@askalf/dario 3.1.1 → 3.2.0

package/dist/cli.js

@@ -9,6 +9,29 @@
  *   dario refresh   — Force token refresh
  *   dario logout    — Remove saved credentials
  */
+// ── Bun auto-relaunch ──
+// Bun's TLS fingerprint matches Claude Code's runtime (both use Bun/BoringSSL).
+// If Bun is installed and we're running on Node, relaunch under Bun for
+// network-level fingerprint fidelity.
+if (!('Bun' in globalThis) && !process.env.DARIO_NO_BUN) {
+    try {
+        const { execFileSync } = await import('node:child_process');
+        // Check if bun exists
+        execFileSync('bun', ['--version'], { stdio: 'ignore', timeout: 3000 });
+        // Relaunch under bun
+        const { spawn } = await import('node:child_process');
+        const child = spawn('bun', ['run', ...process.argv.slice(1)], {
+            stdio: 'inherit',
+            env: { ...process.env, DARIO_NO_BUN: '1' },
+        });
+        child.on('exit', (code) => process.exit(code ?? 0));
+        // Prevent this process from continuing
+        await new Promise(() => { });
+    }
+    catch {
+        // Bun not available, continue with Node
+    }
+}
 import { unlink } from 'node:fs/promises';
 import { join } from 'node:path';
 import { homedir } from 'node:os';

package/dist/proxy.js

@@ -143,7 +143,9 @@ function sendCliResponse(res, cliResult, clientWantsStream, isOpenAI, corsOrigin
     res.writeHead(cliResult.status, { 'Content-Type': cliResult.contentType, ...headers });
     res.end(cliResult.body);
 }
-const SESSION_ID = randomUUID();
+// Session ID rotates per request — each CC --print invocation creates a new session.
+// A persistent session ID across many requests is a detection signal.
+let SESSION_ID = randomUUID();
 const OS_NAME = platform === 'win32' ? 'Windows' : platform === 'darwin' ? 'MacOS' : 'Linux';
 // Claude Code device identity — required for Max plan billing classification.
 // Without metadata.user_id, Anthropic classifies requests as third-party and
@@ -520,7 +522,6 @@ export async function startProxy(opts = {}) {
         'anthropic-dangerous-direct-browser-access': 'true',
         'user-agent': `claude-cli/${cliVersion} (external, cli)`,
         'x-app': 'cli',
-        'x-claude-code-session-id': SESSION_ID,
         'x-stainless-arch': arch,
         'x-stainless-lang': 'js',
         'x-stainless-os': OS_NAME,
@@ -533,6 +534,11 @@ export async function startProxy(opts = {}) {
     const useCli = opts.cliBackend ?? false;
     let requestCount = 0;
     const semaphore = new Semaphore(MAX_CONCURRENT);
+    // Rate governor: CC --print takes ~2-3s per invocation.
+    // Rapid-fire requests from one "session" is an inhuman pattern.
+    // Minimum 500ms between requests — fast enough for agents, slow enough to not flag.
+    let lastRequestTime = 0;
+    const MIN_REQUEST_INTERVAL_MS = parseInt(process.env.DARIO_MIN_INTERVAL_MS || '500', 10);
     // Optional proxy authentication — pre-encode key buffer for performance
     const apiKey = process.env.DARIO_API_KEY;
     const apiKeyBuf = apiKey ? Buffer.from(apiKey) : null;
@@ -739,15 +745,24 @@ export async function startProxy(opts = {}) {
                         beta += ',' + filtered;
                 }
             }
+            // Rate governor — prevent inhuman request cadence
+            const now = Date.now();
+            const elapsed = now - lastRequestTime;
+            if (elapsed < MIN_REQUEST_INTERVAL_MS && lastRequestTime > 0) {
+                await new Promise(r => setTimeout(r, MIN_REQUEST_INTERVAL_MS - elapsed));
+            }
+            lastRequestTime = Date.now();
+            // Rotate session ID per request — CC --print creates a new session each invocation
+            SESSION_ID = randomUUID();
             const headers = {
                 ...staticHeaders,
                 'Authorization': `Bearer ${accessToken}`,
+                'x-claude-code-session-id': SESSION_ID,
                 'anthropic-version': passthrough ? (req.headers['anthropic-version'] || '2023-06-01') : '2023-06-01',
                 'anthropic-beta': beta,
-                // Real Claude Code adds x-client-request-id for firstParty + api.anthropic.com
                 'x-client-request-id': randomUUID(),
-                // Real Claude Code sends 600 on first request, 300 on subsequent
-                'x-stainless-timeout': requestCount <= 1 ? '600' : '300',
+                // CC sends 600 on first request per session. With rotation, every request is "first"
+                'x-stainless-timeout': '600',
             };
             const upstream = await fetch(targetBase, {
                 method: req.method ?? 'POST',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "3.1.1",
+  "version": "3.2.0",
   "description": "Use your Claude subscription as an API. No API key needed. Local proxy for Claude Max/Pro subscriptions.",
   "type": "module",
   "bin": {