@askalf/dario 4.8.38 → 4.8.40

package/dist/cc-template.d.ts

@@ -129,6 +129,7 @@ export declare function orderHeadersForOutbound(headers: Record<string, string>,
  */
 export declare function orderBodyForOutbound(body: Record<string, unknown>, overrideOrder?: string[] | undefined): Record<string, unknown>;
 export declare function scrubFrameworkIdentifiers(text: string): string;
+export declare function scrubFrameworkIdentifiersInContent(text: string): string;
 /**
  * Detect text-tool-protocol clients (Cline, Kilo Code, Roo Code and
  * their forks) by fingerprinting the incoming system prompt.

package/dist/cc-template.js

@@ -247,9 +247,31 @@ const FRAMEWORK_PATTERNS = [
     // OC's sessions_* tool-name prefix — flagged as a fingerprint in dario#23.
     /\bsessions_[a-z_]+\b/gi,
 ];
-export function scrubFrameworkIdentifiers(text) {
+// Patterns SAFE to apply to message *content* (user data: source code, docs,
+// tool output). This is the small subset of FRAMEWORK_PATTERNS that consists
+// only of distinctive, multi-word / unambiguous product identifiers which
+// effectively never appear verbatim in real code or prose. It deliberately
+// EXCLUDES every bare single-word pattern (`continue`, `cursor`, `gateway`,
+// `openai`, `hermes`, `zed`, `tabby`, `cody`, `aider`, `cline`, `copilot`,
+// `windsurf`, …) because those collide with ordinary code tokens and English.
+// Stripping those from a user's payload silently CORRUPTS it: the JS keyword
+// `continue;` became `;` (because Continue.dev is on the list), which made a
+// code auditor report a bare-semicolon "no-op" that THIS PROXY had introduced.
+// A proxy must never mutate the user's content — identity-masking of the
+// *client's framing* is the job of the system-prompt scrub, which still uses
+// the full FRAMEWORK_PATTERNS set.
+const CONTENT_FRAMEWORK_PATTERNS = [
+    /\b(roo[- ]?cline|roo[- ]?code|big[- ]?agi|claude[- ]?bridge)\b/gi,
+    /\b(librechat|typingmind)\b/gi,
+    // NOTE: deliberately omits `/powered by [a-z]+/` and `/\bgateway\b/` etc.
+    // from FRAMEWORK_PATTERNS — those would strip legitimate user content like
+    // a "Powered by Stripe" footer or a `gateway` variable. Only distinctive,
+    // multi-token product names that never occur verbatim in real code/data are
+    // safe to mask in the user's payload.
+];
+function scrubWithPatterns(text, patterns) {
     let result = text;
-    for (const pattern of FRAMEWORK_PATTERNS) {
+    for (const pattern of patterns) {
         pattern.lastIndex = 0;
         result = result.replace(pattern, (match, ...args) => {
             const offset = args[args.length - 2];
@@ -271,6 +293,15 @@ export function scrubFrameworkIdentifiers(text) {
     }
     return result;
 }
+// Scrub the CLIENT'S system prompt / identity fields — full pattern set.
+export function scrubFrameworkIdentifiers(text) {
+    return scrubWithPatterns(text, FRAMEWORK_PATTERNS);
+}
+// Scrub message CONTENT (the user's code/data) — content-safe subset only, so
+// a user's payload is never corrupted. See CONTENT_FRAMEWORK_PATTERNS.
+export function scrubFrameworkIdentifiersInContent(text) {
+    return scrubWithPatterns(text, CONTENT_FRAMEWORK_PATTERNS);
+}
 /**
  * Detect text-tool-protocol clients (Cline, Kilo Code, Roo Code and
  * their forks) by fingerprinting the incoming system prompt.
@@ -1237,25 +1268,29 @@ export function buildCCRequest(clientBody, billingTag, cacheControl, identity, o
     // system array a second time per request. Scrub applies at this
     // point so framework identifiers don't leak upstream.
     let systemText = scrubFrameworkIdentifiers(rawSystemForDetection);
-    // Also scrub framework identifiers from message content text blocks.
-    // Clients often inject their product name into user/tool messages as well,
-    // and the system-prompt-only scrub used to miss those.
+    // Also scrub framework identifiers from message content text blocks —
+    // clients can leak their product name in user/tool messages too. This uses
+    // the CONTENT-SAFE subset (scrubFrameworkIdentifiersInContent), NOT the full
+    // pattern set: message content is the user's own code/data and must never be
+    // mutated. The full set ran here previously and corrupted source — the JS
+    // keyword `continue;` became `;` (Continue.dev is a scrubbed name), so a code
+    // auditor "found" a bare-semicolon no-op the proxy itself had introduced.
     for (const msg of messages) {
         if (typeof msg.content === 'string') {
-            msg.content = scrubFrameworkIdentifiers(msg.content);
+            msg.content = scrubFrameworkIdentifiersInContent(msg.content);
         }
         else if (Array.isArray(msg.content)) {
             for (const block of msg.content) {
                 if (block.type === 'text' && typeof block.text === 'string') {
-                    block.text = scrubFrameworkIdentifiers(block.text);
+                    block.text = scrubFrameworkIdentifiersInContent(block.text);
                 }
                 if (block.type === 'tool_result' && typeof block.content === 'string') {
-                    block.content = scrubFrameworkIdentifiers(block.content);
+                    block.content = scrubFrameworkIdentifiersInContent(block.content);
                 }
                 if (block.type === 'tool_result' && Array.isArray(block.content)) {
                     for (const sub of block.content) {
                         if (sub.type === 'text' && typeof sub.text === 'string') {
-                            sub.text = scrubFrameworkIdentifiers(sub.text);
+                            sub.text = scrubFrameworkIdentifiersInContent(sub.text);
                         }
                     }
                 }

package/dist/proxy.d.ts

@@ -193,6 +193,17 @@ interface ProxyOptions {
      * Sourced from `--system-prompt=<value>` or DARIO_SYSTEM_PROMPT.
      */
     systemPrompt?: string;
+    /**
+     * Upstream auth override: forward to api.anthropic.com using `x-api-key:
+     * <this>` (the per-token API pool) instead of the Pro/Max OAuth bearer.
+     * When set, OAuth/getAccessToken and the account pool are bypassed entirely
+     * — dario becomes a thin per-token Anthropic proxy. Default (unset) keeps
+     * the subscription-OAuth behavior. Used by the self-hosted compat workflow
+     * so it can route the suite THROUGH dario without tripping the subscription
+     * pool's ~3/min cap. Sourced from ANTHROPIC_UPSTREAM_API_KEY (env-only — never
+     * a CLI flag, so the key never lands in `ps`/argv).
+     */
+    upstreamApiKey?: string;
     /**
      * Overage-guard — halt the proxy on the first response carrying
      * `representative-claim: overage`. Subscribers should never see a
@@ -253,5 +264,11 @@ export declare function authenticateRequest(headers: IncomingMessage['headers'],
  * user's real credential for some other provider. Pure over inputs (dario#97).
  */
 export declare function describeAuthReject(headers: IncomingMessage['headers']): string;
+/**
+ * Build the upstream auth header for the request to api.anthropic.com.
+ * `upstreamApiKey` set → per-token API pool (`x-api-key`); otherwise the
+ * Pro/Max OAuth bearer. Pure + exported for unit testing.
+ */
+export declare function upstreamAuthHeaders(upstreamApiKey: string, accessToken: string): Record<string, string>;
 export declare function startProxy(opts?: ProxyOptions): Promise<void>;
 export {};

package/dist/proxy.js

@@ -448,11 +448,27 @@ function enrich429(body, headers) {
         return body;
     }
 }
+/**
+ * Build the upstream auth header for the request to api.anthropic.com.
+ * `upstreamApiKey` set → per-token API pool (`x-api-key`); otherwise the
+ * Pro/Max OAuth bearer. Pure + exported for unit testing.
+ */
+export function upstreamAuthHeaders(upstreamApiKey, accessToken) {
+    return upstreamApiKey
+        ? { 'x-api-key': upstreamApiKey }
+        : { 'Authorization': `Bearer ${accessToken}` };
+}
 export async function startProxy(opts = {}) {
     const port = opts.port ?? DEFAULT_PORT;
     const host = opts.host ?? process.env.DARIO_HOST ?? DEFAULT_HOST;
     const verbose = opts.verbose ?? false;
     const passthrough = opts.passthrough ?? false;
+    // Upstream auth override: a per-token API key forwards to the standard API
+    // pool via `x-api-key`, bypassing OAuth/Max + the account pool entirely.
+    // Env-only so the key never lands in `ps`/argv. Default (empty) = OAuth/Max.
+    const upstreamApiKey = (opts.upstreamApiKey ?? process.env.ANTHROPIC_UPSTREAM_API_KEY ?? '').trim();
+    if (upstreamApiKey)
+        console.error('[dario] upstream auth: per-token API key (x-api-key) — OAuth/Max + account pool bypassed');
     // DNS result order — prefer IPv4 for the Anthropic upstream by default.
     // api.anthropic.com publishes both A and AAAA records. In a container with
     // no IPv6 egress (e.g. a default Docker bridge network), Node's `verbatim`
@@ -1218,7 +1234,13 @@ export async function startProxy(opts = {}) {
             // requests, not within a single 429 retry.
             let poolAccount = null;
             let accessToken;
-            if (pool) {
+            if (upstreamApiKey) {
+                // Per-token API-key mode: no OAuth, no pool. `poolAccount` stays null,
+                // so every pool-failover retry below is skipped; the x-api-key is set
+                // on the outbound headers instead of an Authorization bearer.
+                accessToken = '';
+            }
+            else if (pool) {
                 poolAccount = pool.select();
                 if (!poolAccount) {
                     res.writeHead(503, JSON_HEADERS);
@@ -1612,7 +1634,7 @@ export async function startProxy(opts = {}) {
             }
             const headers = {
                 ...staticHeaders,
-                'Authorization': `Bearer ${accessToken}`,
+                ...upstreamAuthHeaders(upstreamApiKey, accessToken),
                 'x-claude-code-session-id': outboundSessionId,
                 'anthropic-version': passthrough ? (req.headers['anthropic-version'] || '2023-06-01') : '2023-06-01',
                 'anthropic-beta': beta,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "4.8.38",
+  "version": "4.8.40",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {