@goodandready/dsh-key-rotation 0.8.12 → 0.8.14

package/CHANGELOG.md

@@ -0,0 +1,216 @@
+# Changelog
+
+All notable changes to `@goodandready/dsh-key-rotation` are documented here.
+User-facing feature notes also appear in README (en is source of truth).
+
+## 0.8.14 - 2026-09-19
+
+### Fixed
+- **Critical fix: switchable error rotation crash (#324, GitHub #3 / PR #4)**: `isSwitchableError()` in `lib/pool.js` now normalizes `switchCodes` to a `Set` when passed as an array. Previously, runtime schema arrays (`cfg.switchCodes`, `DEFAULT_SWITCH_CODES`) caused `TypeError: switchCodes.has is not a function`, crashing turns on rate limits, quota exhaustion, and 5xx errors instead of rotating keys.
+- **Critical fix: settings UI render crash (#324, GitHub #2 / PR #5)**: declared `UpdaterSection` at factory scope in `lib/client.js` before `KeyRotationSection`, removing the `apply(ctx)`-local declaration that caused `ReferenceError: UpdaterSection is not defined`.
+- **Security hardening: packageSpec validation (#324, GitHub #6)**: added strict package spec regex validation in `lib/plugin-updater.js` `installExact()` before child process invocation, preventing command-option injection.
+- **Settings reachable again**: the card registered into `settings.plugin.item`, a
+  slot the current DSH core (0.1.6-alpha.2) no longer renders, so the plugin's
+  settings were unreachable. The surface now registers into the Plugins page row
+  seat `plugins.row.config` first, keyed
+  `@goodandready/dsh-key-rotation#dsh-key-rotation` (`rowConfigKey(package, rowId)`):
+  the plugin's row gains a configure control whose page is the settings form
+  (`view: 'page'`, open and without our card chrome — the host page draws the title,
+  icon, crumb and padding) plus a one-line state for `view: 'summary'`. The legacy
+  seat stays registered as a fallback for older cores.
+
+Version bump and public release are intentionally held back for now: the feature
+work on `feat/issue-303-v089-evolution` is still in flight, so this change lands in
+`main` without a release.
+
+## 0.8.13 - 2026-09-17
+
+### Changed
+- **Server Decomposition (#312)**: `lib/index.js` decomposed from 924 to ~562 lines to meet the 600-line plugin authoring threshold. Extracted modular services into `lib/logger.js`, `lib/sandbox-service.js`, `lib/budget-monitor.js`, `lib/pool-builder.js`, and `lib/lifecycle.js`. Public exports and runtime behavior are 100% preserved.
+- **Logging Alignment**: replaced all runtime `console.warn` calls across server modules (`lib/index.js`, `lib/rotate.js`, `lib/ops-status.js`, `lib/ops-webhook.js`) with Cordis scoped logger (`ctx.logger('key-rotation')` / `getLogger(ctx)`).
+
+### Fixed
+- **Preflight & Theme Conformance (#312)**:
+  - Client UI: eliminated 11 hardcoded fallback hex color literals from `lib/client.js`, strictly adopting `--dsw-alias-state-*` tokens.
+  - Client UI: requested `IconChevronDownOutline14` in module header to satisfy preflight icon contract.
+  - HTTP Bridge: added strict HTTP method guard (`GET`, `PUT`, `DELETE`, `OPTIONS`) on `/api/dsh-key-rotation/config` write-capable routes.
+- Preflight score improved to `FAIL: 0, WARN: 1` (only `lib/client.js` exceeding 600 lines as documented single-file browser bundle).
+
+### Verification
+- unit: 375 pass / 0 fail / 1 skipped
+- `bash preflight.sh`: FAIL: 0, WARN: 1
+
+## 0.8.12 - 2026-09-16
+
+### Changed
+- **Internal decompose (#312)**: operational HTTP routes split from a single `lib/routes-ops.js` facade into focused modules (`lib/ops-status.js`, `ops-telemetry.js`, `ops-keys.js`, `ops-test.js`, `ops-webhook.js`, shared `lib/ops-paths.js`). Public entry `registerOpsRoutes` is unchanged.
+- Notify helpers (`notifySwitch`, `pushEvent`, `notifyExhaustion`) extracted to `lib/notify-events.js`; `lib/index.js` re-exports the public pair.
+- `lib/client.js` intentionally remains a single ModuleLoader factory (no bundler contract); pure helpers stay in `lib/client-helpers.js`.
+
+### Fixed
+- `stability-hardening` inject mock now provides `sctx.get` so the settings registration path runs when the schemastery peer is present.
+
+### Notes
+- No user-facing behavior change: same HTTP paths, same rotation/notify semantics, same settings card.
+- `lib/index.js` `apply()` remains a single cordis wiring unit by design.
+
+### Packaging
+- New runtime modules under `lib/` are included via existing `files: ["lib", ...]`.
+
+### Verification
+- unit: 377 pass / 0 fail
+- PR #319 merged to main (`4d78853`)
+
+## 0.8.11 - 2026-09-16
+
+### Added
+- **One-click plugin updater** (#307): host endpoint `GET/POST /api/dsh-key-rotation/update` and settings UI section to check the latest npm version and install it via the standard `dsh plugin add` path. POST is loopback + same-origin gated; GET exposes version metadata only.
+- `lib/best-effort.js` helper for intentional non-critical side effects (sync + async, debug log, never throws) (#315).
+- `dsh.client.inject` declares `@deepseek-ai/dsh-client-locale` and `@deepseek-ai/dsh-client-ui-settings` (#313).
+- Unit tests: `test/plugin-updater-307.test.mjs`, `test/best-effort.test.mjs`.
+
+### Changed
+- Client styles use theme tokens via `color-mix` / `--krot_chart-*` instead of hard-coded rgba/hex (#311).
+- Cyrillic comments in `lib/client.js` translated to English; locale note documents en+zh (#309).
+- DESIGN.md locks: ModuleLoader single-file client constraint; short cordis `export const name` vs scoped npm identity; bestEffort policy (#312, #315).
+
+### Fixed
+- Empty `catch` blocks that swallowed persistence, circuit-reset, webhook-callback and UI errors now go through `bestEffort` with debug logging (#315).
+- Production-path tests retargeted after removal of dead exports (`isSoftFailure`, `TokenBucketAccumulator`, etc.) and `test/bucket-o1.test.mjs` (#314).
+
+### Removed
+- Internal agent files (`AGENTS.md`, `index.md`, `docs/plans/*`) from the git publication set and npm pack (#308).
+- Stale release `.tgz` artifacts from the DEV tree (#310).
+
+### Packaging
+- `npm pack`: 34 files, max file ~105KB (`lib/client.js`), no AGENTS/index/docs/plans/openwiki.
+
+### Verification
+- unit: 248 pass / 0 fail / 1 skip
+- preflight: empty-catch FAIL cleared; remaining name FAIL is accepted short cordis id (image-gen convention)
+- MiniPC test contour: status 200, updater GET 200, POST foreign/missing origin 403, cleanup OK
+- Production candidate (temporary tgz): status 200, providers=2 keys=7 present=7, updater GET 200, POST 403 on non-local origin
+
+## 0.8.8 - 2026-09-12
+
+- feat(ui): add dedicated `.krot-header` with live status badges (pools count, keys configured, circuit state, health score) and subtitle matching `dsh-clinebot` styling (#301, #302)
+- fix(ops): resolve `ReferenceError: quotaStore is not defined` in `GET /dsh-key-rotation/health` by passing dependency from `index.js` and adding defensive invocation (#301, #302)
+- fix(ops): import `isLoopbackAddress` in `routes-ops.js` for local loopback verification without Origin header (#301, #302)
+- fix(ops): guard `lastTestCache.snapshot` in `GET /dsh-key-rotation/sandbox-cache` against Map and mock instances (#301, #302)
+- fix(ops): synchronize provider reset in `POST /dsh-key-rotation/webhook-action` with `RESET_PATH` to clear `authFailCounts`, reset `switches`, and reset `circuitBreaker` (#301, #302)
+- fix(ops): single-key reset in `POST /dsh-key-rotation/reset` now checks and clears `brokenUntil` and `authFailCounts` even when cooldown has elapsed (#301, #302)
+- fix(ops): clean up orphan entries from `poolState` and `lastTestCache` upon key deletion via `DELETE /dsh-key-rotation/key` (#301, #302)
+- test: add comprehensive test suites `test/routes-ops-comprehensive.test.mjs` (12 tests) and `test/http-bridge-config.test.mjs` (5 tests), increasing overall test coverage to 89.40% (359 total unit tests) (#301, #302)
+
+## 0.8.7 - 2026-09-12
+
+- fix(client): resolve `t is not defined` ReferenceError during client bundle factory loading (#285)
+- test: add automated VM execution test for client module loader factory and exports (`test/client-factory-import.test.mjs`)
+
+## 0.8.6 - 2026-09-11
+
+- feat(ops): add e2e failover harness covering multi-key pool exhaustion and recovery (#285)
+- feat(ops): add chaos concurrency tests for parallel rotate/cooldown/reset races (#286)
+- feat(ops): persist pool and circuit-breaker state across restarts via `lib/persistence.js` (#287)
+- fix(ops): resolve persistence path from `persistencePath` → `DSH_HOME` → `cwd`; do not read `ctx.baseDir` (#287, #299)
+- feat(ops): sanitize status snapshots — key values never leave the host (#288)
+- feat(ui): accessible modal (dialog role, focus trap, Escape, focus restore) (#289)
+- feat(ui): loading/error/unavailable/empty card states (#290)
+- feat(ui): keyboard navigation and bulk key removal with confirmation (#291)
+- fix(locale): complete en locale coverage for new UI strings (#292)
+- docs: refresh `index.md` coverage matrix and pack policy (#293, #296)
+- docs: document ModuleLoader single-file client constraint and helper split (#294)
+- chore: branch/worktree hygiene audit recorded (#295)
+
+## 0.8.5 - 2026-09-10
+
+- feat(ui): add interactive key load distribution bar chart (`.krot-load-chart`, `.krot-load-bar`, `.krot-load-segment`) displaying proportional request volume per key (#283, #284)
+- feat(ui): add modal action confirmation dialog (`.krot-modal`, `.krot-modal-card`) for pool cooldown resets and provider/key deletions (#283, #284)
+- fix(ops): activate jitter (`applyJitter`) on 429 and 5xx backoff calculations in `lib/rotate.js` and `lib/index.js` to eliminate the thundering herd retry spike (#283, #284)
+- fix(ops): synchronously reset provider `circuitBreaker` on `POST /dsh-key-rotation/reset` ops route (#283, #284)
+- test: add dedicated Phase 2 test suite `test/stability-phase2-283.test.mjs` (313 total unit tests passing) (#283, #284)
+
+## 0.8.4 - 2026-09-10
+
+- fix(ui): inject `settingsScope` in client manifest and safely guard context property access to prevent ErrorBoundary crash on card mount (#281)
+
+## 0.8.3 - 2026-09-10
+
+- feat(ui): unify settings card styling with `dsh-clinebot` design baseline (`.krot-section-card`, `.krot-stat-box`, `.krot-badge-ok/warn/bad`, `.krot-btn-primary/danger`, 36px inputs with brand focus, `data-dsh-plugin="dsh-key-rotation"` style isolation) (#281, #282)
+- feat(ui): add live pool health telemetry stat boxes (configured pools, total keys, healthy/ready keys) (#281)
+- feat(ui): replace hardcoded hex colors with semantic DSH design system tokens (`--dsw-alias-state-*`, `--dsw-alias-bg-*`) for full dark/light theme fidelity (#281)
+- test: add comprehensive stability coverage test suite (`test/stability-coverage-281.test.mjs`, 18 new unit tests covering quota windows, clock monotonicity, sandbox cache, pool network guards, and http bridge helpers) (#281)
+
+## 0.8.2 - 2026-09-10
+
+- fix(ui): settings live only as `settings.plugin.item` card — fallback `settings.section` sidebar row removed (#275)
+- fix: resolve DSH services via `ctx.get('llm')` / `sctx.get('settings')` instead of bare context properties that proxy to `undefined` (#275)
+- fix(locale): source strings are English-only (`ctx.locale.register(NS, { en })`); other languages come from host `props.t` / translation plugins (#277, GitHub #1)
+- fix(locale): active locale falls back `ctx.locale` snapshot → first `navigator.languages` entry → `en` (core-aligned) (#277)
+- test: card-only, `ctx.get` and full Cyrillic-in-literal locale gates
+
+## 0.8.1 - 2026-09-09
+
+- fix(ui): settings card no longer disappears on open — ErrorBoundary around the section and referentially stable `settingsScope.getSnapshot()` (#273)
+
+## 0.8.0 - 2026-09-09
+
+Stability block (#260–#270). Changed in v0.8.0.
+
+- feat: per-provider **circuit breaker** (`circuitBreakerEnabled`, threshold/openMs/halfOpenProbes) — fail fast while a provider is down (#260)
+- fix: **monotonic process clock** (`performance.timeOrigin + performance.now`) for cooldowns/durations so NTP jumps do not corrupt remaining times (#261)
+- perf: **BoundedMap** (max + TTL + LRU) foundation for usage/notify maps (#262)
+- fix: **non-blocking webhook notify** via bounded NotifyQueue with backoff — rotate() never awaits webhook I/O (#263)
+- feat: **atomic file I/O helpers** (`atomicWriteFile`/`safeReadJson`/`safeParseJson`) — corrupt JSON never wipes previous state (#264)
+- fix: in-stream failover remains safe across reload; `quotaStore` properly injected into rotate (#265)
+- feat: **clone-route GC** — `expectedClones` computed from live providers; orphans dropped from runtime set (#266)
+- test: **error taxonomy table** — 408/425/429/5xx, ECONNRESET/ETIMEDOUT, gRPC codes classified switch|surface|cooldown (#267)
+- fix: status API returns **single snapshot** with `circuit`, `meta.expectedClones`, `meta.notifyQueue` (#268)
+- test: **smoke harness** `test/smoke-rotation-080.test.mjs` — mock 429 → key switch → success (#269)
+- docs: full 0.8.0 documentation package (README en/ru/zh config tables, DESIGN taxonomy, index test matrix) (#270)
+
+## 0.7.40 - 2026-09-09
+
+- docs: align README en/ru/zh and DESIGN.md with shipped surface after v0.7.36 de-bloat (#251)
+- docs: add project `index.md` and `AGENTS.md` (#252)
+- refactor: split `lib/index.js` into `rotate.js`, `http-bridge.js`, `routes-ops.js` (#253)
+- feat: `verboseLogging` config (default false) gates per-request rotation logs (#254)
+- docs: CHANGELOG history and task_plan hygiene (#255)
+
+## 0.7.39 - 2026-08-28
+
+- fix(heal): wire `lastUsedAt` into `credentials.resolve` and idle self-heal sweep; cache sweep runtime (issue #249, PR #250)
+- perf: fewer redundant `buildRuntime()` calls on hot path
+
+## 0.7.38 - 2026-08-28
+
+- perf(hotpath): single-pass `extractRateLimit`, memoized `todayIso`, zero-allocation status totals, purge stale notify maps (issue #246)
+
+## 0.7.37 - 2026-08-28
+
+- fix(concurrency): AsyncLocalStorage request isolation for `pickedRef`; stream-exception failover before first token; copy `attemptList`; wire 30-day usage compaction; clear quarantine after successful sandbox probe (issue #243)
+
+## 0.7.36 - 2026-08-27
+
+- refactor: remove overengineered modules (`shadow`, `incident`, `agent-budget`, `region`, `canary`, `maintenance`)
+- perf: memoize `buildRuntime()`, atomic pointer round-robin, HTTP/gRPC error detection, exhaustion ETA, smart visibility polling
+
+## 0.7.34 - 2026-08-27
+
+- fix(authoring): lifecycle dispose for credentials.resolve / stream listeners; secret role masking; settingsScope integration (PR #241)
+
+## 0.7.33 - 2026-08-27
+
+- fix: key probing baseURL via pool owner; cascade recursion guard; midnight PST sign; timer cleanup via cordis effect; stale lock recovery in least-loaded balancer; zh locale
+
+## 0.7.31 - 2026-08-27
+
+- perf: O(1) token bucket; soft vs hard backoff; penalty decay; cooldown jitter; canary probing (later removed in 0.7.36); TTFT percentiles; webhook digest; 30-day usage compaction; optimistic UI + filter pills
+
+## 0.7.20 - 2026-08-27
+
+- fix(client): hoist `h` to factory scope for KeyRotationCard (#155)
+
+## Earlier
+
+See Gitea release history and README changelog sections for pre-0.7.20 work.

package/lib/budget-monitor.js

@@ -0,0 +1,123 @@
+// lib/budget-monitor.js — periodic budget, expiry, low health and SLO alerts
+import { expiringSoon, shouldNotifyDaily, costForDay, costForWeek, budgetVerdict } from './pool.js';
+
+const DAY_MS = 86400000;
+
+export function checkBudgetAndHealthAlerts({
+  runtime,
+  poolState,
+  now,
+  expiryNotifiedAt,
+  budgetNotifiedAt,
+  lowHealthNotifiedAt,
+  sloNotifiedAt,
+  latencyHistogram,
+  webhookSender,
+  logger,
+}) {
+  try {
+    const seen = new Set();
+    for (const pool of runtime.poolByRef.values()) {
+      if (seen.has(pool.base)) continue;
+      seen.add(pool.base);
+      // #207: keys expiring within expiryWarnDays -> one webhook per key/day
+      for (const { ref, expiresInDays } of expiringSoon(pool, runtime.expiryWarnDays, now)) {
+        if (!shouldNotifyDaily(expiryNotifiedAt, pool.base + ':' + ref, now)) continue;
+        logger?.warn?.(`[dsh-key-rotation] ${pool.base}: key ${ref} expires in ~${expiresInDays}d`);
+        if (runtime.notifyWebhook) {
+          webhookSender.send(runtime.notifyWebhook, {
+            title: `Key expiring soon: ${pool.base}`,
+            text: `${ref} expires in ~${expiresInDays} day(s)`,
+            provider: pool.base,
+            kind: 'expiry',
+            keys: [ref],
+          });
+        }
+      }
+      // #208: daily/weekly budget -> warn webhook, optional 1-day pause at 100%
+      const budget = runtime.providerBudgets.get(pool.base);
+      if (!budget) continue;
+      const daily = costForDay(pool.state.costDays);
+      const weekly = costForWeek(pool.state.costDays, now);
+      const verdict = budgetVerdict(daily, budget.costBudgetDaily);
+      const wVerdict = budgetVerdict(weekly, budget.costBudgetWeekly);
+      const hit = verdict.warn || wVerdict.warn;
+      if (hit && shouldNotifyDaily(budgetNotifiedAt, pool.base + ':budget', now)) {
+        logger?.warn?.(`[dsh-key-rotation] ${pool.base}: cost budget - day $${daily.toFixed(2)}/$${budget.costBudgetDaily} week $${weekly.toFixed(2)}/$${budget.costBudgetWeekly}`);
+        if (runtime.notifyWebhook) {
+          // #217: budget webhook gains action buttons when a callback token is configured
+          const token = runtime.webhookActionToken ?? '';
+          webhookSender.send(runtime.notifyWebhook, {
+            title: `Cost budget: ${pool.base}`,
+            text: `day $${daily.toFixed(2)} of $${budget.costBudgetDaily} · week $${weekly.toFixed(2)} of $${budget.costBudgetWeekly}` + (verdict.exceeded || wVerdict.exceeded ? ' · EXCEEDED' : ''),
+            provider: pool.base,
+            kind: 'budget',
+            spend: { daily, weekly },
+            actionToken: token || undefined,
+            actions: token ? [
+              { id: `pause-${pool.base}`, label: 'Pause 1h' },
+              { id: `reset-${pool.base}`, label: 'Reset cooldown' },
+            ] : undefined,
+          });
+        }
+      }
+      if ((verdict.exceeded || wVerdict.exceeded) && budget.pauseOnBudget) {
+        const until = now + DAY_MS;
+        for (const ref of pool.refs) {
+          if ((pool.state.failedUntil.get(ref) ?? 0) < until) pool.state.failedUntil.set(ref, until);
+        }
+      }
+      // #221: pool running low - webhook while healthy < warnBelowHealthy
+      const warnBelow = runtime.warnBelowHealthy ?? 0;
+      if (warnBelow > 0) {
+        let healthy = 0;
+        for (const ref of pool.refs) {
+          const fu = pool.state.failedUntil.get(ref);
+          if (fu !== undefined && fu > now) continue;
+          const exp = pool.expiresAt?.[ref];
+          if (exp !== undefined && now >= exp) continue;
+          healthy++;
+        }
+        if (healthy < warnBelow && shouldNotifyDaily(lowHealthNotifiedAt, pool.base, now)) {
+          logger?.warn?.(`[dsh-key-rotation] ${pool.base}: pool running low - ${healthy}/${pool.refs.length} healthy`);
+          if (runtime.notifyWebhook) {
+            const token = runtime.webhookActionToken ?? '';
+            webhookSender.send(runtime.notifyWebhook, {
+              title: `Pool running low: ${pool.base}`,
+              text: `${healthy}/${pool.refs.length} keys healthy (alert below ${warnBelow})`,
+              provider: pool.base,
+              kind: 'low-health',
+              healthy,
+              total: pool.refs.length,
+              actionToken: token || undefined,
+              actions: token ? [{ id: `reset-${pool.base}`, label: 'Reset cooldown' }] : undefined,
+            });
+          }
+        }
+      }
+      // #225: latency SLO - webhook when a key's p95 exceeds the threshold
+      const slo = runtime.latencySloMs ?? 0;
+      if (slo > 0) {
+        for (const ref of pool.refs) {
+          const snap = latencyHistogram.snapshot(ref);
+          if (!snap.p95 || snap.p95 <= slo) continue;
+          if (!shouldNotifyDaily(sloNotifiedAt, pool.base + ':' + ref + ':slo', now)) continue;
+          logger?.warn?.(`[dsh-key-rotation] ${pool.base}: ${ref} p95 ${Math.round(snap.p95)}ms > SLO ${slo}ms`);
+          if (runtime.notifyWebhook) {
+            webhookSender.send(runtime.notifyWebhook, {
+              title: `Latency SLO exceeded: ${pool.base}`,
+              text: `${ref} p95 ${Math.round(snap.p95)}ms > ${slo}ms (${snap.count} samples)`,
+              provider: pool.base,
+              kind: 'latency-slo',
+              ref,
+              p95: Math.round(snap.p95),
+              slo,
+            });
+          }
+        }
+      }
+    }
+  } catch (_) {
+    /* maintenance must never crash the sweep */
+  }
+}

package/lib/client.js

@@ -21,8 +21,21 @@ window.__ModuleLoader__.load({
     const React = require('react');
     const h = React.createElement;
 
+        // Core primitives and chevron icon
+    let ChevronIcon = null;
+    try {
+      const primitives = require('@deepseek-ai/dsh-client-primitives') || require('@deepseek-ai/dsh-client-icons');
+      ChevronIcon = primitives && (primitives.IconChevronDownOutline14 || primitives.IconChevronDownOutline);
+    } catch (err) {
+      ChevronIcon = null;
+    }
+
     const CONFIG_PATH = '/dsh-key-rotation/config';
     const NS = 'dsh-key-rotation';
+    // Plugins page row seat (DSH 0.1.6-alpha.2): key = '<package name>#<row id>'.
+    const PKG = '@goodandready/dsh-key-rotation';
+    const ROW_ID = 'dsh-key-rotation';
+    const ROW_CONFIG_KEY = PKG + '#' + ROW_ID;
 
     // -------------------------------------------------------------- i18n
     const en = {
@@ -413,7 +426,7 @@ window.__ModuleLoader__.load({
       '.krot-page-sub{font-size:13px;color:var(--dsw-alias-label-secondary);line-height:1.5}',
       '.krot p{margin:0}',
       '.krot-hint{font-size:12px;color:var(--dsw-alias-label-secondary);line-height:1.4}',
-      '.krot-err{font-size:13px;color:var(--dsw-alias-state-error-primary);padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 10%, transparent);display:flex;align-items:center;gap:8px}',
+      '.krot-err{font-size:13px;color:var(--dsw-alias-state-error-primary);padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, transparent);display:flex;align-items:center;gap:8px}',
       '.krot-label{font-size:13px;font-weight:500;color:var(--dsw-alias-label-primary)}',
       '.krot-field{display:flex;flex-direction:column;gap:6px}',
       '.krot-in{background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-primary);border-radius:8px;padding:0 12px;font-size:13px;height:36px;font-family:inherit;min-width:0;width:100%;box-sizing:border-box;transition:border-color .15s ease}',
@@ -436,15 +449,15 @@ window.__ModuleLoader__.load({
       '.krot-load-legend{display:flex;flex-wrap:wrap;gap:8px;margin-top:6px;font-size:11px}',
       '.krot-load-item{display:inline-flex;align-items:center;gap:4px}',
       '.krot-load-dot{width:7px;height:7px;border-radius:50%}',
-      '.krot-modal-backdrop{position:fixed;top:0;left:0;right:0;bottom:0;background:var(--dsw-alias-bg-overlay, color-mix(in srgb, var(--dsw-alias-bg-layer-1, #000) 55%, transparent));z-index:9999;display:flex;align-items:center;justify-content:center;backdrop-filter:blur(2px)}',
-      '.krot-modal-card{width:90%;max-width:420px;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;box-shadow:0 12px 36px color-mix(in srgb, var(--dsw-alias-bg-layer-1, #000) 28%, transparent);padding:20px;display:flex;flex-direction:column;gap:12px}',
+      '.krot-modal-backdrop{position:fixed;top:0;left:0;right:0;bottom:0;background:var(--dsw-alias-bg-overlay, color-mix(in srgb, var(--dsw-alias-bg-layer-1) 55%, transparent));z-index:9999;display:flex;align-items:center;justify-content:center;backdrop-filter:blur(2px)}',
+      '.krot-modal-card{width:90%;max-width:420px;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;box-shadow:0 12px 36px color-mix(in srgb, var(--dsw-alias-bg-layer-1) 28%, transparent);padding:20px;display:flex;flex-direction:column;gap:12px}',
       '.krot-modal-title{font-size:16px;font-weight:600;color:var(--dsw-alias-label-primary)}',
       '.krot-modal-desc{font-size:13px;color:var(--dsw-alias-label-secondary);line-height:1.45}',
       '.krot-modal-actions{display:flex;justify-content:flex-end;gap:10px;margin-top:8px}',
       '.krot-badge{font-size:12px;padding:3px 10px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);display:inline-flex;align-items:center;gap:5px;font-weight:500;white-space:nowrap}',
-      '.krot-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:color-mix(in srgb, var(--dsw-alias-state-success-primary, #10b981) 8%, transparent)}',
-      '.krot-badge-warn{border-color:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);background:color-mix(in srgb, var(--dsw-alias-state-warning-primary, #f59e0b) 8%, transparent)}',
-      '.krot-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 8%, transparent)}',
+      '.krot-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:color-mix(in srgb, var(--dsw-alias-state-success-primary) 8%, transparent)}',
+      '.krot-badge-warn{border-color:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);background:color-mix(in srgb, var(--dsw-alias-state-warning-primary) 8%, transparent)}',
+      '.krot-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 8%, transparent)}',
       '.krot-prov{display:flex;flex-direction:column;gap:12px;border:1px solid var(--dsw-alias-border-l2);border-radius:10px;background:var(--dsw-alias-bg-layer-2);padding:14px 16px}',
       '.krot-prov-head{display:flex;gap:10px;align-items:center;flex-wrap:wrap}',
       '.krot-prov-head select{flex:1;min-width:180px}',
@@ -462,18 +475,18 @@ window.__ModuleLoader__.load({
       '.krot-btn:hover:not(:disabled){background:var(--dsw-alias-bg-layer-4,var(--dsw-alias-bg-layer-2));border-color:var(--dsw-alias-label-dimmed,var(--dsw-alias-border-l2))}',
       '.krot-btn-primary,.krot-save{background:var(--dsw-alias-label-primary);color:var(--dsw-alias-bg-layer-3);border-color:transparent;font-weight:600}',
       '.krot-btn-primary:hover:not(:disabled),.krot-save:hover:not(:disabled){background:var(--dsw-alias-label-primary)!important;color:var(--dsw-alias-bg-layer-3)!important;opacity:0.88}',
-      '.krot-btn-danger{color:var(--dsw-alias-state-error-primary);border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 30%, transparent)}',
-      '.krot-btn-danger:hover:not(:disabled){background:color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 12%, transparent)!important;border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 50%, transparent)}',
+      '.krot-btn-danger{color:var(--dsw-alias-state-error-primary);border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary) 30%, transparent)}',
+      '.krot-btn-danger:hover:not(:disabled){background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 12%, transparent)!important;border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary) 50%, transparent)}',
       '.krot-btn:disabled{opacity:0.45;cursor:not-allowed}',
       '.krot-foot{display:flex;gap:10px;align-items:center;flex-wrap:wrap}',
       '.krot-filter-bar{display:flex;gap:8px;margin:4px 0 10px;flex-wrap:wrap}',
       '.krot-pill{appearance:none;background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:999px;padding:4px 12px;font-size:12px;font-weight:500;color:var(--dsw-alias-label-secondary);cursor:pointer;transition:all .15s ease}',
       '.krot-pill:hover{background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-primary)}',
       '.krot-pill-active{background:var(--dsw-alias-label-primary);border-color:var(--dsw-alias-label-primary);color:var(--dsw-alias-bg-layer-3)!important;font-weight:600}',
-      '.krot-pill-warn{border-color:color-mix(in srgb, var(--dsw-alias-state-warning-primary, #f59e0b) 30%, transparent);color:var(--dsw-alias-state-warning-primary)}',
-      '.krot-pill-err{border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 30%, transparent);color:var(--dsw-alias-state-error-primary)}',
-      '.krot-alert-ok{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-success-primary, #10b981) 10%, transparent);color:var(--dsw-alias-state-success-primary);font-size:13px;display:flex;align-items:center;gap:10px}',
-      '.krot-alert-bad{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 10%, transparent);color:var(--dsw-alias-state-error-primary);font-size:13px;display:flex;align-items:center;gap:10px}',
+      '.krot-pill-warn{border-color:color-mix(in srgb, var(--dsw-alias-state-warning-primary) 30%, transparent);color:var(--dsw-alias-state-warning-primary)}',
+      '.krot-pill-err{border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary) 30%, transparent);color:var(--dsw-alias-state-error-primary)}',
+      '.krot-alert-ok{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-success-primary) 10%, transparent);color:var(--dsw-alias-state-success-primary);font-size:13px;display:flex;align-items:center;gap:10px}',
+      '.krot-alert-bad{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, transparent);color:var(--dsw-alias-state-error-primary);font-size:13px;display:flex;align-items:center;gap:10px}',
       '.krot-event-stream{display:flex;flex-direction:column;gap:6px;margin-top:8px;padding:10px 12px;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);border-radius:8px}',
       '.krot-event-row{display:flex;align-items:center;gap:8px;font-size:12px;padding:4px 0;border-bottom:1px solid var(--dsw-alias-border-l1)}',
       '.krot-event-time{font-family:ui-monospace,Menlo,Consolas,monospace;color:var(--dsw-alias-label-tertiary);font-size:11px}',
@@ -487,7 +500,7 @@ window.__ModuleLoader__.load({
       '.krot-card-body{border-top:1px solid var(--dsw-alias-border-l2);margin:0 16px;padding:16px 0 8px}',
       '.krot-header-chip{display:inline-flex;align-items:center;gap:6px;height:26px;padding:0 10px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);font-size:12px;font-weight:600;cursor:pointer;position:relative;user-select:none;transition:all .15s ease}',
       '.krot-header-chip:hover{background:var(--dsw-alias-interactive-bg-hover,var(--dsw-alias-bg-layer-3));border-color:var(--dsw-alias-border-l1);transform:translateY(-0.5px)}',
-      '.krot-popover{position:absolute;top:calc(100% + 6px);right:0;z-index:10000;min-width:220px;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;padding:12px 14px;box-shadow:0 16px 40px color-mix(in srgb, var(--dsw-alias-bg-layer-1, #000) 45%, transparent),0 2px 8px color-mix(in srgb, var(--dsw-alias-bg-layer-1, #000) 15%, transparent);backdrop-filter:blur(16px);-webkit-backdrop-filter:blur(16px);display:flex;flex-direction:column;gap:8px;text-align:left}',
+      '.krot-popover{position:absolute;top:calc(100% + 6px);right:0;z-index:10000;min-width:220px;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;padding:12px 14px;box-shadow:0 16px 40px color-mix(in srgb, var(--dsw-alias-bg-layer-1) 45%, transparent),0 2px 8px color-mix(in srgb, var(--dsw-alias-bg-layer-1) 15%, transparent);backdrop-filter:blur(16px);-webkit-backdrop-filter:blur(16px);display:flex;flex-direction:column;gap:8px;text-align:left}',
       '.krot-pop-title{font-size:11px;font-weight:700;letter-spacing:.06em;text-transform:uppercase;color:var(--dsw-alias-label-secondary)}',
       '.krot-pop-row{display:flex;align-items:center;justify-content:space-between;gap:12px;padding:4px 0}',
       '.krot-pop-name{font-size:13px;font-weight:600;color:var(--dsw-alias-label-primary);display:flex;align-items:center;gap:8px}',
@@ -565,6 +578,70 @@ window.__ModuleLoader__.load({
       };
     }
 
+    function UpdaterSection({ t }) {
+      const [state, setState] = React.useState({ phase: 'idle', current: '', latest: '', message: '' });
+      const load = React.useCallback(async () => {
+        setState((s) => ({ ...s, phase: 'loading', message: '' }));
+        try {
+          const res = await fetch('/api/dsh-key-rotation/update', { headers: { 'x-dsh-plugin-update': '1' } });
+          const data = await res.json();
+          if (!res.ok) throw new Error(data?.error?.message || t('updateFailed'));
+          setState({
+            phase: data.updateAvailable ? 'available' : 'current',
+            current: data.currentVersion || '',
+            latest: data.latestVersion || '',
+            message: data.updateAvailable ? t('updateAvailable') : t('updateNone'),
+          });
+        } catch (e) {
+          setState({ phase: 'error', current: '', latest: '', message: e?.message || t('updateFailed') });
+        }
+      }, [t]);
+      React.useEffect(() => { load(); }, [load]);
+      const run = async () => {
+        setState((s) => ({ ...s, phase: 'running', message: t('updateRunning') }));
+        try {
+          const res = await fetch('/api/dsh-key-rotation/update', {
+            method: 'POST',
+            headers: { 'x-dsh-plugin-update': '1', 'content-type': 'application/json' },
+          });
+          const data = await res.json();
+          if (!res.ok) throw new Error(data?.error?.message || t('updateFailed'));
+          setState({
+            phase: 'done',
+            current: data.currentVersion || '',
+            latest: data.installedVersion || data.latestVersion || '',
+            message: t('updateRestart'),
+          });
+        } catch (e) {
+          setState({ phase: 'error', current: '', latest: '', message: e?.message || t('updateFailed') });
+        }
+      };
+      return h('div', { className: 'krot-update', style: { marginTop: 12, paddingTop: 12, borderTop: '1px solid var(--dsw-alias-border-l2)' } },
+        h('div', { style: { display: 'flex', gap: 8, alignItems: 'center', flexWrap: 'wrap' } },
+          h('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary)' } },
+            t('currentVersion') + ': ' + (state.current || '—')),
+          state.latest ? h('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary)' } },
+            t('latestVersion') + ': ' + state.latest) : null,
+          h('button', {
+            className: 'krot-btn',
+            type: 'button',
+            disabled: state.phase === 'running' || state.phase === 'loading',
+            onClick: load,
+          }, t('updateCheck')),
+          state.phase === 'available' ? h('button', {
+            className: 'krot-btn krot-btn-primary',
+            type: 'button',
+            disabled: state.phase === 'running',
+            onClick: run,
+          }, t('updateRun')) : null,
+        ),
+        state.message ? h('div', {
+          className: state.phase === 'error' ? 'krot-alert-bad' : state.phase === 'done' ? 'krot-alert-ok' : '',
+          style: { marginTop: 8, fontSize: 12 },
+        }, state.message) : null,
+      );
+    }
+
     function KeyRotationSection(props) {
       const t = resolveT(props);
       const settingsScope = React.useMemo(() => {
@@ -1716,94 +1793,42 @@ window.__ModuleLoader__.load({
       // (settings.plugin.item), matching Model Sync / Spendmeter / Vision Bridge.
       // key MUST equal the settings namespace (NS), else the tab silently skips it.
       
-  function UpdaterSection({ t }) {
-    const [state, setState] = React.useState({ phase: 'idle', current: '', latest: '', message: '' });
-    const load = React.useCallback(async () => {
-      setState((s) => ({ ...s, phase: 'loading', message: '' }));
-      try {
-        const res = await fetch('/api/dsh-key-rotation/update', { headers: { 'x-dsh-plugin-update': '1' } });
-        const data = await res.json();
-        if (!res.ok) throw new Error(data?.error?.message || t('updateFailed'));
-        setState({
-          phase: data.updateAvailable ? 'available' : 'current',
-          current: data.currentVersion || '',
-          latest: data.latestVersion || '',
-          message: data.updateAvailable ? t('updateAvailable') : t('updateNone'),
-        });
-      } catch (e) {
-        setState({ phase: 'error', current: '', latest: '', message: e?.message || t('updateFailed') });
-      }
-    }, [t]);
-    React.useEffect(() => { load(); }, [load]);
-    const run = async () => {
-      setState((s) => ({ ...s, phase: 'running', message: t('updateRunning') }));
-      try {
-        const res = await fetch('/api/dsh-key-rotation/update', {
-          method: 'POST',
-          headers: { 'x-dsh-plugin-update': '1', 'content-type': 'application/json' },
-        });
-        const data = await res.json();
-        if (!res.ok) throw new Error(data?.error?.message || t('updateFailed'));
-        setState({
-          phase: 'done',
-          current: data.currentVersion || '',
-          latest: data.installedVersion || data.latestVersion || '',
-          message: t('updateRestart'),
-        });
-      } catch (e) {
-        setState({ phase: 'error', current: '', latest: '', message: e?.message || t('updateFailed') });
-      }
-    };
-    return h('div', { className: 'krot-update', style: { marginTop: 12, paddingTop: 12, borderTop: '1px solid var(--dsw-alias-border-l2)' } },
-      h('div', { style: { display: 'flex', gap: 8, alignItems: 'center', flexWrap: 'wrap' } },
-        h('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary)' } },
-          t('currentVersion') + ': ' + (state.current || '—')),
-        state.latest ? h('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary)' } },
-          t('latestVersion') + ': ' + state.latest) : null,
-        h('button', {
-          className: 'krot-btn',
-          type: 'button',
-          disabled: state.phase === 'running' || state.phase === 'loading',
-          onClick: load,
-        }, t('updateCheck')),
-        state.phase === 'available' ? h('button', {
-          className: 'krot-btn krot-btn-primary',
-          type: 'button',
-          disabled: state.phase === 'running',
-          onClick: run,
-        }, t('updateRun')) : null,
-      ),
-      state.message ? h('div', {
-        className: state.phase === 'error' ? 'krot-alert-bad' : state.phase === 'done' ? 'krot-alert-ok' : '',
-        style: { marginTop: 8, fontSize: 12 },
-      }, state.message) : null,
-    );
-  }
-
   function KeyRotationCard(props) {
         const locale = useLocale();
         const t = resolveT(props);
-        const [open, setOpen] = React.useState(false);
-        return h('div', { className: 'krot-card' + (open ? ' krot-card-open' : '') },
-          h('button', { type: 'button', className: 'krot-card-header', 'aria-expanded': open, onClick: () => setOpen((v) => !v) },
+        const page = !!(props && props.view === 'page');
+        const [open, setOpen] = React.useState(!!page);
+        // Row seat (plugins.row.config): the host page draws title/icon/crumb and the
+        // padding, so the summary is a one-liner and the page drops our card chrome.
+        if (props && props.view === 'summary') {
+          return h('span', { className: 'krot-card-description' }, t('subtitle'));
+        }
+        return h(page ? 'div' : 'div', { className: page ? 'krot-page' : 'krot-card' + (open ? ' krot-card-open' : '') },
+          h('button', { type: 'button', className: 'krot-card-header', style: page ? { display: 'none' } : undefined, 'aria-expanded': page ? true : open, onClick: () => setOpen((v) => !v) },
             h('span', { className: 'krot-card-head-text' },
               h('span', { className: 'krot-card-name' }, t('title')),
               h('span', { className: 'krot-card-description' }, t('subtitle'))),
             h('span', { className: 'krot-card-chevron' + (open ? ' krot-card-chevron-open' : ''), 'aria-hidden': 'true' },
               h('svg', { width: 14, height: 14, viewBox: '0 0 14 14', fill: 'none', stroke: 'currentColor', strokeWidth: 1.5, style: { display: 'block' } },
                 h('path', { d: 'M3.5 5.25L7 8.75L10.5 5.25' })))),
-          open ? h('div', { className: 'krot-card-body' }, h(KeyRotationErrorBoundary, null, h(KeyRotationSection, { ...props, locale }))) : null);
+          (page || open) ? h('div', { className: 'krot-card-body' }, h(KeyRotationErrorBoundary, null, h(KeyRotationSection, { ...props, locale }))) : null);
       }
       // #275: card only — no top-level sidebar row. The host sidebar is a
       // shared flat list; a duplicate row wastes a slot and confuses Settings.
+      // Row seat first (the seat the current core renders), legacy seat after it.
       try {
+        ctx.slots.inject('plugins.row.config', () =>
+          ctx.slots.register(
+            { name: 'plugins.row.config', key: ROW_CONFIG_KEY, locale: NS, inject: () => ({ ctx }) },
+            KeyRotationCard,
+          ));
         ctx.slots.inject('settings.plugin.item', () =>
           ctx.slots.register(
             { name: 'settings.plugin.item', key: NS, locale: NS, inject: () => ({ ctx }) },
             KeyRotationCard,
           ));
       } catch (e) {
-        bestEffort('slots.register.log', () => { console.error('[dsh-key-rotation] settings.plugin.item register failed', e); });
+        bestEffort('slots.register.log', () => { console.error('[dsh-key-rotation] settings seats register failed', e); });
       }
     }