@askalf/dario 5.4.10 → 5.4.12

package/dist/live-fingerprint.d.ts

@@ -239,6 +239,35 @@ interface CapturedRequest {
     rawHeaders: string[];
     body: Record<string, unknown>;
 }
+/**
+ * Does this request belong to the capture we started?
+ *
+ * The MITM used to accept the FIRST request whose URL contained
+ * `/v1/messages` with nothing tying it to the child we spawned (dario#872).
+ * The port is ephemeral, so a collision is improbable rather than
+ * impossible, and nothing downstream could tell a foreign request from the
+ * child's once it was captured.
+ *
+ * The nonce rides in the URL path because that is the one channel we fully
+ * control without touching what CC sends. Two measurements decided it over a
+ * key-borne nonce:
+ *
+ *   1. CC honours a path segment in ANTHROPIC_BASE_URL — given
+ *      `http://127.0.0.1:PORT/<nonce>` it requests
+ *      `/<nonce>/v1/messages?beta=true` (and probes `/<nonce>/api/hello`
+ *      first, which still 404s here).
+ *   2. On a subscription install CC authenticates with
+ *      `authorization: Bearer sk-ant-…`, so ANTHROPIC_API_KEY is not the auth
+ *      header at all. A key-borne nonce would do nothing on OAuth installs
+ *      while changing the auth path for API-key ones — and changing what the
+ *      child authenticates with can change what it sends, which is the whole
+ *      thing a fingerprint capture must not do.
+ *
+ * Fails closed: no nonce, no capture. A miss makes the capture return null
+ * and the bake exit non-zero, which is the correct outcome for a request we
+ * cannot attribute.
+ */
+export declare function isOwnCaptureRequest(url: string | undefined, nonce: string): boolean;
 /**
  * Run a loopback MITM server on a random port, spawn CC with
  * ANTHROPIC_BASE_URL pointed at it, wait for one request, respond with a

package/dist/live-fingerprint.js

@@ -85,6 +85,7 @@
  * the right piece without re-deriving the threat model.
  */
 import { spawn, execFileSync } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
 import { createServer } from 'node:http';
 import { readFileSync, writeFileSync, mkdirSync, existsSync, renameSync, unlinkSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -363,6 +364,41 @@ export function _atomicWriteJsonForTest(targetPath, data) {
 function writeLiveCache(data) {
     atomicWriteJson(liveCachePath(), data);
 }
+/**
+ * Does this request belong to the capture we started?
+ *
+ * The MITM used to accept the FIRST request whose URL contained
+ * `/v1/messages` with nothing tying it to the child we spawned (dario#872).
+ * The port is ephemeral, so a collision is improbable rather than
+ * impossible, and nothing downstream could tell a foreign request from the
+ * child's once it was captured.
+ *
+ * The nonce rides in the URL path because that is the one channel we fully
+ * control without touching what CC sends. Two measurements decided it over a
+ * key-borne nonce:
+ *
+ *   1. CC honours a path segment in ANTHROPIC_BASE_URL — given
+ *      `http://127.0.0.1:PORT/<nonce>` it requests
+ *      `/<nonce>/v1/messages?beta=true` (and probes `/<nonce>/api/hello`
+ *      first, which still 404s here).
+ *   2. On a subscription install CC authenticates with
+ *      `authorization: Bearer sk-ant-…`, so ANTHROPIC_API_KEY is not the auth
+ *      header at all. A key-borne nonce would do nothing on OAuth installs
+ *      while changing the auth path for API-key ones — and changing what the
+ *      child authenticates with can change what it sends, which is the whole
+ *      thing a fingerprint capture must not do.
+ *
+ * Fails closed: no nonce, no capture. A miss makes the capture return null
+ * and the bake exit non-zero, which is the correct outcome for a request we
+ * cannot attribute.
+ */
+export function isOwnCaptureRequest(url, nonce) {
+    if (!url || nonce.length === 0)
+        return false;
+    if (!url.startsWith(`/${nonce}/`))
+        return false;
+    return url.includes('/v1/messages');
+}
 /**
  * Run a loopback MITM server on a random port, spawn CC with
  * ANTHROPIC_BASE_URL pointed at it, wait for one request, respond with a
@@ -377,9 +413,11 @@ export async function captureLiveTemplateAsync(timeoutMs = 10_000) {
     return extractTemplate(captured);
 }
 async function runCapture(timeoutMs) {
+    const nonce = `dario-capture-${randomBytes(12).toString('hex')}`;
     return new Promise((resolve) => {
         let captured = null;
         let settled = false;
+        let foreign = 0;
         const settle = (result) => {
             if (settled)
                 return;
@@ -395,9 +433,17 @@ async function runCapture(timeoutMs) {
             resolve(result);
         };
         const server = createServer((req, res) => {
-            // Only handle /v1/messages — everything else gets a 404 so CC doesn't
-            // accidentally think /v1/models is live.
-            if (!req.url?.includes('/v1/messages')) {
+            // Only handle OUR /v1/messages — everything else gets a 404 so CC
+            // doesn't accidentally think /v1/models is live, and so a request we
+            // cannot attribute to the spawned child is never captured (dario#872).
+            if (!isOwnCaptureRequest(req.url, nonce)) {
+                // A /v1/messages without our nonce is exactly the case #872 is about:
+                // something else reached this port. Say so — a silent 404 here is how
+                // a foreign capture would have gone unnoticed.
+                if (req.url?.includes('/v1/messages')) {
+                    foreign++;
+                    console.error(`[dario] capture: rejected a /v1/messages request that did not carry this capture's nonce (${foreign} so far) — see dario#872`);
+                }
                 res.writeHead(404, { 'content-type': 'application/json' });
                 res.end('{"type":"error","error":{"type":"not_found_error","message":"not found"}}');
                 return;
@@ -417,7 +463,7 @@ async function runCapture(timeoutMs) {
                     }
                     captured = {
                         method: req.method ?? 'POST',
-                        path: req.url ?? '/v1/messages',
+                        path: (req.url ?? '/v1/messages').replace(`/${nonce}`, ''),
                         headers,
                         rawHeaders: Array.isArray(req.rawHeaders) ? [...req.rawHeaders] : [],
                         body,
@@ -481,7 +527,7 @@ async function runCapture(timeoutMs) {
                 settle(null);
                 return;
             }
-            const url = `http://127.0.0.1:${address.port}`;
+            const url = `http://127.0.0.1:${address.port}/${nonce}`;
             // Spawn CC with ANTHROPIC_BASE_URL pointed at our MITM.
             const claudeBin = findClaudeBinary();
             if (!claudeBin) {

package/dist/scrub-template.d.ts

@@ -42,8 +42,14 @@ export declare function scrubTemplate(data: TemplateData): TemplateData;
  */
 export declare function scrubText(text: string): string;
 /**
- * Run over a string and report any user-identifying patterns that remain.
- * Used by `scripts/check-cc-drift.mjs` to verify the baked template
- * passes scrubbing before a release goes out.
+ * Run over a string and report anything that must not survive into a bake:
+ * user-identifying paths, host-context sections the strip missed, and
+ * instruction-file prose (dario#872). Despite the name the contract has never
+ * been paths-only. Used by `scripts/check-cc-drift.mjs` to gate a release and
+ * by `scripts/capture-and-bake.mjs` to fail a bake.
+ *
+ * Deliberately NOT called from `extractTemplate`: that serves the live-capture
+ * path too, and the live fingerprint keeps host context on purpose — it exists
+ * to replay the operator's own CC install faithfully. Only the bake publishes.
  */
 export declare function findUserPathHits(text: string): string[];

package/dist/scrub-template.js

@@ -222,9 +222,44 @@ function scrubObjectStrings(value) {
     return value;
 }
 /**
- * Run over a string and report any user-identifying patterns that remain.
- * Used by `scripts/check-cc-drift.mjs` to verify the baked template
- * passes scrubbing before a release goes out.
+ * Prose CC emits when it injects user- or project-level instruction files
+ * (CLAUDE.md, memory, environment) into a prompt. The section strip above is
+ * keyed on the `# claudeMd` heading shape; these are keyed on the wrapper text
+ * itself, so a reshaped or renamed heading still gets caught.
+ *
+ * Both halves are load-bearing. `removeSection` and the heading detector in
+ * findUserPathHits read the SAME heading list, so a heading CC renames strips
+ * nothing and flags nothing — two silent failures — and once paths are scrubbed
+ * the leftover prose carries no user path for the other detectors to catch.
+ * dario#872 saw one capture in six come back carrying another session's
+ * instruction text; this is the half that does not depend on the heading.
+ *
+ * Every marker is verified absent from the real baked template — base, fable,
+ * opus-5 and sonnet-5 prompts plus every tool description. Do NOT add bare
+ * `CLAUDE.md` or `system-reminder`: CC's own system prompt and tool
+ * descriptions both mention them, so either would fail every bake. Verified,
+ * not assumed, and test/context-bleed.mjs pins it.
+ */
+const INSTRUCTION_INJECTION_MARKERS = [
+    { label: 'instruction-file wrapper', re: /Codebase and user instructions are shown below/ },
+    { label: 'instruction-file wrapper', re: /IMPORTANT: These instructions OVERRIDE any default behavior/ },
+    // Straight and typographic apostrophe both — CC emits the straight one today,
+    // and a marker that a quote-style change silently disarms is not a guard.
+    { label: 'instruction-file annotation', re: /user['’]s private global instructions/ },
+    { label: 'memory-file annotation', re: /auto-memory, persists across conversations/ },
+    { label: 'instruction-file heading', re: /\bContents of [^\n]{1,300}\.md\b/ },
+    { label: 'project-instruction wrapper', re: /Here are useful instructions from/ },
+];
+/**
+ * Run over a string and report anything that must not survive into a bake:
+ * user-identifying paths, host-context sections the strip missed, and
+ * instruction-file prose (dario#872). Despite the name the contract has never
+ * been paths-only. Used by `scripts/check-cc-drift.mjs` to gate a release and
+ * by `scripts/capture-and-bake.mjs` to fail a bake.
+ *
+ * Deliberately NOT called from `extractTemplate`: that serves the live-capture
+ * path too, and the live fingerprint keeps host context on purpose — it exists
+ * to replay the operator's own CC install faithfully. Only the bake publishes.
  */
 export function findUserPathHits(text) {
     const hits = [];
@@ -249,5 +284,13 @@ export function findUserPathHits(text) {
             hits.push(`# ${name} (host-context section not stripped)`);
         }
     }
+    // Instruction-file prose, matched on the wrapper rather than the heading.
+    // Excerpt is bounded: a hit is printed by the bake, and the whole point is
+    // that the matched text may be somebody's private instructions.
+    for (const { label, re } of INSTRUCTION_INJECTION_MARKERS) {
+        const m = text.match(re);
+        if (m)
+            hits.push(`${m[0].slice(0, 60)} (${label} not stripped)`);
+    }
     return hits;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "5.4.10",
+  "version": "5.4.12",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {
@@ -22,7 +22,7 @@
   "scripts": {
     "build": "tsc && cp src/cc-template-data.json dist/",
     "test": "node --test --test-concurrency=8 test/all.test.mjs",
-    "test:serial": "node test/issue-29-tool-translation.mjs && node test/hybrid-tools.mjs && node test/tool-schema-contract.mjs && node test/scrub-paths.mjs && node test/provider-prefix.mjs && node test/analytics-recording.mjs && node test/analytics-billing-bucket.mjs && node test/failover-429.mjs && node test/pool-sticky.mjs && node test/live-fingerprint.mjs && node test/proxy-header-order.mjs && node test/proxy-body-order.mjs && node test/runtime-fingerprint.mjs && node test/pacing.mjs && node test/stream-drain.mjs && node test/subagent.mjs && node test/mcp-protocol.mjs && node test/mcp-tools.mjs && node test/mcp-e2e.mjs && node test/session-rotation.mjs && node test/drift-detection.mjs && node test/cc-authorize-probe-classifier.mjs && node test/compat-range.mjs && node test/doctor-formatter.mjs && node test/doctor-identity-drift.mjs && node test/atomic-write.mjs && node test/account-refresh-singleflight.mjs && node test/durable-token-persist.mjs && node test/streaming-edge-cases.mjs && node test/client-detection.mjs && node test/manual-oauth-flow.mjs && node test/scrub-template.mjs && node test/sanitize-messages.mjs && node test/platform-tools.mjs && node test/strict-template-flags.mjs && node test/request-queue.mjs && node test/effort-flag.mjs && node test/template-invariants.mjs",
+    "test:serial": "node test/issue-29-tool-translation.mjs && node test/hybrid-tools.mjs && node test/tool-schema-contract.mjs && node test/scrub-paths.mjs && node test/provider-prefix.mjs && node test/analytics-recording.mjs && node test/analytics-billing-bucket.mjs && node test/failover-429.mjs && node test/pool-sticky.mjs && node test/live-fingerprint.mjs && node test/proxy-header-order.mjs && node test/proxy-body-order.mjs && node test/runtime-fingerprint.mjs && node test/pacing.mjs && node test/stream-drain.mjs && node test/subagent.mjs && node test/mcp-protocol.mjs && node test/mcp-tools.mjs && node test/mcp-e2e.mjs && node test/session-rotation.mjs && node test/drift-detection.mjs && node test/cc-authorize-probe-classifier.mjs && node test/compat-range.mjs && node test/doctor-formatter.mjs && node test/doctor-identity-drift.mjs && node test/atomic-write.mjs && node test/account-refresh-singleflight.mjs && node test/durable-token-persist.mjs && node test/streaming-edge-cases.mjs && node test/client-detection.mjs && node test/manual-oauth-flow.mjs && node test/scrub-template.mjs && node test/context-bleed.mjs && node test/capture-provenance.mjs && node test/sanitize-messages.mjs && node test/platform-tools.mjs && node test/strict-template-flags.mjs && node test/request-queue.mjs && node test/effort-flag.mjs && node test/template-invariants.mjs",
     "audit": "npm audit --production --audit-level=high",
     "prepublishOnly": "npm run build",
     "start": "node dist/cli.js",