@askalf/dario 5.4.0 → 5.4.1

package/dist/cc-template-data.json

@@ -1430,9 +1430,7 @@
   "header_values": {
     "accept": "application/json",
     "user-agent": "claude-cli/2.1.220 (external, sdk-cli)",
-    "x-stainless-arch": "x64",
     "x-stainless-lang": "js",
-    "x-stainless-os": "Windows",
     "x-stainless-package-version": "0.94.0",
     "x-stainless-retry-count": "0",
     "x-stainless-runtime": "node",

package/dist/cc-template.d.ts

@@ -170,6 +170,15 @@ export declare const CC_AGENT_IDENTITY: string;
  */
 export declare const CLIENT_SYSTEM_PREFACE: string;
 export declare function resolveSystemPrompt(arg: string | undefined, model?: string): string;
+/**
+ * Overlay a captured template's `header_values` onto the outbound header record,
+ * skipping the keys that must never be replayed.
+ *
+ * Extracted as a pure function (like `orderHeadersForOutbound`) so the skip
+ * behaviour is unit-testable without spinning up the proxy. Mutates and returns
+ * `headers` for call-site convenience.
+ */
+export declare function overlayTemplateHeaderValues(headers: Record<string, string>, headerValues: Record<string, string> | undefined): Record<string, string>;
 /**
  * Apply the live template's captured header_order to an outbound header
  * record. Returns a HeadersInit in one of two forms:

package/dist/cc-template.js

@@ -267,6 +267,45 @@ function stripBehavioralConstraints(input, level) {
     }
     return s;
 }
+/**
+ * Header-value keys from a captured template that must NEVER be replayed onto an
+ * outbound request, even though they are stored in `header_values`.
+ *
+ * - `x-api-key` is a capture artifact: the fingerprint spawn sets
+ *   ANTHROPIC_API_KEY=sk-dario-fingerprint-capture, and replaying that
+ *   placeholder alongside a real OAuth Bearer 401s on some tiers (dario#42).
+ * - `x-stainless-os` / `x-stainless-arch` describe the machine that ran the
+ *   CAPTURE, not CC's wire shape. The proxy already computes both correctly for
+ *   the current process; overlaying the captured values made a Linux host
+ *   announce `x-stainless-os: Windows` off a Windows-baked bundle (dario#854).
+ *
+ * `extractStaticHeaderValues` (live-fingerprint.ts) also refuses to STORE these,
+ * so new captures are clean. This skip list is what makes every ALREADY-baked
+ * template and warm cache self-heal without waiting for a re-bake.
+ */
+const NEVER_REPLAY_HEADER_VALUES = new Set([
+    'x-api-key',
+    'x-stainless-os',
+    'x-stainless-arch',
+]);
+/**
+ * Overlay a captured template's `header_values` onto the outbound header record,
+ * skipping the keys that must never be replayed.
+ *
+ * Extracted as a pure function (like `orderHeadersForOutbound`) so the skip
+ * behaviour is unit-testable without spinning up the proxy. Mutates and returns
+ * `headers` for call-site convenience.
+ */
+export function overlayTemplateHeaderValues(headers, headerValues) {
+    if (!headerValues)
+        return headers;
+    for (const [k, v] of Object.entries(headerValues)) {
+        if (NEVER_REPLAY_HEADER_VALUES.has(k.toLowerCase()))
+            continue;
+        headers[k] = v;
+    }
+    return headers;
+}
 /**
  * Apply the live template's captured header_order to an outbound header
  * record. Returns a HeadersInit in one of two forms:

package/dist/live-fingerprint.js

@@ -692,6 +692,23 @@ const STATIC_HEADER_EXCLUDE = new Set([
     'anthropic-beta',
     // Billing tag — rebuilt per request from cc_version
     'x-anthropic-billing-header',
+    // HOST-SPECIFIC (dario#854 fallout). These describe the machine that ran the
+    // capture, not CC's wire shape, so replaying them makes every consumer of a
+    // baked template announce the BAKE host's platform instead of its own. The
+    // proxy already computes both correctly per-process (OS_NAME / arch), and the
+    // overlay used to clobber those with the captured values.
+    //
+    // Found 2026-07-25: the bundled template had been baked on Windows for
+    // several releases (#820/#828/#840/#849/#851 -> x-stainless-os: Windows,
+    // 30 tools incl. PowerShell), while cc-drift-template-watch runs its live
+    // capture every 30 min on the Linux Hetzner runner. So the Linux box served
+    // `x-stainless-os: Windows`, and the watch saw permanent drift against a
+    // bundle it could never match -- auto-rebaking to Linux (#852), which the next
+    // Windows-side bake (#854) would flip straight back. Excluding these ends
+    // both the fidelity bug and the rebake ping-pong: the bake host stops
+    // mattering for these keys.
+    'x-stainless-os',
+    'x-stainless-arch',
 ]);
 function extractStaticHeaderValues(headers) {
     const out = {};

package/dist/proxy.js

@@ -9,7 +9,7 @@ import { arch, platform } from 'node:process';
 import { getAccessToken, getStatus } from './oauth.js';
 import { buildHealthResponse, derivePoolStatus, shouldDiscloseHealthInternals } from './health-response.js';
 import { darioVersion } from './version.js';
-import { buildCCRequest, applyCcPromptCaching, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, isMcpToolName, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
+import { buildCCRequest, applyCcPromptCaching, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, isMcpToolName, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
 import { stampCch, hasCchSeed } from './cch.js';
 import { describeTemplate, detectDrift, checkCCCompat } from './live-fingerprint.js';
 import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, reconcilePoolAccounts, resolvePoolStrategy } from './pool.js';
@@ -1393,12 +1393,18 @@ export async function startProxy(opts = {}) {
     // "invalid x-api-key" 401 on some account tiers as of 2026-04-17 (dario#42).
     // The capture filter was updated in v3.19.2 to stop storing it, but the
     // per-request skip below lets existing caches self-heal without a refresh.
-    if (!passthrough && CC_TEMPLATE.header_values) {
-        for (const [k, v] of Object.entries(CC_TEMPLATE.header_values)) {
-            if (k.toLowerCase() === 'x-api-key')
-                continue;
-            staticHeaders[k] = v;
-        }
+    // `x-stainless-os` / `x-stainless-arch` are skipped for the same
+    // self-healing reason: they describe the machine that ran the CAPTURE, not
+    // CC's wire shape. Overlaying them made a Linux box announce
+    // `x-stainless-os: Windows` off a Windows-baked bundle (dario#854), so the
+    // runtime values set above — OS_NAME and arch, correct for THIS process —
+    // must win. The capture filter stops storing them going forward; this skip
+    // keeps every already-baked template and warm cache honest immediately.
+    //
+    // The skip list lives with the overlay in cc-template.ts so it is unit-testable
+    // without standing up the proxy (same reason orderHeadersForOutbound is pure).
+    if (!passthrough) {
+        overlayTemplateHeaderValues(staticHeaders, CC_TEMPLATE.header_values);
     }
     let requestCount = 0;
     const queue = new RequestQueue({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "5.4.0",
+  "version": "5.4.1",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {