@goodandready/dsh-key-rotation 0.8.32 → 0.8.34

package/CHANGELOG.md

@@ -3,6 +3,40 @@
 All notable changes to `@goodandready/dsh-key-rotation` are documented here.
 User-facing feature notes also appear in README (en is source of truth).
 
+## 0.8.34 - 2026-09-28
+
+### Security & Hardening
+- **Credentials Encryption at Rest on PUT (#395)**:
+  - Wired `encryptSecret` in `lib/ops-keys.js` (`PUT /dsh-key-rotation/key`).
+  - When `DSH_KEY_SECRET` is set in the environment, new keys are automatically encrypted at rest via AES-256-GCM (`enc:v1:...`).
+  - Key tail calculation and leak shape analysis continue to operate on raw values for uninterrupted UI diagnostics.
+  - Added dedicated integration test suite `test/crypto-storage-keys.test.mjs`.
+
+### Refactored & Tech-Debt
+- **Preflight Cleanliness & Safe Diagnostics (#393)**:
+  - Eliminated 5 empty `catch {}` blocks across `lib/plugin-updater.js` and `lib/ops-webhook.js`.
+  - Replaced unhandled exceptions with `bestEffort(label, fn, logger)` utilizing structured debug logging to `ctx?.logger`.
+  - Resolved preflight check blocker (`FAIL=0`).
+- **Dead Export Wiring & Core Cohesion (#394)**:
+  - Reused `scanForLiveSecrets` in `lib/http-bridge.js` to parse patch ops arrays directly in `handleConfigBridge`.
+  - Connected `filterQuotaEligible` to `anyModelQuotaAvailable` in `lib/model-quota.js`.
+  - Integrated `nowWall()` in `lib/quota-window.js` for default calendar reset calculations.
+
+## 0.8.33 - 2026-09-28
+
+### Fixed & Hardened
+- **Telegram Webhook Interactive Actions (#388)**:
+  - Route `/dsh-key-rotation/webhook-action` now accepts `X-Telegram-Bot-Api-Secret-Token` via constant-time comparison (`crypto.timingSafeEqual`) alongside `Authorization: Bearer`.
+  - Added native Telegram `answerCallbackQuery` webhook response (`{ method: 'answerCallbackQuery', callback_query_id, text }`) dismissing the spinner immediately on button presses.
+  - Enforced mandatory explicit HTTPS URL requirement in `setWebhook` helper and transmission of `secret_token`.
+- **Plugin Self-Updater Resiliency & Supply Chain Protection (#390)**:
+  - Removed `--config.minimumReleaseAge=0` override from `dsh plugin add` arguments, restoring release age policies and package verification.
+  - Implemented live PID detection via `process.kill(pid, 0)` in `package.json.lock`, returning 409 Conflict if installation is already in progress.
+  - Added automatic cleanup of orphaned/stale lockfiles left by dead processes.
+  - Ensured child process timeout immediately cleans up its own lockfile.
+- **Repository & Worktree Hygiene (#389)**:
+  - Pruned obsolete worktrees and deleted old merged feature branches.
+
 ## 0.8.32 - 2026-09-28
 
 ### Added & Enhanced

package/README.md

@@ -311,7 +311,7 @@ All management routes require loopback authentication (`127.0.0.1` / `::1`) with
 | `/dsh-key-rotation/reset` | `POST` | Instantly resets all cooldowns and restores all keys to `ready`. |
 | `/dsh-key-rotation/test-matrix` | `POST` | Triggers parallel health check across all configured keys and models. |
 | `/dsh-key-rotation/usage-report` | `GET` | Returns aggregated usage metrics in JSON or CSV format (`?format=csv`). |
-| `/dsh-key-rotation/webhook-callback`| `POST` | Receives and executes interactive actions from Telegram/Slack callbacks. |
+| `/dsh-key-rotation/webhook-action` | `POST` | Receives and executes interactive actions from Telegram/Slack callbacks (`Authorization: Bearer` or `X-Telegram-Bot-Api-Secret-Token`). |
 
 ---
 

package/README.ru.md

@@ -303,7 +303,7 @@ dsh-key-rotation:
 | `/dsh-key-rotation/reset` | `POST` | Мгновенный сброс всех кулдаунов и возврат ключей в статус `ready`. |
 | `/dsh-key-rotation/test-matrix` | `POST` | Запуск параллельного тестирования всей матрицы ключей и моделей. |
 | `/dsh-key-rotation/usage-report` | `GET` | Получение сводного отчета использования в формате JSON или CSV (`?format=csv`). |
-| `/dsh-key-rotation/webhook-callback`| `POST` | Обработка интерактивных действий от кнопок в Telegram/Slack. |
+| `/dsh-key-rotation/webhook-action` | `POST` | Обработка интерактивных действий от кнопок в Telegram/Slack (`Authorization: Bearer` или `X-Telegram-Bot-Api-Secret-Token`). |
 
 ---
 

package/lib/http-bridge.js

@@ -170,9 +170,14 @@ export function providerCatalog(ctx, cloneIds) {
 
 
 export function scanForLiveSecrets(section) {
+  if (Array.isArray(section)) {
+    return findSecrets(JSON.stringify(section.filter(op => !['webhookActionToken', 'notifyWebhook'].includes(op?.path?.[0]))));
+  }
   const masked = structuredClone(section);
-  if (masked.webhookActionToken) masked.webhookActionToken = '***';
-  if (masked.notifyWebhook) masked.notifyWebhook = '***';
+  if (masked && typeof masked === 'object') {
+    if (masked.webhookActionToken) masked.webhookActionToken = '***';
+    if (masked.notifyWebhook) masked.notifyWebhook = '***';
+  }
   return findSecrets(JSON.stringify(masked));
 }
 
@@ -230,7 +235,7 @@ export async function handleConfigBridge(ctx, request, res, getCloneIds) {
         return;
       }
       try {
-        const findings = findSecrets(JSON.stringify(section.filter(op => !['webhookActionToken', 'notifyWebhook'].includes(op.path[0]))));
+        const findings = scanForLiveSecrets(section);
         if (findings.length > 0) {
           json(res, 400, {
             error: {

package/lib/model-quota.js

@@ -187,11 +187,7 @@ export function isModelQuotaAvailable(pool, ref, now) {
 
 /** True when at least one ref of `pool` still has local quota left. */
 export function anyModelQuotaAvailable(pool, now) {
-  const refs = pool?.refs ?? [];
-  for (const ref of refs) {
-    if (isModelQuotaAvailable(pool, ref, now)) return true;
-  }
-  return false;
+  return filterQuotaEligible(pool, pool?.refs ?? [], now).length > 0;
 }
 
 /**

package/lib/ops-keys.js

@@ -1,4 +1,4 @@
-import { decryptSecret } from './crypto-storage.js';
+import { decryptSecret, encryptSecret } from './crypto-storage.js';
 // lib/ops-keys.js — key store + cooldown reset + import routes (#312 split from routes-ops.js).
 import {
   json,
@@ -89,7 +89,8 @@ ctx.effect(() => ctx.webServer.register({
         json(res, 400, { error: { code: 'empty-value', message: 'dsh-key-rotation: an empty key cannot be stored' } });
         return;
       }
-      await credentialsService.set(ref, value);
+      const storedValue = encryptSecret(value);
+      await credentialsService.set(ref, storedValue);
       // #200: leak-detector hint - stored value should look like a credential
       const secretShape = looksLikeApiSecret(value);
       json(res, 200, { ok: true, ref, tail: keyTail(value), looksLikeSecret: secretShape });

package/lib/ops-webhook.js

@@ -1,11 +1,28 @@
 import crypto from 'node:crypto';
-// lib/ops-webhook.js — webhook interactive action route (#312 split from routes-ops.js).
+// lib/ops-webhook.js — webhook interactive action route (#312 split from routes-ops.js, #388 telegram secret-token & answerCallbackQuery).
 import {
   json,
   readJson,
 } from './http-bridge.js';
+import { bestEffort } from './best-effort.js';
 import { WEBHOOK_ACTION_PATH } from './ops-paths.js';
 
+function constantTimeEqual(a, b) {
+  if (typeof a !== 'string' || typeof b !== 'string') return false;
+  const aBuf = Buffer.from(a);
+  const bBuf = Buffer.from(b);
+  return aBuf.length === bBuf.length && crypto.timingSafeEqual(aBuf, bBuf);
+}
+
+function getHeader(headers, name) {
+  if (!headers || typeof headers !== 'object') return '';
+  const target = name.toLowerCase();
+  for (const [k, v] of Object.entries(headers)) {
+    if (k.toLowerCase() === target) return String(v ?? '');
+  }
+  return '';
+}
+
 /**
  * @param {object} ctx cordis context
  * @param {object} deps live dependencies from apply()
@@ -26,27 +43,20 @@ ctx.effect(() => ctx.webServer.register({
     const runtime = buildRuntime();
     const expected = runtime.webhookActionToken;
     if (!expected) { json(res, 503, { error: { code: 'no-token', message: 'dsh-key-rotation: webhookActionToken is not configured' } }); return; }
-    const auth = String(req.headers.authorization ?? '');
-    const expectedAuth = `Bearer ${expected}`;
-    const authBuf = Buffer.from(auth);
-    const expBuf = Buffer.from(expectedAuth);
-    const tokenMatch = authBuf.length === expBuf.length && crypto.timingSafeEqual(authBuf, expBuf);
-    if (!tokenMatch) { json(res, 401, { error: { code: 'unauthorized', message: 'dsh-key-rotation: bad webhook action token' } }); return; }
+
+    const authHeader = getHeader(req.headers, 'authorization');
+    const secretHeader = getHeader(req.headers, 'x-telegram-bot-api-secret-token');
+    const bearerMatch = constantTimeEqual(authHeader, `Bearer ${expected}`);
+    const secretMatch = constantTimeEqual(secretHeader, expected);
+    if (!bearerMatch && !secretMatch) {
+      json(res, 401, { error: { code: 'unauthorized', message: 'dsh-key-rotation: bad webhook action token' } });
+      return;
+    }
+
     let body;
     try { body = await readJson(req); } catch (e) { json(res, 400, { error: { code: 'bad-request', message: String(e?.message ?? e) } }); return; }
-    // Accept callback payloads from formatInteractive (Telegram/Discord/Slack) or plain {action}
-    let action = typeof body?.action === 'string' ? body.action : '';
-    if (!action && typeof body?.data === 'string') {
-      try { action = String(JSON.parse(body.data)?.id ?? ''); } catch { action = ''; }
-    }
-    if (!action && typeof body?.callback_data === 'string') {
-      try { action = String(JSON.parse(body.callback_data)?.id ?? ''); } catch { action = ''; }
-    }
-    // #222: Telegram update envelope {update_id, callback_query:{data}}
-    if (!action && typeof body?.callback_query?.data === 'string') {
-      try { action = String(JSON.parse(body.callback_query.data)?.id ?? ''); } catch { action = ''; }
-    }
-    // #222: Telegram setWebhook registration helper
+
+    // #222 / #388: Telegram setWebhook registration helper
     if (typeof body?.setWebhook === 'object' && body.setWebhook) {
       const botToken = typeof body.setWebhook.botToken === 'string' ? body.setWebhook.botToken : '';
       if (!botToken) { json(res, 400, { error: { code: 'bad-request', message: 'dsh-key-rotation: setWebhook.botToken required' } }); return; }
@@ -55,38 +65,92 @@ ctx.effect(() => ctx.webServer.register({
         json(res, 400, { error: { code: 'bad-request', message: 'dsh-key-rotation: invalid telegram bot token format' } });
         return;
       }
-      // derive the public URL from request headers; explicit URL wins
-      const url = typeof body.setWebhook.url === 'string' && body.setWebhook.url ? body.setWebhook.url : `https://${String(req.headers.host ?? '')}/dsh-key-rotation/webhook-action`;
+      const rawUrl = typeof body.setWebhook.url === 'string' ? body.setWebhook.url.trim() : '';
+      if (!rawUrl || !rawUrl.startsWith('https://')) {
+        json(res, 400, { error: { code: 'bad-request', message: 'dsh-key-rotation: explicit public https url required in setWebhook.url' } });
+        return;
+      }
       try {
         const hookRes = await fetch(`https://api.telegram.org/bot${botToken}/setWebhook`, {
-          method: 'POST', headers: { 'content-type': 'application/json' },
-          body: JSON.stringify({ url, allowed_updates: ['callback_query'] }),
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({
+            url: rawUrl,
+            secret_token: expected,
+            allowed_updates: ['callback_query'],
+          }),
           signal: AbortSignal.timeout(10000),
         });
         const hookData = await hookRes.json().catch(() => ({}));
-        json(res, 200, { ok: hookRes.ok, url, telegram: hookData });
+        json(res, 200, { ok: hookRes.ok, url: rawUrl, secret_token_set: true, telegram: hookData });
       } catch (e) {
         json(res, 502, { error: { code: 'telegram-failed', message: String(e?.message ?? e) } });
       }
       return;
     }
-    if (!action) { json(res, 400, { error: { code: 'bad-action', message: 'dsh-key-rotation: no action in payload' } }); return; }
+
+    const callbackQueryId = typeof body?.callback_query?.id === 'string'
+      ? body.callback_query.id
+      : (typeof body?.callback_query?.id === 'number' ? String(body.callback_query.id) : '');
+    const botToken = typeof body?.botToken === 'string' ? body.botToken : '';
+
+    const respond = async (statusCode, payload, answerText) => {
+      if (callbackQueryId) {
+        payload.method = 'answerCallbackQuery';
+        payload.callback_query_id = callbackQueryId;
+        payload.text = answerText || payload.error?.message || 'OK';
+        if (botToken) {
+          await bestEffort('telegram-answerCallbackQuery', () => fetch(`https://api.telegram.org/bot${botToken}/answerCallbackQuery`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ callback_query_id: callbackQueryId, text: payload.text }),
+            signal: AbortSignal.timeout(5000),
+          }), ctx?.logger);
+        }
+      }
+      json(res, statusCode, payload);
+    };
+
+    // Accept callback payloads from formatInteractive (Telegram/Discord/Slack) or plain {action}
+    let action = typeof body?.action === 'string' ? body.action : '';
+    if (!action && typeof body?.data === 'string') {
+      try { action = String(JSON.parse(body.data)?.id ?? ''); } catch { action = ''; }
+    }
+    if (!action && typeof body?.callback_data === 'string') {
+      try { action = String(JSON.parse(body.callback_data)?.id ?? ''); } catch { action = ''; }
+    }
+    // #222 / #388: Telegram update envelope {update_id, callback_query:{id, data}}
+    if (!action && typeof body?.callback_query?.data === 'string') {
+      try {
+        const parsed = JSON.parse(body.callback_query.data);
+        action = typeof parsed?.id === 'string' ? parsed.id : String(parsed ?? '');
+      } catch {
+        action = body.callback_query.data;
+      }
+    }
+    if (!action) {
+      await respond(400, { error: { code: 'bad-action', message: 'dsh-key-rotation: no action in payload' } }, 'No action in payload');
+      return;
+    }
     const provider = action.startsWith('pause-') || action.startsWith('reset-') ? action.replace(/^(pause|reset)-/, '') : '';
     try {
       if (action === 'disable-rotation') {
         setRotationDisabled(true);
         (ctx?.logger ? ctx.logger('dsh-key-rotation') : null)?.warn?.('[dsh-key-rotation] rotation DISABLED via webhook action');
-        json(res, 200, { ok: true, action });
+        await respond(200, { ok: true, action }, 'Rotation disabled');
         return;
       }
       if (action === 'enable-rotation') {
         setRotationDisabled(false);
-        json(res, 200, { ok: true, action });
+        await respond(200, { ok: true, action }, 'Rotation enabled');
         return;
       }
       if (action.startsWith('pause-') || action.startsWith('reset-')) {
         const st = poolState.get(provider);
-        if (!st) { json(res, 404, { error: { code: 'not-found', message: `dsh-key-rotation: no pool for '${provider}'` } }); return; }
+        if (!st) {
+          await respond(404, { error: { code: 'not-found', message: `dsh-key-rotation: no pool for '${provider}'` } }, `Pool not found: ${provider}`);
+          return;
+        }
         if (action.startsWith('pause-')) {
           const until = Date.now() + 3600000; // 1h pause
           for (const ref of (st.failedUntil ? [...st.failedUntil.keys()] : [])) st.failedUntil.set(ref, Math.max(st.failedUntil.get(ref) ?? 0, until));
@@ -96,7 +160,7 @@ ctx.effect(() => ctx.webServer.register({
             for (const ref of p.refs) st.failedUntil.set(ref, Math.max(st.failedUntil.get(ref) ?? 0, until));
           }
           (ctx?.logger ? ctx.logger('dsh-key-rotation') : null)?.warn?.(`[dsh-key-rotation] pool ${provider} PAUSED 1h via webhook action`);
-          json(res, 200, { ok: true, action, provider, until: Date.now() + 3600000 });
+          await respond(200, { ok: true, action, provider, until }, `Pool ${provider} paused 1h`);
           return;
         }
         const cleared = st.failedUntil.size;
@@ -114,12 +178,12 @@ ctx.effect(() => ctx.webServer.register({
           else if (typeof br.onSuccess === 'function') { br.onSuccess(provider); circuitReset = true; }
         }
         (ctx?.logger ? ctx.logger('dsh-key-rotation') : null)?.warn?.(`[dsh-key-rotation] pool ${provider} RESET via webhook action (circuitReset=${circuitReset})`);
-        json(res, 200, { ok: true, action, provider, cleared, circuitReset });
+        await respond(200, { ok: true, action, provider, cleared, circuitReset }, `Pool ${provider} reset`);
         return;
       }
-      json(res, 400, { error: { code: 'unknown-action', message: `dsh-key-rotation: unknown action '${action}'` } });
+      await respond(400, { error: { code: 'unknown-action', message: `dsh-key-rotation: unknown action '${action}'` } }, `Unknown action: ${action}`);
     } catch (e) {
-      json(res, 500, { error: { code: 'action-failed', message: String(e?.message ?? e) } });
+      await respond(500, { error: { code: 'action-failed', message: String(e?.message ?? e) } }, 'Action failed');
     }
   },
 }), 'dsh-key-rotation: webhook-action');

package/lib/plugin-updater.js

@@ -1,9 +1,10 @@
 import { spawn } from 'node:child_process'
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readFileSync, rmSync, statSync } from 'node:fs'
 import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { basename, dirname, isAbsolute, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { bestEffort } from './best-effort.js'
 
 /**
  * Host-side one-click updater for a DSH Web plugin.
@@ -60,17 +61,17 @@ function validProfileName(value) {
 }
 
 function profileNameFromArgv(argv) {
-  for (let index = 2; index < argv.length; index += 1) {
-    if (argv[index] === '--profile') return argv[index + 1]
-    if (argv[index]?.startsWith('--profile=')) return argv[index].slice('--profile='.length)
+  for (let index = 0; index < argv.length; index += 1) {
+    const item = argv[index]
+    if (item === '--profile' || item === '-p') return argv[index + 1]
+    if (typeof item === 'string' && item.startsWith('--profile=')) return item.slice('--profile='.length)
   }
-  return argv[2] === 'web' ? 'web' : undefined
+  return undefined
 }
 
 function findDshCliEntry() {
-  const value = process.argv[1]
-  if (value === undefined || value === '') return undefined
-  const entry = value.startsWith('file:') ? fileURLToPath(value) : resolve(process.cwd(), value)
+  const entry = process.argv[1]
+  if (typeof entry !== 'string' || entry === '') return undefined
   if (!existsSync(entry)) return undefined
   for (let directory = dirname(entry); ; directory = dirname(directory)) {
     const manifestPath = resolve(directory, 'package.json')
@@ -187,13 +188,88 @@ export function isValidPackageSpec(packageSpec) {
   return typeof packageSpec === 'string' && PACKAGE_SPEC_PATTERN.test(packageSpec)
 }
 
-async function installExact(target, packageSpec, options) {
+export function readLockPid(lockPath, logger) {
+  try {
+    if (!existsSync(lockPath)) return undefined
+    const stat = statSync(lockPath)
+    if (stat.isDirectory()) return undefined
+    const content = readFileSync(lockPath, 'utf8').trim()
+    if (!content) return undefined
+    const parsed = bestEffort('readLockPid-json', () => JSON.parse(content), logger)
+    if (parsed && typeof parsed.pid === 'number') return parsed.pid
+    const num = parseInt(content, 10)
+    if (!isNaN(num) && num > 0) return num
+    const match = /\b(\d{1,8})\b/.exec(content)
+    if (match) return Number(match[1])
+    return undefined
+  } catch {
+    return undefined
+  }
+}
+
+export function isPidAlive(pid) {
+  if (typeof pid !== 'number' || isNaN(pid) || pid <= 0) return false
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (err) {
+    return err?.code === 'EPERM'
+  }
+}
+
+export function checkAndCleanLock(profileDir, childPid, logger) {
+  const lockPath = resolve(profileDir, 'package.json.lock')
+  if (!existsSync(lockPath)) return { locked: false }
+  const pid = readLockPid(lockPath, logger)
+  if (pid !== undefined) {
+    if (isPidAlive(pid)) {
+      if (childPid !== undefined && pid === childPid) {
+        try {
+          rmSync(lockPath, { recursive: true, force: true })
+          return { locked: false, cleaned: true }
+        } catch {
+          return { locked: true, pid }
+        }
+      }
+      return { locked: true, pid }
+    }
+    // PID is dead, remove stale lock
+    try {
+      rmSync(lockPath, { recursive: true, force: true })
+      return { locked: false, cleaned: true }
+    } catch {
+      return { locked: true, pid }
+    }
+  }
+  // Unknown or empty lockfile format
+  if (childPid !== undefined) {
+    const cleaned = bestEffort('clean-unknown-lock', () => {
+      rmSync(lockPath, { recursive: true, force: true })
+      return true
+    }, logger)
+    if (cleaned) {
+      return { locked: false, cleaned: true }
+    }
+  }
+  return { locked: true }
+}
+
+export async function installExact(target, packageSpec, options = {}) {
   if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.')
   if (!isValidPackageSpec(packageSpec)) throw new Error(`Invalid package spec: ${packageSpec}`)
+  
+  const lockStatus = checkAndCleanLock(target.profileDir)
+  if (lockStatus.locked) {
+    const error = new Error('Another plugin installation is currently in progress.')
+    error.status = 409
+    error.code = 'ELOCKED'
+    throw error
+  }
+
   await new Promise((resolvePromise, reject) => {
     const child = spawn(process.execPath, [
       target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
-      '--config.minimumReleaseAge=0', packageSpec,
+      packageSpec,
       `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
     ], {
       cwd: target.profileDir,
@@ -204,13 +280,24 @@ async function installExact(target, packageSpec, options) {
     let detail = ''
     child.stdout?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000) })
     child.stderr?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000) })
+    let timedOut = false
+    const timeoutMs = options.timeoutMs ?? UPDATE_TIMEOUT_MS
     const timer = setTimeout(() => {
-      child.kill()
+      timedOut = true
+      bestEffort('timeout-sigterm', () => child.kill('SIGTERM'), options.logger)
+      setTimeout(() => {
+        bestEffort('timeout-sigkill', () => child.kill('SIGKILL'), options.logger)
+        checkAndCleanLock(target.profileDir, child.pid, options.logger)
+      }, 500).unref?.()
       reject(new Error('Update timed out; use the normal DSH update flow.'))
-    }, UPDATE_TIMEOUT_MS)
+    }, timeoutMs)
     child.once('error', error => { clearTimeout(timer); reject(error) })
-    child.once('exit', code => {
+    child.once('exit', (code, signal) => {
       clearTimeout(timer)
+      if (timedOut) {
+        checkAndCleanLock(target.profileDir, child.pid)
+        return
+      }
       if (code === 0) resolvePromise()
       else reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`))
     })
@@ -255,6 +342,11 @@ export function registerPluginUpdater(ctx, options) {
           json(response, 409, { error: 'This plugin is already updating.' })
           return
         }
+        const profileLock = checkAndCleanLock(target.profileDir)
+        if (profileLock.locked) {
+          json(response, 409, { error: 'Another plugin installation is currently in progress in this profile.' })
+          return
+        }
         installing = true
         try {
           const before = await status(options, target)
@@ -276,6 +368,10 @@ export function registerPluginUpdater(ctx, options) {
           installing = false
         }
       } catch (error) {
+        if (error?.status === 409 || error?.code === 'ELOCKED') {
+          json(response, 409, { error: error.message || 'Another plugin installation is currently in progress.' })
+          return
+        }
         ctx.logger?.warn?.(`plugin updater failed: ${String(error)}`)
         json(response, 503, { error: 'Plugin update failed; see server logs.' })
       }

package/lib/quota-window.js

@@ -1,9 +1,10 @@
+import { nowWall } from './clock.js';
 // quota-window.js — calendar-based quota reset windows (issue #197).
 
 export const QUOTA_WINDOW_TYPES = ['midnight_utc', 'midnight_pst', 'rolling_24h'];
 
 export function nextQuotaReset(quotaResetWindow, now) {
-  now = now || Date.now();
+  now = now || nowWall();
   const win = typeof quotaResetWindow === 'string' ? { type: quotaResetWindow === 'daily' ? 'midnight_utc' : quotaResetWindow } : quotaResetWindow;
   if (!win || typeof win !== 'object') return null;
   const type = win.type === 'daily' ? 'midnight_utc' : win.type;
@@ -39,7 +40,7 @@ export function poolResetAt(pool, quotaResetWindow, now) {
 }
 
 export function isBlockedUntilReset(failedUntil, resetAt, now) {
-  now = now || Date.now();
+  now = now || nowWall();
   if (!Number.isFinite(failedUntil)) return false;
   if (resetAt === null || resetAt === undefined) return false;
   return failedUntil >= resetAt;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.32",
+  "version": "0.8.34",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [