@goodandready/dsh-key-rotation 0.8.24 → 0.8.25

package/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to `@goodandready/dsh-key-rotation` are documented here.
 User-facing feature notes also appear in README (en is source of truth).
 
+## 0.8.25 - 2026-09-27
+
+### Fixed & Hardened
+- **Sandbox cache HTTP method validation (#357)**:
+  - `lib/ops-test.js`: enforced strict `GET` method check on `/dsh-key-rotation/sandbox-cache`. Non-GET requests (`POST`, `PUT`, `DELETE`) now consistently return HTTP 405 Method Not Allowed (`{ error: { code: 'method', message: 'GET only' } }`).
+- **Webhook action security and timeout hardening (#358)**:
+  - `lib/ops-webhook.js`: converted authorization bearer token validation to constant-time comparison via `crypto.timingSafeEqual`, preventing timing side-channel attacks on `webhookActionToken`.
+  - Added strict Telegram bot token format validation (`TELEGRAM_BOT_TOKEN_RE = /^[0-9]{5,16}:[a-zA-Z0-9_-]{20,50}$/`).
+  - Added 10-second timeout guard (`signal: AbortSignal.timeout(10000)`) on outgoing Telegram API `setWebhook` requests to eliminate socket hang risks.
+- **Dead code removal & unexported private symbols (#359)**:
+  - Removed unimported orphaned module `lib/bounded-map.js` and removed its standalone test cases.
+  - Eliminated dead exports in internal modules: unexported `CONCURRENCY_DEFAULT_LIMIT`, `CONCURRENCY_STALE_LOCK_MS` in `lib/concurrency.js`, `MAX_USAGE_RETENTION_DAYS` in `lib/usage-report.js`, `WEBHOOK_*` constants in `lib/webhook.js`, `assertJson` and `SECRET_FIELDS` in `lib/settings-write.js`, and `isNewerVersion` in `lib/plugin-updater.js`.
+- **Documentation contract alignment (#360)**:
+  - `docs/design/DESIGN.md`: added mandatory sections «Политика маршрутов» (complete 12-route method, origin, and authorization matrix) and «Что публикуется» (npm files, exclusions, and verification timestamp) per `dsh-documentation-standard`.
+  - Corrected webhook endpoint URI in DESIGN.md to `/dsh-key-rotation/webhook-action`.
+- **Canonical scoped package name in module export (#361)**:
+  - `lib/index.js`: unified `export const name = '@goodandready/dsh-key-rotation';` across all four package identity checkpoints (`package.json`, `cordis.patch.yml`, `lib/client.js`, and `lib/index.js`), resolving preflight check failure.
+
 ## 0.8.24 - 2026-09-25
 
 ### Security Hardening

package/lib/concurrency.js

@@ -1,7 +1,7 @@
 // concurrency.js — per-key in-flight counter + least-connections picking (issue #193).
 
-export const CONCURRENCY_DEFAULT_LIMIT = 0;
-export const CONCURRENCY_STALE_LOCK_MS = 5 * 60 * 1000;
+const CONCURRENCY_DEFAULT_LIMIT = 0;
+const CONCURRENCY_STALE_LOCK_MS = 5 * 60 * 1000;
 
 export class ConcurrencyTracker {
   constructor(opts) {

package/lib/index.js

@@ -37,7 +37,7 @@ import { checkBudgetAndHealthAlerts } from './budget-monitor.js';
 import { buildPoolItem, cleanupRemovedProviders } from './pool-builder.js';
 import { setupIdleHealEffect, setupAutoUnbreakEffect, setupPersistence } from './lifecycle.js';
 
-export const name = 'dsh-key-rotation';
+export const name = '@goodandready/dsh-key-rotation';
 export const inject = ['llm', 'webServer', 'settings', 'credentials'];
 export { keyTail, KEY_TAIL_CHARS, KEY_TAIL_PLACEHOLDER, isLoopbackAddress, isTrustedBridgeRequest, DEFAULT_SWITCH_CODES, isSwitchableError, formatExhaustionMessage, getRuntime };
 export { notifySwitch, notifyExhaustion };

package/lib/ops-test.js

@@ -90,6 +90,7 @@ ctx.effect(() => ctx.webServer.register({
   kind: 'exact',
   path: SANDBOX_CACHE_PATH,
   handler: (req, res) => {
+    if (req.method !== 'GET') { json(res, 405, { error: { code: 'method', message: 'GET only' } }); return; }
     if (!isTrustedBridgeRequest(req)) { json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: cache is local-only' } }); return; }
     const cacheSnap = typeof lastTestCache?.snapshot === 'function'
       ? lastTestCache.snapshot()

package/lib/ops-webhook.js

@@ -1,3 +1,4 @@
+import crypto from 'node:crypto';
 // lib/ops-webhook.js — webhook interactive action route (#312 split from routes-ops.js).
 import {
   json,
@@ -26,7 +27,11 @@ ctx.effect(() => ctx.webServer.register({
     const expected = runtime.webhookActionToken;
     if (!expected) { json(res, 503, { error: { code: 'no-token', message: 'dsh-key-rotation: webhookActionToken is not configured' } }); return; }
     const auth = String(req.headers.authorization ?? '');
-    if (auth !== `Bearer ${expected}`) { json(res, 401, { error: { code: 'unauthorized', message: 'dsh-key-rotation: bad webhook action token' } }); return; }
+    const expectedAuth = `Bearer ${expected}`;
+    const authBuf = Buffer.from(auth);
+    const expBuf = Buffer.from(expectedAuth);
+    const tokenMatch = authBuf.length === expBuf.length && crypto.timingSafeEqual(authBuf, expBuf);
+    if (!tokenMatch) { json(res, 401, { error: { code: 'unauthorized', message: 'dsh-key-rotation: bad webhook action token' } }); return; }
     let body;
     try { body = await readJson(req); } catch (e) { json(res, 400, { error: { code: 'bad-request', message: String(e?.message ?? e) } }); return; }
     // Accept callback payloads from formatInteractive (Telegram/Discord/Slack) or plain {action}
@@ -45,12 +50,18 @@ ctx.effect(() => ctx.webServer.register({
     if (typeof body?.setWebhook === 'object' && body.setWebhook) {
       const botToken = typeof body.setWebhook.botToken === 'string' ? body.setWebhook.botToken : '';
       if (!botToken) { json(res, 400, { error: { code: 'bad-request', message: 'dsh-key-rotation: setWebhook.botToken required' } }); return; }
+      const TELEGRAM_BOT_TOKEN_RE = /^[0-9]{5,16}:[a-zA-Z0-9_-]{20,50}$/;
+      if (!TELEGRAM_BOT_TOKEN_RE.test(botToken)) {
+        json(res, 400, { error: { code: 'bad-request', message: 'dsh-key-rotation: invalid telegram bot token format' } });
+        return;
+      }
       // derive the public URL from request headers; explicit URL wins
       const url = typeof body.setWebhook.url === 'string' && body.setWebhook.url ? body.setWebhook.url : `https://${String(req.headers.host ?? '')}/dsh-key-rotation/webhook-action`;
       try {
         const hookRes = await fetch(`https://api.telegram.org/bot${botToken}/setWebhook`, {
           method: 'POST', headers: { 'content-type': 'application/json' },
           body: JSON.stringify({ url, allowed_updates: ['callback_query'] }),
+          signal: AbortSignal.timeout(10000),
         });
         const hookData = await hookRes.json().catch(() => ({}));
         json(res, 200, { ok: hookRes.ok, url, telegram: hookData });

package/lib/plugin-updater.js

@@ -135,7 +135,7 @@ function comparePrerelease(left, right) {
   return 0
 }
 
-export function isNewerVersion(currentValue, candidateValue) {
+function isNewerVersion(currentValue, candidateValue) {
   const current = parseSemver(currentValue)
   const candidate = parseSemver(candidateValue)
   if (current === undefined || candidate === undefined) return false

package/lib/settings-write.js

@@ -1,6 +1,6 @@
 // Settings writes from redacted browser views must never replace an entire
 // namespace. Host-side mutate is atomic and rejects conflicts on both core eras.
-export const SECRET_FIELDS = new Set(['webhookActionToken']);
+const SECRET_FIELDS = new Set(['webhookActionToken']);
 const UNSAFE_FIELDS = new Set(['__proto__', 'prototype', 'constructor']);
 
 export function plainObject(value) {
@@ -9,7 +9,7 @@ export function plainObject(value) {
   return proto === Object.prototype || proto === null;
 }
 
-export function assertJson(value, depth = 0) {
+function assertJson(value, depth = 0) {
   if (depth > 40) throw new TypeError('Configuration is nested too deeply');
   if (value === null || typeof value === 'string' || typeof value === 'boolean') return;
   if (typeof value === 'number' && Number.isFinite(value)) return;

package/lib/usage-report.js

@@ -1,6 +1,6 @@
 // lib/usage-report.js - #209 usage report rows from pool state + 30-day compaction (#11). Pure helpers.
 const DAY_MS = 86400000;
-export const MAX_USAGE_RETENTION_DAYS = 30;
+const MAX_USAGE_RETENTION_DAYS = 30;
 
 /**
  * Build per-key usage rows for the last `days` ISO days (default 7).

package/lib/webhook.js

@@ -1,8 +1,8 @@
 import { bestEffort } from './best-effort.js';
 // lib/webhook.js — webhook sender with throttle, interactive actions + alert digest debouncer (#199, #10).
-export const WEBHOOK_TIMEOUT_MS = 5000;
-export const WEBHOOK_MIN_INTERVAL_MS = 1000;
-export const WEBHOOK_RETRY_DELAY_MS = 2000;
+const WEBHOOK_TIMEOUT_MS = 5000;
+const WEBHOOK_MIN_INTERVAL_MS = 1000;
+const WEBHOOK_RETRY_DELAY_MS = 2000;
 
 /**
  * Detect platform from webhook URL (#199).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.24",
+  "version": "0.8.25",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [

package/lib/bounded-map.js

@@ -1,65 +0,0 @@
-// lib/bounded-map.js — Map with max size + optional TTL (#262).
-
-export class BoundedMap {
-  /** @param {{ max?: number, ttlMs?: number|null }} opts */
-  constructor({ max = 1000, ttlMs = null } = {}) {
-    if (!Number.isFinite(max) || max < 1) throw new Error('BoundedMap: max must be >= 1');
-    this.max = max;
-    this.ttlMs = Number.isFinite(ttlMs) && ttlMs > 0 ? ttlMs : null;
-    this._m = new Map(); // insertion order = LRU order when we re-insert on get/set
-  }
-
-  get size() { return this._m.size; }
-
-  _expired(entry, now) {
-    if (!this.ttlMs || !entry) return false;
-    return now - entry.at >= this.ttlMs;
-  }
-
-  get(key, now = Date.now()) {
-    const e = this._m.get(key);
-    if (!e) return undefined;
-    if (this._expired(e, now)) {
-      this._m.delete(key);
-      return undefined;
-    }
-    // refresh LRU
-    this._m.delete(key);
-    this._m.set(key, e);
-    return e.v;
-  }
-
-  set(key, value, now = Date.now()) {
-    if (this._m.has(key)) this._m.delete(key);
-    this._m.set(key, { v: value, at: now });
-    while (this._m.size > this.max) {
-      const oldest = this._m.keys().next().value;
-      this._m.delete(oldest);
-    }
-    return this;
-  }
-
-  has(key, now = Date.now()) {
-    return this.get(key, now) !== undefined;
-  }
-
-  delete(key) { return this._m.delete(key); }
-  clear() { this._m.clear(); }
-
-  *entries(now = Date.now()) {
-    for (const [k, e] of [...this._m.entries()]) {
-      if (this._expired(e, now)) { this._m.delete(k); continue; }
-      yield [k, e.v];
-    }
-  }
-
-  *keys(now = Date.now()) {
-    for (const [k] of this.entries(now)) yield k;
-  }
-
-  toObject(now = Date.now()) {
-    const out = {};
-    for (const [k, v] of this.entries(now)) out[k] = v;
-    return out;
-  }
-}