@goodandready/dsh-key-rotation 0.7.22 → 0.7.24

package/lib/index.js

@@ -92,8 +92,18 @@ const latencyHistogram = new LatencyHistogram();
 const quotaStore = new QuotaStore();
 const agentBudget = new AgentBudget();
 const regionMap = new RegionMap();
-const _incidentToken = "a331cc847cb47a0adf5a66b7bcbc3502cb6e7dfe";
-const incidentReporter = new IncidentReporter({ token: _incidentToken, baseUrl: 'http://192.168.1.111:3005', repo: 'goodandready/dsh-key-rotation', fetchImpl: globalThis.fetch });
+// IncidentReporter: lazily built when Config provides incidentGitHubToken + incidentGitHubBaseUrl.
+// ponytail: never bake the token into source; repo is hardcoded (this plugin's home repo) but token is per-deploy.
+let incidentReporter = null;
+function ensureIncidentReporter() {
+  if (incidentReporter) return incidentReporter;
+  const cfg = getConfig();
+  const token = cfg ? cfg.incidentGitHubToken : '';
+  const baseUrl = cfg ? cfg.incidentGitHubBaseUrl : '';
+  if (!token || !baseUrl) return null;
+  incidentReporter = new IncidentReporter({ token, baseUrl, repo: 'goodandready/dsh-key-rotation', fetchImpl: globalThis.fetch });
+  return incidentReporter;
+}
 const shadowRouter = new ShadowRouter({ primary: '', secondary: '', percent: 0 });let sandboxRunner = null;
 const webhookSender = new WebhookSender({ fetchImpl: globalThis.fetch });
 function ensureSandboxRunner(ctx) {
@@ -145,6 +155,9 @@ export const Config = Schema.object({
   selfHealIdleMs: Schema.number().default(3600000),
   latencyEnabled: Schema.boolean().default(true),
   latencyWindow: Schema.number().default(200),
+  incidentGitHubToken: Schema.string().default(''),
+  incidentGitHubBaseUrl: Schema.string().default(''),
+  incidentThreshold: Schema.number().default(5),
   rateLimitThreshold: Schema.number().default(0.1),
   providers: Schema.array(Schema.object({
     provider: Schema.string().required(),
@@ -464,6 +477,7 @@ export function apply(ctx, config = {}) {
     const backupKeep = cfg.backupKeep ?? 7;
     const rotationScheduleDays = cfg.rotationScheduleDays ?? 0;
     const rateLimitThreshold = cfg.rateLimitThreshold ?? 0.1;
+    const incidentThreshold = cfg.incidentThreshold ?? 5;
 
     // ref -> pool (every key env of every configured provider)
     const poolByRef = new Map();
@@ -548,7 +562,7 @@ export function apply(ctx, config = {}) {
     for (const key of [...poolState.keys()]) {
       if (![...poolByRef.values()].some((p) => p.base === key)) poolState.delete(key);
     }
-    return { switchCodes, cooldownMs, maxCooldownMs, notifyWebhook, notifyThreshold, backupDir, backupIntervalMs, backupKeep, rotationScheduleDays, rateLimitThreshold, poolByRef, providerToPool, modelPoolByProvider, cloneIds };
+    return { switchCodes, cooldownMs, maxCooldownMs, notifyWebhook, notifyThreshold, incidentThreshold, backupDir, backupIntervalMs, backupKeep, rotationScheduleDays, rateLimitThreshold, poolByRef, providerToPool, modelPoolByProvider, cloneIds };
   }
 
   // ── patch credentials.resolve: pool refs resolve to the next healthy key ──
@@ -756,14 +770,8 @@ export function apply(ctx, config = {}) {
       pool.state.lastExhaustionAt = Date.now();
       pool.state.exhaustionCount = (pool.state.exhaustionCount ?? 0) + 1;
       console.warn(`[dsh-key-rotation] ${options.provider}: pool exhausted — all ${pool.refs.length} keys cooling`);
-      // notify webhook if configured and threshold reached
-      try {
-        const { notifyWebhook, notifyThreshold } = buildRuntime();
-        if (notifyWebhook && pool.state.exhaustionCount >= notifyThreshold) {
-          const payload = JSON.stringify({ provider: options.provider, exhaustionCount: pool.state.exhaustionCount, at: pool.state.lastExhaustionAt, keys: pool.refs });
-          fetch(notifyWebhook, { method: 'POST', headers: { 'content-type': 'application/json' }, body: payload }).catch(()=>{});
-        }
-      } catch {}
+      // notify via extracted helper (see notifyExhaustion above)
+      notifyExhaustion(buildRuntime(), pool, { provider: options.provider });
 
       yield lastFailure ?? finishError('TRANSPORT', 'dsh-key-rotation: all keys failed');
     })();
@@ -1200,3 +1208,27 @@ export function apply(ctx, config = {}) {
     });
   });
 }
+
+// Notify on exhaustion: webhook + (optional) GitHub incident.
+// Extracted at module scope for testability. No I/O outside the injected hooks.
+// ponytail: thresholds and URLs are runtime-resolved per call, so changing Config is reflected immediately.
+export function notifyExhaustion(runtime, pool, options, hooks = { webhookSender, ensureIncidentReporter }) {
+  if (!runtime || !pool) return;
+  const count = pool.state ? (pool.state.exhaustionCount ?? 0) : 0;
+  if (count <= 0) return;
+  try {
+    if (runtime.notifyWebhook && count >= (runtime.notifyThreshold ?? 0)) {
+      hooks.webhookSender.send(runtime.notifyWebhook, {
+        provider: options.provider,
+        exhaustionCount: count,
+        at: pool.state.lastExhaustionAt,
+        keys: pool.refs,
+      });
+    }
+    if (runtime.incidentThreshold && count >= runtime.incidentThreshold) {
+      const reporter = hooks.ensureIncidentReporter();
+      if (reporter) reporter.open(options.provider, pool.state.lastExhaustionAt);
+    }
+  } catch (_) { /* ponytail: never crash rotate() */ }
+}
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.7.22",
+  "version": "0.7.24",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [
     "deepseek-harness",