@askalf/dario 6.8.18 → 6.9.1

package/README.md

@@ -27,7 +27,7 @@
 
 <p><strong>One local endpoint. Every AI tool you own. The subscriptions you already pay for.</strong></p>
 
-<sub><code>npm i -g @askalf/dario</code> · <strong>0</strong> runtime deps · <a href="https://www.npmjs.com/package/@askalf/dario">SLSA-attested</a> every release · nothing phones home · ~38k lines you can read in a weekend · independent, unofficial, third-party (<a href="DISCLAIMER.md">DISCLAIMER.md</a>)</sub>
+<sub><code>npm i -g @askalf/dario</code> · <strong>0</strong> runtime deps · <a href="https://www.npmjs.com/package/@askalf/dario">SLSA-attested</a> every release · nothing phones home · ~39k lines you can read in a weekend · independent, unofficial, third-party (<a href="DISCLAIMER.md">DISCLAIMER.md</a>)</sub>
 
 <sub><a href="#start-in-60-seconds">Start</a> · <a href="#point-your-tools-at-it">Your tools</a> · <a href="#what-it-does-with-a-request">Routing</a> · <a href="#two-plans-one-endpoint">Two plans</a> · <a href="#many-seats-one-endpoint">Pool</a> · <a href="#it-tracks-a-moving-target">Drift</a> · <a href="#trust--transparency">Trust</a> · <a href="#will-my-account-get-suspended">Risk</a> · <a href="#commands">Commands</a> · <a href="#faq">FAQ</a> · <a href="docs/returning.md">Coming back after a while?</a></sub>
 
@@ -409,7 +409,7 @@ The rolling window forgets on every restart; the **ledger** does not. Since 6.6
 
 Only served requests count. Traffic that was metered anyway — an API key upstream, or Anthropic's paid `extra_usage` overage — is kept in its own column and reported as spent, not saved. `dario usage --card` writes the headline as a 640×320 SVG you can drop in a README or a post, and `--donut` writes the same number as three rings — by model, by key, subscription vs metered; `--no-ledger` / `DARIO_LEDGER=0` turns the file off, `DARIO_LEDGER_PATH` moves it, and `GET /analytics/ledger` is the per-day table behind the number. Details: [api-equivalent-spend.md](./docs/api-equivalent-spend.md).
 
-**Scrape it, or open it.** `GET /metrics` is the same state as Prometheus text exposition — window, seats, models, consumers, queue, latency quantiles, burn rates, ledger — so Grafana reads dario like anything else. `GET /analytics/ui` is a self-contained dashboard page with the headline, the rings and the tables, refreshing every minute. Both sit behind the same gate as `/analytics`; `--analytics-token` (env `DARIO_ANALYTICS_TOKEN`) adds a **read-only** credential accepted on those paths and nowhere else, so a scraper or a browser can hold the numbers without holding request rights. Families and the gate: [analytics.md](./docs/analytics.md).
+**Scrape it, or open it.** `GET /metrics` is the same state as Prometheus text exposition — window, seats, models, consumers, queue, latency quantiles, burn rates, ledger — so Grafana reads dario like anything else. Since 6.9 every request also carries its **timing split**: queue wait, governor sleep, the provider's time to first byte, the provider's total, and what is left — dario's own overhead — as `x-dario-*-ms` response headers on the request itself, as `window.timing` on `/analytics`, and as five more `/metrics` families, so "was that Anthropic or the proxy?" is a `curl -i` away ([details](./docs/analytics.md#the-timing-split)). `GET /analytics/ui` is a self-contained dashboard page with the headline, the rings and the tables, refreshing every minute. Both sit behind the same gate as `/analytics`; `--analytics-token` (env `DARIO_ANALYTICS_TOKEN`) adds a **read-only** credential accepted on those paths and nowhere else, so a scraper or a browser can hold the numbers without holding request rights. Families and the gate: [analytics.md](./docs/analytics.md).
 
 ## It tracks a moving target
 
@@ -465,7 +465,7 @@ The split isn't live, but it was announced once on short notice and could return
 
 | Signal | Status |
 |---|---|
-| Source | **~33k** lines of TypeScript across **68** files, auditable in a weekend. One credential path since v5: the pool. |
+| Source | **~39k** lines of TypeScript across **77** files, auditable in a weekend. One credential path since v5: the pool. |
 | Dependencies | **0 runtime.** Verify: `npm ls --production` |
 | Provenance | Every release [SLSA-attested](https://www.npmjs.com/package/@askalf/dario) via GitHub Actions + Sigstore, published with OIDC trusted publishing — no long-lived npm token exists to leak |
 | Scanning | [CodeQL](https://github.com/askalf/dario/actions/workflows/codeql.yml) on every push and weekly · [ClusterFuzzLite](./.github/workflows/cflite.yml) fuzzes the SSE translator and rejection parsers weekly · [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/askalf/dario) and [Best Practices](https://www.bestpractices.dev/projects/13638) badges above are live |

package/dist/analytics.d.ts

@@ -17,6 +17,7 @@
  * each subscriber listens for `'record'` and writes one SSE frame.
  */
 import { EventEmitter } from 'node:events';
+import { type RequestTiming, type TimingStats } from './timing.js';
 export interface RequestRecord {
     timestamp: number;
     /**
@@ -47,6 +48,13 @@ export interface RequestRecord {
      * delivered, which leg served the rest. Absent on every ordinary request.
      */
     continuation?: RequestContinuation;
+    /**
+     * Where the wall-clock time went (src/timing.ts): queue wait, governor
+     * sleep, upstream time-to-first-byte, upstream total, end-to-end total.
+     * Absent on rows written before the split existed and on legs that never
+     * reached an upstream.
+     */
+    timing?: RequestTiming;
 }
 export interface RequestContinuation {
     /** See midstream.ts ContinuationOutcome. */
@@ -351,6 +359,12 @@ interface WindowStats {
     cachedPromptPercent: number;
     estimatedCost: number;
     avgLatencyMs: number;
+    /**
+     * The latency split, averaged over the rows that carry one: queue wait,
+     * governor sleep, upstream TTFB, upstream total and dario's own overhead
+     * (src/timing.ts). `samples` says how many rows that was.
+     */
+    timing: TimingStats;
     errorRate: number;
     /** Mid-stream continuations in the window and how they went (v6.1 guard, counted since v6.6.1). */
     continuations: ContinuationStats;

package/dist/analytics.js

@@ -18,6 +18,7 @@
  */
 import { EventEmitter } from 'node:events';
 import { createHash } from 'node:crypto';
+import { timingStats } from './timing.js';
 export function continuationStats(records) {
     const out = { attempted: 0, finished: 0, unfinished: 0, failed: 0, noTarget: 0 };
     for (const r of records) {
@@ -397,7 +398,7 @@ export class Analytics extends EventEmitter {
             return {
                 totalInputTokens: 0, totalOutputTokens: 0, totalThinkingTokens: 0,
                 totalCacheReadTokens: 0, totalCacheCreateTokens: 0, cachedPromptPercent: 0,
-                estimatedCost: 0, avgLatencyMs: 0, errorRate: 0,
+                estimatedCost: 0, avgLatencyMs: 0, timing: timingStats([]), errorRate: 0,
                 continuations: { attempted: 0, finished: 0, unfinished: 0, failed: 0, noTarget: 0 },
                 claimBreakdown: {},
                 billingBucketBreakdown: {
@@ -444,6 +445,7 @@ export class Analytics extends EventEmitter {
             cachedPromptPercent: cachedPromptPercent(totalInput, totalCacheRead, totalCacheCreate),
             estimatedCost: Math.round(cost * 10000) / 10000,
             avgLatencyMs: Math.round(avgLatency),
+            timing: timingStats(records.map(r => r.timing)),
             errorRate: Math.round((errors / records.length) * 10000) / 10000,
             continuations: continuationStats(records),
             claimBreakdown: claims,

package/dist/cli.js

@@ -2801,6 +2801,12 @@ async function usage() {
         console.log(`  Input tokens:    ${(win.totalInputTokens ?? 0).toLocaleString()}`);
         console.log(`  Output tokens:   ${(win.totalOutputTokens ?? 0).toLocaleString()}`);
         console.log(`  Avg latency:     ${win.avgLatencyMs ?? 0} ms`);
+        // Where that went (src/timing.ts): the provider, the waits, and dario itself.
+        const t = win.timing;
+        if (t && t.samples > 0) {
+            console.log(`    upstream:      ${t.avgUpstreamMs} ms (TTFB ${t.avgUpstreamTtfbMs} ms)`);
+            console.log(`    dario:         ${t.avgOverheadMs} ms overhead · ${t.avgQueueMs} ms queue · ${t.avgPacingMs} ms pacing`);
+        }
         if ((win.errorRate ?? 0) > 0) {
             console.log(`  Error rate:      ${((win.errorRate ?? 0) * 100).toFixed(1)}%`);
         }

package/dist/codex-backend.d.ts

@@ -34,6 +34,10 @@ export declare function fetchCodexModels(creds: CodexAccountCredentials, fetchIm
 export interface CodexForwardOutcome {
     status: number;
     latencyMs: number;
+    /** First outbound fetch → upstream response headers, ms: the seat's time to first byte (the served attempt when a refresh forced a retry). 0 when nothing went out. */
+    upstreamTtfbMs: number;
+    /** First outbound fetch → the report, ms: the seat's time including its body. 0 when nothing went out. */
+    upstreamMs: number;
     /** Net of the cached prefix (Anthropic convention; see splitResponsesUsage). */
     inputTokens: number;
     outputTokens: number;
@@ -311,7 +315,12 @@ onDecline?: (info: CodexDecline) => void,
 /** When true a decline returns false WITHOUT writing, so the caller can
  *  retry the request on a healthy peer. False keeps the old behaviour: the
  *  upstream error is written through as the backend sent it. */
-deferOnUnavailable?: boolean): Promise<boolean>;
+deferOnUnavailable?: boolean, 
+/** Queue wait and arrival stamp from the proxy: the response carries the timing headers (src/timing.ts) like a Claude-path response does. */
+timing?: {
+    queueMs: number;
+    arrivedAt: number;
+}): Promise<boolean>;
 /**
  * Serve a request from a stored Codex account, in either client wire shape.
  *
@@ -354,4 +363,9 @@ effort?: ResponsesReasoningConfig['effort'],
  * stream that dies with content on the wire is finished from the Claude
  * pool instead of ending truncated.
  */
-midstream?: MidstreamGuard | null): Promise<boolean>;
+midstream?: MidstreamGuard | null, 
+/** Queue wait and arrival stamp from the proxy: the response carries the timing headers (src/timing.ts) like a Claude-path response does. */
+timing?: {
+    queueMs: number;
+    arrivedAt: number;
+}): Promise<boolean>;

package/dist/codex-backend.js

@@ -22,6 +22,7 @@
  * translation in both directions, including SSE.
  */
 import { createHash } from 'node:crypto';
+import { timingHeaders } from './timing.js';
 import { forceRefreshCodexAccount } from './codex-accounts.js';
 import { anthropicToResponsesRequest, anthropicUsageFromResponses, createResponsesSSEParser, formatResponsesAnthropicSSE, createAnthropicMessageAssembler, responsesStreamToAnthropicSSE, } from './anthropic-responses-translate.js';
 import { resolveClaudeTarget } from './claude-model.js';
@@ -815,8 +816,30 @@ onDecline,
 /** When true a decline returns false WITHOUT writing, so the caller can
  *  retry the request on a healthy peer. False keeps the old behaviour: the
  *  upstream error is written through as the backend sent it. */
-deferOnUnavailable = false) {
+deferOnUnavailable = false, 
+/** Queue wait and arrival stamp from the proxy: the response carries the timing headers (src/timing.ts) like a Claude-path response does. */
+timing) {
     const startedAt = Date.now();
+    // Timing split (src/timing.ts): the first outbound fetch and the headers of
+    // the attempt that was served. A refresh-and-retry keeps the first start —
+    // the rejected attempt was the seat's time too.
+    let fetchStartedAt = 0;
+    let upstreamHeadersAt = 0;
+    const timedFetch = async (input, init) => {
+        if (!fetchStartedAt)
+            fetchStartedAt = Date.now();
+        const r = await fetchImpl(input, init);
+        upstreamHeadersAt = Date.now();
+        return r;
+    };
+    const ttfbMs = () => (fetchStartedAt && upstreamHeadersAt ? Math.max(0, upstreamHeadersAt - fetchStartedAt) : 0);
+    const upstreamMsNow = () => (fetchStartedAt ? Math.max(0, Date.now() - fetchStartedAt) : 0);
+    // The four x-dario-*-ms headers, merged into every response this leg writes
+    // once the backend has answered. The governor never runs for codex: pacing 0.
+    const splitHeaders = () => timingHeaders({
+        queueMs: timing?.queueMs ?? 0, pacingMs: 0, arrivedAt: timing?.arrivedAt ?? startedAt,
+        fetchStartedAt: fetchStartedAt || Date.now(), upstreamTtfbMs: ttfbMs(),
+    });
     const model = String(body.model ?? '');
     let reported = false;
     const report = (status, usage) => {
@@ -824,7 +847,7 @@ deferOnUnavailable = false) {
             return;
         reported = true;
         try {
-            onDone({ status, latencyMs: Date.now() - startedAt, inputTokens: usage?.input ?? 0, outputTokens: usage?.output ?? 0,
+            onDone({ status, latencyMs: Date.now() - startedAt, upstreamTtfbMs: ttfbMs(), upstreamMs: upstreamMsNow(), inputTokens: usage?.input ?? 0, outputTokens: usage?.output ?? 0,
                 cacheReadTokens: usage?.cacheRead ?? 0, cacheCreateTokens: usage?.cacheCreate ?? 0, stream: true, model, alias: creds.alias });
         }
         catch { /* never break a served request */ }
@@ -856,13 +879,13 @@ deferOnUnavailable = false) {
         if (verbose)
             console.log(`[dario] → codex backend (responses passthrough): ${target} (model: ${model})`);
         let activeCreds = creds;
-        let upstream = await fetchImpl(target, { method: 'POST', headers: buildCodexHeaders(activeCreds), body: JSON.stringify(upstreamBody), signal: abort.signal });
+        let upstream = await timedFetch(target, { method: 'POST', headers: buildCodexHeaders(activeCreds), body: JSON.stringify(upstreamBody), signal: abort.signal });
         if (isCodexAuthFailure(upstream.status)) {
             await upstream.text().catch(() => ''); // release the rejected response before retrying
             const fresh = await refreshAfterCodexAuthFailure(activeCreds, verbose);
             if (fresh) {
                 activeCreds = fresh;
-                upstream = await fetchImpl(target, { method: 'POST', headers: buildCodexHeaders(activeCreds), body: JSON.stringify(upstreamBody), signal: abort.signal });
+                upstream = await timedFetch(target, { method: 'POST', headers: buildCodexHeaders(activeCreds), body: JSON.stringify(upstreamBody), signal: abort.signal });
             }
         }
         if (!upstream.ok || !upstream.body) {
@@ -890,14 +913,14 @@ deferOnUnavailable = false) {
                 return false;
             }
             if (!clientGone) {
-                res.writeHead(upstream.status, { 'Content-Type': 'application/json', ...securityHeaders });
+                res.writeHead(upstream.status, { 'Content-Type': 'application/json', ...securityHeaders, ...splitHeaders() });
                 // The backend's own error body, already in the client's shape.
                 res.end(detail || JSON.stringify({ error: { message: 'Upstream Codex backend error', type: 'server_error', code: null, param: null } }));
             }
             report(clientGone ? 499 : upstream.status, null);
             return true;
         }
-        res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', 'Connection': 'keep-alive', 'Access-Control-Allow-Origin': corsOrigin, ...securityHeaders });
+        res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', 'Connection': 'keep-alive', 'Access-Control-Allow-Origin': corsOrigin, ...securityHeaders, ...splitHeaders() });
         const reader = upstream.body.getReader();
         const decoder = new TextDecoder();
         let tail = '';
@@ -1015,13 +1038,35 @@ effort,
  * stream that dies with content on the wire is finished from the Claude
  * pool instead of ending truncated.
  */
-midstream) {
+midstream, 
+/** Queue wait and arrival stamp from the proxy: the response carries the timing headers (src/timing.ts) like a Claude-path response does. */
+timing) {
     void req;
     const isAnthropic = shape === 'anthropic';
     // Reported exactly once, on every exit that answered the client. Without
     // this the proxy had no idea a codex request happened: no analytics row, no
     // log line, no per-account count.
     const startedAt = Date.now();
+    // Timing split (src/timing.ts): the first outbound fetch and the headers of
+    // the attempt that was served. A refresh-and-retry keeps the first start —
+    // the rejected attempt was the seat's time too.
+    let fetchStartedAt = 0;
+    let upstreamHeadersAt = 0;
+    const timedFetch = async (input, init) => {
+        if (!fetchStartedAt)
+            fetchStartedAt = Date.now();
+        const r = await fetchImpl(input, init);
+        upstreamHeadersAt = Date.now();
+        return r;
+    };
+    const ttfbMs = () => (fetchStartedAt && upstreamHeadersAt ? Math.max(0, upstreamHeadersAt - fetchStartedAt) : 0);
+    const upstreamMsNow = () => (fetchStartedAt ? Math.max(0, Date.now() - fetchStartedAt) : 0);
+    // The four x-dario-*-ms headers, merged into every response this leg writes
+    // once the backend has answered. The governor never runs for codex: pacing 0.
+    const splitHeaders = () => timingHeaders({
+        queueMs: timing?.queueMs ?? 0, pacingMs: 0, arrivedAt: timing?.arrivedAt ?? startedAt,
+        fetchStartedAt: fetchStartedAt || Date.now(), upstreamTtfbMs: ttfbMs(),
+    });
     let reported = false;
     const report = (status, usage, stream, model) => {
         if (reported || !onDone)
@@ -1029,7 +1074,7 @@ midstream) {
         reported = true;
         try {
             onDone({
-                status, latencyMs: Date.now() - startedAt,
+                status, latencyMs: Date.now() - startedAt, upstreamTtfbMs: ttfbMs(), upstreamMs: upstreamMsNow(),
                 inputTokens: usage?.input ?? 0, outputTokens: usage?.output ?? 0,
                 cacheReadTokens: usage?.cacheRead ?? 0, cacheCreateTokens: usage?.cacheCreate ?? 0,
                 stream, model, alias: creds.alias,
@@ -1110,7 +1155,7 @@ midstream) {
         if (verbose)
             console.log(`[dario] → codex backend: ${target} (model: ${model})`);
         let activeCreds = creds;
-        let upstream = await fetchImpl(target, {
+        let upstream = await timedFetch(target, {
             method: 'POST',
             headers: buildCodexHeaders(activeCreds),
             body: JSON.stringify(scrubbed),
@@ -1123,7 +1168,7 @@ midstream) {
             const fresh = await refreshAfterCodexAuthFailure(activeCreds, verbose);
             if (fresh) {
                 activeCreds = fresh;
-                upstream = await fetchImpl(target, {
+                upstream = await timedFetch(target, {
                     method: 'POST',
                     headers: buildCodexHeaders(activeCreds),
                     body: JSON.stringify(scrubbed),
@@ -1175,7 +1220,7 @@ midstream) {
                 // (the decline was already recorded above, for both exits)
                 return false;
             }
-            res.writeHead(upstream.status, { 'Content-Type': 'application/json', ...securityHeaders });
+            res.writeHead(upstream.status, { 'Content-Type': 'application/json', ...securityHeaders, ...splitHeaders() });
             res.end(errBody('Upstream Codex backend error', { status: upstream.status, account: creds.alias }));
             report(upstream.status, null, clientWantsStream, model);
             return true;
@@ -1228,6 +1273,7 @@ midstream) {
                 'Connection': 'keep-alive',
                 'Access-Control-Allow-Origin': corsOrigin,
                 ...securityHeaders,
+                ...splitHeaders(),
             });
         }
         let buffered = '';
@@ -1311,6 +1357,7 @@ midstream) {
                     'Content-Type': 'application/json',
                     'Access-Control-Allow-Origin': corsOrigin,
                     ...securityHeaders,
+                    ...splitHeaders(),
                 });
                 antAssembler.push(antTranslator.end());
                 finished = true;
@@ -1326,6 +1373,7 @@ midstream) {
                 'Content-Type': 'application/json',
                 'Access-Control-Allow-Origin': corsOrigin,
                 ...securityHeaders,
+                ...splitHeaders(),
             });
             finished = true;
             res.end(JSON.stringify(translator.complete()));

package/dist/metrics.js

@@ -1,4 +1,5 @@
 import { billingBucketFromClaim } from './analytics.js';
+import { TIMING_METRIC_FAMILIES } from './timing.js';
 const escapeLabel = (v) => v.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n');
 const labels = (kv) => {
     const parts = Object.entries(kv).map(([k, v]) => `${k}="${escapeLabel(v)}"`);
@@ -47,6 +48,16 @@ export function renderPrometheus(input) {
     const win = { window_minutes: String(w.minutes) };
     metric('dario_window_requests', 'Requests in the rolling window.', [[win, w.requests]]);
     metric('dario_window_avg_latency_ms', 'Mean request latency in the rolling window, ms.', [[win, w.avgLatencyMs]]);
+    // The split behind the mean (src/timing.ts). Absent when no row in the
+    // window carried one — an older proxy's rows, or nothing served yet.
+    const wt = w.timing;
+    if (wt && wt.samples > 0) {
+        metric('dario_window_avg_upstream_ttfb_ms', 'Mean upstream time to first byte in the rolling window, ms.', [[win, wt.avgUpstreamTtfbMs]]);
+        metric('dario_window_avg_upstream_latency_ms', 'Mean upstream time (first outbound byte to body consumed) in the rolling window, ms.', [[win, wt.avgUpstreamMs]]);
+        metric('dario_window_avg_overhead_ms', 'Mean time dario itself spent per request in the rolling window, ms.', [[win, wt.avgOverheadMs]]);
+        metric('dario_window_avg_queue_wait_ms', 'Mean wait for a concurrency slot in the rolling window, ms.', [[win, wt.avgQueueMs]]);
+        metric('dario_window_avg_pacing_wait_ms', 'Mean rate-governor sleep in the rolling window, ms.', [[win, wt.avgPacingMs]]);
+    }
     metric('dario_window_error_rate', 'Share of requests that failed in the rolling window, 0..1.', [[win, w.errorRate]]);
     metric('dario_window_cached_prompt_percent', 'Share of prompt tokens served from cache in the rolling window, 0..100.', [[win, w.cachedPromptPercent]]);
     metric('dario_window_estimated_cost_usd', 'API-equivalent cost of the rolling window, USD.', [[win, w.estimatedCost]]);
@@ -91,6 +102,21 @@ export function renderPrometheus(input) {
         out.push(`dario_request_latency_ms_sum ${num(lat.reduce((a, b) => a + b, 0))}`);
         out.push(`dario_request_latency_ms_count ${lat.length}`);
     }
+    // The same quantiles for each leg of the split, over the recent records
+    // that carry one. A row without timing (older proxy, pre-upstream reject)
+    // is left out rather than counted as zero.
+    const timed = recent.map(r => r.timing).filter((t) => t !== undefined);
+    if (timed.length > 0) {
+        for (const fam of TIMING_METRIC_FAMILIES) {
+            const vals = timed.map(fam.pick).filter(n => Number.isFinite(n)).sort((a, b) => a - b);
+            out.push(`# HELP ${fam.name} ${fam.help} Nearest-rank quantiles over the most recent records.`);
+            out.push(`# TYPE ${fam.name} summary`);
+            for (const q of [0.5, 0.9, 0.99])
+                out.push(`${fam.name}{quantile="${q}"} ${num(quantile(vals, q))}`);
+            out.push(`${fam.name}_sum ${num(vals.reduce((a, b) => a + b, 0))}`);
+            out.push(`${fam.name}_count ${vals.length}`);
+        }
+    }
     // ---- predictions -------------------------------------------------------
     const p = summary.predictions;
     if (p.estimatedExhaustionMinutes !== null) {

package/dist/pacing.d.ts

@@ -141,3 +141,32 @@ export declare function resolveSessionStartConfig(explicit?: {
     jitterMs?: number;
     stealth?: boolean;
 }, env?: NodeJS.ProcessEnv): SessionStartConfig;
+/**
+ * The governor's clocks, one set per seat (v6.9.1).
+ *
+ * The floors above model ONE account's cadence — that is what the provider
+ * observes. Through v6.9.0 the proxy kept a single `lastRequestTime` for the
+ * whole process, so a pool paced every seat against every other: a three-seat
+ * pool could put at most one request per floor on the wire, and a request to
+ * an idle seat waited for a stranger's request on a busy one (dario#1244's
+ * family — the pool running behind one seat's limits). Keying the clocks by
+ * seat keeps each account's observed rhythm exactly as before while the pool
+ * as a whole moves at pool speed. API-key mode has one seat and one clock.
+ */
+export interface SeatPacingState {
+    /** When the seat's last request STARTED (feeds the inter-request floor). */
+    lastRequestTime: number;
+    /** When the seat's last 2xx response COMPLETED (feeds think-time). */
+    lastResponseTime: number;
+    /** Output tokens of that response (feeds think-time's per-token term). */
+    lastResponseTokens: number;
+}
+export declare class PacingRegistry {
+    private readonly seats;
+    /** The seat's clocks, created at zero on first sight (a fresh seat is never paced). */
+    seat(key: string): SeatPacingState;
+    /** Stamp a completed 2xx response on the seat, for the next request's think-time. */
+    noteResponse(key: string, at: number, outputTokens: number): void;
+    /** Seats the registry has seen, for tests and status. */
+    keys(): string[];
+}

package/dist/pacing.js

@@ -140,3 +140,25 @@ export function resolveSessionStartConfig(explicit = {}, env = process.env) {
     const jitter = pickNonNegativeInt(explicit.jitterMs, env.DARIO_SESSION_START_JITTER_MS) ?? (stealth ? 3000 : 0);
     return { minMs: min, jitterMs: jitter };
 }
+export class PacingRegistry {
+    seats = new Map();
+    /** The seat's clocks, created at zero on first sight (a fresh seat is never paced). */
+    seat(key) {
+        let s = this.seats.get(key);
+        if (!s) {
+            s = { lastRequestTime: 0, lastResponseTime: 0, lastResponseTokens: 0 };
+            this.seats.set(key, s);
+        }
+        return s;
+    }
+    /** Stamp a completed 2xx response on the seat, for the next request's think-time. */
+    noteResponse(key, at, outputTokens) {
+        const s = this.seat(key);
+        s.lastResponseTime = at;
+        s.lastResponseTokens = outputTokens;
+    }
+    /** Seats the registry has seen, for tests and status. */
+    keys() {
+        return [...this.seats.keys()];
+    }
+}

package/dist/proxy.d.ts

@@ -599,6 +599,13 @@ export interface ProxyLogEntry {
     model?: string;
     status?: number;
     latency_ms?: number;
+    /** The latency split (src/timing.ts): where `latency_ms` and the time around it went. */
+    queue_ms?: number;
+    pacing_ms?: number;
+    upstream_ttfb_ms?: number;
+    upstream_ms?: number;
+    total_ms?: number;
+    overhead_ms?: number;
     in_tokens?: number;
     out_tokens?: number;
     cache_read?: number;

package/dist/proxy.js

@@ -11,6 +11,7 @@ import { getServingProbe } from './serving-probe.js';
 import { darioVersion } from './version.js';
 import { buildCCRequest, applyCcPromptCaching, isGenuineCCClient, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, forwardClientCCIdentityHeaders, isMcpToolName, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
 import { stampCch, hasCchSeed } from './cch.js';
+import { foldTiming, timingHeaders, timingLogFields } from './timing.js';
 import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion } from './live-fingerprint.js';
 import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, accountIneligibility, reportedAccountStatus, reconcilePoolAccounts, resolvePoolStrategy, resolvePoolHeadroomFloor, DEFAULT_POOL_HEADROOM_FLOOR, utilFreshness, rateLimitWindow, accountAction, accountPeers, distinctAccounts, describeRejection, maskEmail, isAccountEligible } from './pool.js';
 import { backfillIdentity } from './accounts.js';
@@ -1895,15 +1896,13 @@ export async function startProxy(opts = {}) {
     // 500ms floor keeps the default behavior identical to v3.23; `--pace-min`
     // and `--pace-jitter` let callers tune the distribution. Pure calc lives
     // in src/pacing.ts so the edge cases are unit-tested without timers.
-    const { computePacingDelay, resolvePacingConfig, computeThinkTimeDelay, resolveThinkTimeConfig, computeSessionStartDelay, resolveSessionStartConfig, } = await import('./pacing.js');
-    let lastRequestTime = 0;
-    // Behavioral smoothing state: when the last response *completed* and
-    // how many output tokens it had. Used by computeThinkTimeDelay to
-    // model human read-time before the next request. Distinct from
-    // lastRequestTime (which tracks when the last request *started* and
-    // feeds the inter-request floor).
-    let lastResponseTime = 0;
-    let lastResponseTokens = 0;
+    const { computePacingDelay, resolvePacingConfig, computeThinkTimeDelay, resolveThinkTimeConfig, computeSessionStartDelay, resolveSessionStartConfig, PacingRegistry, } = await import('./pacing.js');
+    // The governor's clocks, PER SEAT (v6.9.1, src/pacing.ts PacingRegistry):
+    // when a seat's last request started (the inter-request floor) and when its
+    // last 2xx response completed with how many output tokens (think-time).
+    // One clock for the whole proxy used to pace every seat against every
+    // other, so a pool moved at one seat's speed. API-key mode is one seat.
+    const pacingClocks = new PacingRegistry();
     // --stealth toggles the behavioral-stealth preset across all three
     // pacing layers (pace, think-time, session-start). When on, each
     // resolver's zero-default flips to its stealth preset; explicit flags
@@ -1931,7 +1930,7 @@ export async function startProxy(opts = {}) {
     if (verbose) {
         if (stealth)
             console.log('[dario] stealth: behavioral-stealth preset active (pace+think+session-start defaults non-zero)');
-        console.log(`[dario] pacing: min=${pacingCfg.minGapMs}ms jitter=${pacingCfg.jitterMs}ms`);
+        console.log(`[dario] pacing: min=${pacingCfg.minGapMs}ms jitter=${pacingCfg.jitterMs}ms (per seat)`);
         if (thinkTimeEnabled) {
             console.log(`[dario] think-time: base=${thinkTimeCfg.baseMs}ms perToken=${thinkTimeCfg.perTokenMs}ms jitter=${thinkTimeCfg.jitterMs}ms max=${thinkTimeCfg.maxMs}ms`);
         }
@@ -2188,7 +2187,9 @@ export async function startProxy(opts = {}) {
      * a silently swapped model family is precisely the surprise this project
      * exists to avoid.
      */
-    const tryCodexPoolFallback = async (req, res, body, fallbackModels, shape, why, attempted) => {
+    const tryCodexPoolFallback = async (req, res, body, fallbackModels, shape, why, attempted, 
+    /** The request's queue wait and arrival, so the codex response carries the timing headers too. */
+    timing) => {
         if (fallbackModels.length === 0)
             return false;
         // Never a second codex attempt in the same request, and never one while it
@@ -2280,7 +2281,7 @@ export async function startProxy(opts = {}) {
             // `--pool-fallback=gpt-5.6-terra:high` is choosing the effort the
             // failover runs at, so the entry's own suffix reaches the request rather
             // than the failover quietly running at the backend default.
-            effortForCodex(fallbackPick.effort));
+            effortForCodex(fallbackPick.effort), undefined, timing);
             if (served || !peer)
                 break;
             console.log(`[dario] codex seat ${seat.alias} declined — retrying this fallback on ${peer.alias}`);
@@ -2316,8 +2317,8 @@ export async function startProxy(opts = {}) {
      * bug structurally impossible to reintroduce: a future third call site gets
      * this by construction, not by remembering to copy six lines correctly.
      */
-    const attemptPoolFallbackOn429 = async (req, res, body, isOpenAI, attempted) => {
-        if (await tryCodexPoolFallback(req, res, body, selectPoolFallbackForBody(body), isOpenAI ? 'openai' : 'anthropic', 'pool exhausted mid-flight (429, no peer)', attempted)) {
+    const attemptPoolFallbackOn429 = async (req, res, body, isOpenAI, attempted, timing) => {
+        if (await tryCodexPoolFallback(req, res, body, selectPoolFallbackForBody(body), isOpenAI ? 'openai' : 'anthropic', 'pool exhausted mid-flight (429, no peer)', attempted, timing)) {
             return true;
         }
         const fallbackModel = selectPoolFallbackForBody(body)[0] ?? null;
@@ -2333,6 +2334,9 @@ export async function startProxy(opts = {}) {
         return false;
     };
     const server = createServer(async (req, res) => {
+        // The request's first stamp (src/timing.ts): every split below is
+        // measured from here, before any parsing, auth or queueing.
+        const arrivedAt = Date.now();
         if (req.method === 'OPTIONS') {
             res.writeHead(204, CORS_HEADERS);
             res.end();
@@ -2971,6 +2975,10 @@ export async function startProxy(opts = {}) {
         // longer uses once its upstream is dead (a one-slot proxy would otherwise
         // wait on itself until the queue timeout).
         let queueSlotHeld = false;
+        // The deliberate waits, reported on their own in the timing split so
+        // "overhead" never has to be guessed at (src/timing.ts).
+        let queueMs = 0;
+        let pacingMs = 0;
         const releaseQueueSlot = () => {
             if (!queueSlotHeld)
                 return;
@@ -2978,7 +2986,9 @@ export async function startProxy(opts = {}) {
             queue.release(consumerFromHeaders);
         };
         try {
+            const queueEnteredAt = Date.now();
             await queue.acquire(consumerFromHeaders);
+            queueMs = Date.now() - queueEnteredAt;
             queueSlotHeld = true;
         }
         catch (err) {
@@ -3845,6 +3855,7 @@ export async function startProxy(opts = {}) {
                                 claim: CODEX_CLAIM, util5h: 0, util7d: 0, overageUtil: 0,
                                 latencyMs: o.latencyMs, status: o.status, isStream: o.stream, isOpenAI,
                                 continuation: continuationOf(codexGuard, requestDepth),
+                                timing: { queueMs, pacingMs: 0, upstreamTtfbMs: o.upstreamTtfbMs, upstreamMs: o.upstreamMs, totalMs: Math.max(0, Date.now() - arrivedAt) },
                             });
                             writeLogLine(logFileStream, {
                                 ts: new Date().toISOString(), req: codexReq,
@@ -3919,14 +3930,14 @@ export async function startProxy(opts = {}) {
                                 // outage this change exists to remove, surviving on the one shape Codex
                                 // CLI actually speaks (caught in review of #1288).
                                 if (isResponses && responsesBodyRaw) {
-                                    served = await forwardResponsesToCodex(rawRes, { ...responsesBodyRaw, model: rawModel }, codexSeat, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, codexFetch, codexOnDone, codexOnDecline, canDefer || codexPeer !== null);
+                                    served = await forwardResponsesToCodex(rawRes, { ...responsesBodyRaw, model: rawModel }, codexSeat, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, codexFetch, codexOnDone, codexOnDecline, canDefer || codexPeer !== null, { queueMs, arrivedAt });
                                 }
                                 else {
                                     served = await forwardToCodex(req, res, body, codexSeat, corsOrigin, SECURITY_HEADERS, upstreamTimeoutMs, verbose, isOpenAI ? 'openai' : 'anthropic', codexFetch, canDefer || codexPeer !== null, codexOnDone, codexOnDecline, 
                                     // dario#1260 — the effort named by the model-name suffix stripped
                                     // above. Undefined for every request that did not name one, which
                                     // leaves the outbound body exactly as it was.
-                                    effortForCodex(requestEffort), codexGuard);
+                                    effortForCodex(requestEffort), codexGuard, { queueMs, arrivedAt });
                                 }
                                 if (served || !codexPeer)
                                     break;
@@ -4056,7 +4067,7 @@ export async function startProxy(opts = {}) {
             if (!upstreamApiKey && !poolAccount) {
                 attemptedProviders.add('claude');
             }
-            if (!upstreamApiKey && !poolAccount && !pinnedAccount && await tryCodexPoolFallback(req, res, body, selectPoolFallbackForBody(body), isOpenAI ? 'openai' : 'anthropic', 'pool exhausted', attemptedProviders)) {
+            if (!upstreamApiKey && !poolAccount && !pinnedAccount && await tryCodexPoolFallback(req, res, body, selectPoolFallbackForBody(body), isOpenAI ? 'openai' : 'anthropic', 'pool exhausted', attemptedProviders, { queueMs, arrivedAt })) {
                 return;
             }
             // `isOpenAI` is REQUIRED here and was not, before v6.0.0 — the selector's
@@ -4493,19 +4504,25 @@ export async function startProxy(opts = {}) {
             //                          Opt-in via --session-start-* flags.
             // We take the max because each layer enforces an independent floor
             // — waiting longer satisfies all of them, so we never need to sum.
+            // The clocks are the selected seat's. A mid-flight failover to a peer
+            // (below) does not re-pace on the peer: the retry is the rare path, and
+            // holding it for a floor would stack a second wait on a request that
+            // has already been refused once.
+            const seatClock = pacingClocks.seat(poolAccount?.alias ?? ACCOUNT_KEY_APIKEY);
             const nowForPacing = Date.now();
-            const pacingDelay = computePacingDelay(nowForPacing, lastRequestTime, pacingCfg);
+            const pacingDelay = computePacingDelay(nowForPacing, seatClock.lastRequestTime, pacingCfg);
             const thinkDelay = thinkTimeEnabled
-                ? computeThinkTimeDelay(nowForPacing, lastResponseTime, lastResponseTokens, thinkTimeCfg)
+                ? computeThinkTimeDelay(nowForPacing, seatClock.lastResponseTime, seatClock.lastResponseTokens, thinkTimeCfg)
                 : 0;
-            const sessionStartDelay = (sessionStartEnabled && lastResponseTime === 0 && lastRequestTime === 0)
+            const sessionStartDelay = (sessionStartEnabled && seatClock.lastResponseTime === 0 && seatClock.lastRequestTime === 0)
                 ? computeSessionStartDelay(sessionStartCfg)
                 : 0;
             const totalDelay = Math.max(pacingDelay, thinkDelay, sessionStartDelay);
             if (totalDelay > 0) {
+                pacingMs += totalDelay;
                 await new Promise(r => setTimeout(r, totalDelay));
             }
-            lastRequestTime = Date.now();
+            seatClock.lastRequestTime = Date.now();
             // Session ID: resolved through the rotation registry keyed by the selected
             // account (src/session-rotation.ts), applying the configured idle / jitter
             // / max-age / per-client policy. The template-build path resolves it
@@ -4583,6 +4600,13 @@ export async function startProxy(opts = {}) {
             };
             req.on('close', onClientClose);
             const startTime = Date.now();
+            // Upstream stamps for the timing split (src/timing.ts). The fetch stamp is
+            // set once, on the first attempt: a failover's earlier tries are provider
+            // time too, and the headers stamp is the attempt that was served.
+            let fetchStartedAt;
+            let upstreamHeadersAt;
+            let upstreamDoneAt;
+            const timingNow = () => foldTiming({ arrivedAt, queueMs, pacingMs, fetchStartedAt, upstreamHeadersAt, upstreamDoneAt, endedAt: Date.now() });
             // Tracks which accounts we've already tried this request — used by the
             // inside-request 429 failover loop to avoid re-hitting exhausted accounts.
             const triedAliases = new Set();
@@ -4611,12 +4635,14 @@ export async function startProxy(opts = {}) {
                 // Skipped in passthrough mode — passthrough means "don't shape the
                 // request to look like CC," and reordering is a form of shaping.
                 const outboundHeaders = passthrough ? headers : orderHeadersForOutbound(headers);
+                fetchStartedAt ??= Date.now();
                 upstream = await upstreamFetch(targetBase, {
                     method: req.method ?? 'POST',
                     headers: outboundHeaders,
                     body: finalBody ? new Uint8Array(finalBody) : undefined,
                     signal: upstreamAbort.signal,
                 });
+                upstreamHeadersAt = Date.now();
                 // Pool mode: capture rate-limit snapshot from the response. parseRateLimits
                 // returns status='rejected' on 429, which makes the next `select()` call
                 // route traffic away from this account until it resets.
@@ -4940,7 +4966,7 @@ export async function startProxy(opts = {}) {
                         // sent one, so the following request does not re-walk the chain.
                         attemptedProviders.add('claude');
                         providerCooldowns.note('claude', parseRetryAfterMs(upstream.headers.get('retry-after')));
-                        if (!pinnedAccount && await attemptPoolFallbackOn429(req, res, body, isOpenAI, attemptedProviders)) {
+                        if (!pinnedAccount && await attemptPoolFallbackOn429(req, res, body, isOpenAI, attemptedProviders, { queueMs, arrivedAt })) {
                             return;
                         }
                         if (allProvidersCooled(['codex', 'claude'], providerCooldowns)) {
@@ -4973,7 +4999,7 @@ export async function startProxy(opts = {}) {
                                 model: requestModel,
                                 inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0, thinkingTokens: 0,
                                 claim: rl.claim, util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
-                                latencyMs: Date.now() - startTime, status: 429, isStream: false, isOpenAI,
+                                latencyMs: Date.now() - startTime, status: 429, isStream: false, isOpenAI, timing: timingNow(),
                             });
                         }
                         res.writeHead(429, responseHeaders);
@@ -5068,7 +5094,7 @@ export async function startProxy(opts = {}) {
                     // Same bookkeeping as the other mid-flight site — see there.
                     attemptedProviders.add('claude');
                     providerCooldowns.note('claude', parseRetryAfterMs(upstream.headers.get('retry-after')));
-                    if (!pinnedAccount && await attemptPoolFallbackOn429(req, res, body, isOpenAI, attemptedProviders)) {
+                    if (!pinnedAccount && await attemptPoolFallbackOn429(req, res, body, isOpenAI, attemptedProviders, { queueMs, arrivedAt })) {
                         return;
                     }
                     if (allProvidersCooled(['codex', 'claude'], providerCooldowns)) {
@@ -5097,7 +5123,7 @@ export async function startProxy(opts = {}) {
                             model: requestModel,
                             inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreateTokens: 0, thinkingTokens: 0,
                             claim: rl.claim, util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
-                            latencyMs: Date.now() - startTime, status: 429, isStream: false, isOpenAI,
+                            latencyMs: Date.now() - startTime, status: 429, isStream: false, isOpenAI, timing: timingNow(),
                         });
                     }
                     res.writeHead(429, responseHeaders);
@@ -5172,6 +5198,11 @@ export async function startProxy(opts = {}) {
                     console.log(`[dario] #${requestCount} billing: headers absent (status=${upstream.status})`);
                 }
             }
+            Object.assign(responseHeaders, timingHeaders({
+                queueMs, pacingMs, arrivedAt,
+                fetchStartedAt: fetchStartedAt ?? Date.now(),
+                upstreamTtfbMs: (upstreamHeadersAt ?? 0) - (fetchStartedAt ?? 0),
+            }));
             res.writeHead(upstream.status, responseHeaders);
             if (isStream && upstream.body) {
                 // Analytics accumulators for streaming responses — filled by parsing
@@ -5252,8 +5283,10 @@ export async function startProxy(opts = {}) {
                     const MAX_LINE_LENGTH = 1_000_000; // 1MB max per SSE line
                     while (true) {
                         const { done, value } = await reader.read();
-                        if (done)
+                        if (done) {
+                            upstreamDoneAt = Date.now();
                             break;
+                        }
                         // Parse SSE events for analytics regardless of routing branch
                         if (analyticsDecoder && value) {
                             analyticsBuffer += analyticsDecoder.decode(value, { stream: true });
@@ -5371,8 +5404,7 @@ export async function startProxy(opts = {}) {
                 // would read, and using their (often zero) output_tokens would
                 // pin think time to baseMs+jitter on the next request needlessly.
                 if (upstream.status >= 200 && upstream.status < 300) {
-                    lastResponseTime = Date.now();
-                    lastResponseTokens = streamOutputTokens;
+                    pacingClocks.noteResponse(poolAccount?.alias ?? ACCOUNT_KEY_APIKEY, Date.now(), streamOutputTokens);
                 }
                 {
                     const rl = poolAccount?.rateLimit ?? parseRateLimits(upstream.headers);
@@ -5385,7 +5417,7 @@ export async function startProxy(opts = {}) {
                         cacheReadTokens: streamCacheReadTokens, cacheCreateTokens: streamCacheCreateTokens,
                         thinkingTokens: Math.round(streamThinkingChars / 4),
                         claim: rl.claim, util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
-                        latencyMs: Date.now() - startTime, status: upstream.status, isStream: true, isOpenAI,
+                        latencyMs: Date.now() - startTime, status: upstream.status, isStream: true, isOpenAI, timing: timingNow(),
                         continuation: continuationOf(guard, requestDepth),
                     });
                 }
@@ -5393,7 +5425,7 @@ export async function startProxy(opts = {}) {
                     ts: new Date().toISOString(), req: requestCount,
                     method: req.method ?? '', path: urlPath,
                     model: requestModel || undefined,
-                    status: upstream.status, latency_ms: Date.now() - startTime,
+                    status: upstream.status, latency_ms: Date.now() - startTime, ...timingLogFields(timingNow()),
                     in_tokens: streamInputTokens, out_tokens: streamOutputTokens,
                     cache_read: streamCacheReadTokens, cache_create: streamCacheCreateTokens,
                     claim: poolAccount?.rateLimit.claim,
@@ -5415,6 +5447,7 @@ export async function startProxy(opts = {}) {
             else {
                 // Buffer and forward
                 let responseBody = await upstream.text();
+                upstreamDoneAt = Date.now();
                 // Reverse tool name mapping so client sees original names
                 if (ccToolMap)
                     responseBody = reverseMapResponse(responseBody, ccToolMap, reqCtx);
@@ -5441,8 +5474,7 @@ export async function startProxy(opts = {}) {
                 // tokens when the body wasn't JSON or had no usage block — base +
                 // jitter still apply but the per-token component is 0.
                 if (upstream.status >= 200 && upstream.status < 300) {
-                    lastResponseTime = Date.now();
-                    lastResponseTokens = bufferedUsage?.outputTokens ?? 0;
+                    pacingClocks.noteResponse(poolAccount?.alias ?? ACCOUNT_KEY_APIKEY, Date.now(), bufferedUsage?.outputTokens ?? 0);
                 }
                 if (bufferedUsage) {
                     try {
@@ -5456,7 +5488,7 @@ export async function startProxy(opts = {}) {
                             cacheReadTokens: bufferedUsage.cacheReadTokens, cacheCreateTokens: bufferedUsage.cacheCreateTokens,
                             thinkingTokens: bufferedUsage.thinkingTokens,
                             claim: rl.claim, util5h: rl.util5h, util7d: rl.util7d, overageUtil: rl.overageUtil,
-                            latencyMs: Date.now() - startTime, status: upstream.status, isStream: false, isOpenAI,
+                            latencyMs: Date.now() - startTime, status: upstream.status, isStream: false, isOpenAI, timing: timingNow(),
                         });
                     }
                     catch { /* don't let analytics errors break responses */ }
@@ -5465,7 +5497,7 @@ export async function startProxy(opts = {}) {
                     ts: new Date().toISOString(), req: requestCount,
                     method: req.method ?? '', path: urlPath,
                     model: bufferedUsage?.model || requestModel || undefined,
-                    status: upstream.status, latency_ms: Date.now() - startTime,
+                    status: upstream.status, latency_ms: Date.now() - startTime, ...timingLogFields(timingNow()),
                     in_tokens: bufferedUsage?.inputTokens, out_tokens: bufferedUsage?.outputTokens,
                     cache_read: bufferedUsage?.cacheReadTokens, cache_create: bufferedUsage?.cacheCreateTokens,
                     claim: poolAccount?.rateLimit.claim,

package/dist/timing.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Per-request timing split — where a request's wall-clock time went.
+ *
+ * Until now a request carried one number, `latencyMs`, measured from the
+ * moment dario was ready to dispatch to the moment the response ended. It
+ * left out the wait for a concurrency slot and the rate governor's sleep,
+ * and it folded the provider's time and dario's own work into one figure.
+ * A user seeing 6 s per request could not tell whether that was Anthropic,
+ * the queue, the 500 ms pacing floor, or the proxy itself (dario#1341 asked
+ * for exactly LiteLLM's split: total, provider, overhead, queue, TTFT).
+ *
+ * Five stamps, all milliseconds, all measured by dario on the same clock:
+ *
+ *   queueMs         waited for a `--max-concurrent` slot
+ *   pacingMs        slept in the rate governor (pacing / think-time /
+ *                   session-start floors)
+ *   upstreamTtfbMs  first outbound byte → upstream response headers
+ *                   (the provider's time-to-first-byte, failover attempts
+ *                   included — that is provider time, not dario's)
+ *   upstreamMs      first outbound byte → upstream body fully consumed
+ *   totalMs         request arrived at dario → response ended
+ *
+ * and one derived figure, `overheadMs = total − upstream − queue − pacing`:
+ * the time dario itself spent reading the body, building the template,
+ * translating shapes and relaying SSE. Deliberate waits (queue, pacing) are
+ * reported on their own so nobody has to guess whether "overhead" includes
+ * them; it does not.
+ *
+ * Pure over its inputs. The proxy stamps the clock; this module only folds.
+ */
+export interface RequestTiming {
+    queueMs: number;
+    pacingMs: number;
+    upstreamTtfbMs: number;
+    upstreamMs: number;
+    totalMs: number;
+}
+/** Averages over the records in a window that carry a timing split. */
+export interface TimingStats {
+    /** Records the averages are over. 0 when no request carried timing (older rows, codex legs without a split). */
+    samples: number;
+    avgQueueMs: number;
+    avgPacingMs: number;
+    avgUpstreamTtfbMs: number;
+    avgUpstreamMs: number;
+    avgOverheadMs: number;
+}
+/** Response headers the client sees before the body, so a curl can read them without /analytics. */
+export declare const TIMING_HEADERS: {
+    readonly queue: "x-dario-queue-ms";
+    readonly pacing: "x-dario-pacing-ms";
+    readonly ttfb: "x-dario-upstream-ttfb-ms";
+    /** Arrival → first outbound byte, minus queue and pacing: dario's own pre-upstream work. */
+    readonly prep: "x-dario-prep-ms";
+};
+/** dario's own processing time: everything that is neither the provider nor a deliberate wait. Never negative. */
+export declare function overheadMs(t: RequestTiming): number;
+/** Fold a set of stamps into a record-ready split; clocks that never ticked read 0, never NaN or negative. */
+export declare function foldTiming(stamps: {
+    arrivedAt: number;
+    queueMs: number;
+    pacingMs: number;
+    /** Absent when nothing went upstream (rejected before dispatch). */
+    fetchStartedAt?: number;
+    upstreamHeadersAt?: number;
+    upstreamDoneAt?: number;
+    endedAt: number;
+}): RequestTiming;
+/** The headers known before the body starts. `prepMs` is what remains of arrival→fetch once the waits are taken out. */
+export declare function timingHeaders(t: {
+    queueMs: number;
+    pacingMs: number;
+    upstreamTtfbMs: number;
+    arrivedAt: number;
+    fetchStartedAt: number;
+}): Record<string, string>;
+/** The split as the request log's snake_case columns. */
+export declare function timingLogFields(t: RequestTiming): {
+    queue_ms: number;
+    pacing_ms: number;
+    upstream_ttfb_ms: number;
+    upstream_ms: number;
+    total_ms: number;
+    overhead_ms: number;
+};
+export declare function timingStats(timings: readonly (RequestTiming | undefined)[]): TimingStats;
+/** The five families `/metrics` exports as summaries, each read off the recent records that carry a split. */
+export declare const TIMING_METRIC_FAMILIES: ReadonlyArray<{
+    name: string;
+    help: string;
+    pick: (t: RequestTiming) => number;
+}>;

package/dist/timing.js

@@ -0,0 +1,93 @@
+/**
+ * Per-request timing split — where a request's wall-clock time went.
+ *
+ * Until now a request carried one number, `latencyMs`, measured from the
+ * moment dario was ready to dispatch to the moment the response ended. It
+ * left out the wait for a concurrency slot and the rate governor's sleep,
+ * and it folded the provider's time and dario's own work into one figure.
+ * A user seeing 6 s per request could not tell whether that was Anthropic,
+ * the queue, the 500 ms pacing floor, or the proxy itself (dario#1341 asked
+ * for exactly LiteLLM's split: total, provider, overhead, queue, TTFT).
+ *
+ * Five stamps, all milliseconds, all measured by dario on the same clock:
+ *
+ *   queueMs         waited for a `--max-concurrent` slot
+ *   pacingMs        slept in the rate governor (pacing / think-time /
+ *                   session-start floors)
+ *   upstreamTtfbMs  first outbound byte → upstream response headers
+ *                   (the provider's time-to-first-byte, failover attempts
+ *                   included — that is provider time, not dario's)
+ *   upstreamMs      first outbound byte → upstream body fully consumed
+ *   totalMs         request arrived at dario → response ended
+ *
+ * and one derived figure, `overheadMs = total − upstream − queue − pacing`:
+ * the time dario itself spent reading the body, building the template,
+ * translating shapes and relaying SSE. Deliberate waits (queue, pacing) are
+ * reported on their own so nobody has to guess whether "overhead" includes
+ * them; it does not.
+ *
+ * Pure over its inputs. The proxy stamps the clock; this module only folds.
+ */
+/** Response headers the client sees before the body, so a curl can read them without /analytics. */
+export const TIMING_HEADERS = {
+    queue: 'x-dario-queue-ms',
+    pacing: 'x-dario-pacing-ms',
+    ttfb: 'x-dario-upstream-ttfb-ms',
+    /** Arrival → first outbound byte, minus queue and pacing: dario's own pre-upstream work. */
+    prep: 'x-dario-prep-ms',
+};
+const nonNeg = (n) => (Number.isFinite(n) && n > 0 ? n : 0);
+/** dario's own processing time: everything that is neither the provider nor a deliberate wait. Never negative. */
+export function overheadMs(t) {
+    return Math.max(0, Math.round(t.totalMs - t.upstreamMs - t.queueMs - t.pacingMs));
+}
+/** Fold a set of stamps into a record-ready split; clocks that never ticked read 0, never NaN or negative. */
+export function foldTiming(stamps) {
+    const fetchAt = stamps.fetchStartedAt ?? stamps.endedAt;
+    const headersAt = stamps.upstreamHeadersAt ?? fetchAt;
+    const doneAt = stamps.upstreamDoneAt ?? headersAt;
+    return {
+        queueMs: Math.round(nonNeg(stamps.queueMs)),
+        pacingMs: Math.round(nonNeg(stamps.pacingMs)),
+        upstreamTtfbMs: Math.round(nonNeg(headersAt - fetchAt)),
+        upstreamMs: Math.round(nonNeg(doneAt - fetchAt)),
+        totalMs: Math.round(nonNeg(stamps.endedAt - stamps.arrivedAt)),
+    };
+}
+/** The headers known before the body starts. `prepMs` is what remains of arrival→fetch once the waits are taken out. */
+export function timingHeaders(t) {
+    const prep = Math.max(0, Math.round(t.fetchStartedAt - t.arrivedAt - t.queueMs - t.pacingMs));
+    return {
+        [TIMING_HEADERS.queue]: String(Math.round(nonNeg(t.queueMs))),
+        [TIMING_HEADERS.pacing]: String(Math.round(nonNeg(t.pacingMs))),
+        [TIMING_HEADERS.ttfb]: String(Math.round(nonNeg(t.upstreamTtfbMs))),
+        [TIMING_HEADERS.prep]: String(prep),
+    };
+}
+/** The split as the request log's snake_case columns. */
+export function timingLogFields(t) {
+    return { queue_ms: t.queueMs, pacing_ms: t.pacingMs, upstream_ttfb_ms: t.upstreamTtfbMs, upstream_ms: t.upstreamMs, total_ms: t.totalMs, overhead_ms: overheadMs(t) };
+}
+export function timingStats(timings) {
+    const rows = timings.filter((t) => t !== undefined);
+    if (rows.length === 0) {
+        return { samples: 0, avgQueueMs: 0, avgPacingMs: 0, avgUpstreamTtfbMs: 0, avgUpstreamMs: 0, avgOverheadMs: 0 };
+    }
+    const avg = (pick) => Math.round(rows.reduce((s, t) => s + pick(t), 0) / rows.length);
+    return {
+        samples: rows.length,
+        avgQueueMs: avg(t => t.queueMs),
+        avgPacingMs: avg(t => t.pacingMs),
+        avgUpstreamTtfbMs: avg(t => t.upstreamTtfbMs),
+        avgUpstreamMs: avg(t => t.upstreamMs),
+        avgOverheadMs: avg(overheadMs),
+    };
+}
+/** The five families `/metrics` exports as summaries, each read off the recent records that carry a split. */
+export const TIMING_METRIC_FAMILIES = [
+    { name: 'dario_queue_wait_ms', help: 'Time a request waited for a concurrency slot, ms.', pick: t => t.queueMs },
+    { name: 'dario_pacing_wait_ms', help: 'Time a request slept in the rate governor (pacing / think-time / session-start floors), ms.', pick: t => t.pacingMs },
+    { name: 'dario_upstream_ttfb_ms', help: 'First outbound byte to upstream response headers, ms (the provider\'s time to first byte).', pick: t => t.upstreamTtfbMs },
+    { name: 'dario_upstream_latency_ms', help: 'First outbound byte to upstream body fully consumed, ms (the provider\'s time).', pick: t => t.upstreamMs },
+    { name: 'dario_overhead_ms', help: 'Time dario itself spent on a request: total minus upstream, queue and pacing, ms.', pick: overheadMs },
+];

package/dist/tui/tabs/analytics.d.ts

@@ -22,6 +22,15 @@ interface SummaryShape {
         totalThinkingTokens: number;
         estimatedCost: number;
         avgLatencyMs: number;
+        /** The latency split (v6.9, src/timing.ts); absent on older proxies. */
+        timing?: {
+            samples: number;
+            avgQueueMs: number;
+            avgPacingMs: number;
+            avgUpstreamTtfbMs: number;
+            avgUpstreamMs: number;
+            avgOverheadMs: number;
+        };
         subscriptionPercent: number;
         billingBucketBreakdown: Record<string, number>;
     };

package/dist/tui/tabs/analytics.js

@@ -97,6 +97,13 @@ export const AnalyticsTab = {
         counters.push('  ' + renderKvRow('Tokens out', formatNumber(s.window.totalOutputTokens), w - 4));
         counters.push('  ' + renderKvRow('Thinking tokens', formatNumber(s.window.totalThinkingTokens), w - 4));
         counters.push('  ' + renderKvRow('Avg latency', `${Math.round(s.window.avgLatencyMs)}ms`, w - 4));
+        // The split behind that number (src/timing.ts), when the proxy is new
+        // enough to send it and a request in the window carried it.
+        const t = s.window.timing;
+        if (t && t.samples > 0) {
+            counters.push('  ' + renderKvRow('  upstream TTFB', `${t.avgUpstreamTtfbMs}ms  ${dim(`upstream ${t.avgUpstreamMs}ms`)}`, w - 4));
+            counters.push('  ' + renderKvRow('  dario overhead', `${t.avgOverheadMs}ms  ${dim(`queue ${t.avgQueueMs}ms · pacing ${t.avgPacingMs}ms`)}`, w - 4));
+        }
         counters.push('  ' + renderKvRow('Subscription %', `${s.window.subscriptionPercent.toFixed(0)}%`, w - 4));
         // The ledger's number: what everything since the first request would
         // have been billed on the metered API. Lifetime, not the window.

package/docs/analytics.md

@@ -41,10 +41,30 @@ Names ending in `_total` are counters; everything else is a gauge. Labels are es
 | `dario_consumer_requests_total`, `dario_consumer_estimated_cost_usd` | `consumer` (named key or `x-dario-consumer`) | since start |
 | `dario_queue_active`, `_queued`, `_max_concurrent`, `_max_queued`, `_stalled`, `_max_wait_ms`, `_consumers_active` | — | request queue |
 | `dario_request_latency_ms{quantile}` + `_sum`, `_count` | `quantile` ∈ 0.5, 0.9, 0.99 | nearest-rank over the most recent 1,000 records |
+| `dario_queue_wait_ms`, `dario_pacing_wait_ms`, `dario_upstream_ttfb_ms`, `dario_upstream_latency_ms`, `dario_overhead_ms` — each `{quantile}` + `_sum`, `_count` | `quantile` ∈ 0.5, 0.9, 0.99 | the timing split (below), nearest-rank over the recent records that carry one |
+| `dario_window_avg_upstream_ttfb_ms`, `_avg_upstream_latency_ms`, `_avg_overhead_ms`, `_avg_queue_wait_ms`, `_avg_pacing_wait_ms` | `window_minutes` | the split averaged over the rolling window; omitted until a request has carried one |
 | `dario_predicted_exhaustion_minutes` (omitted when unknown), `dario_burn_tokens_per_minute`, `dario_burn_cost_usd_per_minute` | — | window predictions |
 | `dario_ledger_requests_total`, `_api_equivalent_usd`, `_metered_usd`, `_recent_api_equivalent_usd{window}`, `_model_api_equivalent_usd{model,provider}`, `_model_requests_total{model,provider}`, `_consumer_api_equivalent_usd{consumer}` | `window` ∈ today, 7d, 30d | ledger (absent when the ledger is off) |
 
-Latency here is end-to-end through dario as the client saw it. Time-to-first-token and the split between dario's own overhead and the provider's time are not recorded per request today; they are the natural next columns on `RequestRecord` if a scrape wants them.
+`dario_request_latency_ms` is the number dario has always kept: dispatch to response end, as the client saw it. Since 6.9 every request also carries the split below, so the one figure can be read as its parts.
+
+## The timing split
+
+A request's wall-clock time through dario is five stamps (`src/timing.ts`), all in milliseconds, all on dario's clock:
+
+| leg | measures | where it shows |
+|---|---|---|
+| `queueMs` | waited for a `--max-concurrent` slot | `x-dario-queue-ms`, `dario_queue_wait_ms`, log `queue_ms` |
+| `pacingMs` | slept in the rate governor (`--pace-min`, think-time, session-start floors) | `x-dario-pacing-ms`, `dario_pacing_wait_ms`, log `pacing_ms` |
+| `upstreamTtfbMs` | first outbound byte → upstream response headers; the provider's time to first byte, failover attempts included | `x-dario-upstream-ttfb-ms`, `dario_upstream_ttfb_ms`, log `upstream_ttfb_ms` |
+| `upstreamMs` | first outbound byte → upstream body fully consumed | `dario_upstream_latency_ms`, log `upstream_ms` |
+| `totalMs` | request arrived at dario → response ended | log `total_ms` |
+
+and one derived figure, **overhead** = `total − upstream − queue − pacing`: the time dario itself spent reading the body, building the template, translating shapes and relaying SSE. The two deliberate waits are reported on their own so "overhead" never has to be guessed at; it does not include them. `x-dario-prep-ms` on the response is the pre-upstream part of that overhead (arrival → first outbound byte, minus the waits), the only part known before the body starts.
+
+The four `x-dario-*-ms` response headers ride on every served `/v1/messages` and `/v1/chat/completions` response, streamed or not, so a `curl -i` answers "was that Anthropic or dario?" without opening `/analytics`. They are added to the response dario writes to the client and change nothing on the wire to the provider; `--passthrough` stays byte-identical upstream.
+
+`GET /analytics` carries the split averaged over the window and since start as `window.timing` / `allTime.timing` (`samples` says how many rows had one), `dario status` prints it under **Avg latency**, and the TUI's Analytics tab shows it beneath the same row. A ChatGPT (codex) leg records its seat's TTFB and total the same way and its response carries the same four headers; the governor never runs for it, so its `pacingMs` is 0.
 
 A minimal scrape config:
 

package/docs/wire-fidelity.md

@@ -6,7 +6,7 @@ Between v3.22 and v3.28, dario's Claude backend closed six axes along which a pr
 |---|---|---|---|
 | **Request body key order** | v3.22 | Top-level JSON key order of the outbound `/v1/messages` body is captured from CC's wire serialization and replayed byte-for-byte. Schema bumped v2 → v3; stale caches quarantined. | Automatic once a live capture exists. The baked fallback carries a v2.1.112 snapshot. |
 | **Runtime / TLS ClientHello** | v3.23 | Classifies the runtime as `bun-match` / `bun-ja3-unverified` / `bun-bypassed` / `node-only` and surfaces the class + hint in `dario doctor`. Bun yields the BoringSSL ClientHello CC presents; Node yields OpenSSL's (distinct JA3). Being on Bun is necessary but not sufficient — only Bun ≥ v1.3.14 is measured to reproduce CC's JA3, so an older Bun is flagged `bun-ja3-unverified` rather than green (#813). | `--strict-tls` (or `DARIO_STRICT_TLS=1`) refuses to start proxy mode unless `bun-match`. `DARIO_QUIET_TLS=1` silences the startup banner in known-fine environments. |
-| **Inter-request timing** | v3.24 | Replaces the hardcoded 500 ms floor with a configurable floor + uniform jitter. A fixed 500 ms minimum-inter-arrival is an observable edge at scale; jitter dissolves the edge. | `--pace-min=MS`, `--pace-jitter=MS`, or `DARIO_PACE_MIN_MS` / `DARIO_PACE_JITTER_MS`. Legacy `DARIO_MIN_INTERVAL_MS` still honored. |
+| **Inter-request timing** | v3.24 | Replaces the hardcoded 500 ms floor with a configurable floor + uniform jitter. A fixed 500 ms minimum-inter-arrival is an observable edge at scale; jitter dissolves the edge. Since 6.9.1 the floor (and think-time / session-start) is kept **per seat**: the cadence the provider sees per account is unchanged, and a pool no longer paces its seats against each other. | `--pace-min=MS`, `--pace-jitter=MS`, or `DARIO_PACE_MIN_MS` / `DARIO_PACE_JITTER_MS`. Legacy `DARIO_MIN_INTERVAL_MS` still honored. |
 | **Stream-consumption shape** | v3.25 | When a downstream client disconnects mid-stream, CC keeps reading SSE to EOF. Dario now offers the same: drain upstream to completion even when the consumer has left. Default off — don't silently burn tokens. | `--drain-on-close` / `DARIO_DRAIN_ON_CLOSE=1`. Bounded by the existing 5-minute upstream timeout. |
 | **Session-ID lifecycle** | v3.28 | Generalizes the v3.19 hardcoded 15-minute idle rotation into a tunable `SessionRegistry` with jitter, max-age, and per-client bucketing. Fixes a v3.27 body/header rotation race as a side effect. | `--session-idle-rotate=MS` (default 900000), `--session-rotate-jitter=MS`, `--session-max-age=MS`, `--session-per-client`. Env mirrors `DARIO_SESSION_*`. Defaults are bit-identical to v3.27. |
 | **MCP / sub-agent reach** | v3.26 + v3.27 | Not a wire axis — a *surface* axis. CC-aware tools can now address dario directly (sub-agent from inside CC, MCP server for any MCP client), so operators don't have to switch terminals to introspect the proxy. Read-only by design. | `dario subagent install` / `dario mcp`. See [`mcp-server.md`](./mcp-server.md) and [`sub-agent.md`](./sub-agent.md). |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.8.18",
+  "version": "6.9.1",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {