@goodandready/dsh-key-rotation 0.7.33 → 0.7.35

package/README.md

@@ -251,4 +251,11 @@ All management routes require loopback authentication (`127.0.0.1` / `::1`) with
 
 ## 📄 License
 
-MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)
+MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)
+
+### v0.7.35
+- **Lifecycle Cleanups**: Wrapped `credentials.resolve` patch and `ctx.on` event handlers (`llm/stream`, `agent/request-error`) in `ctx.effect` scopes with guaranteed unmount cleanup (#238, #239).
+- **Settings & Secret Roles**: Added `.role('secret')` to `incidentGitHubToken` and `webhookActionToken` in `Config` schema for automatic UI masking (#237).
+- **Settings Architecture & UI**: Added native `settingsScope` snapshot reading/saving in settings card with graceful bridge fallback (#235).
+- **Localization**: Localized `settings.section` sidebar fallback label via `t('title')` and registered `zh` dictionary in `ctx.locale` alongside `en` and `ru` (#236).
+- **Dead Code Purge**: Removed obsolete `mountDashboard` routine after header-chip migration (#240).

package/README.ru.md

@@ -251,4 +251,11 @@ dsh-key-rotation:
 
 ## 📄 Лицензия
 
-MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)
+MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)
+
+### v0.7.35
+- **Очистка жизненного цикла**: Патч `credentials.resolve` и слушатели событий `ctx.on` (`llm/stream`, `agent/request-error`) переведены в скоупы `ctx.effect` с автоматическим восстановлением функций и отпиской при выгрузке плагина (#238, #239).
+- **Роли секретов в схеме**: Полям `incidentGitHubToken` и `webhookActionToken` в схеме `Config` присвоена роль `.role('secret')` для маскирования в UI (#237).
+- **Архитектура настроек**: Добавлена нативная интеграция со снимками `settingsScope` в карточке настроек с безопасным фоллбеком на HTTP-мост (#235).
+- **Локализация**: Фоллбек секции настроек `settings.section` переведён на локализованную метку `t('title')` со слотом `locale: NS`, а китайский словарь `zh` зарегистрирован в `ctx.locale` наряду с `en` и `ru` (#236).
+- **Удаление мёртвого кода**: Удалена неиспользуемая функция `mountDashboard` после перехода на header chip (#240).

package/README.zh.md

@@ -212,4 +212,11 @@ dsh-key-rotation:
 
 ## 📄 开源许可
 
-MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)
+MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)
+
+### v0.7.35
+- **生命周期清理**: 将 `credentials.resolve` 猴子补丁和 `ctx.on` 事件监听器 (`llm/stream`, `agent/request-error`) 封装在 `ctx.effect` 作用域内，确保卸载时自动注销并恢复原始方法 (#238, #239)。
+- **配置密钥角色**: 在 `Config` Schema 中为 `incidentGitHubToken` 和 `webhookActionToken` 增加 `.role('secret')`，避免明文泄露并在 UI 中掩码显示 (#237)。
+- **设置架构与状态**: 在设置卡片中增加原生 `settingsScope` 绑定支持，保留 HTTP 桥接安全回退机制 (#235)。
+- **本地化与文案**: 侧边栏备用项 `settings.section` 标签支持本地化 `t('title')` 并配置 `locale: NS`，并在 `ctx.locale` 中注册 `zh` 中文字典 (#236)。
+- **死代码清理**: 移除 header-chip 迁移后残留的废弃 `mountDashboard` 函数 (#240)。

package/lib/client.js

@@ -390,6 +390,20 @@ window.__ModuleLoader__.load({
     function KeyRotationSection(props) {
       const DICT = props.locale === 'ru' ? ru : (props.locale === 'zh' ? zh : en);
       const t = makeT(DICT, en);
+      const settingsScope = React.useMemo(() => {
+        if (props.ctx && props.ctx.settingsScope) {
+          try {
+            return props.ctx.settingsScope.bind({ namespace: NS });
+          } catch (_) {
+            return null;
+          }
+        }
+        return null;
+      }, [props.ctx]);
+      const scopeSnapshot = React.useSyncExternalStore(
+        React.useMemo(() => (cb) => (settingsScope ? settingsScope.subscribe(cb) : () => {}), [settingsScope]),
+        React.useCallback(() => (settingsScope ? settingsScope.getSnapshot() : null), [settingsScope])
+      );
       const [state, setState] = React.useState({ status: 'loading', value: null, revision: 0, error: '', providers: [] });
       const [draft, setDraft] = React.useState(null);
       // ── all hooks live ABOVE any early return (React error 310 otherwise) ──
@@ -455,7 +469,18 @@ window.__ModuleLoader__.load({
           .catch((e) => setState((s) => ({ ...s, status: 'error', error: String(e) })));
       }, []);
 
-      React.useEffect(() => { load(); }, [load]);
+      React.useEffect(() => {
+        if (scopeSnapshot && scopeSnapshot.status === 'ready' && scopeSnapshot.value) {
+          setState((s) => ({
+            ...s,
+            status: 'ready',
+            value: scopeSnapshot.value,
+            revision: scopeSnapshot.revision ?? s.revision,
+          }));
+        } else {
+          load();
+        }
+      }, [load, scopeSnapshot]);
 
       const val = draft ?? state.value;
       const status = useRotationStatus();
@@ -650,21 +675,38 @@ window.__ModuleLoader__.load({
       const save = () => {
         if (!draft) return;
         setState((s) => ({ ...s, status: 'saving', error: '' }));
-        fetch(CONFIG_PATH, {
-          method: 'PUT',
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify({ section: draft, expectedRevision: state.revision }),
-        })
-          .then((r) => r.json())
-          .then((data) => {
-            if (data.error) {
-              setState((s) => ({ ...s, status: 'error', error: data.error.message }));
-              return;
-            }
-            setState((s) => ({ status: 'ready', value: data.value ?? draft, revision: data.revision ?? s.revision, error: '', providers: s.providers }));
-            setDraft(null);
+        const saveViaBridge = () => {
+          fetch(CONFIG_PATH, {
+            method: 'PUT',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ section: draft, expectedRevision: state.revision }),
           })
-          .catch((e) => setState((s) => ({ ...s, status: 'error', error: String(e) })));
+            .then((r) => r.json())
+            .then((data) => {
+              if (data.error) {
+                setState((s) => ({ ...s, status: 'error', error: data.error.message }));
+                return;
+              }
+              setState((s) => ({ status: 'ready', value: data.value ?? draft, revision: data.revision ?? s.revision, error: '', providers: s.providers }));
+              setDraft(null);
+            })
+            .catch((e) => setState((s) => ({ ...s, status: 'error', error: String(e) })));
+        };
+        if (settingsScope && typeof settingsScope.set === 'function') {
+          (async () => {
+            try {
+              for (const [k, v] of Object.entries(draft)) {
+                await settingsScope.set(k, v);
+              }
+              setState((s) => ({ ...s, status: 'ready', value: draft, error: '' }));
+              setDraft(null);
+            } catch (_) {
+              saveViaBridge();
+            }
+          })();
+          return;
+        }
+        saveViaBridge();
       };
 
       
@@ -1021,13 +1063,7 @@ window.__ModuleLoader__.load({
       );
     }
 
-    function mountDashboard() {
-      // Floating dashboard disabled in favor of pinned header chip popover
-      if (typeof document !== 'undefined') {
-        var el = document.getElementById('krot-dash');
-        if (el) el.remove();
-      }
-    }
+
 
     // #201 header chip: one dot + counts for all pools. Green = all healthy,
     // amber = some keys cooling, red = a pool fully exhausted. Click opens the
@@ -1096,9 +1132,7 @@ window.__ModuleLoader__.load({
     }
 
     function apply(ctx) {
-      ctx.effect(() => ctx.locale.register(NS, { en, ru }), 'dsh-key-rotation: dictionaries');
-      // Dashboard widget: lives on every page, polls /health (#152).
-      ctx.effect(() => mountDashboard(), 'dsh-key-rotation: dashboard widget');
+      ctx.effect(() => ctx.locale.register(NS, { en, ru, zh }), 'dsh-key-rotation: dictionaries');
       // Header chip (#201): status dot in the session header utilities slot,
       // same slot dsh-gitea / dsh-subscriptions use for their header widgets.
       ctx.effect(() => {
@@ -1144,8 +1178,16 @@ window.__ModuleLoader__.load({
       };
       if (!tryPluginItem()) {
         // Fallback for builds without the Plugins tab slot: keep the sidebar section.
+        const t = ctx.locale ? ctx.locale.bind(NS) : null;
         ctx.slots.inject('settings.section', () => ctx.slots.register(
-          { name: 'settings.section', id: 'dsh-key-rotation', order: 20, label: () => 'Key Rotation' },
+          {
+            name: 'settings.section',
+            id: 'dsh-key-rotation',
+            order: 20,
+            locale: NS,
+            label: () => (t ? t('title') : 'Key Rotation') || 'Key Rotation',
+            inject: () => ({ ctx }),
+          },
           (props) => h(KeyRotationSection, { ...props, locale: useLocale() }),
         ));
       }

package/lib/index.js

@@ -219,7 +219,7 @@ export const Config = Schema.object({
   selfHealIdleMs: Schema.number().default(3600000),
   latencyEnabled: Schema.boolean().default(true),
   latencyWindow: Schema.number().default(200),
-  incidentGitHubToken: Schema.string().default(''),
+  incidentGitHubToken: Schema.string().role('secret').default(''),
   incidentGitHubBaseUrl: Schema.string().default(''),
   incidentThreshold: Schema.number().default(5),
   concurrencyLimit: Schema.number().default(0),
@@ -235,7 +235,7 @@ export const Config = Schema.object({
   }),
   rateLimitThreshold: Schema.number().default(0.1),
   rpmLimit: Schema.number().default(0),
-  webhookActionToken: Schema.string().default(''),
+  webhookActionToken: Schema.string().role('secret').default(''),
   expiryWarnDays: Schema.number().default(7),
   switchNotify: Schema.boolean().default(false),
   switchNotifyThrottleMs: Schema.number().default(60000),
@@ -862,13 +862,14 @@ export function apply(ctx, config = {}) {
   // ── patch credentials.resolve: pool refs resolve to the next healthy key ──
   // Round-robin over the pool, skipping keys in cooldown; the request's
   // provider identity never changes, so pi-ai replay state stays consistent.
-  const credentials = ctx.get('credentials');
-  if (credentials && typeof credentials.resolve === 'function' && !credentials.__dshKeyRotationPatched) {
-    const original = credentials.resolve.bind(credentials);
-    // Kept for the status route: it must ask about one exact ref instead of
-    // being rotated to a different key by the patch below.
-    credentials.__dshKeyRotationOriginalResolve = original;
-    credentials.resolve = async (ref) => {
+  ctx.effect(() => {
+    const credentials = ctx.get('credentials');
+    if (credentials && typeof credentials.resolve === 'function' && !credentials.__dshKeyRotationPatched) {
+      const original = credentials.resolve.bind(credentials);
+      // Kept for the status route: it must ask about one exact ref instead of
+      // being rotated to a different key by the patch below.
+      credentials.__dshKeyRotationOriginalResolve = original;
+      credentials.resolve = async (ref) => {
       const { poolByRef } = buildRuntime();
       const pool = poolByRef.get(ref);
       if (!pool) return original(ref);
@@ -944,9 +945,17 @@ export function apply(ctx, config = {}) {
         }
       }
       return original(ref); // everything cooled/missing — surface the base value
-    };
-    credentials.__dshKeyRotationPatched = true;
-  }
+      };
+      credentials.__dshKeyRotationPatched = true;
+      return () => {
+        if (credentials.__dshKeyRotationPatched) {
+          credentials.resolve = original;
+          delete credentials.__dshKeyRotationPatched;
+          delete credentials.__dshKeyRotationOriginalResolve;
+        }
+      };
+    }
+  }, 'dsh-key-rotation: patch credentials.resolve');
 
   const finishError = (code, message) => ({
     type: 'finish',
@@ -1777,7 +1786,7 @@ export function apply(ctx, config = {}) {
     },
   }), 'dsh-key-rotation: agent-budget');
 
-  ctx.on('llm/stream', (options, next) => {
+  ctx.effect(() => ctx.on('llm/stream', (options, next) => {
     if (options[MARKER]) return next();
     if (rotationDisabled) return next(); // #199: disabled via webhook action
     const { providerToPool, modelPoolByProvider } = buildRuntime();
@@ -1786,13 +1795,13 @@ export function apply(ctx, config = {}) {
     if (!pool) return next();
     console.warn(`[dsh-key-rotation] rotating ${options.provider}/${options.model} across ${(pool.weightedRefs ?? pool.refs).length} slots (${pool.refs.length} keys)`);
     return rotate(options, pool);
-  });
+  }), 'dsh-key-rotation: llm/stream');
 
   // Safety net for non-stream requests (agent/request-error waterfall).
   // llm/stream covers streaming calls; sync calls (embeddings, batch) go
   // through agent/request and surface errors here. If the error is
   // switchable, mark the key and ask the agent loop to retry.
-  ctx.on('agent/request-error', async (payload, next) => {
+  ctx.effect(() => ctx.on('agent/request-error', async (payload, next) => {
     const provider = payload?.provider ?? payload?.failure?.provider ?? '';
     if (!provider) return next();
     const { providerToPool, modelPoolByProvider, switchCodes } = buildRuntime();
@@ -1815,7 +1824,7 @@ export function apply(ctx, config = {}) {
       console.warn(`[dsh-key-rotation] ${provider}: key ${String(ref)} failed via agent/request-error (${String(code)} ${String(message).slice(0, 80)}) — retry`);
     }
     return { kind: 'retry' };
-  });
+  }), 'dsh-key-rotation: agent/request-error');
 
   ctx.inject(['settings'], (sctx) => {
     const scope = sctx.settings.register(NS, Config, { base: config });

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.7.33",
+  "version": "0.7.35",
+  "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [
     "deepseek-harness",
@@ -40,13 +41,13 @@
     },
     "client": {
       "platform": "web",
-      "inject": [
-        "@deepseek-ai/dsh-client-runtime",
-        "@deepseek-ai/dsh-client-ui-slots"
-      ]
+      "inject": []
     }
   },
   "license": "MIT",
+  "engines": {
+    "node": ">=18"
+  },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
     "@deepseek-ai/schemastery": "^3.18.1",