@askalf/dario 4.8.124 → 4.8.126

package/dist/oauth.js

@@ -454,8 +454,8 @@ export async function startAutoOAuthFlow() {
             // Exchange the code for tokens
             server.close();
             exchangeCodeWithRedirect(code, codeVerifier, state, port)
-                .then(resolve)
-                .catch(reject);
+                .then((tokens) => { clearTimeout(loginTimeout); resolve(tokens); })
+                .catch((e) => { clearTimeout(loginTimeout); reject(e); });
         });
         let port = 0;
         server.listen(0, 'localhost', async () => {
@@ -490,11 +490,14 @@ export async function startAutoOAuthFlow() {
         server.on('error', (err) => {
             reject(new Error(`Failed to start OAuth callback server: ${err.message}`));
         });
-        // Timeout after 5 minutes
-        setTimeout(() => {
+        // Timeout after 5 minutes. unref so a completed login (server already
+        // closed, promise resolved on the success path) does not pin the process
+        // for 5 min — the #642-audit CLI hang. Also cleared on success below.
+        const loginTimeout = setTimeout(() => {
             server.close();
             reject(new Error('OAuth flow timed out. Try again with `dario login`.'));
         }, 300_000);
+        loginTimeout.unref();
     });
 }
 /**

package/dist/scrub-template.js

@@ -141,7 +141,7 @@ function removeHostContextSections(systemPrompt) {
  * drift signals and leaks the bake host's repo state.
  */
 function removeGitStatusBlock(systemPrompt) {
-    return systemPrompt.replace(/\ngitStatus:[\s\S]*?(?=\n# |$)/, '');
+    return systemPrompt.replace(/\r?\ngitStatus:[\s\S]*?(?=\r?\n# |$)/, '');
 }
 /**
  * Strip one named top-level section (`\n# <name>\n` through the next
@@ -150,7 +150,9 @@ function removeGitStatusBlock(systemPrompt) {
  */
 function removeSection(systemPrompt, name) {
     const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    const heading = new RegExp(`\\n# ${escaped}\\n`);
+    // \r?\n tolerates a CRLF capture; [ \t]* tolerates trailing whitespace on the
+    // heading line — either would otherwise leave a host-context section unstripped.
+    const heading = new RegExp(`\\r?\\n# ${escaped}[ \\t]*\\r?\\n`);
     let out = systemPrompt;
     while (true) {
         const m = heading.exec(out);
@@ -158,7 +160,7 @@ function removeSection(systemPrompt, name) {
             return out;
         const sectionStart = m.index;
         const afterHeading = out.slice(sectionStart + m[0].length);
-        const nextHeading = /\n# /.exec(afterHeading);
+        const nextHeading = /\r?\n# /.exec(afterHeading);
         const sectionEnd = nextHeading
             ? sectionStart + m[0].length + nextHeading.index
             : out.length;
@@ -203,5 +205,14 @@ export function findUserPathHits(text) {
         if (matches)
             hits.push(...matches);
     }
+    // A host-context section still present here means removeSection failed to
+    // strip it (e.g. a CRLF capture or a renamed heading). Flag it so the drift-
+    // gate fails the release rather than shipping the leak (#642-audit).
+    for (const name of HOST_CONTEXT_SECTION_HEADINGS) {
+        const esc = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        if (new RegExp(`\\r?\\n# ${esc}[ \\t]*\\r?\\n`).test(text)) {
+            hits.push(`# ${name} (host-context section not stripped)`);
+        }
+    }
     return hits;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "4.8.124",
+  "version": "4.8.126",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {