@askalf/dario 4.8.134 → 4.8.136

package/README.md

@@ -224,7 +224,7 @@ Tune via `~/.dario/config.json` → `overageGuard`, or CLI flags: `--overage-beh
 - **Multi-account pool.** Drop Claude accounts in `~/.dario/accounts/` and pool mode auto-activates — one is enough to serve, so `dario accounts add` alone bootstraps a proxy with no `dario login` step. With more, every request routes to the account with the most headroom, multi-turn sessions pin to one account so the prompt cache survives, in-flight 429s fail over to a peer before your client sees an error. → [`docs/multi-account-pool.md`](./docs/multi-account-pool.md)
 - **Headless admin API (`DARIO_ADMIN=1`).** Provision and manage pool accounts entirely over HTTP — start with zero accounts, `POST /admin/login/start`, paste the code back, and the account is routable the moment the `200` lands (live pool hot-reload, no restart). Token-gated even on loopback, audit-logged, rate-limited; `GET /admin/accounts` reports live per-account headroom. Built for Docker / k8s / Raspberry-Pi deployments where a console is the awkward part. → [`docs/admin-api.md`](./docs/admin-api.md)
 - **Behavioral stealth (`--stealth`).** Static wire fidelity covers *what* the request looks like; `--stealth` adds *when* it arrives — response-length-correlated think time and 1.2–4.2s session-start latency, the inter-arrival pattern real interactive sessions have and agent loops don't. → [`docs/wire-fidelity.md`](./docs/wire-fidelity.md)
-- **Runs any non-Claude-Code agent.** A 64-entry schema-verified `TOOL_MAP` pre-maps Cline, Roo, Kilo, Cursor, Windsurf, Continue, Copilot, OpenHands, OpenClaw, Hermes, [hands](https://github.com/askalf/hands) tool names to CC's native set. No flag, no validator errors. → [`docs/integrations/agent-compat.md`](./docs/integrations/agent-compat.md)
+- **Runs any non-Claude-Code agent.** A 64-entry schema-verified `TOOL_MAP` pre-maps Cline, Roo, Kilo, Cursor, Windsurf, Continue, Copilot, OpenHands, OpenClaw, Hermes, [hands](https://github.com/askalf/hands) tool names to CC's native set. No flag, no validator errors. MCP tools (`mcp__server__tool`) forward verbatim — the shape real CC uses for session-attached servers (v4.8.135). → [`docs/integrations/agent-compat.md`](./docs/integrations/agent-compat.md)
 - **Recover output capability.** `dario proxy --system-prompt=partial` strips CC's tone/verbosity/no-comments constraints for 1.2–2.8× more output on open-ended work — empirically without flipping billing (the classifier doesn't read that slot). [Discussion #183](https://github.com/askalf/dario/discussions/183) has the per-prompt receipts. → [`docs/system-prompt.md`](./docs/system-prompt.md)
 - **Honor client thinking (`--honor-client-thinking`).** By default dario rebuilds the outbound request with CC's interactive thinking shape regardless of what the client sent. Pass this flag (or `DARIO_HONOR_CLIENT_THINKING=1`) to pass a non-CC client's own `thinking` block through unchanged. Off by default; the rebuild-to-CC path is what keeps the subscription pool routing.
 - **Preserve structured output (`--preserve-output-format`).** By default dario rebuilds `output_config` from CC's template (effort only), dropping a client's `output_config.format` JSON schema, so structured-output clients get unconstrained prose their strict parser rejects. Pass this flag (or `DARIO_PRESERVE_OUTPUT_FORMAT=1`) to carry the client's schema through unchanged — SDK clients like the Vercel AI SDK's `generateObject` then get schema-constrained output. Off by default; empirically without flipping billing (verified `five_hour` on `claude-sonnet-4-6`).

package/dist/cc-template.d.ts

@@ -56,13 +56,45 @@ export declare const CC_TOOL_DEFINITIONS: {
     description: string;
     input_schema: Record<string, unknown>;
 }[];
+/** The UNFILTERED bundled union — every tool the bake knows across platforms
+ *  (PLATFORM_ONLY_TOOLS keeps the bundle a superset). The identity-mapping,
+ *  detection, and advertise paths intersect with what the CLIENT declared,
+ *  and the client's declaration already encodes its platform — a Linux CC
+ *  never declares PowerShell. Filtering those paths by the PROXY HOST's
+ *  process.platform (pre-v4.8.136) made a Linux-hosted dario treat a win32
+ *  client's PowerShell/Glob/Grep as non-native: PowerShell fell to the
+ *  unmapped round-robin, and all three were dropped from the advertised
+ *  array (Glob/Grep translated via lowercase aliases but were never sent
+ *  upstream). Host-filtered CC_TOOL_DEFINITIONS stays correct for the paths
+ *  with no client declaration to mirror: the full-template fallback, the
+ *  merge-mode base array, and Fable's no-tools shape. */
+export declare const CC_TOOL_DEFINITIONS_UNION: {
+    name: string;
+    description: string;
+    input_schema: Record<string, unknown>;
+}[];
+export declare const CC_NATIVE_NAMES_UNION: Set<string>;
 /** CC's own tool names, EXACT case ("Read", "Bash", "Agent", …). A CC client's
  *  tools identity-map to themselves and OVERRIDE TOOL_MAP — whose lowercase
  *  cross-client aliases ('read' → {path}/{filePath}) would otherwise mistranslate
  *  a CC tool (Read's file_path → path). Exact case is the discriminator: CC sends
  *  PascalCase, the {path}-style clients send lowercase/snake, so a non-CC `read`
- *  still routes through TOOL_MAP. Tracks the live bundle (refreshed each bake). */
+ *  still routes through TOOL_MAP. Tracks the live bundle (refreshed each bake).
+ *  HOST-filtered — the routing, detection, and advertise paths use the
+ *  _UNION variants below so a client on a different platform than the proxy
+ *  host still identity-maps (v4.8.136). */
 export declare const CC_NATIVE_NAMES: Set<string>;
+/** MCP tools attached to a CC session are namespaced `mcp__<server>__<tool>`.
+ *  Real CC advertises them VERBATIM after its built-ins — the schemas are
+ *  operator-supplied, so there is no canonical template entry to substitute.
+ *  Passing them through unchanged IS CC's wire shape; remapping them was the
+ *  divergence. Before v4.8.135 they fell through to the unmapped-tool
+ *  round-robin: dropped from the advertised array (the model never saw them)
+ *  while history tool_use blocks were renamed onto Bash/Read/… with junk args
+ *  — seen live as "tool substitution: 28/52 client tools not in TOOL_MAP" on
+ *  a CC session with an MCP server attached. Like CC_NATIVE_NAMES, these
+ *  identity-map and skip TOOL_MAP entirely. */
+export declare function isMcpToolName(name: unknown): boolean;
 /** CC's static system prompt (~25KB). The shared base — baked from a non-Fable
  *  model (Opus). CC ships some models a larger, model-specific prompt; see
  *  CC_SYSTEM_PROMPT_FABLE / systemPromptForModel. */

package/dist/cc-template.js

@@ -66,13 +66,43 @@ export const INTERACTIVE_ONLY_TOOLS = new Set([
 ]);
 /** CC's exact tool definitions for the current platform — filtered from the bundled union. */
 export const CC_TOOL_DEFINITIONS = filterToolsForPlatform(TEMPLATE.tools, process.platform);
+/** The UNFILTERED bundled union — every tool the bake knows across platforms
+ *  (PLATFORM_ONLY_TOOLS keeps the bundle a superset). The identity-mapping,
+ *  detection, and advertise paths intersect with what the CLIENT declared,
+ *  and the client's declaration already encodes its platform — a Linux CC
+ *  never declares PowerShell. Filtering those paths by the PROXY HOST's
+ *  process.platform (pre-v4.8.136) made a Linux-hosted dario treat a win32
+ *  client's PowerShell/Glob/Grep as non-native: PowerShell fell to the
+ *  unmapped round-robin, and all three were dropped from the advertised
+ *  array (Glob/Grep translated via lowercase aliases but were never sent
+ *  upstream). Host-filtered CC_TOOL_DEFINITIONS stays correct for the paths
+ *  with no client declaration to mirror: the full-template fallback, the
+ *  merge-mode base array, and Fable's no-tools shape. */
+export const CC_TOOL_DEFINITIONS_UNION = TEMPLATE.tools;
+export const CC_NATIVE_NAMES_UNION = new Set(TEMPLATE.tools.map((t) => String(t.name)));
 /** CC's own tool names, EXACT case ("Read", "Bash", "Agent", …). A CC client's
  *  tools identity-map to themselves and OVERRIDE TOOL_MAP — whose lowercase
  *  cross-client aliases ('read' → {path}/{filePath}) would otherwise mistranslate
  *  a CC tool (Read's file_path → path). Exact case is the discriminator: CC sends
  *  PascalCase, the {path}-style clients send lowercase/snake, so a non-CC `read`
- *  still routes through TOOL_MAP. Tracks the live bundle (refreshed each bake). */
+ *  still routes through TOOL_MAP. Tracks the live bundle (refreshed each bake).
+ *  HOST-filtered — the routing, detection, and advertise paths use the
+ *  _UNION variants below so a client on a different platform than the proxy
+ *  host still identity-maps (v4.8.136). */
 export const CC_NATIVE_NAMES = new Set(CC_TOOL_DEFINITIONS.map((t) => String(t.name)));
+/** MCP tools attached to a CC session are namespaced `mcp__<server>__<tool>`.
+ *  Real CC advertises them VERBATIM after its built-ins — the schemas are
+ *  operator-supplied, so there is no canonical template entry to substitute.
+ *  Passing them through unchanged IS CC's wire shape; remapping them was the
+ *  divergence. Before v4.8.135 they fell through to the unmapped-tool
+ *  round-robin: dropped from the advertised array (the model never saw them)
+ *  while history tool_use blocks were renamed onto Bash/Read/… with junk args
+ *  — seen live as "tool substitution: 28/52 client tools not in TOOL_MAP" on
+ *  a CC session with an MCP server attached. Like CC_NATIVE_NAMES, these
+ *  identity-map and skip TOOL_MAP entirely. */
+export function isMcpToolName(name) {
+    return typeof name === 'string' && name.startsWith('mcp__');
+}
 /** CC's static system prompt (~25KB). The shared base — baked from a non-Fable
  *  model (Opus). CC ships some models a larger, model-specific prompt; see
  *  CC_SYSTEM_PROMPT_FABLE / systemPromptForModel. */
@@ -526,14 +556,21 @@ export function detectNonCCByTools(clientTools) {
         const rawName = tool.name || '';
         // A tool is "foreign" only if dario can neither map it (TOOL_MAP, by
         // lowercased cross-client alias) nor recognize it as CC's own (CC_NATIVE_NAMES,
-        // by exact PascalCase). CC-native tools identity-map to themselves in the remap
+        // by exact PascalCase) nor pass it through as an MCP tool (mcp__* — identity,
+        // like CC natives). CC-native tools identity-map to themselves in the remap
         // path (see buildCCRequest), so counting them here inflates the ratio and
         // mis-flags a modern, agentic-heavy CC client (Agent, Skill, Workflow, Task*,
         // … — in the live bundle but absent from TOOL_MAP's alias table) as
         // 'unknown-non-cc', flipping it to preserve and discarding the CC tool
-        // fingerprint dario exists to present. Mirror the routing's membership test so
-        // detection and routing agree.
-        if (!TOOL_MAP[rawName.toLowerCase()] && !CC_NATIVE_NAMES.has(rawName))
+        // fingerprint dario exists to present. Same trap for MCP tools: two or three
+        // attached servers push a real CC session past the 80% line on their own
+        // (28/52 seen live). Mirror the routing's membership test so detection and
+        // routing agree. An ALL-mcp surface now scores ratio 0 and stays in default
+        // mode — safe, because the advertise path sends an mcp-only declaration
+        // verbatim rather than falling back to the full CC template.
+        // Union set, not the host-filtered one: a win32 client's PowerShell is
+        // native regardless of the platform dario itself runs on (v4.8.136).
+        if (!TOOL_MAP[rawName.toLowerCase()] && !CC_NATIVE_NAMES_UNION.has(rawName) && !isMcpToolName(rawName))
             unmapped++;
     }
     const ratio = unmapped / clientTools.length;
@@ -1336,10 +1373,16 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
             //  2. CC's newer built-ins (Agent, AskUserQuestion, Cron*, Task*, Workflow,
             //     NotebookEdit, Enter/ExitPlanMode, …) aren't in TOOL_MAP at all, so
             //     they were round-robined onto Read/Bash/etc. and collided.
+            //  3. MCP tools (mcp__<server>__<tool>) carry operator-supplied schemas
+            //     that never have a TOOL_MAP or template entry. Real CC forwards them
+            //     verbatim, so they identity-map too and are advertised as-is below.
             // Exact case is the discriminator (CC sends PascalCase; {path}-style clients
             // send lowercase/snake) so a genuine non-CC `read` still routes via TOOL_MAP.
             // Tracks the live bundle, so future CC tools are covered after the next bake.
-            const mapping = CC_NATIVE_NAMES.has(tool.name)
+            // UNION set: identity must hold for a win32 client's PowerShell/Glob/Grep
+            // even when dario itself runs on Linux (v4.8.136) — the exact-case check
+            // still keeps a non-CC lowercase `glob`/`grep` on its TOOL_MAP alias.
+            const mapping = CC_NATIVE_NAMES_UNION.has(tool.name) || isMcpToolName(tool.name)
                 ? { ccTool: tool.name, translateArgs: (a) => a, translateBack: (a) => a }
                 : TOOL_MAP[name];
             if (mapping) {
@@ -1377,8 +1420,8 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
         const CC_FALLBACK_TOOLS = ['Bash', 'Read', 'Grep', 'Glob', 'WebSearch', 'WebFetch'];
         for (const tool of clientTools) {
             const name = (tool.name || '').toLowerCase();
-            if (CC_NATIVE_NAMES.has(tool.name) || TOOL_MAP[name])
-                continue; // CC-native (identity in pass 1) or mapped
+            if (CC_NATIVE_NAMES_UNION.has(tool.name) || isMcpToolName(tool.name) || TOOL_MAP[name])
+                continue; // CC-native (union) / MCP (identity in pass 1) or mapped
             unmappedTools.push(tool.name);
             if (opts.hybridTools)
                 continue; // dropped — see comment above
@@ -1555,13 +1598,31 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
             // dario-routed CC session). A real CC client with a reduced tool set sends
             // exactly this reduced array (every --disallowedTools / MCP delta does
             // this), so filtering tracks CC's wire shape rather than diverging from it.
-            // If the client declared no CC-native tool at all it isn't really CC; keep
-            // the full template as the safer fingerprint default in that case.
+            //
+            // MCP tools (mcp__<server>__<tool>) are appended VERBATIM after the
+            // canonical natives — that mirrors real CC, which sends operator-supplied
+            // MCP schemas after its built-ins. There is no template entry to
+            // substitute, and omitting them here (pre-v4.8.135) meant the model never
+            // saw the session's MCP surface at all while history references were
+            // round-robined onto fallback slots.
+            //
+            // If the client declared neither a CC-native nor an MCP tool it isn't
+            // really CC; keep the full template as the safer fingerprint default in
+            // that case. An mcp-only declaration goes out verbatim instead — falling
+            // back to the full template there would advertise natives the client
+            // can't execute (the AskUserQuestion failure mode above).
             const clientToolNames = new Set(clientTools
                 .map((t) => t.name?.toLowerCase())
                 .filter((n) => Boolean(n)));
-            const availableCC = CC_TOOL_DEFINITIONS.filter((t) => clientToolNames.has(t.name.toLowerCase()));
-            ccRequest.tools = availableCC.length > 0 ? availableCC : CC_TOOL_DEFINITIONS;
+            // Intersect against the UNION, not the host-filtered set: the client's
+            // declaration encodes the client's platform, so a win32 CC declaring
+            // PowerShell/Glob/Grep gets their canonical defs even from a Linux-hosted
+            // dario. The host filter only governs the no-declaration fallbacks.
+            const availableCC = CC_TOOL_DEFINITIONS_UNION.filter((t) => clientToolNames.has(t.name.toLowerCase()));
+            const mcpTools = clientTools.filter((t) => isMcpToolName(t.name));
+            ccRequest.tools = availableCC.length > 0 || mcpTools.length > 0
+                ? [...availableCC, ...mcpTools]
+                : CC_TOOL_DEFINITIONS;
         }
     }
     else if (effectiveMergeTools) {

package/dist/proxy.js

@@ -9,7 +9,7 @@ import { arch, platform } from 'node:process';
 import { getAccessToken, getStatus } from './oauth.js';
 import { buildHealthResponse, derivePoolStatus, shouldDiscloseHealthInternals } from './health-response.js';
 import { darioVersion } from './version.js';
-import { buildCCRequest, applyCcPromptCaching, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, CC_TEMPLATE } from './cc-template.js';
+import { buildCCRequest, applyCcPromptCaching, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, isMcpToolName, CC_TEMPLATE } from './cc-template.js';
 import { stampCch, hasCchSeed } from './cch.js';
 import { describeTemplate, detectDrift, checkCCCompat } from './live-fingerprint.js';
 import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, reconcilePoolAccounts } from './pool.js';
@@ -892,6 +892,8 @@ export async function startProxy(opts = {}) {
     // tool-substitution warn line. Same de-dup contract as
     // detectedClientsLogged so mixed-traffic proxies don't spam.
     const toolSubLogged = new Set();
+    // Same de-dup contract for the verbose-only MCP-passthrough note.
+    const mcpPassthroughLogged = new Set();
     // Body-dump mode: set via --verbose=2 / -vv or DARIO_LOG_BODIES=1.
     // When on, every request emits a redacted JSON body to stderr so
     // operators can see exactly what dario forwards upstream. Default
@@ -2146,6 +2148,20 @@ export async function startProxy(opts = {}) {
                             const more = unmappedTools.length > 5 ? `, +${unmappedTools.length - 5} more` : '';
                             console.log(`[dario] tool substitution: ${unmappedTools.length}/${totalTools} client tool${unmappedTools.length === 1 ? '' : 's'} not in TOOL_MAP — remapped onto CC fallback slots (${sample}${more}). Pass --preserve-tools to forward your schemas verbatim instead.`);
                         }
+                        // MCP tools (mcp__<server>__<tool>) forward verbatim in default
+                        // mode — real CC advertises session-attached MCP schemas as-is,
+                        // so this is passthrough, not substitution. Verbose-only note so
+                        // operators can confirm their MCP surface survived; same de-dupe
+                        // as the substitution warn.
+                        if (verbose && !preserveToolsEffective && !mcpPassthroughLogged.has(subKey)) {
+                            const mcpCount = Array.isArray(r.tools)
+                                ? r.tools.filter((t) => isMcpToolName(t?.name)).length
+                                : 0;
+                            if (mcpCount > 0) {
+                                mcpPassthroughLogged.add(subKey);
+                                console.log(`[dario] ${mcpCount} MCP tool${mcpCount === 1 ? '' : 's'} (mcp__*) forwarded verbatim alongside CC's native set`);
+                            }
+                        }
                         // Store tool map for response reverse-mapping
                         ccToolMap = toolMap;
                         // Replace request body entirely with CC template

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "4.8.134",
+  "version": "4.8.136",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {