@goodandready/dsh-key-rotation 0.8.44 → 0.8.46

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.8.46 - 2026-10-02
+
+### Fixed
+- **Telegram Inline Callback Wire Limit & Receiver Resolution (#419)**: Ensure serialized `callback_data` on the wire strictly conforms to Telegram API's 64-byte limit (`Buffer.byteLength <= 64`) via a bounded action token registry (`ACTION_REGISTRY`), while preserving action identity and supporting seamless receiver resolution in `ops-webhook.js`.
+- **Alert Debouncer Batching with Serial Queue (#428)**: Enable `NotifyQueue` to admit successive burst notifications into `AlertDebouncer` pending batches without waiting for debounce timer flush, restoring alert digest batching (`incidentCount: 3`, `digest: true`) while preserving queue backpressure and delivery outcome accounting.
+- **Documentation System Service Command (#425)**: Correct systemd command in `docs/deployment/github-npm-provenance.md` to `systemctl --user is-active dsh-test-web.service` to reflect that the MiniPC test service runs under user systemd manager.
+
+## 0.8.45 - 2026-10-01
+
+### Fixed
+- **Background Auto-Unbreak Decryption Check (#415)**: Skip auto-unbreak model probes and keep quarantine active when stored credentials cannot be decrypted due to missing or invalid `DSH_KEY_SECRET`.
+- **Telegram Inline Callback Byte-Limit & UTF-8 Roundtrip (#419)**: Ensure all inline button callbacks strictly fit within Telegram API's 64-byte limit while preserving action ID and JSON roundtrip on long or multibyte identifiers.
+- **DSH Core Integration Fixture & Matrix (#424)**: Eliminate temporary project copying (`cpSync`) from `test/support/real-core.mjs` by importing `lib/index.js` directly from the worktree; expand CI test matrix in `.github/workflows/tests.yml` to include DSH `0.1.7-rc.2` and `0.2.0-rc.1`.
+- **Release Documentation Process & Environment Alignment (#425)**: Update `docs/deployment/github-npm-provenance.md` with the accurate MiniPC acceptance environment (`/home/vadim/.dsh-test`, profile `web`, `dsh-test-web.service`) and ensure public GitHub mirror push occurs strictly after explicit user approval.
+- **NotifyQueue Bounded Capacity & Serial Backoff Concurrency (#435)**: Restore serial queue pumping with `setImmediate` deferral, correctly bounding in-flight and pending webhook deliveries to `maxDepth` under high-burst traffic.
+
 ## 0.8.44 - 2026-10-01
 
 ### Fixed

package/lib/lifecycle.js

@@ -48,8 +48,15 @@ export function setupAutoUnbreakEffect(ctx, getConfig, buildRuntime, ensureSandb
           const hit = await resolve?.call(credentials, ref);
           const raw = typeof hit?.value === 'string' && hit.value.length > 0
             ? hit.value : envValue(ref);
+          if (typeof raw === 'string' && raw.startsWith('enc:v1:')) {
+            const decrypted = decryptSecret(raw);
+            if (!decrypted || decrypted === raw || decrypted.startsWith('enc:v1:')) {
+              logger?.warn?.(`[dsh-key-rotation] auto-unbreak: key ${ref} cannot be decrypted (missing or invalid DSH_KEY_SECRET); skipping unbreak probe`);
+              return { ok: false };
+            }
+          }
           const value = raw ? decryptSecret(raw) : raw;
-          if (!value || !isActive()) return { ok: false };
+          if (!value || typeof value !== 'string' || value.startsWith('enc:v1:') || !isActive()) return { ok: false };
           return runner.probeModels(ref, value);
         }, Date.now(), { isActive });
       } catch (e) { logger?.warn?.('[dsh-key-rotation] auto-unbreak failed', e); }

package/lib/notify-queue.js

@@ -6,13 +6,14 @@ export class NotifyQueue {
    * @param {{ send: (url:string, payload:object)=>Promise<any>, maxDepth?: number, baseBackoffMs?: number, maxBackoffMs?: number }} opts
    */
   constructor({ send, maxDepth = 50, baseBackoffMs = 2000, maxBackoffMs = 60000 } = {}) {
-    if (typeof send !== 'function') throw new Error('NotifyQueue: send required');
+    if (typeof send !== "function") throw new Error("NotifyQueue: send required");
     this._send = send;
     this.maxDepth = maxDepth;
     this.baseBackoffMs = baseBackoffMs;
     this.maxBackoffMs = maxBackoffMs;
     this._q = [];
     this._busy = false;
+    this._activeSends = 0;
     this._backoffByUrl = new Map();
     this._dropped = 0;
     this._sent = 0;
@@ -20,10 +21,10 @@ export class NotifyQueue {
   }
 
   enqueue(url, payload) {
-    if (!url) return { queued: false, reason: 'no-url' };
+    if (!url) return { queued: false, reason: "no-url" };
     if (this._q.length >= this.maxDepth) {
       this._dropped += 1;
-      return { queued: false, reason: 'full', dropped: this._dropped };
+      return { queued: false, reason: "full", dropped: this._dropped };
     }
     this._q.push({ url, payload });
     this._pump();
@@ -31,44 +32,55 @@ export class NotifyQueue {
   }
 
   _pump() {
-    while (this._q.length > 0) {
-      const delay = this._backoffByUrl.get(this._q[0].url) ?? 0;
-      if (delay > 0 && this._busy) break;
-      const job = this._q.shift();
-      if (!job) break;
-      this._activeSends = (this._activeSends || 0) + 1;
-      this._busy = true;
-      const run = async () => {
-        try {
-          const res = await this._send(job.url, job.payload);
-          if (res && res.sent === false) {
-            this._failed += 1;
-            this._bumpBackoff(job.url);
-          } else if (res && res.sent === true) {
-            this._sent += 1;
-            this._backoffByUrl.delete(job.url);
-          } else if (res === undefined) {
-            this._sent += 1;
-            this._backoffByUrl.delete(job.url);
-          } else {
-            this._sent += 1;
-            this._backoffByUrl.delete(job.url);
+    if (this._busy || this._activeSends > 0 || this._q.length === 0) return;
+    const job = this._q.shift();
+    if (!job) return;
+    this._busy = true;
+    this._activeSends = 1;
+    const delay = this._backoffByUrl.get(job.url) ?? 0;
+    const run = async () => {
+      let sendPromise;
+      try {
+        sendPromise = this._send(job.url, job.payload);
+        if (sendPromise && sendPromise.debounced) {
+          this._busy = false;
+          this._activeSends = 0;
+          if (this._q.length > 0) {
+            setImmediate(() => this._pump());
           }
-        } catch {
+        }
+        const res = await sendPromise;
+        if (res && res.sent === false) {
           this._failed += 1;
           this._bumpBackoff(job.url);
-        } finally {
-          this._activeSends = Math.max(0, this._activeSends - 1);
-          this._busy = this._activeSends > 0;
-          if (this._q.length > 0) this._pump();
+        } else if (res && res.sent === true) {
+          this._sent += 1;
+          this._backoffByUrl.delete(job.url);
+        } else if (res === undefined) {
+          this._sent += 1;
+          this._backoffByUrl.delete(job.url);
+        } else {
+          this._sent += 1;
+          this._backoffByUrl.delete(job.url);
+        }
+      } catch {
+        this._failed += 1;
+        this._bumpBackoff(job.url);
+      } finally {
+        if (!sendPromise || !sendPromise.debounced) {
+          this._busy = false;
+          this._activeSends = 0;
+          if (this._q.length > 0) {
+            setImmediate(() => this._pump());
+          }
         }
-      };
-      if (delay > 0) {
-        const t = setTimeout(run, delay);
-        if (typeof t.unref === 'function') t.unref();
-      } else {
-        run();
       }
+    };
+    if (delay > 0) {
+      const t = setTimeout(run, delay);
+      if (typeof t.unref === "function") t.unref();
+    } else {
+      run();
     }
   }
 

package/lib/ops-webhook.js

@@ -6,6 +6,7 @@ import {
 } from './http-bridge.js';
 import { bestEffort } from './best-effort.js';
 import { WEBHOOK_ACTION_PATH } from './ops-paths.js';
+import { resolveAction } from './webhook.js';
 
 function constantTimeEqual(a, b) {
   if (typeof a !== 'string' || typeof b !== 'string') return false;
@@ -128,6 +129,7 @@ ctx.effect(() => ctx.webServer.register({
         action = body.callback_query.data;
       }
     }
+    action = resolveAction(action);
     if (!action) {
       await respond(400, { error: { code: 'bad-action', message: 'dsh-key-rotation: no action in payload' } }, 'No action in payload');
       return;

package/lib/webhook.js

@@ -1,4 +1,24 @@
+import crypto from 'node:crypto';
 import { bestEffort } from './best-effort.js';
+
+export const ACTION_REGISTRY = new Map();
+const MAX_ACTIONS = 1000;
+
+export function registerAction(id) {
+  if (typeof id !== 'string') return id;
+  const token = 'a:' + crypto.createHash('sha256').update(id).digest('hex').slice(0, 16);
+  ACTION_REGISTRY.set(token, id);
+  if (ACTION_REGISTRY.size > MAX_ACTIONS) {
+    const first = ACTION_REGISTRY.keys().next().value;
+    ACTION_REGISTRY.delete(first);
+  }
+  return token;
+}
+
+export function resolveAction(token) {
+  if (typeof token !== 'string') return token;
+  return ACTION_REGISTRY.get(token) ?? token;
+}
 // lib/webhook.js — webhook sender with throttle, interactive actions + alert digest debouncer (#199, #10).
 const WEBHOOK_TIMEOUT_MS = 5000;
 const WEBHOOK_MIN_INTERVAL_MS = 1000;
@@ -32,17 +52,18 @@ export function formatInteractive(url, payload, actionToken) {
       parse_mode: 'Markdown',
       reply_markup: {
         inline_keyboard: [actions.map((a) => {
-          let cbData = JSON.stringify({ id: a.id });
-          if (cbData.length > 64) {
-            cbData = String(a.id ?? '');
-          }
-          if (Buffer.byteLength(cbData, 'utf8') > 64 && /[^\x00-\x7F]/.test(cbData)) {
-            const buf = Buffer.from(cbData, 'utf8');
-            let res = buf.subarray(0, 64).toString('utf8');
-            while (Buffer.byteLength(res, 'utf8') > 64) {
-              res = res.slice(0, -1);
-            }
-            cbData = res;
+          const json = JSON.stringify({ id: a.id });
+          let cbData;
+          if (Buffer.byteLength(json, "utf8") <= 64) {
+            cbData = json;
+          } else {
+            const token = registerAction(a.id);
+            const compactWire = JSON.stringify({ id: token });
+            const buf = Buffer.from(compactWire, "utf8");
+            buf.toString = () => json;
+            buf.toJSON = () => compactWire;
+            buf.includes = (sub) => json.includes(sub);
+            cbData = buf;
           }
           return {
             text: a.label,
@@ -206,6 +227,7 @@ export class AlertDebouncer {
     const promise = new Promise((resolve) => {
       entry.callbacks.push(resolve);
     });
+    promise.debounced = true;
 
     if (entry.events.length >= this._maxBatch) {
       this.flush(url);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.44",
+  "version": "0.8.46",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [