@askalf/dario 4.8.118 → 4.8.120

package/dist/health-response.d.ts

@@ -41,4 +41,22 @@ export interface PoolDerivedStatus {
     accounts: number;
 }
 export declare function derivePoolStatus(accounts: readonly PoolAccountStatusLike[], now: number, adminEnabled: boolean): PoolDerivedStatus;
-export declare function buildHealthResponse(s: HealthStatusLike, requestCount: number, viaPublicTunnel: boolean): HealthResponse;
+export declare function buildHealthResponse(s: HealthStatusLike, requestCount: number, includeInternal: boolean): HealthResponse;
+/**
+ * Decide whether a /health caller may see the OAuth internals (#642).
+ *
+ * /health is intentionally auth-free (docker healthchecks need it before a
+ * key is configured), so we cannot simply gate on the API key. Trust model:
+ *   - authenticated (valid DARIO_API_KEY)      -> internal (an internal caller)
+ *   - came via the Cloudflare tunnel (cf-ray)  -> public   (world-reachable)
+ *   - otherwise bare loopback                  -> internal (docker HC / doctor)
+ *   - otherwise (LAN, other container, WAN)    -> public
+ * The cf-ray check is now only ever used to DENY (force public), never to
+ * grant, so spoofing it cannot widen disclosure — the previous fail-open
+ * direction is closed.
+ */
+export declare function shouldDiscloseHealthInternals(opts: {
+    authenticated: boolean;
+    loopback: boolean;
+    viaCfRay: boolean;
+}): boolean;

package/dist/health-response.js

@@ -59,24 +59,50 @@ export function derivePoolStatus(accounts, now, adminEnabled) {
         expiresIn: formatMsLeft(earliest - now),
     };
 }
-export function buildHealthResponse(s, requestCount, viaPublicTunnel) {
+export function buildHealthResponse(s, requestCount, includeInternal) {
     const dead = s.status === 'broken' ||
         s.status === 'none' ||
         (s.status === 'expired' && s.canRefresh === false);
     const httpStatus = dead ? 503 : 200;
     const liveness = { status: dead ? 'degraded' : 'ok' };
-    const body = viaPublicTunnel
-        ? liveness
-        : {
+    // Only trusted callers (authenticated, or bare loopback not via the CF
+    // tunnel — see shouldDiscloseHealthInternals) get the OAuth internals.
+    // Everyone else (LAN, public tunnel) gets the liveness verdict only; the
+    // HTTP status is identical either way so uptime checks still work. #642:
+    // this used to key on the presence of the client-suppliable `cf-ray`
+    // header, which failed OPEN — a direct non-tunnel caller omits it and got
+    // the full internal view. `lastRefreshError` is no longer exposed here at
+    // all (it can carry a raw upstream error string); it remains on the
+    // key-gated /status.
+    const body = includeInternal
+        ? {
             ...liveness,
-            // Version for internal callers only — an update-check signal (#640),
-            // withheld from the public-tunnel view alongside the OAuth internals.
             ...(s.version ? { version: s.version } : {}),
             oauth: s.status,
             expiresIn: s.expiresIn,
             requests: requestCount,
             ...(s.refreshFailures ? { refreshFailures: s.refreshFailures } : {}),
-            ...(s.lastRefreshError ? { lastRefreshError: s.lastRefreshError } : {}),
-        };
+        }
+        : liveness;
     return { httpStatus, body };
 }
+/**
+ * Decide whether a /health caller may see the OAuth internals (#642).
+ *
+ * /health is intentionally auth-free (docker healthchecks need it before a
+ * key is configured), so we cannot simply gate on the API key. Trust model:
+ *   - authenticated (valid DARIO_API_KEY)      -> internal (an internal caller)
+ *   - came via the Cloudflare tunnel (cf-ray)  -> public   (world-reachable)
+ *   - otherwise bare loopback                  -> internal (docker HC / doctor)
+ *   - otherwise (LAN, other container, WAN)    -> public
+ * The cf-ray check is now only ever used to DENY (force public), never to
+ * grant, so spoofing it cannot widen disclosure — the previous fail-open
+ * direction is closed.
+ */
+export function shouldDiscloseHealthInternals(opts) {
+    if (opts.authenticated)
+        return true;
+    if (opts.viaCfRay)
+        return false;
+    return opts.loopback;
+}

package/dist/proxy.js

@@ -7,7 +7,7 @@ import { homedir } from 'node:os';
 import { setDefaultResultOrder } from 'node:dns';
 import { arch, platform } from 'node:process';
 import { getAccessToken, getStatus } from './oauth.js';
-import { buildHealthResponse, derivePoolStatus } from './health-response.js';
+import { buildHealthResponse, derivePoolStatus, shouldDiscloseHealthInternals } from './health-response.js';
 import { darioVersion } from './version.js';
 import { buildCCRequest, applyCcPromptCaching, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, CC_TEMPLATE } from './cc-template.js';
 import { stampCch } from './cch.js';
@@ -38,6 +38,18 @@ function isLoopbackHost(host) {
         return true;
     return host.startsWith('127.');
 }
+// A socket peer address is loopback if it is 127.0.0.0/8 or ::1, including the
+// IPv4-mapped-IPv6 form Node reports on dual-stack sockets (`::ffff:127.0.0.1`).
+// Distinct from isLoopbackHost (which classifies a bind-address string): this
+// classifies an inbound connection's peer for the /health disclosure gate (#642).
+function isLoopbackAddr(addr) {
+    if (!addr)
+        return false;
+    if (addr === '::1')
+        return true;
+    const v4 = addr.startsWith('::ffff:') ? addr.slice(7) : addr;
+    return v4 === '127.0.0.1' || v4.startsWith('127.');
+}
 // Concurrency control: see src/request-queue.ts for the bounded queue
 // (replaced the v3.30.x-and-earlier simple unbounded semaphore in dario#80).
 // Billing tag hash seed — matches Claude Code's value
@@ -1169,6 +1181,14 @@ export async function startProxy(opts = {}) {
     const adminTokenBuf = adminToken ? Buffer.from(adminToken) : null;
     if (adminEnabled) {
         console.log(`[dario] admin API enabled at /admin/* (token ${adminTokenBuf ? 'configured' : 'MISSING — endpoints return 403 until DARIO_ADMIN_TOKEN is set'})`);
+        // Hardening (#642): the admin API adds/removes OAuth accounts. When it
+        // shares DARIO_API_KEY (which is embedded in every client config) instead
+        // of a distinct DARIO_ADMIN_TOKEN, every client that can proxy can also
+        // control the account pool. Non-fatal for back-compat, but warn loudly.
+        if (adminTokenBuf && !process.env.DARIO_ADMIN_TOKEN) {
+            console.warn('[dario] WARNING: admin API is using DARIO_API_KEY as its token (no DARIO_ADMIN_TOKEN set).');
+            console.warn('[dario] every client holding the proxy key can add/remove accounts. Set a distinct DARIO_ADMIN_TOKEN.');
+        }
     }
     // Admin rate limiting (#620). Two token buckets, created once per proxy:
     // failed auth (brute-force / broken-client throttle) and mutations. Global,
@@ -1269,10 +1289,16 @@ export async function startProxy(opts = {}) {
         // react instead of cheerfully passing while every /v1/messages 401s.
         if (urlPath === '/health' || urlPath === '/') {
             const s = await currentStatus();
-            // Public requests arrive through the Cloudflare tunnel (the edge stamps
-            // `cf-ray`); they get only the liveness verdict, never the OAuth internals.
-            // See buildHealthResponse for the full rationale.
-            const { httpStatus, body } = buildHealthResponse({ ...s, version: darioVersion() }, requestCount, req.headers['cf-ray'] !== undefined);
+            // Disclose OAuth internals only to trusted callers (#642). This used to
+            // key on the presence of the client-suppliable `cf-ray` header and failed
+            // OPEN — a direct non-tunnel caller omits it and got the full internal
+            // view. Now: authenticated, OR bare loopback that did not arrive via CF.
+            const includeInternal = shouldDiscloseHealthInternals({
+                authenticated: authenticateRequest(req.headers, apiKeyBuf),
+                loopback: isLoopbackAddr(req.socket?.remoteAddress),
+                viaCfRay: req.headers['cf-ray'] !== undefined,
+            });
+            const { httpStatus, body } = buildHealthResponse({ ...s, version: darioVersion() }, requestCount, includeInternal);
             res.writeHead(httpStatus, JSON_HEADERS);
             res.end(JSON.stringify(body));
             return;
@@ -3173,7 +3199,17 @@ export async function startProxy(opts = {}) {
             return;
         lastPresencePulse = now;
         try {
-            const token = await getAccessToken();
+            // In pool mode the pool refresh loop (above) is the SOLE refresher of
+            // every account's token lineage. credentials.json shares its refresh-
+            // token family with accounts/login.json after a login->pool migration
+            // (ensureLoginCredentialsInPool), so refreshing credentials.json here
+            // via getAccessToken() races the pool refreshing login.json and trips
+            // Anthropic's refresh-token reuse-detection (the 2026-06-23 fleet
+            // outage, dario#641-audit). Pulse with a token the pool already keeps
+            // fresh; never refresh from this side in pool mode.
+            const token = pool ? (pool.all()[0]?.accessToken ?? '') : await getAccessToken();
+            if (!token)
+                return;
             const presenceUrl = `${ANTHROPIC_API}/v1/code/sessions/${SESSION_ID}/client/presence`;
             await fetch(presenceUrl, {
                 method: 'POST',
@@ -3191,6 +3227,12 @@ export async function startProxy(opts = {}) {
     }, 5000);
     // Periodic token refresh (every 15 minutes)
     const refreshInterval = setInterval(async () => {
+        // Pool mode: the pool's own 15-min refresh loop (above) owns token refresh
+        // for every account. Refreshing credentials.json here too would double-
+        // refresh a shared token lineage (see the presence-loop note) -> reuse-
+        // detection. Skip; the pool is the sole refresher.
+        if (pool)
+            return;
         try {
             const s = await getStatus();
             if (s.status === 'expiring' || s.status === 'expired') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "4.8.118",
+  "version": "4.8.120",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {