@goodandready/dsh-key-rotation 0.8.28 → 0.8.30

package/CHANGELOG.md

@@ -3,6 +3,55 @@
 All notable changes to `@goodandready/dsh-key-rotation` are documented here.
 User-facing feature notes also appear in README (en is source of truth).
 
+## 0.8.30 - 2026-09-28
+
+### Added & Enhanced
+- **Per-Model Per-Key Token Quotas (#380)**:
+  - Granular token budgets per key within model sub-pools (`models.<model>.quotas.<ref>.tokenLimit`).
+  - Fail-closed local quota enforcement without penalising keys (healthy keys reaching their budget are safely skipped for that model without poisoning health scores or cooldown timers).
+  - Live token usage meters and progress bars in Settings UI card with remaining token counts and reset countdowns.
+  - Multi-window persistence of token consumption across daemon restarts.
+- **Resilient Provider Catalog (#379)**:
+  - Hardened provider catalog discovery for RPC-backed LLM service layers and backwards compatibility across core versions.
+  - Safe fallbacks from `listProviders()` to `listConfigurableProviders()` preventing card load failures when remote providers are registered.
+- **Method-Aware Bridge Security Guard (#378)**:
+  - Reinforced loopback origin checks distinguishing read-only operations (GET, HEAD, OPTIONS) from mutating operations.
+  - Hardened host header normalization (IPv6 bracket stripping and port stripping) guarding local management endpoints.
+
+### Refactored & Optimized
+- **Isolated Credential Resolver Module (#381)**:
+  - Extracted `credentials.resolve` dispatch logic from `lib/index.js` into modular `lib/resolver.js` (`createResolver`).
+  - Unit-testable routing decisions, request-scoped pool ownership (AsyncLocalStorage), and fail-closed budget checks.
+
+### Fixed & Hardened (#385)
+- **Lifecycle & Quota State Synchronization**:
+  - `/health` operational route now accurately respects `isKeyRevoked` and `isKeyPaused` in healthy count and degradation status.
+  - Fixed cost budget loop early `continue` in `lib/budget-monitor.js` which previously suppressed low-health and latency SLO alerts on providers lacking cost budgets.
+  - Integrated model token quota exhaustion detection (`isModelQuotaAvailable`) into low-health alerting (`warnBelowHealthy`).
+  - `DELETE /key` and `POST /reset` now cleanly purge stale `st.tokenUsage` entries.
+  - Replaced hardcoded hex color fallback in UI `Sparkline` with CSS theme variables.
+
+## 0.8.29 - 2026-09-27
+
+### Fixed & Hardened (#376)
+- **Decrypted secret resolution at rest**:
+  - `lib/index.js`: patched `credentials.resolve` now decrypts ciphertext (`enc:v1:...`) via `decryptSecret` for pooled hits, fallback environment variables, and unpooled standalone key queries, preventing raw encrypted strings from being passed to upstream LLM providers.
+- **Fail-safe candidate selection in rotation pool**:
+  - `lib/index.js`: `credentials.resolve` candidate check loop now explicitly enforces `!isKeyRevoked(pool, candidate)` and `!isKeyPaused(pool, candidate)` before selecting candidates.
+- **Predicate logic & dynamic state resolution**:
+  - `lib/pool.js`: corrected `isKeyPaused` predicate to ensure `pool.state.pausedRefs` is inspected when `pool.pausedRefs` Set or Array does not contain the ref, allowing runtime key pause mutations to take effect.
+  - `lib/cascade.js`: replaced raw `.has()` call with `isKeyRevoked(pool, ref)` and unified `isKeyPaused`, preventing `TypeError` crashes when `revokedRefs` is represented as an Array.
+- **Config & schema synchronization**:
+  - `lib/index.js`: propagated `p.revoked` into `buildPool` / `buildPoolItem` and added missing `paused` and `revoked` definitions to `SettingsSchema.providers`.
+- **Status & key administrative routes**:
+  - `lib/ops-status.js`: exposed `paused` and `revoked` booleans on key entries in `/dsh-key-rotation/status`.
+  - `lib/pool.js`: updated `keyTail` to transparently decrypt ciphertext before extracting the tail, displaying the actual credential mask instead of random ciphertext characters while preserving test safety contracts.
+  - `lib/ops-keys.js`: `/dsh-key-rotation/reset` now clears `st.revokedRefs` for provider resets and single ref resets, enabling operators to unblock fixed keys.
+- **Prometheus metrics & monitoring**:
+  - `lib/ops-metrics.js`: separated expired keys from active counts and added `dsh_key_rotation_expired_keys` gauge.
+  - `lib/budget-monitor.js`: excluded revoked and paused keys from healthy count in `warnBelowHealthy` threshold evaluation.
+  - `lib/webhook.js`: hardened Ntfy topic extraction against URLs with trailing slashes and query strings.
+
 ## 0.8.28 - 2026-09-27
 
 ### Security & Key Lifecycle (Block 3)

package/README.md

@@ -264,6 +264,16 @@ dsh-key-rotation:
         - PRIMARY_API_KEY
         - PRIMARY_API_KEY_2
         - PRIMARY_API_KEY_BACKUP
+      models:
+        reasoning-model-id:
+          keys:
+            - PRIMARY_API_KEY
+            - PRIMARY_API_KEY_2
+          quotas:
+            PRIMARY_API_KEY:
+              tokenLimit: 500000
+            PRIMARY_API_KEY_2:
+              tokenLimit: 1000000
     - provider: secondary-provider
       keys:
         - SECONDARY_API_KEY

package/README.ru.md

@@ -261,6 +261,16 @@ dsh-key-rotation:
         - PRIMARY_API_KEY
         - PRIMARY_API_KEY_2
         - PRIMARY_API_KEY_BACKUP
+      models:
+        reasoning-model-id:
+          keys:
+            - PRIMARY_API_KEY
+            - PRIMARY_API_KEY_2
+          quotas:
+            PRIMARY_API_KEY:
+              tokenLimit: 500000
+            PRIMARY_API_KEY_2:
+              tokenLimit: 1000000
     - provider: secondary-provider
       keys:
         - SECONDARY_API_KEY

package/README.zh.md

@@ -242,6 +242,16 @@ dsh-key-rotation:
         - PRIMARY_API_KEY
         - PRIMARY_API_KEY_2
         - PRIMARY_API_KEY_BACKUP
+      models:
+        reasoning-model-id:
+          keys:
+            - PRIMARY_API_KEY
+            - PRIMARY_API_KEY_2
+          quotas:
+            PRIMARY_API_KEY:
+              tokenLimit: 500000
+            PRIMARY_API_KEY_2:
+              tokenLimit: 1000000
     - provider: secondary-provider
       keys:
         - SECONDARY_API_KEY

package/lib/budget-monitor.js

@@ -1,5 +1,6 @@
 // lib/budget-monitor.js — periodic budget, expiry, low health and SLO alerts
-import { expiringSoon, shouldNotifyDaily, costForDay, costForWeek, budgetVerdict } from './pool.js';
+import { expiringSoon, shouldNotifyDaily, costForDay, costForWeek, budgetVerdict, isKeyPaused, isKeyRevoked } from './pool.js';
+import { isModelQuotaAvailable, hasModelQuotaConfig } from './model-quota.js';
 
 const DAY_MS = 86400000;
 
@@ -35,47 +36,51 @@ export function checkBudgetAndHealthAlerts({
         }
       }
       // #208: daily/weekly budget -> warn webhook, optional 1-day pause at 100%
-      const budget = runtime.providerBudgets.get(pool.base);
-      if (!budget) continue;
-      const daily = costForDay(pool.state.costDays);
-      const weekly = costForWeek(pool.state.costDays, now);
-      const verdict = budgetVerdict(daily, budget.costBudgetDaily);
-      const wVerdict = budgetVerdict(weekly, budget.costBudgetWeekly);
-      const hit = verdict.warn || wVerdict.warn;
-      if (hit && shouldNotifyDaily(budgetNotifiedAt, pool.base + ':budget', now)) {
-        logger?.warn?.(`[dsh-key-rotation] ${pool.base}: cost budget - day $${daily.toFixed(2)}/$${budget.costBudgetDaily} week $${weekly.toFixed(2)}/$${budget.costBudgetWeekly}`);
-        if (runtime.notifyWebhook) {
-          // #217: budget webhook gains action buttons when a callback token is configured
-          const token = runtime.webhookActionToken ?? '';
-          webhookSender.send(runtime.notifyWebhook, {
-            title: `Cost budget: ${pool.base}`,
-            text: `day $${daily.toFixed(2)} of $${budget.costBudgetDaily} · week $${weekly.toFixed(2)} of $${budget.costBudgetWeekly}` + (verdict.exceeded || wVerdict.exceeded ? ' · EXCEEDED' : ''),
-            provider: pool.base,
-            kind: 'budget',
-            spend: { daily, weekly },
-            actionToken: token || undefined,
-            actions: token ? [
-              { id: `pause-${pool.base}`, label: 'Pause 1h' },
-              { id: `reset-${pool.base}`, label: 'Reset cooldown' },
-            ] : undefined,
-          });
+      const budget = runtime.providerBudgets?.get?.(pool.base);
+      if (budget) {
+        const daily = costForDay(pool.state.costDays);
+        const weekly = costForWeek(pool.state.costDays, now);
+        const verdict = budgetVerdict(daily, budget.costBudgetDaily);
+        const wVerdict = budgetVerdict(weekly, budget.costBudgetWeekly);
+        const hit = verdict.warn || wVerdict.warn;
+        if (hit && shouldNotifyDaily(budgetNotifiedAt, pool.base + ':budget', now)) {
+          logger?.warn?.(`[dsh-key-rotation] ${pool.base}: cost budget - day $${daily.toFixed(2)}/$${budget.costBudgetDaily} week $${weekly.toFixed(2)}/$${budget.costBudgetWeekly}`);
+          if (runtime.notifyWebhook) {
+            // #217: budget webhook gains action buttons when a callback token is configured
+            const token = runtime.webhookActionToken ?? '';
+            webhookSender.send(runtime.notifyWebhook, {
+              title: `Cost budget: ${pool.base}`,
+              text: `day $${daily.toFixed(2)} of $${budget.costBudgetDaily} · week $${weekly.toFixed(2)} of $${budget.costBudgetWeekly}` + (verdict.exceeded || wVerdict.exceeded ? ' · EXCEEDED' : ''),
+              provider: pool.base,
+              kind: 'budget',
+              spend: { daily, weekly },
+              actionToken: token || undefined,
+              actions: token ? [
+                { id: `pause-${pool.base}`, label: 'Pause 1h' },
+                { id: `reset-${pool.base}`, label: 'Reset cooldown' },
+              ] : undefined,
+            });
+          }
         }
-      }
-      if ((verdict.exceeded || wVerdict.exceeded) && budget.pauseOnBudget) {
-        const until = now + DAY_MS;
-        for (const ref of pool.refs) {
-          if ((pool.state.failedUntil.get(ref) ?? 0) < until) pool.state.failedUntil.set(ref, until);
+        if ((verdict.exceeded || wVerdict.exceeded) && budget.pauseOnBudget) {
+          const until = now + DAY_MS;
+          for (const ref of pool.refs) {
+            if ((pool.state.failedUntil.get(ref) ?? 0) < until) pool.state.failedUntil.set(ref, until);
+          }
         }
       }
       // #221: pool running low - webhook while healthy < warnBelowHealthy
       const warnBelow = runtime.warnBelowHealthy ?? 0;
       if (warnBelow > 0) {
+        const quotaAware = hasModelQuotaConfig(pool);
         let healthy = 0;
         for (const ref of pool.refs) {
+          if (isKeyRevoked(pool, ref) || isKeyPaused(pool, ref)) continue;
           const fu = pool.state.failedUntil.get(ref);
           if (fu !== undefined && fu > now) continue;
           const exp = pool.expiresAt?.[ref];
           if (exp !== undefined && now >= exp) continue;
+          if (quotaAware && !isModelQuotaAvailable(pool, ref, now)) continue;
           healthy++;
         }
         if (healthy < warnBelow && shouldNotifyDaily(lowHealthNotifiedAt, pool.base, now)) {

package/lib/cascade.js

@@ -1,15 +1,9 @@
-// cascade.js — cross-provider failover cascade (issues #194, #364).
+// cascade.js — cross-provider failover cascade (issues #194, #364, #376).
 // ponytail: minimal — pick fallback provider with model mapping from config.
+import { isKeyPaused, isKeyRevoked } from './pool.js';
 
 export const CASCADE_MAX_DEPTH = 3;
 
-function isKeyPaused(pool, ref) {
-  if (!pool || !ref) return false;
-  if (pool.pausedRefs instanceof Set) return pool.pausedRefs.has(ref);
-  if (Array.isArray(pool.pausedRefs)) return pool.pausedRefs.includes(ref);
-  return false;
-}
-
 export function pickCascadeFallback(provider, cfg, pools, currentModel) {
   const list = Array.isArray(cfg && cfg.cascade) ? cfg.cascade : [];
   for (const entry of list) {
@@ -20,7 +14,7 @@ export function pickCascadeFallback(provider, cfg, pools, currentModel) {
     const now = Date.now();
     let healthy = 0;
     for (const ref of pool.refs) {
-      if (isKeyPaused(pool, ref) || (pool.revokedRefs && pool.revokedRefs.has(ref)) || (pool.state?.revokedRefs && pool.state.revokedRefs.has(ref))) continue;
+      if (isKeyPaused(pool, ref) || isKeyRevoked(pool, ref)) continue;
       const failedUntil = (pool.state && pool.state.failedUntil && pool.state.failedUntil.get(ref)) || 0;
       if (failedUntil > now) continue;
       const exp = pool.expiresAt ? pool.expiresAt[ref] : undefined;

package/lib/client.js

@@ -120,6 +120,24 @@ window.__ModuleLoader__.load({
       budgetLabel: 'budget:',
       exportCsv: 'Export CSV',
       weightHint: 'round-robin weight: how many times this key joins the cycle (1 = equal share)',
+      modelPoolsTitle: 'Per-model token quotas',
+      modelPoolsHint: 'Give one credential its own token budget for one model. A key that spends its budget is skipped for that model only — other models keep using it. Leave the limit empty for unlimited.',
+      modelPoolsEmpty: 'No model sub-pools configured. Add one to give a model its own keys and token budgets.',
+      addModel: '+ Add model',
+      modelName: 'Model id',
+      modelNamePlaceholder: 'e.g. claude-sonnet',
+      removeModel: 'Remove this model pool',
+      modelKeys: 'Credential references for this model',
+      tokenLimitLabel: 'Token limit',
+      tokenLimitPlaceholder: 'unlimited',
+      tokenLimitHint: 'Tokens this credential may spend on this model per quota window. Empty = unlimited.',
+      mtUnlimited: 'Unlimited',
+      mtExhausted: 'Exhausted',
+      mtRemaining: 'Remaining: {n}',
+      mtResetIn: 'Reset: {t}',
+      mtUsedOf: '{u} / {l}',
+      mtResetWindowHint: 'Window controlled by quotaResetWindow.',
+      mtLocalOnly: 'Tracked locally from provider-reported usage on successful responses.',
       retestBroken: 'Re-test',
       retestFail: 're-test failed - key still down',
       snapshotExport: 'Snapshot ⬇',
@@ -276,6 +294,24 @@ window.__ModuleLoader__.load({
       budgetLabel: '预算:',
       exportCsv: '导出 CSV',
       weightHint: '轮换权重：该密钥参与循环的次数 (1 = 等分)',
+      modelPoolsTitle: '按模型设置 Token 额度',
+      modelPoolsHint: '为某个凭据在某个模型上单独设置 Token 额度。额度用尽的密钥只会在该模型上被跳过，其他模型仍可继续使用。留空表示不限额。',
+      modelPoolsEmpty: '尚未配置模型子池。添加一个即可为该模型单独指定密钥与 Token 额度。',
+      addModel: '+ 添加模型',
+      modelName: '模型 ID',
+      modelNamePlaceholder: '例如 claude-sonnet',
+      removeModel: '移除该模型子池',
+      modelKeys: '该模型使用的凭据引用',
+      tokenLimitLabel: 'Token 额度',
+      tokenLimitPlaceholder: '不限额',
+      tokenLimitHint: '该凭据在此模型的每个额度周期内可消耗的 Token 数。留空表示不限额。',
+      mtUnlimited: '不限额',
+      mtExhausted: '已耗尽',
+      mtRemaining: '剩余：{n}',
+      mtResetIn: '重置：{t}',
+      mtUsedOf: '{u} / {l}',
+      mtResetWindowHint: '周期由 quotaResetWindow 控制。',
+      mtLocalOnly: '仅在成功响应后根据提供商返回的 usage 本地记账。',
       retestBroken: '重新测试',
       retestFail: '重新测试失败 - 密钥仍然不可用',
       snapshotExport: '快照 ⬇',
@@ -522,6 +558,19 @@ window.__ModuleLoader__.load({
       '.krot-alert-ok{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-success-primary) 10%, transparent);color:var(--dsw-alias-state-success-primary);font-size:13px;display:flex;align-items:center;gap:10px}',
       '.krot-alert-bad{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, transparent);color:var(--dsw-alias-state-error-primary);font-size:13px;display:flex;align-items:center;gap:10px}',
       '.krot-event-stream{display:flex;flex-direction:column;gap:6px;margin-top:8px;padding:10px 12px;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);border-radius:8px}',
+      // Per-model token quota editor + runtime meter
+      '.krot-models{margin-top:14px;border-top:1px solid var(--dsw-alias-border-l2);padding-top:12px}',
+      '.krot-models-title{display:flex;align-items:center;gap:8px;font-size:13px;font-weight:600;color:var(--dsw-alias-label-primary);margin-bottom:4px}',
+      '.krot-models-hint{font-size:12px;color:var(--dsw-alias-label-secondary);line-height:1.4;margin:0 0 10px}',
+      '.krot-model{border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:10px 12px;margin-bottom:10px;background:var(--dsw-alias-bg-layer-2)}',
+      '.krot-model-head{display:flex;align-items:center;gap:8px;flex-wrap:wrap;margin-bottom:8px}',
+      '.krot-model-tag{font-size:11px;padding:2px 8px;border-radius:10px;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-secondary)}',
+      '.krot-limit{width:110px;font-variant-numeric:tabular-nums;text-align:right}',
+      '.krot-qbar{display:inline-block;width:64px;height:6px;background:var(--dsw-alias-bg-layer-3);border-radius:3px;overflow:hidden;vertical-align:middle}',
+      '.krot-qbar-fill{display:block;height:100%;transition:width .2s ease}',
+      '.krot-qmeta{font-size:11px;color:var(--dsw-alias-label-secondary);font-variant-numeric:tabular-nums}',
+      '.krot-q-exhausted{font-size:11px;font-weight:600;color:var(--dsw-alias-state-error-primary)}',
+      '.krot-q-unlimited{font-size:11px;color:var(--dsw-alias-label-tertiary);font-style:italic}',
       '.krot-event-row{display:flex;align-items:center;gap:8px;font-size:12px;padding:4px 0;border-bottom:1px solid var(--dsw-alias-border-l1)}',
       '.krot-event-time{font-family:ui-monospace,Menlo,Consolas,monospace;color:var(--dsw-alias-label-tertiary);font-size:11px}',
       ':root{--krot-chart-4:var(--dsw-alias-state-brand-primary);--krot-chart-5:var(--dsw-alias-state-error-primary);--krot-chart-6:var(--dsw-alias-state-success-primary)}',
@@ -613,7 +662,7 @@ window.__ModuleLoader__.load({
     }
 
 
-    function Sparkline({ points = [], width = 120, height = 22, stroke = 'var(--dsw-alias-state-brand-primary, #3b82f6)' }) {
+    function Sparkline({ points = [], width = 120, height = 22, stroke = 'var(--dsw-alias-state-brand-primary, var(--dsw-alias-color-primary, currentColor))' }) {
       if (!Array.isArray(points) || points.length < 2) {
         return h('svg', { width, height, viewBox: `0 0 ${width} ${height}`, style: { opacity: 0.3 } },
           h('line', { x1: 0, y1: height / 2, x2: width, y2: height / 2, stroke, strokeWidth: 1, strokeDasharray: '3 3' })
@@ -872,6 +921,55 @@ window.__ModuleLoader__.load({
       return next;
     }
 
+    function formatCountdown(ms) {
+      if (!Number.isFinite(ms) || ms <= 0) return '00:00:00';
+      const total = Math.floor(ms / 1000);
+      const h = Math.floor(total / 3600);
+      const m = Math.floor((total % 3600) / 60);
+      const s = total % 60;
+      const pad = (n) => String(n).padStart(2, '0');
+      return pad(h) + ':' + pad(m) + ':' + pad(s);
+    }
+
+    function quotaMapOf(modelEntry) {
+      const out = {};
+      const raw = (modelEntry && typeof modelEntry === 'object' && modelEntry.quotas) || {};
+      if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return out;
+      for (const [ref, value] of Object.entries(raw)) {
+        if (['__proto__', 'constructor', 'prototype'].includes(ref)) continue;
+        const n = typeof value === 'object' && value !== null ? value.tokenLimit : value;
+        const num = typeof n === 'string' ? Number(n.trim() === '' ? NaN : n) : Number(n);
+        if (Number.isFinite(num) && num > 0) out[ref] = { tokenLimit: Math.floor(num) };
+      }
+      return out;
+    }
+
+    function withQuotas(modelEntry, limits) {
+      const quotas = {};
+      for (const [ref, value] of Object.entries(limits ?? {})) {
+        const n = typeof value === 'object' && value !== null ? value.tokenLimit : value;
+        const num = typeof n === 'string' ? Number(n.trim() === '' ? NaN : n) : Number(n);
+        if (!Number.isFinite(num) || num <= 0) continue;
+        quotas[ref] = { tokenLimit: Math.floor(num) };
+      }
+      const next = { ...modelEntry };
+      if (Object.keys(quotas).length === 0) delete next.quotas;
+      else next.quotas = quotas;
+      return next;
+    }
+
+    function modelEntriesOf(entry) {
+      const models = entry && entry.models;
+      if (!models || typeof models !== 'object' || Array.isArray(models)) return [];
+      return Object.entries(models).filter(([, value]) => value && typeof value === 'object' && !Array.isArray(value));
+    }
+
+    function isValidModelId(id) {
+      return typeof id === 'string' && id.trim().length > 0
+        && !['__proto__', 'constructor', 'prototype'].includes(id)
+        && id.length <= 200;
+    }
+
     function validatePoolDraft(providers) {
       if (!Array.isArray(providers)) throw new Error('Provider pools must be an array');
       const names = new Set();
@@ -883,6 +981,17 @@ window.__ModuleLoader__.load({
           throw new Error('Choose a unique provider and valid, unique credential reference names');
         }
         names.add(entry.provider);
+        for (const [model, mp] of modelEntriesOf(entry)) {
+          if (!isValidModelId(model)) throw new Error('Model ids must be non-empty and safe as configuration keys');
+          if (!Array.isArray(mp.keys)
+            || mp.keys.some(key => typeof key !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+            || new Set(mp.keys).size !== mp.keys.length) {
+            throw new Error('Each model pool needs valid, unique credential reference names');
+          }
+          for (const ref of Object.keys(quotaMapOf(mp))) {
+            if (!mp.keys.includes(ref)) throw new Error('A model token limit must reference a credential of that model pool');
+          }
+        }
       }
     }
 
@@ -1491,6 +1600,79 @@ window.__ModuleLoader__.load({
         providers: [...(Array.isArray(cur.providers) ? cur.providers : []), { provider: '', keys: [] }],
       }));
 
+      // ── per-model sub-pools + token quotas ──
+      const setModels = (pIndex, mutate) => setField((cur) => {
+        const providers = [...(cur.providers ?? [])];
+        const entry = { ...(providers[pIndex] ?? {}) };
+        const models = { ...(entry.models && !Array.isArray(entry.models) ? entry.models : {}) };
+        mutate(models);
+        if (Object.keys(models).length === 0) delete entry.models;
+        else entry.models = models;
+        providers[pIndex] = entry;
+        return { ...cur, providers };
+      });
+
+      const addModel = (pIndex) => setModels(pIndex, (models) => {
+        let name = 'model';
+        let n = 2;
+        while (Object.prototype.hasOwnProperty.call(models, name)) name = 'model-' + n++;
+        const seedKeys = ((draftRef.current ?? stateRef.current.value)?.providers ?? [])[pIndex]?.keys ?? [];
+        models[name] = { keys: [...seedKeys] };
+      });
+
+      const renameModel = (pIndex, from, to) => setModels(pIndex, (models) => {
+        const id = String(to ?? '');
+        if (id === from || !isValidModelId(id)) return;
+        if (Object.prototype.hasOwnProperty.call(models, id)) return;
+        const rebuilt = {};
+        for (const [key, value] of Object.entries(models)) rebuilt[key === from ? id : key] = value;
+        for (const key of Object.keys(models)) delete models[key];
+        Object.assign(models, rebuilt);
+      });
+
+      const removeModel = (pIndex, model) => setModels(pIndex, (models) => {
+        delete models[model];
+      });
+
+      const toggleModelKey = (pIndex, model, ref, on) => setModels(pIndex, (models) => {
+        const mp = { ...(models[model] ?? {}) };
+        const keys = Array.isArray(mp.keys) ? [...mp.keys] : [];
+        const index = keys.indexOf(ref);
+        if (on && index < 0) keys.push(ref);
+        if (!on && index >= 0) keys.splice(index, 1);
+        mp.keys = keys;
+        if (!on) {
+          const limits = quotaMapOf(mp);
+          delete limits[ref];
+          models[model] = withQuotas(mp, limits);
+        } else {
+          models[model] = mp;
+        }
+      });
+
+      const setModelTokenLimit = (pIndex, model, ref, raw) => setModels(pIndex, (models) => {
+        const mp = { ...(models[model] ?? {}) };
+        const limits = quotaMapOf(mp);
+        const text = String(raw ?? '').trim();
+        if (text === '') delete limits[ref];
+        else {
+          const num = Number(text);
+          if (!Number.isFinite(num) || num <= 0) delete limits[ref];
+          else limits[ref] = Math.floor(num);
+        }
+        models[model] = withQuotas(mp, limits);
+      });
+
+      const reorderModelKeys = (pIndex, model, delta, kIndex) => setModels(pIndex, (models) => {
+        const mp = { ...(models[model] ?? {}) };
+        const keys = Array.isArray(mp.keys) ? [...mp.keys] : [];
+        const target = kIndex + delta;
+        if (target < 0 || target >= keys.length) return;
+        [keys[kIndex], keys[target]] = [keys[target], keys[kIndex]];
+        mp.keys = keys;
+        models[model] = mp;
+      });
+
       const save = async () => {
         const savingDraft = draftRef.current;
         const base = draftBaseRef.current;
@@ -1853,6 +2035,100 @@ window.__ModuleLoader__.load({
           );
         })();
 
+// ── per-model sub-pools: keys + token quotas, plus live usage meters ──
+        const modelPools = (() => {
+          const models = modelEntriesOf(entry);
+          const statusFor = (model) => status[entry.provider + '::' + model] ?? null;
+          const runtimeKeysOf = (model) => {
+            const ps = statusFor(model);
+            return ps && Array.isArray(ps.keys) ? ps.keys : null;
+          };
+          const rendered = models.map(([model, mp]) => {
+            const keys = Array.isArray(mp.keys) ? mp.keys : [];
+            const limits = quotaMapOf(mp);
+            const rtKeys = runtimeKeysOf(model);
+            const rows = keys.map((ref, kIndex) => {
+              const info = rtKeys ? rtKeys.find((x) => x.ref === ref) : null;
+              const quota = info && info.modelQuota ? info.modelQuota : null;
+              const limits2 = { ...limits };
+              const limitValue = limits2[ref]?.tokenLimit;
+              const cells = [
+                h('span', { key: 'r', className: 'krot-tail', title: ref }, ref),
+                h('input', {
+                  key: 'l',
+                  type: 'number',
+                  min: 1,
+                  step: 1,
+                  className: 'krot-in krot-limit',
+                  value: limitValue === undefined ? '' : String(limitValue),
+                  placeholder: t('tokenLimitPlaceholder'),
+                  title: t('tokenLimitHint'),
+                  disabled: !stateRef.current.writable,
+                  onChange: (e) => setModelTokenLimit(pIndex, model, ref, e.target.value),
+                }),
+              ];
+              if (!quota) {
+                cells.push(h('span', { key: 'm', className: 'krot-q-unlimited', title: t('mtLocalOnly') }, t('mtUnlimited')));
+              } else {
+                const pct = quota.limit > 0 ? Math.min(100, Math.round((quota.used / quota.limit) * 100)) : 0;
+                const color = quota.exhausted
+                  ? 'var(--dsw-alias-state-error-primary)'
+                  : pct >= 80 ? 'var(--dsw-alias-state-warning-primary)' : 'var(--dsw-alias-state-success-primary)';
+                const resetIn = quota.resetAt ? formatCountdown(quota.resetAt - Date.now()) : null;
+                cells.push(h('span', { key: 'm', style: { display: 'inline-flex', alignItems: 'center', gap: '6px' } },
+                  h('span', { className: 'krot-qbar', title: t('mtUsedOf').replace('{u}', String(quota.used)).replace('{l}', String(quota.limit)) },
+                    h('span', { className: 'krot-qbar-fill', style: { width: pct + '%', background: color } })),
+                  h('span', {
+                    className: quota.exhausted ? 'krot-q-exhausted' : 'krot-qmeta',
+                    title: [t('mtUsedOf').replace('{u}', String(quota.used)).replace('{l}', String(quota.limit)),
+                      t('mtRemaining').replace('{n}', String(quota.remaining)),
+                      resetIn ? t('mtResetIn').replace('{t}', resetIn) : '',
+                      t('mtResetWindowHint')].filter(Boolean).join(' · '),
+                  }, quota.exhausted
+                    ? t('mtExhausted')
+                    : (pct >= 1 || quota.used > 0 ? pct + '%' : t('mtRemaining').replace('{n}', String(quota.remaining)))),
+                ));
+              }
+              cells.push(h('span', { key: 'a', className: 'krot-acts' },
+                btn('↑', () => reorderModelKeys(pIndex, model, -1, kIndex), { disabled: kIndex === 0, title: t('moveUp') }),
+                btn('↓', () => reorderModelKeys(pIndex, model, 1, kIndex), { disabled: kIndex === keys.length - 1, title: t('moveDown') }),
+                btn('✕', () => toggleModelKey(pIndex, model, ref, false), { title: t('removeKey') }),
+              ));
+              return h('div', { key: ref, className: 'krot-qrow' }, cells);
+            });
+
+            const available = (entry.keys ?? []).filter((ref) => !keys.includes(ref));
+            return h('div', { key: model, className: 'krot-model' },
+              h('div', { className: 'krot-model-head' },
+                h('input', {
+                  className: 'krot-in',
+                  defaultValue: model,
+                  title: t('modelName'),
+                  placeholder: t('modelNamePlaceholder'),
+                  disabled: !stateRef.current.writable,
+                  onBlur: (e) => renameModel(pIndex, model, e.target.value.trim()),
+                  style: { maxWidth: '220px' },
+                }),
+                h('span', { className: 'krot-tail' }, t('modelKeys') + ': ' + keys.length),
+                btn(t('removeModel'), () => removeModel(pIndex, model), { title: t('removeModel') }),
+              ),
+              rows.length > 0 ? h('div', { className: 'krot-keys' }, rows)
+                : h('p', { className: 'krot-hint' }, t('modelPoolsEmpty')),
+              available.length > 0 ? h('div', { className: 'krot-foot', style: { marginTop: '6px' } },
+                h('span', { className: 'krot-hint' }, t('addKey') + ':'),
+                available.map((ref) => btn(ref, () => toggleModelKey(pIndex, model, ref, true), { key: 'add-' + ref, title: ref })),
+              ) : null,
+            );
+          });
+
+          return h('div', { className: 'krot-models' },
+            h('div', { className: 'krot-models-title' }, '🎯 ' + t('modelPoolsTitle')),
+            h('p', { className: 'krot-models-hint' }, t('modelPoolsHint')),
+            rendered.length > 0 ? h('div', null, rendered) : h('p', { className: 'krot-hint' }, t('modelPoolsEmpty')),
+            btn(t('addModel'), () => addModel(pIndex), { title: t('addModel'), disabled: !stateRef.current.writable }),
+          );
+        })();
+
         return h('div', { key: pIndex, className: 'krot-prov' },
           h('div', { className: 'krot-prov-head' },
             h('input', {
@@ -1918,6 +2194,7 @@ window.__ModuleLoader__.load({
           filterBar,
           loadChart,
           h('div', { className: 'krot-keys' }, keyRows),
+          modelPools,
           h(UpdaterSection, { t }),
       h('div', { className: 'krot-foot' },
             btn(t('addKey'), () => addKey(pIndex), { title: t('addKeyTitle'), disabled: !entry.provider.trim() }),
@@ -2384,6 +2661,11 @@ window.__ModuleLoader__.load({
     }
 
     module.exports = { apply, inject: ['slots', 'locale'] };
+    if (typeof globalThis !== 'undefined') {
+      globalThis.__dshKeyRotationClientInternals = {
+        quotaMapOf, withQuotas, modelEntriesOf, isValidModelId, formatCountdown, validatePoolDraft,
+      };
+    }
     return module.exports;
   },
     updateCheck: 'Check for updates',