@askalf/dario 5.4.22 → 5.4.24

package/README.md

@@ -18,7 +18,9 @@
 
 <p><strong>One local endpoint. Every AI tool you own. The subscription you already pay for.</strong></p>
 
-<sub><code>npm i -g @askalf/dario</code> · <strong>0</strong> runtime deps · <a href="https://www.npmjs.com/package/@askalf/dario">SLSA-attested</a> every release · nothing phones home · ~22k lines you can read in a weekend · independent, unofficial, third-party (<a href="DISCLAIMER.md">DISCLAIMER.md</a>)</sub>
+<sub><code>npm i -g @askalf/dario</code> · <strong>0</strong> runtime deps · <a href="https://www.npmjs.com/package/@askalf/dario">SLSA-attested</a> every release · nothing phones home · ~24k lines you can read in a weekend · independent, unofficial, third-party (<a href="DISCLAIMER.md">DISCLAIMER.md</a>)</sub>
+
+<sub>Part of <a href="#own-your-stack"><strong>Own Your Stack</strong></a> — 12 open tools for owning your AI infra: <a href="https://github.com/askalf/truecopy">truecopy</a> · <a href="https://github.com/askalf/strongroom">strongroom</a> · <a href="https://github.com/askalf/fieldpass">fieldpass</a> · <a href="https://github.com/askalf/plumbline">plumbline</a> · <a href="#own-your-stack">full family ↓</a></sub>
 
 </div>
 
@@ -353,6 +355,7 @@ dario is the routing layer of **[Own Your Stack](https://github.com/askalf)**
 - **[strongroom](https://github.com/askalf/strongroom)** — own your agent secrets
 - **[cordon](https://github.com/askalf/cordon)** — own your prompts
 - **[fieldpass](https://github.com/askalf/fieldpass)** — own your agent browser
+- **[plumbline](https://github.com/askalf/plumbline)** — own your agent oversight
 - **[amnesia](https://github.com/askalf/amnesia)** — own your search
 - **[askalf](https://askalf.org)** — own your operation: the AI operation that runs Sprayberry Labs
 

package/dist/doctor.js

@@ -20,6 +20,7 @@ import { CC_TEMPLATE, resolveSystemPrompt, } from './cc-template.js';
 import { describeTemplate, detectDrift, checkCCCompat, findInstalledCC, SUPPORTED_CC_RANGE, CURRENT_SCHEMA_VERSION, compareVersions, } from './live-fingerprint.js';
 import { detectCCOAuthConfig } from './cc-oauth-detect.js';
 import { runAuthorizeProbe } from './cc-authorize-probe.js';
+import { MIGRATED_LOGIN_ALIAS } from './accounts.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /**
  * Format a epoch timestamp reset time relative to the current time.
@@ -109,6 +110,7 @@ export function checkIdentityDrift(input) {
     }
     const aligned = [];
     const drifted = [];
+    const driftedAliases = [];
     for (const acc of poolAccounts) {
         const deviceMatch = acc.deviceId === live.deviceId;
         const acctMatch = acc.accountUuid === live.accountUuid;
@@ -118,6 +120,7 @@ export function checkIdentityDrift(input) {
         else {
             const which = !deviceMatch && !acctMatch ? 'both' : !deviceMatch ? 'deviceId' : 'accountUuid';
             drifted.push(`${acc.alias} (${which})`);
+            driftedAliases.push(acc.alias);
         }
     }
     if (drifted.length === 0) {
@@ -127,10 +130,30 @@ export function checkIdentityDrift(input) {
                 detail: `${aligned.length}/${poolAccounts.length} pool account${poolAccounts.length === 1 ? '' : 's'} match ~/.claude.json (userID=${shortId(live.deviceId)})`,
             }];
     }
+    // The remedy is deliberately NOT `accounts add <alias>`. That command
+    // exits 1 on an alias that already exists ("Remove it first"), and its
+    // default path runs a full OAuth browser flow rather than re-snapshotting
+    // — so naming it here walked every drifted user into a dead end. The two
+    // alias kinds genuinely need different commands: the reserved login alias
+    // is back-filled from whatever credentials are current, so removing it is
+    // enough (it re-materializes on the next `dario login` / `dario proxy`),
+    // while a user-added alias has to be removed and re-added, which re-runs
+    // OAuth for that account by design.
+    const loginDrifted = driftedAliases.includes(MIGRATED_LOGIN_ALIAS);
+    const otherDrifted = driftedAliases.filter((a) => a !== MIGRATED_LOGIN_ALIAS);
+    const fixes = [];
+    if (loginDrifted) {
+        fixes.push(`\`dario accounts remove ${MIGRATED_LOGIN_ALIAS}\` — it re-materializes from your ` +
+            `current credentials on the next \`dario login\` / \`dario proxy\``);
+    }
+    if (otherDrifted.length > 0) {
+        fixes.push(`\`dario accounts remove <alias>\` then \`dario accounts add <alias>\` to re-snapshot` +
+            `${otherDrifted.length === 1 ? '' : ' (for each of them)'} — the add re-runs OAuth for that account`);
+    }
     return [{
             status: 'warn',
             label: 'Identity',
-            detail: `${drifted.length}/${poolAccounts.length} pool account${poolAccounts.length === 1 ? '' : 's'} drifted from ~/.claude.json (live userID=${shortId(live.deviceId)}): ${drifted.join('; ')} — re-run \`dario accounts add <alias>\` to refresh the stored snapshot, or non-Haiku requests on the drifted account(s) will 401`,
+            detail: `${drifted.length}/${poolAccounts.length} pool account${poolAccounts.length === 1 ? '' : 's'} drifted from ~/.claude.json (live userID=${shortId(live.deviceId)}): ${drifted.join('; ')} — non-Haiku requests on the drifted account(s) will 401. Fix: ${fixes.join('; ')}`,
         }];
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "5.4.22",
+  "version": "5.4.24",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {