@askalf/dario 5.4.24 → 5.4.26

package/dist/config-report.js

@@ -18,6 +18,7 @@ import { readFileSync, existsSync, statSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { homedir } from 'node:os';
+import { ignoreCcCredentials } from './oauth.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /**
  * Collect the effective dario configuration the proxy would run with.
@@ -76,6 +77,12 @@ export async function collectEffectiveConfig() {
         rows: [
             { label: 'credentials', value: credsInfo },
             { label: 'path', value: credsPath },
+            {
+                label: 'DARIO_IGNORE_CC_CREDENTIALS',
+                value: ignoreCcCredentials()
+                    ? "on — using ONLY dario's own credentials.json; Claude Code session token + keychain ignored (won't rotate a live `claude` session)"
+                    : 'off — also reads ~/.claude/.credentials.json + OS keychain, picks freshest (can rotate a live `claude` session on the same machine)',
+            },
         ],
     });
     // ── Pool

package/dist/live-fingerprint.d.ts

@@ -354,7 +354,7 @@ export declare function detectDrift(t: TemplateData, installedOverride?: string
  */
 export declare const SUPPORTED_CC_RANGE: {
     readonly min: "1.0.0";
-    readonly maxTested: "2.1.220";
+    readonly maxTested: "2.1.221";
 };
 /**
  * Compare two dotted-numeric version strings. Returns negative if `a<b`,

package/dist/live-fingerprint.js

@@ -969,7 +969,7 @@ export function detectDrift(t, installedOverride) {
  */
 export const SUPPORTED_CC_RANGE = {
     min: '1.0.0',
-    maxTested: '2.1.220',
+    maxTested: '2.1.221',
 };
 /**
  * Compare two dotted-numeric version strings. Returns negative if `a<b`,

package/dist/oauth.d.ts

@@ -22,6 +22,39 @@ export interface OAuthTokens {
 export interface CredentialsFile {
     claudeAiOauth: OAuthTokens;
 }
+/**
+ * Whether to ignore the interactive Claude Code session's credentials entirely
+ * — set via `DARIO_IGNORE_CC_CREDENTIALS` (1/true/yes/on). Exported for tests.
+ *
+ * Default (unset) keeps the historical behaviour: loadCredentials reads dario's
+ * own file, CC's `~/.claude/.credentials.json`, AND the OS keychain (where
+ * modern CC stores its token), then uses the FRESHEST. That auto-detection is
+ * convenient for a machine dedicated to dario, but it is exactly what breaks a
+ * live `claude` session running on the SAME machine/account: the moment CC's
+ * token is fresher (e.g. right after you log into CC), dario grabs that same
+ * token and refreshes it, Anthropic rotates it, and the interactive session
+ * still holding the old copy starts 401ing.
+ *
+ * With the flag set, dario uses ONLY its own `~/.dario/credentials.json` (from a
+ * prior `dario login`) and never touches the CC file or keychain — so it stays
+ * on the Max subscription ($0) while never rotating the interactive session's
+ * token. The API-key path (`ANTHROPIC_UPSTREAM_API_KEY`) also isolates, but
+ * bypasses OAuth/Max onto retail billing, defeating the point of dario.
+ */
+export declare function ignoreCcCredentials(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Which credential sources loadCredentials() consults, given whether the
+ * interactive Claude Code session's credentials should be ignored. Exported so
+ * the isolation guarantee is testable without real credentials on disk.
+ *
+ * `readKeychain` gates the OS keychain the same way as the CC file: the modern
+ * CC binary stores its OAuth token in the keychain, not on disk, so isolating
+ * from the interactive session means skipping BOTH.
+ */
+export declare function credentialSourcePlan(ignoreCc: boolean): {
+    filePaths: string[];
+    readKeychain: boolean;
+};
 /**
  * Information about a keychain entry surfaced for operator disambiguation
  * during `dario accounts add --from-keychain`.

package/dist/oauth.js

@@ -75,6 +75,43 @@ function generatePKCE() {
 function getDarioCredentialsPath() {
     return join(homedir(), '.dario', 'credentials.json');
 }
+/**
+ * Whether to ignore the interactive Claude Code session's credentials entirely
+ * — set via `DARIO_IGNORE_CC_CREDENTIALS` (1/true/yes/on). Exported for tests.
+ *
+ * Default (unset) keeps the historical behaviour: loadCredentials reads dario's
+ * own file, CC's `~/.claude/.credentials.json`, AND the OS keychain (where
+ * modern CC stores its token), then uses the FRESHEST. That auto-detection is
+ * convenient for a machine dedicated to dario, but it is exactly what breaks a
+ * live `claude` session running on the SAME machine/account: the moment CC's
+ * token is fresher (e.g. right after you log into CC), dario grabs that same
+ * token and refreshes it, Anthropic rotates it, and the interactive session
+ * still holding the old copy starts 401ing.
+ *
+ * With the flag set, dario uses ONLY its own `~/.dario/credentials.json` (from a
+ * prior `dario login`) and never touches the CC file or keychain — so it stays
+ * on the Max subscription ($0) while never rotating the interactive session's
+ * token. The API-key path (`ANTHROPIC_UPSTREAM_API_KEY`) also isolates, but
+ * bypasses OAuth/Max onto retail billing, defeating the point of dario.
+ */
+export function ignoreCcCredentials(env = process.env) {
+    const v = (env['DARIO_IGNORE_CC_CREDENTIALS'] ?? '').trim().toLowerCase();
+    return v === '1' || v === 'true' || v === 'yes' || v === 'on';
+}
+/**
+ * Which credential sources loadCredentials() consults, given whether the
+ * interactive Claude Code session's credentials should be ignored. Exported so
+ * the isolation guarantee is testable without real credentials on disk.
+ *
+ * `readKeychain` gates the OS keychain the same way as the CC file: the modern
+ * CC binary stores its OAuth token in the keychain, not on disk, so isolating
+ * from the interactive session means skipping BOTH.
+ */
+export function credentialSourcePlan(ignoreCc) {
+    return ignoreCc
+        ? { filePaths: [getDarioCredentialsPath()], readKeychain: false }
+        : { filePaths: [getDarioCredentialsPath(), getClaudeCodeCredentialsPath()], readKeychain: true };
+}
 function getClaudeCodeCredentialsPath() {
     return join(homedir(), '.claude', '.credentials.json');
 }
@@ -362,8 +399,15 @@ export async function loadCredentials() {
     // work the way it did before any `dario login` had ever run, while
     // still preferring dario's own file when both sources are equivalent
     // (dario file wins ties on expiresAt by being checked first).
+    //
+    // DARIO_IGNORE_CC_CREDENTIALS narrows the source set to dario's OWN file
+    // only — never the interactive CC session's token (its file OR the keychain).
+    // See ignoreCcCredentials() / credentialSourcePlan() for why: on a machine
+    // shared with a live `claude` session, grabbing + refreshing CC's token here
+    // rotates it out from under that session.
+    const plan = credentialSourcePlan(ignoreCcCredentials());
     const candidates = [];
-    for (const path of [getDarioCredentialsPath(), getClaudeCodeCredentialsPath()]) {
+    for (const path of plan.filePaths) {
         try {
             const raw = await readFile(path, 'utf-8');
             const parsed = JSON.parse(raw);
@@ -374,9 +418,11 @@ export async function loadCredentials() {
         catch { /* try next */ }
     }
     // OS keychain (modern CC stores credentials here, not on disk).
-    const keychainCreds = await loadKeychainCredentials();
-    if (keychainCreds?.claudeAiOauth?.accessToken && keychainCreds?.claudeAiOauth?.refreshToken) {
-        candidates.push(keychainCreds);
+    if (plan.readKeychain) {
+        const keychainCreds = await loadKeychainCredentials();
+        if (keychainCreds?.claudeAiOauth?.accessToken && keychainCreds?.claudeAiOauth?.refreshToken) {
+            candidates.push(keychainCreds);
+        }
     }
     const best = pickFreshestCredentials(candidates);
     if (!best)

package/dist/proxy.js

@@ -5,7 +5,7 @@ import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { setDefaultResultOrder } from 'node:dns';
 import { arch, platform } from 'node:process';
-import { getAccessToken, getStatus } from './oauth.js';
+import { getAccessToken, getStatus, ignoreCcCredentials } from './oauth.js';
 import { buildHealthResponse, derivePoolStatus, shouldDiscloseHealthInternals } from './health-response.js';
 import { darioVersion } from './version.js';
 import { buildCCRequest, applyCcPromptCaching, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, forwardClientCCIdentityHeaders, isMcpToolName, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
@@ -962,6 +962,8 @@ export async function startProxy(opts = {}) {
     const upstreamApiKey = (opts.upstreamApiKey ?? process.env.ANTHROPIC_UPSTREAM_API_KEY ?? '').trim();
     if (upstreamApiKey)
         console.error('[dario] upstream auth: per-token API key (x-api-key) — OAuth/Max + account pool bypassed');
+    else if (ignoreCcCredentials())
+        console.error("[dario] DARIO_IGNORE_CC_CREDENTIALS: using ONLY dario's own credentials.json — Claude Code session token + keychain ignored (won't rotate a live `claude` session; run `dario login` if not authed)");
     // DNS result order — prefer IPv4 for the Anthropic upstream by default.
     // api.anthropic.com publishes both A and AAAA records. In a container with
     // no IPv6 egress (e.g. a default Docker bridge network), Node's `verbatim`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "5.4.24",
+  "version": "5.4.26",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {