@goodandready/dsh-key-rotation 0.8.16 → 0.8.18

package/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to `@goodandready/dsh-key-rotation` are documented here.
 User-facing feature notes also appear in README (en is source of truth).
 
+## 0.8.18 - 2026-09-21
+
+### Fixed
+- **Stream success failCount reset (#336)**: `rotate()` now invokes `recordSuccess(pool, activeRef, now())` upon successful stream completion and clean EOF, clearing accumulated `failCounts`, removing stale `failedUntil`, and updating `lastSuccessAt`.
+- **Calendar-based quota reset connection (#337)**: connected `quota-window.js` (`nextQuotaReset`) to `penalizeRef` in `lib/rotate.js` when `QUOTA` / `RESOURCE_EXHAUSTED` / quota errors occur and `quotaResetWindow` is configured. Ensures exhausted keys remain penalized until calendar reset window instead of rapidly failing over back into penalty. Enhanced `nextQuotaReset` to safely handle both object and string window configurations.
+- **Penalty decay during maintenance sweeps (#338)**: `sweepExpired` in `lib/pool.js` now invokes `decayPenalties({ state: st }, now)`, allowing keys with historic transient failures that have run stably to gradually recover their base backoff levels. Also cleans up expired `quotaWindows`. Removed redundant duplicate check in `isSwitchableError`.
+- **State persistence during failover (#339)**: `schedulePersist()` is now passed into `createRotate()` and invoked whenever a key failover occurs, ensuring key penalty and switch state is promptly written to disk across restarts.
+- **Dead imports cleanup (#340)**: removed 16 unused named imports from `lib/index.js` (`pickCascadeFallback`, `nextQuotaReset`, `usageRows`, `usageCsv`, `findSecrets`, `readJson`, `writeSection`, etc.) ensuring lean bundle evaluation.
+- **Remote configuration import timeout (#341)**: added 10-second timeout via `AbortSignal.timeout(10000)` to remote `fetch(url)` in `/dsh-key-rotation/import` route (`lib/ops-keys.js`), returning HTTP 504 Gateway Timeout with structured error code `'timeout'` on network stalls.
+
+## 0.8.17 - 2026-09-21
+
+### Fixed
+- **Provider catalog decoupling in settings UI (#333, GitHub #11 / PR #12)**: `useProviderCatalog` in `lib/client.js` now loads the active provider catalog (`/dsh-key-rotation/config`) independently of `settingsScope` readiness, using `AbortController` and `window.focus` refresh. Eliminates false-negative `(not registered)` badge on existing routes when the settings snapshot was already ready on initial render. Fallback configuration loading is protected against overwriting newer settings values.
+- **Modern provider probe endpoint discovery (#333, GitHub #11 / PR #12)**: extracted dedicated resolver `resolveProbeBaseUrl(ctx, provider)` in `lib/probe-endpoint.js`. Inspects `llm.listConfigurableProviders()` and resolves connection URLs from `settingsNs` + `settingsPath` in effective settings (`settings.describe()`). Supports `baseURL`, `baseUrl`, `apiBase`, `endpoint`, and `url`, eliminating false `no-baseurl` errors when probing SenseNova and modern dictionary-configured pi-ai / standalone adapters. Implements safe path traversal and fail-closed validation.
+
 ## 0.8.16 - 2026-09-20
 
 ### Fixed

package/lib/client.js

@@ -72,6 +72,7 @@ window.__ModuleLoader__.load({
       cardDesc: 'Per-provider API key rotation: pools of keys, automatic failover on quota/rate-limit errors, cooldown and recovery.',
       loading: 'Loading…',
       notRegistered: 'not registered',
+      providerCatalogUnavailable: 'Provider list unavailable',
       removeKey: 'Remove key',
       removeProvider: 'Remove provider',
       addKey: '+ Add key',
@@ -211,6 +212,7 @@ window.__ModuleLoader__.load({
       cardDesc: '按提供商 API 密钥轮换：密钥池、配额/限流错误自动故障转移、冷却与恢复。',
       loading: '加载中…',
       notRegistered: '未注册',
+      providerCatalogUnavailable: '提供商列表暂不可用',
       removeKey: '移除密钥',
       removeProvider: '移除提供商',
       addKey: '+ 添加密钥',
@@ -642,6 +644,47 @@ window.__ModuleLoader__.load({
       );
     }
 
+    // Provider registration is not part of settingsScope's value. Fetch it
+    // independently, and never turn an unavailable catalog into proof of absence.
+    function useProviderCatalog() {
+      const [catalog, setCatalog] = React.useState({ status: 'loading', providers: [] });
+      const requestRef = React.useRef(null);
+      const reload = React.useCallback(() => {
+        requestRef.current?.abort();
+        const controller = new AbortController();
+        requestRef.current = controller;
+        setCatalog((s) => ({ ...s, status: 'loading' }));
+        return fetch(CONFIG_PATH, { headers: { accept: 'application/json' }, signal: controller.signal })
+          .then(async (response) => {
+            if (!response.ok) throw new Error('provider catalog unavailable');
+            const data = await response.json();
+            if (!Array.isArray(data?.providers) || !data.providers.every((p) =>
+              p && typeof p.id === 'string' && p.id.length > 0)) {
+              throw new Error('invalid provider catalog');
+            }
+            if (controller.signal.aborted || requestRef.current !== controller) return;
+            setCatalog({ status: 'ready', providers: data.providers.map((p) => ({
+              id: p.id, name: typeof p.name === 'string' ? p.name : p.id,
+            })) });
+          })
+          .catch(() => {
+            if (!controller.signal.aborted && requestRef.current === controller) {
+              setCatalog((s) => ({ ...s, status: 'error' }));
+            }
+          });
+      }, []);
+      React.useEffect(() => {
+        reload();
+        // A provider may have been installed/enabled while this page was open.
+        window.addEventListener?.('focus', reload);
+        return () => {
+          requestRef.current?.abort();
+          window.removeEventListener?.('focus', reload);
+        };
+      }, [reload]);
+      return { ...catalog, reload };
+    }
+
     function KeyRotationSection(props) {
       const t = resolveT(props);
       const settingsScope = React.useMemo(() => {
@@ -681,6 +724,9 @@ window.__ModuleLoader__.load({
         getScopeSnapshot
       );
       const [state, setState] = React.useState({ status: 'loading', value: null, revision: 0, error: '', providers: [] });
+      const catalog = useProviderCatalog();
+      const latestScopeSnapshot = React.useRef(scopeSnapshot);
+      latestScopeSnapshot.current = scopeSnapshot;
       // #290: surface settingsScope availability as card state
       React.useEffect(() => {
         if (!settingsScope) {
@@ -807,10 +853,15 @@ window.__ModuleLoader__.load({
       };
 
       const load = React.useCallback(() => {
+        const scopeIsReady = () => latestScopeSnapshot.current?.status === 'ready'
+          && latestScopeSnapshot.current.value;
         setState((s) => ({ ...s, status: 'loading', error: '' }));
         fetch(CONFIG_PATH, { headers: { accept: 'application/json' } })
           .then((r) => r.json())
           .then((data) => {
+            // The scope may have become ready while this fallback was in flight.
+            // A bridge snapshot must not replace that newer value or its revision.
+            if (scopeIsReady()) return;
             setState({
               status: 'ready',
               value: data.value ?? null,
@@ -818,9 +869,10 @@ window.__ModuleLoader__.load({
               providers: Array.isArray(data.providers) ? data.providers : [],
               error: data.error ? data.error.message : '',
             });
-            setDraft(null);
           })
-          .catch((e) => setState((s) => ({ ...s, status: 'error', error: String(e) })));
+          .catch((e) => {
+            if (!scopeIsReady()) setState((s) => ({ ...s, status: 'error', error: String(e) }));
+          });
       }, []);
 
       React.useEffect(() => {
@@ -962,7 +1014,7 @@ window.__ModuleLoader__.load({
         );
       }
 
-      const providers = state.providers;
+      const providers = catalog.providers;
       const providerById = new Map(providers.map((p) => [p.id, p.name]));
 
       const setField = (fn) => setDraft(fn(val));
@@ -1131,7 +1183,8 @@ window.__ModuleLoader__.load({
       const providerRows = providerList.map((entry, pIndex) => {
         const options = [];
         if (entry.provider && !providerById.has(entry.provider)) {
-          options.push(h('option', { key: entry.provider, value: entry.provider }, entry.provider + ' (' + t('notRegistered') + ')'));
+          options.push(h('option', { key: entry.provider, value: entry.provider }, entry.provider + ' (' + (catalog.status === 'ready' ? t('notRegistered')
+            : catalog.status === 'loading' ? t('loading') : t('providerCatalogUnavailable')) + ')'));
         }
         options.push(...providers.map((prov) =>
           h('option', { key: prov.id, value: prov.id }, prov.name + (prov.id !== prov.name ? ' — ' + prov.id : ''))));
@@ -1466,7 +1519,10 @@ window.__ModuleLoader__.load({
         );
       });
 
-      const noProviders = providers.length === 0
+      const noProviders = catalog.status === 'error'
+        ? h('div', { className: 'krot-hint', role: 'status' }, t('providerCatalogUnavailable'),
+          btn(t('retry'), catalog.reload))
+        : catalog.status === 'ready' && providers.length === 0
         ? h('div', { className: 'krot-empty', role: 'status', style: { display: 'flex', flexDirection: 'column', gap: '6px', padding: '16px 14px', border: '1px dashed var(--dsw-alias-border-l2)', borderRadius: 10, background: 'var(--dsw-alias-bg-layer-2)' } },
             h('p', { style: { margin: 0, fontWeight: 600, fontSize: 14, color: 'var(--dsw-alias-label-primary)' } }, t('emptyTitle')),
             h('p', { className: 'krot-hint', style: { margin: 0 } }, t('emptyDesc')),

package/lib/index.js

@@ -15,22 +15,17 @@ import {
   budgetVerdict, sortAttemptList,
 } from './pool.js';
 import { LatencyHistogram } from './histogram.js';
-import { pickCascadeFallback } from './cascade.js';
 import { ConcurrencyTracker } from './concurrency.js';
-import { nextQuotaReset } from './quota-window.js';
 import { QuotaStore } from './quota.js';
 import { WebhookSender } from './webhook.js';
-import { bucketAllow, bucketRetryMs, bucketSweep, bucketInfo } from './bucket.js';
-import { usageRows, usageCsv, compactUsage } from './usage-report.js';
-import { findSecrets, looksLikeApiSecret } from './keycheck.js';
-import { json, readJson, descriptorOf, viewOf, writeSection, providerCatalog, handleConfigBridge, NS as BRIDGE_NS } from './http-bridge.js';
+import { bucketAllow, bucketRetryMs } from './bucket.js';
+import { compactUsage } from './usage-report.js';
+import { json, handleConfigBridge } from './http-bridge.js';
 import { createRotate } from './rotate.js';
 import { nowMono } from './clock.js';
 import { CircuitBreaker } from './circuit-breaker.js';
 import { NotifyQueue } from './notify-queue.js';
-import { BoundedMap } from './bounded-map.js';
 import { classifyFailure } from './error-taxonomy.js';
-import { safeParseJson } from './atomic-io.js';
 import { registerOpsRoutes } from './routes-ops.js';
 import { registerPluginUpdater } from './plugin-updater.js';
 import { notifySwitch, notifyExhaustion, pushEvent } from './notify-events.js';
@@ -472,6 +467,7 @@ export function apply(ctx, config = {}) {
     ctx,
     dispatchStorage,
     buildRuntime,
+    schedulePersist,
     pushEvent,
     notifySwitch: (runtime, pool, info) => notifySwitch(runtime, pool, info, { webhookSender, notifyQueue: moduleNotifyQueue, now: () => Date.now() }),
     notifyExhaustion,

package/lib/ops-keys.js

@@ -167,7 +167,7 @@ ctx.effect(() => ctx.webServer.register({
     const url = typeof body?.url === 'string' ? body.url.trim() : '';
     if (!url || !url.startsWith('https://')) { json(res, 400, { error: { code: 'bad-url', message: 'dsh-key-rotation: only HTTPS URLs are allowed' } }); return; }
     try {
-      const resp = await fetch(url);
+      const resp = await fetch(url, { signal: AbortSignal.timeout(10000) });
       if (!resp.ok) { json(res, 400, { error: { code: 'fetch-failed', message: 'dsh-key-rotation: fetch returned ' + resp.status } }); return; }
       const data = await resp.json();
       if (!Array.isArray(data)) { json(res, 400, { error: { code: 'bad-format', message: 'dsh-key-rotation: expected JSON array of providers' } }); return; }
@@ -181,7 +181,10 @@ ctx.effect(() => ctx.webServer.register({
       const mergedArr = [...merged.values()];
       await settings.replace(NS, { ...(desc?.value ?? {}), providers: mergedArr }, desc?.revision);
       json(res, 200, { ok: true, providersImported: data.length, total: mergedArr.length });
-    } catch (e) { json(res, 400, { error: { code: 'import-failed', message: String(e?.message ?? e) } }); }
+    } catch (e) {
+      const isTimeout = e?.name === 'TimeoutError' || e?.name === 'AbortError';
+      json(res, isTimeout ? 504 : 400, { error: { code: isTimeout ? 'timeout' : 'import-failed', message: String(e?.message ?? e) } });
+    }
   },
 }), 'dsh-key-rotation: import route');
 

package/lib/pool.js

@@ -185,10 +185,13 @@ export function sweepExpired(poolState, now = Date.now(), activeRefs = null) {
   let cleared = 0;
   const activeSet = activeRefs ? new Set(activeRefs) : null;
   for (const st of poolState.values()) {
+    // #338: decay penalty failCounts for stable keys in maintenance sweep
+    decayPenalties({ state: st }, now);
     for (const [ref, until] of [...st.failedUntil.entries()]) {
       if (until <= now) {
         st.failedUntil.delete(ref);
         st.failCounts?.delete(ref);
+        st.quotaWindows?.delete(ref);
         cleared++;
       }
     }
@@ -372,7 +375,6 @@ export function isSwitchableError(failureOrPayload, switchCodes = new Set(DEFAUL
 
   // 1. Direct HTTP status codes (#267: also 408/425 transient)
   if ((status === 429 || status === 408 || status === 425) && (switchCodes.has('RATE_LIMIT') || switchCodes.has('QUOTA') || switchCodes.has('429') || switchCodes.has('TIMEOUT') || switchCodes.has(String(status)))) return true;
-  if (status === 429 && (switchCodes.has('RATE_LIMIT') || switchCodes.has('QUOTA') || switchCodes.has('429'))) return true;
   if ((status === 401 || status === 403) && (switchCodes.has('AUTH') || switchCodes.has('401'))) return true;
   if ((status >= 500 && status <= 504) && (switchCodes.has('SERVER') || switchCodes.has(String(status)))) return true;
 

package/lib/probe-endpoint.js

@@ -0,0 +1,99 @@
+// Resolve only the selected provider's connection; never infer a vendor URL.
+import { bestEffort } from './best-effort.js';
+
+const own = (object, key) => object != null && typeof object === 'object'
+  && Object.prototype.hasOwnProperty.call(object, key);
+
+function endpointOf(profile) {
+  for (const field of ['baseURL', 'baseUrl', 'apiBase', 'endpoint', 'url']) {
+    if (!own(profile, field) || profile[field] == null || profile[field] === '') continue;
+    const value = profile[field];
+    if (typeof value !== 'string' || !value.trim()) return null;
+    try {
+      const url = new URL(value.trim());
+      // /models is appended by the runner. Query/fragment/userinfo bases do
+      // not compose safely; HTTP loopback remains valid for local providers.
+      if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password
+        || url.search || url.hash) return null;
+      return value.trim();
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+
+function atPath(value, path) {
+  if (!Array.isArray(path)) return undefined;
+  for (const segment of path) {
+    if (typeof segment !== 'string' || !segment
+      || ['__proto__', 'constructor', 'prototype'].includes(segment) || !own(value, segment)) return undefined;
+    value = value[segment];
+  }
+  return value;
+}
+
+function legacyProfile(providers, provider) {
+  if (Array.isArray(providers)) {
+    // A declared alias is routing metadata; a display name is not an identity.
+    const matches = providers.filter((p) => p && (p.id === provider || p.provider === provider
+      || (Array.isArray(p.aliases) && p.aliases.includes(provider))));
+    return matches.length === 1 ? matches[0] : undefined;
+  }
+  return own(providers, provider) ? providers[provider] : undefined;
+}
+
+/** Resolve current effective settings on every probe (including after edits).
+ * LlmProviderInfo is display-only. Modern hosts declare the exact settings
+ * address via listConfigurableProviders(); no adapter/model call is necessary.
+ */
+export async function resolveProbeBaseUrl(ctx, provider) {
+  if (typeof provider !== 'string' || !provider) return null;
+  const llm = await bestEffort('probe.llm', () => ctx?.get?.('llm') ?? ctx?.llm);
+  const readSections = async () => {
+    const settings = await bestEffort('probe.settings', () => ctx?.get?.('settings'));
+    const sections = await bestEffort('probe.settings.describe', () => settings?.describe?.({ redactSecrets: true }));
+    return Array.isArray(sections) ? sections : [];
+  };
+  if (typeof llm?.listConfigurableProviders === 'function') {
+    const directory = await bestEffort('probe.directory', () => llm.listConfigurableProviders());
+    // Do not fall through to a stale endpoint if the authoritative directory
+    // is unavailable or ambiguous. No exception/connection detail is logged.
+    if (!Array.isArray(directory)) return null;
+    const matches = directory.filter((entry) => entry?.provider === provider);
+    if (matches.length > 1) return null;
+    if (matches.length === 1) {
+      const entry = matches[0];
+      if (typeof entry.settingsNs !== 'string' || !entry.settingsNs) return null;
+      const sections = (await readSections()).filter((section) => section?.ns === entry.settingsNs);
+      if (sections.length !== 1) return null;
+      return endpointOf(atPath(sections[0].value, entry.settingsPath));
+    }
+  }
+
+  // Older integrations may still expose endpoints directly. Only exact route
+  // identities are accepted; never match a provider by its human-readable name.
+  const info = await bestEffort('probe.provider', () => llm?.getProvider?.(provider));
+  if (info && (info.id == null || info.id === provider)) {
+    const url = endpointOf(info);
+    if (url) return url;
+  }
+  const providers = await bestEffort('probe.providers', () => llm?.listProviders?.());
+  const match = Array.isArray(providers) ? providers.filter((p) => p?.id === provider) : [];
+  if (match.length > 1) return null;
+  if (match.length === 1) {
+    const url = endpointOf(match[0]);
+    if (url) return url;
+  }
+
+  // Compatibility for hosts predating the configurable-provider directory.
+  // llm-pi-ai is a known settings namespace, not necessarily a Cordis service.
+  const sections = (await readSections()).filter((section) => section?.ns === 'llm-pi-ai');
+  if (sections.length > 1) return null;
+  if (sections.length === 1) {
+    const profile = legacyProfile(sections[0].value?.providers, provider);
+    if (profile !== undefined) return endpointOf(profile);
+  }
+  const legacy = await bestEffort('probe.legacy', () => ctx?.get?.('llm-pi-ai'));
+  return endpointOf(legacyProfile(legacy?.providers ?? legacy?.config?.providers, provider));
+}

package/lib/quota-window.js

@@ -4,9 +4,10 @@ export const QUOTA_WINDOW_TYPES = ['midnight_utc', 'midnight_pst', 'rolling_24h'
 
 export function nextQuotaReset(quotaResetWindow, now) {
   now = now || Date.now();
-  if (!quotaResetWindow || typeof quotaResetWindow !== 'object') return null;
-  const type = quotaResetWindow.type;
-  const hour = Number.isFinite(quotaResetWindow.hour) ? quotaResetWindow.hour : 0;
+  const win = typeof quotaResetWindow === 'string' ? { type: quotaResetWindow === 'daily' ? 'midnight_utc' : quotaResetWindow } : quotaResetWindow;
+  if (!win || typeof win !== 'object') return null;
+  const type = win.type === 'daily' ? 'midnight_utc' : win.type;
+  const hour = Number.isFinite(win.hour) ? win.hour : 0;
 
   if (type === 'rolling_24h') {
     const d = new Date(now);

package/lib/rotate.js

@@ -5,6 +5,7 @@ import { classifyFailure } from './error-taxonomy.js';
 import {
   isSwitchableError,
   recordFailure,
+  recordSuccess,
   parseRetryAfter,
   extractRateLimit,
   isRateLimited,
@@ -12,6 +13,7 @@ import {
   sortAttemptList,
 } from './pool.js';
 import { pickCascadeFallback } from './cascade.js';
+import { nextQuotaReset } from './quota-window.js';
 
 /**
  * Create the rotate(options, pool) async generator used by llm/stream.
@@ -34,6 +36,7 @@ export function createRotate(deps) {
     quotaStore,
     circuitBreaker,
     logger,
+    schedulePersist,
     now = nowMono,
   } = deps;
 
@@ -77,8 +80,24 @@ export function createRotate(deps) {
         const _effBase = _retry !== undefined ? Math.max(_base, Math.min(_retry, _max ?? _base * 8)) : _base;
         const cls = classifyFailure({ code: errCode, message: errMsg });
         const _b = recordFailure(pool, targetRef, now(), _effBase, _max, cls.soft, true);
+
+        // #337: connect quota-window calendar reset for quota exhaustion
+        const isQuota = errCode === 'QUOTA' || cls.code === 'QUOTA' || /quota|exceeded/i.test(errMsg);
+        const qWindow = pool.quotaResetWindow ?? runtime0.quotaResetWindow;
+        if (isQuota && qWindow) {
+          const quotaResetAt = nextQuotaReset(qWindow, now());
+          if (quotaResetAt && quotaResetAt > now()) {
+            if (!pool.state.quotaWindows) pool.state.quotaWindows = new Map();
+            pool.state.quotaWindows.set(targetRef, quotaResetAt);
+            pool.state.failedUntil.set(targetRef, quotaResetAt);
+          }
+        }
+
         if (circuitBreaker) circuitBreaker.onFailure(pool.base ?? options?.provider);
         pushEvent(pool, targetRef, errCode ?? 'UNKNOWN', _b);
+        if (typeof schedulePersist === 'function') {
+          try { schedulePersist(); } catch (_) { /* best-effort persistence */ }
+        }
         if (!pool.state.authFailCounts) pool.state.authFailCounts = new Map();
         if (!pool.state.brokenUntil) pool.state.brokenUntil = new Map();
         const _cStr = String(errCode ?? '');
@@ -190,6 +209,11 @@ export function createRotate(deps) {
                   if (!byRef) { byRef = new Map(); pool.state.byModel.set(activeRef, byRef); }
                   byRef.set(options.model, (byRef.get(options.model) ?? 0) + 1);
                 }
+                // #336: record success for the active key upon successful stream finish
+                if (activeRef) {
+                  recordSuccess(pool, activeRef, now());
+                }
+
                 // Proactive rate-limit (#115, #303): if response headers say this key is near
                 // its quota or has retry-after, cool it down so the NEXT request starts on a different key.
                 // We do NOT re-run this (already successful) request — that would double-send.
@@ -248,6 +272,9 @@ export function createRotate(deps) {
           }
 
           if (switching) continue; // try the next key
+          if (_pickedRef && yielded) {
+            recordSuccess(pool, _pickedRef, now());
+          }
           return; // clean end — served
         } finally {
           if (acquired && _pickedRef) {

package/lib/sandbox-service.js

@@ -1,5 +1,7 @@
 // lib/sandbox-service.js — sandbox runner and cache service
 import { LastTestCache, SandboxRunner } from './sandbox.js';
+import { bestEffort } from './best-effort.js';
+import { resolveProbeBaseUrl } from './probe-endpoint.js';
 
 export function createSandboxService({ getRuntime }) {
   let sandboxRunner = null;
@@ -9,36 +11,11 @@ export function createSandboxService({ getRuntime }) {
   function ensureSandboxRunner(ctx) {
     if (ctx) defaultCtx = ctx;
     if (sandboxRunner) return sandboxRunner;
-    function resolveBaseUrl(providerOrRef) {
-      try {
-        let provider = providerOrRef;
-        const rt = typeof getRuntime === 'function' ? getRuntime() : null;
-        const pool = rt?.poolByRef?.get(providerOrRef);
-        if (pool?.base) provider = pool.base;
-        else if (pool?.provider) provider = pool.provider;
-
-        const c = ctx || defaultCtx;
-        const pInfo = c?.llm?.getProvider?.(provider);
-        if (pInfo && (pInfo.baseUrl || pInfo.endpoint || pInfo.url)) {
-          return String(pInfo.baseUrl || pInfo.endpoint || pInfo.url);
-        }
-        for (const info of (c?.llm?.listProviders?.() || [])) {
-          if (info && (info.id === provider || info.name === provider)) {
-            const u = info.baseUrl || info.endpoint || info.url;
-            if (u) return String(u);
-          }
-        }
-        const ns = c?.get ? c.get('llm-pi-ai') : null;
-        const list = ns && (ns.providers || (ns.config && ns.config.providers) || []);
-        if (Array.isArray(list)) {
-          const hit = list.find((p) => p && (p.id === provider || p.name === provider || (Array.isArray(p.aliases) && p.aliases.includes(provider))));
-          const base = hit && (hit.baseUrl || hit.endpoint || hit.url);
-          if (base) return String(base);
-        }
-        return null;
-      } catch (_) {
-        return null;
-      }
+    async function resolveBaseUrl(providerOrRef) {
+      const rt = await bestEffort('probe.runtime', () => typeof getRuntime === 'function' ? getRuntime() : null);
+      const pool = rt?.poolByRef?.get(providerOrRef);
+      const provider = pool?.base || pool?.provider || providerOrRef;
+      return resolveProbeBaseUrl(defaultCtx, provider);
     }
     sandboxRunner = new SandboxRunner({ fetchImpl: globalThis.fetch, resolveBaseUrl });
     return sandboxRunner;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.16",
+  "version": "0.8.18",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [