@askalf/dario 2.7.0 → 2.8.0

package/README.md

@@ -70,14 +70,15 @@ Opus, Sonnet, Haiku — all models, streaming, tool use. Works with Cursor, Cont
 
 Most Claude subscription proxies have a critical billing problem: **Anthropic classifies their requests as third-party and routes all usage to Extra Usage billing** — even when you have Max plan limits available. You're paying for your subscription twice.
 
-dario is the only proxy that solves this. It injects native Claude Code device identity (`metadata.user_id`) into every request, so Anthropic's billing system treats your requests exactly like Claude Code itself. Your Max plan limits work correctly.
+dario is the only proxy that solves this. It injects native Claude Code device identity, billing classification tags, and priority routing into every request — so Anthropic's billing system treats your requests exactly like Claude Code itself. Your Max plan limits work correctly, and Opus/Sonnet stay available even at high utilization.
 
 | | dario | Other proxies |
 |---|---|---|
 | **Billing classification** | Native Claude Code session | Third-party (Extra Usage) |
 | **Max plan limits** | Used correctly | Bypassed — billed separately |
 | **Device identity** | Injected automatically | Missing |
-| **Beta flags** | Match Claude Code v2.1.98 | Outdated or missing |
+| **Priority routing** | Billing tag + service_tier auto | Missing |
+| **Beta flags** | Match Claude Code v2.1.100 | Outdated or missing |
 | **Billable beta filtering** | Strips surprise charges | Passes everything through |
 
 <details>
@@ -91,7 +92,7 @@ dario is the only proxy that solves this. It injects native Claude Code device i
 | OpenAI API compat | **Yes** | Yes | Yes | Yes |
 | Orchestration sanitization | **Yes** | Yes | No | No |
 | Token anomaly detection | **Yes** | Yes | No | No |
-| Codebase size | ~1,200 lines | ~9,000 lines | Platform | Rust binary |
+| Codebase size | ~1,500 lines | ~9,000 lines | Platform | Rust binary |
 | Dependencies | 1 | Many | Many | Compiled |
 | Setup | 2 commands | Config + build | Config + dashboard | Config |
 
@@ -382,6 +383,9 @@ Then run `hermes` normally — it routes through dario using your Claude subscri
 ### Direct API Mode
 - All Claude models (Opus 4.6, Sonnet 4.6, Haiku 4.5) + 1M extended context aliases (`opus1m`, `sonnet1m`)
 - **Native billing classification** — device identity metadata ensures Max plan limits work correctly
+- **Priority routing** — billing tag injection + `service_tier: auto` activates per-model rate limits, keeping Opus/Sonnet available even at 100% overall utilization
+- **Adaptive thinking** — matches Claude Code's `{ type: 'adaptive' }` mode for optimal reasoning
+- **Auto CLI fallback** — if the API returns 429 and Claude Code is installed, transparently retries through `claude --print` with SSE conversion
 - **OpenAI-compatible** (`/v1/chat/completions`) — works with any OpenAI SDK or tool
 - Streaming and non-streaming (both Anthropic and OpenAI SSE formats, including tool_use streaming)
 - Tool use / function calling
@@ -493,7 +497,7 @@ Dario handles your OAuth tokens. Here's why you can trust it:
 
 | Signal | Status |
 |--------|--------|
-| **Source code** | ~1,300 lines of TypeScript — small enough to audit in one sitting |
+| **Source code** | ~1,500 lines of TypeScript — small enough to audit in one sitting |
 | **Dependencies** | 1 production dep (`@anthropic-ai/sdk`). Verify: `npm ls --production` |
 | **npm provenance** | Every release is [SLSA attested](https://www.npmjs.com/package/@askalf/dario) via GitHub Actions |
 | **Security scanning** | [CodeQL](https://github.com/askalf/dario/actions/workflows/codeql.yml) runs on every push and weekly |
@@ -515,7 +519,7 @@ cd $(npm root -g)/@askalf/dario && npm ls --production
 
 ## Contributing
 
-PRs welcome. The codebase is ~1,300 lines of TypeScript across 4 files:
+PRs welcome. The codebase is ~1,500 lines of TypeScript across 4 files:
 
 | File | Purpose |
 |------|---------|
@@ -536,7 +540,7 @@ npm run dev   # runs with tsx (no build needed)
 | Who | Contributions |
 |-----|---------------|
 | [@GodsBoy](https://github.com/GodsBoy) | Proxy authentication, token redaction, error sanitization ([#2](https://github.com/askalf/dario/pull/2)) |
-| [@belangertrading](https://github.com/belangertrading) | Billing classification investigation — reported, tested 5 versions, confirmed fix via response header analysis ([#4](https://github.com/askalf/dario/issues/4)) |
+| [@belangertrading](https://github.com/belangertrading) | Billing classification investigation ([#4](https://github.com/askalf/dario/issues/4)), Opus/Sonnet 429 diagnosis + CLI fallback workaround ([#6](https://github.com/askalf/dario/issues/6)) |
 
 ## Also by AskAlf
 

package/dist/cli.js

@@ -112,9 +112,10 @@ async function proxy() {
     }
     const verbose = args.includes('--verbose') || args.includes('-v');
     const cliBackend = args.includes('--cli');
+    const passthrough = args.includes('--passthrough') || args.includes('--thin');
     const modelArg = args.find(a => a.startsWith('--model='));
     const model = modelArg ? modelArg.split('=')[1] : undefined;
-    await startProxy({ port, verbose, model, cliBackend });
+    await startProxy({ port, verbose, model, cliBackend, passthrough });
 }
 async function help() {
     console.log(`
@@ -133,6 +134,7 @@ async function help() {
                              Full IDs: claude-opus-4-6, claude-sonnet-4-6
                              Default: passthrough (client decides)
     --cli                    Use Claude CLI as backend (bypasses rate limits)
+    --passthrough            Thin proxy — OAuth swap only, no injection
     --port=PORT              Port to listen on (default: 3456)
     --verbose, -v            Log all requests
 

package/dist/proxy.d.ts

@@ -3,6 +3,7 @@ interface ProxyOptions {
     verbose?: boolean;
     model?: string;
     cliBackend?: boolean;
+    passthrough?: boolean;
 }
 export declare function sanitizeError(err: unknown): string;
 export declare function startProxy(opts?: ProxyOptions): Promise<void>;

package/dist/proxy.js

@@ -301,6 +301,37 @@ export function sanitizeError(err) {
         .replace(/eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g, '[REDACTED_JWT]')
         .replace(/Bearer\s+[^\s,;]+/gi, 'Bearer [REDACTED]');
 }
+/**
+ * Enrich Anthropic's unhelpful 429 "Error" body with rate limit details from headers.
+ */
+function enrich429(body, headers) {
+    try {
+        const parsed = JSON.parse(body);
+        const err = parsed.error;
+        if (err && (err.message === 'Error' || !err.message)) {
+            const claim = headers.get('anthropic-ratelimit-unified-representative-claim') || 'unknown';
+            const status = headers.get('anthropic-ratelimit-unified-status') || 'rejected';
+            const util5h = headers.get('anthropic-ratelimit-unified-5h-utilization');
+            const util7d = headers.get('anthropic-ratelimit-unified-7d-utilization');
+            const reset = headers.get('anthropic-ratelimit-unified-reset');
+            const parts = [`Rate limited (${status}). Limiting window: ${claim}`];
+            if (util5h)
+                parts.push(`5h utilization: ${Math.round(parseFloat(util5h) * 100)}%`);
+            if (util7d)
+                parts.push(`7d utilization: ${Math.round(parseFloat(util7d) * 100)}%`);
+            if (reset) {
+                const resetDate = new Date(parseInt(reset) * 1000);
+                const mins = Math.max(0, Math.round((resetDate.getTime() - Date.now()) / 60000));
+                parts.push(`resets in ${mins}m`);
+            }
+            err.message = parts.join('. ');
+        }
+        return JSON.stringify(parsed);
+    }
+    catch {
+        return body;
+    }
+}
 /**
  * CLI Backend: route requests through `claude --print` instead of direct API.
  * This bypasses rate limiting because Claude Code's binary has priority routing.
@@ -398,6 +429,7 @@ async function handleViaCli(body, model, verbose) {
 export async function startProxy(opts = {}) {
     const port = opts.port ?? DEFAULT_PORT;
     const verbose = opts.verbose ?? false;
+    const passthrough = opts.passthrough ?? false;
     // Verify auth before starting
     const status = await getStatus();
     if (!status.authenticated) {
@@ -415,8 +447,11 @@ export async function startProxy(opts = {}) {
         console.warn('[dario] WARNING: No Claude Code device identity found. Requests may be billed as Extra Usage.');
         console.warn('[dario] Run Claude Code at least once to generate ~/.claude/.claude.json');
     }
-    // Pre-build static headers (only auth, version, beta, request-id change per request)
-    const staticHeaders = {
+    // Pre-build static headers
+    const staticHeaders = passthrough ? {
+        'accept': 'application/json',
+        'Content-Type': 'application/json',
+    } : {
         'accept': 'application/json',
         'Content-Type': 'application/json',
         'anthropic-dangerous-direct-browser-access': 'true',
@@ -556,30 +591,60 @@ export async function startProxy(opts = {}) {
             // CLI backend mode: route through claude --print (works for both Anthropic and OpenAI endpoints)
             if (useCli && req.method === 'POST' && body.length > 0) {
                 let cliBody = body;
+                let clientWantsStream = false;
                 // Translate OpenAI format before passing to CLI
                 if (isOpenAI) {
                     try {
                         const parsed = JSON.parse(body.toString());
+                        clientWantsStream = !!parsed.stream;
                         cliBody = Buffer.from(JSON.stringify(openaiToAnthropic(parsed, modelOverride)));
                     }
                     catch { /* send as-is */ }
                 }
+                else {
+                    try {
+                        const parsed = JSON.parse(body.toString());
+                        clientWantsStream = !!parsed.stream;
+                    }
+                    catch { }
+                }
                 const cliResult = await handleViaCli(cliBody, modelOverride, verbose);
                 requestCount++;
-                // Translate CLI response back to OpenAI format if needed
-                if (isOpenAI && cliResult.status >= 200 && cliResult.status < 300) {
-                    try {
-                        const parsed = JSON.parse(cliResult.body);
-                        cliResult.body = JSON.stringify(anthropicToOpenai(parsed));
+                if (cliResult.status >= 200 && cliResult.status < 300 && clientWantsStream) {
+                    // Client requested streaming — convert CLI JSON to SSE
+                    if (isOpenAI) {
+                        try {
+                            const parsed = JSON.parse(cliResult.body);
+                            const text = parsed.content?.find(c => c.type === 'text')?.text ?? '';
+                            const ts = Math.floor(Date.now() / 1000);
+                            let sseData = `data: ${JSON.stringify({ id: 'chatcmpl-dario', object: 'chat.completion.chunk', created: ts, model: 'claude', choices: [{ index: 0, delta: { content: text }, finish_reason: null }] })}\n\n`;
+                            sseData += `data: ${JSON.stringify({ id: 'chatcmpl-dario', object: 'chat.completion.chunk', created: ts, model: 'claude', choices: [{ index: 0, delta: {}, finish_reason: 'stop' }] })}\n\ndata: [DONE]\n\n`;
+                            res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Access-Control-Allow-Origin': corsOrigin, ...SECURITY_HEADERS });
+                            res.end(sseData);
+                        }
+                        catch {
+                            res.writeHead(cliResult.status, { 'Content-Type': cliResult.contentType, 'Access-Control-Allow-Origin': corsOrigin, ...SECURITY_HEADERS });
+                            res.end(cliResult.body);
+                        }
+                    }
+                    else {
+                        const sseData = jsonToSse(cliResult.body);
+                        res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Access-Control-Allow-Origin': corsOrigin, ...SECURITY_HEADERS });
+                        res.end(sseData);
                     }
-                    catch { /* send as-is */ }
                 }
-                res.writeHead(cliResult.status, {
-                    'Content-Type': cliResult.contentType,
-                    'Access-Control-Allow-Origin': corsOrigin,
-                    ...SECURITY_HEADERS,
-                });
-                res.end(cliResult.body);
+                else {
+                    // Non-streaming or error — translate and return as JSON
+                    if (isOpenAI && cliResult.status >= 200 && cliResult.status < 300) {
+                        try {
+                            const parsed = JSON.parse(cliResult.body);
+                            cliResult.body = JSON.stringify(anthropicToOpenai(parsed));
+                        }
+                        catch { /* send as-is */ }
+                    }
+                    res.writeHead(cliResult.status, { 'Content-Type': cliResult.contentType, 'Access-Control-Allow-Origin': corsOrigin, ...SECURITY_HEADERS });
+                    res.end(cliResult.body);
+                }
                 return;
             }
             // Parse body once, apply OpenAI translation, model override, and sanitization
@@ -595,51 +660,61 @@ export async function startProxy(opts = {}) {
                     }
                     const result = isOpenAI ? openaiToAnthropic(parsed, modelOverride) : (modelOverride ? { ...parsed, model: modelOverride } : parsed);
                     const r = result;
-                    // Inject device identity metadata for session tracking
-                    if (identity.deviceId) {
-                        r.metadata = {
-                            user_id: JSON.stringify({
-                                device_id: identity.deviceId,
-                                account_uuid: identity.accountUuid,
-                                session_id: SESSION_ID,
-                            }),
-                        };
-                    }
-                    // Enable adaptive thinking (matches Claude Code default)
-                    // adaptive lets the model decide when/how much to think — preferred for Opus/Sonnet 4.6
-                    if (!r.thinking) {
-                        r.thinking = { type: 'adaptive' };
-                        // Ensure max_tokens is reasonable for thinking models
-                        const clientMax = r.max_tokens || 8192;
-                        r.max_tokens = Math.max(clientMax, 16000);
-                    }
-                    // Request priority capacity when available
-                    if (!r.service_tier) {
-                        r.service_tier = 'auto';
-                    }
-                    // Enable context management (matches Claude Code default)
-                    if (!r.context_management) {
-                        r.context_management = { edits: [{ type: 'clear_thinking_20251015', keep: 'all' }] };
-                    }
-                    // Inject Claude Code billing header into system prompt.
-                    // Anthropic uses this to route requests through priority rate limiting
-                    // instead of the general API quota. Without it, Opus/Sonnet get 429
-                    // when overall utilization is high, even though model-specific limits
-                    // have headroom. The CLI binary embeds this in its system prompt.
-                    const billingTag = `x-anthropic-billing-header: cc_version=${cliVersion}; cc_entrypoint=cli; cch=98638;`;
-                    if (typeof r.system === 'string') {
-                        if (!r.system.includes('x-anthropic-billing-header:')) {
-                            r.system = billingTag + '\n' + r.system;
+                    // In passthrough mode, skip all Claude-specific injection — OAuth swap only
+                    if (!passthrough) {
+                        // Inject device identity metadata for session tracking
+                        if (identity.deviceId) {
+                            r.metadata = {
+                                user_id: JSON.stringify({
+                                    device_id: identity.deviceId,
+                                    account_uuid: identity.accountUuid,
+                                    session_id: SESSION_ID,
+                                }),
+                            };
                         }
-                    }
-                    else if (Array.isArray(r.system)) {
-                        const hasTag = r.system.some(b => typeof b.text === 'string' && b.text.includes('x-anthropic-billing-header:'));
-                        if (!hasTag) {
-                            r.system.unshift({ type: 'text', text: billingTag });
+                        // Enable adaptive thinking for models that support it (Opus/Sonnet 4.6+)
+                        // Haiku 4.5 does not support thinking at all
+                        const modelName = (r.model || '').toLowerCase();
+                        const supportsThinking = !modelName.includes('haiku');
+                        if (supportsThinking && !r.thinking) {
+                            r.thinking = { type: 'adaptive' };
+                            // Ensure max_tokens is reasonable for thinking models
+                            const clientMax = r.max_tokens || 8192;
+                            r.max_tokens = Math.max(clientMax, 16000);
+                        }
+                        // Request priority capacity when available
+                        if (!r.service_tier) {
+                            r.service_tier = 'auto';
+                        }
+                        // Set reasoning effort (pass through client value or default)
+                        if (!r.output_config) {
+                            r.output_config = { effort: 'high' };
+                        }
+                        // Enable context management (matches Claude Code default)
+                        // Requires thinking to be enabled — skip for models without thinking support (e.g. Haiku)
+                        if (supportsThinking && !r.context_management) {
+                            r.context_management = { edits: [{ type: 'clear_thinking_20251015', keep: 'all' }] };
+                        }
+                        // Inject Claude Code billing header into system prompt.
+                        // Anthropic uses this to route requests through priority rate limiting
+                        // instead of the general API quota. Without it, Opus/Sonnet get 429
+                        // when overall utilization is high, even though model-specific limits
+                        // have headroom. The CLI binary embeds this in its system prompt.
+                        const billingTag = `x-anthropic-billing-header: cc_version=${cliVersion}; cc_entrypoint=cli; cch=98638;`;
+                        if (typeof r.system === 'string') {
+                            if (!r.system.includes('x-anthropic-billing-header:')) {
+                                r.system = billingTag + '\n' + r.system;
+                            }
+                        }
+                        else if (Array.isArray(r.system)) {
+                            const hasTag = r.system.some(b => typeof b.text === 'string' && b.text.includes('x-anthropic-billing-header:'));
+                            if (!hasTag) {
+                                r.system.unshift({ type: 'text', text: billingTag });
+                            }
+                        }
+                        else {
+                            r.system = billingTag;
                         }
-                    }
-                    else {
-                        r.system = billingTag;
                     }
                     finalBody = Buffer.from(JSON.stringify(r));
                 }
@@ -649,15 +724,23 @@ export async function startProxy(opts = {}) {
                 const modelInfo = modelOverride ? ` (model: ${modelOverride})` : '';
                 console.log(`[dario] #${requestCount} ${req.method} ${urlPath}${modelInfo}`);
             }
-            // Beta defaults — matches native Claude Code v2.1.98 headers exactly.
-            // Billing classification is determined by the OAuth token alone, not beta flags.
-            // context-management and prompt-caching-scope are safe for all subscription types.
+            // Beta headers
             const clientBeta = req.headers['anthropic-beta'];
-            let beta = 'oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27,prompt-caching-scope-2026-01-05,claude-code-20250219,advisor-tool-2026-03-01,effort-2025-11-24';
-            if (clientBeta) {
-                const filtered = filterBillableBetas(clientBeta);
-                if (filtered)
-                    beta += ',' + filtered;
+            let beta;
+            if (passthrough) {
+                // Passthrough: only add oauth beta, forward client betas as-is
+                beta = 'oauth-2025-04-20';
+                if (clientBeta)
+                    beta += ',' + clientBeta;
+            }
+            else {
+                // Claude-optimized: full beta set matching CLI v2.1.100
+                beta = 'oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27,prompt-caching-scope-2026-01-05,claude-code-20250219,advisor-tool-2026-03-01,effort-2025-11-24';
+                if (clientBeta) {
+                    const filtered = filterBillableBetas(clientBeta);
+                    if (filtered)
+                        beta += ',' + filtered;
+                }
             }
             const headers = {
                 ...staticHeaders,
@@ -672,6 +755,25 @@ export async function startProxy(opts = {}) {
                 body: finalBody ? new Uint8Array(finalBody) : undefined,
                 signal: AbortSignal.timeout(UPSTREAM_TIMEOUT_MS),
             });
+            // Enrich 429 errors with rate limit details from headers (Anthropic only returns "Error")
+            if (upstream.status === 429 && !(cliAvailable && !useCli)) {
+                const errBody = await upstream.text().catch(() => '');
+                const enriched = enrich429(errBody, upstream.headers);
+                const responseHeaders = {
+                    'Content-Type': 'application/json',
+                    'Access-Control-Allow-Origin': corsOrigin,
+                    ...SECURITY_HEADERS,
+                };
+                for (const [key, value] of upstream.headers.entries()) {
+                    if (key.startsWith('x-ratelimit') || key.startsWith('anthropic-ratelimit') || key === 'request-id') {
+                        responseHeaders[key] = value;
+                    }
+                }
+                requestCount++;
+                res.writeHead(429, responseHeaders);
+                res.end(enriched);
+                return;
+            }
             // Auto-fallback: if API returns 429 and CLI is available, retry through CLI binary.
             // The CLI gets priority routing from Anthropic's server — a separate rate limit pool
             // that continues working when the direct API quota is exhausted for expensive models.
@@ -866,7 +968,7 @@ export async function startProxy(opts = {}) {
         process.exit(1);
     });
     server.listen(port, LOCALHOST, () => {
-        const oauthLine = useCli ? 'Backend: Claude CLI (bypasses rate limits)' : `OAuth: ${status.status} (expires in ${status.expiresIn})`;
+        const modeLine = passthrough ? 'Mode: passthrough (OAuth swap only, no injection)' : useCli ? 'Backend: Claude CLI (bypasses rate limits)' : `OAuth: ${status.status} (expires in ${status.expiresIn})`;
         const modelLine = modelOverride ? `Model: ${modelOverride} (all requests)` : 'Model: passthrough (client decides)';
         console.log('');
         console.log(`  dario — http://localhost:${port}`);
@@ -877,7 +979,7 @@ export async function startProxy(opts = {}) {
         console.log(`    ANTHROPIC_BASE_URL=http://localhost:${port}`);
         console.log('    ANTHROPIC_API_KEY=dario');
         console.log('');
-        console.log(`  ${oauthLine}`);
+        console.log(`  ${modeLine}`);
         console.log(`  ${modelLine}`);
         console.log('');
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "2.7.0",
+  "version": "2.8.0",
   "description": "Use your Claude subscription as an API. No API key needed. Local proxy for Claude Max/Pro subscriptions.",
   "type": "module",
   "bin": {
@@ -24,7 +24,8 @@
     "audit": "npm audit --production --audit-level=high",
     "prepublishOnly": "npm run build",
     "start": "node dist/cli.js",
-    "dev": "tsx src/cli.ts"
+    "dev": "tsx src/cli.ts",
+    "e2e": "node test/e2e.mjs"
   },
   "keywords": [
     "claude",