@askalf/dario 5.4.23 → 5.4.25

package/README.md

@@ -18,7 +18,9 @@
 
 <p><strong>One local endpoint. Every AI tool you own. The subscription you already pay for.</strong></p>
 
-<sub><code>npm i -g @askalf/dario</code> · <strong>0</strong> runtime deps · <a href="https://www.npmjs.com/package/@askalf/dario">SLSA-attested</a> every release · nothing phones home · ~22k lines you can read in a weekend · independent, unofficial, third-party (<a href="DISCLAIMER.md">DISCLAIMER.md</a>)</sub>
+<sub><code>npm i -g @askalf/dario</code> · <strong>0</strong> runtime deps · <a href="https://www.npmjs.com/package/@askalf/dario">SLSA-attested</a> every release · nothing phones home · ~24k lines you can read in a weekend · independent, unofficial, third-party (<a href="DISCLAIMER.md">DISCLAIMER.md</a>)</sub>
+
+<sub>Part of <a href="#own-your-stack"><strong>Own Your Stack</strong></a> — 12 open tools for owning your AI infra: <a href="https://github.com/askalf/truecopy">truecopy</a> · <a href="https://github.com/askalf/strongroom">strongroom</a> · <a href="https://github.com/askalf/fieldpass">fieldpass</a> · <a href="https://github.com/askalf/plumbline">plumbline</a> · <a href="#own-your-stack">full family ↓</a></sub>
 
 </div>
 
@@ -353,6 +355,7 @@ dario is the routing layer of **[Own Your Stack](https://github.com/askalf)**
 - **[strongroom](https://github.com/askalf/strongroom)** — own your agent secrets
 - **[cordon](https://github.com/askalf/cordon)** — own your prompts
 - **[fieldpass](https://github.com/askalf/fieldpass)** — own your agent browser
+- **[plumbline](https://github.com/askalf/plumbline)** — own your agent oversight
 - **[amnesia](https://github.com/askalf/amnesia)** — own your search
 - **[askalf](https://askalf.org)** — own your operation: the AI operation that runs Sprayberry Labs
 

package/dist/config-report.js

@@ -18,6 +18,7 @@ import { readFileSync, existsSync, statSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { homedir } from 'node:os';
+import { ignoreCcCredentials } from './oauth.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /**
  * Collect the effective dario configuration the proxy would run with.
@@ -76,6 +77,12 @@ export async function collectEffectiveConfig() {
         rows: [
             { label: 'credentials', value: credsInfo },
             { label: 'path', value: credsPath },
+            {
+                label: 'DARIO_IGNORE_CC_CREDENTIALS',
+                value: ignoreCcCredentials()
+                    ? "on — using ONLY dario's own credentials.json; Claude Code session token + keychain ignored (won't rotate a live `claude` session)"
+                    : 'off — also reads ~/.claude/.credentials.json + OS keychain, picks freshest (can rotate a live `claude` session on the same machine)',
+            },
         ],
     });
     // ── Pool

package/dist/doctor.js

@@ -20,6 +20,7 @@ import { CC_TEMPLATE, resolveSystemPrompt, } from './cc-template.js';
 import { describeTemplate, detectDrift, checkCCCompat, findInstalledCC, SUPPORTED_CC_RANGE, CURRENT_SCHEMA_VERSION, compareVersions, } from './live-fingerprint.js';
 import { detectCCOAuthConfig } from './cc-oauth-detect.js';
 import { runAuthorizeProbe } from './cc-authorize-probe.js';
+import { MIGRATED_LOGIN_ALIAS } from './accounts.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /**
  * Format a epoch timestamp reset time relative to the current time.
@@ -109,6 +110,7 @@ export function checkIdentityDrift(input) {
     }
     const aligned = [];
     const drifted = [];
+    const driftedAliases = [];
     for (const acc of poolAccounts) {
         const deviceMatch = acc.deviceId === live.deviceId;
         const acctMatch = acc.accountUuid === live.accountUuid;
@@ -118,6 +120,7 @@ export function checkIdentityDrift(input) {
         else {
             const which = !deviceMatch && !acctMatch ? 'both' : !deviceMatch ? 'deviceId' : 'accountUuid';
             drifted.push(`${acc.alias} (${which})`);
+            driftedAliases.push(acc.alias);
         }
     }
     if (drifted.length === 0) {
@@ -127,10 +130,30 @@ export function checkIdentityDrift(input) {
                 detail: `${aligned.length}/${poolAccounts.length} pool account${poolAccounts.length === 1 ? '' : 's'} match ~/.claude.json (userID=${shortId(live.deviceId)})`,
             }];
     }
+    // The remedy is deliberately NOT `accounts add <alias>`. That command
+    // exits 1 on an alias that already exists ("Remove it first"), and its
+    // default path runs a full OAuth browser flow rather than re-snapshotting
+    // — so naming it here walked every drifted user into a dead end. The two
+    // alias kinds genuinely need different commands: the reserved login alias
+    // is back-filled from whatever credentials are current, so removing it is
+    // enough (it re-materializes on the next `dario login` / `dario proxy`),
+    // while a user-added alias has to be removed and re-added, which re-runs
+    // OAuth for that account by design.
+    const loginDrifted = driftedAliases.includes(MIGRATED_LOGIN_ALIAS);
+    const otherDrifted = driftedAliases.filter((a) => a !== MIGRATED_LOGIN_ALIAS);
+    const fixes = [];
+    if (loginDrifted) {
+        fixes.push(`\`dario accounts remove ${MIGRATED_LOGIN_ALIAS}\` — it re-materializes from your ` +
+            `current credentials on the next \`dario login\` / \`dario proxy\``);
+    }
+    if (otherDrifted.length > 0) {
+        fixes.push(`\`dario accounts remove <alias>\` then \`dario accounts add <alias>\` to re-snapshot` +
+            `${otherDrifted.length === 1 ? '' : ' (for each of them)'} — the add re-runs OAuth for that account`);
+    }
     return [{
             status: 'warn',
             label: 'Identity',
-            detail: `${drifted.length}/${poolAccounts.length} pool account${poolAccounts.length === 1 ? '' : 's'} drifted from ~/.claude.json (live userID=${shortId(live.deviceId)}): ${drifted.join('; ')} — re-run \`dario accounts add <alias>\` to refresh the stored snapshot, or non-Haiku requests on the drifted account(s) will 401`,
+            detail: `${drifted.length}/${poolAccounts.length} pool account${poolAccounts.length === 1 ? '' : 's'} drifted from ~/.claude.json (live userID=${shortId(live.deviceId)}): ${drifted.join('; ')} — non-Haiku requests on the drifted account(s) will 401. Fix: ${fixes.join('; ')}`,
         }];
 }
 /**

package/dist/oauth.d.ts

@@ -22,6 +22,39 @@ export interface OAuthTokens {
 export interface CredentialsFile {
     claudeAiOauth: OAuthTokens;
 }
+/**
+ * Whether to ignore the interactive Claude Code session's credentials entirely
+ * — set via `DARIO_IGNORE_CC_CREDENTIALS` (1/true/yes/on). Exported for tests.
+ *
+ * Default (unset) keeps the historical behaviour: loadCredentials reads dario's
+ * own file, CC's `~/.claude/.credentials.json`, AND the OS keychain (where
+ * modern CC stores its token), then uses the FRESHEST. That auto-detection is
+ * convenient for a machine dedicated to dario, but it is exactly what breaks a
+ * live `claude` session running on the SAME machine/account: the moment CC's
+ * token is fresher (e.g. right after you log into CC), dario grabs that same
+ * token and refreshes it, Anthropic rotates it, and the interactive session
+ * still holding the old copy starts 401ing.
+ *
+ * With the flag set, dario uses ONLY its own `~/.dario/credentials.json` (from a
+ * prior `dario login`) and never touches the CC file or keychain — so it stays
+ * on the Max subscription ($0) while never rotating the interactive session's
+ * token. The API-key path (`ANTHROPIC_UPSTREAM_API_KEY`) also isolates, but
+ * bypasses OAuth/Max onto retail billing, defeating the point of dario.
+ */
+export declare function ignoreCcCredentials(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Which credential sources loadCredentials() consults, given whether the
+ * interactive Claude Code session's credentials should be ignored. Exported so
+ * the isolation guarantee is testable without real credentials on disk.
+ *
+ * `readKeychain` gates the OS keychain the same way as the CC file: the modern
+ * CC binary stores its OAuth token in the keychain, not on disk, so isolating
+ * from the interactive session means skipping BOTH.
+ */
+export declare function credentialSourcePlan(ignoreCc: boolean): {
+    filePaths: string[];
+    readKeychain: boolean;
+};
 /**
  * Information about a keychain entry surfaced for operator disambiguation
  * during `dario accounts add --from-keychain`.

package/dist/oauth.js

@@ -75,6 +75,43 @@ function generatePKCE() {
 function getDarioCredentialsPath() {
     return join(homedir(), '.dario', 'credentials.json');
 }
+/**
+ * Whether to ignore the interactive Claude Code session's credentials entirely
+ * — set via `DARIO_IGNORE_CC_CREDENTIALS` (1/true/yes/on). Exported for tests.
+ *
+ * Default (unset) keeps the historical behaviour: loadCredentials reads dario's
+ * own file, CC's `~/.claude/.credentials.json`, AND the OS keychain (where
+ * modern CC stores its token), then uses the FRESHEST. That auto-detection is
+ * convenient for a machine dedicated to dario, but it is exactly what breaks a
+ * live `claude` session running on the SAME machine/account: the moment CC's
+ * token is fresher (e.g. right after you log into CC), dario grabs that same
+ * token and refreshes it, Anthropic rotates it, and the interactive session
+ * still holding the old copy starts 401ing.
+ *
+ * With the flag set, dario uses ONLY its own `~/.dario/credentials.json` (from a
+ * prior `dario login`) and never touches the CC file or keychain — so it stays
+ * on the Max subscription ($0) while never rotating the interactive session's
+ * token. The API-key path (`ANTHROPIC_UPSTREAM_API_KEY`) also isolates, but
+ * bypasses OAuth/Max onto retail billing, defeating the point of dario.
+ */
+export function ignoreCcCredentials(env = process.env) {
+    const v = (env['DARIO_IGNORE_CC_CREDENTIALS'] ?? '').trim().toLowerCase();
+    return v === '1' || v === 'true' || v === 'yes' || v === 'on';
+}
+/**
+ * Which credential sources loadCredentials() consults, given whether the
+ * interactive Claude Code session's credentials should be ignored. Exported so
+ * the isolation guarantee is testable without real credentials on disk.
+ *
+ * `readKeychain` gates the OS keychain the same way as the CC file: the modern
+ * CC binary stores its OAuth token in the keychain, not on disk, so isolating
+ * from the interactive session means skipping BOTH.
+ */
+export function credentialSourcePlan(ignoreCc) {
+    return ignoreCc
+        ? { filePaths: [getDarioCredentialsPath()], readKeychain: false }
+        : { filePaths: [getDarioCredentialsPath(), getClaudeCodeCredentialsPath()], readKeychain: true };
+}
 function getClaudeCodeCredentialsPath() {
     return join(homedir(), '.claude', '.credentials.json');
 }
@@ -362,8 +399,15 @@ export async function loadCredentials() {
     // work the way it did before any `dario login` had ever run, while
     // still preferring dario's own file when both sources are equivalent
     // (dario file wins ties on expiresAt by being checked first).
+    //
+    // DARIO_IGNORE_CC_CREDENTIALS narrows the source set to dario's OWN file
+    // only — never the interactive CC session's token (its file OR the keychain).
+    // See ignoreCcCredentials() / credentialSourcePlan() for why: on a machine
+    // shared with a live `claude` session, grabbing + refreshing CC's token here
+    // rotates it out from under that session.
+    const plan = credentialSourcePlan(ignoreCcCredentials());
     const candidates = [];
-    for (const path of [getDarioCredentialsPath(), getClaudeCodeCredentialsPath()]) {
+    for (const path of plan.filePaths) {
         try {
             const raw = await readFile(path, 'utf-8');
             const parsed = JSON.parse(raw);
@@ -374,9 +418,11 @@ export async function loadCredentials() {
         catch { /* try next */ }
     }
     // OS keychain (modern CC stores credentials here, not on disk).
-    const keychainCreds = await loadKeychainCredentials();
-    if (keychainCreds?.claudeAiOauth?.accessToken && keychainCreds?.claudeAiOauth?.refreshToken) {
-        candidates.push(keychainCreds);
+    if (plan.readKeychain) {
+        const keychainCreds = await loadKeychainCredentials();
+        if (keychainCreds?.claudeAiOauth?.accessToken && keychainCreds?.claudeAiOauth?.refreshToken) {
+            candidates.push(keychainCreds);
+        }
     }
     const best = pickFreshestCredentials(candidates);
     if (!best)

package/dist/proxy.js

@@ -5,7 +5,7 @@ import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { setDefaultResultOrder } from 'node:dns';
 import { arch, platform } from 'node:process';
-import { getAccessToken, getStatus } from './oauth.js';
+import { getAccessToken, getStatus, ignoreCcCredentials } from './oauth.js';
 import { buildHealthResponse, derivePoolStatus, shouldDiscloseHealthInternals } from './health-response.js';
 import { darioVersion } from './version.js';
 import { buildCCRequest, applyCcPromptCaching, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, forwardClientCCIdentityHeaders, isMcpToolName, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
@@ -962,6 +962,8 @@ export async function startProxy(opts = {}) {
     const upstreamApiKey = (opts.upstreamApiKey ?? process.env.ANTHROPIC_UPSTREAM_API_KEY ?? '').trim();
     if (upstreamApiKey)
         console.error('[dario] upstream auth: per-token API key (x-api-key) — OAuth/Max + account pool bypassed');
+    else if (ignoreCcCredentials())
+        console.error("[dario] DARIO_IGNORE_CC_CREDENTIALS: using ONLY dario's own credentials.json — Claude Code session token + keychain ignored (won't rotate a live `claude` session; run `dario login` if not authed)");
     // DNS result order — prefer IPv4 for the Anthropic upstream by default.
     // api.anthropic.com publishes both A and AAAA records. In a container with
     // no IPv6 egress (e.g. a default Docker bridge network), Node's `verbatim`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "5.4.23",
+  "version": "5.4.25",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {