@askalf/dario 3.7.1 → 3.7.2

package/dist/cli.js

@@ -274,10 +274,12 @@ async function backend() {
         console.log(`  ${all.length} backend${all.length === 1 ? '' : 's'} configured`);
         console.log('');
         for (const b of all) {
-            const redacted = b.apiKey.length > 8
-                ? `${b.apiKey.slice(0, 3)}...${b.apiKey.slice(-4)}`
-                : '***';
-            console.log(`    ${b.name.padEnd(16)} ${b.provider.padEnd(10)} ${b.baseUrl.padEnd(40)} ${redacted}`);
+            // Never emit any substring of the key itself — even partial
+            // prefixes/suffixes (like "sk-proj-...a1b2") are leakage as
+            // far as CodeQL's js/clear-text-logging rule is concerned, and
+            // it's right: partial disclosure is still disclosure. Name and
+            // baseUrl together are enough to identify a backend.
+            console.log(`    ${b.name.padEnd(16)} ${b.provider.padEnd(10)} ${b.baseUrl.padEnd(40)} ***`);
         }
         console.log('');
         return;

package/dist/openai-backend.js

@@ -148,11 +148,16 @@ export async function forwardToOpenAI(req, res, body, backend, corsOrigin, secur
     }
     catch (err) {
         clearTimeout(timeout);
+        // Log error details server-side only. Responding with err.message
+        // exposes internal stack / path / module information (CodeQL
+        // js/stack-trace-exposure). The client gets a generic 502.
+        const detail = err instanceof Error ? err.message : String(err);
+        if (verbose)
+            console.error(`[dario] openai backend (${backend.name}) error: ${detail}`);
         if (!res.headersSent) {
             res.writeHead(502, { 'Content-Type': 'application/json', ...securityHeaders });
             res.end(JSON.stringify({
                 error: 'Upstream OpenAI-compat backend error',
-                message: err instanceof Error ? err.message : String(err),
                 backend: backend.name,
             }));
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "3.7.1",
+  "version": "3.7.2",
   "description": "A local LLM router. One endpoint, every provider — Claude subscriptions, OpenAI, OpenRouter, Groq, local LiteLLM, any OpenAI-compat endpoint — your tools don't need to change.",
   "type": "module",
   "bin": {