@askalf/dario 6.12.25 → 6.12.27

package/dist/accounts.js

@@ -526,7 +526,7 @@ export async function addAccountViaOAuth(alias) {
                     grantedAt: Date.now(),
                     ...profileFields(profile),
                 };
-                await saveAccount(creds);
+                await saveGrantedAccount(creds);
                 resolve(creds);
             }
             catch (err) {
@@ -663,7 +663,7 @@ export async function completeAddAccount(alias, code, codeVerifier, state) {
         grantedAt: Date.now(),
         ...profileFields(profile),
     };
-    await saveAccount(creds);
+    await saveGrantedAccount(creds);
     return creds;
 }
 export function getAccountsDir() {
@@ -935,3 +935,22 @@ export async function mirrorLoginToCredentials(refreshed) {
     });
     return 'mirrored';
 }
+/**
+ * Save an account that an OAuth grant has just produced.
+ *
+ * A grant on the `login` alias is mirrored to credentials.json at once.
+ * mirrorLoginToCredentials otherwise runs only when the pool next refreshes
+ * the seat, which is hours away after a grant, and until then every other
+ * reader of credentials.json (a co-resident Claude Code, a runner that borrows
+ * the file) holds the token of the grant that was just replaced. After a
+ * re-grant of a dead seat that token is refused upstream.
+ *
+ * Best-effort, like the mirror after a refresh: the account is already saved,
+ * and a mirror that fails must not fail the grant.
+ */
+async function saveGrantedAccount(creds) {
+    await saveAccount(creds);
+    await mirrorLoginToCredentials(creds).catch((err) => {
+        console.error(`[dario] could not mirror the granted ${creds.alias} token to credentials.json: ${err instanceof Error ? err.message : err}`);
+    });
+}

package/dist/live-fingerprint.d.ts

@@ -510,7 +510,7 @@ export declare function detectDrift(t: TemplateData, installedOverride?: string
  */
 export declare const SUPPORTED_CC_RANGE: {
     readonly min: "1.0.0";
-    readonly maxTested: "2.1.289";
+    readonly maxTested: "2.1.290";
 };
 /**
  * Compare two dotted-numeric version strings. Returns negative if `a<b`,

package/dist/live-fingerprint.js

@@ -1211,7 +1211,7 @@ export function detectDrift(t, installedOverride) {
  */
 export const SUPPORTED_CC_RANGE = {
     min: '1.0.0',
-    maxTested: '2.1.289',
+    maxTested: '2.1.290',
 };
 /**
  * Compare two dotted-numeric version strings. Returns negative if `a<b`,

package/docs/drift-monitor.md

@@ -67,6 +67,10 @@ fields that always differ between runs (`_captured` timestamp, user-agent
 string, `_version` / `_supportedMaxTested` labels). It flags **shape** drift in:
 
 - **tools** added or removed (by name set)
+- **tool descriptions, input schemas and order** for tools on both sides
+- **header values** the proxy replays (not `user-agent`, which carries the
+  version, and not `x-api-key`, `x-stainless-os` or `x-stainless-arch`, which
+  describe the capture)
 - **anthropic_beta** header values added or removed
 - **system_prompt** content (any character delta)
 - **body_field_order** (top-level JSON key order)
@@ -95,7 +99,7 @@ That exact sequence reached the ship gate on 2026-07-02 (PR #632: runner CC at
 older. A *deliberate* downgrade bake (an upstream CC release gets pulled and
 the bundle must go backward) bypasses it with `--allow-older-cc`.
 
-### Exit 2 vs exit 3 — why the split, and why only one auto-merges
+### Exit 2 vs exit 3: why the split, and what each needs to merge
 
 Because `--check` ignores `_version`, a CC release whose wire shape is
 *unchanged* (the common case for a patch bump) produces a bundle whose shape
@@ -114,8 +118,8 @@ user-agent header) — never the wire shape — patch-bumps `package.json`,
 promotes the CHANGELOG, opens a `bot/template-label-*` PR, and turns on
 **auto-merge**.
 
-Auto-merge is safe for exit 3 but **not** for exit 2: an empty `computeDrift`
-means the live capture shows no difference in the fields listed under
+An exit 3 PR merges on the review and the required checks alone: an empty
+`computeDrift` means the live capture shows no difference in the fields listed under
 [What --check considers drift](#what---check-considers-drift). It is not a
 byte comparison: tools are compared by name only (descriptions and schemas
 of existing tools are not), the memory path in the system prompt is
@@ -126,7 +130,68 @@ same deterministic-bump risk class `cc-drift-watch.yml` already auto-merges for
 (build ×3, live-test, CodeQL, actionlint, validate-package-json); compat runs
 alongside but is not required. A red required check leaves the PR open
 with the bot branch preserved. A shape rebake (exit 2) changes the wire-shape
-contract, so a human reviews compat-test + the diff before merging.
+contract, so it needs one thing more before it merges: the upstream check
+described under [The rebake PR](#the-rebake-pr) has to have passed on the
+bundle the PR's head carries. A rebake whose check failed waits for a person.
+
+## The rebake PR
+
+On exit 2 the watcher bakes, checks the new bundle against upstream, and opens a
+`bot/template-rebake-*` PR. Three things about that PR come from the bake itself
+and not from the `--check` log:
+
+- **What changes.** `scripts/rebake-release-prep.mjs` diffs the bundle on the
+  base branch against the baked one (`describeBundleChange` in
+  `scripts/drift-report.mjs`) and writes both the CHANGELOG entry and the PR's
+  list from it. The bake writes the whole capture, and `--check` compares the
+  tools and the replayed header values as well as their order. Those texts
+  say what the bundle holds. What a request carries also depends on the proxy,
+  which prefers a fresh live capture, sets some headers itself and manages some
+  beta flags per request.
+- **Validation.** `scripts/rebake-upstream-check.mjs` starts the checkout's
+  proxy in code (`scripts/_rebake-probe-proxy.mjs`), with the bundle as its
+  only template and the proxy's own defaults for building a request: the
+  caller's `DARIO_*` and `ANTHROPIC_*` variables and `~/.dario/config.json`
+  take no part. It sends one request for the base model and for each
+  prompt-variant family. Each request declares, by name, the bundled tools
+  whose definitions the request builder uses, so the rebuilt request carries
+  those definitions and the bundled prompt for its model. The proxy records
+  the `/v1/messages` requests it sends upstream, and the
+  script reads that record: a request that lacks the bundled prompt or a
+  declared tool's bundled definition makes the run an error, not a verdict. A
+  request passes when upstream answers 200 and bills it to the subscription,
+  and fails when upstream rejects it or bills it elsewhere. The proxy can send
+  a request again, on another seat or changed after upstream refused part of
+  it, and the last answer is the one judged. A probe the proxy did not answer
+  is an error too, and so is one the proxy answered itself for a reason that
+  is not about a seat.
+  The script borrows the subscription credential read-only
+  (`DARIO_NO_TOKEN_REFRESH=1`). A PR is opened only with a verdict, pass or
+  fail: the result is in the PR body and on the bundle's commit as the
+  `rebake/upstream` status, and a failed check adds the `upstream-check-failed`
+  label. When upstream did not judge a request (it refused the borrowed
+  token, rate-limited, failed or did not answer), or the proxy had no seat to
+  send one with (a borrowed token inside its expiry margin, or a seat inside a
+  rate-limit window), no PR is opened and the next run bakes and checks again.
+  On an error the watcher's job fails.
+- **Freshness.** A bake is a snapshot, and Claude Code's remote configuration
+  moves under a fixed version. An open rebake PR older than two hours is checked
+  against live on every watcher run, with its own bundle as the baseline. It is
+  closed, with what the check reported, when two captures in a row report drift
+  and neither is the #881 residue. A fresh bake follows when live also differs
+  from master; when live has returned to master's shape there is nothing to
+  bake. While such a PR is open each run makes one more capture pass, and a
+  second when the first reports drift.
+
+The platform review gate merges the PR once the review approves it at its
+head, the required checks pass, and the `rebake/upstream` status is a pass on a
+commit of the PR whose `src/cc-template-data.json` is the one the head carries.
+A failed check, or a bundle changed after the check, leaves the merge to a
+person.
+
+The bundle is captured from Claude Code and scrubbed by the bake. The prompts
+and tool descriptions in it are Claude Code's wording and are not edited for
+style in review: a change to them comes from a bake.
 
 ## Setting up the self-hosted runner
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.12.25",
+  "version": "6.12.27",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, with automatic failover when one hits its limit.",
   "type": "module",
   "bin": {
@@ -87,7 +87,7 @@
     "node": ">=18.0.0"
   },
   "devDependencies": {
-    "@types/node": "^26.6.2",
+    "@types/node": "^26.6.4",
     "tsx": "^4.23.15",
     "typescript": "^5.7.0"
   }