@goodandready/dsh-key-rotation 0.8.33 → 0.8.35

package/CHANGELOG.md

@@ -3,6 +3,44 @@
 All notable changes to `@goodandready/dsh-key-rotation` are documented here.
 User-facing feature notes also appear in README (en is source of truth).
 
+## 0.8.35 - 2026-09-28
+
+### Refactored & Architecture
+- **Frontend Modularization (`lib/client-src/`) (#399, PR #400)**:
+  - Decomposed monolithic `lib/client.js` (~152 KiB, 2,691 lines) into 8 clean, domain-focused fragments under `lib/client-src/`:
+    - `00-header.js`: Module loader entry, requires, scoped CSS injection.
+    - `10-locales.js`: English (`en`) and Chinese (`zh`) translation dictionaries, error boundary, and helper constants.
+    - `20-hooks.js`: `useRotationStatus` and `useProbeCache` smart hooks.
+    - `30-utils.js`: Formatting utilities, CSS stylesheet, and dynamic locale resolver.
+    - `40-components.js`: Micro-components, JSON diff/patch operators, quota utilities, and pool validation.
+    - `50-card-main.js`: `KeyRotationSection` main settings surface and live telemetry controls.
+    - `60-header-chip.js`: `KeyRotationHeaderChip` session header status widget.
+    - `90-apply.js`: Plugin apply lifecycle, slot registrations, and internals exposure.
+  - Added deterministic zero-dependency Node build script `scripts/build-client.mjs` matching sister plugin standards (`dsh-cron`).
+  - Integrated `build:client` and `pretest` lifecycle triggers into `package.json`.
+  - Excluded `lib/client-src/` from distributed npm package tarballs via `files: ["lib/*.js", ...]`.
+  - Fixed misplaced updater translation keys, moving them cleanly inside `en` and `zh` dictionaries.
+  - Added automated CI regression test `test/build-client.test.mjs`.
+
+## 0.8.34 - 2026-09-28
+
+### Security & Hardening
+- **Credentials Encryption at Rest on PUT (#395)**:
+  - Wired `encryptSecret` in `lib/ops-keys.js` (`PUT /dsh-key-rotation/key`).
+  - When `DSH_KEY_SECRET` is set in the environment, new keys are automatically encrypted at rest via AES-256-GCM (`enc:v1:...`).
+  - Key tail calculation and leak shape analysis continue to operate on raw values for uninterrupted UI diagnostics.
+  - Added dedicated integration test suite `test/crypto-storage-keys.test.mjs`.
+
+### Refactored & Tech-Debt
+- **Preflight Cleanliness & Safe Diagnostics (#393)**:
+  - Eliminated 5 empty `catch {}` blocks across `lib/plugin-updater.js` and `lib/ops-webhook.js`.
+  - Replaced unhandled exceptions with `bestEffort(label, fn, logger)` utilizing structured debug logging to `ctx?.logger`.
+  - Resolved preflight check blocker (`FAIL=0`).
+- **Dead Export Wiring & Core Cohesion (#394)**:
+  - Reused `scanForLiveSecrets` in `lib/http-bridge.js` to parse patch ops arrays directly in `handleConfigBridge`.
+  - Connected `filterQuotaEligible` to `anyModelQuotaAvailable` in `lib/model-quota.js`.
+  - Integrated `nowWall()` in `lib/quota-window.js` for default calendar reset calculations.
+
 ## 0.8.33 - 2026-09-28
 
 ### Fixed & Hardened

package/lib/client.js

@@ -209,9 +209,17 @@ window.__ModuleLoader__.load({
       proactiveGuardHint: 'Pre-emptively pause keys when remaining quota or Retry-After header indicates limit before hitting 429',
       selfHealingLabel: 'Auto-Unbreak Interval (min)',
       selfHealingHint: 'Periodic free model check to revive broken keys (0 to disable)',
+      updateCheck: 'Check for updates',
+      updateAvailable: 'Update available',
+      updateNone: 'Plugin is up to date',
+      updateRun: 'Update now',
+      updateRestart: 'Update installed. Restart DSH to load the new version.',
+      updateRunning: 'Updating…',
+      updateFailed: 'Update failed',
+      currentVersion: 'Current version',
+      latestVersion: 'Latest version',
     };
 
-    
     const zh = {
       title: '密钥轮换',
       'header.title': '密钥轮换与故障转移',
@@ -382,6 +390,15 @@ window.__ModuleLoader__.load({
       proactiveGuardHint: '当响应中的剩余配额或 Retry-After 头提示即将超限时，预先冷却密钥以防触发 429',
       selfHealingLabel: '自愈检查间隔 (分钟)',
       selfHealingHint: '定期轻量探测以自动恢复损坏密钥 (0 为禁用)',
+      updateCheck: '检查更新',
+      updateAvailable: '有可用更新',
+      updateNone: '插件已是最新版本',
+      updateRun: '立即更新',
+      updateRestart: '更新已安装。请重启 DSH 以加载新版本。',
+      updateRunning: '更新中…',
+      updateFailed: '更新失败',
+      currentVersion: '当前版本',
+      latestVersion: '最新版本',
     };
 
     // Codes worth switching on. Host list is DEFAULT_SWITCH_CODES; config may
@@ -2668,24 +2685,4 @@ window.__ModuleLoader__.load({
     }
     return module.exports;
   },
-    updateCheck: 'Check for updates',
-    updateAvailable: 'Update available',
-    updateNone: 'Plugin is up to date',
-    updateRun: 'Update now',
-    updateRestart: 'Update installed. Restart DSH to load the new version.',
-    updateRunning: 'Updating…',
-    updateFailed: 'Update failed',
-    currentVersion: 'Current version',
-    latestVersion: 'Latest version',
-
-    updateCheck: '检查更新',
-    updateAvailable: '有可用更新',
-    updateNone: '插件已是最新版本',
-    updateRun: '立即更新',
-    updateRestart: '更新已安装。请重启 DSH 以加载新版本。',
-    updateRunning: '更新中…',
-    updateFailed: '更新失败',
-    currentVersion: '当前版本',
-    latestVersion: '最新版本',
-
 });

package/lib/http-bridge.js

@@ -170,9 +170,14 @@ export function providerCatalog(ctx, cloneIds) {
 
 
 export function scanForLiveSecrets(section) {
+  if (Array.isArray(section)) {
+    return findSecrets(JSON.stringify(section.filter(op => !['webhookActionToken', 'notifyWebhook'].includes(op?.path?.[0]))));
+  }
   const masked = structuredClone(section);
-  if (masked.webhookActionToken) masked.webhookActionToken = '***';
-  if (masked.notifyWebhook) masked.notifyWebhook = '***';
+  if (masked && typeof masked === 'object') {
+    if (masked.webhookActionToken) masked.webhookActionToken = '***';
+    if (masked.notifyWebhook) masked.notifyWebhook = '***';
+  }
   return findSecrets(JSON.stringify(masked));
 }
 
@@ -230,7 +235,7 @@ export async function handleConfigBridge(ctx, request, res, getCloneIds) {
         return;
       }
       try {
-        const findings = findSecrets(JSON.stringify(section.filter(op => !['webhookActionToken', 'notifyWebhook'].includes(op.path[0]))));
+        const findings = scanForLiveSecrets(section);
         if (findings.length > 0) {
           json(res, 400, {
             error: {

package/lib/model-quota.js

@@ -187,11 +187,7 @@ export function isModelQuotaAvailable(pool, ref, now) {
 
 /** True when at least one ref of `pool` still has local quota left. */
 export function anyModelQuotaAvailable(pool, now) {
-  const refs = pool?.refs ?? [];
-  for (const ref of refs) {
-    if (isModelQuotaAvailable(pool, ref, now)) return true;
-  }
-  return false;
+  return filterQuotaEligible(pool, pool?.refs ?? [], now).length > 0;
 }
 
 /**

package/lib/ops-keys.js

@@ -1,4 +1,4 @@
-import { decryptSecret } from './crypto-storage.js';
+import { decryptSecret, encryptSecret } from './crypto-storage.js';
 // lib/ops-keys.js — key store + cooldown reset + import routes (#312 split from routes-ops.js).
 import {
   json,
@@ -89,7 +89,8 @@ ctx.effect(() => ctx.webServer.register({
         json(res, 400, { error: { code: 'empty-value', message: 'dsh-key-rotation: an empty key cannot be stored' } });
         return;
       }
-      await credentialsService.set(ref, value);
+      const storedValue = encryptSecret(value);
+      await credentialsService.set(ref, storedValue);
       // #200: leak-detector hint - stored value should look like a credential
       const secretShape = looksLikeApiSecret(value);
       json(res, 200, { ok: true, ref, tail: keyTail(value), looksLikeSecret: secretShape });

package/lib/ops-webhook.js

@@ -4,6 +4,7 @@ import {
   json,
   readJson,
 } from './http-bridge.js';
+import { bestEffort } from './best-effort.js';
 import { WEBHOOK_ACTION_PATH } from './ops-paths.js';
 
 function constantTimeEqual(a, b) {
@@ -99,14 +100,12 @@ ctx.effect(() => ctx.webServer.register({
         payload.callback_query_id = callbackQueryId;
         payload.text = answerText || payload.error?.message || 'OK';
         if (botToken) {
-          try {
-            await fetch(`https://api.telegram.org/bot${botToken}/answerCallbackQuery`, {
-              method: 'POST',
-              headers: { 'content-type': 'application/json' },
-              body: JSON.stringify({ callback_query_id: callbackQueryId, text: payload.text }),
-              signal: AbortSignal.timeout(5000),
-            });
-          } catch {}
+          await bestEffort('telegram-answerCallbackQuery', () => fetch(`https://api.telegram.org/bot${botToken}/answerCallbackQuery`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ callback_query_id: callbackQueryId, text: payload.text }),
+            signal: AbortSignal.timeout(5000),
+          }), ctx?.logger);
         }
       }
       json(res, statusCode, payload);

package/lib/plugin-updater.js

@@ -4,6 +4,7 @@ import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { basename, dirname, isAbsolute, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { bestEffort } from './best-effort.js'
 
 /**
  * Host-side one-click updater for a DSH Web plugin.
@@ -187,17 +188,15 @@ export function isValidPackageSpec(packageSpec) {
   return typeof packageSpec === 'string' && PACKAGE_SPEC_PATTERN.test(packageSpec)
 }
 
-export function readLockPid(lockPath) {
+export function readLockPid(lockPath, logger) {
   try {
     if (!existsSync(lockPath)) return undefined
     const stat = statSync(lockPath)
     if (stat.isDirectory()) return undefined
     const content = readFileSync(lockPath, 'utf8').trim()
     if (!content) return undefined
-    try {
-      const parsed = JSON.parse(content)
-      if (parsed && typeof parsed.pid === 'number') return parsed.pid
-    } catch {}
+    const parsed = bestEffort('readLockPid-json', () => JSON.parse(content), logger)
+    if (parsed && typeof parsed.pid === 'number') return parsed.pid
     const num = parseInt(content, 10)
     if (!isNaN(num) && num > 0) return num
     const match = /\b(\d{1,8})\b/.exec(content)
@@ -218,10 +217,10 @@ export function isPidAlive(pid) {
   }
 }
 
-export function checkAndCleanLock(profileDir, childPid) {
+export function checkAndCleanLock(profileDir, childPid, logger) {
   const lockPath = resolve(profileDir, 'package.json.lock')
   if (!existsSync(lockPath)) return { locked: false }
-  const pid = readLockPid(lockPath)
+  const pid = readLockPid(lockPath, logger)
   if (pid !== undefined) {
     if (isPidAlive(pid)) {
       if (childPid !== undefined && pid === childPid) {
@@ -244,10 +243,13 @@ export function checkAndCleanLock(profileDir, childPid) {
   }
   // Unknown or empty lockfile format
   if (childPid !== undefined) {
-    try {
+    const cleaned = bestEffort('clean-unknown-lock', () => {
       rmSync(lockPath, { recursive: true, force: true })
+      return true
+    }, logger)
+    if (cleaned) {
       return { locked: false, cleaned: true }
-    } catch {}
+    }
   }
   return { locked: true }
 }
@@ -282,10 +284,10 @@ export async function installExact(target, packageSpec, options = {}) {
     const timeoutMs = options.timeoutMs ?? UPDATE_TIMEOUT_MS
     const timer = setTimeout(() => {
       timedOut = true
-      try { child.kill('SIGTERM') } catch {}
+      bestEffort('timeout-sigterm', () => child.kill('SIGTERM'), options.logger)
       setTimeout(() => {
-        try { child.kill('SIGKILL') } catch {}
-        checkAndCleanLock(target.profileDir, child.pid)
+        bestEffort('timeout-sigkill', () => child.kill('SIGKILL'), options.logger)
+        checkAndCleanLock(target.profileDir, child.pid, options.logger)
       }, 500).unref?.()
       reject(new Error('Update timed out; use the normal DSH update flow.'))
     }, timeoutMs)

package/lib/quota-window.js

@@ -1,9 +1,10 @@
+import { nowWall } from './clock.js';
 // quota-window.js — calendar-based quota reset windows (issue #197).
 
 export const QUOTA_WINDOW_TYPES = ['midnight_utc', 'midnight_pst', 'rolling_24h'];
 
 export function nextQuotaReset(quotaResetWindow, now) {
-  now = now || Date.now();
+  now = now || nowWall();
   const win = typeof quotaResetWindow === 'string' ? { type: quotaResetWindow === 'daily' ? 'midnight_utc' : quotaResetWindow } : quotaResetWindow;
   if (!win || typeof win !== 'object') return null;
   const type = win.type === 'daily' ? 'midnight_utc' : win.type;
@@ -39,7 +40,7 @@ export function poolResetAt(pool, quotaResetWindow, now) {
 }
 
 export function isBlockedUntilReset(failedUntil, resetAt, now) {
-  now = now || Date.now();
+  now = now || nowWall();
   if (!Number.isFinite(failedUntil)) return false;
   if (resetAt === null || resetAt === undefined) return false;
   return failedUntil >= resetAt;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.33",
+  "version": "0.8.35",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [
@@ -30,7 +30,7 @@
     "./cordis.patch.yml": "./cordis.patch.yml"
   },
   "files": [
-    "lib",
+    "lib/*.js",
     "cordis.patch.yml",
     "README.md",
     "README.zh.md",
@@ -63,7 +63,9 @@
   "scripts": {
     "test": "node tools/test.mjs",
     "test:core": "node tools/test.mjs --core",
-    "check": "node tools/check.mjs"
+    "check": "node tools/check.mjs",
+    "build:client": "node scripts/build-client.mjs",
+    "pretest": "node scripts/build-client.mjs"
   },
   "devDependencies": {
     "react": "18.3.1",