStream: o.stream, isOpenAI,
+                                continuation: continuationOf(codexGuard, requestDepth),
                             });
                             writeLogLine(logFileStream, {
                                 ts: new Date().toISOString(), req: codexReq,
@@ -3631,6 +3676,8 @@ export async function startProxy(opts = {}) {
                                 status: o.status, latency_ms: o.latencyMs, in_tokens: o.inputTokens, out_tokens: o.outputTokens,
                                 cache_read: o.cacheReadTokens, cache_create: o.cacheCreateTokens,
                                 claim: CODEX_CLAIM, bucket: 'subscription', account: o.alias, consumer, stream: o.stream,
+                                ...(codexGuard?.outcome ? { continued: codexGuard.outcome, continued_by: codexGuard.continuedBy ?? undefined, continued_after: codexGuard.partialChars } : {}),
+                                ...continuationLeg,
                             });
                             if (verbose)
                                 console.log(formatUsageLogLine(codexReq, {
@@ -5156,6 +5203,7 @@ export async function startProxy(opts = {}) {
                         thinkingTokens: Math.round(streamThinkingChars / 4),
                         claim: rl.claim, util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
                         latencyMs: Date.now() - startTime, status: upstream.status, isStream: true, isOpenAI,
+                        continuation: continuationOf(guard, requestDepth),
                     });
                 }
                 writeLogLine(logFileStream, {
@@ -5172,6 +5220,8 @@ export async function startProxy(opts = {}) {
                     client: detectedClientForLog,
                     preserve_tools: preserveToolsEffective,
                     stream: true,
+                    ...(guard?.outcome ? { continued: guard.outcome, continued_by: guard.continuedBy ?? undefined, continued_after: guard.partialChars } : {}),
+                    ...continuationLeg,
                 });
                 if (verbose)
                     console.log(formatUsageLogLine(requestCount, {
@@ -5532,7 +5582,7 @@ export async function startProxy(opts = {}) {
         // Flush tokens first (best-effort, bounded), then close the server. The
         // flush is fire-and-forget under the same 5s force-exit guard below so a
         // hung fsync can't wedge shutdown.
-        void flushPoolTokens().finally(() => {
+        void Promise.all([flushPoolTokens(), ledger?.close()]).finally(() => {
             server.close(() => process.exit(0));
         });
         // Force exit after 5s if connections (or the flush) don't complete.

package/dist/tui/tabs/analytics.d.ts

@@ -43,6 +43,14 @@ interface SummaryShape {
         currentUtil7d: number;
         lastClaim: string;
     }>;
+    /** The ledger's lifetime view (v6.6); null when the proxy runs --no-ledger, absent on older proxies. */
+    lifetime?: {
+        apiEquivalentCost: number;
+        since: string;
+        recent: {
+            today: number;
+        };
+    } | null;
 }
 export interface AnalyticsState {
     summary: SummaryShape | null;

package/dist/tui/tabs/analytics.js

@@ -14,6 +14,7 @@
 import { fg, dim, brand, progressBar, pad, truncate } from '../render.js';
 import { renderKvRow } from '../layout.js';
 import { fitPanels } from '../panels.js';
+import { formatUsd } from '../../ledger.js';
 const POLL_INTERVAL_MS = 2000;
 /**
  * Label column for the gauge rows (5h / 7d / Overage). Was 6, which is
@@ -97,13 +98,21 @@ export const AnalyticsTab = {
         counters.push('  ' + renderKvRow('Thinking tokens', formatNumber(s.window.totalThinkingTokens), w - 4));
         counters.push('  ' + renderKvRow('Avg latency', `${Math.round(s.window.avgLatencyMs)}ms`, w - 4));
         counters.push('  ' + renderKvRow('Subscription %', `${s.window.subscriptionPercent.toFixed(0)}%`, w - 4));
-        // Headline numbers — the two that answer "is this costing me money?"
+        // The ledger's number: what everything since the first request would
+        // have been billed on the metered API. Lifetime, not the window.
+        const lifetimeRow = s.lifetime
+            ? '  ' + renderKvRow('API-equivalent', `${formatUsd(s.lifetime.apiEquivalentCost)}  ${dim(`lifetime, ${formatUsd(s.lifetime.recent.today)} today, since ${s.lifetime.since.slice(0, 10)}`)}`, w - 4)
+            : null;
+        if (lifetimeRow)
+            counters.push(lifetimeRow);
+        // Headline numbers — the ones that answer "is this costing me money?"
         // survive as the collapsed form.
         panels.push({
             lines: counters,
             collapsed: ['',
                 '  ' + renderKvRow('Requests', `${s.window.requests}  ${dim(`(${rpm.toFixed(1)}/min)`)}`, w - 4),
-                '  ' + renderKvRow('Subscription %', `${s.window.subscriptionPercent.toFixed(0)}%`, w - 4)],
+                '  ' + renderKvRow('Subscription %', `${s.window.subscriptionPercent.toFixed(0)}%`, w - 4),
+                ...(lifetimeRow ? [lifetimeRow] : [])],
             priority: 1,
         });
         // ── Per-model bars ─────────────────────────────────────────

package/docs/api-equivalent-spend.md

@@ -0,0 +1,116 @@
+# API-equivalent spend — the ledger
+
+What the traffic dario has served would have cost on the metered API, kept
+across restarts. `dario usage` opens with it; `/analytics` carries it as
+`lifetime`; the TUI's Analytics tab shows it as **API-equivalent**.
+
+## Why a file
+
+`/analytics` is a rolling in-memory window: 10k records, gone on restart. It
+answers "what is this costing me right now" and could never answer the
+question a subscription user actually has — what has this saved me since I
+set it up. The ledger is the persistent half. It is deliberately small: one
+row per UTC day, per model, per billing bucket, holding a request count and
+the four token buckets (input, output, cache read, cache write). Nothing else.
+
+It never stores a price. Rows are priced when read, at the rate in effect on
+the row's day, from the same tables the rolling window uses (`PRICING` for
+Claude, `OPENAI_PRICING` for the ChatGPT leg, both in `src/analytics.ts`).
+Pricing has been wrong twice in this repo (#1047, #1048); a stored dollar
+figure would have frozen the wrong number in, a stored token count gets
+repriced the moment the table is fixed.
+
+## What counts
+
+Only responses with a 2xx status. A 429 carries no tokens and a 5xx bills
+nothing.
+
+Two columns per row:
+
+- **covered** — served against a subscription: every Anthropic subscription
+  claim (`five_hour`, `seven_day`, their `_fallback` and `_overage_included`
+  forms), the ChatGPT leg, and a 2xx that carried no claim at all (a stream
+  cut before the headers were read, api-key mode without the header). The
+  API-equivalent cost of this column is the headline — the invoice that never
+  arrived.
+- **metered** — billed per token anyway: an API key upstream (`api`) or
+  Anthropic's paid overage (`overage` → `extra_usage`). That money was spent.
+  It is reported on its own line ("Paid per token on top") and never counted
+  as saved.
+
+A mid-stream continuation (6.1) is two upstream requests and records as two
+rows, one per provider, each with the tokens that leg actually consumed.
+
+## Where it lives
+
+`~/.dario/ledger.json` for a proxy on the default port; `ledger-<port>.json`
+for any other, so two instances sharing a home (a live-test rig next to
+production) do not overwrite each other. `DARIO_LEDGER_PATH=<file>` moves it;
+`--no-ledger` / `DARIO_LEDGER=0` turns it off, after which `/analytics`
+reports `lifetime: null`, `/analytics/ledger` is a 404 and `dario usage` says
+so.
+
+Writes are debounced (3 s after the last record) and durable — temp file,
+fsync, rename, directory fsync, the same path the credential store uses
+(#790). The shutdown hook flushes what the debounce still holds, so a
+`docker rm -f` loses at most the last few seconds. A file that will not parse
+is moved aside as `ledger.json.corrupt-<ts>` and the ledger starts fresh; it
+is never overwritten in place. Days past 730 roll off the front.
+
+The test suite pins `DARIO_LEDGER_PATH` to a temp directory, so a suite run
+does not add stub traffic to the operator's file.
+
+## Reading it
+
+```
+$ dario usage
+  API-equivalent spend (since 2026-09-11, 3 days, 1,515 requests):
+    $413 would have been billed on the metered API — covered by subscriptions
+      Claude       $388   1,204 reqs   (Opus 5 $301 · Sonnet 5 $86.68)
+      ChatGPT    $24.75     311 reqs   (gpt-5.6-terra $24.75)
+    Today $48.20 · Last 7d $413 · Last 30d $413
+    Paid per token on top (API key / extra usage): $1.10
+```
+
+The proxy's view is preferred (it holds records the debounce has not flushed
+yet); with no proxy on the port, the command reads the file the proxy on that
+port would write. `--card[=file.svg]` renders the headline as a 640×320 SVG
+(default `dario-api-equivalent.svg`) — plain system monospace, nothing to
+fetch, so it looks the same in a README and a screenshot. `--json` is the raw
+`/analytics` payload, `lifetime` included.
+
+`GET /analytics` → `lifetime`:
+
+```json
+{
+  "path": "/root/.dario/ledger.json",
+  "since": "2026-09-11T02:14:09.000Z",
+  "days": 3,
+  "requests": 1515,
+  "apiEquivalentCost": 412.87,
+  "meteredCost": 1.1,
+  "tokens": { "input": 1204000, "output": 388000, "cacheRead": 91200000, "cacheCreate": 4100000 },
+  "perProvider": { "anthropic": { "requests": 1204, "apiEquivalentCost": 388.12 }, "openai": { "requests": 311, "apiEquivalentCost": 24.75 } },
+  "perModel": { "claude-opus-5": { "provider": "anthropic", "requests": 900, "apiEquivalentCost": 301.44, "meteredCost": 1.1, "...": "token totals" } },
+  "recent": { "today": 48.2, "last7d": 412.87, "last30d": 412.87 }
+}
+```
+
+`GET /analytics/ledger` is the file itself: `{ path, version, since, updated,
+days: { "YYYY-MM-DD": { "<model>": { covered: {…}, metered: {…} } } } }`.
+
+## Pricing on the ChatGPT leg
+
+Before 6.6 a `gpt-*` row fell through to the Claude fallback rate and the
+"would-be API cost" of a ChatGPT-plan request was Anthropic's Sonnet 4.6
+price for a model Anthropic does not sell. `OPENAI_PRICING` carries OpenAI's
+published standard-tier rates for the models the codex backend serves, read
+off `developers.openai.com/api/docs/pricing` on 2026-09-11. OpenAI charges
+nothing to write a cache entry, so cache-write tokens (which the codex path
+never reports anyway) are priced at the input rate. Unknown `gpt-*` ids take
+gpt-5.6-terra's rate, dario's default codex model.
+
+`scripts/check-pricing-drift.mjs` watches the Claude table against
+Anthropic's page. Nothing watches the OpenAI table yet — an entry that is
+correct today goes wrong the moment OpenAI changes it, and the only signal
+would be this number moving.

package/docs/midstream-continuation.md

@@ -161,6 +161,32 @@ its own answer; the other subscription takes over only when that model cannot
 serve the resume. dario warns loudly at startup while the tap is set; it is a
 demo and test affordance, never a default.
 
+## Seeing it after the fact
+
+A continuation leaves three traces. The SSE comment on the wire
+(`: dario continuation gpt-5.6-terra (codex live) after 1204 chars`) is the
+one a raw capture shows; every SSE parser ignores it. The request log
+(`--log-file`) tells the hop-by-hop story: the row of a request whose stream
+died carries `continued` (`continued`, `continued-unfinished`,
+`resume-failed`, `no-target`), `continued_by` (the leg that served the rest)
+and `continued_after` (characters the client already had); every resume leg
+has a row of its own with `continuation_depth` (1, or 2 for the resume of a
+resume) and `continuation_of`, the number of the request it resumed — and,
+when it died too, its own `continued_*` fields. A two-hop resume is three
+rows that point at each other. `/analytics` tallies per window under
+`continuations`: `attempted`, split into `finished`, `unfinished`, `failed`
+and `noTarget`. Only the client's own request counts there — a resume leg is
+a loopback request with a guard of its own, and counting its attempt too
+would show one dying stream as two. `dario usage` prints the tally as one
+line when anything died:
+
+```
+  Continuations:   3 streams died mid-answer: 2 finished, 1 unfinished
+```
+
+`noTarget` above zero is the line to act on: streams are dying and there is
+no `--pool-fallback` entry for the other provider to finish them.
+
 ## How it was proven
 
 `test/midstream-continuation-wiring.mjs` runs a real proxy against a fake

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.5.0",
+  "version": "6.6.1",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {