@askalf/dario 6.9.0 → 6.9.2

package/README.md

@@ -473,6 +473,7 @@ The split isn't live, but it was announced once on short notice and could return
 | Credentials | Your own subscription tokens, never logged, redacted from errors, `0600` on disk in `0700` dirs |
 | Network | Binds `127.0.0.1` by default; upstream only to configured backends over HTTPS; hardcoded SSRF allow-list; refuses a non-loopback bind without `DARIO_API_KEY` |
 | Telemetry | **None.** No analytics, no tracking, nothing phones home |
+| Overhead | Measured in the open on every PR: [`scripts/bench-overhead.mjs`](./scripts/bench-overhead.mjs) runs a real proxy against an instant upstream beside a bare http server serving the same bytes. On loopback dario adds no measurable p50 wall time over that floor; the CPU per request is the number to watch, and the per-request [timing split](./docs/analytics.md#the-timing-split) shows it live |
 | This README | CI fails if the line count above drifts from `src/` or a link or anchor here stops resolving ([`check-readme-line-count.mjs`](./scripts/check-readme-line-count.mjs), [`check-readme-links.mjs`](./scripts/check-readme-links.mjs)); the TUI screenshots are rendered from the real TUI and the diagrams are briefed art, not screenshots ([how](./scripts/readme/README.md)) |
 
 ```bash

package/dist/pacing.d.ts

@@ -141,3 +141,32 @@ export declare function resolveSessionStartConfig(explicit?: {
     jitterMs?: number;
     stealth?: boolean;
 }, env?: NodeJS.ProcessEnv): SessionStartConfig;
+/**
+ * The governor's clocks, one set per seat (v6.9.1).
+ *
+ * The floors above model ONE account's cadence — that is what the provider
+ * observes. Through v6.9.0 the proxy kept a single `lastRequestTime` for the
+ * whole process, so a pool paced every seat against every other: a three-seat
+ * pool could put at most one request per floor on the wire, and a request to
+ * an idle seat waited for a stranger's request on a busy one (dario#1244's
+ * family — the pool running behind one seat's limits). Keying the clocks by
+ * seat keeps each account's observed rhythm exactly as before while the pool
+ * as a whole moves at pool speed. API-key mode has one seat and one clock.
+ */
+export interface SeatPacingState {
+    /** When the seat's last request STARTED (feeds the inter-request floor). */
+    lastRequestTime: number;
+    /** When the seat's last 2xx response COMPLETED (feeds think-time). */
+    lastResponseTime: number;
+    /** Output tokens of that response (feeds think-time's per-token term). */
+    lastResponseTokens: number;
+}
+export declare class PacingRegistry {
+    private readonly seats;
+    /** The seat's clocks, created at zero on first sight (a fresh seat is never paced). */
+    seat(key: string): SeatPacingState;
+    /** Stamp a completed 2xx response on the seat, for the next request's think-time. */
+    noteResponse(key: string, at: number, outputTokens: number): void;
+    /** Seats the registry has seen, for tests and status. */
+    keys(): string[];
+}

package/dist/pacing.js

@@ -140,3 +140,25 @@ export function resolveSessionStartConfig(explicit = {}, env = process.env) {
     const jitter = pickNonNegativeInt(explicit.jitterMs, env.DARIO_SESSION_START_JITTER_MS) ?? (stealth ? 3000 : 0);
     return { minMs: min, jitterMs: jitter };
 }
+export class PacingRegistry {
+    seats = new Map();
+    /** The seat's clocks, created at zero on first sight (a fresh seat is never paced). */
+    seat(key) {
+        let s = this.seats.get(key);
+        if (!s) {
+            s = { lastRequestTime: 0, lastResponseTime: 0, lastResponseTokens: 0 };
+            this.seats.set(key, s);
+        }
+        return s;
+    }
+    /** Stamp a completed 2xx response on the seat, for the next request's think-time. */
+    noteResponse(key, at, outputTokens) {
+        const s = this.seat(key);
+        s.lastResponseTime = at;
+        s.lastResponseTokens = outputTokens;
+    }
+    /** Seats the registry has seen, for tests and status. */
+    keys() {
+        return [...this.seats.keys()];
+    }
+}

package/dist/proxy.d.ts

@@ -636,6 +636,21 @@ export interface ProxyLogEntry {
  * null (logFile not configured). Errors are swallowed — log writes
  * must never break the request path.
  */
+/**
+ * The `data:` line of one SSE frame, without allocating a per-line array
+ * (the frame is `event: x\ndata: {...}\n\n`; the data line is the one that
+ * starts with the field name, at the start of the frame or after a newline).
+ * Null when the frame has no data line (a comment, a bare event).
+ */
+export declare function sseDataLine(frame: string): string | null;
+/**
+ * Whether the analytics tap needs to parse this frame at all: only the
+ * message_start usage, the message_delta usage and thinking deltas feed a
+ * number it keeps. A text or tool-input delta — most of any stream — is
+ * skipped before JSON.parse. Substring tests on the data line; a frame that
+ * happens to contain these words inside a text delta merely costs a parse.
+ */
+export declare function analyticsFrameOfInterest(dataLine: string): boolean;
 export declare function writeLogLine(stream: WriteStream | null, entry: ProxyLogEntry): void;
 export declare function sanitizeError(err: unknown): string;
 /**

package/dist/proxy.js

@@ -990,6 +990,31 @@ export function requiresClaudeLogin(poolSize, adminEnabled, hasUpstreamApiKey, n
  * null (logFile not configured). Errors are swallowed — log writes
  * must never break the request path.
  */
+/**
+ * The `data:` line of one SSE frame, without allocating a per-line array
+ * (the frame is `event: x\ndata: {...}\n\n`; the data line is the one that
+ * starts with the field name, at the start of the frame or after a newline).
+ * Null when the frame has no data line (a comment, a bare event).
+ */
+export function sseDataLine(frame) {
+    let at = frame.startsWith('data: ') ? 0 : frame.indexOf('\ndata: ');
+    if (at < 0)
+        return null;
+    if (at > 0)
+        at += 1;
+    const end = frame.indexOf('\n', at);
+    return end < 0 ? frame.slice(at) : frame.slice(at, end);
+}
+/**
+ * Whether the analytics tap needs to parse this frame at all: only the
+ * message_start usage, the message_delta usage and thinking deltas feed a
+ * number it keeps. A text or tool-input delta — most of any stream — is
+ * skipped before JSON.parse. Substring tests on the data line; a frame that
+ * happens to contain these words inside a text delta merely costs a parse.
+ */
+export function analyticsFrameOfInterest(dataLine) {
+    return dataLine.includes('"message_start"') || dataLine.includes('"message_delta"') || dataLine.includes('thinking_delta');
+}
 export function writeLogLine(stream, entry) {
     if (!stream)
         return;
@@ -1896,15 +1921,13 @@ export async function startProxy(opts = {}) {
     // 500ms floor keeps the default behavior identical to v3.23; `--pace-min`
     // and `--pace-jitter` let callers tune the distribution. Pure calc lives
     // in src/pacing.ts so the edge cases are unit-tested without timers.
-    const { computePacingDelay, resolvePacingConfig, computeThinkTimeDelay, resolveThinkTimeConfig, computeSessionStartDelay, resolveSessionStartConfig, } = await import('./pacing.js');
-    let lastRequestTime = 0;
-    // Behavioral smoothing state: when the last response *completed* and
-    // how many output tokens it had. Used by computeThinkTimeDelay to
-    // model human read-time before the next request. Distinct from
-    // lastRequestTime (which tracks when the last request *started* and
-    // feeds the inter-request floor).
-    let lastResponseTime = 0;
-    let lastResponseTokens = 0;
+    const { computePacingDelay, resolvePacingConfig, computeThinkTimeDelay, resolveThinkTimeConfig, computeSessionStartDelay, resolveSessionStartConfig, PacingRegistry, } = await import('./pacing.js');
+    // The governor's clocks, PER SEAT (v6.9.1, src/pacing.ts PacingRegistry):
+    // when a seat's last request started (the inter-request floor) and when its
+    // last 2xx response completed with how many output tokens (think-time).
+    // One clock for the whole proxy used to pace every seat against every
+    // other, so a pool moved at one seat's speed. API-key mode is one seat.
+    const pacingClocks = new PacingRegistry();
     // --stealth toggles the behavioral-stealth preset across all three
     // pacing layers (pace, think-time, session-start). When on, each
     // resolver's zero-default flips to its stealth preset; explicit flags
@@ -1932,7 +1955,7 @@ export async function startProxy(opts = {}) {
     if (verbose) {
         if (stealth)
             console.log('[dario] stealth: behavioral-stealth preset active (pace+think+session-start defaults non-zero)');
-        console.log(`[dario] pacing: min=${pacingCfg.minGapMs}ms jitter=${pacingCfg.jitterMs}ms`);
+        console.log(`[dario] pacing: min=${pacingCfg.minGapMs}ms jitter=${pacingCfg.jitterMs}ms (per seat)`);
         if (thinkTimeEnabled) {
             console.log(`[dario] think-time: base=${thinkTimeCfg.baseMs}ms perToken=${thinkTimeCfg.perTokenMs}ms jitter=${thinkTimeCfg.jitterMs}ms max=${thinkTimeCfg.maxMs}ms`);
         }
@@ -4079,7 +4102,14 @@ export async function startProxy(opts = {}) {
             // hand the client an OpenAI-shaped response for a Messages request. This
             // route still has no reverse translation; the codex route above does,
             // which is why it takes both shapes and this one does not.
-            const fallbackModel = selectPoolFallbackForBody(body)[0] ?? null;
+            // Only the drained-pool branch below reads this, and computing it means
+            // parsing the whole client body again — on a 200 KB Claude Code turn
+            // that was ~2% of dario's own CPU on every request that never took the
+            // branch (scripts/bench-overhead.mjs profile, v6.9.2). Resolved only
+            // when the branch can be taken.
+            const fallbackModel = (!upstreamApiKey && !poolAccount && openaiBackend && isOpenAI)
+                ? (selectPoolFallbackForBody(body)[0] ?? null)
+                : null;
             if (!upstreamApiKey && !poolAccount && fallbackModel && openaiBackend && isOpenAI) {
                 const fallbackBody = buildPoolFallbackBody(body, fallbackModel);
                 if (!fallbackBody) {
@@ -4506,12 +4536,17 @@ export async function startProxy(opts = {}) {
             //                          Opt-in via --session-start-* flags.
             // We take the max because each layer enforces an independent floor
             // — waiting longer satisfies all of them, so we never need to sum.
+            // The clocks are the selected seat's. A mid-flight failover to a peer
+            // (below) does not re-pace on the peer: the retry is the rare path, and
+            // holding it for a floor would stack a second wait on a request that
+            // has already been refused once.
+            const seatClock = pacingClocks.seat(poolAccount?.alias ?? ACCOUNT_KEY_APIKEY);
             const nowForPacing = Date.now();
-            const pacingDelay = computePacingDelay(nowForPacing, lastRequestTime, pacingCfg);
+            const pacingDelay = computePacingDelay(nowForPacing, seatClock.lastRequestTime, pacingCfg);
             const thinkDelay = thinkTimeEnabled
-                ? computeThinkTimeDelay(nowForPacing, lastResponseTime, lastResponseTokens, thinkTimeCfg)
+                ? computeThinkTimeDelay(nowForPacing, seatClock.lastResponseTime, seatClock.lastResponseTokens, thinkTimeCfg)
                 : 0;
-            const sessionStartDelay = (sessionStartEnabled && lastResponseTime === 0 && lastRequestTime === 0)
+            const sessionStartDelay = (sessionStartEnabled && seatClock.lastResponseTime === 0 && seatClock.lastRequestTime === 0)
                 ? computeSessionStartDelay(sessionStartCfg)
                 : 0;
             const totalDelay = Math.max(pacingDelay, thinkDelay, sessionStartDelay);
@@ -4519,7 +4554,7 @@ export async function startProxy(opts = {}) {
                 pacingMs += totalDelay;
                 await new Promise(r => setTimeout(r, totalDelay));
             }
-            lastRequestTime = Date.now();
+            seatClock.lastRequestTime = Date.now();
             // Session ID: resolved through the rotation registry keyed by the selected
             // account (src/session-rotation.ts), applying the configured idle / jitter
             // / max-age / per-client policy. The template-build path resolves it
@@ -5284,14 +5319,22 @@ export async function startProxy(opts = {}) {
                             upstreamDoneAt = Date.now();
                             break;
                         }
-                        // Parse SSE events for analytics regardless of routing branch
+                        // Parse SSE events for analytics regardless of routing branch.
+                        // Only three frame kinds carry a number this tap reads — the
+                        // message_start usage, the message_delta usage, and thinking
+                        // deltas (for the ~4-chars-per-token estimate). Every other frame
+                        // is a text or tool delta, i.e. most of a stream, and parsing
+                        // them was the single largest cost in dario's own streaming path
+                        // (scripts/bench-overhead.mjs profile, v6.9.2). A substring test
+                        // on the data line decides before JSON.parse; the parse itself
+                        // is unchanged for the frames that pass.
                         if (analyticsDecoder && value) {
                             analyticsBuffer += analyticsDecoder.decode(value, { stream: true });
                             const parts = analyticsBuffer.split('\n\n');
                             analyticsBuffer = parts.pop() ?? '';
                             for (const part of parts) {
-                                const dataLine = part.split('\n').find(l => l.startsWith('data: '));
-                                if (!dataLine)
+                                const dataLine = sseDataLine(part);
+                                if (!dataLine || !analyticsFrameOfInterest(dataLine))
                                     continue;
                                 try {
                                     const e = JSON.parse(dataLine.slice(6));
@@ -5401,8 +5444,7 @@ export async function startProxy(opts = {}) {
                 // would read, and using their (often zero) output_tokens would
                 // pin think time to baseMs+jitter on the next request needlessly.
                 if (upstream.status >= 200 && upstream.status < 300) {
-                    lastResponseTime = Date.now();
-                    lastResponseTokens = streamOutputTokens;
+                    pacingClocks.noteResponse(poolAccount?.alias ?? ACCOUNT_KEY_APIKEY, Date.now(), streamOutputTokens);
                 }
                 {
                     const rl = poolAccount?.rateLimit ?? parseRateLimits(upstream.headers);
@@ -5472,8 +5514,7 @@ export async function startProxy(opts = {}) {
                 // tokens when the body wasn't JSON or had no usage block — base +
                 // jitter still apply but the per-token component is 0.
                 if (upstream.status >= 200 && upstream.status < 300) {
-                    lastResponseTime = Date.now();
-                    lastResponseTokens = bufferedUsage?.outputTokens ?? 0;
+                    pacingClocks.noteResponse(poolAccount?.alias ?? ACCOUNT_KEY_APIKEY, Date.now(), bufferedUsage?.outputTokens ?? 0);
                 }
                 if (bufferedUsage) {
                     try {

package/docs/wire-fidelity.md

@@ -6,7 +6,7 @@ Between v3.22 and v3.28, dario's Claude backend closed six axes along which a pr
 |---|---|---|---|
 | **Request body key order** | v3.22 | Top-level JSON key order of the outbound `/v1/messages` body is captured from CC's wire serialization and replayed byte-for-byte. Schema bumped v2 → v3; stale caches quarantined. | Automatic once a live capture exists. The baked fallback carries a v2.1.112 snapshot. |
 | **Runtime / TLS ClientHello** | v3.23 | Classifies the runtime as `bun-match` / `bun-ja3-unverified` / `bun-bypassed` / `node-only` and surfaces the class + hint in `dario doctor`. Bun yields the BoringSSL ClientHello CC presents; Node yields OpenSSL's (distinct JA3). Being on Bun is necessary but not sufficient — only Bun ≥ v1.3.14 is measured to reproduce CC's JA3, so an older Bun is flagged `bun-ja3-unverified` rather than green (#813). | `--strict-tls` (or `DARIO_STRICT_TLS=1`) refuses to start proxy mode unless `bun-match`. `DARIO_QUIET_TLS=1` silences the startup banner in known-fine environments. |
-| **Inter-request timing** | v3.24 | Replaces the hardcoded 500 ms floor with a configurable floor + uniform jitter. A fixed 500 ms minimum-inter-arrival is an observable edge at scale; jitter dissolves the edge. | `--pace-min=MS`, `--pace-jitter=MS`, or `DARIO_PACE_MIN_MS` / `DARIO_PACE_JITTER_MS`. Legacy `DARIO_MIN_INTERVAL_MS` still honored. |
+| **Inter-request timing** | v3.24 | Replaces the hardcoded 500 ms floor with a configurable floor + uniform jitter. A fixed 500 ms minimum-inter-arrival is an observable edge at scale; jitter dissolves the edge. Since 6.9.1 the floor (and think-time / session-start) is kept **per seat**: the cadence the provider sees per account is unchanged, and a pool no longer paces its seats against each other. | `--pace-min=MS`, `--pace-jitter=MS`, or `DARIO_PACE_MIN_MS` / `DARIO_PACE_JITTER_MS`. Legacy `DARIO_MIN_INTERVAL_MS` still honored. |
 | **Stream-consumption shape** | v3.25 | When a downstream client disconnects mid-stream, CC keeps reading SSE to EOF. Dario now offers the same: drain upstream to completion even when the consumer has left. Default off — don't silently burn tokens. | `--drain-on-close` / `DARIO_DRAIN_ON_CLOSE=1`. Bounded by the existing 5-minute upstream timeout. |
 | **Session-ID lifecycle** | v3.28 | Generalizes the v3.19 hardcoded 15-minute idle rotation into a tunable `SessionRegistry` with jitter, max-age, and per-client bucketing. Fixes a v3.27 body/header rotation race as a side effect. | `--session-idle-rotate=MS` (default 900000), `--session-rotate-jitter=MS`, `--session-max-age=MS`, `--session-per-client`. Env mirrors `DARIO_SESSION_*`. Defaults are bit-identical to v3.27. |
 | **MCP / sub-agent reach** | v3.26 + v3.27 | Not a wire axis — a *surface* axis. CC-aware tools can now address dario directly (sub-agent from inside CC, MCP server for any MCP client), so operators don't have to switch terminals to introspect the proxy. Read-only by design. | `dario subagent install` / `dario mcp`. See [`mcp-server.md`](./mcp-server.md) and [`sub-agent.md`](./sub-agent.md). |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.9.0",
+  "version": "6.9.2",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {
@@ -42,7 +42,8 @@
     "fix:pkg": "node -e \"const fs=require('fs');fs.writeFileSync('package.json',JSON.stringify(JSON.parse(fs.readFileSync('package.json','utf-8')),null,2)+'\\n')\"",
     "audit:tui": "node tools/tui-audit/audit.mjs",
     "readme:assets": "node scripts/readme/terminal.mjs && node scripts/readme/tui.mjs",
-    "check:readme": "node scripts/check-readme-line-count.mjs && node scripts/check-readme-links.mjs"
+    "check:readme": "node scripts/check-readme-line-count.mjs && node scripts/check-readme-links.mjs",
+    "bench": "node scripts/bench-overhead.mjs"
   },
   "keywords": [
     "llm",