askalf 发布 dario：把 Claude 与 ChatGPT 订阅接入任意编码工具的本地端点

dario

One local endpoint that puts your Claude and ChatGPT subscriptions behind any coding tool. Cursor, Cline, Aider, Claude Code, Codex CLI and the Agent SDK all talk to it. Either plan answers either wire shape, with failover between them, session-sticky multi-seat pooling, one key per developer with a daily budget, and eleven unattended watchers that track Claude Code's request shape. Zero runtime dependencies.

Every release is SLSA-attested and published from CI with no long-lived token. 9.5 OpenSSF Scorecard, 100% Best Practices.

Merged upstream

Fixes found, reproduced and landed in other people's projects, reviewed and merged by their maintainers.

Project	The fix
huggingface_hub #4546 · #4896	Two Windows long-path bugs in the client the Hugging Face stack is built on: a crash downloading into a deep directory, and a tree cache that silently switched itself off.
redis/ioredis #2196	Unsubscribing from the last shard channel took the client out of subscriber mode while its regular channel and pattern subscriptions were still live (and the reverse), so their messages stopped arriving.
erigontech/erigon #24022	A consensus-layer TTL cache now expires on read instead of running a sweep goroutine, and a peer-refresh loop no longer outlives its owner's context.
securego/gosec #1746	An always-out-of-range index that the G602 analyzer waved through under an equality guard.
nodejs/undici #5827	The WebSocket parser kept a message's compressed flag after it completed, so a stray continuation frame was accepted instead of failing the connection.
NervJS/taro #19506	`Events#once` could fire twice when its callback re-triggered the event, and stayed attached when the callback threw; it now fires exactly once and detaches on every path.
nicolargo/glances #3744	The quicklook `gpu_mem` and `gpu_proc` stats kept no history, so `--sparkline` crashed the curses UI with a `TypeError` as soon as either was shown.
qax-os/excelize #2402	Conditional-formatting and data-validation ranges moved onto the wrong row when their first row was deleted.
lingui/js-lingui #2677	New catalog messages were written with `translation` first and rewritten with it last on the next extract, a diff that changed nothing.
github/advisory-database #8824	A security advisory's patched-version range that missed the 1.x fix.
oblien/openship #945	Mail delivery health was graded on only the first three deferral reasons, so a fatal auth or TLS failure ranked fourth was graded `warn` instead of `fail`.
krillinai/OpenCreator #333	An LLM reply with conversational text around its JSON, or a trailing comma, failed the whole subtitle or translation step; a new extractor tolerates both.
silverbulletmd/silverbullet #2128	Short or link-leading task lines never got the page reference their Linked Mentions toggle needs.
zsviczian/obsidian-excalidraw-plugin #2959	A back-of-the-note embeddable that mounted before the Canvas node factory was ready rendered the whole drawing instead of its linked section; the mount now waits for the factory to initialize.
getopenscreen/openscreen #708	Linux capture lost an early first frame; the capture-started state is now latched.
williamngan/pts #228	A numeric equality threshold excluded a difference exactly at the threshold, unlike the point comparison beside it.
raycast/extensions #31314	A scoreboard command sent a date range the ESPN endpoint rejects with a 400; it now asks one day at a time.

Also shipped by maintainers from our reports: GAM-team/GAM #1992, added by hand in GAM 7.48.14, and huggingface_hub #4908, re-landed as #4937 with credit.

What I build

Two questions every agent deployment has to answer: what is it allowed to do, and what does it run on? Everything here is open source, and runs the operation that ships it.

Own Your Agent Security

Deterministic gates around what an agent may do.

redstamp: an offline firewall for agent tool calls. It blocks RCE, secret exfiltration, SSRF, prompt injection and poisoned MCP tools, with a tamper-evident audit trail, under CrewAI, LangGraph, the OpenAI Agents SDK and AutoGen.	truecopy: vet, sign and pin every skill and MCP server, then fail the build when the bytes change. 68,560 skills poison-scanned across two ecosystems.
truecopy-action: truecopy as a GitHub Action. One YAML block, and a skill that drifted or turned poisonous fails the pull request.	plumbline: out-of-band monitoring that scores an agent's whole action sequence against its declared job, catching an escape assembled from individually allowed steps.

Own Your Stack

The plan you already pay for, on the machine you already own.

The whole map on one page → ownyourstack.sprayberrylabs.com

How it runs

askalf is the agent operation behind Sprayberry Labs: an orchestrator and specialist agents that ship, review, audit and send fixes upstream, with one human approving what matters. It runs on the tools above. dario routes its model traffic, redstamp gates its tool calls, truecopy verifies every skill at load, and every pull request gets a gating review from a different model family than the one that wrote it, in the open, before it lands.

I'm that human: fifteen-plus years in systems and infrastructure engineering, data centers and virtualization before the agent work. I architect it, review it and sign everything that leaves the shop, and I write down what actually happens.

Write-ups: the numbers and the misses

We scanned the marketplace that started the poisoned-skills panic: all 66,541 ClawHub skills poison-scanned with truecopy. Zero confirmed malicious, 813 deterministic alarms, every one checked and mapped.
The leaderboard I refused to build: why an agent-firewall leaderboard is a category error, and a threat-model map instead, misses included.
Auditing the skills supply chain: truecopy across 2,019 published Claude skills.
Zero raw credentials: moving a live agent fleet from 132 inherited environment keys to scoped leases, one seam at a time.
An injection firewall for the agentic browser: why the lethal trifecta is structural, and how to gate it.
A self-healing release pipeline: how dario ships, health-gates and rolls itself back.
redstamp governing third-party frameworks: CrewAI · LangGraph · OpenAI Agents SDK · AutoGen

Full engineering log → sprayberrylabs.com/blog

Supply-chain receipts

Live OpenSSF Scorecard on dario, redstamp, truecopy, truecopy-action, plumbline, cordon, browser-bridge, amnesia and checkout-with-retry; 100% OpenSSF Best Practices on dario, truecopy, redstamp and amnesia.
npm packages publish from CI through OIDC trusted publishing, with provenance and no long-lived token.
cordon ships as an attested container from GHCR.