@goodandready/dsh-key-rotation 0.8.33 → 0.8.34

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to `@goodandready/dsh-key-rotation` are documented here.
 User-facing feature notes also appear in README (en is source of truth).
 
+## 0.8.34 - 2026-09-28
+
+### Security & Hardening
+- **Credentials Encryption at Rest on PUT (#395)**:
+  - Wired `encryptSecret` in `lib/ops-keys.js` (`PUT /dsh-key-rotation/key`).
+  - When `DSH_KEY_SECRET` is set in the environment, new keys are automatically encrypted at rest via AES-256-GCM (`enc:v1:...`).
+  - Key tail calculation and leak shape analysis continue to operate on raw values for uninterrupted UI diagnostics.
+  - Added dedicated integration test suite `test/crypto-storage-keys.test.mjs`.
+
+### Refactored & Tech-Debt
+- **Preflight Cleanliness & Safe Diagnostics (#393)**:
+  - Eliminated 5 empty `catch {}` blocks across `lib/plugin-updater.js` and `lib/ops-webhook.js`.
+  - Replaced unhandled exceptions with `bestEffort(label, fn, logger)` utilizing structured debug logging to `ctx?.logger`.
+  - Resolved preflight check blocker (`FAIL=0`).
+- **Dead Export Wiring & Core Cohesion (#394)**:
+  - Reused `scanForLiveSecrets` in `lib/http-bridge.js` to parse patch ops arrays directly in `handleConfigBridge`.
+  - Connected `filterQuotaEligible` to `anyModelQuotaAvailable` in `lib/model-quota.js`.
+  - Integrated `nowWall()` in `lib/quota-window.js` for default calendar reset calculations.
+
 ## 0.8.33 - 2026-09-28
 
 ### Fixed & Hardened

package/lib/http-bridge.js

@@ -170,9 +170,14 @@ export function providerCatalog(ctx, cloneIds) {
 
 
 export function scanForLiveSecrets(section) {
+  if (Array.isArray(section)) {
+    return findSecrets(JSON.stringify(section.filter(op => !['webhookActionToken', 'notifyWebhook'].includes(op?.path?.[0]))));
+  }
   const masked = structuredClone(section);
-  if (masked.webhookActionToken) masked.webhookActionToken = '***';
-  if (masked.notifyWebhook) masked.notifyWebhook = '***';
+  if (masked && typeof masked === 'object') {
+    if (masked.webhookActionToken) masked.webhookActionToken = '***';
+    if (masked.notifyWebhook) masked.notifyWebhook = '***';
+  }
   return findSecrets(JSON.stringify(masked));
 }
 
@@ -230,7 +235,7 @@ export async function handleConfigBridge(ctx, request, res, getCloneIds) {
         return;
       }
       try {
-        const findings = findSecrets(JSON.stringify(section.filter(op => !['webhookActionToken', 'notifyWebhook'].includes(op.path[0]))));
+        const findings = scanForLiveSecrets(section);
         if (findings.length > 0) {
           json(res, 400, {
             error: {

package/lib/model-quota.js

@@ -187,11 +187,7 @@ export function isModelQuotaAvailable(pool, ref, now) {
 
 /** True when at least one ref of `pool` still has local quota left. */
 export function anyModelQuotaAvailable(pool, now) {
-  const refs = pool?.refs ?? [];
-  for (const ref of refs) {
-    if (isModelQuotaAvailable(pool, ref, now)) return true;
-  }
-  return false;
+  return filterQuotaEligible(pool, pool?.refs ?? [], now).length > 0;
 }
 
 /**

package/lib/ops-keys.js

@@ -1,4 +1,4 @@
-import { decryptSecret } from './crypto-storage.js';
+import { decryptSecret, encryptSecret } from './crypto-storage.js';
 // lib/ops-keys.js — key store + cooldown reset + import routes (#312 split from routes-ops.js).
 import {
   json,
@@ -89,7 +89,8 @@ ctx.effect(() => ctx.webServer.register({
         json(res, 400, { error: { code: 'empty-value', message: 'dsh-key-rotation: an empty key cannot be stored' } });
         return;
       }
-      await credentialsService.set(ref, value);
+      const storedValue = encryptSecret(value);
+      await credentialsService.set(ref, storedValue);
       // #200: leak-detector hint - stored value should look like a credential
       const secretShape = looksLikeApiSecret(value);
       json(res, 200, { ok: true, ref, tail: keyTail(value), looksLikeSecret: secretShape });

package/lib/ops-webhook.js

@@ -4,6 +4,7 @@ import {
   json,
   readJson,
 } from './http-bridge.js';
+import { bestEffort } from './best-effort.js';
 import { WEBHOOK_ACTION_PATH } from './ops-paths.js';
 
 function constantTimeEqual(a, b) {
@@ -99,14 +100,12 @@ ctx.effect(() => ctx.webServer.register({
         payload.callback_query_id = callbackQueryId;
         payload.text = answerText || payload.error?.message || 'OK';
         if (botToken) {
-          try {
-            await fetch(`https://api.telegram.org/bot${botToken}/answerCallbackQuery`, {
-              method: 'POST',
-              headers: { 'content-type': 'application/json' },
-              body: JSON.stringify({ callback_query_id: callbackQueryId, text: payload.text }),
-              signal: AbortSignal.timeout(5000),
-            });
-          } catch {}
+          await bestEffort('telegram-answerCallbackQuery', () => fetch(`https://api.telegram.org/bot${botToken}/answerCallbackQuery`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ callback_query_id: callbackQueryId, text: payload.text }),
+            signal: AbortSignal.timeout(5000),
+          }), ctx?.logger);
         }
       }
       json(res, statusCode, payload);

package/lib/plugin-updater.js

@@ -4,6 +4,7 @@ import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { basename, dirname, isAbsolute, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { bestEffort } from './best-effort.js'
 
 /**
  * Host-side one-click updater for a DSH Web plugin.
@@ -187,17 +188,15 @@ export function isValidPackageSpec(packageSpec) {
   return typeof packageSpec === 'string' && PACKAGE_SPEC_PATTERN.test(packageSpec)
 }
 
-export function readLockPid(lockPath) {
+export function readLockPid(lockPath, logger) {
   try {
     if (!existsSync(lockPath)) return undefined
     const stat = statSync(lockPath)
     if (stat.isDirectory()) return undefined
     const content = readFileSync(lockPath, 'utf8').trim()
     if (!content) return undefined
-    try {
-      const parsed = JSON.parse(content)
-      if (parsed && typeof parsed.pid === 'number') return parsed.pid
-    } catch {}
+    const parsed = bestEffort('readLockPid-json', () => JSON.parse(content), logger)
+    if (parsed && typeof parsed.pid === 'number') return parsed.pid
     const num = parseInt(content, 10)
     if (!isNaN(num) && num > 0) return num
     const match = /\b(\d{1,8})\b/.exec(content)
@@ -218,10 +217,10 @@ export function isPidAlive(pid) {
   }
 }
 
-export function checkAndCleanLock(profileDir, childPid) {
+export function checkAndCleanLock(profileDir, childPid, logger) {
   const lockPath = resolve(profileDir, 'package.json.lock')
   if (!existsSync(lockPath)) return { locked: false }
-  const pid = readLockPid(lockPath)
+  const pid = readLockPid(lockPath, logger)
   if (pid !== undefined) {
     if (isPidAlive(pid)) {
       if (childPid !== undefined && pid === childPid) {
@@ -244,10 +243,13 @@ export function checkAndCleanLock(profileDir, childPid) {
   }
   // Unknown or empty lockfile format
   if (childPid !== undefined) {
-    try {
+    const cleaned = bestEffort('clean-unknown-lock', () => {
       rmSync(lockPath, { recursive: true, force: true })
+      return true
+    }, logger)
+    if (cleaned) {
       return { locked: false, cleaned: true }
-    } catch {}
+    }
   }
   return { locked: true }
 }
@@ -282,10 +284,10 @@ export async function installExact(target, packageSpec, options = {}) {
     const timeoutMs = options.timeoutMs ?? UPDATE_TIMEOUT_MS
     const timer = setTimeout(() => {
       timedOut = true
-      try { child.kill('SIGTERM') } catch {}
+      bestEffort('timeout-sigterm', () => child.kill('SIGTERM'), options.logger)
       setTimeout(() => {
-        try { child.kill('SIGKILL') } catch {}
-        checkAndCleanLock(target.profileDir, child.pid)
+        bestEffort('timeout-sigkill', () => child.kill('SIGKILL'), options.logger)
+        checkAndCleanLock(target.profileDir, child.pid, options.logger)
       }, 500).unref?.()
       reject(new Error('Update timed out; use the normal DSH update flow.'))
     }, timeoutMs)

package/lib/quota-window.js

@@ -1,9 +1,10 @@
+import { nowWall } from './clock.js';
 // quota-window.js — calendar-based quota reset windows (issue #197).
 
 export const QUOTA_WINDOW_TYPES = ['midnight_utc', 'midnight_pst', 'rolling_24h'];
 
 export function nextQuotaReset(quotaResetWindow, now) {
-  now = now || Date.now();
+  now = now || nowWall();
   const win = typeof quotaResetWindow === 'string' ? { type: quotaResetWindow === 'daily' ? 'midnight_utc' : quotaResetWindow } : quotaResetWindow;
   if (!win || typeof win !== 'object') return null;
   const type = win.type === 'daily' ? 'midnight_utc' : win.type;
@@ -39,7 +40,7 @@ export function poolResetAt(pool, quotaResetWindow, now) {
 }
 
 export function isBlockedUntilReset(failedUntil, resetAt, now) {
-  now = now || Date.now();
+  now = now || nowWall();
   if (!Number.isFinite(failedUntil)) return false;
   if (resetAt === null || resetAt === undefined) return false;
   return failedUntil >= resetAt;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.33",
+  "version": "0.8.34",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [