@askalf/dario 3.31.13 → 3.31.14

package/README.md

@@ -202,6 +202,8 @@ dario accounts list
 dario proxy
 ```
 
+If you already have a single-account `dario login` set up and run `dario accounts add <alias>` for the first time, dario **back-fills** your existing login credentials into the pool under the reserved alias `login` before running OAuth for the new alias. Net effect: your first `accounts add` gives you two pool accounts (login + new alias), pool mode activates immediately. Back-fill is one-shot, idempotent, and never touches your existing `credentials.json` — if you later `dario accounts remove` below the 2+ threshold, single-account mode reads it unchanged. Skipped if you explicitly pick `login` as the new alias — your intent wins.
+
 Each request picks the account with the highest headroom:
 
 ```
@@ -340,7 +342,7 @@ A version marker (`<!-- dario-sub-agent-version: X -->`) embedded in the markdow
 | `dario status` | Show Claude backend OAuth token health and expiry |
 | `dario refresh` | Force an immediate Claude token refresh |
 | `dario logout` | Delete stored Claude credentials |
-| `dario accounts list` / `add <alias>` / `remove <alias>` | Multi-account pool management |
+| `dario accounts list` / `add <alias>` / `remove <alias>` | Multi-account pool management. `add <alias>` on a fresh pool auto back-fills your existing `dario login` credentials as `login`, so your first `add` trips the 2+ pool threshold on its own — see [Multi-account pool mode](#multi-account-pool-mode). |
 | `dario backend list` / `add <name> --key=<key> [--base-url=<url>]` / `remove <name>` | OpenAI-compat backend management |
 | `dario shim -- <cmd> [args...]` | Run a child process with the in-process fetch patch (see [Shim mode](#shim-mode)) |
 | `dario subagent install` / `remove` / `status` | CC sub-agent lifecycle (v3.26 — see [sub-agent hook](#claude-code-sub-agent-hook-v326)) |
@@ -762,6 +764,17 @@ Yes — anything that speaks the OpenAI Chat Completions API. Groq, OpenRouter,
 **Something's wrong. Where do I start?**
 `dario doctor`. One command, one aggregated report — dario version, Node, platform, runtime/TLS classification, CC binary compat, template source + age + drift, OAuth status, pool state, backends, sub-agent install state, home dir. Exit code 1 if any check fails. Paste the output when you file an issue. (If you're inside Claude Code, `dario subagent install` once and then ask CC to "use the dario sub-agent to run doctor" — same output, no context switch.)
 
+**OpenClaw returns 401 after I set `DARIO_API_KEY` (or upgrade past v3.30.6).**
+If you run `dario proxy --host=0.0.0.0` (non-loopback), dario requires `DARIO_API_KEY` to be set so it's not an open subscription relay. OpenClaw 2026.2.17+ prefers `~/.openclaw/agents/main/agent/auth-profiles.json` over `openclaw.json`'s `apiKey` field or the `ANTHROPIC_API_KEY` env var — so if you have a stale Anthropic token in `auth-profiles.json` from an earlier setup, OpenClaw sends *that* token instead of `dario`, and dario rejects the request with `Authorization present but value mismatch` (visible under `dario proxy -v`, added in v3.31.2).
+
+Three fixes, in order of simplicity:
+
+1. **Use loopback.** `dario proxy --host=127.0.0.1` — auth only enforced on non-loopback binds, no `DARIO_API_KEY` required, no OpenClaw changes. Best if you don't actually need LAN reach to dario.
+2. **Delete the Anthropic auth profile.** Remove the `"anthropic:default"` entry from `~/.openclaw/agents/main/agent/auth-profiles.json`. OpenClaw then falls back through the config chain and picks up `ANTHROPIC_API_KEY=dario` from the env. Confirmed working by [@tetsuco in #97](https://github.com/askalf/dario/issues/97).
+3. **Overwrite the auth profile.** `openclaw models auth paste-token --provider anthropic` and paste `dario`. Replaces whatever key was in there — keep a backup if you use it elsewhere.
+
+Diagnose with `dario proxy -v` — the reject log (v3.31.2+) reports header-name only (never the value, since it may be a real credential you mistyped) and tells you which of the three configs is actually being hit.
+
 **What happens when Anthropic rotates the OAuth config?**
 Dario auto-detects OAuth config from the installed Claude Code binary. When CC ships a new version with rotated values, dario picks them up on the next run. Cache at `~/.dario/cc-oauth-cache-v6.json`, keyed by the CC binary fingerprint. The cache path version bumps each time the canonical OAuth config shape changes so stale caches regenerate automatically on upgrade — v3 → v4 in v3.19.4 (scope-list flip CC v2.1.104 → v2.1.107), v4 → v5 in v3.31.3 (authorize URL `claude.com/cai/` → `claude.ai/` host normalization), v5 → v6 in v3.31.4 (6-scope restore after CC v2.1.116).
 
@@ -781,6 +794,9 @@ Env vars win over the file. Set `DARIO_OAUTH_DISABLE_OVERRIDE=1` to force pure a
 **What happens when Anthropic changes the CC request template?**
 Dario extracts the live request template from your installed Claude Code binary on startup — the system prompt, tool schemas, user-agent, beta flags, header insertion order, static header values, and top-level request-body key order — and uses those to replay requests instead of a version pinned into dario itself. When CC ships a new version with a tweaked template, the next `dario proxy` run picks it up automatically. Drift detection forces a refresh when the installed CC version changes under dario, and the nightly `cc-drift-watch` workflow catches upstream rotations (client_id, URLs, tool set, version) the day they ship on npm.
 
+**Why does `dario accounts list` show an account called `login` I never added?**
+That's your existing `dario login` credentials, back-filled into the pool automatically on your first `dario accounts add <alias>`. Pool mode activates at 2+ accounts in `~/.dario/accounts/`, and the single-account `credentials.json` store lives outside that directory — so without the back-fill, one `accounts add` would leave you at 1 pool entry and your login account orphaned. The `login` alias is reserved for this path. Safe to `dario accounts remove login` if you don't want it pooled; the original `credentials.json` is untouched by the back-fill, so single-account mode resumes reading it after removal drops you below the 2+ threshold. See [Multi-account pool mode](#multi-account-pool-mode) for the full picture.
+
 **First time setup on a fresh Claude account.**
 If dario is the first thing you run against a brand-new Claude account, prime the account with a few real Claude Code commands first:
 ```bash

package/dist/accounts.d.ts

@@ -23,3 +23,37 @@ export declare function _accountRefreshesInFlightSizeForTest(): number;
  */
 export declare function addAccountViaOAuth(alias: string): Promise<AccountCredentials>;
 export declare function getAccountsDir(): string;
+/**
+ * Alias reserved for credentials auto-migrated from the single-account
+ * `dario login` store. Named `login` so it's semantically obvious where
+ * the entry came from and unlikely to collide with user-chosen aliases
+ * like `work`, `personal`, etc. If a user specifically requests `login`
+ * as the alias for `dario accounts add`, the caller falls back to
+ * `default` so the migration doesn't step on the user's intent.
+ */
+export declare const MIGRATED_LOGIN_ALIAS = "login";
+/**
+ * Promote the user's existing single-account `dario login` credentials
+ * (`~/.dario/credentials.json`, `~/.claude/.credentials.json`, or OS
+ * keychain — whichever `loadCredentials` finds) into the pool under a
+ * reserved alias.
+ *
+ * Why: the pool activation threshold is 2+ accounts in `~/.dario/accounts/`.
+ * A user with one `dario login` account + one `dario accounts add bar`
+ * ends up with only one account in `accounts/` (bar), pool mode never
+ * trips, and the login account is effectively orphaned while pool is off.
+ * Calling this on the first `dario accounts add` back-fills the login
+ * account into the pool so the second `add` crosses the threshold.
+ *
+ * Idempotent: no-op if `accounts/` already has any entry, no-op if no
+ * credentials are reachable anywhere. Returns the alias written to, or
+ * `null` when nothing happened.
+ *
+ * The source `credentials.json` (if present) is left untouched — single-
+ * account mode still reads it if the user later `accounts remove`s down
+ * below the pool threshold. Migration is copy-only, never destructive.
+ *
+ * @param preferredAlias caller may request a specific alias. If it's
+ *   already the reserved `login` (or collides), falls back to `default`.
+ */
+export declare function ensureLoginCredentialsInPool(alias?: string): Promise<string | null>;

package/dist/accounts.js

@@ -2,10 +2,15 @@
  * Multi-account credential storage.
  *
  * Accounts live at `~/.dario/accounts/<alias>.json`. Single-account dario
- * still uses `~/.dario/credentials.json` and does not touch this module.
- * When `~/.dario/accounts/` contains 2+ files the proxy activates pool mode
- * (see pool.ts). Each account has its own independent OAuth lifecycle and
- * can refresh without affecting the others.
+ * uses `~/.dario/credentials.json` (plus the CC file + OS keychain fallback
+ * paths in oauth.ts). When `~/.dario/accounts/` contains 2+ files the proxy
+ * activates pool mode (see pool.ts). Each account has its own independent
+ * OAuth lifecycle and can refresh without affecting the others.
+ *
+ * `ensureLoginCredentialsInPool` (below) bridges the two stores on the
+ * first `dario accounts add` — it promotes the user's existing login
+ * credentials into the pool under a reserved alias so that adding a
+ * second account actually trips the 2+ threshold and activates pooling.
  *
  * OAuth config (client_id, scopes, authorize URL, token URL) comes from
  * dario's cc-oauth-detect scanner — the same source the single-account
@@ -17,6 +22,7 @@ import { homedir } from 'node:os';
 import { randomUUID, randomBytes, createHash } from 'node:crypto';
 import { createServer } from 'node:http';
 import { detectCCOAuthConfig } from './cc-oauth-detect.js';
+import { loadCredentials } from './oauth.js';
 const DARIO_DIR = join(homedir(), '.dario');
 const ACCOUNTS_DIR = join(DARIO_DIR, 'accounts');
 /**
@@ -308,3 +314,61 @@ export async function addAccountViaOAuth(alias) {
 export function getAccountsDir() {
     return ACCOUNTS_DIR;
 }
+/**
+ * Alias reserved for credentials auto-migrated from the single-account
+ * `dario login` store. Named `login` so it's semantically obvious where
+ * the entry came from and unlikely to collide with user-chosen aliases
+ * like `work`, `personal`, etc. If a user specifically requests `login`
+ * as the alias for `dario accounts add`, the caller falls back to
+ * `default` so the migration doesn't step on the user's intent.
+ */
+export const MIGRATED_LOGIN_ALIAS = 'login';
+/**
+ * Promote the user's existing single-account `dario login` credentials
+ * (`~/.dario/credentials.json`, `~/.claude/.credentials.json`, or OS
+ * keychain — whichever `loadCredentials` finds) into the pool under a
+ * reserved alias.
+ *
+ * Why: the pool activation threshold is 2+ accounts in `~/.dario/accounts/`.
+ * A user with one `dario login` account + one `dario accounts add bar`
+ * ends up with only one account in `accounts/` (bar), pool mode never
+ * trips, and the login account is effectively orphaned while pool is off.
+ * Calling this on the first `dario accounts add` back-fills the login
+ * account into the pool so the second `add` crosses the threshold.
+ *
+ * Idempotent: no-op if `accounts/` already has any entry, no-op if no
+ * credentials are reachable anywhere. Returns the alias written to, or
+ * `null` when nothing happened.
+ *
+ * The source `credentials.json` (if present) is left untouched — single-
+ * account mode still reads it if the user later `accounts remove`s down
+ * below the pool threshold. Migration is copy-only, never destructive.
+ *
+ * @param preferredAlias caller may request a specific alias. If it's
+ *   already the reserved `login` (or collides), falls back to `default`.
+ */
+export async function ensureLoginCredentialsInPool(alias = MIGRATED_LOGIN_ALIAS) {
+    if (!safeAliasPath(alias))
+        return null;
+    const existing = await listAccountAliases();
+    if (existing.length > 0)
+        return null;
+    const creds = await loadCredentials();
+    const tok = creds?.claudeAiOauth;
+    if (!tok?.accessToken || !tok?.refreshToken)
+        return null;
+    const identity = (await detectClaudeIdentity()) ?? {
+        deviceId: randomUUID(),
+        accountUuid: randomUUID(),
+    };
+    await saveAccount({
+        alias,
+        accessToken: tok.accessToken,
+        refreshToken: tok.refreshToken,
+        expiresAt: tok.expiresAt,
+        scopes: tok.scopes ?? [],
+        deviceId: identity.deviceId,
+        accountUuid: identity.accountUuid,
+    });
+    return alias;
+}

package/dist/cc-authorize-probe.js

@@ -131,7 +131,11 @@ export function buildProbeAuthorizeUrl(cfg) {
         scope: cfg.scopes,
         code_challenge: pkceChallenge(),
         code_challenge_method: 'S256',
-        state: base64url(randomBytes(16)),
+        // 32 bytes — match what CC v2.1.116+ actually sends. See dario#71.
+        // Shorter states produce "Invalid request format" from Anthropic's
+        // authorize endpoint, which the probe classifier would otherwise mis-
+        // attribute to drift when it's actually our own request shape.
+        state: base64url(randomBytes(32)),
     });
     return `${cfg.authorizeUrl}?${params.toString()}`;
 }

package/dist/cli.js

@@ -38,7 +38,7 @@ import { homedir } from 'node:os';
 import { startAutoOAuthFlow, startManualOAuthFlow, detectHeadlessEnvironment, getStatus, refreshTokens, loadCredentials } from './oauth.js';
 import { startProxy, sanitizeError } from './proxy.js';
 import { VALID_EFFORT_VALUES } from './cc-template.js';
-import { listAccountAliases, loadAllAccounts, addAccountViaOAuth, removeAccount } from './accounts.js';
+import { listAccountAliases, loadAllAccounts, addAccountViaOAuth, removeAccount, ensureLoginCredentialsInPool, MIGRATED_LOGIN_ALIAS } from './accounts.js';
 import { listBackends, saveBackend, removeBackend } from './openai-backend.js';
 const args = process.argv.slice(2);
 const command = args[0] ?? 'proxy';
@@ -463,6 +463,22 @@ async function accounts() {
             console.error(`[dario] Account "${alias}" already exists. Remove it first with \`dario accounts remove ${alias}\`.`);
             process.exit(1);
         }
+        // If the user has `dario login` credentials on disk or in the keychain
+        // and the pool is empty, migrate those credentials into the pool first.
+        // Otherwise the new account lives alone in accounts/, pool mode never
+        // trips the 2+ threshold, and the login account is orphaned from the
+        // pool until the user figures out they have to re-`accounts add` it.
+        // Skip silently when the user explicitly picks the reserved alias —
+        // their intent wins, they can run `accounts add` again for the login
+        // migration under a different alias.
+        if (existing.length === 0 && alias !== MIGRATED_LOGIN_ALIAS) {
+            const migrated = await ensureLoginCredentialsInPool();
+            if (migrated) {
+                console.log('');
+                console.log(`  Migrated your existing \`dario login\` account into the pool as "${migrated}".`);
+                console.log(`  (Pool mode activates on 2+ accounts — this back-fill plus "${alias}" crosses that.)`);
+            }
+        }
         console.log('');
         console.log(`  Adding account "${alias}" to the pool...`);
         console.log('');

package/dist/index.d.ts

@@ -9,7 +9,7 @@ export type { OAuthTokens, CredentialsFile } from './oauth.js';
 export { startProxy, sanitizeError } from './proxy.js';
 export { AccountPool, parseRateLimits } from './pool.js';
 export type { PoolAccount, PoolStatus, RateLimitSnapshot, AccountIdentity } from './pool.js';
-export { listAccountAliases, loadAccount, loadAllAccounts, saveAccount, removeAccount, refreshAccountToken, addAccountViaOAuth, getAccountsDir, } from './accounts.js';
+export { listAccountAliases, loadAccount, loadAllAccounts, saveAccount, removeAccount, refreshAccountToken, addAccountViaOAuth, ensureLoginCredentialsInPool, MIGRATED_LOGIN_ALIAS, getAccountsDir, } from './accounts.js';
 export type { AccountCredentials } from './accounts.js';
 export { Analytics } from './analytics.js';
 export type { RequestRecord, AnalyticsSummary } from './analytics.js';

package/dist/index.js

@@ -10,7 +10,7 @@ export { startProxy, sanitizeError } from './proxy.js';
 // contains 2+ accounts; see README for the progression from single-account
 // mode to pool mode).
 export { AccountPool, parseRateLimits } from './pool.js';
-export { listAccountAliases, loadAccount, loadAllAccounts, saveAccount, removeAccount, refreshAccountToken, addAccountViaOAuth, getAccountsDir, } from './accounts.js';
+export { listAccountAliases, loadAccount, loadAllAccounts, saveAccount, removeAccount, refreshAccountToken, addAccountViaOAuth, ensureLoginCredentialsInPool, MIGRATED_LOGIN_ALIAS, getAccountsDir, } from './accounts.js';
 export { Analytics } from './analytics.js';
 // Multi-provider backends (v3.6.0+). Secondary OpenAI-compat providers
 // (OpenAI, OpenRouter, Groq, local LiteLLM, etc.) configured via

package/dist/oauth.js

@@ -198,7 +198,10 @@ async function saveCredentials(creds) {
 export async function startAutoOAuthFlow() {
     const { createServer } = await import('node:http');
     const { codeVerifier, codeChallenge } = generatePKCE();
-    const state = base64url(randomBytes(16));
+    // 32 random bytes → 43-char base64url state. See dario#71 — Anthropic's
+    // authorize endpoint rejects shorter states with "Invalid request format";
+    // CC v2.1.116+ ships 32. Keep in lockstep with CC's entropy-per-state.
+    const state = base64url(randomBytes(32));
     return new Promise((resolve, reject) => {
         const server = createServer((req, res) => {
             const url = new URL(req.url || '', `http://${req.headers.host || 'localhost'}`);
@@ -387,7 +390,8 @@ export function detectHeadlessEnvironment() {
  */
 export async function startManualOAuthFlow() {
     const { codeVerifier, codeChallenge } = generatePKCE();
-    const state = base64url(randomBytes(16));
+    // 32 bytes — same reason as startAutoOAuthFlow. See dario#71.
+    const state = base64url(randomBytes(32));
     const cfg = await getOAuthConfig();
     const authUrl = buildManualAuthorizeUrl(cfg, codeChallenge, state);
     console.log('');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "3.31.13",
+  "version": "3.31.14",
   "description": "A local LLM router. One endpoint, every provider — Claude subscriptions, OpenAI, OpenRouter, Groq, local LiteLLM, any OpenAI-compat endpoint — your tools don't need to change.",
   "type": "module",
   "bin": {
@@ -69,7 +69,7 @@
     "node": ">=18.0.0"
   },
   "devDependencies": {
-    "@types/node": "^22.0.0",
+    "@types/node": "^25.6.0",
     "tsx": "^4.19.0",
     "typescript": "^5.7.0"
   }