@askalf/dario 3.4.0 → 3.4.3

package/dist/proxy.js

@@ -1,9 +1,9 @@
 import { createServer } from 'node:http';
 import { randomUUID, randomBytes, timingSafeEqual, createHash } from 'node:crypto';
-import { execSync, spawn } from 'node:child_process';
-import { readFileSync, readdirSync, writeFileSync, unlinkSync } from 'node:fs';
+import { execSync } from 'node:child_process';
+import { readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
-import { homedir, tmpdir } from 'node:os';
+import { homedir } from 'node:os';
 import { arch, platform } from 'node:process';
 import { getAccessToken, getStatus } from './oauth.js';
 import { buildCCRequest, reverseMapResponse } from './cc-template.js';
@@ -13,7 +13,16 @@ const MAX_BODY_BYTES = 10 * 1024 * 1024; // 10 MB — generous for large prompts
 const UPSTREAM_TIMEOUT_MS = 300_000; // 5 min — matches Anthropic SDK default
 const BODY_READ_TIMEOUT_MS = 30_000; // 30s — prevents slow-loris on body reads
 const MAX_CONCURRENT = 10; // Max concurrent upstream requests
-const LOCALHOST = '127.0.0.1';
+const DEFAULT_HOST = '127.0.0.1';
+// A host is "loopback" if it's one of the well-known localhost literals.
+// Used to decide whether to warn at startup about binding to a reachable
+// interface — binding anywhere else means other machines can reach the
+// proxy and should only be done with DARIO_API_KEY set.
+function isLoopbackHost(host) {
+    if (host === '127.0.0.1' || host === '::1' || host === 'localhost')
+        return true;
+    return host.startsWith('127.');
+}
 // Simple semaphore for concurrency control
 class Semaphore {
     max;
@@ -36,63 +45,29 @@ class Semaphore {
             next();
     }
 }
-// Billing tag hash seed — extracted from Claude Code binary (constant XGA)
+// Billing tag hash seed — matches Claude Code's value
 const BILLING_SEED = '59cf53e54c78';
-// Compute per-request build tag matching Claude Code's Oz$ algorithm:
+// Compute per-request build tag:
 // SHA-256(seed + chars[4,7,20] of user message + version).slice(0,3)
 function computeBuildTag(userMessage, version) {
     const chars = [4, 7, 20].map(i => userMessage[i] || '0').join('');
     return createHash('sha256').update(`${BILLING_SEED}${chars}${version}`).digest('hex').slice(0, 3);
 }
-// Per-request cch: real Claude Code generates a random 5-char hex value each request.
-// Confirmed via MITM: 10 identical requests → 10 unique cch values, no deterministic pattern.
+// Per-request cch: random 5-char hex value each request (Claude Code does the same).
 function computeCch() {
     return randomBytes(3).toString('hex').slice(0, 5);
 }
-// Detect installed Claude Code binary at startup (single exec for both version + availability)
-let cliAvailable = false;
-function detectCli() {
+// Detect installed Claude Code version for the build-tag computation.
+// Falls back to a known-good version if claude isn't on PATH.
+function detectCliVersion() {
     try {
         const out = execSync('claude --version', { timeout: 5000, stdio: 'pipe' }).toString().trim();
-        cliAvailable = true;
-        // Capture major version (e.g., 2.1.100) — build tag is computed per-request
         return out.match(/^([\d]+\.[\d]+\.[\d]+)/)?.[1] ?? '2.1.100';
     }
     catch {
-        cliAvailable = false;
         return '2.1.100';
     }
 }
-/** Convert a non-streaming Messages API response to SSE event stream. */
-function jsonToSse(jsonBody) {
-    try {
-        const msg = JSON.parse(jsonBody);
-        const events = [];
-        // message_start
-        events.push(`event: message_start\ndata: ${JSON.stringify({ type: 'message_start', message: { ...msg, content: [], stop_reason: null } })}\n\n`);
-        // content blocks
-        const content = msg.content;
-        if (content) {
-            for (let i = 0; i < content.length; i++) {
-                const block = content[i];
-                events.push(`event: content_block_start\ndata: ${JSON.stringify({ type: 'content_block_start', index: i, content_block: { type: block.type, ...(block.type === 'text' ? { text: '' } : { thinking: '' }) } })}\n\n`);
-                if (block.type === 'text' && block.text) {
-                    events.push(`event: content_block_delta\ndata: ${JSON.stringify({ type: 'content_block_delta', index: i, delta: { type: 'text_delta', text: block.text } })}\n\n`);
-                }
-                else if (block.type === 'thinking' && block.thinking) {
-                    events.push(`event: content_block_delta\ndata: ${JSON.stringify({ type: 'content_block_delta', index: i, delta: { type: 'thinking_delta', thinking: block.thinking } })}\n\n`);
-                }
-                events.push(`event: content_block_stop\ndata: ${JSON.stringify({ type: 'content_block_stop', index: i })}\n\n`);
-            }
-        }
-        // message_stop
-        events.push(`event: message_stop\ndata: ${JSON.stringify({ type: 'message_stop' })}\n\n`);
-        return events.join('');
-    }
-    catch {
-        return '';
-    }
-}
 /** Extract first user message text from a request body for billing tag computation. */
 function extractFirstUserMessage(body) {
     const messages = body.messages;
@@ -109,42 +84,8 @@ function extractFirstUserMessage(body) {
     }
     return '';
 }
-/** Convert CLI JSON response to OpenAI SSE format. */
-function jsonToOpenaiSse(jsonBody) {
-    try {
-        const parsed = JSON.parse(jsonBody);
-        const text = parsed.content?.find(c => c.type === 'text')?.text ?? '';
-        const ts = Math.floor(Date.now() / 1000);
-        return `data: ${JSON.stringify({ id: 'chatcmpl-dario', object: 'chat.completion.chunk', created: ts, model: 'claude', choices: [{ index: 0, delta: { content: text }, finish_reason: null }] })}\n\n` +
-            `data: ${JSON.stringify({ id: 'chatcmpl-dario', object: 'chat.completion.chunk', created: ts, model: 'claude', choices: [{ index: 0, delta: {}, finish_reason: 'stop' }] })}\n\ndata: [DONE]\n\n`;
-    }
-    catch {
-        return '';
-    }
-}
-/** Send a CLI result to the client, handling streaming/format translation. */
-function sendCliResponse(res, cliResult, clientWantsStream, isOpenAI, corsOrigin, securityHeaders) {
-    const headers = { 'Access-Control-Allow-Origin': corsOrigin, ...securityHeaders };
-    const ok = cliResult.status >= 200 && cliResult.status < 300;
-    if (ok && clientWantsStream) {
-        const sseData = isOpenAI ? jsonToOpenaiSse(cliResult.body) : jsonToSse(cliResult.body);
-        if (sseData) {
-            res.writeHead(200, { 'Content-Type': 'text/event-stream', ...headers });
-            res.end(sseData);
-            return;
-        }
-    }
-    if (ok && isOpenAI) {
-        try {
-            cliResult.body = JSON.stringify(anthropicToOpenai(JSON.parse(cliResult.body)));
-        }
-        catch { }
-    }
-    res.writeHead(cliResult.status, { 'Content-Type': cliResult.contentType, ...headers });
-    res.end(cliResult.body);
-}
-// Session ID rotates per request — each CC --print invocation creates a new session.
-// A persistent session ID across many requests is a detection signal.
+// Session ID rotates per request — fresh UUID per invocation.
+// A persistent session ID across many requests is a behavioral fingerprint.
 let SESSION_ID = randomUUID();
 const OS_NAME = platform === 'win32' ? 'Windows' : platform === 'darwin' ? 'MacOS' : 'Linux';
 // Claude Code device identity — required for Max plan billing classification.
@@ -205,8 +146,7 @@ function filterBillableBetas(betas) {
 const ORCHESTRATION_TAG_NAMES = [
     'system-reminder', 'env', 'system_information', 'current_working_directory',
     'operating_system', 'default_shell', 'home_directory', 'task_metadata',
-    'tool_exec', 'tool_output', 'skill_content', 'skill_files',
-    'directories', 'available_skills', 'thinking',
+    'directories', 'thinking',
 ];
 const ORCHESTRATION_PATTERNS = ORCHESTRATION_TAG_NAMES.flatMap(tag => [
     new RegExp(`<${tag}\\b[^>]*>[\\s\\S]*?<\\/${tag}>`, 'gi'),
@@ -375,125 +315,9 @@ function enrich429(body, headers) {
         return body;
     }
 }
-/**
- * CLI Backend: route requests through `claude --print` instead of direct API.
- * This bypasses rate limiting because Claude Code's binary has priority routing.
- */
-async function handleViaCli(body, model, verbose) {
-    try {
-        const parsed = JSON.parse(body.toString());
-        // Extract the last user message as the prompt
-        const messages = parsed.messages ?? [];
-        const lastUser = [...messages].reverse().find(m => m.role === 'user');
-        if (!lastUser) {
-            return { status: 400, body: JSON.stringify({ error: 'No user message' }), contentType: 'application/json' };
-        }
-        const rawModel = model ?? parsed.model ?? 'claude-opus-4-6';
-        // Validate model name — only allow alphanumeric, hyphens, dots, underscores
-        const effectiveModel = /^[a-zA-Z0-9._-]+$/.test(rawModel) ? rawModel : 'claude-opus-4-6';
-        const prompt = typeof lastUser.content === 'string'
-            ? lastUser.content
-            : JSON.stringify(lastUser.content);
-        // Build claude --print command
-        const args = ['--print', '--model', effectiveModel];
-        // Flatten system prompt — API accepts string or array of content blocks,
-        // but claude --print only accepts a string
-        let systemPrompt = '';
-        if (typeof parsed.system === 'string') {
-            systemPrompt = parsed.system;
-        }
-        else if (Array.isArray(parsed.system)) {
-            systemPrompt = parsed.system
-                .filter(b => b.text)
-                .map(b => b.text)
-                .join('\n\n');
-        }
-        // Include conversation history as context
-        const history = messages.slice(0, -1);
-        if (history.length > 0) {
-            const historyText = history.map(m => `${m.role}: ${typeof m.content === 'string' ? m.content : JSON.stringify(m.content)}`).join('\n');
-            systemPrompt = systemPrompt ? `${systemPrompt}\n\nConversation history:\n${historyText}` : `Conversation history:\n${historyText}`;
-        }
-        // Write system prompt to temp file instead of passing as arg to avoid E2BIG
-        // on large conversation contexts (OS arg size limit ~2MB)
-        let systemPromptFile = null;
-        if (systemPrompt) {
-            systemPromptFile = join(tmpdir(), `dario-sysprompt-${randomUUID()}.txt`);
-            writeFileSync(systemPromptFile, systemPrompt, { mode: 0o600 });
-            args.push('--append-system-prompt-file', systemPromptFile);
-        }
-        if (verbose) {
-            console.log(`[dario:cli] model=${effectiveModel} prompt=${prompt.substring(0, 60)}...`);
-        }
-        // Spawn claude --print
-        return new Promise((resolve) => {
-            // Cleanup temp file when done
-            const cleanup = () => { if (systemPromptFile)
-                try {
-                    unlinkSync(systemPromptFile);
-                }
-                catch { } };
-            const child = spawn('claude', args, {
-                stdio: ['pipe', 'pipe', 'pipe'],
-                timeout: 300_000,
-            });
-            let stdout = '';
-            let stderr = '';
-            const MAX_CLI_OUTPUT = 5_000_000; // 5MB cap per stream — prevents OOM from runaway CLI
-            child.stdout.on('data', (d) => { if (stdout.length < MAX_CLI_OUTPUT)
-                stdout += d.toString(); });
-            child.stderr.on('data', (d) => { if (stderr.length < MAX_CLI_OUTPUT)
-                stderr += d.toString(); });
-            child.stdin.write(prompt);
-            child.stdin.end();
-            child.on('close', (code) => {
-                cleanup();
-                if (code !== 0 || !stdout.trim()) {
-                    resolve({
-                        status: 502,
-                        body: JSON.stringify({ type: 'error', error: { type: 'api_error', message: sanitizeError(stderr.substring(0, 200)) || 'CLI backend failed' } }),
-                        contentType: 'application/json',
-                    });
-                    return;
-                }
-                // Build a proper Messages API response
-                const text = stdout.trim();
-                const estimatedTokens = Math.ceil(text.length / 4);
-                const response = {
-                    id: `msg_${randomUUID().replace(/-/g, '').substring(0, 24)}`,
-                    type: 'message',
-                    role: 'assistant',
-                    model: effectiveModel,
-                    content: [{ type: 'text', text }],
-                    stop_reason: 'end_turn',
-                    stop_sequence: null,
-                    usage: {
-                        input_tokens: Math.ceil(prompt.length / 4),
-                        output_tokens: estimatedTokens,
-                    },
-                };
-                resolve({ status: 200, body: JSON.stringify(response), contentType: 'application/json' });
-            });
-            child.on('error', (err) => {
-                cleanup();
-                resolve({
-                    status: 502,
-                    body: JSON.stringify({ type: 'error', error: { type: 'api_error', message: 'Claude CLI not found. Install Claude Code first.' } }),
-                    contentType: 'application/json',
-                });
-            });
-        });
-    }
-    catch (err) {
-        return {
-            status: 400,
-            body: JSON.stringify({ type: 'error', error: { type: 'invalid_request_error', message: 'Invalid request body' } }),
-            contentType: 'application/json',
-        };
-    }
-}
 export async function startProxy(opts = {}) {
     const port = opts.port ?? DEFAULT_PORT;
+    const host = opts.host ?? process.env.DARIO_HOST ?? DEFAULT_HOST;
     const verbose = opts.verbose ?? false;
     const passthrough = opts.passthrough ?? false;
     // Verify auth before starting
@@ -502,7 +326,7 @@ export async function startProxy(opts = {}) {
         console.error('[dario] Not authenticated. Run `dario login` first.');
         process.exit(1);
     }
-    const cliVersion = detectCli();
+    const cliVersion = detectCliVersion();
     const modelOverride = opts.model ? (MODEL_ALIASES[opts.model] ?? opts.model) : null;
     const identity = loadClaudeIdentity();
     if (identity.deviceId) {
@@ -512,7 +336,7 @@ export async function startProxy(opts = {}) {
         console.warn('[dario] WARNING: No Claude Code device identity found. Requests may be billed as Extra Usage.');
         console.warn('[dario] Run Claude Code at least once to generate ~/.claude/.claude.json');
     }
-    // Pre-build static headers (matches real Claude Code captured via MITM)
+    // Pre-build static headers — matches the set a real Claude Code client sends.
     const staticHeaders = passthrough ? {
         'accept': 'application/json',
         'Content-Type': 'application/json',
@@ -531,18 +355,20 @@ export async function startProxy(opts = {}) {
         // Claude Code runs on Bun which reports v24.3.0 as Node compat version
         'x-stainless-runtime-version': 'v24.3.0',
     };
-    const useCli = opts.cliBackend ?? false;
     let requestCount = 0;
     const semaphore = new Semaphore(MAX_CONCURRENT);
-    // Rate governor: CC --print takes ~2-3s per invocation.
-    // Rapid-fire requests from one "session" is an inhuman pattern.
-    // Minimum 500ms between requests — fast enough for agents, slow enough to not flag.
+    // Rate governor — minimum 500ms between requests. Fast enough for agents,
+    // slow enough to not look like a scripted flood of identical traffic.
     let lastRequestTime = 0;
     const MIN_REQUEST_INTERVAL_MS = parseInt(process.env.DARIO_MIN_INTERVAL_MS || '500', 10);
     // Optional proxy authentication — pre-encode key buffer for performance
     const apiKey = process.env.DARIO_API_KEY;
     const apiKeyBuf = apiKey ? Buffer.from(apiKey) : null;
-    const corsOrigin = `http://localhost:${port}`;
+    // CORS origin defaults to the localhost URL the proxy is served at. Users
+    // binding to a non-loopback address (e.g. a Tailscale interface) can
+    // override via DARIO_CORS_ORIGIN — otherwise browser-based clients hitting
+    // dario over the mesh will be blocked by their browser's CORS check.
+    const corsOrigin = process.env.DARIO_CORS_ORIGIN || `http://localhost:${port}`;
     // Security headers for all responses
     const SECURITY_HEADERS = {
         'X-Content-Type-Options': 'nosniff',
@@ -656,31 +482,6 @@ export async function startProxy(opts = {}) {
                 clearTimeout(bodyTimeout);
             }
             const body = Buffer.concat(chunks);
-            // CLI backend mode: route through claude --print (works for both Anthropic and OpenAI endpoints)
-            if (useCli && req.method === 'POST' && body.length > 0) {
-                let cliBody = body;
-                let clientWantsStream = false;
-                // Translate OpenAI format before passing to CLI
-                if (isOpenAI) {
-                    try {
-                        const parsed = JSON.parse(body.toString());
-                        clientWantsStream = !!parsed.stream;
-                        cliBody = Buffer.from(JSON.stringify(openaiToAnthropic(parsed, modelOverride)));
-                    }
-                    catch { /* send as-is */ }
-                }
-                else {
-                    try {
-                        const parsed = JSON.parse(body.toString());
-                        clientWantsStream = !!parsed.stream;
-                    }
-                    catch { }
-                }
-                const cliResult = await handleViaCli(cliBody, modelOverride, verbose);
-                requestCount++;
-                sendCliResponse(res, cliResult, clientWantsStream, isOpenAI, corsOrigin, SECURITY_HEADERS);
-                return;
-            }
             // Parse body once, apply OpenAI translation, model override, and sanitization
             let finalBody = body.length > 0 ? body : undefined;
             let ccToolMap = null;
@@ -731,7 +532,7 @@ export async function startProxy(opts = {}) {
                     beta += ',' + clientBeta;
             }
             else {
-                // CC v2.1.104 beta set (exact 8 from MITM capture, exact order).
+                // CC v2.1.104 beta set — 8 flags in the order Claude Code sends them.
                 // context-1m requires Extra Usage — if it 400s, we auto-retry without it.
                 beta = 'claude-code-20250219,oauth-2025-04-20,context-1m-2025-08-07,interleaved-thinking-2025-05-14,context-management-2025-06-27,prompt-caching-scope-2026-01-05,advisor-tool-2026-03-01,effort-2025-11-24';
                 if (clientBeta) {
@@ -749,7 +550,7 @@ export async function startProxy(opts = {}) {
                 await new Promise(r => setTimeout(r, MIN_REQUEST_INTERVAL_MS - elapsed));
             }
             lastRequestTime = Date.now();
-            // Rotate session ID per request — CC --print creates a new session each invocation
+            // Rotate session ID per request — fresh UUID avoids persistent-session fingerprinting
             SESSION_ID = randomUUID();
             const headers = {
                 ...staticHeaders,
@@ -798,24 +599,20 @@ export async function startProxy(opts = {}) {
                 else if (upstream.status === 429) {
                     // Not a context-1m issue — return enriched 429 directly
                     const enriched = enrich429(peekedBody, upstream.headers);
-                    if (!(cliAvailable && !useCli)) {
-                        const responseHeaders = {
-                            'Content-Type': 'application/json',
-                            'Access-Control-Allow-Origin': corsOrigin,
-                            ...SECURITY_HEADERS,
-                        };
-                        for (const [key, value] of upstream.headers.entries()) {
-                            if (key.startsWith('x-ratelimit') || key.startsWith('anthropic-ratelimit') || key === 'request-id') {
-                                responseHeaders[key] = value;
-                            }
+                    const responseHeaders = {
+                        'Content-Type': 'application/json',
+                        'Access-Control-Allow-Origin': corsOrigin,
+                        ...SECURITY_HEADERS,
+                    };
+                    for (const [key, value] of upstream.headers.entries()) {
+                        if (key.startsWith('x-ratelimit') || key.startsWith('anthropic-ratelimit') || key === 'request-id') {
+                            responseHeaders[key] = value;
                         }
-                        requestCount++;
-                        res.writeHead(429, responseHeaders);
-                        res.end(enriched);
-                        return;
                     }
-                    // Fall through to CLI fallback below — need to re-handle 429 with
-                    // already-consumed body; stash it for the fallback path.
+                    requestCount++;
+                    res.writeHead(429, responseHeaders);
+                    res.end(enriched);
+                    return;
                 }
                 else if (upstream.status === 400) {
                     // Non-long-context 400 — forward upstream error directly.
@@ -836,7 +633,7 @@ export async function startProxy(opts = {}) {
                 }
             }
             // Enrich 429 errors with rate limit details from headers (Anthropic only returns "Error")
-            if (upstream.status === 429 && !(cliAvailable && !useCli)) {
+            if (upstream.status === 429) {
                 const errBody = await upstream.text().catch(() => '');
                 const enriched = enrich429(errBody, upstream.headers);
                 const responseHeaders = {
@@ -854,42 +651,6 @@ export async function startProxy(opts = {}) {
                 res.end(enriched);
                 return;
             }
-            // Auto-fallback: if API returns 429 and CLI is available, retry through CLI binary
-            if (upstream.status === 429 && cliAvailable && !useCli) {
-                const errBody429 = await upstream.text().catch(() => '');
-                if (verbose)
-                    console.log(`[dario] #${requestCount} 429 from API — falling back to CLI`);
-                let clientWantsStream = false;
-                try {
-                    clientWantsStream = !!JSON.parse(body.toString()).stream;
-                }
-                catch { }
-                const cliResult = await handleViaCli(body, modelOverride, verbose);
-                // If CLI fallback also failed, return the original 429 with enriched details
-                // instead of a cryptic 502 from CLI failure
-                if (cliResult.status >= 500) {
-                    if (verbose)
-                        console.log(`[dario] #${requestCount} CLI fallback failed (${cliResult.status}) — returning original 429`);
-                    const enriched = enrich429(errBody429, upstream.headers);
-                    const responseHeaders = {
-                        'Content-Type': 'application/json',
-                        'Access-Control-Allow-Origin': corsOrigin,
-                        ...SECURITY_HEADERS,
-                    };
-                    for (const [key, value] of upstream.headers.entries()) {
-                        if (key.startsWith('x-ratelimit') || key.startsWith('anthropic-ratelimit') || key === 'request-id') {
-                            responseHeaders[key] = value;
-                        }
-                    }
-                    requestCount++;
-                    res.writeHead(429, responseHeaders);
-                    res.end(enriched);
-                    return;
-                }
-                requestCount++;
-                sendCliResponse(res, cliResult, clientWantsStream, isOpenAI, corsOrigin, SECURITY_HEADERS);
-                return;
-            }
             // Detect streaming from content-type (reliable) or body (fallback)
             const contentType = upstream.headers.get('content-type') ?? '';
             const isStream = contentType.includes('text/event-stream');
@@ -1007,24 +768,43 @@ export async function startProxy(opts = {}) {
         }
         process.exit(1);
     });
-    server.listen(port, LOCALHOST, () => {
-        const modeLine = passthrough ? 'Mode: passthrough (OAuth swap only, no injection)' : useCli ? 'Backend: Claude CLI (bypasses rate limits)' : `OAuth: ${status.status} (expires in ${status.expiresIn})`;
+    server.listen(port, host, () => {
+        const modeLine = passthrough
+            ? 'Mode: passthrough (OAuth swap only, no injection)'
+            : `OAuth: ${status.status} (expires in ${status.expiresIn})`;
         const modelLine = modelOverride ? `Model: ${modelOverride} (all requests)` : 'Model: passthrough (client decides)';
+        // Display URL uses `localhost` for loopback binds and the literal host
+        // for exposed binds, so the printed URL is the one a client would
+        // actually use to reach the proxy.
+        const displayHost = isLoopbackHost(host) ? 'localhost' : host;
         console.log('');
-        console.log(`  dario — http://localhost:${port}`);
+        console.log(`  dario — http://${displayHost}:${port}`);
         console.log('');
         console.log('  Your Claude subscription is now an API.');
         console.log('');
         console.log('  Usage:');
-        console.log(`    ANTHROPIC_BASE_URL=http://localhost:${port}`);
+        console.log(`    ANTHROPIC_BASE_URL=http://${displayHost}:${port}`);
         console.log('    ANTHROPIC_API_KEY=dario');
         console.log('');
         console.log(`  ${modeLine}`);
         console.log(`  ${modelLine}`);
+        if (!isLoopbackHost(host)) {
+            console.log('');
+            console.log(`  ⚠  Bound to ${host} — reachable from other machines on the network.`);
+            if (!apiKey) {
+                console.log('     DARIO_API_KEY is not set. Any host that can reach this port can');
+                console.log('     proxy requests through your OAuth subscription. Set DARIO_API_KEY');
+                console.log('     before exposing dario beyond loopback.');
+            }
+            else {
+                console.log('     DARIO_API_KEY is set — clients must send x-api-key or Authorization');
+                console.log('     to be accepted.');
+            }
+        }
         console.log('');
     });
-    // Session presence heartbeat — registers this proxy as an active Claude Code session
-    // Claude Code sends this every 5 seconds; the server uses it for priority routing
+    // Session presence heartbeat — keeps the OAuth session marked active
+    // (matches the ~5s cadence of a real Claude Code session).
     const clientId = randomUUID();
     const connectedAt = new Date().toISOString();
     let lastPresencePulse = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "3.4.0",
+  "version": "3.4.3",
   "description": "Use your Claude subscription as an API. No API key needed. Local proxy for Claude Max/Pro subscriptions.",
   "type": "module",
   "bin": {
@@ -26,7 +26,9 @@
     "start": "node dist/cli.js",
     "dev": "tsx src/cli.ts",
     "e2e": "node test/e2e.mjs",
-    "compat": "node test/compat.mjs"
+    "compat": "node test/compat.mjs",
+    "lint:pkg": "node scripts/check-package-json.mjs",
+    "fix:pkg": "node -e \"const fs=require('fs');fs.writeFileSync('package.json',JSON.stringify(JSON.parse(fs.readFileSync('package.json','utf-8')),null,2)+'\\n')\""
   },
   "keywords": [
     "claude",