@askalf/dario - npm Package Compare versions

Comparing version 5.4.17 to 5.4.19

dist/cc-template.d.ts

@@ -174,2 +174,13 @@ /**
 /**
+ * Pick the CC-identity headers out of an inbound request so the passthrough
+ * path can forward them unchanged.
+ *
+ * Pure and exported so the allow/deny behaviour is unit-testable without
+ * standing up the proxy, matching `orderHeadersForOutbound` and
+ * `overlayTemplateHeaderValues`. Array-valued headers (Node allows repeats)
+ * take the first value; empty strings are skipped so a client sending a blank
+ * header cannot blank out a value dario would otherwise supply.
+ */
+export declare function forwardClientCCIdentityHeaders(reqHeaders: Record<string, string | string[] | undefined>): Record<string, string>;
+/**
  * Overlay a captured template's `header_values` onto the outbound header record,
@@ -176,0 +187,0 @@ * skipping the keys that must never be replayed.

dist/live-fingerprint.d.ts

@@ -340,8 +340,2 @@ /**
 /**
- * Reset the memoized `claude --version` probe. Test-only — production
- * code should never need to clear the cache since the installed binary
- * doesn't change mid-process.
- */
-export declare function _resetInstalledVersionProbeForTest(): void;
-/**
  * The CC version range the current dario release has been exercised
@@ -348,0 +342,0 @@ * against. Update `maxTested` every time we validate against a new CC

dist/live-fingerprint.js

@@ -922,10 +922,2 @@ /**
 }
-/**
- * Reset the memoized `claude --version` probe. Test-only — production
- * code should never need to clear the cache since the installed binary
- * doesn't change mid-process.
- */
-export function _resetInstalledVersionProbeForTest() {
-    _installedVersionProbe = { value: null, cached: false };
-}
 // ============================================================
@@ -932,0 +924,0 @@ //  CC version compat matrix (v3.17)

dist/version.d.ts

 export declare function darioVersion(): string;
-/** Test-only: clear the memoized version. */
-export declare function _resetVersionCacheForTest(): void;

dist/version.js

@@ -29,5 +29,1 @@ /**
 }
-/** Test-only: clear the memoized version. */
-export function _resetVersionCacheForTest() {
-    cached = null;
-}

docs/wire-fidelity.md

@@ -14,2 +14,4 @@ # Wire-fidelity axes
 
-The six-direction wire-fidelity roadmap is complete. Subsequent releases return to responding to issues and upstream template drift.
+| **Client identity headers** | v5.4.19 | On the passthrough path `isGenuineCCClient` has already established the caller *is* Claude Code, so its own identity headers (`user-agent`, `x-app`, `x-stainless-*`, `x-claude-code-*`, `x-client-*`) are forwarded unchanged instead of being replaced with template values. The template exists to synthesise CC's shape for clients that are not CC; where the genuine article is in hand, forwarding beats imitating. Measured before the change: of 13 identity headers a real client sent, 12 were replaced and 1 dropped — 0 forwarded (#885). Auth, session id and the merged beta set stay dario's. | Automatic on the genuine-CC path; nothing to tune. Non-CC clients are unaffected, and the gate reads the request **body**, so headers cannot self-authorise. |
+
+The original six-direction roadmap is complete; the axes below it are later findings. Note that header **order** is deliberately absent as an axis: `orderHeadersForOutbound` builds the captured sequence, but `fetch()` re-normalises it before the wire, and on Bun you cannot have both CC's JA3 and raw header control in one process (#813). The honest framing of the whole table is byte-identical **body**, structurally close **headers** — not packet-identical.

package.json

 {
   "name": "@askalf/dario",
-  "version": "5.4.17",
+  "version": "5.4.19",
   "description": "Use your Claude Pro/Max subscription in any tool — Cursor, Cline, Aider, the Agent SDK, your scripts — at subscription pricing, not per-token API bills. One local Anthropic + OpenAI-compatible endpoint.",
@@ -27,3 +27,3 @@ "type": "module",
     "test": "node --test --test-concurrency=8 test/all.test.mjs",
-    "test:serial": "node test/issue-29-tool-translation.mjs && node test/hybrid-tools.mjs && node test/tool-schema-contract.mjs && node test/scrub-paths.mjs && node test/provider-prefix.mjs && node test/analytics-recording.mjs && node test/analytics-billing-bucket.mjs && node test/failover-429.mjs && node test/pool-sticky.mjs && node test/live-fingerprint.mjs && node test/proxy-header-order.mjs && node test/proxy-body-order.mjs && node test/runtime-fingerprint.mjs && node test/pacing.mjs && node test/stream-drain.mjs && node test/subagent.mjs && node test/mcp-protocol.mjs && node test/mcp-tools.mjs && node test/mcp-e2e.mjs && node test/session-rotation.mjs && node test/drift-detection.mjs && node test/cc-authorize-probe-classifier.mjs && node test/compat-range.mjs && node test/doctor-formatter.mjs && node test/doctor-identity-drift.mjs && node test/atomic-write.mjs && node test/account-refresh-singleflight.mjs && node test/durable-token-persist.mjs && node test/streaming-edge-cases.mjs && node test/client-detection.mjs && node test/manual-oauth-flow.mjs && node test/scrub-template.mjs && node test/context-bleed.mjs && node test/capture-provenance.mjs && node test/sanitize-messages.mjs && node test/platform-tools.mjs && node test/strict-template-flags.mjs && node test/request-queue.mjs && node test/effort-flag.mjs && node test/template-invariants.mjs",
+    "test:serial": "node test/issue-29-tool-translation.mjs && node test/hybrid-tools.mjs && node test/tool-schema-contract.mjs && node test/scrub-paths.mjs && node test/provider-prefix.mjs && node test/analytics-recording.mjs && node test/analytics-billing-bucket.mjs && node test/failover-429.mjs && node test/pool-sticky.mjs && node test/live-fingerprint.mjs && node test/proxy-header-order.mjs && node test/proxy-body-order.mjs && node test/runtime-fingerprint.mjs && node test/pacing.mjs && node test/stream-drain.mjs && node test/subagent.mjs && node test/mcp-protocol.mjs && node test/mcp-tools.mjs && node test/mcp-e2e.mjs && node test/session-rotation.mjs && node test/drift-detection.mjs && node test/cc-authorize-probe-classifier.mjs && node test/compat-range.mjs && node test/doctor-formatter.mjs && node test/doctor-identity-drift.mjs && node test/atomic-write.mjs && node test/account-refresh-singleflight.mjs && node test/durable-token-persist.mjs && node test/streaming-edge-cases.mjs && node test/client-detection.mjs && node test/manual-oauth-flow.mjs && node test/scrub-template.mjs && node test/context-bleed.mjs && node test/passthrough-header-forwarding.mjs && node test/capture-provenance.mjs && node test/sanitize-messages.mjs && node test/platform-tools.mjs && node test/strict-template-flags.mjs && node test/request-queue.mjs && node test/effort-flag.mjs && node test/template-invariants.mjs",
     "audit": "npm audit --production --audit-level=high",
@@ -30,0 +30,0 @@ "prepublishOnly": "npm run build",

New alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

1732855

0.36%

Lines of code

28702

0.29%

No dependency changes