@askalf/dario 5.5.67 → 5.5.68

package/dist/accounts.js

@@ -23,7 +23,7 @@ import { homedir } from 'node:os';
 import { randomUUID, randomBytes, createHash } from 'node:crypto';
 import { createServer } from 'node:http';
 import { detectCCOAuthConfig } from './cc-oauth-detect.js';
-import { loadCredentials, saveCredentialsTokens, buildManualAuthorizeUrl, parseManualPaste, readLineFromStdin, enumerateKeychainCredentials } from './oauth.js';
+import { loadCredentials, saveCredentialsTokens, buildManualAuthorizeUrl, parseManualPaste, readLineFromStdin, enumerateKeychainCredentials, tokenRefreshDisabled, refreshDisabledError } from './oauth.js';
 import { openBrowser } from './open-browser.js';
 import { redactSecrets } from './redact.js';
 import { durableWriteFile } from './durable-write.js';
@@ -137,6 +137,12 @@ export async function detectClaudeIdentity() {
 const accountRefreshesInFlight = new Map();
 /** Refresh an account's OAuth token using dario's auto-detected CC OAuth config. */
 export async function refreshAccountToken(creds) {
+    // Borrow-don't-rotate: the pool path needs the same guard as the legacy one
+    // in oauth.ts, and for the same reason — a rotation here logs out every
+    // other holder of this account. Guarding only one of the two paths would
+    // leave the hole open for whichever store the process happens to load.
+    if (tokenRefreshDisabled())
+        throw refreshDisabledError();
     const inFlight = accountRefreshesInFlight.get(creds.alias);
     if (inFlight)
         return inFlight;

package/dist/oauth.d.ts

@@ -188,6 +188,31 @@ export declare function readLineFromStdin(prompt: string): Promise<string>;
  * doomed retries and masking as healthy.
  */
 export declare function isTerminalRefreshFailure(status: number, body: string): boolean;
+/**
+ * Borrow-don't-rotate mode. `DARIO_NO_TOKEN_REFRESH=1` makes every refresh
+ * path throw instead of rotating.
+ *
+ * WHY THIS EXISTS. Anthropic invalidates the previous refresh_token on every
+ * refresh (see the distributed-lock note in accounts.ts). So a process that
+ * merely READS a shared credential store is harmless, but the moment it
+ * refreshes, whatever else holds that token — a production proxy, another
+ * box — is silently logged out. Copying the file first does not help: the
+ * rotation happens upstream, so the copy invalidates the original too.
+ *
+ * That is not hypothetical. On 2026-08-25 a CI job on the self-hosted runner
+ * started a proxy against the shared store, refreshed it, and took the fleet
+ * down for roughly three hours with `invalid_grant`. The runner shares a box
+ * with prod and `/root/.dario` is a symlink into prod's store, so "just point
+ * HOME somewhere else" only helps when the job needs no real auth at all.
+ *
+ * Jobs that genuinely need subscription OAuth (the billing-classifier canary
+ * cannot use an API key — an API key IS the other billing bucket, so it would
+ * test the wrong thing) can now borrow the credential read-only: requests work
+ * for as long as the access token is valid, and an expiry fails LOUDLY here
+ * rather than quietly rotating a token that production is holding.
+ */
+export declare function tokenRefreshDisabled(env?: NodeJS.ProcessEnv): boolean;
+export declare function refreshDisabledError(): Error;
 export declare function refreshTokens(): Promise<OAuthTokens>;
 /**
  * Get a valid access token, refreshing if needed.

package/dist/oauth.js

@@ -769,7 +769,41 @@ export async function readLineFromStdin(prompt) {
 export function isTerminalRefreshFailure(status, body) {
     return status === 401 || status === 403 || /invalid_grant/i.test(body);
 }
+/**
+ * Borrow-don't-rotate mode. `DARIO_NO_TOKEN_REFRESH=1` makes every refresh
+ * path throw instead of rotating.
+ *
+ * WHY THIS EXISTS. Anthropic invalidates the previous refresh_token on every
+ * refresh (see the distributed-lock note in accounts.ts). So a process that
+ * merely READS a shared credential store is harmless, but the moment it
+ * refreshes, whatever else holds that token — a production proxy, another
+ * box — is silently logged out. Copying the file first does not help: the
+ * rotation happens upstream, so the copy invalidates the original too.
+ *
+ * That is not hypothetical. On 2026-08-25 a CI job on the self-hosted runner
+ * started a proxy against the shared store, refreshed it, and took the fleet
+ * down for roughly three hours with `invalid_grant`. The runner shares a box
+ * with prod and `/root/.dario` is a symlink into prod's store, so "just point
+ * HOME somewhere else" only helps when the job needs no real auth at all.
+ *
+ * Jobs that genuinely need subscription OAuth (the billing-classifier canary
+ * cannot use an API key — an API key IS the other billing bucket, so it would
+ * test the wrong thing) can now borrow the credential read-only: requests work
+ * for as long as the access token is valid, and an expiry fails LOUDLY here
+ * rather than quietly rotating a token that production is holding.
+ */
+export function tokenRefreshDisabled(env = process.env) {
+    return env.DARIO_NO_TOKEN_REFRESH === '1';
+}
+export function refreshDisabledError() {
+    return new Error('token refresh is disabled (DARIO_NO_TOKEN_REFRESH=1) and the access token needs renewing. ' +
+        'This process is borrowing a shared credential read-only: refreshing would rotate the token ' +
+        'out from under whoever else holds it. Re-run once the credential owner has refreshed, or ' +
+        'unset DARIO_NO_TOKEN_REFRESH if this process is the owner.');
+}
 export async function refreshTokens() {
+    if (tokenRefreshDisabled())
+        throw refreshDisabledError();
     // Prevent concurrent refreshes — if one is already in progress, wait for it
     if (refreshInProgress)
         return refreshInProgress;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "5.5.67",
+  "version": "5.5.68",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
   "type": "module",
   "bin": {