@askalf/dario 4.8.144 → 4.8.146

package/dist/cc-template.d.ts

@@ -490,6 +490,27 @@ export declare const CC_CACHE_CONTROL: CacheControl;
  * Exported for unit testing.
  */
 export declare function applyCcPromptCaching(ccRequest: Record<string, unknown>, cacheControl: CacheControl): void;
+/**
+ * Drop later tools whose exact name already appeared. Upstream rejects the
+ * whole request with 400 "tools: Tool names must be unique" on any repeat,
+ * so this is the last-line guard on the assembled advertise array — a
+ * polluted live template (see the mcp__ exclusion at the availableCC build)
+ * or a client double-declare degrades to first-wins instead of a hard
+ * request failure. Exported for tests.
+ */
+export declare function dedupeToolsByName<T extends {
+    name?: unknown;
+}>(tools: T[]): T[];
+/**
+ * A genuine Claude Code client is identified by TWO markers together:
+ * the `x-anthropic-billing-header:` system block at [0] (the discriminator
+ * extractSystemText and extractTemplate key on) AND CC's own identity block
+ * at [1] ("You are Claude Code…" / the Claude Agent SDK variant). Requiring
+ * both keeps a non-CC framework that replays a billing-tagged body (e.g. a
+ * Kilo client behind a second proxy hop) on the detector path instead of
+ * passthrough. Exported for tests.
+ */
+export declare function isGenuineCCClient(clientBody: Record<string, unknown>): boolean;
 export declare function buildCCRequest(clientBody: Record<string, unknown>, billingTag: string, cacheControl: CacheControl, identity: {
     deviceId: string;
     accountUuid: string;
@@ -510,6 +531,7 @@ export declare function buildCCRequest(clientBody: Record<string, unknown>, bill
     toolMap: Map<string, ToolMapping>;
     unmappedTools: string[];
     detectedClient?: string;
+    genuineCC?: boolean;
 };
 /**
  * Reverse-map CC tool calls in a non-streaming response back to the

package/dist/cc-template.js

@@ -1308,12 +1308,105 @@ export function applyCcPromptCaching(ccRequest, cacheControl) {
         }
     }
 }
+/**
+ * Drop later tools whose exact name already appeared. Upstream rejects the
+ * whole request with 400 "tools: Tool names must be unique" on any repeat,
+ * so this is the last-line guard on the assembled advertise array — a
+ * polluted live template (see the mcp__ exclusion at the availableCC build)
+ * or a client double-declare degrades to first-wins instead of a hard
+ * request failure. Exported for tests.
+ */
+export function dedupeToolsByName(tools) {
+    const seen = new Set();
+    const out = [];
+    for (const t of tools) {
+        const name = typeof t.name === 'string' ? t.name : '';
+        if (name && seen.has(name))
+            continue;
+        if (name)
+            seen.add(name);
+        out.push(t);
+    }
+    return out;
+}
+/**
+ * A genuine Claude Code client is identified by TWO markers together:
+ * the `x-anthropic-billing-header:` system block at [0] (the discriminator
+ * extractSystemText and extractTemplate key on) AND CC's own identity block
+ * at [1] ("You are Claude Code…" / the Claude Agent SDK variant). Requiring
+ * both keeps a non-CC framework that replays a billing-tagged body (e.g. a
+ * Kilo client behind a second proxy hop) on the detector path instead of
+ * passthrough. Exported for tests.
+ */
+export function isGenuineCCClient(clientBody) {
+    const sys = clientBody.system;
+    if (!Array.isArray(sys) || sys.length < 2)
+        return false;
+    const first = sys[0];
+    if (typeof first?.text !== 'string' || !first.text.includes('x-anthropic-billing-header:'))
+        return false;
+    const second = sys[1];
+    if (typeof second?.text !== 'string')
+        return false;
+    return second.text.startsWith('You are Claude Code') || second.text.includes('Claude Agent SDK');
+}
 export function buildCCRequest(clientBody, billingTag, cacheControl, identity, opts = {}) {
     const model = clientBody.model || 'claude-sonnet-5';
     const isHaiku = model.toLowerCase().includes('haiku');
     const messages = clientBody.messages || [];
     const clientTools = clientBody.tools;
     const stream = clientBody.stream ?? false;
+    // ── Genuine Claude Code client → byte-faithful passthrough ──
+    // A real CC request already IS the CC wire shape. Replacing its system
+    // prompt with the template (prepending ~25KB per request shape) and
+    // substituting template tool defs was pure duplication: it re-billed the
+    // doubled prompt per shape per cache window (the residual +5%-vs-direct in
+    // the dario#678 re-test), drifted the tool schemas whenever the client's CC
+    // version differed from the template's, and round-robin-mangled natives the
+    // `--print`-mode template capture never sees (AskUserQuestion, plan-mode
+    // tools). Forward system blocks and tools verbatim. dario still owns:
+    //   - system[0]: dario's billing tag (consistent with dario's headers),
+    //   - metadata.user_id: dario's identity (the OAuth account is dario's,
+    //     not the client's),
+    //   - cache breakpoints: client stamps are stripped and re-placed (system
+    //     here, conversation in applyCcPromptCaching) so the 4-breakpoint
+    //     budget stays deterministic.
+    // Messages, thinking, effort, max_tokens, top-level key order: untouched —
+    // the client is the authority on its own wire shape. Outranks the
+    // tool-mode flags: those configure how NON-CC clients are dressed up as
+    // CC, which a genuine CC client doesn't need.
+    if (isGenuineCCClient(clientBody)) {
+        const clientSystem = clientBody.system;
+        const system = clientSystem.map((b, i) => {
+            const copy = { ...b };
+            delete copy.cache_control;
+            if (i === 0)
+                copy.text = billingTag;
+            return copy;
+        });
+        // Mirror CC's own placement: the identity + prompt blocks carry the
+        // stamps (the last two non-billing blocks; a 2-block system stamps just
+        // the last one).
+        for (let i = Math.max(1, system.length - 2); i < system.length; i++) {
+            system[i] = { ...system[i], cache_control: cacheControl };
+        }
+        for (const msg of messages) {
+            if (Array.isArray(msg.content)) {
+                for (const block of msg.content) {
+                    delete block.cache_control;
+                }
+            }
+        }
+        const body = { ...clientBody, system };
+        body.metadata = {
+            user_id: JSON.stringify({
+                device_id: identity.deviceId,
+                account_uuid: identity.accountUuid,
+                session_id: identity.sessionId,
+            }),
+        };
+        return { body, toolMap: new Map(), unmappedTools: [], genuineCC: true };
+    }
     // ── Detect text-tool-protocol clients up-front ──
     // Cline / Kilo Code / Roo Code (and forks) ship an XML tool-invocation
     // protocol in the system prompt. Peek at it before scrubbing so the
@@ -1648,10 +1741,20 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
             // declaration encodes the client's platform, so a win32 CC declaring
             // PowerShell/Glob/Grep gets their canonical defs even from a Linux-hosted
             // dario. The host filter only governs the no-declaration fallbacks.
-            const availableCC = CC_TOOL_DEFINITIONS_UNION.filter((t) => clientToolNames.has(t.name.toLowerCase()));
+            //
+            // mcp__* entries are EXCLUDED from the template side: a live capture on
+            // a machine with MCP servers configured absorbs the capture session's
+            // mcp__* tools into the template (the dario#678 reporter's doctor showed
+            // 138 tool defs — ~111 of them MCP pollution), and any client-declared
+            // MCP tool whose name also sat in the polluted union then went out
+            // TWICE (template def + verbatim client schema) — upstream rejects the
+            // whole request with 400 "tools: Tool names must be unique". MCP
+            // schemas are operator-supplied; the client's declaration is the only
+            // authoritative source, never the template.
+            const availableCC = CC_TOOL_DEFINITIONS_UNION.filter((t) => !isMcpToolName(t.name) && clientToolNames.has(t.name.toLowerCase()));
             const mcpTools = clientTools.filter((t) => isMcpToolName(t.name));
             ccRequest.tools = availableCC.length > 0 || mcpTools.length > 0
-                ? [...availableCC, ...mcpTools]
+                ? dedupeToolsByName([...availableCC, ...mcpTools])
                 : CC_TOOL_DEFINITIONS;
         }
     }

package/dist/live-fingerprint.js

@@ -220,6 +220,17 @@ function readLiveCache() {
         quarantineCorruptCache('missing required fields (system_prompt / tools)');
         return null;
     }
+    // Pre-4.8.145 captures baked the operator's mcp__* tools into the template
+    // (dario#678 regression: duplicate tool names → upstream 400). The capture
+    // path filters them now, but a polluted cache written by an older dario
+    // sits on disk until something rewrites it — its junk union and inflated
+    // doctor Overhead numbers persist (the #678 reporter's cache showed 138
+    // tool defs, ~111 of them MCP). Quarantine on load; the background refresh
+    // re-captures clean.
+    if (parsed.tools.some((t) => typeof t?.name === 'string' && t.name.startsWith('mcp__'))) {
+        quarantineCorruptCache('mcp__ tool pollution (pre-4.8.145 capture)');
+        return null;
+    }
     // Schema version mismatch is NOT corruption — it's an expected event on
     // dario upgrade or downgrade. Skip the cache silently; the background
     // refresh will rewrite it in the new shape.
@@ -550,9 +561,18 @@ export function extractTemplate(captured) {
     const systemPrompt = pickTextBlock(systemBlocks[2]);
     if (!agentIdentity || !systemPrompt)
         return null;
+    // mcp__* tools are EXCLUDED from the template: the capture spawns the
+    // operator's own CC, and on a machine with MCP servers configured the
+    // captured request declares their mcp__<server>__<tool> schemas — session
+    // config, not CC wire shape. Baking them poisoned CC_TOOL_DEFINITIONS_UNION
+    // and duplicated any client-declared MCP tool on the advertise path
+    // (template def + verbatim client schema), which upstream rejects with
+    // 400 "tools: Tool names must be unique" (dario#678 follow-up). Local
+    // startsWith mirror of cc-template's isMcpToolName — importing it here
+    // would cycle (cc-template imports loadTemplate from this module).
     const tools = Array.isArray(body.tools)
         ? body.tools
-            .filter((t) => typeof t.name === 'string')
+            .filter((t) => typeof t.name === 'string' && !t.name.startsWith('mcp__'))
             .map((t) => ({
             name: t.name,
             description: t.description ?? '',

package/dist/proxy.d.ts

@@ -64,8 +64,10 @@ export declare const CLAUDE_CODE_BETA = "claude-code-20250219";
  * it, ORDER included:
  *
  *   opus-4-8    = base                                    (unchanged)
- *   sonnet-5    = base − {mid-conversation-system}        (CC 2.1.201 dropped it
- *                 from sonnet; 2.1.199 sonnet == opus and still kept it — #667)
+ *   sonnet-5    = base                                    (== opus — wire-drift
+ *                 live capture, CC 2.1.204: mid-conversation-system included)
+ *   sonnet-4-x  = base − {mid-conversation-system}        (CC 2.1.201 dropped it
+ *                 from sonnet 4.6; 2.1.199 sonnet == opus and still kept it — #667)
  *   haiku-4-5   = base − {mid-conversation-system, effort, afk-mode}, and
  *                 claude-code-20250219 MOVED to position 5 (before advisor-tool)
  *   fable-5     = base + fallback-credit-2026-06-01 inserted BEFORE afk-mode

package/dist/proxy.js

@@ -323,8 +323,10 @@ function moveBetaBefore(flags, flag, anchor) {
  * it, ORDER included:
  *
  *   opus-4-8    = base                                    (unchanged)
- *   sonnet-5    = base − {mid-conversation-system}        (CC 2.1.201 dropped it
- *                 from sonnet; 2.1.199 sonnet == opus and still kept it — #667)
+ *   sonnet-5    = base                                    (== opus — wire-drift
+ *                 live capture, CC 2.1.204: mid-conversation-system included)
+ *   sonnet-4-x  = base − {mid-conversation-system}        (CC 2.1.201 dropped it
+ *                 from sonnet 4.6; 2.1.199 sonnet == opus and still kept it — #667)
  *   haiku-4-5   = base − {mid-conversation-system, effort, afk-mode}, and
  *                 claude-code-20250219 MOVED to position 5 (before advisor-tool)
  *   fable-5     = base + fallback-credit-2026-06-01 inserted BEFORE afk-mode
@@ -353,9 +355,11 @@ export function betaForModel(base, model, skipContext1m = false) {
         flags = flags.filter((f) => !drop.has(f));
         flags = moveBetaBefore(flags, CLAUDE_CODE_BETA, ADVISOR_TOOL_BETA);
     }
-    else if (m.includes('sonnet')) {
-        // CC 2.1.201 dropped mid-conversation-system from sonnet's beta set (2.1.199
-        // sonnet == opus and still carried it — live capture #667). opus + fable keep it.
+    else if (/sonnet-4/.test(m)) {
+        // CC 2.1.201 dropped mid-conversation-system from SONNET 4.6's beta set
+        // (2.1.199 sonnet == opus and still carried it — live capture #667).
+        // Scoped to the sonnet-4 line: Sonnet 5 carries it again — the wire-drift
+        // runner's live capture on CC 2.1.204 shows sonnet-5's set equal to opus's.
         flags = flags.filter((f) => f !== MID_CONVERSATION_SYSTEM_BETA);
     }
     else if (m.includes('fable')) {
@@ -894,6 +898,8 @@ export async function startProxy(opts = {}) {
     const toolSubLogged = new Set();
     // Same de-dup contract for the verbose-only MCP-passthrough note.
     const mcpPassthroughLogged = new Set();
+    // One-shot log for the genuine-CC byte-faithful passthrough path.
+    let ccPassthroughLogged = false;
     // Body-dump mode: set via --verbose=2 / -vv or DARIO_LOG_BODIES=1.
     // When on, every request emits a redacted JSON body to stderr so
     // operators can see exactly what dario forwards upstream. Default
@@ -2091,7 +2097,7 @@ export async function startProxy(opts = {}) {
                         const bodyIdentity = poolAccount
                             ? poolAccount.identity
                             : { deviceId: identity.deviceId, accountUuid: identity.accountUuid, sessionId: preBodySessionId };
-                        const { body: ccBody, toolMap, detectedClient, unmappedTools } = buildCCRequest(r, billingTag, CACHE_EPHEMERAL, bodyIdentity, {
+                        const { body: ccBody, toolMap, detectedClient, unmappedTools, genuineCC } = buildCCRequest(r, billingTag, CACHE_EPHEMERAL, bodyIdentity, {
                             preserveTools: opts.preserveTools ?? false,
                             hybridTools: opts.hybridTools ?? false,
                             mergeTools: opts.mergeTools ?? false,
@@ -2113,8 +2119,15 @@ export async function startProxy(opts = {}) {
                             applyCcPromptCaching(ccBody, CACHE_EPHEMERAL);
                         }
                         detectedClientForLog = detectedClient;
+                        // genuineCC → the client's own tool schemas went out verbatim, so
+                        // the response path must not rewrite tool names either.
                         preserveToolsEffective = Boolean(opts.preserveTools)
+                            || Boolean(genuineCC)
                             || (Boolean(detectedClient) && !opts.hybridTools && !opts.mergeTools);
+                        if (genuineCC && !ccPassthroughLogged) {
+                            ccPassthroughLogged = true;
+                            console.log('[dario] genuine Claude Code client — system + tools forwarded verbatim (byte-faithful passthrough)');
+                        }
                         // Log the auto-preserve-tools switch once per text-tool
                         // client family. Skip when the operator already opted into
                         // --preserve-tools or --hybrid-tools — they know what they

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "4.8.144",
+  "version": "4.8.146",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {