@askalf/dario 5.4.10 → 5.4.11

package/dist/scrub-template.d.ts

@@ -42,8 +42,14 @@ export declare function scrubTemplate(data: TemplateData): TemplateData;
  */
 export declare function scrubText(text: string): string;
 /**
- * Run over a string and report any user-identifying patterns that remain.
- * Used by `scripts/check-cc-drift.mjs` to verify the baked template
- * passes scrubbing before a release goes out.
+ * Run over a string and report anything that must not survive into a bake:
+ * user-identifying paths, host-context sections the strip missed, and
+ * instruction-file prose (dario#872). Despite the name the contract has never
+ * been paths-only. Used by `scripts/check-cc-drift.mjs` to gate a release and
+ * by `scripts/capture-and-bake.mjs` to fail a bake.
+ *
+ * Deliberately NOT called from `extractTemplate`: that serves the live-capture
+ * path too, and the live fingerprint keeps host context on purpose — it exists
+ * to replay the operator's own CC install faithfully. Only the bake publishes.
  */
 export declare function findUserPathHits(text: string): string[];

package/dist/scrub-template.js

@@ -222,9 +222,44 @@ function scrubObjectStrings(value) {
     return value;
 }
 /**
- * Run over a string and report any user-identifying patterns that remain.
- * Used by `scripts/check-cc-drift.mjs` to verify the baked template
- * passes scrubbing before a release goes out.
+ * Prose CC emits when it injects user- or project-level instruction files
+ * (CLAUDE.md, memory, environment) into a prompt. The section strip above is
+ * keyed on the `# claudeMd` heading shape; these are keyed on the wrapper text
+ * itself, so a reshaped or renamed heading still gets caught.
+ *
+ * Both halves are load-bearing. `removeSection` and the heading detector in
+ * findUserPathHits read the SAME heading list, so a heading CC renames strips
+ * nothing and flags nothing — two silent failures — and once paths are scrubbed
+ * the leftover prose carries no user path for the other detectors to catch.
+ * dario#872 saw one capture in six come back carrying another session's
+ * instruction text; this is the half that does not depend on the heading.
+ *
+ * Every marker is verified absent from the real baked template — base, fable,
+ * opus-5 and sonnet-5 prompts plus every tool description. Do NOT add bare
+ * `CLAUDE.md` or `system-reminder`: CC's own system prompt and tool
+ * descriptions both mention them, so either would fail every bake. Verified,
+ * not assumed, and test/context-bleed.mjs pins it.
+ */
+const INSTRUCTION_INJECTION_MARKERS = [
+    { label: 'instruction-file wrapper', re: /Codebase and user instructions are shown below/ },
+    { label: 'instruction-file wrapper', re: /IMPORTANT: These instructions OVERRIDE any default behavior/ },
+    // Straight and typographic apostrophe both — CC emits the straight one today,
+    // and a marker that a quote-style change silently disarms is not a guard.
+    { label: 'instruction-file annotation', re: /user['’]s private global instructions/ },
+    { label: 'memory-file annotation', re: /auto-memory, persists across conversations/ },
+    { label: 'instruction-file heading', re: /\bContents of [^\n]{1,300}\.md\b/ },
+    { label: 'project-instruction wrapper', re: /Here are useful instructions from/ },
+];
+/**
+ * Run over a string and report anything that must not survive into a bake:
+ * user-identifying paths, host-context sections the strip missed, and
+ * instruction-file prose (dario#872). Despite the name the contract has never
+ * been paths-only. Used by `scripts/check-cc-drift.mjs` to gate a release and
+ * by `scripts/capture-and-bake.mjs` to fail a bake.
+ *
+ * Deliberately NOT called from `extractTemplate`: that serves the live-capture
+ * path too, and the live fingerprint keeps host context on purpose — it exists
+ * to replay the operator's own CC install faithfully. Only the bake publishes.
  */
 export function findUserPathHits(text) {
     const hits = [];
@@ -249,5 +284,13 @@ export function findUserPathHits(text) {
             hits.push(`# ${name} (host-context section not stripped)`);
         }
     }
+    // Instruction-file prose, matched on the wrapper rather than the heading.
+    // Excerpt is bounded: a hit is printed by the bake, and the whole point is
+    // that the matched text may be somebody's private instructions.
+    for (const { label, re } of INSTRUCTION_INJECTION_MARKERS) {
+        const m = text.match(re);
+        if (m)
+            hits.push(`${m[0].slice(0, 60)} (${label} not stripped)`);
+    }
     return hits;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "5.4.10",
+  "version": "5.4.11",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {
@@ -22,7 +22,7 @@
   "scripts": {
     "build": "tsc && cp src/cc-template-data.json dist/",
     "test": "node --test --test-concurrency=8 test/all.test.mjs",
-    "test:serial": "node test/issue-29-tool-translation.mjs && node test/hybrid-tools.mjs && node test/tool-schema-contract.mjs && node test/scrub-paths.mjs && node test/provider-prefix.mjs && node test/analytics-recording.mjs && node test/analytics-billing-bucket.mjs && node test/failover-429.mjs && node test/pool-sticky.mjs && node test/live-fingerprint.mjs && node test/proxy-header-order.mjs && node test/proxy-body-order.mjs && node test/runtime-fingerprint.mjs && node test/pacing.mjs && node test/stream-drain.mjs && node test/subagent.mjs && node test/mcp-protocol.mjs && node test/mcp-tools.mjs && node test/mcp-e2e.mjs && node test/session-rotation.mjs && node test/drift-detection.mjs && node test/cc-authorize-probe-classifier.mjs && node test/compat-range.mjs && node test/doctor-formatter.mjs && node test/doctor-identity-drift.mjs && node test/atomic-write.mjs && node test/account-refresh-singleflight.mjs && node test/durable-token-persist.mjs && node test/streaming-edge-cases.mjs && node test/client-detection.mjs && node test/manual-oauth-flow.mjs && node test/scrub-template.mjs && node test/sanitize-messages.mjs && node test/platform-tools.mjs && node test/strict-template-flags.mjs && node test/request-queue.mjs && node test/effort-flag.mjs && node test/template-invariants.mjs",
+    "test:serial": "node test/issue-29-tool-translation.mjs && node test/hybrid-tools.mjs && node test/tool-schema-contract.mjs && node test/scrub-paths.mjs && node test/provider-prefix.mjs && node test/analytics-recording.mjs && node test/analytics-billing-bucket.mjs && node test/failover-429.mjs && node test/pool-sticky.mjs && node test/live-fingerprint.mjs && node test/proxy-header-order.mjs && node test/proxy-body-order.mjs && node test/runtime-fingerprint.mjs && node test/pacing.mjs && node test/stream-drain.mjs && node test/subagent.mjs && node test/mcp-protocol.mjs && node test/mcp-tools.mjs && node test/mcp-e2e.mjs && node test/session-rotation.mjs && node test/drift-detection.mjs && node test/cc-authorize-probe-classifier.mjs && node test/compat-range.mjs && node test/doctor-formatter.mjs && node test/doctor-identity-drift.mjs && node test/atomic-write.mjs && node test/account-refresh-singleflight.mjs && node test/durable-token-persist.mjs && node test/streaming-edge-cases.mjs && node test/client-detection.mjs && node test/manual-oauth-flow.mjs && node test/scrub-template.mjs && node test/context-bleed.mjs && node test/sanitize-messages.mjs && node test/platform-tools.mjs && node test/strict-template-flags.mjs && node test/request-queue.mjs && node test/effort-flag.mjs && node test/template-invariants.mjs",
     "audit": "npm audit --production --audit-level=high",
     "prepublishOnly": "npm run build",
     "start": "node dist/cli.js",