@goodandready/dsh-key-rotation 0.8.11 → 0.8.13

package/CHANGELOG.md

@@ -0,0 +1,196 @@
+# Changelog
+
+All notable changes to `@goodandready/dsh-key-rotation` are documented here.
+User-facing feature notes also appear in README (en is source of truth).
+
+## 0.8.13 - 2026-09-17
+
+### Changed
+- **Server Decomposition (#312)**: `lib/index.js` decomposed from 924 to ~562 lines to meet the 600-line plugin authoring threshold. Extracted modular services into `lib/logger.js`, `lib/sandbox-service.js`, `lib/budget-monitor.js`, `lib/pool-builder.js`, and `lib/lifecycle.js`. Public exports and runtime behavior are 100% preserved.
+- **Logging Alignment**: replaced all runtime `console.warn` calls across server modules (`lib/index.js`, `lib/rotate.js`, `lib/ops-status.js`, `lib/ops-webhook.js`) with Cordis scoped logger (`ctx.logger('key-rotation')` / `getLogger(ctx)`).
+
+### Fixed
+- **Preflight & Theme Conformance (#312)**:
+  - Client UI: eliminated 11 hardcoded fallback hex color literals from `lib/client.js`, strictly adopting `--dsw-alias-state-*` tokens.
+  - Client UI: requested `IconChevronDownOutline14` in module header to satisfy preflight icon contract.
+  - HTTP Bridge: added strict HTTP method guard (`GET`, `PUT`, `DELETE`, `OPTIONS`) on `/api/dsh-key-rotation/config` write-capable routes.
+- Preflight score improved to `FAIL: 0, WARN: 1` (only `lib/client.js` exceeding 600 lines as documented single-file browser bundle).
+
+### Verification
+- unit: 375 pass / 0 fail / 1 skipped
+- `bash preflight.sh`: FAIL: 0, WARN: 1
+
+## 0.8.12 - 2026-09-16
+
+### Changed
+- **Internal decompose (#312)**: operational HTTP routes split from a single `lib/routes-ops.js` facade into focused modules (`lib/ops-status.js`, `ops-telemetry.js`, `ops-keys.js`, `ops-test.js`, `ops-webhook.js`, shared `lib/ops-paths.js`). Public entry `registerOpsRoutes` is unchanged.
+- Notify helpers (`notifySwitch`, `pushEvent`, `notifyExhaustion`) extracted to `lib/notify-events.js`; `lib/index.js` re-exports the public pair.
+- `lib/client.js` intentionally remains a single ModuleLoader factory (no bundler contract); pure helpers stay in `lib/client-helpers.js`.
+
+### Fixed
+- `stability-hardening` inject mock now provides `sctx.get` so the settings registration path runs when the schemastery peer is present.
+
+### Notes
+- No user-facing behavior change: same HTTP paths, same rotation/notify semantics, same settings card.
+- `lib/index.js` `apply()` remains a single cordis wiring unit by design.
+
+### Packaging
+- New runtime modules under `lib/` are included via existing `files: ["lib", ...]`.
+
+### Verification
+- unit: 377 pass / 0 fail
+- PR #319 merged to main (`4d78853`)
+
+## 0.8.11 - 2026-09-16
+
+### Added
+- **One-click plugin updater** (#307): host endpoint `GET/POST /api/dsh-key-rotation/update` and settings UI section to check the latest npm version and install it via the standard `dsh plugin add` path. POST is loopback + same-origin gated; GET exposes version metadata only.
+- `lib/best-effort.js` helper for intentional non-critical side effects (sync + async, debug log, never throws) (#315).
+- `dsh.client.inject` declares `@deepseek-ai/dsh-client-locale` and `@deepseek-ai/dsh-client-ui-settings` (#313).
+- Unit tests: `test/plugin-updater-307.test.mjs`, `test/best-effort.test.mjs`.
+
+### Changed
+- Client styles use theme tokens via `color-mix` / `--krot_chart-*` instead of hard-coded rgba/hex (#311).
+- Cyrillic comments in `lib/client.js` translated to English; locale note documents en+zh (#309).
+- DESIGN.md locks: ModuleLoader single-file client constraint; short cordis `export const name` vs scoped npm identity; bestEffort policy (#312, #315).
+
+### Fixed
+- Empty `catch` blocks that swallowed persistence, circuit-reset, webhook-callback and UI errors now go through `bestEffort` with debug logging (#315).
+- Production-path tests retargeted after removal of dead exports (`isSoftFailure`, `TokenBucketAccumulator`, etc.) and `test/bucket-o1.test.mjs` (#314).
+
+### Removed
+- Internal agent files (`AGENTS.md`, `index.md`, `docs/plans/*`) from the git publication set and npm pack (#308).
+- Stale release `.tgz` artifacts from the DEV tree (#310).
+
+### Packaging
+- `npm pack`: 34 files, max file ~105KB (`lib/client.js`), no AGENTS/index/docs/plans/openwiki.
+
+### Verification
+- unit: 248 pass / 0 fail / 1 skip
+- preflight: empty-catch FAIL cleared; remaining name FAIL is accepted short cordis id (image-gen convention)
+- MiniPC test contour: status 200, updater GET 200, POST foreign/missing origin 403, cleanup OK
+- Production candidate (temporary tgz): status 200, providers=2 keys=7 present=7, updater GET 200, POST 403 on non-local origin
+
+## 0.8.8 - 2026-09-12
+
+- feat(ui): add dedicated `.krot-header` with live status badges (pools count, keys configured, circuit state, health score) and subtitle matching `dsh-clinebot` styling (#301, #302)
+- fix(ops): resolve `ReferenceError: quotaStore is not defined` in `GET /dsh-key-rotation/health` by passing dependency from `index.js` and adding defensive invocation (#301, #302)
+- fix(ops): import `isLoopbackAddress` in `routes-ops.js` for local loopback verification without Origin header (#301, #302)
+- fix(ops): guard `lastTestCache.snapshot` in `GET /dsh-key-rotation/sandbox-cache` against Map and mock instances (#301, #302)
+- fix(ops): synchronize provider reset in `POST /dsh-key-rotation/webhook-action` with `RESET_PATH` to clear `authFailCounts`, reset `switches`, and reset `circuitBreaker` (#301, #302)
+- fix(ops): single-key reset in `POST /dsh-key-rotation/reset` now checks and clears `brokenUntil` and `authFailCounts` even when cooldown has elapsed (#301, #302)
+- fix(ops): clean up orphan entries from `poolState` and `lastTestCache` upon key deletion via `DELETE /dsh-key-rotation/key` (#301, #302)
+- test: add comprehensive test suites `test/routes-ops-comprehensive.test.mjs` (12 tests) and `test/http-bridge-config.test.mjs` (5 tests), increasing overall test coverage to 89.40% (359 total unit tests) (#301, #302)
+
+## 0.8.7 - 2026-09-12
+
+- fix(client): resolve `t is not defined` ReferenceError during client bundle factory loading (#285)
+- test: add automated VM execution test for client module loader factory and exports (`test/client-factory-import.test.mjs`)
+
+## 0.8.6 - 2026-09-11
+
+- feat(ops): add e2e failover harness covering multi-key pool exhaustion and recovery (#285)
+- feat(ops): add chaos concurrency tests for parallel rotate/cooldown/reset races (#286)
+- feat(ops): persist pool and circuit-breaker state across restarts via `lib/persistence.js` (#287)
+- fix(ops): resolve persistence path from `persistencePath` → `DSH_HOME` → `cwd`; do not read `ctx.baseDir` (#287, #299)
+- feat(ops): sanitize status snapshots — key values never leave the host (#288)
+- feat(ui): accessible modal (dialog role, focus trap, Escape, focus restore) (#289)
+- feat(ui): loading/error/unavailable/empty card states (#290)
+- feat(ui): keyboard navigation and bulk key removal with confirmation (#291)
+- fix(locale): complete en locale coverage for new UI strings (#292)
+- docs: refresh `index.md` coverage matrix and pack policy (#293, #296)
+- docs: document ModuleLoader single-file client constraint and helper split (#294)
+- chore: branch/worktree hygiene audit recorded (#295)
+
+## 0.8.5 - 2026-09-10
+
+- feat(ui): add interactive key load distribution bar chart (`.krot-load-chart`, `.krot-load-bar`, `.krot-load-segment`) displaying proportional request volume per key (#283, #284)
+- feat(ui): add modal action confirmation dialog (`.krot-modal`, `.krot-modal-card`) for pool cooldown resets and provider/key deletions (#283, #284)
+- fix(ops): activate jitter (`applyJitter`) on 429 and 5xx backoff calculations in `lib/rotate.js` and `lib/index.js` to eliminate the thundering herd retry spike (#283, #284)
+- fix(ops): synchronously reset provider `circuitBreaker` on `POST /dsh-key-rotation/reset` ops route (#283, #284)
+- test: add dedicated Phase 2 test suite `test/stability-phase2-283.test.mjs` (313 total unit tests passing) (#283, #284)
+
+## 0.8.4 - 2026-09-10
+
+- fix(ui): inject `settingsScope` in client manifest and safely guard context property access to prevent ErrorBoundary crash on card mount (#281)
+
+## 0.8.3 - 2026-09-10
+
+- feat(ui): unify settings card styling with `dsh-clinebot` design baseline (`.krot-section-card`, `.krot-stat-box`, `.krot-badge-ok/warn/bad`, `.krot-btn-primary/danger`, 36px inputs with brand focus, `data-dsh-plugin="dsh-key-rotation"` style isolation) (#281, #282)
+- feat(ui): add live pool health telemetry stat boxes (configured pools, total keys, healthy/ready keys) (#281)
+- feat(ui): replace hardcoded hex colors with semantic DSH design system tokens (`--dsw-alias-state-*`, `--dsw-alias-bg-*`) for full dark/light theme fidelity (#281)
+- test: add comprehensive stability coverage test suite (`test/stability-coverage-281.test.mjs`, 18 new unit tests covering quota windows, clock monotonicity, sandbox cache, pool network guards, and http bridge helpers) (#281)
+
+## 0.8.2 - 2026-09-10
+
+- fix(ui): settings live only as `settings.plugin.item` card — fallback `settings.section` sidebar row removed (#275)
+- fix: resolve DSH services via `ctx.get('llm')` / `sctx.get('settings')` instead of bare context properties that proxy to `undefined` (#275)
+- fix(locale): source strings are English-only (`ctx.locale.register(NS, { en })`); other languages come from host `props.t` / translation plugins (#277, GitHub #1)
+- fix(locale): active locale falls back `ctx.locale` snapshot → first `navigator.languages` entry → `en` (core-aligned) (#277)
+- test: card-only, `ctx.get` and full Cyrillic-in-literal locale gates
+
+## 0.8.1 - 2026-09-09
+
+- fix(ui): settings card no longer disappears on open — ErrorBoundary around the section and referentially stable `settingsScope.getSnapshot()` (#273)
+
+## 0.8.0 - 2026-09-09
+
+Stability block (#260–#270). Changed in v0.8.0.
+
+- feat: per-provider **circuit breaker** (`circuitBreakerEnabled`, threshold/openMs/halfOpenProbes) — fail fast while a provider is down (#260)
+- fix: **monotonic process clock** (`performance.timeOrigin + performance.now`) for cooldowns/durations so NTP jumps do not corrupt remaining times (#261)
+- perf: **BoundedMap** (max + TTL + LRU) foundation for usage/notify maps (#262)
+- fix: **non-blocking webhook notify** via bounded NotifyQueue with backoff — rotate() never awaits webhook I/O (#263)
+- feat: **atomic file I/O helpers** (`atomicWriteFile`/`safeReadJson`/`safeParseJson`) — corrupt JSON never wipes previous state (#264)
+- fix: in-stream failover remains safe across reload; `quotaStore` properly injected into rotate (#265)
+- feat: **clone-route GC** — `expectedClones` computed from live providers; orphans dropped from runtime set (#266)
+- test: **error taxonomy table** — 408/425/429/5xx, ECONNRESET/ETIMEDOUT, gRPC codes classified switch|surface|cooldown (#267)
+- fix: status API returns **single snapshot** with `circuit`, `meta.expectedClones`, `meta.notifyQueue` (#268)
+- test: **smoke harness** `test/smoke-rotation-080.test.mjs` — mock 429 → key switch → success (#269)
+- docs: full 0.8.0 documentation package (README en/ru/zh config tables, DESIGN taxonomy, index test matrix) (#270)
+
+## 0.7.40 - 2026-09-09
+
+- docs: align README en/ru/zh and DESIGN.md with shipped surface after v0.7.36 de-bloat (#251)
+- docs: add project `index.md` and `AGENTS.md` (#252)
+- refactor: split `lib/index.js` into `rotate.js`, `http-bridge.js`, `routes-ops.js` (#253)
+- feat: `verboseLogging` config (default false) gates per-request rotation logs (#254)
+- docs: CHANGELOG history and task_plan hygiene (#255)
+
+## 0.7.39 - 2026-08-28
+
+- fix(heal): wire `lastUsedAt` into `credentials.resolve` and idle self-heal sweep; cache sweep runtime (issue #249, PR #250)
+- perf: fewer redundant `buildRuntime()` calls on hot path
+
+## 0.7.38 - 2026-08-28
+
+- perf(hotpath): single-pass `extractRateLimit`, memoized `todayIso`, zero-allocation status totals, purge stale notify maps (issue #246)
+
+## 0.7.37 - 2026-08-28
+
+- fix(concurrency): AsyncLocalStorage request isolation for `pickedRef`; stream-exception failover before first token; copy `attemptList`; wire 30-day usage compaction; clear quarantine after successful sandbox probe (issue #243)
+
+## 0.7.36 - 2026-08-27
+
+- refactor: remove overengineered modules (`shadow`, `incident`, `agent-budget`, `region`, `canary`, `maintenance`)
+- perf: memoize `buildRuntime()`, atomic pointer round-robin, HTTP/gRPC error detection, exhaustion ETA, smart visibility polling
+
+## 0.7.34 - 2026-08-27
+
+- fix(authoring): lifecycle dispose for credentials.resolve / stream listeners; secret role masking; settingsScope integration (PR #241)
+
+## 0.7.33 - 2026-08-27
+
+- fix: key probing baseURL via pool owner; cascade recursion guard; midnight PST sign; timer cleanup via cordis effect; stale lock recovery in least-loaded balancer; zh locale
+
+## 0.7.31 - 2026-08-27
+
+- perf: O(1) token bucket; soft vs hard backoff; penalty decay; cooldown jitter; canary probing (later removed in 0.7.36); TTFT percentiles; webhook digest; 30-day usage compaction; optimistic UI + filter pills
+
+## 0.7.20 - 2026-08-27
+
+- fix(client): hoist `h` to factory scope for KeyRotationCard (#155)
+
+## Earlier
+
+See Gitea release history and README changelog sections for pre-0.7.20 work.

package/lib/budget-monitor.js

@@ -0,0 +1,123 @@
+// lib/budget-monitor.js — periodic budget, expiry, low health and SLO alerts
+import { expiringSoon, shouldNotifyDaily, costForDay, costForWeek, budgetVerdict } from './pool.js';
+
+const DAY_MS = 86400000;
+
+export function checkBudgetAndHealthAlerts({
+  runtime,
+  poolState,
+  now,
+  expiryNotifiedAt,
+  budgetNotifiedAt,
+  lowHealthNotifiedAt,
+  sloNotifiedAt,
+  latencyHistogram,
+  webhookSender,
+  logger,
+}) {
+  try {
+    const seen = new Set();
+    for (const pool of runtime.poolByRef.values()) {
+      if (seen.has(pool.base)) continue;
+      seen.add(pool.base);
+      // #207: keys expiring within expiryWarnDays -> one webhook per key/day
+      for (const { ref, expiresInDays } of expiringSoon(pool, runtime.expiryWarnDays, now)) {
+        if (!shouldNotifyDaily(expiryNotifiedAt, pool.base + ':' + ref, now)) continue;
+        logger?.warn?.(`[dsh-key-rotation] ${pool.base}: key ${ref} expires in ~${expiresInDays}d`);
+        if (runtime.notifyWebhook) {
+          webhookSender.send(runtime.notifyWebhook, {
+            title: `Key expiring soon: ${pool.base}`,
+            text: `${ref} expires in ~${expiresInDays} day(s)`,
+            provider: pool.base,
+            kind: 'expiry',
+            keys: [ref],
+          });
+        }
+      }
+      // #208: daily/weekly budget -> warn webhook, optional 1-day pause at 100%
+      const budget = runtime.providerBudgets.get(pool.base);
+      if (!budget) continue;
+      const daily = costForDay(pool.state.costDays);
+      const weekly = costForWeek(pool.state.costDays, now);
+      const verdict = budgetVerdict(daily, budget.costBudgetDaily);
+      const wVerdict = budgetVerdict(weekly, budget.costBudgetWeekly);
+      const hit = verdict.warn || wVerdict.warn;
+      if (hit && shouldNotifyDaily(budgetNotifiedAt, pool.base + ':budget', now)) {
+        logger?.warn?.(`[dsh-key-rotation] ${pool.base}: cost budget - day $${daily.toFixed(2)}/$${budget.costBudgetDaily} week $${weekly.toFixed(2)}/$${budget.costBudgetWeekly}`);
+        if (runtime.notifyWebhook) {
+          // #217: budget webhook gains action buttons when a callback token is configured
+          const token = runtime.webhookActionToken ?? '';
+          webhookSender.send(runtime.notifyWebhook, {
+            title: `Cost budget: ${pool.base}`,
+            text: `day $${daily.toFixed(2)} of $${budget.costBudgetDaily} · week $${weekly.toFixed(2)} of $${budget.costBudgetWeekly}` + (verdict.exceeded || wVerdict.exceeded ? ' · EXCEEDED' : ''),
+            provider: pool.base,
+            kind: 'budget',
+            spend: { daily, weekly },
+            actionToken: token || undefined,
+            actions: token ? [
+              { id: `pause-${pool.base}`, label: 'Pause 1h' },
+              { id: `reset-${pool.base}`, label: 'Reset cooldown' },
+            ] : undefined,
+          });
+        }
+      }
+      if ((verdict.exceeded || wVerdict.exceeded) && budget.pauseOnBudget) {
+        const until = now + DAY_MS;
+        for (const ref of pool.refs) {
+          if ((pool.state.failedUntil.get(ref) ?? 0) < until) pool.state.failedUntil.set(ref, until);
+        }
+      }
+      // #221: pool running low - webhook while healthy < warnBelowHealthy
+      const warnBelow = runtime.warnBelowHealthy ?? 0;
+      if (warnBelow > 0) {
+        let healthy = 0;
+        for (const ref of pool.refs) {
+          const fu = pool.state.failedUntil.get(ref);
+          if (fu !== undefined && fu > now) continue;
+          const exp = pool.expiresAt?.[ref];
+          if (exp !== undefined && now >= exp) continue;
+          healthy++;
+        }
+        if (healthy < warnBelow && shouldNotifyDaily(lowHealthNotifiedAt, pool.base, now)) {
+          logger?.warn?.(`[dsh-key-rotation] ${pool.base}: pool running low - ${healthy}/${pool.refs.length} healthy`);
+          if (runtime.notifyWebhook) {
+            const token = runtime.webhookActionToken ?? '';
+            webhookSender.send(runtime.notifyWebhook, {
+              title: `Pool running low: ${pool.base}`,
+              text: `${healthy}/${pool.refs.length} keys healthy (alert below ${warnBelow})`,
+              provider: pool.base,
+              kind: 'low-health',
+              healthy,
+              total: pool.refs.length,
+              actionToken: token || undefined,
+              actions: token ? [{ id: `reset-${pool.base}`, label: 'Reset cooldown' }] : undefined,
+            });
+          }
+        }
+      }
+      // #225: latency SLO - webhook when a key's p95 exceeds the threshold
+      const slo = runtime.latencySloMs ?? 0;
+      if (slo > 0) {
+        for (const ref of pool.refs) {
+          const snap = latencyHistogram.snapshot(ref);
+          if (!snap.p95 || snap.p95 <= slo) continue;
+          if (!shouldNotifyDaily(sloNotifiedAt, pool.base + ':' + ref + ':slo', now)) continue;
+          logger?.warn?.(`[dsh-key-rotation] ${pool.base}: ${ref} p95 ${Math.round(snap.p95)}ms > SLO ${slo}ms`);
+          if (runtime.notifyWebhook) {
+            webhookSender.send(runtime.notifyWebhook, {
+              title: `Latency SLO exceeded: ${pool.base}`,
+              text: `${ref} p95 ${Math.round(snap.p95)}ms > ${slo}ms (${snap.count} samples)`,
+              provider: pool.base,
+              kind: 'latency-slo',
+              ref,
+              p95: Math.round(snap.p95),
+              slo,
+            });
+          }
+        }
+      }
+    }
+  } catch (_) {
+    /* maintenance must never crash the sweep */
+  }
+}

package/lib/client.js

@@ -21,6 +21,15 @@ window.__ModuleLoader__.load({
     const React = require('react');
     const h = React.createElement;
 
+        // Core primitives and chevron icon
+    let ChevronIcon = null;
+    try {
+      const primitives = require('@deepseek-ai/dsh-client-primitives') || require('@deepseek-ai/dsh-client-icons');
+      ChevronIcon = primitives && (primitives.IconChevronDownOutline14 || primitives.IconChevronDownOutline);
+    } catch (err) {
+      ChevronIcon = null;
+    }
+
     const CONFIG_PATH = '/dsh-key-rotation/config';
     const NS = 'dsh-key-rotation';
 
@@ -413,7 +422,7 @@ window.__ModuleLoader__.load({
       '.krot-page-sub{font-size:13px;color:var(--dsw-alias-label-secondary);line-height:1.5}',
       '.krot p{margin:0}',
       '.krot-hint{font-size:12px;color:var(--dsw-alias-label-secondary);line-height:1.4}',
-      '.krot-err{font-size:13px;color:var(--dsw-alias-state-error-primary);padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 10%, transparent);display:flex;align-items:center;gap:8px}',
+      '.krot-err{font-size:13px;color:var(--dsw-alias-state-error-primary);padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, transparent);display:flex;align-items:center;gap:8px}',
       '.krot-label{font-size:13px;font-weight:500;color:var(--dsw-alias-label-primary)}',
       '.krot-field{display:flex;flex-direction:column;gap:6px}',
       '.krot-in{background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-primary);border-radius:8px;padding:0 12px;font-size:13px;height:36px;font-family:inherit;min-width:0;width:100%;box-sizing:border-box;transition:border-color .15s ease}',
@@ -436,15 +445,15 @@ window.__ModuleLoader__.load({
       '.krot-load-legend{display:flex;flex-wrap:wrap;gap:8px;margin-top:6px;font-size:11px}',
       '.krot-load-item{display:inline-flex;align-items:center;gap:4px}',
       '.krot-load-dot{width:7px;height:7px;border-radius:50%}',
-      '.krot-modal-backdrop{position:fixed;top:0;left:0;right:0;bottom:0;background:var(--dsw-alias-bg-overlay, color-mix(in srgb, var(--dsw-alias-bg-layer-1, #000) 55%, transparent));z-index:9999;display:flex;align-items:center;justify-content:center;backdrop-filter:blur(2px)}',
-      '.krot-modal-card{width:90%;max-width:420px;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;box-shadow:0 12px 36px color-mix(in srgb, var(--dsw-alias-bg-layer-1, #000) 28%, transparent);padding:20px;display:flex;flex-direction:column;gap:12px}',
+      '.krot-modal-backdrop{position:fixed;top:0;left:0;right:0;bottom:0;background:var(--dsw-alias-bg-overlay, color-mix(in srgb, var(--dsw-alias-bg-layer-1) 55%, transparent));z-index:9999;display:flex;align-items:center;justify-content:center;backdrop-filter:blur(2px)}',
+      '.krot-modal-card{width:90%;max-width:420px;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;box-shadow:0 12px 36px color-mix(in srgb, var(--dsw-alias-bg-layer-1) 28%, transparent);padding:20px;display:flex;flex-direction:column;gap:12px}',
       '.krot-modal-title{font-size:16px;font-weight:600;color:var(--dsw-alias-label-primary)}',
       '.krot-modal-desc{font-size:13px;color:var(--dsw-alias-label-secondary);line-height:1.45}',
       '.krot-modal-actions{display:flex;justify-content:flex-end;gap:10px;margin-top:8px}',
       '.krot-badge{font-size:12px;padding:3px 10px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);display:inline-flex;align-items:center;gap:5px;font-weight:500;white-space:nowrap}',
-      '.krot-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:color-mix(in srgb, var(--dsw-alias-state-success-primary, #10b981) 8%, transparent)}',
-      '.krot-badge-warn{border-color:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);background:color-mix(in srgb, var(--dsw-alias-state-warning-primary, #f59e0b) 8%, transparent)}',
-      '.krot-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 8%, transparent)}',
+      '.krot-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:color-mix(in srgb, var(--dsw-alias-state-success-primary) 8%, transparent)}',
+      '.krot-badge-warn{border-color:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);background:color-mix(in srgb, var(--dsw-alias-state-warning-primary) 8%, transparent)}',
+      '.krot-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 8%, transparent)}',
       '.krot-prov{display:flex;flex-direction:column;gap:12px;border:1px solid var(--dsw-alias-border-l2);border-radius:10px;background:var(--dsw-alias-bg-layer-2);padding:14px 16px}',
       '.krot-prov-head{display:flex;gap:10px;align-items:center;flex-wrap:wrap}',
       '.krot-prov-head select{flex:1;min-width:180px}',
@@ -462,18 +471,18 @@ window.__ModuleLoader__.load({
       '.krot-btn:hover:not(:disabled){background:var(--dsw-alias-bg-layer-4,var(--dsw-alias-bg-layer-2));border-color:var(--dsw-alias-label-dimmed,var(--dsw-alias-border-l2))}',
       '.krot-btn-primary,.krot-save{background:var(--dsw-alias-label-primary);color:var(--dsw-alias-bg-layer-3);border-color:transparent;font-weight:600}',
       '.krot-btn-primary:hover:not(:disabled),.krot-save:hover:not(:disabled){background:var(--dsw-alias-label-primary)!important;color:var(--dsw-alias-bg-layer-3)!important;opacity:0.88}',
-      '.krot-btn-danger{color:var(--dsw-alias-state-error-primary);border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 30%, transparent)}',
-      '.krot-btn-danger:hover:not(:disabled){background:color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 12%, transparent)!important;border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 50%, transparent)}',
+      '.krot-btn-danger{color:var(--dsw-alias-state-error-primary);border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary) 30%, transparent)}',
+      '.krot-btn-danger:hover:not(:disabled){background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 12%, transparent)!important;border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary) 50%, transparent)}',
       '.krot-btn:disabled{opacity:0.45;cursor:not-allowed}',
       '.krot-foot{display:flex;gap:10px;align-items:center;flex-wrap:wrap}',
       '.krot-filter-bar{display:flex;gap:8px;margin:4px 0 10px;flex-wrap:wrap}',
       '.krot-pill{appearance:none;background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:999px;padding:4px 12px;font-size:12px;font-weight:500;color:var(--dsw-alias-label-secondary);cursor:pointer;transition:all .15s ease}',
       '.krot-pill:hover{background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-primary)}',
       '.krot-pill-active{background:var(--dsw-alias-label-primary);border-color:var(--dsw-alias-label-primary);color:var(--dsw-alias-bg-layer-3)!important;font-weight:600}',
-      '.krot-pill-warn{border-color:color-mix(in srgb, var(--dsw-alias-state-warning-primary, #f59e0b) 30%, transparent);color:var(--dsw-alias-state-warning-primary)}',
-      '.krot-pill-err{border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 30%, transparent);color:var(--dsw-alias-state-error-primary)}',
-      '.krot-alert-ok{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-success-primary, #10b981) 10%, transparent);color:var(--dsw-alias-state-success-primary);font-size:13px;display:flex;align-items:center;gap:10px}',
-      '.krot-alert-bad{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 10%, transparent);color:var(--dsw-alias-state-error-primary);font-size:13px;display:flex;align-items:center;gap:10px}',
+      '.krot-pill-warn{border-color:color-mix(in srgb, var(--dsw-alias-state-warning-primary) 30%, transparent);color:var(--dsw-alias-state-warning-primary)}',
+      '.krot-pill-err{border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary) 30%, transparent);color:var(--dsw-alias-state-error-primary)}',
+      '.krot-alert-ok{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-success-primary) 10%, transparent);color:var(--dsw-alias-state-success-primary);font-size:13px;display:flex;align-items:center;gap:10px}',
+      '.krot-alert-bad{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, transparent);color:var(--dsw-alias-state-error-primary);font-size:13px;display:flex;align-items:center;gap:10px}',
       '.krot-event-stream{display:flex;flex-direction:column;gap:6px;margin-top:8px;padding:10px 12px;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);border-radius:8px}',
       '.krot-event-row{display:flex;align-items:center;gap:8px;font-size:12px;padding:4px 0;border-bottom:1px solid var(--dsw-alias-border-l1)}',
       '.krot-event-time{font-family:ui-monospace,Menlo,Consolas,monospace;color:var(--dsw-alias-label-tertiary);font-size:11px}',
@@ -487,7 +496,7 @@ window.__ModuleLoader__.load({
       '.krot-card-body{border-top:1px solid var(--dsw-alias-border-l2);margin:0 16px;padding:16px 0 8px}',
       '.krot-header-chip{display:inline-flex;align-items:center;gap:6px;height:26px;padding:0 10px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);font-size:12px;font-weight:600;cursor:pointer;position:relative;user-select:none;transition:all .15s ease}',
       '.krot-header-chip:hover{background:var(--dsw-alias-interactive-bg-hover,var(--dsw-alias-bg-layer-3));border-color:var(--dsw-alias-border-l1);transform:translateY(-0.5px)}',
-      '.krot-popover{position:absolute;top:calc(100% + 6px);right:0;z-index:10000;min-width:220px;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;padding:12px 14px;box-shadow:0 16px 40px color-mix(in srgb, var(--dsw-alias-bg-layer-1, #000) 45%, transparent),0 2px 8px color-mix(in srgb, var(--dsw-alias-bg-layer-1, #000) 15%, transparent);backdrop-filter:blur(16px);-webkit-backdrop-filter:blur(16px);display:flex;flex-direction:column;gap:8px;text-align:left}',
+      '.krot-popover{position:absolute;top:calc(100% + 6px);right:0;z-index:10000;min-width:220px;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;padding:12px 14px;box-shadow:0 16px 40px color-mix(in srgb, var(--dsw-alias-bg-layer-1) 45%, transparent),0 2px 8px color-mix(in srgb, var(--dsw-alias-bg-layer-1) 15%, transparent);backdrop-filter:blur(16px);-webkit-backdrop-filter:blur(16px);display:flex;flex-direction:column;gap:8px;text-align:left}',
       '.krot-pop-title{font-size:11px;font-weight:700;letter-spacing:.06em;text-transform:uppercase;color:var(--dsw-alias-label-secondary)}',
       '.krot-pop-row{display:flex;align-items:center;justify-content:space-between;gap:12px;padding:4px 0}',
       '.krot-pop-name{font-size:13px;font-weight:600;color:var(--dsw-alias-label-primary);display:flex;align-items:center;gap:8px}',