@askalf/dario 4.8.73 → 4.8.74

package/dist/health-response.d.ts

@@ -0,0 +1,28 @@
+/**
+ * /health response builder — extracted so the public-vs-internal disclosure rule
+ * is unit-testable without spinning a proxy.
+ *
+ * dario's /health is auth-free (docker healthchecks + `depends_on: service_healthy`
+ * need it before any secret is configured). When dario sits behind a Cloudflare
+ * tunnel with a public /health bypass (uptime monitoring), that endpoint is
+ * world-readable — so it must not leak OAuth internals (token countdown, request
+ * volume, refresh errors). The Cloudflare edge stamps `cf-ray` on every request it
+ * proxies, so its presence marks a request as having come from the public internet.
+ * Internal callers (the docker healthcheck, `dario doctor`, the self-probe) hit
+ * dario directly on loopback with no CF headers and still get the full detail.
+ *
+ * The HTTP status (200 healthy / 503 degraded) is identical either way, so external
+ * uptime monitoring that keys on the status code is unaffected.
+ */
+export interface HealthStatusLike {
+    status: string;
+    canRefresh?: boolean;
+    expiresIn?: string;
+    refreshFailures?: number;
+    lastRefreshError?: string;
+}
+export interface HealthResponse {
+    httpStatus: number;
+    body: Record<string, unknown>;
+}
+export declare function buildHealthResponse(s: HealthStatusLike, requestCount: number, viaPublicTunnel: boolean): HealthResponse;

package/dist/health-response.js

@@ -0,0 +1,34 @@
+/**
+ * /health response builder — extracted so the public-vs-internal disclosure rule
+ * is unit-testable without spinning a proxy.
+ *
+ * dario's /health is auth-free (docker healthchecks + `depends_on: service_healthy`
+ * need it before any secret is configured). When dario sits behind a Cloudflare
+ * tunnel with a public /health bypass (uptime monitoring), that endpoint is
+ * world-readable — so it must not leak OAuth internals (token countdown, request
+ * volume, refresh errors). The Cloudflare edge stamps `cf-ray` on every request it
+ * proxies, so its presence marks a request as having come from the public internet.
+ * Internal callers (the docker healthcheck, `dario doctor`, the self-probe) hit
+ * dario directly on loopback with no CF headers and still get the full detail.
+ *
+ * The HTTP status (200 healthy / 503 degraded) is identical either way, so external
+ * uptime monitoring that keys on the status code is unaffected.
+ */
+export function buildHealthResponse(s, requestCount, viaPublicTunnel) {
+    const dead = s.status === 'broken' ||
+        s.status === 'none' ||
+        (s.status === 'expired' && s.canRefresh === false);
+    const httpStatus = dead ? 503 : 200;
+    const liveness = { status: dead ? 'degraded' : 'ok' };
+    const body = viaPublicTunnel
+        ? liveness
+        : {
+            ...liveness,
+            oauth: s.status,
+            expiresIn: s.expiresIn,
+            requests: requestCount,
+            ...(s.refreshFailures ? { refreshFailures: s.refreshFailures } : {}),
+            ...(s.lastRefreshError ? { lastRefreshError: s.lastRefreshError } : {}),
+        };
+    return { httpStatus, body };
+}

package/dist/proxy.js

@@ -7,6 +7,7 @@ import { homedir } from 'node:os';
 import { setDefaultResultOrder } from 'node:dns';
 import { arch, platform } from 'node:process';
 import { getAccessToken, getStatus } from './oauth.js';
+import { buildHealthResponse } from './health-response.js';
 import { buildCCRequest, applyCcPromptCaching, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, CC_TEMPLATE } from './cc-template.js';
 import { describeTemplate, detectDrift, checkCCCompat } from './live-fingerprint.js';
 import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs } from './pool.js';
@@ -1110,18 +1111,12 @@ export async function startProxy(opts = {}) {
         // react instead of cheerfully passing while every /v1/messages 401s.
         if (urlPath === '/health' || urlPath === '/') {
             const s = await getStatus();
-            const dead = s.status === 'broken' || s.status === 'none' ||
-                (s.status === 'expired' && s.canRefresh === false);
-            const httpStatus = dead ? 503 : 200;
+            // Public requests arrive through the Cloudflare tunnel (the edge stamps
+            // `cf-ray`); they get only the liveness verdict, never the OAuth internals.
+            // See buildHealthResponse for the full rationale.
+            const { httpStatus, body } = buildHealthResponse(s, requestCount, req.headers['cf-ray'] !== undefined);
             res.writeHead(httpStatus, JSON_HEADERS);
-            res.end(JSON.stringify({
-                status: dead ? 'degraded' : 'ok',
-                oauth: s.status,
-                expiresIn: s.expiresIn,
-                requests: requestCount,
-                ...(s.refreshFailures ? { refreshFailures: s.refreshFailures } : {}),
-                ...(s.lastRefreshError ? { lastRefreshError: s.lastRefreshError } : {}),
-            }));
+            res.end(JSON.stringify(body));
             return;
         }
         if (!checkAuth(req)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "4.8.73",
+  "version": "4.8.74",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {