@askalf/dario 6.9.0 → 6.9.1

package/dist/pacing.d.ts

@@ -141,3 +141,32 @@ export declare function resolveSessionStartConfig(explicit?: {
     jitterMs?: number;
     stealth?: boolean;
 }, env?: NodeJS.ProcessEnv): SessionStartConfig;
+/**
+ * The governor's clocks, one set per seat (v6.9.1).
+ *
+ * The floors above model ONE account's cadence — that is what the provider
+ * observes. Through v6.9.0 the proxy kept a single `lastRequestTime` for the
+ * whole process, so a pool paced every seat against every other: a three-seat
+ * pool could put at most one request per floor on the wire, and a request to
+ * an idle seat waited for a stranger's request on a busy one (dario#1244's
+ * family — the pool running behind one seat's limits). Keying the clocks by
+ * seat keeps each account's observed rhythm exactly as before while the pool
+ * as a whole moves at pool speed. API-key mode has one seat and one clock.
+ */
+export interface SeatPacingState {
+    /** When the seat's last request STARTED (feeds the inter-request floor). */
+    lastRequestTime: number;
+    /** When the seat's last 2xx response COMPLETED (feeds think-time). */
+    lastResponseTime: number;
+    /** Output tokens of that response (feeds think-time's per-token term). */
+    lastResponseTokens: number;
+}
+export declare class PacingRegistry {
+    private readonly seats;
+    /** The seat's clocks, created at zero on first sight (a fresh seat is never paced). */
+    seat(key: string): SeatPacingState;
+    /** Stamp a completed 2xx response on the seat, for the next request's think-time. */
+    noteResponse(key: string, at: number, outputTokens: number): void;
+    /** Seats the registry has seen, for tests and status. */
+    keys(): string[];
+}

package/dist/pacing.js

@@ -140,3 +140,25 @@ export function resolveSessionStartConfig(explicit = {}, env = process.env) {
     const jitter = pickNonNegativeInt(explicit.jitterMs, env.DARIO_SESSION_START_JITTER_MS) ?? (stealth ? 3000 : 0);
     return { minMs: min, jitterMs: jitter };
 }
+export class PacingRegistry {
+    seats = new Map();
+    /** The seat's clocks, created at zero on first sight (a fresh seat is never paced). */
+    seat(key) {
+        let s = this.seats.get(key);
+        if (!s) {
+            s = { lastRequestTime: 0, lastResponseTime: 0, lastResponseTokens: 0 };
+            this.seats.set(key, s);
+        }
+        return s;
+    }
+    /** Stamp a completed 2xx response on the seat, for the next request's think-time. */
+    noteResponse(key, at, outputTokens) {
+        const s = this.seat(key);
+        s.lastResponseTime = at;
+        s.lastResponseTokens = outputTokens;
+    }
+    /** Seats the registry has seen, for tests and status. */
+    keys() {
+        return [...this.seats.keys()];
+    }
+}

package/dist/proxy.js

@@ -1896,15 +1896,13 @@ export async function startProxy(opts = {}) {
     // 500ms floor keeps the default behavior identical to v3.23; `--pace-min`
     // and `--pace-jitter` let callers tune the distribution. Pure calc lives
     // in src/pacing.ts so the edge cases are unit-tested without timers.
-    const { computePacingDelay, resolvePacingConfig, computeThinkTimeDelay, resolveThinkTimeConfig, computeSessionStartDelay, resolveSessionStartConfig, } = await import('./pacing.js');
-    let lastRequestTime = 0;
-    // Behavioral smoothing state: when the last response *completed* and
-    // how many output tokens it had. Used by computeThinkTimeDelay to
-    // model human read-time before the next request. Distinct from
-    // lastRequestTime (which tracks when the last request *started* and
-    // feeds the inter-request floor).
-    let lastResponseTime = 0;
-    let lastResponseTokens = 0;
+    const { computePacingDelay, resolvePacingConfig, computeThinkTimeDelay, resolveThinkTimeConfig, computeSessionStartDelay, resolveSessionStartConfig, PacingRegistry, } = await import('./pacing.js');
+    // The governor's clocks, PER SEAT (v6.9.1, src/pacing.ts PacingRegistry):
+    // when a seat's last request started (the inter-request floor) and when its
+    // last 2xx response completed with how many output tokens (think-time).
+    // One clock for the whole proxy used to pace every seat against every
+    // other, so a pool moved at one seat's speed. API-key mode is one seat.
+    const pacingClocks = new PacingRegistry();
     // --stealth toggles the behavioral-stealth preset across all three
     // pacing layers (pace, think-time, session-start). When on, each
     // resolver's zero-default flips to its stealth preset; explicit flags
@@ -1932,7 +1930,7 @@ export async function startProxy(opts = {}) {
     if (verbose) {
         if (stealth)
             console.log('[dario] stealth: behavioral-stealth preset active (pace+think+session-start defaults non-zero)');
-        console.log(`[dario] pacing: min=${pacingCfg.minGapMs}ms jitter=${pacingCfg.jitterMs}ms`);
+        console.log(`[dario] pacing: min=${pacingCfg.minGapMs}ms jitter=${pacingCfg.jitterMs}ms (per seat)`);
         if (thinkTimeEnabled) {
             console.log(`[dario] think-time: base=${thinkTimeCfg.baseMs}ms perToken=${thinkTimeCfg.perTokenMs}ms jitter=${thinkTimeCfg.jitterMs}ms max=${thinkTimeCfg.maxMs}ms`);
         }
@@ -4506,12 +4504,17 @@ export async function startProxy(opts = {}) {
             //                          Opt-in via --session-start-* flags.
             // We take the max because each layer enforces an independent floor
             // — waiting longer satisfies all of them, so we never need to sum.
+            // The clocks are the selected seat's. A mid-flight failover to a peer
+            // (below) does not re-pace on the peer: the retry is the rare path, and
+            // holding it for a floor would stack a second wait on a request that
+            // has already been refused once.
+            const seatClock = pacingClocks.seat(poolAccount?.alias ?? ACCOUNT_KEY_APIKEY);
             const nowForPacing = Date.now();
-            const pacingDelay = computePacingDelay(nowForPacing, lastRequestTime, pacingCfg);
+            const pacingDelay = computePacingDelay(nowForPacing, seatClock.lastRequestTime, pacingCfg);
             const thinkDelay = thinkTimeEnabled
-                ? computeThinkTimeDelay(nowForPacing, lastResponseTime, lastResponseTokens, thinkTimeCfg)
+                ? computeThinkTimeDelay(nowForPacing, seatClock.lastResponseTime, seatClock.lastResponseTokens, thinkTimeCfg)
                 : 0;
-            const sessionStartDelay = (sessionStartEnabled && lastResponseTime === 0 && lastRequestTime === 0)
+            const sessionStartDelay = (sessionStartEnabled && seatClock.lastResponseTime === 0 && seatClock.lastRequestTime === 0)
                 ? computeSessionStartDelay(sessionStartCfg)
                 : 0;
             const totalDelay = Math.max(pacingDelay, thinkDelay, sessionStartDelay);
@@ -4519,7 +4522,7 @@ export async function startProxy(opts = {}) {
                 pacingMs += totalDelay;
                 await new Promise(r => setTimeout(r, totalDelay));
             }
-            lastRequestTime = Date.now();
+            seatClock.lastRequestTime = Date.now();
             // Session ID: resolved through the rotation registry keyed by the selected
             // account (src/session-rotation.ts), applying the configured idle / jitter
             // / max-age / per-client policy. The template-build path resolves it
@@ -5401,8 +5404,7 @@ export async function startProxy(opts = {}) {
                 // would read, and using their (often zero) output_tokens would
                 // pin think time to baseMs+jitter on the next request needlessly.
                 if (upstream.status >= 200 && upstream.status < 300) {
-                    lastResponseTime = Date.now();
-                    lastResponseTokens = streamOutputTokens;
+                    pacingClocks.noteResponse(poolAccount?.alias ?? ACCOUNT_KEY_APIKEY, Date.now(), streamOutputTokens);
                 }
                 {
                     const rl = poolAccount?.rateLimit ?? parseRateLimits(upstream.headers);
@@ -5472,8 +5474,7 @@ export async function startProxy(opts = {}) {
                 // tokens when the body wasn't JSON or had no usage block — base +
                 // jitter still apply but the per-token component is 0.
                 if (upstream.status >= 200 && upstream.status < 300) {
-                    lastResponseTime = Date.now();
-                    lastResponseTokens = bufferedUsage?.outputTokens ?? 0;
+                    pacingClocks.noteResponse(poolAccount?.alias ?? ACCOUNT_KEY_APIKEY, Date.now(), bufferedUsage?.outputTokens ?? 0);
                 }
                 if (bufferedUsage) {
                     try {

package/docs/wire-fidelity.md

@@ -6,7 +6,7 @@ Between v3.22 and v3.28, dario's Claude backend closed six axes along which a pr
 |---|---|---|---|
 | **Request body key order** | v3.22 | Top-level JSON key order of the outbound `/v1/messages` body is captured from CC's wire serialization and replayed byte-for-byte. Schema bumped v2 → v3; stale caches quarantined. | Automatic once a live capture exists. The baked fallback carries a v2.1.112 snapshot. |
 | **Runtime / TLS ClientHello** | v3.23 | Classifies the runtime as `bun-match` / `bun-ja3-unverified` / `bun-bypassed` / `node-only` and surfaces the class + hint in `dario doctor`. Bun yields the BoringSSL ClientHello CC presents; Node yields OpenSSL's (distinct JA3). Being on Bun is necessary but not sufficient — only Bun ≥ v1.3.14 is measured to reproduce CC's JA3, so an older Bun is flagged `bun-ja3-unverified` rather than green (#813). | `--strict-tls` (or `DARIO_STRICT_TLS=1`) refuses to start proxy mode unless `bun-match`. `DARIO_QUIET_TLS=1` silences the startup banner in known-fine environments. |
-| **Inter-request timing** | v3.24 | Replaces the hardcoded 500 ms floor with a configurable floor + uniform jitter. A fixed 500 ms minimum-inter-arrival is an observable edge at scale; jitter dissolves the edge. | `--pace-min=MS`, `--pace-jitter=MS`, or `DARIO_PACE_MIN_MS` / `DARIO_PACE_JITTER_MS`. Legacy `DARIO_MIN_INTERVAL_MS` still honored. |
+| **Inter-request timing** | v3.24 | Replaces the hardcoded 500 ms floor with a configurable floor + uniform jitter. A fixed 500 ms minimum-inter-arrival is an observable edge at scale; jitter dissolves the edge. Since 6.9.1 the floor (and think-time / session-start) is kept **per seat**: the cadence the provider sees per account is unchanged, and a pool no longer paces its seats against each other. | `--pace-min=MS`, `--pace-jitter=MS`, or `DARIO_PACE_MIN_MS` / `DARIO_PACE_JITTER_MS`. Legacy `DARIO_MIN_INTERVAL_MS` still honored. |
 | **Stream-consumption shape** | v3.25 | When a downstream client disconnects mid-stream, CC keeps reading SSE to EOF. Dario now offers the same: drain upstream to completion even when the consumer has left. Default off — don't silently burn tokens. | `--drain-on-close` / `DARIO_DRAIN_ON_CLOSE=1`. Bounded by the existing 5-minute upstream timeout. |
 | **Session-ID lifecycle** | v3.28 | Generalizes the v3.19 hardcoded 15-minute idle rotation into a tunable `SessionRegistry` with jitter, max-age, and per-client bucketing. Fixes a v3.27 body/header rotation race as a side effect. | `--session-idle-rotate=MS` (default 900000), `--session-rotate-jitter=MS`, `--session-max-age=MS`, `--session-per-client`. Env mirrors `DARIO_SESSION_*`. Defaults are bit-identical to v3.27. |
 | **MCP / sub-agent reach** | v3.26 + v3.27 | Not a wire axis — a *surface* axis. CC-aware tools can now address dario directly (sub-agent from inside CC, MCP server for any MCP client), so operators don't have to switch terminals to introspect the proxy. Read-only by design. | `dario subagent install` / `dario mcp`. See [`mcp-server.md`](./mcp-server.md) and [`sub-agent.md`](./sub-agent.md). |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.9.0",
+  "version": "6.9.1",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {