@askalf/dario 3.32.2 → 3.33.0

package/dist/cc-template.js

@@ -255,6 +255,21 @@ export function detectTextToolClient(systemText) {
     // preserve-tools is the only correct routing.
     if (/\bYou are Arnie\b/.test(systemText))
         return 'arnie';
+    // hands (askalf) — cross-platform computer-use agent built on the
+    // Anthropic SDK with computer-use beta tools (computer_20251124,
+    // bash_20250124, text_editor_20250728). Identity line is stable
+    // across CLI mode ("You are a computer control agent with FULL
+    // access to this <os> machine ...") and SDK mode ("You are a
+    // computer control agent on <os> ..."). Tool name `bash` overlaps
+    // with TOOL_MAP, but the wire shape is Anthropic's beta computer-
+    // use tool (`type: 'bash_20250124'`, no `command`/`description`
+    // schema) — default round-robin remap would corrupt those calls
+    // and lose the `computer` / `text_editor` tools entirely (neither
+    // is in TOOL_MAP, structural fallback won't catch them at the
+    // 80% threshold either). Identity match → auto preserve-tools,
+    // like arnie.
+    if (/\bYou are a computer control agent\b/.test(systemText))
+        return 'hands';
     // Protocol-signature fallback — unique to the Cline family and its
     // forks; survives a forked system prompt that edited the identity
     // string out but kept the tool protocol intact.

package/dist/oauth.d.ts

@@ -14,6 +14,15 @@ export interface CredentialsFile {
     claudeAiOauth: OAuthTokens;
 }
 export declare function loadCredentials(): Promise<CredentialsFile | null>;
+/**
+ * Pick the freshest of a set of `CredentialsFile` candidates by
+ * `expiresAt` (unix-ms timestamp; missing/zero sorts last). Stable on
+ * ties — the first-pushed candidate wins when expiresAt is equal,
+ * which means the canonical call order
+ * `[darioFile, ccFile, keychain]` keeps the dario-file source as the
+ * tiebreaker preference. Exported for direct testing.
+ */
+export declare function pickFreshestCredentials(candidates: CredentialsFile[]): CredentialsFile | null;
 /**
  * Automatic OAuth flow using a local callback server (same as Claude Code).
  * Opens browser, captures the authorization code automatically.

package/dist/oauth.js

@@ -159,27 +159,60 @@ export async function loadCredentials() {
     if (credentialsCache && Date.now() - credentialsCacheTime < CACHE_TTL_MS) {
         return credentialsCache;
     }
-    // Try dario's own credentials first, then fall back to Claude Code's file
+    // Read every available source (dario file, CC file, OS keychain) and
+    // pick the freshest. Previously this returned the first source that
+    // had both tokens regardless of expiry — which means a stale
+    // ~/.dario/credentials.json (left over from a prior `dario login`
+    // whose refresh_token has since been invalidated by Anthropic) would
+    // shadow CC's still-fresh ~/.claude/.credentials.json forever, with
+    // no automatic recovery. Picking the freshest makes auto-detection
+    // work the way it did before any `dario login` had ever run, while
+    // still preferring dario's own file when both sources are equivalent
+    // (dario file wins ties on expiresAt by being checked first).
+    const candidates = [];
     for (const path of [getDarioCredentialsPath(), getClaudeCodeCredentialsPath()]) {
         try {
             const raw = await readFile(path, 'utf-8');
             const parsed = JSON.parse(raw);
             if (parsed?.claudeAiOauth?.accessToken && parsed?.claudeAiOauth?.refreshToken) {
-                credentialsCache = parsed;
-                credentialsCacheTime = Date.now();
-                return credentialsCache;
+                candidates.push(parsed);
             }
         }
         catch { /* try next */ }
     }
-    // Fall back to OS keychain (modern CC stores credentials here, not on disk)
+    // OS keychain (modern CC stores credentials here, not on disk).
     const keychainCreds = await loadKeychainCredentials();
-    if (keychainCreds) {
-        credentialsCache = keychainCreds;
-        credentialsCacheTime = Date.now();
-        return credentialsCache;
+    if (keychainCreds?.claudeAiOauth?.accessToken && keychainCreds?.claudeAiOauth?.refreshToken) {
+        candidates.push(keychainCreds);
     }
-    return null;
+    const best = pickFreshestCredentials(candidates);
+    if (!best)
+        return null;
+    credentialsCache = best;
+    credentialsCacheTime = Date.now();
+    return credentialsCache;
+}
+/**
+ * Pick the freshest of a set of `CredentialsFile` candidates by
+ * `expiresAt` (unix-ms timestamp; missing/zero sorts last). Stable on
+ * ties — the first-pushed candidate wins when expiresAt is equal,
+ * which means the canonical call order
+ * `[darioFile, ccFile, keychain]` keeps the dario-file source as the
+ * tiebreaker preference. Exported for direct testing.
+ */
+export function pickFreshestCredentials(candidates) {
+    if (candidates.length === 0)
+        return null;
+    let best = candidates[0];
+    let bestExp = best.claudeAiOauth.expiresAt ?? 0;
+    for (let i = 1; i < candidates.length; i++) {
+        const exp = candidates[i].claudeAiOauth.expiresAt ?? 0;
+        if (exp > bestExp) {
+            best = candidates[i];
+            bestExp = exp;
+        }
+    }
+    return best;
 }
 async function saveCredentials(creds) {
     const path = getDarioCredentialsPath();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "3.32.2",
+  "version": "3.33.0",
   "description": "A local LLM router. One endpoint, every provider — Claude subscriptions, OpenAI, OpenRouter, Groq, local LiteLLM, any OpenAI-compat endpoint — your tools don't need to change.",
   "type": "module",
   "bin": {