@askalf/dario 1.0.5 → 1.0.6

package/dist/cli.js

@@ -119,6 +119,10 @@ async function logout() {
 async function proxy() {
     const portArg = args.find(a => a.startsWith('--port='));
     const port = portArg ? parseInt(portArg.split('=')[1]) : 3456;
+    if (isNaN(port) || port < 1 || port > 65535) {
+        console.error('[dario] Invalid port. Must be 1-65535.');
+        process.exit(1);
+    }
     const verbose = args.includes('--verbose') || args.includes('-v');
     await startProxy({ port, verbose });
 }
@@ -176,6 +180,7 @@ if (!handler) {
     process.exit(1);
 }
 handler().catch(err => {
-    console.error('Fatal error:', err);
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error('Fatal error:', msg.replace(/sk-ant-[a-zA-Z0-9_-]+/g, '[REDACTED]'));
     process.exit(1);
 });

package/dist/oauth.d.ts

@@ -30,6 +30,7 @@ export declare function exchangeCode(code: string, codeVerifier: string): Promis
 /**
  * Refresh the access token using the refresh token.
  * Retries with exponential backoff on transient failures.
+ * Uses a mutex to prevent concurrent refresh races.
  */
 export declare function refreshTokens(): Promise<OAuthTokens>;
 /**

package/dist/oauth.js

@@ -15,6 +15,12 @@ const OAUTH_TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
 const OAUTH_REDIRECT_URI = 'https://platform.claude.com/oauth/code/callback';
 // Refresh 30 min before expiry
 const REFRESH_BUFFER_MS = 30 * 60 * 1000;
+// In-memory credential cache — avoids disk reads on every request
+let credentialsCache = null;
+let credentialsCacheTime = 0;
+const CACHE_TTL_MS = 10_000; // Re-read from disk every 10s at most
+// Mutex to prevent concurrent refresh races
+let refreshInProgress = null;
 function base64url(buf) {
     return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
 }
@@ -27,9 +33,20 @@ function getCredentialsPath() {
     return join(homedir(), '.dario', 'credentials.json');
 }
 export async function loadCredentials() {
+    // Return cached if fresh
+    if (credentialsCache && Date.now() - credentialsCacheTime < CACHE_TTL_MS) {
+        return credentialsCache;
+    }
     try {
         const raw = await readFile(getCredentialsPath(), 'utf-8');
-        return JSON.parse(raw);
+        const parsed = JSON.parse(raw);
+        // Validate structure
+        if (!parsed?.claudeAiOauth?.accessToken || !parsed?.claudeAiOauth?.refreshToken) {
+            return null;
+        }
+        credentialsCache = parsed;
+        credentialsCacheTime = Date.now();
+        return credentialsCache;
     }
     catch {
         return null;
@@ -48,6 +65,9 @@ async function saveCredentials(creds) {
         await chmod(path, 0o600);
     }
     catch { /* Windows ignores file modes */ }
+    // Invalidate cache so next read picks up the new tokens
+    credentialsCache = creds;
+    credentialsCacheTime = Date.now();
 }
 /**
  * Start the OAuth flow. Returns the authorization URL and PKCE state
@@ -103,8 +123,21 @@ export async function exchangeCode(code, codeVerifier) {
 /**
  * Refresh the access token using the refresh token.
  * Retries with exponential backoff on transient failures.
+ * Uses a mutex to prevent concurrent refresh races.
  */
 export async function refreshTokens() {
+    // Prevent concurrent refreshes — if one is already in progress, wait for it
+    if (refreshInProgress)
+        return refreshInProgress;
+    refreshInProgress = doRefreshTokens();
+    try {
+        return await refreshInProgress;
+    }
+    finally {
+        refreshInProgress = null;
+    }
+}
+async function doRefreshTokens() {
     const creds = await loadCredentials();
     if (!creds?.claudeAiOauth?.refreshToken) {
         throw new Error('No refresh token available. Run `dario login` first.');

package/dist/proxy.js

@@ -12,6 +12,7 @@ import { getAccessToken, getStatus } from './oauth.js';
 const ANTHROPIC_API = 'https://api.anthropic.com';
 const DEFAULT_PORT = 3456;
 const MAX_BODY_BYTES = 10 * 1024 * 1024; // 10 MB — generous for large prompts, prevents abuse
+const UPSTREAM_TIMEOUT_MS = 300_000; // 5 min — matches Anthropic SDK default
 const LOCALHOST = '127.0.0.1';
 const CORS_ORIGIN = 'http://localhost';
 function sanitizeError(err) {
@@ -124,6 +125,7 @@ export async function startProxy(opts = {}) {
                 method: req.method ?? 'POST',
                 headers,
                 body: body.length > 0 ? body : undefined,
+                signal: AbortSignal.timeout(UPSTREAM_TIMEOUT_MS),
                 // @ts-expect-error — duplex needed for streaming
                 duplex: 'half',
             });
@@ -187,7 +189,7 @@ export async function startProxy(opts = {}) {
     server.listen(port, LOCALHOST, () => {
         const oauthLine = `OAuth: ${status.status} (expires in ${status.expiresIn})`;
         console.log('');
-        console.log(`  dario v1.0.0 — http://localhost:${port}`);
+        console.log(`  dario — http://localhost:${port}`);
         console.log('');
         console.log('  Your Claude subscription is now an API.');
         console.log('');
@@ -199,7 +201,7 @@ export async function startProxy(opts = {}) {
         console.log('');
     });
     // Periodic token refresh (every 15 minutes)
-    setInterval(async () => {
+    const refreshInterval = setInterval(async () => {
         try {
             const s = await getStatus();
             if (s.status === 'expiring') {
@@ -211,4 +213,14 @@ export async function startProxy(opts = {}) {
             console.error('[dario] Background refresh error:', err instanceof Error ? err.message : err);
         }
     }, 15 * 60 * 1000);
+    // Graceful shutdown
+    const shutdown = () => {
+        console.log('\n[dario] Shutting down...');
+        clearInterval(refreshInterval);
+        server.close(() => process.exit(0));
+        // Force exit after 5s if connections don't close
+        setTimeout(() => process.exit(0), 5000).unref();
+    };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "Use your Claude subscription as an API. Two commands, no API key. OAuth bridge for Claude Max/Pro.",
   "type": "module",
   "bin": {