@goodandready/dsh-key-rotation 0.7.11 → 0.7.13

package/lib/client.js

@@ -39,6 +39,7 @@ window.__ModuleLoader__.load({
       addProvider: '+ Add provider',
       desc: 'Per-provider API key rotation. For each provider, list its API keys (env names, stored in DSH credentials). The plugin routes a model through that provider\u2019s keys in order and switches to the next on a quota/rate-limit failure.',
       cooldown: 'Cooldown after failure (ms)',
+      scheduleDays: 'Rotation schedule (days, 0=off)',
       switchCodes: 'Switch codes (comma-separated)',
       providersTitle: 'Providers and their keys',
       save: 'Save',
@@ -63,6 +64,8 @@ window.__ModuleLoader__.load({
       keyWriteFailed: 'could not store the key: {msg}',
       keyHint: 'The value is stored in DSH credentials and never sent back to the browser — only its last 5 characters are shown. Names are generated for you; hover a key to see the one it uses.',
       brokenKey: 'broken (3× AUTH)',
+      keyExpired: 'expired',
+      keyExpiringSoon: 'expires in {n} d',
       exportPools: 'Export',
       exportOne: '⬇',
       usedAgo: '{ago} ago',
@@ -92,6 +95,7 @@ window.__ModuleLoader__.load({
       addProvider: '+ Добавить провайдера',
       desc: 'Ротация API-ключей по провайдерам. Для каждого провайдера укажите его API-ключи (имена env, хранятся в учётных данных DSH). Плагин ведёт модель по ключам провайдера по порядку и переключается на следующий при исчерпании квоты/превышении лимита.',
       cooldown: 'Задержка после сбоя (мс)',
+      scheduleDays: 'Расписание ротации (дней, 0=выкл)',
       switchCodes: 'Коды переключения (через запятую)',
       providersTitle: 'Провайдеры и их ключи',
       save: 'Сохранить',
@@ -116,6 +120,8 @@ window.__ModuleLoader__.load({
       keyWriteFailed: 'не удалось сохранить ключ: {msg}',
       keyHint: 'Значение хранится в учётных данных DSH и обратно в браузер не отдаётся — показываются только последние 5 символов. Имена переменных создаются автоматически; наведите на ключ, чтобы увидеть используемое имя.',
       brokenKey: 'сломан (3× AUTH)',
+      keyExpired: 'истёк',
+      keyExpiringSoon: 'истекает через {n} д',
       exportPools: 'Экспорт',
       exportOne: '⬇',
       usedAgo: '{ago} назад',
@@ -347,10 +353,34 @@ window.__ModuleLoader__.load({
         return (entryStatus.keys ?? []).find((k) => k.ref === ref) ?? null;
       };
 
-      const saveSecret = (ref, rowKey) => {
+      const [validating, setValidating] = React.useState('');
+      const [validationResult, setValidationResult] = React.useState({});
+      const validateBeforeSave = (ref, value) => {
+        setValidating(ref);
+        return fetch('/dsh-key-rotation/test', {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ ref, value }),
+        })
+          .then((r) => r.json())
+          .then((data) => { setValidationResult((m) => ({ ...m, [ref]: data })); return data; })
+          .catch(() => null)
+          .finally(() => setValidating(''));
+      };
+      const saveSecret = async (ref, rowKey) => {
         const value = secretDraft[rowKey];
         if (!value) return;
         setSecretError('');
+        // Pre-save validation (issue #118)
+        setValidating(ref);
+        const vres = await validateBeforeSave(ref, value);
+        setValidating('');
+        if (vres && vres.ok === false && vres.code === 'no-credential') {
+          // No credential yet is fine for a new key being saved
+        } else if (vres && !vres.ok) {
+          setSecretError(t('keyWriteFailed').replace('{msg}', vres.message || 'validation failed'));
+          return;
+        }
         fetch('/dsh-key-rotation/key', {
           method: 'PUT',
           headers: { 'content-type': 'application/json' },
@@ -476,6 +506,11 @@ window.__ModuleLoader__.load({
       const keyStatus = (providerId, ref) => {
         const hit = keyInfo(providerId, ref);
         if (!hit) return null;
+        if (hit.expired) return { color: 'var(--dsw-alias-state-error-primary)', text: t('keyExpired') };
+        if (hit.expiresAt && !hit.expired) {
+          const days = Math.ceil((hit.expiresAt - Date.now()) / 86400000);
+          if (days <= 7) return { color: 'var(--dsw-alias-state-warning-primary)', text: t('keyExpiringSoon').replace('{n}', String(days)) };
+        }
         if (hit.broken) return { color: 'var(--dsw-alias-state-error-primary)', text: t('brokenKey') };
         if (!hit.present) return { color: 'var(--dsw-alias-state-error-primary)', text: t('keyMissing') };
         if (hit.cooldownMsLeft > 0) {
@@ -590,6 +625,13 @@ window.__ModuleLoader__.load({
               });
             }, { title: 'Sort by usage' }),
             h('select', { className: 'krot-in', value: entry.provider, onChange: (e) => setProvider(pIndex, e.target.value) }, options),
+            (() => {
+              const ps = status[entry.provider];
+              const score = ps && typeof ps.healthScore === 'number' ? ps.healthScore : null;
+              if (score === null) return null;
+              const color = score > 80 ? 'var(--dsw-alias-state-success-primary)' : score >= 50 ? 'var(--dsw-alias-state-warning-primary)' : 'var(--dsw-alias-state-error-primary)';
+              return h('span', { className: 'krot-tail', title: 'health score', style: { flex: 'none', color, fontWeight: 700 } }, String(score));
+            })(),
             (() => { const ps = status[entry.provider]; const tot = ps && typeof ps.totalUsage === 'number' ? ps.totalUsage : null; return tot !== null ? h('span', { className: 'krot-tail', title: 'total requests', style: { flex: 'none' } }, String(tot)) : null; })(),
             btn('✕', () => removeProvider(pIndex), { title: t('removeProvider') }),
           ),
@@ -613,6 +655,7 @@ window.__ModuleLoader__.load({
       return h('div', { className: 'krot' },
         h('p', { className: 'krot-hint' }, t('desc')),
         field(t('cooldown'), textInput(String(val.cooldownMs ?? 60000), (v) => setField((cur) => ({ ...cur, cooldownMs: Number(v) || 0 })))),
+        field(t('scheduleDays'), textInput(String(val.rotationScheduleDays ?? 0), (v) => setField((cur) => ({ ...cur, rotationScheduleDays: Number(v) || 0 })))),
         field(t('codesTitle'), h('div', { className: 'krot-codes' }, codeList.map((code) => h('label', { key: code, className: 'krot-code' },
           h('input', {
             type: 'checkbox',

package/lib/index.js

@@ -33,7 +33,7 @@
 //    providers:  array       [{ provider, keys: [envName, ...] }]
 // ─────────────────────────────────────────────────────────────────────────────
 import Schema from '@deepseek-ai/schemastery';
-import { keyTail, isLoopbackAddress, isTrustedBridgeRequest, SWITCHABLE_MESSAGE_PATTERN, DEFAULT_SWITCH_CODES, isValidRef, pickNext, applyCooldown, recordFailure, recordSuccess, computeBackoff, envValue, sweepExpired, parseRetryAfter } from './pool.js';
+import { keyTail, isLoopbackAddress, isTrustedBridgeRequest, SWITCHABLE_MESSAGE_PATTERN, DEFAULT_SWITCH_CODES, isValidRef, pickNext, applyCooldown, recordFailure, recordSuccess, computeBackoff, envValue, sweepExpired, parseRetryAfter, computeHealthScore } from './pool.js';
 
 export const name = 'dsh-key-rotation';
 export const inject = ['llm', 'webServer', 'settings', 'credentials'];
@@ -86,10 +86,12 @@ export const Config = Schema.object({
   backupDir: Schema.string().default(''),
   backupIntervalMs: Schema.number().default(86400000),
   backupKeep: Schema.number().default(7),
+  rotationScheduleDays: Schema.number().default(0),
   providers: Schema.array(Schema.object({
     provider: Schema.string().required(),
     keys: Schema.array(Schema.string()).default([]),
     weights: Schema.array(Schema.number()).default([]),
+    expiresAt: Schema.array(Schema.union([Schema.number(), Schema.string()])).default([]),
     models: Schema.dict(Schema.object({
       keys: Schema.array(Schema.string()).default([]),
       weights: Schema.array(Schema.number()).default([]),
@@ -318,6 +320,29 @@ export function apply(ctx, config = {}) {
       return () => clearInterval(id);
     } catch { return () => {}; }
   }, 'dsh-key-rotation: persist stats');
+  // Rotation schedule: shift pointer every N days
+  ctx.effect(() => {
+    const { rotationScheduleDays } = buildRuntime();
+    if (!rotationScheduleDays || rotationScheduleDays <= 0) return;
+    const intervalMs = Math.min(rotationScheduleDays * 86400000, 2147483647);
+    const id = setInterval(() => {
+      try {
+        const rt = buildRuntime();
+        let shifted = 0;
+        for (const pool of rt.poolByRef.values()) {
+          if (pool.refs.length < 2) continue;
+          const oldPtr = pool.state.pointer ?? 0;
+          pool.state.pointer = (oldPtr + 1) % pool.refs.length;
+          shifted++;
+          console.warn(`[dsh-key-rotation] ${pool.base}: scheduled rotation -> ${pool.refs[pool.state.pointer]} (day ${rotationScheduleDays})`);
+        }
+        if (shifted) console.warn(`[dsh-key-rotation] schedule: rotated ${shifted} pools`);
+      } catch (e) {
+        console.warn('[dsh-key-rotation] schedule error:', String(e?.message ?? e));
+      }
+    }, intervalMs);
+    return () => clearInterval(id);
+  }, 'dsh-key-rotation: rotation schedule');
   // Periodic sweep of expired cooldowns — keeps health probe cheap and avoids waiting for next user request
   ctx.effect(() => {
     const id = setInterval(() => {
@@ -349,6 +374,10 @@ export function apply(ctx, config = {}) {
     const maxCooldownMs = cfg.maxCooldownMs ?? undefined;
     const notifyWebhook = cfg.notifyWebhook ?? '';
     const notifyThreshold = cfg.notifyThreshold ?? 3;
+    const backupDir = cfg.backupDir ?? '';
+    const backupIntervalMs = cfg.backupIntervalMs ?? 86400000;
+    const backupKeep = cfg.backupKeep ?? 7;
+    const rotationScheduleDays = cfg.rotationScheduleDays ?? 0;
 
     // ref -> pool (every key env of every configured provider)
     const poolByRef = new Map();
@@ -371,7 +400,12 @@ export function apply(ctx, config = {}) {
       }
       return st;
     };
-    const buildPool = (base, keys, weights, poolCooldown, poolMax) => {
+    const parseExpiry = (v) => {
+      if (typeof v === 'number' && v > 0) return v;
+      if (typeof v === 'string' && v.length > 0) { const ts = Date.parse(v); return Number.isNaN(ts) ? undefined : ts; }
+      return undefined;
+    };
+    const buildPool = (base, keys, weights, poolCooldown, poolMax, expiresAt) => {
       const refs = (keys ?? []).filter((ref) => typeof ref === 'string' && ref.length > 0);
       if (refs.length === 0) return null;
       const w = Array.isArray(weights) ? weights : [];
@@ -380,8 +414,15 @@ export function apply(ctx, config = {}) {
         const ww = typeof w[i] === 'number' && w[i] > 0 ? Math.floor(w[i]) : 1;
         for (let k = 0; k < ww; k++) weightedRefs.push(refs[i]);
       }
+      const parsedExpiry = {};
+      if (Array.isArray(expiresAt)) {
+        for (let i = 0; i < refs.length; i++) {
+          const exp = parseExpiry(expiresAt[i]);
+          if (exp !== undefined) parsedExpiry[refs[i]] = exp;
+        }
+      }
       return { base, refs, weightedRefs: weightedRefs.length > 0 ? weightedRefs : refs,
-               state: makeState(base), cooldownMs: poolCooldown, maxCooldownMs: poolMax };
+               state: makeState(base), cooldownMs: poolCooldown, maxCooldownMs: poolMax, expiresAt: parsedExpiry };
     };
     for (const p of cfg.providers ?? []) {
       const poolCooldown = typeof p.cooldownMs === 'number' ? p.cooldownMs : (cfg.cooldownMs ?? 60000);
@@ -421,7 +462,7 @@ export function apply(ctx, config = {}) {
     for (const key of [...poolState.keys()]) {
       if (![...poolByRef.values()].some((p) => p.base === key)) poolState.delete(key);
     }
-    return { switchCodes, cooldownMs, maxCooldownMs, notifyWebhook, notifyThreshold, backupDir, backupIntervalMs, backupKeep, poolByRef, providerToPool, modelPoolByProvider, cloneIds };
+    return { switchCodes, cooldownMs, maxCooldownMs, notifyWebhook, notifyThreshold, backupDir, backupIntervalMs, backupKeep, rotationScheduleDays, poolByRef, providerToPool, modelPoolByProvider, cloneIds };
   }
 
   // ── patch credentials.resolve: pool refs resolve to the next healthy key ──
@@ -445,6 +486,7 @@ export function apply(ctx, config = {}) {
         const candidate = list[index];
         const until = pool.state.failedUntil.get(candidate);
         if (until !== undefined && until > now) continue;
+        if (pool.expiresAt?.[candidate] !== undefined && now >= pool.expiresAt[candidate]) continue;
         // perHour quota check
         if (pool.perHour) {
           if (!pool.state.quotaWindows) pool.state.quotaWindows = new Map();
@@ -659,6 +701,8 @@ export function apply(ctx, config = {}) {
             usage: pool.state.usageCounts?.get(ref) ?? 0,
             cost: pool.state.costPerKey?.get(ref) ?? 0,
             lastUsedAt: pool.state.lastUsedAt?.get(ref) ?? null,
+            expiresAt: pool.expiresAt?.[ref] ?? null,
+            expired: pool.expiresAt?.[ref] !== undefined && now >= pool.expiresAt[ref],
             broken: pool.state.brokenUntil?.has(ref) ?? false,
           });
         }
@@ -672,6 +716,7 @@ export function apply(ctx, config = {}) {
           exhaustionCount: pool.state.exhaustionCount ?? 0,
           totalUsage: [...(pool.state.usageCounts?.values() ?? [])].reduce((a, b) => a + b, 0),
           events: (pool.state.events ?? []).slice(-50),
+          healthScore: computeHealthScore(pool.state),
         });
       }
       json(res, 200, { providers });
@@ -839,12 +884,15 @@ export function apply(ctx, config = {}) {
         let healthy = 0;
         for (const ref of pool.refs) {
           const until = pool.state.failedUntil.get(ref);
-          if (!(until !== undefined && until > now)) healthy++;
+          if (until !== undefined && until > now) continue;
+          const exp = pool.expiresAt?.[ref];
+          if (exp !== undefined && now >= exp) continue;
+          healthy++;
         }
         const total = pool.refs.length;
         const exhausted = healthy === 0 && total > 0;
         if (exhausted) exhaustedAny = true;
-        pools[pool.base] = { healthy, total, exhausted };
+        pools[pool.base] = { healthy, total, exhausted, healthScore: computeHealthScore(pool.state) };
       }
       json(res, 200, { status: exhaustedAny ? 'degraded' : 'ok', pools, exhaustedAny });
     },
@@ -860,17 +908,23 @@ export function apply(ctx, config = {}) {
       let body; try { body = await readJson(req); } catch (e) { json(res, 400, { error: { code: 'bad-request', message: String(e?.message ?? e) } }); return; }
       const ref = typeof body?.ref === 'string' ? body.ref.trim() : '';
       if (!isValidRef(ref)) { json(res, 400, { error: { code: 'bad-ref', message: 'dsh-key-rotation: ref must be an environment variable name' } }); return; }
+      // Optional value for pre-save validation (issue #118)
+      const testValue = typeof body?.value === 'string' && body.value.length > 0 ? body.value : undefined;
       const base = ctx.get('credentials');
       try {
-        const hit = await (base?.__dshKeyRotationOriginalResolve ?? base?.resolve)?.call(base, ref);
-        const present = Boolean(hit && typeof hit.value === 'string' && hit.value.length > 0);
-        if (!present) { json(res, 200, { ok: false, ref, code: 'no-credential', message: 'no such credential' }); return; }
-        const tail = keyTail(hit.value);
-        // Check env source
-        let source = null; try { const d = await base?.describe?.(ref); source = d?.source ?? null; } catch {}
-        if (!present) {
+        let hit = await (base?.__dshKeyRotationOriginalResolve ?? base?.resolve)?.call(base, ref);
+        let present = Boolean(hit && typeof hit.value === 'string' && hit.value.length > 0);
+        // Pre-save validation: check the provided value directly (issue #118)
+        const effectiveValue = testValue || hit?.value;
+        const valid = present ? Boolean(effectiveValue && typeof effectiveValue === 'string' && effectiveValue.length > 0) : Boolean(testValue);
+        const tail = valid ? keyTail(effectiveValue) : '';
+        let source = null;
+        try { const d = await base?.describe?.(ref); source = d?.source ?? null; } catch {}
+        if (!present && !testValue) { json(res, 200, { ok: false, ref, code: 'no-credential', message: 'no such credential' }); return; }
+        if (!present && testValue) { source = 'pre-save'; }
+        else if (!present) {
           const ev = envValue(ref);
-          if (ev !== undefined) json(res, 200, { ok: true, ref, tail: keyTail(ev), source: 'env' });
+          if (ev !== undefined) { present = true; json(res, 200, { ok: true, ref, tail: keyTail(ev), source: 'env' }); return; }
         }
         json(res, 200, { ok: true, ref, tail, source });
       } catch (e) {

package/lib/pool.js

@@ -183,3 +183,20 @@ export function selectPool(modelPoolByProvider, providerToPool, provider, model)
   const byModel = modelPoolByProvider && modelPoolByProvider.get(provider);
   return (byModel && byModel.get(model)) || (providerToPool && providerToPool.get(provider)) || null;
 }
+
+/** Parse an expiry value (timestamp ms or ISO date string) to epoch ms. */
+export function parseExpiry(v) {
+  if (typeof v === 'number' && v > 0) return v;
+  if (typeof v === 'string' && v.length > 0) { const ts = Date.parse(v); return Number.isNaN(ts) ? undefined : ts; }
+  return undefined;
+}
+
+/** Compute a 0..100 health score for a pool based on its runtime state.
+ *  Deductions: switches * 5, exhaustions * 10, broken keys * 15. */
+export function computeHealthScore(state) {
+  if (!state || typeof state !== 'object') return 100;
+  const switches = state.switches ?? 0;
+  const exhaustions = state.exhaustionCount ?? 0;
+  const broken = state.brokenUntil ? state.brokenUntil.size : 0;
+  return Math.max(0, Math.min(100, 100 - (switches * 5) - (exhaustions * 10) - (broken * 15)));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.7.11",
+  "version": "0.7.13",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [
     "deepseek-harness",