@askalf/dario 5.2.11 → 5.2.12

package/dist/cli.js

@@ -1287,13 +1287,15 @@ async function help() {
                              intact even when a text-tool client is
                              detected; use --preserve-tools per session
                              when edits are needed. (dario#40)
-    --strict-tls             Refuse to start proxy mode if this process
-                             isn't running under Bun. Bun is what Claude
-                             Code uses; matching its TLS stack keeps the
+    --strict-tls             Refuse to start proxy mode unless this process
+                             runs under Bun at a version whose JA3 is verified
+                             to match Claude Code (≥ v1.3.14). Bun is what
+                             Claude Code uses; matching its TLS stack keeps the
                              proxy's JA3/JA4 ClientHello indistinguishable
-                             from a stock CC request. Install Bun
-                             (https://bun.sh) so dario auto-relaunches
-                             under it. (v3.23)
+                             from a stock CC request — but an older Bun ships an
+                             older BoringSSL whose ClientHello diverges (#813).
+                             Install/upgrade Bun (https://bun.sh) so dario
+                             auto-relaunches under it. (v3.23)
     --stealth                Single-flag behavioral-stealth preset.
                              Flips pace-jitter, think-time, and
                              session-start defaults from 0 to non-zero

package/dist/live-fingerprint.d.ts

@@ -282,7 +282,7 @@ export declare function _resetInstalledVersionProbeForTest(): void;
  */
 export declare const SUPPORTED_CC_RANGE: {
     readonly min: "1.0.0";
-    readonly maxTested: "2.1.214";
+    readonly maxTested: "2.1.215";
 };
 /**
  * Compare two dotted-numeric version strings. Returns negative if `a<b`,

package/dist/live-fingerprint.js

@@ -806,7 +806,7 @@ export function _resetInstalledVersionProbeForTest() {
  */
 export const SUPPORTED_CC_RANGE = {
     min: '1.0.0',
-    maxTested: '2.1.214',
+    maxTested: '2.1.215',
 };
 /**
  * Compare two dotted-numeric version strings. Returns negative if `a<b`,

package/dist/proxy.js

@@ -1638,6 +1638,19 @@ export async function startProxy(opts = {}) {
         }
         // Strip query parameters for endpoint matching
         const urlPath = req.url?.split('?')[0] ?? '';
+        // Liveness probe — always 200 while the HTTP server is accepting requests,
+        // deliberately decoupled from OAuth state. Docker's healthcheck (and the
+        // autoheal watchdog that keys on it) points HERE, not /health: a broken or
+        // expired refresh token makes /health return 503, but a container restart
+        // cannot mint a new token, so restarting on that is a pointless loop (one
+        // shared-refresh-family outage thrashed dario for 4h+ this way). Readiness —
+        // the 503-on-broken-OAuth verdict that uptime monitors and
+        // `depends_on: service_healthy` need — stays on /health.
+        if (urlPath === '/livez') {
+            res.writeHead(200, JSON_HEADERS);
+            res.end(JSON.stringify({ status: 'ok' }));
+            return;
+        }
         // Health check
         //
         // Returns HTTP 503 when OAuth is in a state that will cause every upstream

package/dist/runtime-fingerprint.d.ts

@@ -25,8 +25,16 @@
  */
 /** Canonical buckets the caller pivots on. */
 export type RuntimeFingerprintStatus = 
-/** Running under Bun — TLS stack matches CC. */
+/** Running under Bun ≥ the JA3-verified floor — TLS ClientHello matches CC. */
 'bun-match'
+/**
+ * Running under Bun, but at a version below the JA3-verified floor: being on
+ * Bun is necessary but not sufficient. Older Bun ships an older BoringSSL
+ * whose ClientHello is not confirmed to match CC's (measured divergent on
+ * Bun 1.0.9 — see #813). Treated as a warn so an old Bun on PATH can't
+ * report a false-green match while emitting a divergent JA3.
+ */
+ | 'bun-ja3-unverified'
 /** Running under Node, Bun available on PATH but auto-relaunch was bypassed. */
  | 'bun-bypassed'
 /** Running under Node, Bun not installed. */
@@ -54,6 +62,24 @@ export interface RuntimeFingerprint {
  * the (~sub-100ms) cost when Bun is installed.
  */
 export declare function probeBunVersion(): string | undefined;
+/**
+ * Lowest public Bun version whose TLS ClientHello (JA3) is *measured* to match
+ * the Bun/BoringSSL fingerprint Claude Code presents on the wire. Empirical
+ * basis (#813, macOS arm64): CC 2.1.214 embeds the Bun canary line and hashes
+ * to JA3 `e97f5146a7009cc2918b50e903b6ff8d`; bare public Bun 1.3.14 and canary
+ * reproduce it byte-for-byte, while Bun 1.0.9 diverges (adds 3DES, ECH,
+ * padding → `2ae7eb4b…`). The window between 1.0.9 and 1.3.14 is unmeasured,
+ * so anything below this floor is reported unverified rather than a green match.
+ */
+export declare const JA3_VERIFIED_BUN_FLOOR = "1.3.14";
+/**
+ * True when Bun `version` is at or above `floor`. Parses the leading
+ * `major.minor.patch` and ignores any pre-release/`-canary…` suffix, so Bun's
+ * canary tags (e.g. `1.4.0-canary.x`) compare as their base triple. Returns
+ * `undefined` when either string can't be parsed — the caller decides how to
+ * treat "can't tell" (we keep those as a best-effort match rather than warn).
+ */
+export declare function bunVersionMeetsJa3Floor(version: string, floor?: string): boolean | undefined;
 /**
  * Synthesize the TLS-fingerprint status from three inputs. All three are
  * passed explicitly so tests can cover every combination without touching

package/dist/runtime-fingerprint.js

@@ -51,6 +51,38 @@ export function probeBunVersion() {
         return undefined;
     }
 }
+/**
+ * Lowest public Bun version whose TLS ClientHello (JA3) is *measured* to match
+ * the Bun/BoringSSL fingerprint Claude Code presents on the wire. Empirical
+ * basis (#813, macOS arm64): CC 2.1.214 embeds the Bun canary line and hashes
+ * to JA3 `e97f5146a7009cc2918b50e903b6ff8d`; bare public Bun 1.3.14 and canary
+ * reproduce it byte-for-byte, while Bun 1.0.9 diverges (adds 3DES, ECH,
+ * padding → `2ae7eb4b…`). The window between 1.0.9 and 1.3.14 is unmeasured,
+ * so anything below this floor is reported unverified rather than a green match.
+ */
+export const JA3_VERIFIED_BUN_FLOOR = '1.3.14';
+/**
+ * True when Bun `version` is at or above `floor`. Parses the leading
+ * `major.minor.patch` and ignores any pre-release/`-canary…` suffix, so Bun's
+ * canary tags (e.g. `1.4.0-canary.x`) compare as their base triple. Returns
+ * `undefined` when either string can't be parsed — the caller decides how to
+ * treat "can't tell" (we keep those as a best-effort match rather than warn).
+ */
+export function bunVersionMeetsJa3Floor(version, floor = JA3_VERIFIED_BUN_FLOOR) {
+    const parse = (v) => {
+        const m = /^(\d+)\.(\d+)\.(\d+)/.exec(v.trim());
+        return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : undefined;
+    };
+    const a = parse(version);
+    const b = parse(floor);
+    if (!a || !b)
+        return undefined;
+    for (let i = 0; i < 3; i++) {
+        if (a[i] !== b[i])
+            return a[i] > b[i];
+    }
+    return true; // equal versions meet the floor
+}
 /**
  * Synthesize the TLS-fingerprint status from three inputs. All three are
  * passed explicitly so tests can cover every combination without touching
@@ -65,6 +97,21 @@ export function classifyRuntimeFingerprint(runningUnderBun, availableBunVersion,
         // is readable; we don't require a separate probe. The caller passes the
         // resolved version string as `availableBunVersion` in the bun case.
         const bunVer = availableBunVersion ?? 'unknown';
+        // Being on Bun is necessary but NOT sufficient: only Bun ≥ the JA3-verified
+        // floor is measured to reproduce CC's ClientHello (#813). A readable version
+        // below the floor is the false-green case — dario auto-relaunches into an
+        // old Bun on PATH and would otherwise report a match while emitting a
+        // divergent JA3. An unreadable version (rare; Bun almost always exposes
+        // .version) has nothing to check, so we leave it as a best-effort match.
+        if (bunVer !== 'unknown' && bunVersionMeetsJa3Floor(bunVer) === false) {
+            return {
+                status: 'bun-ja3-unverified',
+                runtime: 'bun',
+                runtimeVersion: bunVer,
+                detail: `Bun v${bunVer} — under Bun, but its TLS ClientHello (JA3) is not verified to match Claude Code (known-good ≥ v${JA3_VERIFIED_BUN_FLOOR})`,
+                hint: `Upgrade Bun to ≥ v${JA3_VERIFIED_BUN_FLOOR} (https://bun.sh); older Bun ships an older BoringSSL whose ClientHello diverges from Claude Code's.`,
+            };
+        }
         return {
             status: 'bun-match',
             runtime: 'bun',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "5.2.11",
+  "version": "5.2.12",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {