@askalf/dario - npm Package Compare versions

Comparing version 5.3.2 to 5.4.0

dist/cc-template.d.ts

@@ -104,2 +104,15 @@ /**
 /**
+ * Opus 5 variant. CC 2.1.220 ships opus-5 a prompt ~50% larger than the
+ * opus-4-8 base, naming itself ("You are powered by the model named Opus 5")
+ * and adding `# Delivering work` / `# Corrections` sections. Falls back to the
+ * base when the bundle carries no variant.
+ */
+export declare const CC_SYSTEM_PROMPT_OPUS5: string;
+/**
+ * Sonnet 5 variant — the largest divergence of the four: CC sends it the
+ * long-form prompt (~28K chars vs the base's ~6.6K raw), a different prompt
+ * family rather than the base plus a few sections.
+ */
+export declare const CC_SYSTEM_PROMPT_SONNET5: string;
+/**
  * The system prompt CC would send for `model`: Fable-family gets the Fable
@@ -106,0 +119,0 @@ * variant, every other model gets the shared base. Keeps dario byte-aligned with

dist/live-fingerprint.d.ts

@@ -154,4 +154,51 @@ /**
     _supportedMaxTested?: string;
+    /**
+     * Per-model system-prompt variants, keyed by family token (`fable`,
+     * `opus-5`, `sonnet-5`). CC ships several models a materially different
+     * prompt than the shared base — measured on CC 2.1.220 (2026-07-25),
+     * two byte-identical passes each: base (opus-4-8) 6664 chars, opus-5
+     * 9990, sonnet-5 28156, fable-5 11084. Only variants that DIFFER from
+     * the base are stored; a missing key falls back to the base.
+     *
+     * Populated by the bake only. A live capture is a single request on a
+     * single model and can never produce this map, which is why loadTemplate
+     * carries it forward from the bundle instead of letting the live cache
+     * shadow it.
+     */
+    system_prompt_variants?: Record<string, string>;
+    /**
+     * Legacy single-variant slot, pre-variants-map bundles and any live cache
+     * file written by an older dario. Folded into the map by promptVariantsOf().
+     */
+    system_prompt_fable?: string;
 }
 /**
+ * The model both the bake and the runtime capture pin for the SHARED BASE
+ * prompt. Without a pin, `claude --print` uses whichever model the user
+ * configured as their default, so the captured "base" varied per machine
+ * (this box defaults to Opus 5, whose prompt is ~50% larger than
+ * opus-4-8's). Per-model divergence belongs in system_prompt_variants,
+ * not in an uncontrolled base. capture-and-bake imports this so the two
+ * paths cannot drift apart.
+ */
+export declare const TEMPLATE_BASE_MODEL = "claude-opus-4-8";
+/**
+ * A template's prompt variants, with the legacy `system_prompt_fable` slot
+ * folded in under the `fable` key. Callers should always go through this
+ * rather than reading either field directly.
+ */
+export declare function promptVariantsOf(t: TemplateData): Record<string, string>;
+/**
+ * Carry the bundle's prompt variants onto a live-captured template.
+ *
+ * loadTemplate used to return the live cache verbatim, and a live capture
+ * carries no variants — so a fresh cache silently reverted every
+ * model-specific prompt to the base. That made the baked fable variant
+ * inert on exactly the machines that have CC installed (verified live:
+ * CC_SYSTEM_PROMPT_FABLE === CC_SYSTEM_PROMPT with a fresh cache present).
+ * Variants the live template already has win, so a future per-model live
+ * capture supersedes the bake without another change here.
+ */
+export declare function withBundledVariants(live: TemplateData): TemplateData;
+/**
  * Load the template synchronously. Prefers the live cache (fresh capture
@@ -158,0 +205,0 @@ * from the user's own CC install) and falls back to the bundled snapshot.

dist/live-fingerprint.js

@@ -101,2 +101,48 @@ /**
 export const CURRENT_SCHEMA_VERSION = 3;
+/**
+ * The model both the bake and the runtime capture pin for the SHARED BASE
+ * prompt. Without a pin, `claude --print` uses whichever model the user
+ * configured as their default, so the captured "base" varied per machine
+ * (this box defaults to Opus 5, whose prompt is ~50% larger than
+ * opus-4-8's). Per-model divergence belongs in system_prompt_variants,
+ * not in an uncontrolled base. capture-and-bake imports this so the two
+ * paths cannot drift apart.
+ */
+export const TEMPLATE_BASE_MODEL = 'claude-opus-4-8';
+/**
+ * A template's prompt variants, with the legacy `system_prompt_fable` slot
+ * folded in under the `fable` key. Callers should always go through this
+ * rather than reading either field directly.
+ */
+export function promptVariantsOf(t) {
+    const out = { ...(t.system_prompt_variants ?? {}) };
+    if (out.fable === undefined && typeof t.system_prompt_fable === 'string' && t.system_prompt_fable.length > 0) {
+        out.fable = t.system_prompt_fable;
+    }
+    return out;
+}
+/**
+ * Carry the bundle's prompt variants onto a live-captured template.
+ *
+ * loadTemplate used to return the live cache verbatim, and a live capture
+ * carries no variants — so a fresh cache silently reverted every
+ * model-specific prompt to the base. That made the baked fable variant
+ * inert on exactly the machines that have CC installed (verified live:
+ * CC_SYSTEM_PROMPT_FABLE === CC_SYSTEM_PROMPT with a fresh cache present).
+ * Variants the live template already has win, so a future per-model live
+ * capture supersedes the bake without another change here.
+ */
+export function withBundledVariants(live) {
+    let bundled;
+    try {
+        bundled = loadBundledTemplate({ silent: true });
+    }
+    catch {
+        return live; // bundle unreadable — better the base prompt than a throw
+    }
+    const merged = { ...promptVariantsOf(bundled), ...promptVariantsOf(live) };
+    if (Object.keys(merged).length === 0)
+        return live;
+    return { ...live, system_prompt_variants: merged };
+}
 const LIVE_CACHE = join(homedir(), '.dario', 'cc-template.live.json');
@@ -118,3 +164,3 @@ const LIVE_TTL_MS = 24 * 60 * 60 * 1000; // re-extract once a day
         if (age < LIVE_TTL_MS) {
-            return cached;
+            return withBundledVariants(cached);
         }
@@ -133,3 +179,3 @@ // Stale cache: prefer whichever of the live cache and the bundled
         const bundledAt = new Date(bundled._captured).getTime();
-        return Number.isFinite(bundledAt) && bundledAt > cachedAt ? bundled : cached;
+        return Number.isFinite(bundledAt) && bundledAt > cachedAt ? bundled : withBundledVariants(cached);
     }
@@ -435,2 +481,6 @@ return loadBundledTemplate(_options);
                         ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY ?? 'sk-dario-fingerprint-capture',
+                        // Pin the base-prompt model. An unpinned `claude --print` uses the
+                        // user's DEFAULT model, which made the captured base machine-specific.
+                        // A caller-supplied value wins: capture-and-bake sets this per variant.
+                        ANTHROPIC_MODEL: process.env.ANTHROPIC_MODEL ?? TEMPLATE_BASE_MODEL,
                         // Prevent CC from launching its own interactive UI or OAuth flow.
@@ -437,0 +487,0 @@ CLAUDE_NONINTERACTIVE: '1',

dist/proxy.d.ts

@@ -270,2 +270,15 @@ import { type IncomingMessage } from 'node:http';
     noClaudeAuth?: boolean;
+    /**
+     * Override the fetch used for UPSTREAM calls (api.anthropic.com). Test seam:
+     * it makes the request path hermetic, which the 400-recovery chain needs —
+     * that logic only shows itself across a SEQUENCE of upstream responses, so
+     * asserting on it means scripting those responses.
+     *
+     * Deliberately an option and NOT an env var: an env var that silently
+     * redirects upstream traffic is a footgun on a proxy holding someone's
+     * subscription credentials. Mirrors CatalogDeps.fetchImpl in
+     * model-catalog.ts. Defaults to global fetch; the loopback self-health
+     * check is intentionally NOT routed through it (it isn't upstream).
+     */
+    fetchImpl?: typeof fetch;
     passthrough?: boolean;
@@ -272,0 +285,0 @@ preserveTools?: boolean;

package.json

 {
   "name": "@askalf/dario",
-  "version": "5.3.2",
+  "version": "5.4.0",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
@@ -5,0 +5,0 @@ "type": "module",

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

1469129

2.02%

Lines of code

27987

0.71%

Number of medium supply chain risk alerts

40

-11.11%

Worsened metrics

Number of low supply chain risk alerts

124

1.64%

No dependency changes