@goodandready/dsh-key-rotation 0.8.13 → 0.8.15

package/CHANGELOG.md

@@ -3,6 +3,39 @@
 All notable changes to `@goodandready/dsh-key-rotation` are documented here.
 User-facing feature notes also appear in README (en is source of truth).
 
+## 0.8.15 - 2026-09-20
+
+### Fixed
+- **Settings on the plugin's own page**: the plugin-list seat `plugins.item` is the one
+  the current core (0.1.6-alpha.2) renders as the plugin's page with its configuration;
+  the row seat alone leaves the page without the form. `KeyRotationCard` is now
+  registered there too (`id: 'dsh-key-rotation'`, order 60) with a **static** label —
+  the label is resolved while the page renders, and a locale lookup there aborts the
+  whole client batch. The row seat and the legacy `settings.plugin.item` card stay as
+  fallbacks.
+- The authoring test no longer forbids every hardcoded label: it now requires the
+  list-seat label to be static while the card body keeps using `t(...)`.
+
+## 0.8.14 - 2026-09-19
+
+### Fixed
+- **Critical fix: switchable error rotation crash (#324, GitHub #3 / PR #4)**: `isSwitchableError()` in `lib/pool.js` now normalizes `switchCodes` to a `Set` when passed as an array. Previously, runtime schema arrays (`cfg.switchCodes`, `DEFAULT_SWITCH_CODES`) caused `TypeError: switchCodes.has is not a function`, crashing turns on rate limits, quota exhaustion, and 5xx errors instead of rotating keys.
+- **Critical fix: settings UI render crash (#324, GitHub #2 / PR #5)**: declared `UpdaterSection` at factory scope in `lib/client.js` before `KeyRotationSection`, removing the `apply(ctx)`-local declaration that caused `ReferenceError: UpdaterSection is not defined`.
+- **Security hardening: packageSpec validation (#324, GitHub #6)**: added strict package spec regex validation in `lib/plugin-updater.js` `installExact()` before child process invocation, preventing command-option injection.
+- **Settings reachable again**: the card registered into `settings.plugin.item`, a
+  slot the current DSH core (0.1.6-alpha.2) no longer renders, so the plugin's
+  settings were unreachable. The surface now registers into the Plugins page row
+  seat `plugins.row.config` first, keyed
+  `@goodandready/dsh-key-rotation#dsh-key-rotation` (`rowConfigKey(package, rowId)`):
+  the plugin's row gains a configure control whose page is the settings form
+  (`view: 'page'`, open and without our card chrome — the host page draws the title,
+  icon, crumb and padding) plus a one-line state for `view: 'summary'`. The legacy
+  seat stays registered as a fallback for older cores.
+
+Version bump and public release are intentionally held back for now: the feature
+work on `feat/issue-303-v089-evolution` is still in flight, so this change lands in
+`main` without a release.
+
 ## 0.8.13 - 2026-09-17
 
 ### Changed

package/lib/client.js

@@ -32,6 +32,10 @@ window.__ModuleLoader__.load({
 
     const CONFIG_PATH = '/dsh-key-rotation/config';
     const NS = 'dsh-key-rotation';
+    // Plugins page row seat (DSH 0.1.6-alpha.2): key = '<package name>#<row id>'.
+    const PKG = '@goodandready/dsh-key-rotation';
+    const ROW_ID = 'dsh-key-rotation';
+    const ROW_CONFIG_KEY = PKG + '#' + ROW_ID;
 
     // -------------------------------------------------------------- i18n
     const en = {
@@ -574,6 +578,70 @@ window.__ModuleLoader__.load({
       };
     }
 
+    function UpdaterSection({ t }) {
+      const [state, setState] = React.useState({ phase: 'idle', current: '', latest: '', message: '' });
+      const load = React.useCallback(async () => {
+        setState((s) => ({ ...s, phase: 'loading', message: '' }));
+        try {
+          const res = await fetch('/api/dsh-key-rotation/update', { headers: { 'x-dsh-plugin-update': '1' } });
+          const data = await res.json();
+          if (!res.ok) throw new Error(data?.error?.message || t('updateFailed'));
+          setState({
+            phase: data.updateAvailable ? 'available' : 'current',
+            current: data.currentVersion || '',
+            latest: data.latestVersion || '',
+            message: data.updateAvailable ? t('updateAvailable') : t('updateNone'),
+          });
+        } catch (e) {
+          setState({ phase: 'error', current: '', latest: '', message: e?.message || t('updateFailed') });
+        }
+      }, [t]);
+      React.useEffect(() => { load(); }, [load]);
+      const run = async () => {
+        setState((s) => ({ ...s, phase: 'running', message: t('updateRunning') }));
+        try {
+          const res = await fetch('/api/dsh-key-rotation/update', {
+            method: 'POST',
+            headers: { 'x-dsh-plugin-update': '1', 'content-type': 'application/json' },
+          });
+          const data = await res.json();
+          if (!res.ok) throw new Error(data?.error?.message || t('updateFailed'));
+          setState({
+            phase: 'done',
+            current: data.currentVersion || '',
+            latest: data.installedVersion || data.latestVersion || '',
+            message: t('updateRestart'),
+          });
+        } catch (e) {
+          setState({ phase: 'error', current: '', latest: '', message: e?.message || t('updateFailed') });
+        }
+      };
+      return h('div', { className: 'krot-update', style: { marginTop: 12, paddingTop: 12, borderTop: '1px solid var(--dsw-alias-border-l2)' } },
+        h('div', { style: { display: 'flex', gap: 8, alignItems: 'center', flexWrap: 'wrap' } },
+          h('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary)' } },
+            t('currentVersion') + ': ' + (state.current || '—')),
+          state.latest ? h('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary)' } },
+            t('latestVersion') + ': ' + state.latest) : null,
+          h('button', {
+            className: 'krot-btn',
+            type: 'button',
+            disabled: state.phase === 'running' || state.phase === 'loading',
+            onClick: load,
+          }, t('updateCheck')),
+          state.phase === 'available' ? h('button', {
+            className: 'krot-btn krot-btn-primary',
+            type: 'button',
+            disabled: state.phase === 'running',
+            onClick: run,
+          }, t('updateRun')) : null,
+        ),
+        state.message ? h('div', {
+          className: state.phase === 'error' ? 'krot-alert-bad' : state.phase === 'done' ? 'krot-alert-ok' : '',
+          style: { marginTop: 8, fontSize: 12 },
+        }, state.message) : null,
+      );
+    }
+
     function KeyRotationSection(props) {
       const t = resolveT(props);
       const settingsScope = React.useMemo(() => {
@@ -1725,94 +1793,51 @@ window.__ModuleLoader__.load({
       // (settings.plugin.item), matching Model Sync / Spendmeter / Vision Bridge.
       // key MUST equal the settings namespace (NS), else the tab silently skips it.
       
-  function UpdaterSection({ t }) {
-    const [state, setState] = React.useState({ phase: 'idle', current: '', latest: '', message: '' });
-    const load = React.useCallback(async () => {
-      setState((s) => ({ ...s, phase: 'loading', message: '' }));
-      try {
-        const res = await fetch('/api/dsh-key-rotation/update', { headers: { 'x-dsh-plugin-update': '1' } });
-        const data = await res.json();
-        if (!res.ok) throw new Error(data?.error?.message || t('updateFailed'));
-        setState({
-          phase: data.updateAvailable ? 'available' : 'current',
-          current: data.currentVersion || '',
-          latest: data.latestVersion || '',
-          message: data.updateAvailable ? t('updateAvailable') : t('updateNone'),
-        });
-      } catch (e) {
-        setState({ phase: 'error', current: '', latest: '', message: e?.message || t('updateFailed') });
-      }
-    }, [t]);
-    React.useEffect(() => { load(); }, [load]);
-    const run = async () => {
-      setState((s) => ({ ...s, phase: 'running', message: t('updateRunning') }));
-      try {
-        const res = await fetch('/api/dsh-key-rotation/update', {
-          method: 'POST',
-          headers: { 'x-dsh-plugin-update': '1', 'content-type': 'application/json' },
-        });
-        const data = await res.json();
-        if (!res.ok) throw new Error(data?.error?.message || t('updateFailed'));
-        setState({
-          phase: 'done',
-          current: data.currentVersion || '',
-          latest: data.installedVersion || data.latestVersion || '',
-          message: t('updateRestart'),
-        });
-      } catch (e) {
-        setState({ phase: 'error', current: '', latest: '', message: e?.message || t('updateFailed') });
-      }
-    };
-    return h('div', { className: 'krot-update', style: { marginTop: 12, paddingTop: 12, borderTop: '1px solid var(--dsw-alias-border-l2)' } },
-      h('div', { style: { display: 'flex', gap: 8, alignItems: 'center', flexWrap: 'wrap' } },
-        h('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary)' } },
-          t('currentVersion') + ': ' + (state.current || '—')),
-        state.latest ? h('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary)' } },
-          t('latestVersion') + ': ' + state.latest) : null,
-        h('button', {
-          className: 'krot-btn',
-          type: 'button',
-          disabled: state.phase === 'running' || state.phase === 'loading',
-          onClick: load,
-        }, t('updateCheck')),
-        state.phase === 'available' ? h('button', {
-          className: 'krot-btn krot-btn-primary',
-          type: 'button',
-          disabled: state.phase === 'running',
-          onClick: run,
-        }, t('updateRun')) : null,
-      ),
-      state.message ? h('div', {
-        className: state.phase === 'error' ? 'krot-alert-bad' : state.phase === 'done' ? 'krot-alert-ok' : '',
-        style: { marginTop: 8, fontSize: 12 },
-      }, state.message) : null,
-    );
-  }
-
   function KeyRotationCard(props) {
         const locale = useLocale();
         const t = resolveT(props);
-        const [open, setOpen] = React.useState(false);
-        return h('div', { className: 'krot-card' + (open ? ' krot-card-open' : '') },
-          h('button', { type: 'button', className: 'krot-card-header', 'aria-expanded': open, onClick: () => setOpen((v) => !v) },
+        const page = !!(props && props.view === 'page');
+        const [open, setOpen] = React.useState(!!page);
+        // Row seat (plugins.row.config): the host page draws title/icon/crumb and the
+        // padding, so the summary is a one-liner and the page drops our card chrome.
+        if (props && props.view === 'summary') {
+          return h('span', { className: 'krot-card-description' }, t('subtitle'));
+        }
+        return h(page ? 'div' : 'div', { className: page ? 'krot-page' : 'krot-card' + (open ? ' krot-card-open' : '') },
+          h('button', { type: 'button', className: 'krot-card-header', style: page ? { display: 'none' } : undefined, 'aria-expanded': page ? true : open, onClick: () => setOpen((v) => !v) },
             h('span', { className: 'krot-card-head-text' },
               h('span', { className: 'krot-card-name' }, t('title')),
               h('span', { className: 'krot-card-description' }, t('subtitle'))),
             h('span', { className: 'krot-card-chevron' + (open ? ' krot-card-chevron-open' : ''), 'aria-hidden': 'true' },
               h('svg', { width: 14, height: 14, viewBox: '0 0 14 14', fill: 'none', stroke: 'currentColor', strokeWidth: 1.5, style: { display: 'block' } },
                 h('path', { d: 'M3.5 5.25L7 8.75L10.5 5.25' })))),
-          open ? h('div', { className: 'krot-card-body' }, h(KeyRotationErrorBoundary, null, h(KeyRotationSection, { ...props, locale }))) : null);
+          (page || open) ? h('div', { className: 'krot-card-body' }, h(KeyRotationErrorBoundary, null, h(KeyRotationSection, { ...props, locale }))) : null);
       }
       // #275: card only — no top-level sidebar row. The host sidebar is a
       // shared flat list; a duplicate row wastes a slot and confuses Settings.
+      // Plugin-list seat (plugins.item) first: it is what the current core
+      // (0.1.6-alpha.2) renders as the plugin's own page with its configuration. The
+      // label is a static string on purpose — it is resolved while the page renders,
+      // and a locale lookup there would take the whole client batch down with it.
       try {
+        ctx.slots.inject('plugins.item', () =>
+          ctx.slots.register(
+            { name: 'plugins.item', id: ROW_ID, order: 60, label: () => 'Key Rotation', locale: NS, inject: () => ({ ctx }) },
+            KeyRotationCard,
+          ));
+        // Row seat and the legacy seat stay as fallbacks.
+        ctx.slots.inject('plugins.row.config', () =>
+          ctx.slots.register(
+            { name: 'plugins.row.config', key: ROW_CONFIG_KEY, locale: NS, inject: () => ({ ctx }) },
+            KeyRotationCard,
+          ));
         ctx.slots.inject('settings.plugin.item', () =>
           ctx.slots.register(
             { name: 'settings.plugin.item', key: NS, locale: NS, inject: () => ({ ctx }) },
             KeyRotationCard,
           ));
       } catch (e) {
-        bestEffort('slots.register.log', () => { console.error('[dsh-key-rotation] settings.plugin.item register failed', e); });
+        bestEffort('slots.register.log', () => { console.error('[dsh-key-rotation] settings seats register failed', e); });
       }
     }
 

package/lib/plugin-updater.js

@@ -181,8 +181,15 @@ async function status(options, target) {
   }
 }
 
+export const PACKAGE_SPEC_PATTERN = /^(@[a-z0-9~][a-z0-9_.~-]*\/)?[a-z0-9~][a-z0-9_.~-]*(@[0-9a-zA-Z_.~+-]+)?$/i
+
+export function isValidPackageSpec(packageSpec) {
+  return typeof packageSpec === 'string' && PACKAGE_SPEC_PATTERN.test(packageSpec)
+}
+
 async function installExact(target, packageSpec, options) {
   if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.')
+  if (!isValidPackageSpec(packageSpec)) throw new Error(`Invalid package spec: ${packageSpec}`)
   await new Promise((resolvePromise, reject) => {
     const child = spawn(process.execPath, [
       target.cliEntry, 'plugin', '--profile', target.profileName, 'add',

package/lib/pool.js

@@ -362,6 +362,9 @@ export function sortAttemptList(refs, strategy = 'round-robin', deps = {}) {
  */
 export function isSwitchableError(failureOrPayload, switchCodes = new Set(DEFAULT_SWITCH_CODES)) {
   if (!failureOrPayload) return false;
+  // Runtime switch codes arrive as an array (cfg.switchCodes is a schema array,
+  // and DEFAULT_SWITCH_CODES is exported as an array); normalize before .has().
+  if (!(switchCodes instanceof Set)) switchCodes = new Set(Array.isArray(switchCodes) ? switchCodes : DEFAULT_SWITCH_CODES);
   const failure = failureOrPayload.failure ?? failureOrPayload;
   const status = Number(failure.status ?? failure.statusCode ?? failure.httpStatus ?? 0);
   const code = String(failure.code ?? failure.reason ?? '').toUpperCase();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.13",
+  "version": "0.8.15",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [