@askalf/dario 5.4.20 → 5.4.22

package/dist/live-fingerprint.d.ts

@@ -286,6 +286,8 @@ export declare function findInstalledCC(): {
     path: string | null;
     version: string | null;
 };
+/** Test-only: drop the resolved-binary memo. */
+export declare function _resetClaudeBinCacheForTest(): void;
 export declare function enumerateClaudeCandidates(): string[];
 /**
  * Given a captured /v1/messages request body, pull out the fields that

package/dist/live-fingerprint.js

@@ -341,10 +341,20 @@ function quarantineCorruptCache(reason) {
  * other's partial writes. Exposed for tests via `_atomicWriteJsonForTest`.
  */
 function atomicWriteJson(targetPath, data) {
-    mkdirSync(dirname(targetPath), { recursive: true });
+    // 0700: whichever code path creates ~/.dario first decides that directory's
+    // permissions, and this one runs at startup, before any credential write.
+    // Without a mode it lands 755 on Linux, which makes every non-0600 file inside
+    // world-readable. The credential paths already create their dirs 0700; this was
+    // the one that could get there first and did not.
+    mkdirSync(dirname(targetPath), { recursive: true, mode: 0o700 });
     const tmp = `${targetPath}.${process.pid}.tmp`;
     try {
-        writeFileSync(tmp, JSON.stringify(data, null, 2));
+        // 0600: this file holds the UNSCRUBBED live capture. Verified on the Linux
+        // deployment to contain `# Environment` (cwd, OS, platform) and `gitStatus:`
+        // (branch, modified files, recent commits); structurally it can also carry
+        // `# claudeMd`, `# userEmail` and `# auto memory` — the scrub list exists
+        // because CC emits them. Credentials beside it are 0600; this was 0644.
+        writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
         renameSync(tmp, targetPath);
     }
     catch (err) {
@@ -587,11 +597,32 @@ export function findInstalledCC() {
     const version = path ? probeInstalledCCVersion() : null;
     return { path, version };
 }
+// Resolving the binary means enumerating candidates and, when there is more
+// than one, SPAWNING each to compare versions. That is a subprocess per
+// candidate per call, and there are four call sites (refresh, capture,
+// findInstalledCC, drift). Profiling a proxy start showed ~720ms of blocking
+// spawnSync, over half of a ~1270ms startup, from repeating this and the
+// version probe. The installed binary cannot change mid-process, so resolve
+// once. Keyed on the override so a test flipping DARIO_CLAUDE_BIN is not served
+// a stale answer.
+let _claudeBinCache = null;
+/** Test-only: drop the resolved-binary memo. */
+export function _resetClaudeBinCacheForTest() {
+    _claudeBinCache = null;
+}
 function findClaudeBinary() {
     // Honor an explicit override first — useful for tests and for users on
     // non-standard installs.
-    if (process.env.DARIO_CLAUDE_BIN)
-        return process.env.DARIO_CLAUDE_BIN;
+    const override = process.env.DARIO_CLAUDE_BIN;
+    if (override)
+        return override;
+    if (_claudeBinCache && _claudeBinCache.key === '')
+        return _claudeBinCache.value;
+    const resolved = resolveClaudeBinaryUncached();
+    _claudeBinCache = { key: '', value: resolved };
+    return resolved;
+}
+function resolveClaudeBinaryUncached() {
     const candidates = enumerateClaudeCandidates();
     if (candidates.length === 0)
         return null;

package/dist/proxy.js

@@ -1,6 +1,5 @@
 import { createServer } from 'node:http';
 import { randomUUID, randomBytes, timingSafeEqual, createHash } from 'node:crypto';
-import { execSync } from 'node:child_process';
 import { readFileSync, readdirSync, createWriteStream } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
@@ -11,7 +10,7 @@ import { buildHealthResponse, derivePoolStatus, shouldDiscloseHealthInternals }
 import { darioVersion } from './version.js';
 import { buildCCRequest, applyCcPromptCaching, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, forwardClientCCIdentityHeaders, isMcpToolName, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
 import { stampCch, hasCchSeed } from './cch.js';
-import { describeTemplate, detectDrift, checkCCCompat } from './live-fingerprint.js';
+import { describeTemplate, detectDrift, checkCCCompat, probeInstalledCCVersion } from './live-fingerprint.js';
 import { AccountPool, computeStickyKey, parseRateLimits, modelFamily, isInAuthCooldown, authCooldownMs, reconcilePoolAccounts, resolvePoolStrategy } from './pool.js';
 import { Analytics, billingBucketFromClaim, formatUsageLogLine, SUBSCRIPTION_CLAIMS } from './analytics.js';
 import { OverageGuard, buildHaltErrorBody } from './overage-guard.js';
@@ -118,8 +117,15 @@ export function buildBillingTag(cliVersion, cch) {
 function detectCliVersion() {
     const templateVersion = CC_TEMPLATE._version || '2.1.100';
     try {
-        const out = execSync('claude --version', { timeout: 5000, stdio: 'pipe' }).toString().trim();
-        return out.match(/^([\d]+\.[\d]+\.[\d]+)/)?.[1] ?? templateVersion;
+        // Was its own execSync('claude --version'), which made this the THIRD
+        // synchronous spawn of a 259 MB binary during startup for one version
+        // string — findClaudeBinary probes candidates, probeInstalledCCVersion
+        // probes the winner, and this probed again. probeInstalledCCVersion is
+        // memoised per process and resolves the binary properly (honours
+        // DARIO_CLAUDE_BIN, picks the newest candidate) rather than trusting
+        // whatever bare `claude` the shell finds, so reusing it is both cheaper and
+        // more correct.
+        return probeInstalledCCVersion() ?? templateVersion;
     }
     catch {
         return templateVersion;
@@ -1082,7 +1088,13 @@ export async function startProxy(opts = {}) {
     let logFileStream = null;
     if (logFilePath) {
         try {
-            logFileStream = createWriteStream(logFilePath, { flags: 'a' });
+            // 0600 to match everything else dario writes. Records are redacted metadata
+            // rather than bodies (writeLogLine runs redactSecrets; -vv bodies go to
+            // stdout), so this is defence-in-depth — but it still shows which account
+            // served which request and when, and 0644 contradicted the convention every
+            // credential path here follows. Mode applies to CREATION only, so an
+            // existing log keeps its own mode, which is right for append.
+            logFileStream = createWriteStream(logFilePath, { flags: 'a', mode: 0o600 });
             logFileStream.on('error', (err) => {
                 console.error(`[dario] log-file write error: ${err.message} (logging disabled)`);
                 logFileStream = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "5.4.20",
+  "version": "5.4.22",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {