@askalf/dario 1.0.2 → 1.0.4

package/README.md

@@ -146,7 +146,7 @@ curl http://localhost:3456/v1/messages \
   -H "Content-Type: application/json" \
   -H "anthropic-version: 2023-06-01" \
   -d '{
-    "model": "claude-sonnet-4-6",
+    "model": "claude-opus-4-6",
     "max_tokens": 1024,
     "stream": true,
     "messages": [{"role": "user", "content": "Write a haiku about APIs"}]

package/dist/cli.js

@@ -152,7 +152,7 @@ async function help() {
     Example with curl:
       curl http://localhost:3456/v1/messages \\
         -H "Content-Type: application/json" \\
-        -d '{"model":"claude-sonnet-4-6","max_tokens":1024,"messages":[{"role":"user","content":"Hello"}]}'
+        -d '{"model":"claude-opus-4-6","max_tokens":1024,"messages":[{"role":"user","content":"Hello"}]}'
 
   Your subscription handles the billing. No API key needed.
   Tokens auto-refresh in the background — set it and forget it.

package/dist/proxy.js

@@ -12,7 +12,6 @@ import { getAccessToken, getStatus } from './oauth.js';
 const ANTHROPIC_API = 'https://api.anthropic.com';
 const DEFAULT_PORT = 3456;
 const MAX_BODY_BYTES = 10 * 1024 * 1024; // 10 MB — generous for large prompts, prevents abuse
-const ALLOWED_PATH_PREFIX = '/v1/'; // Only proxy Anthropic API paths
 const LOCALHOST = '127.0.0.1';
 const CORS_ORIGIN = 'http://localhost';
 function sanitizeError(err) {
@@ -62,14 +61,20 @@ export async function startProxy(opts = {}) {
             res.end(JSON.stringify(s));
             return;
         }
-        // Only allow proxying to /v1/* paths — block path traversal
-        const urlPath = req.url?.split('?')[0] ?? '';
-        if (!urlPath.startsWith(ALLOWED_PATH_PREFIX)) {
+        // Allowlisted API paths — only these are proxied (prevents SSRF)
+        const rawPath = req.url?.split('?')[0] ?? '';
+        const allowedPaths = {
+            '/v1/messages': `${ANTHROPIC_API}/v1/messages`,
+            '/v1/models': `${ANTHROPIC_API}/v1/models`,
+            '/v1/complete': `${ANTHROPIC_API}/v1/complete`,
+        };
+        const targetBase = allowedPaths[rawPath];
+        if (!targetBase) {
             res.writeHead(403, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Forbidden', message: `Only ${ALLOWED_PATH_PREFIX}* paths are proxied` }));
+            res.end(JSON.stringify({ error: 'Forbidden', message: 'Path not allowed' }));
             return;
         }
-        // Only allow POST (Messages API) and GET (models, etc)
+        // Only allow POST (Messages API) and GET (models)
         if (req.method !== 'POST' && req.method !== 'GET') {
             res.writeHead(405, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Method not allowed' }));
@@ -96,8 +101,8 @@ export async function startProxy(opts = {}) {
             if (verbose) {
                 console.log(`[dario] #${requestCount} ${req.method} ${req.url}`);
             }
-            // Forward to Anthropic with OAuth token + required beta flag
-            const targetUrl = `${ANTHROPIC_API}${req.url}`;
+            // Build target URL from allowlist (no user input in URL construction)
+            const targetUrl = targetBase;
             // Merge any client-provided beta flags with the required oauth flag
             const clientBeta = req.headers['anthropic-beta'];
             const betaFlags = new Set(['oauth-2025-04-20']);
@@ -173,9 +178,10 @@ export async function startProxy(opts = {}) {
             }
         }
         catch (err) {
+            // Log full error server-side, return generic message to client
             console.error('[dario] Proxy error:', sanitizeError(err));
             res.writeHead(502, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Proxy error', message: sanitizeError(err) }));
+            res.end(JSON.stringify({ error: 'Proxy error', message: 'Failed to reach upstream API' }));
         }
     });
     server.listen(port, LOCALHOST, () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Use your Claude subscription as an API. Two commands, no API key. OAuth bridge for Claude Max/Pro.",
   "type": "module",
   "bin": {