@askalf/dario 4.8.119 → 4.8.121

package/dist/health-response.d.ts

@@ -41,4 +41,22 @@ export interface PoolDerivedStatus {
     accounts: number;
 }
 export declare function derivePoolStatus(accounts: readonly PoolAccountStatusLike[], now: number, adminEnabled: boolean): PoolDerivedStatus;
-export declare function buildHealthResponse(s: HealthStatusLike, requestCount: number, viaPublicTunnel: boolean): HealthResponse;
+export declare function buildHealthResponse(s: HealthStatusLike, requestCount: number, includeInternal: boolean): HealthResponse;
+/**
+ * Decide whether a /health caller may see the OAuth internals (#642).
+ *
+ * /health is intentionally auth-free (docker healthchecks need it before a
+ * key is configured), so we cannot simply gate on the API key. Trust model:
+ *   - authenticated (valid DARIO_API_KEY)      -> internal (an internal caller)
+ *   - came via the Cloudflare tunnel (cf-ray)  -> public   (world-reachable)
+ *   - otherwise bare loopback                  -> internal (docker HC / doctor)
+ *   - otherwise (LAN, other container, WAN)    -> public
+ * The cf-ray check is now only ever used to DENY (force public), never to
+ * grant, so spoofing it cannot widen disclosure — the previous fail-open
+ * direction is closed.
+ */
+export declare function shouldDiscloseHealthInternals(opts: {
+    authenticated: boolean;
+    loopback: boolean;
+    viaCfRay: boolean;
+}): boolean;

package/dist/health-response.js

@@ -59,24 +59,50 @@ export function derivePoolStatus(accounts, now, adminEnabled) {
         expiresIn: formatMsLeft(earliest - now),
     };
 }
-export function buildHealthResponse(s, requestCount, viaPublicTunnel) {
+export function buildHealthResponse(s, requestCount, includeInternal) {
     const dead = s.status === 'broken' ||
         s.status === 'none' ||
         (s.status === 'expired' && s.canRefresh === false);
     const httpStatus = dead ? 503 : 200;
     const liveness = { status: dead ? 'degraded' : 'ok' };
-    const body = viaPublicTunnel
-        ? liveness
-        : {
+    // Only trusted callers (authenticated, or bare loopback not via the CF
+    // tunnel — see shouldDiscloseHealthInternals) get the OAuth internals.
+    // Everyone else (LAN, public tunnel) gets the liveness verdict only; the
+    // HTTP status is identical either way so uptime checks still work. #642:
+    // this used to key on the presence of the client-suppliable `cf-ray`
+    // header, which failed OPEN — a direct non-tunnel caller omits it and got
+    // the full internal view. `lastRefreshError` is no longer exposed here at
+    // all (it can carry a raw upstream error string); it remains on the
+    // key-gated /status.
+    const body = includeInternal
+        ? {
             ...liveness,
-            // Version for internal callers only — an update-check signal (#640),
-            // withheld from the public-tunnel view alongside the OAuth internals.
             ...(s.version ? { version: s.version } : {}),
             oauth: s.status,
             expiresIn: s.expiresIn,
             requests: requestCount,
             ...(s.refreshFailures ? { refreshFailures: s.refreshFailures } : {}),
-            ...(s.lastRefreshError ? { lastRefreshError: s.lastRefreshError } : {}),
-        };
+        }
+        : liveness;
     return { httpStatus, body };
 }
+/**
+ * Decide whether a /health caller may see the OAuth internals (#642).
+ *
+ * /health is intentionally auth-free (docker healthchecks need it before a
+ * key is configured), so we cannot simply gate on the API key. Trust model:
+ *   - authenticated (valid DARIO_API_KEY)      -> internal (an internal caller)
+ *   - came via the Cloudflare tunnel (cf-ray)  -> public   (world-reachable)
+ *   - otherwise bare loopback                  -> internal (docker HC / doctor)
+ *   - otherwise (LAN, other container, WAN)    -> public
+ * The cf-ray check is now only ever used to DENY (force public), never to
+ * grant, so spoofing it cannot widen disclosure — the previous fail-open
+ * direction is closed.
+ */
+export function shouldDiscloseHealthInternals(opts) {
+    if (opts.authenticated)
+        return true;
+    if (opts.viaCfRay)
+        return false;
+    return opts.loopback;
+}

package/dist/proxy.d.ts

@@ -174,6 +174,14 @@ export declare function buildOrchestrationPatterns(preserveTags?: Set<string>):
  * opt any tag out of the scrub. dario#78.
  */
 export declare function sanitizeMessages(body: Record<string, unknown>, preserveTags?: Set<string>): void;
+/**
+ * Translate Anthropic SSE → OpenAI SSE. Returns a stateful per-CALL closure so
+ * concurrent /v1/chat/completions streams don't share tool-call index/id state
+ * (#642-audit: the previous module-global counters cross-contaminated
+ * interleaved streams and emitted malformed tool_calls deltas). One translator
+ * per request, mirroring createStreamingReverseMapper.
+ */
+export declare function createOpenAIStreamTranslator(): (line: string) => string | null;
 export declare const OPENAI_MODELS_LIST: {
     object: string;
     data: Array<{

package/dist/proxy.js

@@ -7,7 +7,7 @@ import { homedir } from 'node:os';
 import { setDefaultResultOrder } from 'node:dns';
 import { arch, platform } from 'node:process';
 import { getAccessToken, getStatus } from './oauth.js';
-import { buildHealthResponse, derivePoolStatus } from './health-response.js';
+import { buildHealthResponse, derivePoolStatus, shouldDiscloseHealthInternals } from './health-response.js';
 import { darioVersion } from './version.js';
 import { buildCCRequest, applyCcPromptCaching, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, CC_TEMPLATE } from './cc-template.js';
 import { stampCch } from './cch.js';
@@ -38,6 +38,18 @@ function isLoopbackHost(host) {
         return true;
     return host.startsWith('127.');
 }
+// A socket peer address is loopback if it is 127.0.0.0/8 or ::1, including the
+// IPv4-mapped-IPv6 form Node reports on dual-stack sockets (`::ffff:127.0.0.1`).
+// Distinct from isLoopbackHost (which classifies a bind-address string): this
+// classifies an inbound connection's peer for the /health disclosure gate (#642).
+function isLoopbackAddr(addr) {
+    if (!addr)
+        return false;
+    if (addr === '::1')
+        return true;
+    const v4 = addr.startsWith('::ffff:') ? addr.slice(7) : addr;
+    return v4 === '127.0.0.1' || v4.startsWith('127.');
+}
 // Concurrency control: see src/request-queue.ts for the bounded queue
 // (replaced the v3.30.x-and-earlier simple unbounded semaphore in dario#80).
 // Billing tag hash seed — matches Claude Code's value
@@ -532,48 +544,55 @@ function anthropicToOpenai(body) {
         usage: { prompt_tokens: u?.input_tokens ?? 0, completion_tokens: u?.output_tokens ?? 0, total_tokens: (u?.input_tokens ?? 0) + (u?.output_tokens ?? 0) },
     };
 }
-/** Translate Anthropic SSE → OpenAI SSE. */
-// Track tool call state across stream chunks
-let _streamToolIndex = 0;
-let _streamToolId = '';
-function translateStreamChunk(line) {
-    if (!line.startsWith('data: '))
-        return null;
-    const json = line.slice(6).trim();
-    if (json === '[DONE]')
-        return 'data: [DONE]\n\n';
-    try {
-        const e = JSON.parse(json);
-        const ts = Math.floor(Date.now() / 1000);
-        if (e.type === 'content_block_start') {
-            const block = e.content_block;
-            if (block?.type === 'tool_use' && block.name) {
-                _streamToolId = block.id ?? `call_${_streamToolIndex}`;
-                return `data: ${JSON.stringify({ id: 'chatcmpl-dario', object: 'chat.completion.chunk', created: ts, model: 'claude', choices: [{ index: 0, delta: { tool_calls: [{ index: _streamToolIndex, id: _streamToolId, type: 'function', function: { name: block.name, arguments: '' } }] }, finish_reason: null }] })}\n\n`;
+/**
+ * Translate Anthropic SSE → OpenAI SSE. Returns a stateful per-CALL closure so
+ * concurrent /v1/chat/completions streams don't share tool-call index/id state
+ * (#642-audit: the previous module-global counters cross-contaminated
+ * interleaved streams and emitted malformed tool_calls deltas). One translator
+ * per request, mirroring createStreamingReverseMapper.
+ */
+export function createOpenAIStreamTranslator() {
+    let toolIndex = 0;
+    let toolId = '';
+    return function translateStreamChunk(line) {
+        if (!line.startsWith('data: '))
+            return null;
+        const json = line.slice(6).trim();
+        if (json === '[DONE]')
+            return 'data: [DONE]\n\n';
+        try {
+            const e = JSON.parse(json);
+            const ts = Math.floor(Date.now() / 1000);
+            if (e.type === 'content_block_start') {
+                const block = e.content_block;
+                if (block?.type === 'tool_use' && block.name) {
+                    toolId = block.id ?? `call_${toolIndex}`;
+                    return `data: ${JSON.stringify({ id: 'chatcmpl-dario', object: 'chat.completion.chunk', created: ts, model: 'claude', choices: [{ index: 0, delta: { tool_calls: [{ index: toolIndex, id: toolId, type: 'function', function: { name: block.name, arguments: '' } }] }, finish_reason: null }] })}\n\n`;
+                }
             }
-        }
-        if (e.type === 'content_block_delta') {
-            const d = e.delta;
-            if (d?.type === 'text_delta' && d.text)
-                return `data: ${JSON.stringify({ id: 'chatcmpl-dario', object: 'chat.completion.chunk', created: ts, model: 'claude', choices: [{ index: 0, delta: { content: d.text }, finish_reason: null }] })}\n\n`;
-            if (d?.type === 'input_json_delta' && d.partial_json)
-                return `data: ${JSON.stringify({ id: 'chatcmpl-dario', object: 'chat.completion.chunk', created: ts, model: 'claude', choices: [{ index: 0, delta: { tool_calls: [{ index: _streamToolIndex, function: { arguments: d.partial_json } }] }, finish_reason: null }] })}\n\n`;
-        }
-        if (e.type === 'content_block_stop') {
-            if (_streamToolId) {
-                _streamToolIndex++;
-                _streamToolId = '';
+            if (e.type === 'content_block_delta') {
+                const d = e.delta;
+                if (d?.type === 'text_delta' && d.text)
+                    return `data: ${JSON.stringify({ id: 'chatcmpl-dario', object: 'chat.completion.chunk', created: ts, model: 'claude', choices: [{ index: 0, delta: { content: d.text }, finish_reason: null }] })}\n\n`;
+                if (d?.type === 'input_json_delta' && d.partial_json)
+                    return `data: ${JSON.stringify({ id: 'chatcmpl-dario', object: 'chat.completion.chunk', created: ts, model: 'claude', choices: [{ index: 0, delta: { tool_calls: [{ index: toolIndex, function: { arguments: d.partial_json } }] }, finish_reason: null }] })}\n\n`;
+            }
+            if (e.type === 'content_block_stop') {
+                if (toolId) {
+                    toolIndex++;
+                    toolId = '';
+                }
+                return null;
+            }
+            if (e.type === 'message_stop') {
+                toolIndex = 0;
+                toolId = '';
+                return `data: ${JSON.stringify({ id: 'chatcmpl-dario', object: 'chat.completion.chunk', created: ts, model: 'claude', choices: [{ index: 0, delta: {}, finish_reason: 'stop' }] })}\n\ndata: [DONE]\n\n`;
             }
-            return null;
-        }
-        if (e.type === 'message_stop') {
-            _streamToolIndex = 0;
-            _streamToolId = '';
-            return `data: ${JSON.stringify({ id: 'chatcmpl-dario', object: 'chat.completion.chunk', created: ts, model: 'claude', choices: [{ index: 0, delta: {}, finish_reason: 'stop' }] })}\n\ndata: [DONE]\n\n`;
         }
-    }
-    catch { }
-    return null;
+        catch { }
+        return null;
+    };
 }
 // Baked /v1/models payload — what the proxy advertises before (or without)
 // a successful upstream catalog fetch. The live route serves the
@@ -1169,6 +1188,14 @@ export async function startProxy(opts = {}) {
     const adminTokenBuf = adminToken ? Buffer.from(adminToken) : null;
     if (adminEnabled) {
         console.log(`[dario] admin API enabled at /admin/* (token ${adminTokenBuf ? 'configured' : 'MISSING — endpoints return 403 until DARIO_ADMIN_TOKEN is set'})`);
+        // Hardening (#642): the admin API adds/removes OAuth accounts. When it
+        // shares DARIO_API_KEY (which is embedded in every client config) instead
+        // of a distinct DARIO_ADMIN_TOKEN, every client that can proxy can also
+        // control the account pool. Non-fatal for back-compat, but warn loudly.
+        if (adminTokenBuf && !process.env.DARIO_ADMIN_TOKEN) {
+            console.warn('[dario] WARNING: admin API is using DARIO_API_KEY as its token (no DARIO_ADMIN_TOKEN set).');
+            console.warn('[dario] every client holding the proxy key can add/remove accounts. Set a distinct DARIO_ADMIN_TOKEN.');
+        }
     }
     // Admin rate limiting (#620). Two token buckets, created once per proxy:
     // failed auth (brute-force / broken-client throttle) and mutations. Global,
@@ -1269,10 +1296,16 @@ export async function startProxy(opts = {}) {
         // react instead of cheerfully passing while every /v1/messages 401s.
         if (urlPath === '/health' || urlPath === '/') {
             const s = await currentStatus();
-            // Public requests arrive through the Cloudflare tunnel (the edge stamps
-            // `cf-ray`); they get only the liveness verdict, never the OAuth internals.
-            // See buildHealthResponse for the full rationale.
-            const { httpStatus, body } = buildHealthResponse({ ...s, version: darioVersion() }, requestCount, req.headers['cf-ray'] !== undefined);
+            // Disclose OAuth internals only to trusted callers (#642). This used to
+            // key on the presence of the client-suppliable `cf-ray` header and failed
+            // OPEN — a direct non-tunnel caller omits it and got the full internal
+            // view. Now: authenticated, OR bare loopback that did not arrive via CF.
+            const includeInternal = shouldDiscloseHealthInternals({
+                authenticated: authenticateRequest(req.headers, apiKeyBuf),
+                loopback: isLoopbackAddr(req.socket?.remoteAddress),
+                viaCfRay: req.headers['cf-ray'] !== undefined,
+            });
+            const { httpStatus, body } = buildHealthResponse({ ...s, version: darioVersion() }, requestCount, includeInternal);
             res.writeHead(httpStatus, JSON_HEADERS);
             res.end(JSON.stringify(body));
             return;
@@ -2753,14 +2786,29 @@ export async function startProxy(opts = {}) {
                 const streamMapper = ccToolMap && !isOpenAI
                     ? createStreamingReverseMapper(ccToolMap, reqCtx)
                     : null;
+                // Per-request OpenAI SSE translator — isolated tool-call state so
+                // concurrent /v1/chat/completions streams don't cross-contaminate (#642-audit).
+                const openaiTranslate = isOpenAI ? createOpenAIStreamTranslator() : null;
                 // Gated writer — a no-op once the downstream client has gone away
                 // in drain-on-close mode. The read loop keeps consuming so the
                 // upstream sees a full-length read; writes to a closed socket are
                 // suppressed to avoid EPIPE/warnings and pointless work.
+                // Honor downstream backpressure (#642-audit): when res.write() returns
+                // false the client's socket buffer is full, so pause the read loop until
+                // it drains instead of buffering the whole (fast) upstream in memory.
+                let needsDrain = false;
                 const writeToClient = (chunk) => {
-                    if (!clientDisconnected)
-                        res.write(chunk);
+                    if (clientDisconnected)
+                        return;
+                    if (res.write(chunk) === false)
+                        needsDrain = true;
                 };
+                // Resolves on 'close' too, so a vanished client can't wedge the loop.
+                const waitForDrain = () => new Promise((resolve) => {
+                    const done = () => { res.off('drain', done); res.off('close', done); resolve(); };
+                    res.once('drain', done);
+                    res.once('close', done);
+                });
                 try {
                     let buffer = '';
                     const MAX_LINE_LENGTH = 1_000_000; // 1MB max per SSE line
@@ -2834,7 +2882,7 @@ export async function startProxy(opts = {}) {
                             const lines = buffer.split('\n');
                             buffer = lines.pop() ?? '';
                             for (const line of lines) {
-                                const translated = translateStreamChunk(line);
+                                const translated = openaiTranslate(line);
                                 if (translated)
                                     writeToClient(translated);
                             }
@@ -2847,10 +2895,16 @@ export async function startProxy(opts = {}) {
                         else {
                             writeToClient(value);
                         }
+                        // Backpressure (#642-audit): if the last writes filled the client
+                        // buffer, pause reading upstream until it drains.
+                        if (needsDrain && !clientDisconnected) {
+                            needsDrain = false;
+                            await waitForDrain();
+                        }
                     }
                     // Flush remaining buffer
                     if (isOpenAI && buffer.trim()) {
-                        const translated = translateStreamChunk(buffer);
+                        const translated = openaiTranslate(buffer);
                         if (translated)
                             writeToClient(translated);
                     }
@@ -2863,6 +2917,11 @@ export async function startProxy(opts = {}) {
                 catch (err) {
                     if (verbose)
                         console.error('[dario] Stream error:', sanitizeError(err));
+                    // Tear down the upstream body reader deterministically on an abnormal
+                    // mid-stream error (e.g. a bare upstream socket reset) so the undici
+                    // socket is released now, not at GC (#642-audit). No-op if aborted.
+                    if (!upstreamAbort.signal.aborted)
+                        upstreamAbort.abort();
                 }
                 res.end();
                 // Stamp the response-completion timestamp + token count so the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "4.8.119",
+  "version": "4.8.121",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {