@askalf/dario 5.4.11 → 5.4.12

package/dist/live-fingerprint.d.ts

@@ -239,6 +239,35 @@ interface CapturedRequest {
     rawHeaders: string[];
     body: Record<string, unknown>;
 }
+/**
+ * Does this request belong to the capture we started?
+ *
+ * The MITM used to accept the FIRST request whose URL contained
+ * `/v1/messages` with nothing tying it to the child we spawned (dario#872).
+ * The port is ephemeral, so a collision is improbable rather than
+ * impossible, and nothing downstream could tell a foreign request from the
+ * child's once it was captured.
+ *
+ * The nonce rides in the URL path because that is the one channel we fully
+ * control without touching what CC sends. Two measurements decided it over a
+ * key-borne nonce:
+ *
+ *   1. CC honours a path segment in ANTHROPIC_BASE_URL — given
+ *      `http://127.0.0.1:PORT/<nonce>` it requests
+ *      `/<nonce>/v1/messages?beta=true` (and probes `/<nonce>/api/hello`
+ *      first, which still 404s here).
+ *   2. On a subscription install CC authenticates with
+ *      `authorization: Bearer sk-ant-…`, so ANTHROPIC_API_KEY is not the auth
+ *      header at all. A key-borne nonce would do nothing on OAuth installs
+ *      while changing the auth path for API-key ones — and changing what the
+ *      child authenticates with can change what it sends, which is the whole
+ *      thing a fingerprint capture must not do.
+ *
+ * Fails closed: no nonce, no capture. A miss makes the capture return null
+ * and the bake exit non-zero, which is the correct outcome for a request we
+ * cannot attribute.
+ */
+export declare function isOwnCaptureRequest(url: string | undefined, nonce: string): boolean;
 /**
  * Run a loopback MITM server on a random port, spawn CC with
  * ANTHROPIC_BASE_URL pointed at it, wait for one request, respond with a

package/dist/live-fingerprint.js

@@ -85,6 +85,7 @@
  * the right piece without re-deriving the threat model.
  */
 import { spawn, execFileSync } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
 import { createServer } from 'node:http';
 import { readFileSync, writeFileSync, mkdirSync, existsSync, renameSync, unlinkSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -363,6 +364,41 @@ export function _atomicWriteJsonForTest(targetPath, data) {
 function writeLiveCache(data) {
     atomicWriteJson(liveCachePath(), data);
 }
+/**
+ * Does this request belong to the capture we started?
+ *
+ * The MITM used to accept the FIRST request whose URL contained
+ * `/v1/messages` with nothing tying it to the child we spawned (dario#872).
+ * The port is ephemeral, so a collision is improbable rather than
+ * impossible, and nothing downstream could tell a foreign request from the
+ * child's once it was captured.
+ *
+ * The nonce rides in the URL path because that is the one channel we fully
+ * control without touching what CC sends. Two measurements decided it over a
+ * key-borne nonce:
+ *
+ *   1. CC honours a path segment in ANTHROPIC_BASE_URL — given
+ *      `http://127.0.0.1:PORT/<nonce>` it requests
+ *      `/<nonce>/v1/messages?beta=true` (and probes `/<nonce>/api/hello`
+ *      first, which still 404s here).
+ *   2. On a subscription install CC authenticates with
+ *      `authorization: Bearer sk-ant-…`, so ANTHROPIC_API_KEY is not the auth
+ *      header at all. A key-borne nonce would do nothing on OAuth installs
+ *      while changing the auth path for API-key ones — and changing what the
+ *      child authenticates with can change what it sends, which is the whole
+ *      thing a fingerprint capture must not do.
+ *
+ * Fails closed: no nonce, no capture. A miss makes the capture return null
+ * and the bake exit non-zero, which is the correct outcome for a request we
+ * cannot attribute.
+ */
+export function isOwnCaptureRequest(url, nonce) {
+    if (!url || nonce.length === 0)
+        return false;
+    if (!url.startsWith(`/${nonce}/`))
+        return false;
+    return url.includes('/v1/messages');
+}
 /**
  * Run a loopback MITM server on a random port, spawn CC with
  * ANTHROPIC_BASE_URL pointed at it, wait for one request, respond with a
@@ -377,9 +413,11 @@ export async function captureLiveTemplateAsync(timeoutMs = 10_000) {
     return extractTemplate(captured);
 }
 async function runCapture(timeoutMs) {
+    const nonce = `dario-capture-${randomBytes(12).toString('hex')}`;
     return new Promise((resolve) => {
         let captured = null;
         let settled = false;
+        let foreign = 0;
         const settle = (result) => {
             if (settled)
                 return;
@@ -395,9 +433,17 @@ async function runCapture(timeoutMs) {
             resolve(result);
         };
         const server = createServer((req, res) => {
-            // Only handle /v1/messages — everything else gets a 404 so CC doesn't
-            // accidentally think /v1/models is live.
-            if (!req.url?.includes('/v1/messages')) {
+            // Only handle OUR /v1/messages — everything else gets a 404 so CC
+            // doesn't accidentally think /v1/models is live, and so a request we
+            // cannot attribute to the spawned child is never captured (dario#872).
+            if (!isOwnCaptureRequest(req.url, nonce)) {
+                // A /v1/messages without our nonce is exactly the case #872 is about:
+                // something else reached this port. Say so — a silent 404 here is how
+                // a foreign capture would have gone unnoticed.
+                if (req.url?.includes('/v1/messages')) {
+                    foreign++;
+                    console.error(`[dario] capture: rejected a /v1/messages request that did not carry this capture's nonce (${foreign} so far) — see dario#872`);
+                }
                 res.writeHead(404, { 'content-type': 'application/json' });
                 res.end('{"type":"error","error":{"type":"not_found_error","message":"not found"}}');
                 return;
@@ -417,7 +463,7 @@ async function runCapture(timeoutMs) {
                     }
                     captured = {
                         method: req.method ?? 'POST',
-                        path: req.url ?? '/v1/messages',
+                        path: (req.url ?? '/v1/messages').replace(`/${nonce}`, ''),
                         headers,
                         rawHeaders: Array.isArray(req.rawHeaders) ? [...req.rawHeaders] : [],
                         body,
@@ -481,7 +527,7 @@ async function runCapture(timeoutMs) {
                 settle(null);
                 return;
             }
-            const url = `http://127.0.0.1:${address.port}`;
+            const url = `http://127.0.0.1:${address.port}/${nonce}`;
             // Spawn CC with ANTHROPIC_BASE_URL pointed at our MITM.
             const claudeBin = findClaudeBinary();
             if (!claudeBin) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "5.4.11",
+  "version": "5.4.12",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {
@@ -22,7 +22,7 @@
   "scripts": {
     "build": "tsc && cp src/cc-template-data.json dist/",
     "test": "node --test --test-concurrency=8 test/all.test.mjs",
-    "test:serial": "node test/issue-29-tool-translation.mjs && node test/hybrid-tools.mjs && node test/tool-schema-contract.mjs && node test/scrub-paths.mjs && node test/provider-prefix.mjs && node test/analytics-recording.mjs && node test/analytics-billing-bucket.mjs && node test/failover-429.mjs && node test/pool-sticky.mjs && node test/live-fingerprint.mjs && node test/proxy-header-order.mjs && node test/proxy-body-order.mjs && node test/runtime-fingerprint.mjs && node test/pacing.mjs && node test/stream-drain.mjs && node test/subagent.mjs && node test/mcp-protocol.mjs && node test/mcp-tools.mjs && node test/mcp-e2e.mjs && node test/session-rotation.mjs && node test/drift-detection.mjs && node test/cc-authorize-probe-classifier.mjs && node test/compat-range.mjs && node test/doctor-formatter.mjs && node test/doctor-identity-drift.mjs && node test/atomic-write.mjs && node test/account-refresh-singleflight.mjs && node test/durable-token-persist.mjs && node test/streaming-edge-cases.mjs && node test/client-detection.mjs && node test/manual-oauth-flow.mjs && node test/scrub-template.mjs && node test/context-bleed.mjs && node test/sanitize-messages.mjs && node test/platform-tools.mjs && node test/strict-template-flags.mjs && node test/request-queue.mjs && node test/effort-flag.mjs && node test/template-invariants.mjs",
+    "test:serial": "node test/issue-29-tool-translation.mjs && node test/hybrid-tools.mjs && node test/tool-schema-contract.mjs && node test/scrub-paths.mjs && node test/provider-prefix.mjs && node test/analytics-recording.mjs && node test/analytics-billing-bucket.mjs && node test/failover-429.mjs && node test/pool-sticky.mjs && node test/live-fingerprint.mjs && node test/proxy-header-order.mjs && node test/proxy-body-order.mjs && node test/runtime-fingerprint.mjs && node test/pacing.mjs && node test/stream-drain.mjs && node test/subagent.mjs && node test/mcp-protocol.mjs && node test/mcp-tools.mjs && node test/mcp-e2e.mjs && node test/session-rotation.mjs && node test/drift-detection.mjs && node test/cc-authorize-probe-classifier.mjs && node test/compat-range.mjs && node test/doctor-formatter.mjs && node test/doctor-identity-drift.mjs && node test/atomic-write.mjs && node test/account-refresh-singleflight.mjs && node test/durable-token-persist.mjs && node test/streaming-edge-cases.mjs && node test/client-detection.mjs && node test/manual-oauth-flow.mjs && node test/scrub-template.mjs && node test/context-bleed.mjs && node test/capture-provenance.mjs && node test/sanitize-messages.mjs && node test/platform-tools.mjs && node test/strict-template-flags.mjs && node test/request-queue.mjs && node test/effort-flag.mjs && node test/template-invariants.mjs",
     "audit": "npm audit --production --audit-level=high",
     "prepublishOnly": "npm run build",
     "start": "node dist/cli.js",