@askalf/dario 2.1.0 → 2.1.1

package/README.md

@@ -27,12 +27,12 @@
 ```bash
 npx @askalf/dario login   # detects Claude Code credentials, starts proxy
 
-# now use it from anywhere
-export ANTHROPIC_BASE_URL=http://localhost:3456
-export ANTHROPIC_API_KEY=dario
+# now use it from anywhere — Anthropic or OpenAI SDK
+export ANTHROPIC_BASE_URL=http://localhost:3456   # or OPENAI_BASE_URL=http://localhost:3456/v1
+export ANTHROPIC_API_KEY=dario                    # or OPENAI_API_KEY=dario
 ```
 
-That's it. Any tool that speaks the Anthropic API now uses your subscription.
+Opus, Sonnet, Haiku — all models, streaming, tool use. Works with OpenClaw, Cursor, Continue, Aider, Hermes, or any tool that speaks the Anthropic or OpenAI API. When rate limited, `--cli` routes through Claude Code for uninterrupted Opus access.
 
 ---
 
@@ -88,6 +88,7 @@ Usage:
   ANTHROPIC_BASE_URL=http://localhost:3456
   ANTHROPIC_API_KEY=dario
 
+Auth: open (no DARIO_API_KEY set)
 OAuth: healthy (expires in 11h 42m)
 Model: passthrough (client decides)
 ```
@@ -294,12 +295,13 @@ ANTHROPIC_BASE_URL=http://localhost:3456 ANTHROPIC_API_KEY=dario your-tool-here
 
 ### Proxy Options
 
-| Flag | Description | Default |
-|------|-------------|---------|
+| Flag/Env | Description | Default |
+|----------|-------------|---------|
 | `--cli` | Use Claude CLI as backend (bypasses rate limits) | off |
 | `--model=MODEL` | Force a model (`opus`, `sonnet`, `haiku`, or full ID) | passthrough |
 | `--port=PORT` | Port to listen on | `3456` |
 | `--verbose` / `-v` | Log every request | off |
+| `DARIO_API_KEY` | If set, all endpoints (except `/health`) require matching `x-api-key` header or `Authorization: Bearer` header | unset (open) |
 
 ## Supported Features
 

package/dist/proxy.js

@@ -201,7 +201,9 @@ async function handleViaCli(body, model, verbose) {
         if (!lastUser) {
             return { status: 400, body: JSON.stringify({ error: 'No user message' }), contentType: 'application/json' };
         }
-        const effectiveModel = model ?? parsed.model ?? 'claude-opus-4-6';
+        const rawModel = model ?? parsed.model ?? 'claude-opus-4-6';
+        // Validate model name — only allow alphanumeric, hyphens, dots, underscores
+        const effectiveModel = /^[a-zA-Z0-9._-]+$/.test(rawModel) ? rawModel : 'claude-opus-4-6';
         const prompt = typeof lastUser.content === 'string'
             ? lastUser.content
             : JSON.stringify(lastUser.content);
@@ -237,7 +239,7 @@ async function handleViaCli(body, model, verbose) {
                 if (code !== 0 || !stdout.trim()) {
                     resolve({
                         status: 502,
-                        body: JSON.stringify({ type: 'error', error: { type: 'api_error', message: stderr.substring(0, 200) || 'CLI backend failed' } }),
+                        body: JSON.stringify({ type: 'error', error: { type: 'api_error', message: sanitizeError(stderr.substring(0, 200)) || 'CLI backend failed' } }),
                         contentType: 'application/json',
                     });
                     return;
@@ -492,6 +494,7 @@ export async function startProxy(opts = {}) {
                 const decoder = new TextDecoder();
                 try {
                     let buffer = '';
+                    const MAX_LINE_LENGTH = 1_000_000; // 1MB max per SSE line
                     while (true) {
                         const { done, value } = await reader.read();
                         if (done)
@@ -499,6 +502,10 @@ export async function startProxy(opts = {}) {
                         if (isOpenAI) {
                             // Translate Anthropic SSE → OpenAI SSE
                             buffer += decoder.decode(value, { stream: true });
+                            // Guard against unbounded buffer growth
+                            if (buffer.length > MAX_LINE_LENGTH) {
+                                buffer = buffer.slice(-MAX_LINE_LENGTH);
+                            }
                             const lines = buffer.split('\n');
                             buffer = lines.pop() ?? '';
                             for (const line of lines) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "Use your Claude subscription as an API. No API key needed. Local proxy for Claude Max/Pro subscriptions.",
   "type": "module",
   "bin": {