saros-proxy 0.7.4 → 0.10.0

package/dist/proxy.js

@@ -8,11 +8,177 @@ import { Hono } from 'hono';
 import { cors } from 'hono/cors';
 import { rateLimiter } from 'hono-rate-limiter';
 import crypto from 'node:crypto';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
 import { createProxyState, selectKeyForRequest, failoverRequest, completeRequest, markKeyFailed, markKeySucceeded, classifyHttpError, } from './proxy-logic.js';
 import { logger, maskKey } from './logger.js';
-import { getAllUsage, isScraperRunning } from './scraper.js';
 import { MAX_BODY_SIZE, MAX_RETRIES, RATE_LIMIT_WINDOW_MS, RATE_LIMIT_MAX, } from './constants.js';
 import { getModelsList } from './models-fetcher.js';
+import { maybeRefreshUsage } from './usage-client.js';
+import { recordModelRequest } from './model-stats.js';
+import { recordKeyTokens } from './token-usage.js';
+import { getProvider, inferProvider } from './providers/index.js';
+/** Canonical client-facing chat route prefix (the opencode-go shape). */
+const CANONICAL_CHAT_BASE = '/zen/go/v1';
+/**
+ * Resolve the upstream URL for one attempt: per-provider base URL + path
+ * remapping. Clients always speak canonical saros routes (/zen/go/v1/<rest>,
+ * the opencode-go shape); requests routed to a provider with a different
+ * chat surface get the prefix remapped (e.g. /provider/v1 for commandcode).
+ */
+export function resolveUpstreamUrl(config, provider, path) {
+    const base = (config.upstreams?.[provider.id] ?? (provider.id === 'opencode-go' ? config.upstreamBaseUrl : provider.baseUrl))
+        .replace(/\/+$/, '');
+    if (provider.chatBasePath === CANONICAL_CHAT_BASE) {
+        return buildUpstreamUrl(base, path);
+    }
+    const remapped = path.startsWith(CANONICAL_CHAT_BASE)
+        ? provider.chatBasePath + path.slice(CANONICAL_CHAT_BASE.length)
+        : path;
+    return buildUpstreamUrl(base, remapped);
+}
+/**
+ * Extract a provider-suffix routing hint from a model id
+ * (e.g. 'claude-…@commandcode' → 'commandcode'). Returns null when absent.
+ */
+export function parseProviderSuffix(modelId) {
+    if (!modelId)
+        return null;
+    const at = modelId.lastIndexOf('@');
+    if (at <= 0 || at === modelId.length - 1)
+        return null;
+    return modelId.slice(at + 1);
+}
+/** Strip the @provider routing suffix from a model id for upstream forwarding. */
+export function stripProviderSuffix(modelId) {
+    const at = modelId.lastIndexOf('@');
+    return at > 0 ? modelId.slice(0, at) : modelId;
+}
+function generateRequestId() {
+    return crypto.randomUUID();
+}
+/**
+ * Opt-in diagnostics: when SAROS_CAPTURE_4XX=1, write the full request
+ * context of every upstream 4xx to <config dir>/captures/ so provider-side
+ * errors (role validation, plan gating) can be replayed and debugged.
+ * Never enabled by default — bodies may contain user content.
+ */
+function captureFailedRequest(ctx, status, errorBody) {
+    if (process.env.SAROS_CAPTURE_4XX !== '1')
+        return;
+    if (status < 400 || status >= 500)
+        return;
+    try {
+        const dir = join(homedir(), '.config', 'saros', 'captures');
+        mkdirSync(dir, { recursive: true });
+        const file = join(dir, `${Date.now()}-${ctx.requestId.slice(0, 8)}.json`);
+        writeFileSync(file, JSON.stringify({
+            ts: new Date().toISOString(),
+            requestId: ctx.requestId,
+            status,
+            method: ctx.method,
+            path: ctx.path,
+            model: ctx.modelId ?? null,
+            kind: ctx.kind,
+            upstreamError: errorBody.slice(0, 2000),
+            requestBody: ctx.bodyText.slice(0, 100_000),
+        }, null, 2), 'utf-8');
+        logger.warn({ requestId: ctx.requestId, file }, 'captured failing request (SAROS_CAPTURE_4XX)');
+    }
+    catch {
+        // diagnostics must never break the proxy
+    }
+}
+/**
+ * Resolve the model id to send upstream for one attempt. An '@provider'
+ * suffix is saros's routing shim and is always stripped; otherwise, when the
+ * serving provider names the same model differently (bare name matches its
+ * catalog under a vendor-prefixed id — e.g. 'deepseek-v4-flash' →
+ * 'deepseek/deepseek-v4-flash' on commandcode), the provider's native id is
+ * used so the upstream recognizes it. null when no rewrite is needed.
+ */
+function targetModelId(modelId, provider) {
+    if (!modelId)
+        return null;
+    if (parseProviderSuffix(modelId))
+        return stripProviderSuffix(modelId);
+    const bare = modelId.split('/').pop() ?? modelId;
+    const native = provider.resolveNativeId?.(bare.toLowerCase());
+    return native && native !== modelId ? native : null;
+}
+/**
+ * Stable conversation fingerprint. The same conversation (same model, same
+ * first user turn) maps to the same id on every request, so upstream routing
+ * and prompt caching stay coherent, while a different conversation gets a
+ * different id. The system prompt is deliberately excluded: harnesses
+ * rewrite it on every turn (timestamps, injected context), which would make
+ * the id change per request and defeat the purpose.
+ */
+function conversationSessionId(parsed, modelId) {
+    const messages = Array.isArray(parsed.messages) ? parsed.messages : [];
+    const firstUser = messages.find((message) => typeof message === 'object' && message !== null && !Array.isArray(message)
+        && 'role' in message && message.role === 'user');
+    const seed = firstUser ?? messages.slice(0, 2);
+    return crypto
+        .createHash('sha256')
+        .update(`${modelId ?? String(parsed.model ?? '')}\n${JSON.stringify(seed).slice(0, 4_000)}`)
+        .digest('hex')
+        .slice(0, 32);
+}
+/**
+ * Prepare the outbound body for one attempt in a single JSON pass:
+ *  - rewrite the model id for the serving provider (see targetModelId);
+ *  - ask for streamed token usage (`stream_options.include_usage`) on chat
+ *    completions, unless the client set the option itself — an explicit
+ *    `false` is respected, otherwise the upstream may withhold the final
+ *    usage chunk and per-key token accounting goes blind;
+ *  - derive a conversation session id when the provider needs one and the
+ *    client didn't send it (see conversationSessionId).
+ *
+ * The original text is returned untouched when nothing changes (or the body
+ * isn't a JSON object), so most requests pay no re-serialization.
+ */
+export function prepareOutboundRequest(bodyText, modelId, provider, options) {
+    const parsed = parseRequestBody(bodyText);
+    if (!parsed)
+        return { bodyText };
+    let changed = false;
+    const target = targetModelId(modelId, provider);
+    if (target && target !== parsed.model && typeof parsed.model === 'string') {
+        parsed.model = target;
+        changed = true;
+    }
+    if (options.wantsStreamUsage && provider.supportsStreamUsage) {
+        const streamOptions = parsed.stream_options;
+        const existing = typeof streamOptions === 'object' && streamOptions !== null && !Array.isArray(streamOptions)
+            ? streamOptions
+            : undefined;
+        if (existing?.include_usage !== true && existing?.include_usage !== false) {
+            parsed.stream_options = { ...existing, include_usage: true };
+            changed = true;
+        }
+    }
+    const sessionId = provider.sessionHeader && !options.clientSessionId
+        ? conversationSessionId(parsed, modelId)
+        : undefined;
+    return { bodyText: changed ? JSON.stringify(parsed) : bodyText, sessionId };
+}
+/**
+ * Provider for a key snapshot. Suffix-routed requests (​@provider model ids)
+ * pin the provider; otherwise structural inference from the key itself.
+ */
+function providerForKey(key, config, modelId) {
+    const suffixProvider = parseProviderSuffix(modelId);
+    if (suffixProvider) {
+        const pinned = getProvider(suffixProvider);
+        if (pinned)
+            return pinned;
+    }
+    const inferred = inferProvider({ label: key.label, key: key.key });
+    void config;
+    return getProvider(inferred) ?? getProvider('opencode-go');
+}
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -45,9 +211,6 @@ class TimeoutError extends Error {
         this.name = 'TimeoutError';
     }
 }
-function generateRequestId() {
-    return crypto.randomUUID();
-}
 /**
  * Build upstream URL from base + request path.
  */
@@ -62,8 +225,11 @@ export function buildUpstreamUrl(base, path) {
     return normalizedBase + normalizedPath;
 }
 /**
- * Clean headers for upstream forwarding: remove hop-by-hop headers
- * and any pre-existing Authorization.
+ * Clean headers for upstream forwarding: remove hop-by-hop headers,
+ * pre-existing Authorization, and content-length (the forwarded body may be
+ * rewritten — model-id aliasing / suffix strip — so a stale content-length
+ * makes the upstream wait for bytes that never arrive; undici recomputes it
+ * from the real body).
  */
 export function buildUpstreamHeaders(incoming, bearerToken) {
     const headers = new Headers();
@@ -77,7 +243,8 @@ export function buildUpstreamHeaders(incoming, bearerToken) {
             lower === 'te' ||
             lower === 'transfer-encoding' ||
             lower === 'upgrade' ||
-            lower === 'authorization') {
+            lower === 'authorization' ||
+            lower === 'content-length') {
             continue;
         }
         headers.set(key, value);
@@ -106,6 +273,15 @@ export function buildDownstreamHeaders(upstreamHeaders) {
             lower === 'upgrade' ||
             // Security-sensitive
             lower === 'set-cookie' ||
+            // Body is already decoded: Node fetch transparently gunzips upstream
+            // responses, so forwarding content-encoding would make clients try to
+            // decompress plain text (found live against api.commandcode.ai).
+            lower === 'content-encoding' ||
+            // The forwarded body may be rewritten (model-id aliasing/suffix strip),
+            // so a forwarded content-length can disagree with the actual body and
+            // hang the upstream waiting for missing bytes (found live). Undici
+            // recomputes content-length from the real body.
+            lower === 'content-length' ||
             // Internal debug
             lower === 'x-request-id' ||
             // Response constructor recalculates content-length
@@ -128,28 +304,19 @@ export function isStreamingRequest(bodyText) {
         return false;
     }
 }
-/**
- * Build usage-based key selection options from scraped data.
- * Returns undefined when no usage data is available or scraping is disabled.
- */
-function buildUsageKeyOptions(config) {
-    const allUsage = getAllUsage();
-    if (allUsage.size === 0)
-        return undefined;
-    const usageMap = new Map();
-    config.keys.forEach((key, i) => {
-        const account = config.scraping?.accounts?.[i];
-        if (account) {
-            const accountUsage = allUsage.get(account.workspaceId);
-            if (accountUsage) {
-                usageMap.set(key.label, accountUsage.usage);
-            }
-        }
-    });
-    if (usageMap.size === 0)
-        return undefined;
-    // Caller ensures config.scraping is defined when scraping is enabled
-    return { usageMap, usageThreshold: config.scraping?.usageThreshold ?? 50 };
+/** Single JSON parse of a request body; null on invalid/missing input. */
+function parseRequestBody(bodyText) {
+    if (!bodyText)
+        return null;
+    try {
+        const parsed = JSON.parse(bodyText);
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
 }
 /**
  * Shared retry loop for both streaming and non-streaming requests.
@@ -166,8 +333,7 @@ async function executeWithRetry(opts) {
         incomingHeaders: opts.incomingHeaders,
         bodyText: opts.bodyText,
         kind: opts.kind,
-        upstreamUrl: buildUpstreamUrl(opts.config.upstreamBaseUrl, opts.path),
-        keyOptions: opts.config.scraping?.enabled ? buildUsageKeyOptions(opts.config) : undefined,
+        modelId: opts.modelId,
         onSuccess: opts.onSuccess,
     };
     let lastError = null;
@@ -185,9 +351,33 @@ async function executeSingleAttempt(attempt, ctx) {
         return { kind: 'done', response: buildNoKeysResponse(ctx.state, ctx.requestId, ctx.kind, attempt) };
     }
     logKeyAttempt(ctx.requestId, key, attempt, ctx.kind);
-    const fetchOptions = buildFetchOptions(ctx.method, ctx.bodyText, ctx.kind, ctx.incomingHeaders, key.key);
+    // Per-attempt upstream: keys may be mixed-provider within one failover chain.
+    // Suffix-routed models (@provider) pin the provider and lose the suffix
+    // in the forwarded body; the upstream never sees saros's routing shim.
+    const provider = providerForKey(key, ctx.config, ctx.modelId);
+    const upstreamUrl = resolveUpstreamUrl(ctx.config, provider, ctx.path);
+    const sessionHeader = provider.sessionHeader;
+    const prepared = ctx.bodyText
+        ? prepareOutboundRequest(ctx.bodyText, ctx.modelId, provider, {
+            // `stream_options` is a Chat Completions field — never inject it into
+            // other streaming surfaces (e.g. the Responses API).
+            wantsStreamUsage: ctx.kind === 'streaming' && ctx.path.endsWith('/chat/completions'),
+            clientSessionId: sessionHeader
+                ? ctx.incomingHeaders.get(sessionHeader) ?? undefined
+                : undefined,
+        })
+        : { bodyText: ctx.bodyText };
+    const fetchOptions = buildFetchOptions({
+        method: ctx.method,
+        bodyText: prepared.bodyText,
+        kind: ctx.kind,
+        incomingHeaders: ctx.incomingHeaders,
+        bearerToken: key.key,
+        provider,
+        sessionId: prepared.sessionId,
+    });
     try {
-        const response = await fetchWithTimeout(ctx.upstreamUrl, fetchOptions, ctx.config.requestTimeoutMs);
+        const response = await fetchWithTimeout(upstreamUrl, fetchOptions, ctx.config.requestTimeoutMs);
         if (response.ok) {
             markKeySucceeded(ctx.state, key.label);
             completeRequest(ctx.state, ctx.requestId, true);
@@ -204,19 +394,31 @@ async function executeSingleAttempt(attempt, ctx) {
 }
 function pickKey(ctx, attempt) {
     return attempt === 0
-        ? selectKeyForRequest(ctx.state, ctx.requestId, ctx.keyOptions)
-        : failoverRequest(ctx.state, ctx.requestId, ctx.keyOptions);
+        ? selectKeyForRequest(ctx.state, ctx.requestId, ctx.modelId)
+        : failoverRequest(ctx.state, ctx.requestId);
 }
-function buildFetchOptions(method, bodyText, kind, incomingHeaders, bearerToken) {
-    const headers = buildUpstreamHeaders(incomingHeaders, bearerToken);
-    const options = { method, headers };
-    if (!bodyText)
+function buildFetchOptions(opts) {
+    const headers = buildUpstreamHeaders(opts.incomingHeaders, opts.bearerToken);
+    // Provider-specific identity headers (e.g. CommandCode CLI headers)
+    if (opts.provider?.extraUpstreamHeaders) {
+        for (const [name, value] of Object.entries(opts.provider.extraUpstreamHeaders())) {
+            headers.set(name, value);
+        }
+    }
+    // Some upstreams require a stable per-conversation session id and reject
+    // requests without one (OpenCode Go: 400 MissingSessionID). A client that
+    // sends its own value keeps it — it was forwarded verbatim above.
+    if (opts.sessionId && opts.provider?.sessionHeader) {
+        headers.set(opts.provider.sessionHeader, opts.sessionId);
+    }
+    const options = { method: opts.method, headers };
+    if (!opts.bodyText)
         return options;
     // Node.js fetch requires `duplex: 'half'` when body is a stream or string
     // that may be streamed. TypeScript's DOM RequestInit lacks this field.
-    if (kind === 'standard' && (method === 'GET' || method === 'HEAD'))
+    if (opts.kind === 'standard' && (opts.method === 'GET' || opts.method === 'HEAD'))
         return options;
-    options.body = bodyText;
+    options.body = opts.bodyText;
     options.duplex = 'half';
     return options;
 }
@@ -224,6 +426,7 @@ async function handleUpstreamErrorResponse(response, ctx, key) {
     const errorBody = await response.text();
     const errorType = classifyHttpError(response.status, errorBody);
     logUpstreamError(ctx.requestId, key, response.status, errorType, errorBody, ctx.kind);
+    captureFailedRequest(ctx, response.status, errorBody);
     if (errorType === 'RequestFault') {
         // Client error — don't retry, don't penalise the key
         completeRequest(ctx.state, ctx.requestId, false);
@@ -238,13 +441,16 @@ async function handleUpstreamErrorResponse(response, ctx, key) {
 }
 function handleNetworkError(err, ctx, key) {
     const lastError = err instanceof Error ? err : new Error(String(err));
+    // Timeouts / connection errors are shared-upstream failures, not per-key
+    // faults: penalising them disabled every key during upstream hangs and
+    // locked the proxy into "all keys unavailable" until cooldown expired.
     if (lastError instanceof TimeoutError) {
         logTimeout(ctx.requestId, key, ctx.config.requestTimeoutMs, ctx.kind);
-        markKeyFailed(ctx.state, key.label, 'ServerFault');
-        return { kind: 'retry', lastError };
     }
-    logNetworkError(ctx.requestId, key, err, ctx.kind);
-    markKeyFailed(ctx.state, key.label, 'ServerFault');
+    else {
+        logNetworkError(ctx.requestId, key, err, ctx.kind);
+    }
+    markKeyFailed(ctx.state, key.label, 'NetworkFault');
     return { kind: 'retry', lastError };
 }
 function buildNoKeysResponse(state, requestId, kind, attempt) {
@@ -310,6 +516,10 @@ function logNetworkError(requestId, key, err, kind) {
 const standardSuccessHandler = async (response, state, requestId, keyLabel) => {
     logger.info({ requestId, keyLabel, status: response.status }, 'Upstream request succeeded');
     const responseBody = await response.text();
+    // Non-streaming bodies report the request's token usage at the top level
+    // (OpenAI shape); recording it is what makes `saros-proxy usage` show real
+    // consumption for providers with no quota API (CommandCode).
+    recordKeyTokens(keyLabel, parseRequestBody(responseBody)?.usage);
     const downstreamHeaders = buildDownstreamHeaders(response.headers);
     downstreamHeaders.set('X-Proxy-Key-Label', keyLabel);
     downstreamHeaders.set('X-Proxy-Request-Id', requestId);
@@ -346,6 +556,7 @@ async function handleWithFailover(opts) {
         incomingHeaders: opts.incomingHeaders,
         bodyText: opts.bodyText,
         kind: 'standard',
+        modelId: opts.modelId,
         onSuccess: standardSuccessHandler,
         maxRetries: opts.maxRetries ?? MAX_RETRIES,
     });
@@ -365,6 +576,7 @@ async function handleStreamingRequest(opts) {
         incomingHeaders: opts.incomingHeaders,
         bodyText: opts.bodyText,
         kind: 'streaming',
+        modelId: opts.modelId,
         onSuccess: streamingSuccessHandler,
         maxRetries: opts.maxRetries ?? MAX_RETRIES,
     });
@@ -381,11 +593,27 @@ function wrapStreamWithErrorDetection(upstreamStream, state, requestId, keyLabel
     const decoder = new TextDecoder();
     const encoder = new TextEncoder();
     let buffer = '';
+    // Upstreams may report the same `usage` on more than one chunk: CommandCode
+    // sends it on the finish chunk (`choices[0].finish_reason`) and again on the
+    // trailing usage-only chunk (`choices: []`), so booking per chunk would
+    // count every streamed request twice. Keep the canonical usage-only chunk
+    // (last one wins, OpenAI's `include_usage` contract) and fall back to the
+    // finish chunk's copy; book exactly once, when the stream ends.
+    let lastUsage = null;
+    let usageOnlyChunk = null;
+    let usageBooked = false;
+    const bookUsage = () => {
+        if (usageBooked)
+            return;
+        usageBooked = true;
+        recordKeyTokens(keyLabel, usageOnlyChunk ?? lastUsage);
+    };
     return new ReadableStream({
         async pull(controller) {
             try {
                 const { done, value } = await reader.read();
                 if (done) {
+                    bookUsage();
                     controller.close();
                     return;
                 }
@@ -405,10 +633,20 @@ function wrapStreamWithErrorDetection(upstreamStream, state, requestId, keyLabel
                         if (parsed && (parsed.error || parsed.type === 'error')) {
                             logger.warn({ requestId, keyLabel }, 'Error detected in stream');
                             markKeyFailed(state, keyLabel, 'ServerFault');
+                            // Whatever the upstream reported before failing was consumed.
+                            bookUsage();
                             controller.enqueue(encoder.encode('data: {"type":"proxy_error","message":"Upstream stream error"}\n\n'));
                             controller.close();
                             return;
                         }
+                        // Intermediate chunks send `usage: null`; the counts arrive on the
+                        // finish chunk and/or the usage-only chunk (see bookUsage).
+                        if (parsed?.usage) {
+                            lastUsage = parsed.usage;
+                            if (Array.isArray(parsed.choices) && parsed.choices.length === 0) {
+                                usageOnlyChunk = parsed.usage;
+                            }
+                        }
                     }
                     catch {
                         // Invalid JSON in SSE event — not an error we can classify, ignore
@@ -420,11 +658,14 @@ function wrapStreamWithErrorDetection(upstreamStream, state, requestId, keyLabel
             catch (err) {
                 logger.error({ requestId, keyLabel, err }, 'Stream read error');
                 markKeyFailed(state, keyLabel, 'ServerFault');
+                bookUsage();
                 controller.enqueue(encoder.encode('data: {"type":"proxy_error","message":"Stream interrupted"}\n\n'));
                 controller.close();
             }
         },
         cancel() {
+            // The client hung up, but the upstream already spent the tokens.
+            bookUsage();
             reader.cancel();
         },
     });
@@ -437,6 +678,24 @@ export function createProxyApp(config) {
         circuitBreakerThreshold: config.circuitBreakerThreshold,
         circuitBreakerCooldownMs: config.circuitBreakerCooldownMs,
     });
+    // Model→provider affinity: requests naming a provider-specific model
+    // (e.g. commandcode's vendor-prefixed ids) are routed to a matching key
+    // first; 'maybe' providers remain as fallback. Bare-name matching lets
+    // shared models (deepseek-v4-flash etc.) rotate across ALL serving keys
+    // cross-provider. No-op for single-provider pools and when no provider
+    // claims the model.
+    state.affinityResolver = (providerId, modelId) => {
+        const provider = getProvider(providerId);
+        if (!provider)
+            return 'maybe';
+        const direct = provider.modelAffinity(modelId);
+        if (direct !== 'maybe')
+            return direct;
+        // Bare-name cross-check: 'deepseek-v4-flash' may be commandcode's
+        // 'deepseek/deepseek-v4-flash'.
+        const bare = (modelId.split('/').pop() ?? modelId).toLowerCase();
+        return provider.modelAffinityByName?.(bare) ?? 'maybe';
+    };
     const app = new Hono();
     // --- Rate limiting (prevent DoS and key exhaustion) ---
     app.use('*', rateLimiter({
@@ -479,31 +738,26 @@ export function createProxyApp(config) {
         const enabledCount = keys.filter((k) => k.enabled).length;
         const disabledCount = keys.length - enabledCount;
         const activeCount = state.activeRequests.size;
-        // Build scraping status
-        const scrapingStatus = config.scraping?.enabled
-            ? {
-                enabled: true,
-                running: isScraperRunning(),
-                intervalMs: config.scraping.intervalMs,
-                usageThreshold: config.scraping.usageThreshold,
-                accounts: Array.from(getAllUsage().entries()).map(([workspaceId, data]) => ({
-                    workspaceId,
-                    usage: data.usage,
-                    lastScrapedAt: data.lastScrapedAt.toISOString(),
-                    lastError: data.lastError ?? null,
-                })),
-            }
-            : { enabled: false };
         return c.json({
             status: 'ok',
             uptime: process.uptime(),
             keyCount: keys.length,
             enabledCount,
             disabledCount,
+            // Keys whose account has no plan for their provider (403 entitlement):
+            // kept out of rotation until the usage refresh clears the flag.
+            entitledCount: keys.filter((k) => k.entitled).length,
             activeRequests: activeCount,
             circuitBreakerThreshold: state.circuitBreakerThreshold,
             circuitBreakerCooldownMs: state.circuitBreakerCooldownMs,
-            scraping: scrapingStatus,
+            // Per-provider key counts (multi-provider pools)
+            providers: keys.reduce((acc, k) => {
+                const entry = (acc[k.provider] ??= { total: 0, enabled: 0 });
+                entry.total++;
+                if (k.enabled)
+                    entry.enabled++;
+                return acc;
+            }, {}),
         });
     });
     // --- Models discovery endpoint (OpenAI-compatible) ---
@@ -529,8 +783,17 @@ export function createProxyApp(config) {
         if (bodyText.length > MAX_BODY_SIZE) {
             return c.json({ error: 'Request body too large', requestId }, 413);
         }
+        maybeRefreshUsage(state, config);
+        // Parse once: used for both streaming detection and model tracking
+        const parsedBody = parseRequestBody(bodyText);
+        // Track most-used models for `saros-proxy usage` (best-effort)
+        if (parsedBody) {
+            const model = parsedBody.model;
+            if (typeof model === 'string' && model.length > 0)
+                recordModelRequest(model);
+        }
         // Check for streaming mode
-        if (bodyText && isStreamingRequest(bodyText)) {
+        if (parsedBody?.stream === true) {
             logger.info({ requestId, method, path }, 'Streaming request detected');
             return handleStreamingRequest({
                 state,
@@ -540,6 +803,7 @@ export function createProxyApp(config) {
                 path,
                 incomingHeaders,
                 bodyText,
+                modelId: typeof parsedBody.model === 'string' ? parsedBody.model : undefined,
             });
         }
         // Non-streaming request with failover
@@ -551,6 +815,7 @@ export function createProxyApp(config) {
             path,
             incomingHeaders,
             bodyText,
+            modelId: typeof parsedBody?.model === 'string' ? parsedBody.model : undefined,
         });
     }
     // Unified catch-all: rewrites /v1/* → /zen/go/v1/* for upstream forwarding