@goodandready/dsh-key-rotation 0.8.49 → 0.8.50

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.8.50 - 2026-10-05
+
+### Fixed
+- **Multi-Instance Isolation in Single Process (#446)**: Scoped all module-level state (`moduleBreaker`, `latencyHistogram`, `quotaStore`, `concurrencyTracker`, `webhookSender`, `alertDebouncer`, `moduleNotifyQueue`, and alert suppression maps `*NotifiedAt`) into `apply(ctx, config)` factory scope, eliminating shared state across profiles/instances.
+- **Config Bridge GET Error Handling (#444)**: Wrapped `handleConfigBridge` GET branch in `try ... catch` to prevent unhandled promise rejections on catalog/settings provider read failures, safely returning HTTP 500 JSON with error code `settings-read-failed`.
+- **Safe Settings Service Property Access (#447)**: Guarded `settings.writable` and `settings.documentPath` reads with defensive fallbacks and verified `typeof settings?.describe === function` in `descriptorOf`, `viewOf`, `writeSection`, and `handleConfigBridge`.
+- **Clean Stream Consumer Finally Block (#445)**: Removed redundant empty `try { ... } finally { }` block in `lib/rotate.js`, keeping the outer resource cleanup block for concurrency permit and picked reference disposal.
+- **Wired Diagnostics Pool Helpers (#440)**: Connected exported `providerOfBase` and `basePoolForBase` in `lib/resolver.js` (provider budget checks and exhaustion error formatting) and `lib/ops-status.js` (`/status` and `/health` routes, circuit breaker evaluation), and added `test/pool-index.test.js`.
+
 ## 0.8.49 - 2026-10-03
 
 ### Added

package/lib/http-bridge.js

@@ -47,16 +47,16 @@ export function readJson(request, maxBytes = 1024 * 1024) {
 
 export function descriptorOf(ctx, ns) {
   const settings = ctx.get('settings');
-  if (settings === void 0) return void 0;
-  return settings.describe({ redactSecrets: true }).find((candidate) => candidate.ns === ns);
+  if (settings === void 0 || typeof settings?.describe !== 'function') return void 0;
+  return settings.describe({ redactSecrets: true })?.find((candidate) => candidate.ns === ns);
 }
 
 export function viewOf(descriptor, settings) {
   return {
     available: true,
-    writable: settings.writable,
-    hasDocument: settings.hasDocument,
-    value: descriptor.value,
+    writable: Boolean(settings?.writable),
+    hasDocument: Boolean(settings?.hasDocument),
+    value: descriptor?.value,
     ...descriptor.base === void 0 ? {} : { base: descriptor.base },
     ...descriptor.user === void 0 || Object.keys(descriptor.user).length === 0 ? {} : { user: descriptor.user },
     revision: descriptor.revision,
@@ -90,7 +90,7 @@ export async function writeSection(ctx, ns, section, expectedRevision, res, rese
     json(res, 500, { error: { code: 'settings-rejected', message: 'dsh-key-rotation: namespace vanished after write' } });
     return;
   }
-  json(res, 200, viewOf(descriptor, { writable: settings.writable, hasDocument: settings.documentPath !== void 0 }));
+  json(res, 200, viewOf(descriptor, { writable: Boolean(settings?.writable), hasDocument: settings?.documentPath !== void 0 }));
 }
 
 /**
@@ -189,29 +189,38 @@ export async function handleConfigBridge(ctx, request, res, getCloneIds) {
   }
   const method = request.method ?? 'GET';
   if (method === 'GET') {
-    const settings = ctx.get('settings');
-    const descriptor = descriptorOf(ctx, NS);
-    const body = {
-      providers: providerCatalog(ctx, getCloneIds()),
-    };
-    if (descriptor === void 0) {
+    try {
+      const settings = ctx.get('settings');
+      const descriptor = descriptorOf(ctx, NS);
+      const body = {
+        providers: providerCatalog(ctx, getCloneIds()),
+      };
+      if (descriptor === void 0) {
+        json(res, 200, {
+          ...body,
+          available: false,
+          writable: Boolean(settings?.writable),
+          hasDocument: settings?.documentPath !== void 0,
+          value: void 0,
+          revision: 0,
+        });
+        return;
+      }
       json(res, 200, {
         ...body,
-        available: false,
-        writable: settings?.writable ?? false,
-        hasDocument: settings?.documentPath !== void 0,
-        value: void 0,
-        revision: 0,
+        ...viewOf(descriptor, {
+          writable: Boolean(settings?.writable),
+          hasDocument: settings?.documentPath !== void 0,
+        }),
+      });
+    } catch (error) {
+      json(res, 500, {
+        error: {
+          code: 'settings-read-failed',
+          message: `dsh-key-rotation: failed to read settings: ${error instanceof Error ? error.message : String(error)}`,
+        },
       });
-      return;
     }
-    json(res, 200, {
-      ...body,
-      ...viewOf(descriptor, {
-        writable: settings?.writable ?? false,
-        hasDocument: settings?.documentPath !== void 0,
-      }),
-    });
     return;
   }
   if (method === 'PUT' || method === 'DELETE') {

package/lib/index.js

@@ -67,32 +67,9 @@ const CONFIG_PATH = '/dsh-key-rotation/config';
 const PIAI_NS = 'llm-pi-ai';
 const MARKER = '__dshKeyRotation';
 
-let rotationDisabled = false;
-const expiryNotifiedAt = new Map();
-const budgetNotifiedAt = new Map();
-const lowHealthNotifiedAt = new Map();
-const sloNotifiedAt = new Map();
-
 const dispatchStorage = new AsyncLocalStorage();
-const latencyHistogram = new LatencyHistogram();
-const quotaStore = new QuotaStore();
-const concurrencyTracker = new ConcurrencyTracker();
-
-let moduleBreaker = new CircuitBreaker({ threshold: 5, openMs: 30000, halfOpenProbes: 1, now: nowMono });
-const webhookSender = new WebhookSender({ fetchImpl: globalThis.fetch });
-const alertDebouncer = new AlertDebouncer({ sender: webhookSender, debounceMs: 2000 });
-let moduleNotifyQueue = new NotifyQueue({ send: (url, payload) => alertDebouncer.enqueue(url, payload) });
-
-let getConfig = () => null;
-function verboseLoggingOn() {
-  try { return Boolean(getConfig()?.verboseLogging); } catch (_) { return false; }
-}
-
 let getRuntime = () => null;
 
-const sandboxService = createSandboxService({ getRuntime: () => getRuntime() });
-const { ensureSandboxRunner, probeRef, lastTestCache } = sandboxService;
-
 const DEFAULT_PROVIDERS = [];
 
 const SettingsSchema = Schema.object({
@@ -189,7 +166,29 @@ function registerConfigBridge(ctx, getCloneIds) {
 export function apply(ctx, config = {}) {
   const logger = getLogger(ctx);
   const readEntryConfig = createConfigReader(config, ctx);
-  getConfig = readEntryConfig;
+  let getConfig = readEntryConfig;
+  const verboseLoggingOn = () => {
+    try { return Boolean(getConfig()?.verboseLogging); } catch (_) { return false; }
+  };
+
+  let rotationDisabled = false;
+  const expiryNotifiedAt = new Map();
+  const budgetNotifiedAt = new Map();
+  const lowHealthNotifiedAt = new Map();
+  const sloNotifiedAt = new Map();
+
+  const latencyHistogram = new LatencyHistogram();
+  const quotaStore = new QuotaStore();
+  const concurrencyTracker = new ConcurrencyTracker();
+
+  const moduleBreaker = new CircuitBreaker({ threshold: 5, openMs: 30000, halfOpenProbes: 1, now: nowMono });
+  const webhookSender = new WebhookSender({ fetchImpl: globalThis.fetch });
+  const alertDebouncer = new AlertDebouncer({ sender: webhookSender, debounceMs: 2000 });
+  const moduleNotifyQueue = new NotifyQueue({ send: (url, payload) => alertDebouncer.enqueue(url, payload) });
+
+  const sandboxService = createSandboxService({ getRuntime: () => buildRuntime() });
+  const { ensureSandboxRunner, probeRef, lastTestCache } = sandboxService;
+
   const readProfiles = createProviderProfilesReader(ctx, PIAI_NS);
   registerConfigBridge(ctx, () => buildRuntime().cloneIds);
   ensureSandboxRunner(ctx);
@@ -340,7 +339,7 @@ export function apply(ctx, config = {}) {
       switchNotifyThrottleMs: cfg.switchNotifyThrottleMs ?? 60000,
       warnBelowHealthy: cfg.warnBelowHealthy ?? 0, latencySloMs: cfg.latencySloMs ?? 0,
       index, pools,
-      breaker: moduleBreaker, notifyQueue: moduleNotifyQueue,
+      breaker: moduleBreaker, notifyQueue: moduleNotifyQueue, concurrencyTracker, quotaStore, latencyHistogram,
       providerTags, providerBudgets, poolByRef, providerToPool, modelPoolByProvider,
       cloneIds, expectedClones,
       circuitBreakerEnabled: cfg.circuitBreakerEnabled ?? true,

package/lib/ops-status.js

@@ -1,4 +1,5 @@
 import { getModelQuotaStatus, isModelQuotaAvailable, hasModelQuotaConfig } from './model-quota.js';
+import { providerOfBase, basePoolForBase } from './pool-index.js';
 import { decryptSecret } from './crypto-storage.js';
 // lib/ops-status.js — status + health operational routes (#312 split from routes-ops.js).
 import { json } from './http-bridge.js';
@@ -119,8 +120,11 @@ ctx.effect(() => ctx.webServer.register({
           modelQuota,
         });
       }
+      const basePool = pool.basePool ?? (runtime.index ? basePoolForBase(runtime.index, pool.base) : null);
       providers.push({
         provider: pool.base,
+        providerName: pool.provider ?? providerOfBase(pool.base),
+        basePool: basePool?.base ?? null,
         model: pool.model ?? null,
         quotasConfigured: hasModelQuotaConfig(pool),
         keys,
@@ -130,8 +134,9 @@ ctx.effect(() => ctx.webServer.register({
           const br = circuitBreaker ?? runtime.breaker;
           if (!br) return null;
           let st = br.state(pool.base);
-          if (st === 'closed' && pool.provider && pool.provider !== pool.base) {
-            const baseSt = br.state(pool.provider);
+          const provKey = pool.provider ?? providerOfBase(pool.base);
+          if (st === 'closed' && provKey && provKey !== pool.base) {
+            const baseSt = br.state(provKey);
             if (baseSt !== 'closed') st = baseSt;
           }
           return { state: st, threshold: br.threshold, openMs: br.openMs };
@@ -212,12 +217,15 @@ ctx.effect(() => ctx.webServer.register({
       const total = pool.refs.length;
       const exhausted = healthy === 0 && total > 0;
       if (exhausted) exhaustedAny = true;
+      const basePoolH = pool.basePool ?? (runtimeH.index ? basePoolForBase(runtimeH.index, pool.base) : null);
       pools[pool.base] = {
         healthy,
         total,
         exhausted,
         healthScore: computeHealthScore(pool.state),
         model: pool.model ?? null,
+        providerName: pool.provider ?? providerOfBase(pool.base),
+        basePool: basePoolH?.base ?? null,
         modelQuota: quotaAware ? { configured: true, exhaustedKeys: quotaExhausted } : null,
       };
     }
@@ -225,7 +233,7 @@ ctx.effect(() => ctx.webServer.register({
     const brH = circuitBreaker ?? runtimeH.breaker;
     if (brH) {
       for (const pool of (runtimeH.pools ?? runtimeH.poolByRef.values())) {
-        const provKey = pool.provider || pool.base;
+        const provKey = pool.provider ?? providerOfBase(pool.base);
         if (brH.state(pool.base) === 'open' || brH.state(provKey) === 'open') {
           circuitOpenAny = true;
           break;

package/lib/resolver.js

@@ -11,7 +11,7 @@
 import { bucketAllow, bucketRetryMs, tpmAllow, tpmRetryMs } from './bucket.js';
 import { envValue, sortAttemptList, isKeyPaused, isKeyRevoked, isKeyBroken, costForDay, costForWeek, budgetVerdict } from './pool.js';
 import { decryptSecret } from './crypto-storage.js';
-import { resolveRefPool, isQuotaManagedRequest } from './pool-index.js';
+import { resolveRefPool, isQuotaManagedRequest, providerOfBase, basePoolForBase } from './pool-index.js';
 import {
   isModelQuotaAvailable,
   hasModelQuotaConfig,
@@ -101,7 +101,7 @@ export function createResolver({
     const at = now();
 
     // Provider monetary budget refusal (#422):
-    const providerName = pool.provider ?? pool.base?.split?.('::')?.[0];
+    const providerName = pool.provider ?? providerOfBase(pool.base);
     const budget = runtime.providerBudgets?.get?.(providerName);
     if (budget && budget.pauseOnBudget) {
       const { daily, weekly } = getProviderCost(providerName, runtime, at);
@@ -221,7 +221,7 @@ export function createResolver({
     // local refusal: it is not penalised and not classified as an upstream failure.
     if (quotaManaged && !anyModelQuotaAvailable(pool, at)) {
       throw Object.assign(
-        new Error(formatModelQuotaExhaustion(pool.provider ?? pool.base, pool)),
+        new Error(formatModelQuotaExhaustion(pool.provider ?? providerOfBase(pool.base), pool)),
         { code: LOCAL_QUOTA_CODE, localQuota: true },
       );
     }

package/lib/rotate.js

@@ -287,8 +287,7 @@ export function createRotate(deps) {
 
           const _pickedRef = reqStore.pickedRef ?? pool.state.lastUsed;
           try {
-            try {
-              for await (const chunk of preserveDispatchContext(inner, dispatchStorage, reqStore)) {
+            for await (const chunk of preserveDispatchContext(inner, dispatchStorage, reqStore)) {
                 if (!reqStore.concurrencyRef && typeof concurrencyTracker?.acquire === 'function') {
                   const fallbackRef = reqStore.pickedRef ?? _pickedRef;
                   if (fallbackRef) {
@@ -464,8 +463,6 @@ export function createRotate(deps) {
               activePermit?.success();
             }
             return; // clean end — served
-          } finally {
-          }
         } finally {
           if (reqStore.concurrencyRef) {
             concurrencyTracker?.release(reqStore.concurrencyRef);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.49",
+  "version": "0.8.50",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [