@askalf/dario 6.18.2 → 6.18.3

package/README.md

@@ -1,6 +1,6 @@
 <div align="center">
 
-<img src=".github/readme/hero.jpg" alt="dario routes every AI tool you use to the subscriptions you already pay for. Claude Code, Cursor, Cline, Aider, Codex CLI and the Agent SDK send requests to dario at localhost:3456, which forwards each one to your Claude plan or your ChatGPT plan and fails over between them on a 429." width="100%">
+<img src=".github/readme/hero.jpg" alt="dario routes every AI tool you use to the subscriptions you already pay for. Claude Code, Cursor, Cline, Aider, Codex CLI and the Agent SDK send requests to dario at localhost:3456, which forwards each one to your Claude plan or your ChatGPT plan and, with a fallback chain configured, fails over between them on a 429." width="100%">
 
 # `dario`
 
@@ -51,12 +51,12 @@ Prefer Homebrew? `brew install askalf/tap/dario` installs the same npm release t
 
 - **Every tool, one URL.** No per-tool keys and no second bill: anything with a base-URL setting runs on the plan you already pay for. [Per-tool setup](docs/tools.md)
 - **Knows who paid.** A ledger prices every request at API rates and splits it by plan, by key and by model: what the seats absorbed, what went to extra usage or an API key. In the TUI, the dashboard at `/analytics/ui`, `/analytics`, Prometheus `/metrics` and `dario usage`. [Analytics](docs/pool-keys-and-analytics.md#what-it-would-have-cost)
-- **Spends the plan before the meter.** Seats with headroom first, then the `--pool-fallback` chain you configure: the other plan on a 429, a metered rung last (your Max plan's API credits through a Console key, or an openai-compat backend). No chain means no substitution, a drained pool returns its honest 429. Nothing is swapped silently: every substituted response says so in a header. [Failover](docs/two-plans.md#failover-between-subscriptions)
+- **Spends the plan before the meter.** Seats with headroom first, then the `--pool-fallback` chain you configure: the other plan on a 429, a metered rung last (your Max plan's API credits through a Console key, or an openai-compat backend). No chain means no substitution, a drained pool returns its honest 429. When one model family is parked but the seat still has room, `--family-fallback=fable=claude-opus-5-5` serves it as another Claude model instead of a 429 ([how](docs/multi-account-pool.md#family-fallback)). Nothing is swapped silently: every substituted response says so in a header. [Failover](docs/two-plans.md#failover-between-subscriptions)
 - **Either plan, either wire shape.** Your ChatGPT plan behind Claude Code and the Anthropic SDKs; Codex CLI on your Claude plan. [Two plans](docs/two-plans.md)
-- **Failover that finishes the answer.** A 429 on one plan is re-served by the other, and a stream that dies mid-answer is completed on the same model first. [Failover](docs/two-plans.md#failover-between-subscriptions)
-- **Many seats, one endpoint.** Per-model headroom routing, session-sticky prompt cache, in-flight 429 failover across every seat you hold. New conversations go to the seat with the most headroom by default; `--pool-strategy=fill-first` fills seats in alias order and `expiring-first` spends the seat whose weekly window resets soonest. The active strategy shows in the startup banner, `GET /status`, `dario doctor` and `dario accounts list`. [The pool](docs/pool-keys-and-analytics.md)
-- **One key per developer.** Named keys with a preferred seat, a model allowlist and a daily budget. [Keys](docs/pool-keys-and-analytics.md#one-key-per-developer)
-- **Tracks Claude Code on its own.** Eleven unattended watchers catch wire-shape drift and ship the fix, usually the same day. [Drift](docs/tracking-claude-code.md)
+- **Failover that finishes the answer.** With a `--pool-fallback` chain, a 429 on one plan is re-served by the other. A stream that dies mid-answer is completed on the same model first, chain or not. [Failover](docs/two-plans.md#failover-between-subscriptions)
+- **Many seats, one endpoint.** Per-model headroom routing, session-sticky prompt cache, in-flight 429 failover across every seat you hold. New conversations go to the seat with the most headroom by default; `--pool-strategy=fill-first` fills seats in alias order, `expiring-first` spends the seat whose weekly window resets soonest, and `headroom-by-plan` counts each seat's headroom by its plan size. The active strategy shows in the startup banner, `GET /status`, `dario doctor` and `dario accounts list`. [The pool](docs/pool-keys-and-analytics.md)
+- **One key per developer.** Named keys with a preferred seat, a model allowlist and a daily budget. A CI job or a sandboxed agent can be a key with no secret to hold: `--key-socket` binds a unix socket to one key ([key sockets](docs/keys.md#a-key-with-no-secret-key-sockets)). [Keys](docs/pool-keys-and-analytics.md#one-key-per-developer)
+- **Tracks Claude Code on its own.** Ten unattended watchers catch wire-shape drift and ship the fix, usually the same day. [Drift](docs/tracking-claude-code.md)
 - **Stops before it costs you.** The overage guard halts the proxy the moment a response bills outside your subscription. [Guardrails](docs/guardrails.md)
 - **Your traffic as the benchmark.** Shadow-compare any request against another model and read the results with `dario compare`. [Shadow compare](docs/two-plans.md#shadow-compare)
 
@@ -113,13 +113,13 @@ dario runs entirely on your machine, authenticates as you with your own Claude l
 
 | Signal | Status |
 |---|---|
-| Source | **~42k** lines of TypeScript across **85** files, auditable in a weekend. One credential path since v5: the pool. |
+| Source | **~42k** lines of TypeScript across **87** files, auditable in a weekend. One credential path since v5: the pool. |
 | Dependencies | **0 runtime.** Verify: `npm ls --production` |
 | Provenance | Every release [SLSA-attested](https://www.npmjs.com/package/@askalf/dario) via GitHub Actions + Sigstore, published with OIDC trusted publishing: no long-lived npm token exists to leak |
 | Scanning | [CodeQL](https://github.com/askalf/dario/actions/workflows/codeql.yml) on every push to master, every PR and weekly · [ClusterFuzzLite](./.github/workflows/cflite.yml) fuzzes the SSE translator, the rejection parsers and the cch stamper weekly · the [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/askalf/dario) badge above and the [Best Practices](https://www.bestpractices.dev/projects/13638) entry are live |
-| Tests | **241 test files** run in parallel by `npm test` on Node 18, 20 and 22; the live e2e / compat / stealth suites have their own entry points. Green on every release |
+| Tests | **282 test files** run in parallel by `npm test` on Node 18, 20 and 22; the live e2e / compat / stealth suites have their own entry points. Green on every release |
 | Credentials | Your own subscription tokens, never logged, redacted from errors, `0600` on disk in `0700` dirs |
-| Network | Binds `127.0.0.1` by default; upstream only to configured backends over HTTPS; hardcoded SSRF allow-list; refuses a non-loopback bind without `DARIO_API_KEY` |
+| Network | Binds `127.0.0.1` by default; upstream only to configured backends over HTTPS; hardcoded SSRF allow-list; refuses a non-loopback bind without `DARIO_API_KEY`; refuses cross-origin and DNS-rebound browser requests |
 | Telemetry | **None.** No analytics, no tracking, nothing phones home |
 | Overhead | Measured in the open on every PR: [`scripts/bench-overhead.mjs`](./scripts/bench-overhead.mjs) runs a real proxy against an instant upstream beside a bare http server serving the same bytes. On loopback dario adds no measurable p50 wall time over that floor; the CPU per request is the number to watch, and the per-request [timing split](./docs/analytics.md#the-timing-split) shows it live |
 | This README | CI fails if the line count above drifts from `src/` or a link or anchor here stops resolving ([`check-readme-line-count.mjs`](./scripts/check-readme-line-count.mjs), [`check-readme-links.mjs`](./scripts/check-readme-links.mjs)); the TUI screenshots are rendered from the real TUI and the diagrams are briefed art, not screenshots ([how](./scripts/readme/README.md)) |
@@ -136,6 +136,7 @@ Security reports go to **security@askalf.org**, not a public issue: [SECURITY.md
 
 - [Claude Code wire drift](https://askalf.github.io/dario/drift-feed/): every change to what Claude Code sends on the wire, as the template watcher observed it; [RSS](https://askalf.github.io/dario/drift-feed/feed.xml) · [JSON Feed](https://askalf.github.io/dario/drift-feed/feed.json)
 
+- [#1017: Will my account get suspended? What is actually observable, and how to monitor it yourself](https://github.com/askalf/dario/discussions/1017)
 - [#183: Modifying Claude Code's system prompt doesn't change billing; stripping its constraints recovers 1.2–2.8× output](https://github.com/askalf/dario/discussions/183)
 - [#68: dario vs LiteLLM / OpenRouter / Kong AI Gateway (when each wins)](https://github.com/askalf/dario/discussions/68)
 - [#14: Template replay: why we replay the shape instead of matching signals](https://github.com/askalf/dario/discussions/14)
@@ -151,7 +152,7 @@ PRs welcome. Small TypeScript codebase, zero runtime deps. Architecture, file-by
 git clone https://github.com/askalf/dario && cd dario
 npm install
 npm run dev    # tsx, no build step
-npm test       # 241 files in parallel via test/all.test.mjs
+npm test       # 282 files in parallel via test/all.test.mjs
 npm run e2e    # live proxy + OAuth (needs a working Claude backend)
 ```
 
@@ -206,6 +207,9 @@ Two easy ways to help beyond code: **star the repo**, the clearest signal this i
 | [@robincle](https://github.com/robincle) | Utilisation freshness: `lastObservedAt` / `utilAgeMs` on `/accounts` ([#1032](https://github.com/askalf/dario/issues/1032)), the documented way out of a parked pool ([#1282](https://github.com/askalf/dario/issues/1282)) |
 | [@anupamme](https://github.com/anupamme) | Refresh-lock ownership by server-issued lock id ([#1059](https://github.com/askalf/dario/pull/1059)) |
 | [@LiveNathan](https://github.com/LiveNathan) | Never send or stamp empty text blocks ([#1067](https://github.com/askalf/dario/pull/1067)), empty final user turn from CC's stream-interruption retry ([#1092](https://github.com/askalf/dario/issues/1092), as [@NathanLively](https://github.com/NathanLively)) |
+| [@dizzystuff](https://github.com/dizzystuff) | Fable's weekly allowance arrives as `7d_oi`, not `7d_fable`, so headroom now counts it ([#1262](https://github.com/askalf/dario/issues/1262)) |
+| [@ZQiannnn](https://github.com/ZQiannnn) | Fable `input_schema.type` 400 on every request, with a full reproduction and the confirmed fix ([#1376](https://github.com/askalf/dario/issues/1376)) |
+| [@andrewmalov](https://github.com/andrewmalov) | Hard-park seats at the headroom floor ([#1450](https://github.com/askalf/dario/pull/1450)) |
 
 ### Sponsors
 

package/dist/browser-guard.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Browser request guard: keeps a web page from using a proxy it can reach.
+ * A tab on any site can reach 127.0.0.1, and CORS only stops a page from
+ * reading a response, not from sending a `no-cors` request in the first place.
+ *
+ * isCrossOriginAllowed refuses a state-changing request a page on another
+ * origin sent. Same algorithm as Go's net/http CrossOriginProtection: GET,
+ * HEAD and OPTIONS pass (a cross-origin page cannot read their responses),
+ * `Sec-Fetch-Site: same-origin | none` passes, an `Origin` on the trusted list
+ * passes, any other `Sec-Fetch-Site` is refused, and a browser that predates
+ * `Sec-Fetch-Site` falls back to comparing `Origin` with `Host`. It reads only
+ * headers a page cannot forge, and applies only to a request carrying one of
+ * them (isBrowserRequest): SDKs, curl and CLI clients send neither. Node's
+ * fetch sends `Sec-Fetch-Mode: cors`, so nothing here reads `Sec-Fetch-Mode`.
+ *
+ * isHostAllowed closes DNS rebinding. A page on attacker.example whose name is
+ * re-pointed at 127.0.0.1 is same-origin with the proxy as far as the browser
+ * knows, so the origin check passes it and the page can read every response.
+ * Its requests still carry `Host: attacker.example`, so a request must name the
+ * proxy by a host that cannot be rebound: localhost, a *.localhost name
+ * (browsers resolve those to loopback without DNS), an IP literal (no DNS to
+ * re-point), the bind host, or the host of a trusted origin. This check cannot
+ * wait for a browser header: browsers send `Sec-Fetch-Site` only to a
+ * trustworthy URL, which http://attacker.example is not, and a same-origin GET
+ * carries no `Origin`, so a rebound GET looks exactly like curl.
+ *
+ * The host check only matters where an absent credential is served, i.e. no
+ * DARIO_API_KEY. With the key set, a rebinding page never holds it and gets
+ * the same 401 as anyone else, so a keyed proxy behind a tunnel hostname keeps
+ * serving without listing that hostname anywhere.
+ */
+type Headers = Record<string, string | string[] | undefined>;
+/**
+ * Lower-cased `scheme://host[:port]` with no trailing slash, the form a
+ * browser's `Origin` header takes. An http(s) origin goes through URL so a
+ * default port or trailing slash in DARIO_CORS_ORIGIN still matches. Other
+ * schemes (`chrome-extension://<id>`) have an opaque URL origin, so they are
+ * compared as written. `null` (sandboxed frames, file: pages) stays `null` so
+ * an operator can trust it explicitly. Anything else returns undefined and is
+ * never trusted.
+ */
+export declare function normalizeOrigin(origin: string): string | undefined;
+/** The hostname of a `Host` header, port dropped and lower-cased; `[::1]` keeps its brackets. */
+export declare function hostnameOf(host: string | undefined): string | undefined;
+/** Whether the request carries a header only a browser sets. */
+export declare function isBrowserRequest(headers: Headers): boolean;
+/**
+ * The trusted origin list: the CORS origin dario already advertises.
+ * Unparseable entries drop out instead of matching anything.
+ */
+export declare function trustedOriginSet(origins: string[]): Set<string>;
+export declare function isCrossOriginAllowed(method: string | undefined, headers: Headers, trusted: Set<string>): boolean;
+/** Host names a request may use to reach an unkeyed proxy, besides *.localhost and IP literals. */
+export declare function allowedHosts(trusted: Set<string>, bindHost: string | undefined): Set<string>;
+export declare function isHostAllowed(headers: Headers, allowed: Set<string>): boolean;
+export {};

package/dist/browser-guard.js

@@ -0,0 +1,147 @@
+/**
+ * Browser request guard: keeps a web page from using a proxy it can reach.
+ * A tab on any site can reach 127.0.0.1, and CORS only stops a page from
+ * reading a response, not from sending a `no-cors` request in the first place.
+ *
+ * isCrossOriginAllowed refuses a state-changing request a page on another
+ * origin sent. Same algorithm as Go's net/http CrossOriginProtection: GET,
+ * HEAD and OPTIONS pass (a cross-origin page cannot read their responses),
+ * `Sec-Fetch-Site: same-origin | none` passes, an `Origin` on the trusted list
+ * passes, any other `Sec-Fetch-Site` is refused, and a browser that predates
+ * `Sec-Fetch-Site` falls back to comparing `Origin` with `Host`. It reads only
+ * headers a page cannot forge, and applies only to a request carrying one of
+ * them (isBrowserRequest): SDKs, curl and CLI clients send neither. Node's
+ * fetch sends `Sec-Fetch-Mode: cors`, so nothing here reads `Sec-Fetch-Mode`.
+ *
+ * isHostAllowed closes DNS rebinding. A page on attacker.example whose name is
+ * re-pointed at 127.0.0.1 is same-origin with the proxy as far as the browser
+ * knows, so the origin check passes it and the page can read every response.
+ * Its requests still carry `Host: attacker.example`, so a request must name the
+ * proxy by a host that cannot be rebound: localhost, a *.localhost name
+ * (browsers resolve those to loopback without DNS), an IP literal (no DNS to
+ * re-point), the bind host, or the host of a trusted origin. This check cannot
+ * wait for a browser header: browsers send `Sec-Fetch-Site` only to a
+ * trustworthy URL, which http://attacker.example is not, and a same-origin GET
+ * carries no `Origin`, so a rebound GET looks exactly like curl.
+ *
+ * The host check only matters where an absent credential is served, i.e. no
+ * DARIO_API_KEY. With the key set, a rebinding page never holds it and gets
+ * the same 401 as anyone else, so a keyed proxy behind a tunnel hostname keeps
+ * serving without listing that hostname anywhere.
+ */
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+function headerOf(headers, name) {
+    const v = headers[name];
+    return Array.isArray(v) ? v[0] : v;
+}
+/**
+ * Lower-cased `scheme://host[:port]` with no trailing slash, the form a
+ * browser's `Origin` header takes. An http(s) origin goes through URL so a
+ * default port or trailing slash in DARIO_CORS_ORIGIN still matches. Other
+ * schemes (`chrome-extension://<id>`) have an opaque URL origin, so they are
+ * compared as written. `null` (sandboxed frames, file: pages) stays `null` so
+ * an operator can trust it explicitly. Anything else returns undefined and is
+ * never trusted.
+ */
+export function normalizeOrigin(origin) {
+    let o = origin.trim().toLowerCase();
+    // A loop, not /\/+$/: that regex backtracks quadratically on a long run of
+    // slashes, and the Origin header is caller-controlled.
+    while (o.endsWith('/'))
+        o = o.slice(0, -1);
+    if (o === 'null')
+        return o;
+    if (/^https?:\/\//.test(o)) {
+        try {
+            return new URL(o).origin;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return /^[a-z][a-z0-9+.-]*:\/\/[^/\s]+$/.test(o) ? o : undefined;
+}
+function httpHostOf(origin) {
+    return /^https?:\/\//.test(origin) ? new URL(origin) : undefined;
+}
+/** The hostname of a `Host` header, port dropped and lower-cased; `[::1]` keeps its brackets. */
+export function hostnameOf(host) {
+    if (!host)
+        return undefined;
+    const h = host.trim().toLowerCase();
+    if (h.startsWith('[')) {
+        const end = h.indexOf(']');
+        return end === -1 ? undefined : h.slice(0, end + 1);
+    }
+    const colon = h.indexOf(':');
+    if (colon === -1)
+        return h;
+    // More than one colon unbracketed is not a valid Host.
+    return h.indexOf(':', colon + 1) === -1 ? h.slice(0, colon) : undefined;
+}
+/** Whether the request carries a header only a browser sets. */
+export function isBrowserRequest(headers) {
+    return headerOf(headers, 'sec-fetch-site') !== undefined || headerOf(headers, 'origin') !== undefined;
+}
+/**
+ * The trusted origin list: the CORS origin dario already advertises.
+ * Unparseable entries drop out instead of matching anything.
+ */
+export function trustedOriginSet(origins) {
+    const out = new Set();
+    for (const o of origins) {
+        const n = normalizeOrigin(o);
+        if (n)
+            out.add(n);
+    }
+    return out;
+}
+export function isCrossOriginAllowed(method, headers, trusted) {
+    if (SAFE_METHODS.has((method ?? '').toUpperCase()))
+        return true;
+    const site = headerOf(headers, 'sec-fetch-site')?.toLowerCase();
+    if (site === 'same-origin' || site === 'none')
+        return true;
+    const origin = headerOf(headers, 'origin');
+    const normalized = origin === undefined ? undefined : normalizeOrigin(origin);
+    if (normalized !== undefined && trusted.has(normalized))
+        return true;
+    // A browser that sends Sec-Fetch-Site said cross-site or same-site here.
+    if (site !== undefined)
+        return false;
+    // Neither header: not a browser, or one too old to send either on a POST.
+    if (origin === undefined)
+        return true;
+    const url = normalized === undefined ? undefined : httpHostOf(normalized);
+    const host = headerOf(headers, 'host')?.trim().toLowerCase();
+    return url !== undefined && host !== undefined && url.host === host;
+}
+/** Host names a request may use to reach an unkeyed proxy, besides *.localhost and IP literals. */
+export function allowedHosts(trusted, bindHost) {
+    const out = new Set(['localhost']);
+    for (const o of trusted) {
+        const url = httpHostOf(o);
+        if (url)
+            out.add(url.hostname);
+    }
+    if (bindHost) {
+        const h = bindHost.trim().toLowerCase();
+        out.add(h.includes(':') && !h.startsWith('[') ? `[${h}]` : h);
+    }
+    return out;
+}
+const IPV4_LITERAL = /^\d{1,3}(\.\d{1,3}){3}$/;
+export function isHostAllowed(headers, allowed) {
+    const host = headerOf(headers, 'host');
+    // A browser always sends Host, so a request without one is not a rebound page.
+    if (host === undefined)
+        return true;
+    const name = hostnameOf(host);
+    if (name === undefined)
+        return false;
+    if (allowed.has(name))
+        return true;
+    if (name.endsWith('.localhost'))
+        return true;
+    return IPV4_LITERAL.test(name) || name.startsWith('[');
+}

package/dist/proxy.js

@@ -9,6 +9,7 @@ import { arch, platform } from 'node:process';
 import { FAMILY_BETA_DROPS } from './beta-family-drops.js';
 import { getAccessToken, getStatus, ignoreCcCredentials } from './oauth.js';
 import { buildHealthResponse, derivePoolStatus, probeRequested, shouldDiscloseHealthInternals, shouldRunServingProbe } from './health-response.js';
+import { allowedHosts, isBrowserRequest, isCrossOriginAllowed, isHostAllowed, trustedOriginSet } from './browser-guard.js';
 import { getServingProbe } from './serving-probe.js';
 import { darioVersion } from './version.js';
 import { CC_TOOL_DEFINITIONS_UNADVERTISABLE, CC_TEMPLATE_PROMPT_BYTES, resolveMaxTokens, buildCCRequest, applyCcPromptCaching, isGenuineCCClient, parseEffortSuffix, reverseMapResponse, createStreamingReverseMapper, orderHeadersForOutbound, overlayTemplateHeaderValues, forwardClientCCIdentityHeaders, isMcpToolName, UnsupportedClientToolError, CLIENT_TOOL_MCP_PREFIX, CC_TEMPLATE, effectiveCacheControl, withForced1hBeta } from './cc-template.js';
@@ -2329,6 +2330,10 @@ export async function startProxy(opts = {}) {
     // override via DARIO_CORS_ORIGIN — otherwise browser-based clients hitting
     // dario over the mesh will be blocked by their browser's CORS check.
     const corsOrigin = process.env.DARIO_CORS_ORIGIN || `http://localhost:${port}`;
+    // The browser guard trusts the same origin CORS advertises, and accepts its
+    // host as a name an unkeyed proxy may be reached by (browser-guard.ts).
+    const trustedOrigins = trustedOriginSet([corsOrigin]);
+    const hostNames = allowedHosts(trustedOrigins, host);
     // Security headers for all responses
     const SECURITY_HEADERS = {
         'X-Content-Type-Options': 'nosniff',
@@ -2397,6 +2402,8 @@ export async function startProxy(opts = {}) {
     const ERR_UNAUTH = JSON.stringify({ error: 'Unauthorized', message: 'Invalid or missing API key' });
     const ERR_FORBIDDEN = JSON.stringify({ error: 'Forbidden', message: 'Path not allowed. Supported paths: POST /v1/messages, POST /v1/messages/count_tokens, POST /v1/chat/completions, GET /v1/models' });
     const ERR_METHOD = JSON.stringify({ error: 'Method not allowed' });
+    const ERR_CROSS_ORIGIN = JSON.stringify({ error: 'Forbidden', message: 'Cross-origin browser request refused. A browser client on another origin needs DARIO_CORS_ORIGIN set to that origin.' });
+    const ERR_HOST = JSON.stringify({ error: 'Forbidden', message: 'Request refused: the Host header is not localhost or an IP address, and DARIO_API_KEY is not set. Reach dario at localhost or 127.0.0.1, set DARIO_API_KEY, or set DARIO_CORS_ORIGIN to the origin you serve it under.' });
     /** The named key each key-socket connection is (opts.keySockets); absent for TCP. */
     const keySocketOf = new WeakMap();
     /**
@@ -2750,6 +2757,32 @@ export async function startProxy(opts = {}) {
             res.end();
             return;
         }
+        // Browser request guard (browser-guard.ts), ahead of every route: a web
+        // page must not spend the subscription, clear the overage halt or read
+        // /accounts through a proxy that serves an absent credential. The
+        // cross-origin check judges only requests carrying Origin or
+        // Sec-Fetch-Site. The Host check covers every request to an unkeyed proxy,
+        // because a rebound page's GET carries neither. A key socket is
+        // unreachable from a browser.
+        if (socketKey === undefined) {
+            const refusal = isBrowserRequest(req.headers) && !isCrossOriginAllowed(req.method, req.headers, trustedOrigins)
+                ? 'cross-origin'
+                : (!apiKeyBuf && !isHostAllowed(req.headers, hostNames)) ? 'host' : null;
+            if (refusal) {
+                if (verbose) {
+                    console.error(refusal === 'cross-origin'
+                        ? `[dario] 403 refused (cross-origin browser request, Origin ${req.headers.origin ?? '-'}, Sec-Fetch-Site ${req.headers['sec-fetch-site'] ?? '-'}): ${req.method} ${urlPath}`
+                        : `[dario] 403 refused (Host ${req.headers.host ?? '-'} on a proxy without DARIO_API_KEY): ${req.method} ${urlPath}`);
+                }
+                writeLogLine(logFileStream, {
+                    ts: new Date().toISOString(), req: requestCount,
+                    method: req.method ?? '', path: urlPath, status: 403, reject: refusal,
+                });
+                res.writeHead(403, JSON_HEADERS);
+                res.end(refusal === 'cross-origin' ? ERR_CROSS_ORIGIN : ERR_HOST);
+                return;
+            }
+        }
         // Liveness probe — always 200 while the HTTP server is accepting requests,
         // deliberately decoupled from OAuth state. Docker's healthcheck (and the
         // autoheal watchdog that keys on it) points HERE, not /health: a broken or

package/docs/commands.md

@@ -43,8 +43,6 @@ This page is the per-flag reference. For environment variables grouped by task
 | `--key-socket=<path>=<key>` / `DARIO_KEY_SOCKETS` | Also listen on a unix socket bound to one named key: every request on it is that key's, with no secret sent or stored by the caller; the socket's directory and group decide who may connect. Repeatable. See [Key sockets](./keys.md#a-key-with-no-secret-key-sockets). | none |
 | `--no-keys` / `DARIO_KEYS=0`; `--keys-path=<file>` / `DARIO_KEYS_PATH` | Ignore named keys (`~/.dario/keys.json`) so only `DARIO_API_KEY` authenticates; or move the file. See [Named keys](./keys.md). (v6.8) | on, `~/.dario/keys.json` |
 | `--log-file=<path>` / `DARIO_LOG_FILE` | Append one JSON-ND record per completed request to PATH. Useful for backgrounded proxies where stdout is unobserved (where `--verbose` can't help). Field set: `ts`, `req`, `method`, `path`, `model`, `status`, `latency_ms`, `in_tokens`, `out_tokens`, `cache_read`, `cache_create`, `claim`, `bucket`, `account`, `client`, `preserve_tools`, `stream`, plus `reject` / `error` on failure paths, and on a ChatGPT (codex) request the cache trace `cache_key`, `cache_items`, `cache_since_ms`, `cache_prev_items`, `cache_extends`, `cache_diverged_at`, `cache_seat_changed`, `cache_prefix_changed`. Secrets scrubbed via the same redactor that `--verbose-bodies` uses; no request bodies. | off |
-| `--pool-fallback=<models>` / `DARIO_POOL_FALLBACK` / config `poolFallback.model` | Strictly opt-in. When every pool seat is drained or in auth cool-down (at selection, or mid-flight on a 429 with no peer left), serve the request as `<model>` from whichever provider can, instead of surfacing the 429/503. Accepts a **chain** — `gpt-5.6-sol,claude-sonnet-5` — read left to right, each provider taking the first entry it can serve. A Codex/ChatGPT subscription that lists the model is preferred (no per-token cost) and works on **both** wire shapes; otherwise a configured openai-compat backend, which is still OpenAI-path only (no Messages translation on that route). A chain also makes failover **symmetric**: a rate-limited or failing subscription hands the request back to the Claude pool. Only a 429/5xx fails over — a 400 surfaces, since a bad request would just reproduce itself elsewhere. Every substituted response carries `x-dario-pool-fallback: <model>` — never silent. Needs a Codex account (`dario add altman`) or a backend (`dario backend add …`); `dario doctor` reports it as INERT with neither. Empty pool still 503s (setup error, not traffic to re-bill). Empty flag value disables, overriding env + config. See [Pool-exhausted fallback](./multi-account-pool.md#pool-exhausted-fallback). | off |
-| `--family-fallback=<family=model,...>` / `DARIO_FAMILY_FALLBACK` / config `familyFallback` | Strictly opt-in. When a rate limit keeps every pool seat off a model family, serve that family's requests as `<model>` on the Claude pool, while some seat can serve the target's family. Written for Fable: its included credit runs out while the seat still has room for Opus, so `fable=claude-opus-5-5` keeps Fable traffic on the subscription instead of a local 429 until the credit resets. The target must be a `claude-*` model of another family; one step, never chained. Runs before `--pool-fallback`, so a pool with room for the target never leaves the Claude pool. Skipped in upstream API-key mode, under `--model`/`--fast-model` and for a seat-pinned request. A `[1m]` tag on the request carries over. Every switched response carries `x-dario-family-fallback: <requested model>`. Empty flag value disables, overriding env + config. See [Family fallback](./multi-account-pool.md#family-fallback). | off |
 | `--passthrough-betas=<csv>` / `DARIO_PASSTHROUGH_BETAS` | Beta flags ALWAYS forwarded upstream regardless of CC's captured set or the client's `anthropic-beta` header. Bypasses the billable-beta filter (so `extended-cache-ttl-*` survives if you opt in). Per-account rejection cache still applies — a pinned flag the upstream 400's gets dropped on retry rather than re-sent forever. Use when you know a beta works on your account but isn't in the captured template, or when client traffic should be force-augmented. Empty flag value (`--passthrough-betas=`) clears the env-default. | off |
 | `--strict-tls` / `DARIO_STRICT_TLS=1` | Refuse to start proxy mode unless runtime classifies as `bun-match` — i.e. the TLS ClientHello matches CC's. See [Wire-fidelity axes](./wire-fidelity.md). (v3.23) | off |
 | `--pace-min=<ms>` / `DARIO_PACE_MIN_MS` | Minimum inter-request gap in ms. Replaces the legacy hardcoded 500 ms. (v3.24) | `500` |
@@ -59,8 +57,8 @@ This page is the per-flag reference. For environment variables grouped by task
 | `--family-fallback=<family=model,...>` / `DARIO_FAMILY_FALLBACK` / config `familyFallback` | Strictly opt-in. When a rate limit keeps every pool seat off a model family, serve that family's requests as `<model>` on the Claude pool, while some seat can serve the target's family. Written for Fable: its included credit runs out while the seat still has room for Opus, so `fable=claude-opus-5-5` keeps Fable traffic on the subscription instead of a local 429 until the credit resets. The target must be a `claude-*` model of another family; one step, never chained. Runs before `--pool-fallback`, so a pool with room for the target never leaves the Claude pool. Skipped in upstream API-key mode, under `--model`/`--fast-model` and for a seat-pinned request. A `[1m]` tag on the request carries over. Every switched response carries `x-dario-family-fallback: <requested model>`. Empty flag value disables, overriding env + config. See [Family fallback](./multi-account-pool.md#family-fallback). | off |
 | `--system-prompt=<verbatim\|partial\|aggressive\|filepath>` / `DARIO_SYSTEM_PROMPT` | System-prompt mode for outbound CC-shaped requests. `partial` strips behavioral constraints (Tone-and-style, Text-output, scope/verbosity/comment bullets) for ~1.2–2.8× output capability on open-ended work. `aggressive` adds prompt-level RLHF restatement removal (<3% over partial — alignment is RLHF-trained). `<filepath>` fully replaces the slot with file contents. Empirically validated as unfingerprinted by the billing classifier — see [`system-prompt.md`](./system-prompt.md) and [`research/system-prompt-classifier-study.md`](./research/system-prompt-classifier-study.md). (v3.34) | `verbatim` |
 | `--upstream-proxy=<url>` / `--via=<url>` / `DARIO_UPSTREAM_PROXY` | Route dario's outbound fetches (api.anthropic.com, OpenAI-compat backends, OAuth) through an HTTP/HTTPS proxy. Pair with the HTTP proxy mode of a VPN provider (Mullvad, AirVPN), a corporate proxy, privoxy/Tor, etc. Localhost calls bypass. Requires Bun runtime; SOCKS5 not supported. Full provider matrix + setup in [`vpn-routing.md`](./vpn-routing.md). (v3.35) | unset |
-| `DARIO_API_KEY` | If set, all endpoints (except `/health`) require a matching `x-api-key` or `Authorization: Bearer` header. Required when `--host` binds non-loopback. | unset (open) |
-| `DARIO_CORS_ORIGIN` | Override browser CORS origin | `http://localhost:${port}` |
+| `DARIO_API_KEY` | If set, all endpoints (except `/health`) require a matching `x-api-key` or `Authorization: Bearer` header. Required when `--host` binds non-loopback. Unset, every request must name dario by `localhost`, a `*.localhost` name, an IP address, the `--host` address or the `DARIO_CORS_ORIGIN` host (DNS rebinding). | unset (open) |
+| `DARIO_CORS_ORIGIN` | The one browser origin besides dario's own that it serves: the CORS `Access-Control-Allow-Origin`, and the only other origin whose POSTs are not refused as cross-origin. Set it for a web UI or a browser extension that calls dario directly (`chrome-extension://<id>` works). Without `DARIO_API_KEY`, its host is also a name dario may be reached by. | `http://localhost:${port}` |
 | `DARIO_QUIET_TLS` | Suppress the runtime/TLS mismatch startup banner | unset |
 | `DARIO_NO_BUN` | Disable automatic Bun relaunch | unset |
 | `DARIO_MIN_INTERVAL_MS` | Legacy name for `DARIO_PACE_MIN_MS`. Still honored; new name wins when both are set. | — |

package/docs/docker.md

@@ -106,7 +106,7 @@ All flags have env-var equivalents. The image sets sensible container defaults:
 | `DARIO_HOST`              | `0.0.0.0`        | Bind address (image flips from `127.0.0.1`)   |
 | `DARIO_PORT`              | `3456`           | Listen port                                   |
 | `DARIO_API_KEY`           | unset (**required**) | Required because of the `0.0.0.0` bind — see "Why an API key is mandatory" |
-| `DARIO_CORS_ORIGIN`       | unset            | Override the default `http://localhost:<port>` allow-list |
+| `DARIO_CORS_ORIGIN`       | unset            | The browser origin to serve besides dario's own (CORS and the cross-origin refusal); default `http://localhost:<port>` |
 | `DARIO_LOG_FILE`          | unset            | Path inside the container (mount a volume)    |
 | `DARIO_LOG_BODIES`        | unset            | `1` to log request/response bodies            |
 | `DARIO_CACHE_TRACE`       | unset            | `1` to log one cache-trace line per ChatGPT (codex) request, see [`docs/analytics.md`](./analytics.md#the-cache-trace) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askalf/dario",
-  "version": "6.18.2",
+  "version": "6.18.3",
   "description": "Use your Claude and ChatGPT subscriptions in Cursor, Cline, Aider, Claude Code and the Agent SDK at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint: either plan answers either wire shape, opt-in failover when one hits its limit, and a ledger of what each plan absorbed.",
   "type": "module",
   "bin": {