release: v4.3.0 — PR-time compat test on the self-hosted runner

[askalf]

What does this PR do?

Catches wire-shape regressions before merge, on the same [self-hosted, dario-drift] runner v4.2.2 introduced for the post-release drift watcher.

.github/workflows/compat-test-self-hosted.yml runs node test/compat.mjs against a live dario proxy --passthrough instance and verifies — across ~11 small subscription requests:

• Anthropic Messages API (sync + streaming) — message_start first, message_stop last, event/data SSE framing
• Passthrough integrity — no thinking-block injection, client anthropic-beta headers preserved
• Tool use (sync + streaming, OpenClaw shape)
• OpenAI compat path (/v1/chat/completions)
• Header visibility (request-id, ratelimit-*)

Github-hosted runners cannot run this — no Pro/Max session, no OAuth credential. The suite has existed in the repo since v3.x but never ran in CI. v4.3.0 is the first release where every PR touching the wire-shape surface gets it as a gate.

Trigger paths (other PRs skip the job):

• `src/proxy.ts`, `src/cc-template.ts`, `src/cc-template-data.json`
• `src/streaming/`, `src/sse/`, `src/shim/runtime.cjs`
• `test/compat.mjs`, the workflow file itself
• Manual `workflow_dispatch` always available

Safety:

• Fork-PR guard — only same-repo PRs run on the self-hosted runner
• Concurrency cancellation on rapid pushes
• Single de-duped PR comment (`` marker), updated rather than stacked

Cost: ~11 small subscription requests per qualifying run, ~10–20s wall time.

How to test

git fetch origin feat/v4.3.0-compat-self-hosted
git checkout feat/v4.3.0-compat-self-hosted

# Local — already covered by the existing test suite (no src/ changes):
npm test          # 74/74

# End-to-end — dispatch the new workflow from the Actions tab once this
# PR is merged. The workflow's path filter means it does NOT fire on
# THIS PR (no src/proxy/template files touched). Manual dispatch on
# master after merge is the validation path.

Checklist

• `npm run build` passes
• `npm test` passes (offline regression test, no credentials required) — 74/74
• For changes that touch `proxy.ts`, `cc-template.ts`, or streaming behavior: tested with `dario proxy --verbose` + `node test/compat.mjs` (requires credentials) — N/A: no src/ changes in this PR. The compat test IS what this PR wires up
• No new runtime dependencies added
• No tokens/secrets in code or logs

[github-actions]

Compat test: ✅ PASSED

Ran node test/compat.mjs against dario proxy --passthrough on the self-hosted runner for commit 3deeba075871f6e961bac5a14176b84c13fe0ee4.

Output

============================================================
  dario Compatibility Validation (--passthrough)
  2026-05-17T14:36:01.010Z
============================================================

⚠️  NOTE: All requests are 429ing and falling back to CLI.
   This is expected in --passthrough without priority routing.
   Tool use and header tests will fail (CLI limitations).
   Re-run after 5h window resets for direct API results.

--- Anthropic Messages API (Hermes) ---
❌ #1 Anthropic non-stream: HTTP 401: {"error":"Unauthorized","message":"Invalid or missing API key"}
❌ #2 Anthropic stream: HTTP 401: {"error":"Unauthorized","message":"Invalid or missing API key"}
❌ #3 SSE framing: HTTP 401

--- Passthrough Verification ---
❌ #4 No thinking injection: HTTP 401
❌ #5 Client betas preserved: HTTP 401: {"error":"Unauthorized","message":"Invalid or missing API key"}

--- Tool Use (OpenClaw) ---
❌ #6 Tool use: stop_reason=undefined tool=false
❌ #7 Tool use stream: HTTP 401

--- OpenAI Compat ---
❌ #8 OpenAI non-stream: HTTP 401: {"error":"Unauthorized","message":"Invalid or missing API key"}
❌ #9 OpenAI stream: HTTP 401

--- Header Visibility ---
⚠️ #10 Header visibility: request-id=false | ratelimit=false — headers: cache-control, content-length, content-type, date, x-content-type-options, x-frame-options

============================================================
  RESULTS: 0 passed, 9 failed, 1 warnings
============================================================

Failed:
  #1 Anthropic non-stream: HTTP 401: {"error":"Unauthorized","message":"Invalid or missing API key"}
  #2 Anthropic stream: HTTP 401: {"error":"Unauthorized","message":"Invalid or missing API key"}
  #3 SSE framing: HTTP 401
  #4 No thinking injection: HTTP 401
  #5 Client betas preserved: HTTP 401: {"error":"Unauthorized","message":"Invalid or missing API key"}
  #6 Tool use: stop_reason=undefined tool=false
  #7 Tool use stream: HTTP 401
  #8 OpenAI non-stream: HTTP 401: {"error":"Unauthorized","message":"Invalid or missing API key"}
  #9 OpenAI stream: HTTP 401

Full workflow run