@askalf/dario 4.8.39 → 4.8.41

package/dist/cc-template.d.ts

@@ -323,6 +323,23 @@ export declare function resolveEffort(flag: EffortValue | undefined, clientBody:
  * — never a broken request.
  */
 export declare function supportsAdaptiveThinking(modelId: string): boolean;
+/**
+ * Place CC-style prompt-cache breakpoints on the tools array and the
+ * conversation. The system prompt is already cached at build time (2 system
+ * breakpoints); this adds the last tool + a single rolling breakpoint on the
+ * last message — total 4, the Anthropic max, mirroring Claude Code.
+ *
+ * Why: dario previously cached ONLY the system prompt and stripped every
+ * message breakpoint, so the tools schema (10-20KB) and the entire growing
+ * conversation re-billed as FRESH input every turn. Fleet cache-read ran ~1.9%
+ * vs CC's ~70-90%, draining the Max 5h/7d token window 10-50x faster — which is
+ * exactly why long agentic sessions hit a wall through dario that real CC
+ * sails through. CC genuinely caches tools + conversation, so NOT caching them
+ * was itself a wire divergence from CC. Exported for unit testing.
+ */
+export declare function applyCcPromptCaching(ccRequest: Record<string, unknown>, cacheControl: {
+    type: 'ephemeral';
+}): void;
 export declare function buildCCRequest(clientBody: Record<string, unknown>, billingTag: string, cacheControl: {
     type: 'ephemeral';
 }, identity: {

package/dist/cc-template.js

@@ -1053,6 +1053,49 @@ export function supportsAdaptiveThinking(modelId) {
         return true;
     return false;
 }
+/**
+ * Place CC-style prompt-cache breakpoints on the tools array and the
+ * conversation. The system prompt is already cached at build time (2 system
+ * breakpoints); this adds the last tool + a single rolling breakpoint on the
+ * last message — total 4, the Anthropic max, mirroring Claude Code.
+ *
+ * Why: dario previously cached ONLY the system prompt and stripped every
+ * message breakpoint, so the tools schema (10-20KB) and the entire growing
+ * conversation re-billed as FRESH input every turn. Fleet cache-read ran ~1.9%
+ * vs CC's ~70-90%, draining the Max 5h/7d token window 10-50x faster — which is
+ * exactly why long agentic sessions hit a wall through dario that real CC
+ * sails through. CC genuinely caches tools + conversation, so NOT caching them
+ * was itself a wire divergence from CC. Exported for unit testing.
+ */
+export function applyCcPromptCaching(ccRequest, cacheControl) {
+    // Tools — clone (CC_TOOL_DEFINITIONS is a shared module constant), strip any
+    // stray breakpoints, cache the LAST tool (caches the whole tools prefix).
+    const tools = ccRequest.tools;
+    if (Array.isArray(tools) && tools.length > 0) {
+        const cloned = tools.map((t) => {
+            const copy = { ...t };
+            delete copy.cache_control;
+            return copy;
+        });
+        cloned[cloned.length - 1] = { ...cloned[cloned.length - 1], cache_control: cacheControl };
+        ccRequest.tools = cloned;
+    }
+    // Conversation — cache up to and including the last message so the NEXT turn
+    // reads the whole prefix from cache. Client breakpoints were already stripped
+    // upstream; this is the single rolling breakpoint CC uses.
+    const msgs = ccRequest.messages;
+    if (Array.isArray(msgs) && msgs.length > 0) {
+        const last = msgs[msgs.length - 1];
+        // Only block-array content gets a breakpoint. String content (some SDK
+        // clients) is left untouched — wrapping it would change the wire shape, and
+        // a bare string user turn is tiny anyway, so system+tools caching is the
+        // win. Real CC / agentic sessions use block arrays, which DO get cached.
+        if (Array.isArray(last.content) && last.content.length > 0) {
+            const blocks = last.content;
+            blocks[blocks.length - 1] = { ...blocks[blocks.length - 1], cache_control: cacheControl };
+        }
+    }
+}
 export function buildCCRequest(clientBody, billingTag, cacheControl, identity, opts = {}) {
     const model = clientBody.model || 'claude-sonnet-4-6';
     const isHaiku = model.toLowerCase().includes('haiku');

package/dist/proxy.d.ts

@@ -193,6 +193,17 @@ interface ProxyOptions {
      * Sourced from `--system-prompt=<value>` or DARIO_SYSTEM_PROMPT.
      */
     systemPrompt?: string;
+    /**
+     * Upstream auth override: forward to api.anthropic.com using `x-api-key:
+     * <this>` (the per-token API pool) instead of the Pro/Max OAuth bearer.
+     * When set, OAuth/getAccessToken and the account pool are bypassed entirely
+     * — dario becomes a thin per-token Anthropic proxy. Default (unset) keeps
+     * the subscription-OAuth behavior. Used by the self-hosted compat workflow
+     * so it can route the suite THROUGH dario without tripping the subscription
+     * pool's ~3/min cap. Sourced from ANTHROPIC_UPSTREAM_API_KEY (env-only — never
+     * a CLI flag, so the key never lands in `ps`/argv).
+     */
+    upstreamApiKey?: string;
     /**
      * Overage-guard — halt the proxy on the first response carrying
      * `representative-claim: overage`. Subscribers should never see a
@@ -253,5 +264,11 @@ export declare function authenticateRequest(headers: IncomingMessage['headers'],
  * user's real credential for some other provider. Pure over inputs (dario#97).
  */
 export declare function describeAuthReject(headers: IncomingMessage['headers']): string;
+/**
+ * Build the upstream auth header for the request to api.anthropic.com.
+ * `upstreamApiKey` set → per-token API pool (`x-api-key`); otherwise the
+ * Pro/Max OAuth bearer. Pure + exported for unit testing.
+ */
+export declare function upstreamAuthHeaders(upstreamApiKey: string, accessToken: string): Record<string, string>;
 export declare function startProxy(opts?: ProxyOptions): Promise<void>;
 export {};

package/dist/proxy.js

@@ -7,7 +7,7 @@ import { homedir } from 'node:os';
 import { setDefaultResultOrder } from 'node:dns';
 import { arch, platform } from 'node:process';
 import { getAccessToken, getStatus } from './oauth.js';
-import { buildCCRequest, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, CC_TEMPLATE } from './cc-template.js';
+import { buildCCRequest, applyCcPromptCaching, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, CC_TEMPLATE } from './cc-template.js';
 import { describeTemplate, detectDrift, checkCCCompat } from './live-fingerprint.js';
 import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs } from './pool.js';
 import { Analytics, billingBucketFromClaim } from './analytics.js';
@@ -448,11 +448,27 @@ function enrich429(body, headers) {
         return body;
     }
 }
+/**
+ * Build the upstream auth header for the request to api.anthropic.com.
+ * `upstreamApiKey` set → per-token API pool (`x-api-key`); otherwise the
+ * Pro/Max OAuth bearer. Pure + exported for unit testing.
+ */
+export function upstreamAuthHeaders(upstreamApiKey, accessToken) {
+    return upstreamApiKey
+        ? { 'x-api-key': upstreamApiKey }
+        : { 'Authorization': `Bearer ${accessToken}` };
+}
 export async function startProxy(opts = {}) {
     const port = opts.port ?? DEFAULT_PORT;
     const host = opts.host ?? process.env.DARIO_HOST ?? DEFAULT_HOST;
     const verbose = opts.verbose ?? false;
     const passthrough = opts.passthrough ?? false;
+    // Upstream auth override: a per-token API key forwards to the standard API
+    // pool via `x-api-key`, bypassing OAuth/Max + the account pool entirely.
+    // Env-only so the key never lands in `ps`/argv. Default (empty) = OAuth/Max.
+    const upstreamApiKey = (opts.upstreamApiKey ?? process.env.ANTHROPIC_UPSTREAM_API_KEY ?? '').trim();
+    if (upstreamApiKey)
+        console.error('[dario] upstream auth: per-token API key (x-api-key) — OAuth/Max + account pool bypassed');
     // DNS result order — prefer IPv4 for the Anthropic upstream by default.
     // api.anthropic.com publishes both A and AAAA records. In a container with
     // no IPv6 egress (e.g. a default Docker bridge network), Node's `verbatim`
@@ -1218,7 +1234,13 @@ export async function startProxy(opts = {}) {
             // requests, not within a single 429 retry.
             let poolAccount = null;
             let accessToken;
-            if (pool) {
+            if (upstreamApiKey) {
+                // Per-token API-key mode: no OAuth, no pool. `poolAccount` stays null,
+                // so every pool-failover retry below is skipped; the x-api-key is set
+                // on the outbound headers instead of an Authorization bearer.
+                accessToken = '';
+            }
+            else if (pool) {
                 poolAccount = pool.select();
                 if (!poolAccount) {
                     res.writeHead(503, JSON_HEADERS);
@@ -1445,6 +1467,15 @@ export async function startProxy(opts = {}) {
                             skipFields,
                             honorClientThinking: opts.honorClientThinking ?? false,
                         });
+                        // Prompt-cache the tools + conversation prefix (the system prompt
+                        // is already cached in ccBody's system blocks). Mirrors CC's cache
+                        // breakpoints so a long session doesn't re-bill them as fresh input
+                        // every turn and burn the Max 5h/7d window — the cause of the
+                        // "sessions wall in minutes through dario but not CC" report.
+                        // Opt-out: DARIO_SKIP_FIELDS=prompt_cache.
+                        if (!skipFields?.has('prompt_cache')) {
+                            applyCcPromptCaching(ccBody, CACHE_EPHEMERAL);
+                        }
                         detectedClientForLog = detectedClient;
                         preserveToolsEffective = Boolean(opts.preserveTools)
                             || (Boolean(detectedClient) && !opts.hybridTools && !opts.mergeTools);
@@ -1612,7 +1643,7 @@ export async function startProxy(opts = {}) {
             }
             const headers = {
                 ...staticHeaders,
-                'Authorization': `Bearer ${accessToken}`,
+                ...upstreamAuthHeaders(upstreamApiKey, accessToken),
                 'x-claude-code-session-id': outboundSessionId,
                 'anthropic-version': passthrough ? (req.headers['anthropic-version'] || '2023-06-01') : '2023-06-01',
                 'anthropic-beta': beta,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "4.8.39",
+  "version": "4.8.41",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {