@askalf/dario 4.8.121 → 4.8.122

package/dist/model-catalog.d.ts

@@ -32,7 +32,7 @@
  * — the same ordering normalizeUpstreamIds() produces for live data.
  */
 export declare const BAKED_BASE_MODELS: readonly string[];
-/** The set of suspended families, resolved from env at call time. */
+/** The set of suspended families, resolved from env (memoized by raw value). */
 export declare function suspendedFamilies(): Set<string>;
 /** True when `model` (any spelling) belongs to a suspended family. */
 export declare function isSuspendedModel(model: string): boolean;

package/dist/model-catalog.js

@@ -67,14 +67,23 @@ export const BAKED_BASE_MODELS = [
  * to re-suspend if access is ever pulled again.
  */
 const DEFAULT_SUSPENDED_MODELS = '';
-/** The set of suspended families, resolved from env at call time. */
+// Memoized by the raw env value (#642-audit): isSuspendedModel runs per request,
+// and this rebuilt a Set from process.env every call. Keyed on the raw string so
+// a runtime change to DARIO_SUSPENDED_MODELS still re-parses; the common (empty)
+// value allocates the Set once.
+let _suspendedCache = null;
+/** The set of suspended families, resolved from env (memoized by raw value). */
 export function suspendedFamilies() {
     const raw = process.env.DARIO_SUSPENDED_MODELS ?? DEFAULT_SUSPENDED_MODELS;
-    return new Set(raw
+    if (_suspendedCache && _suspendedCache.raw === raw)
+        return _suspendedCache.set;
+    const set = new Set(raw
         .split(',')
         .map((s) => s.trim())
         .filter((s) => s.length > 0)
         .map((s) => modelFamily(s) ?? s.toLowerCase()));
+    _suspendedCache = { raw, set };
+    return set;
 }
 /** True when `model` (any spelling) belongs to a suspended family. */
 export function isSuspendedModel(model) {

package/dist/proxy.js

@@ -455,6 +455,21 @@ function sanitizeContent(text, patterns) {
     }
     return result.replace(/\n{3,}/g, '\n\n').trim();
 }
+// Memoize the compiled preserve-tag pattern set by Set reference (#642-audit):
+// opts.preserveOrchestrationTags is a single Set instance passed on every
+// request, so recompile the ~28 patterns once instead of per request. The
+// default (no-preserve) path already uses the precompiled constant.
+let _orchPreserveKey;
+let _orchPatterns;
+function orchestrationPatternsFor(preserveTags) {
+    if (preserveTags === undefined)
+        return ORCHESTRATION_PATTERNS_DEFAULT;
+    if (preserveTags !== _orchPreserveKey) {
+        _orchPreserveKey = preserveTags;
+        _orchPatterns = buildOrchestrationPatterns(preserveTags);
+    }
+    return _orchPatterns;
+}
 /**
  * Strip orchestration tags from all messages in a request body.
  *
@@ -465,7 +480,7 @@ export function sanitizeMessages(body, preserveTags) {
     const messages = body.messages;
     if (!messages)
         return;
-    const patterns = preserveTags === undefined ? ORCHESTRATION_PATTERNS_DEFAULT : buildOrchestrationPatterns(preserveTags);
+    const patterns = orchestrationPatternsFor(preserveTags);
     for (const msg of messages) {
         if (typeof msg.content === 'string') {
             msg.content = sanitizeContent(msg.content, patterns);
@@ -1758,9 +1773,15 @@ export async function startProxy(opts = {}) {
             // recognizes through its own Anthropic gateway, bypassing localhost).
             let forcedProvider = cliProviderOverride;
             let requestEffort; // dario#419 — per-request effort parsed from a model-name suffix (model:high / model-high)
+            // Parsed body, shared between the provider-prefix detection below and the
+            // template-build block further down so the same bytes are not JSON.parsed
+            // twice per request (#642-audit). Mutations in the prefix block re-serialize
+            // `body` FROM this object, so it always represents the current body.
+            let parsedBody = null;
             if (body.length > 0) {
                 try {
                     const parsed = JSON.parse(body.toString());
+                    parsedBody = parsed;
                     const rawModel = parsed.model ?? '';
                     const prefix = parseProviderPrefix(rawModel);
                     if (prefix) {
@@ -1866,7 +1887,11 @@ export async function startProxy(opts = {}) {
             } : undefined;
             if (body.length > 0) {
                 try {
-                    const parsed = JSON.parse(body.toString());
+                    // Reuse the object parsed for provider-prefix detection above — the same
+                    // bytes, so re-parsing is wasted work on large bodies (#642-audit). Falls
+                    // back to a fresh parse when the earlier block didn't run (e.g. the body
+                    // was not JSON, or an OpenAI-backend reroute skipped it).
+                    const parsed = parsedBody ?? JSON.parse(body.toString());
                     // Strip orchestration tags from messages (Aider, Cursor, etc.)
                     sanitizeMessages(parsed, opts.preserveOrchestrationTags);
                     const result = isOpenAI ? openaiToAnthropic(parsed, modelOverride) : (modelOverride ? { ...parsed, model: modelOverride } : parsed);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "4.8.121",
+  "version": "4.8.122",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {