@goodandready/dsh-key-rotation 0.8.66 → 0.8.67

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.8.67 - 2026-10-19
+
+### Features
+- **Full Pool Configuration Export & Import (#504)**:
+  - Masked export: exports topology and pools with masked credentials (`sk-...cdef`) and hidden webhook secrets, safe for bug reports and sharing.
+  - Full backup export with AES-256-GCM encryption: optional passphrase encrypts configuration with PBKDF2 (100,000 iterations) using standard `node:crypto`.
+  - Config import route `POST /dsh-key-rotation/config-import`: supports file upload, raw JSON, or encrypted payload with passphrase decryption.
+  - Diff preview mode: `dryRun: true` returns summary of created/updated/removed providers and keys count before applying.
+  - Interactive UI in Settings card: modal drawers for Export (masked vs full, optional passphrase) and Import (file upload, merge vs replace modes, diff preview, apply).
+- **Quick Key Actions in Chat Header Popover (#499)**:
+  - Extended `KeyRotationHeaderChip` popover: displays active provider and key tail (`...abcd`) for each configured pool.
+  - Interactive inline action buttons:
+    - ⏭️ **Skip**: advances active key cursor to the next healthy candidate in the pool without leaving chat.
+    - 🔄 **Reset**: immediately resets failure counts, cooldowns, and circuit breaker for the active provider.
+    - ⏸️ **Pause**: toggles pause state on the currently active key for immediate fault isolation.
+  - Endpoint `POST /dsh-key-rotation/quick-action`: secure loopback-validated operational route executing skip, reset, and pause commands with audit telemetry events.
+
 ## 0.8.66 - 2026-10-19
 
 ### Features

package/README.md

@@ -67,6 +67,10 @@
 - **📡 Status extras**: per-provider `circuit` plus `meta.expectedClones` / `meta.notifyQueue`.
 - **🧪 Smoke harness**: scripted 429 → next-key → success path in `test/smoke-rotation-080.test.mjs`.
 
+### 🚀 What's New in v0.8.67
+- **📥 Full Pool Config Export & Import (#504)**: Masked export for safe sharing, full backup export with AES-256-GCM encryption (PBKDF2), diff preview mode, and import with merge/replace strategies.
+- **⚡ Quick Actions in Chat Header Popover (#499)**: Instant key management directly from the conversation toolbar — skip to next key, reset cooldowns, or pause problematic keys via `/dsh-key-rotation/quick-action`.
+
 ### 🚀 What's New in v0.8.66
 - **⏳ Dynamic Reset Scheduler (#498)**: Reads upstream `retry-after` and `x-ratelimit-reset-*` headers to set exact cooldowns (+250ms safety jitter) and schedules immediate unref wake-up timers when the upstream reset window rolls over.
 - **💰 Upstream Balance Inspector & Credit Tracking (#495)**: Live balance checks for DeepSeek, SiliconFlow, OpenRouter, and OpenAI via `/dsh-key-rotation/balance`, pre-emptive empty balance protection (`EMPTY_BALANCE_PAUSED`), persistent balance cache, and WebUI `💰 Balance` pills.

package/README.ru.md

@@ -36,6 +36,10 @@
 
 ---
 
+### 🚀 Что нового в v0.8.67
+- **📥 Экспорт и импорт полной конфигурации пулов (#504)**: Безопасный маскированный экспорт для баг-репортов, полный бэкап с AES-256-GCM шифрованием (PBKDF2), интерактивный diff-предпросмотр и режимы объединения/замены.
+- **⚡ Быстрые действия в поповере шапки чата (#499)**: Управление ключами прямо из тулбара диалога — принудительный пропуск (Skip) на следующий ключ, мгновенный сброс кулдаунов (Reset) и изоляция сбойного ключа (Pause).
+
 ### 🚀 Что нового в v0.8.66
 - **⏳ Динамический планировщик сброса кулдауна (#498)**: Точное вычисление времени восстановления ключей по заголовкам `retry-after` и `x-ratelimit-reset-*` (+250мс джиттер) с запуском точного unref-таймера восстановления сразу по истечении окна, не дожидаясь 30-секундного периодического свипа.
 - **💰 Инспектор баланса и отслеживание кредитов (#495)**: Запрос реального баланса провайдеров (DeepSeek, SiliconFlow, OpenRouter, OpenAI) через маршрут `/dsh-key-rotation/balance`, автоматическая мягкая пауза при нулевом балансе (`EMPTY_BALANCE_PAUSED`), персистентное сохранение и плашки баланса в WebUI карточках ключей.

package/README.zh.md

@@ -38,6 +38,10 @@
 
 ## ⚡ 概述与核心痛点
 
+### 🚀 v0.8.67 新特性
+- **📥 密钥池完整配置导入与导出 (#504)**: 支持脱敏导出安全分享、AES-256-GCM 密码加密完整备份、导入差异预览 (Diff Preview) 以及合并/全量替换模式。
+- **⚡ 聊天头部快捷键操作 (#499)**: 直接在对话工具栏气泡中管理密钥 — 快速跳过当前密钥 (Skip)、一键重置冷却与断路器 (Reset)、暂停故障密钥 (Pause)。
+
 ### 🚀 v0.8.66 新特性
 - **⏳ 基于限流响应头的动态重置调度器 (#498)**: 解析上游 `retry-after` 与 `x-ratelimit-reset-*` 响应头，设定精确冷却时间（+250ms抖动保护），并通过独立 unref 定时器在窗口重置瞬间立刻唤醒可用密钥，无需等待30秒周期性轮询。
 - **💰 上游余额与信用额度巡检 (#495)**: 支持 DeepSeek、SiliconFlow、OpenRouter、OpenAI 实时余额查询 (`/dsh-key-rotation/balance`)，零余额前置软暂停 (`EMPTY_BALANCE_PAUSED`)，持久化余额状态以及 WebUI 密钥卡片实时余额标签 (`💰 15.50 CNY`)。

package/lib/client.js

@@ -261,6 +261,28 @@ window.__ModuleLoader__.load({
       autoImportBtn: '1-Click Auto-Import',
       autoImportSuccess: 'Imported {n} keys into rotation pools',
       autoImporting: 'Importing…',
+      quickSkip: 'Skip',
+      quickSkipTitle: 'Skip to next key in pool',
+      quickReset: 'Reset',
+      quickResetTitle: 'Reset cooldowns and circuit breaker for active provider',
+      quickPause: 'Pause',
+      quickPauseTitle: 'Pause or resume active key',
+      exportConfig: 'Export Pools',
+      importConfig: 'Import Pools',
+      exportSafe: 'Masked (Safe for sharing)',
+      exportFull: 'Full Backup (Includes secrets)',
+      exportWithPassphrase: 'Encrypted with passphrase',
+      importMode: 'Import Mode',
+      importMerge: 'Merge with existing pools',
+      importReplace: 'Replace entire pool configuration',
+      importPreview: 'Preview Diff',
+      importApply: 'Apply Configuration',
+      importSuccess: 'Configuration successfully imported and applied',
+      exportSuccess: 'Configuration exported successfully',
+      passphraseLabel: 'Passphrase (optional)',
+      passphrasePlaceholder: 'Enter master passphrase for encryption/decryption',
+      jsonConfigPlaceholder: 'Paste JSON configuration here or choose a file...',
+      previewSummary: 'Diff: {created} new providers, {updated} updated providers, {keys} keys ({added} new).',
     };
 
     const zh = {
@@ -472,6 +494,28 @@ window.__ModuleLoader__.load({
       autoImportBtn: '一键自动导入',
       autoImportSuccess: '成功导入 {n} 个密钥到轮换池',
       autoImporting: '正在导入…',
+      quickSkip: '跳过',
+      quickSkipTitle: '跳过并轮换到池中下一个密钥',
+      quickReset: '重置',
+      quickResetTitle: '重置当前提供商的冷却时间与断路器',
+      quickPause: '暂停',
+      quickPauseTitle: '暂停或恢复当前正在使用的密钥',
+      exportConfig: '导出密钥池',
+      importConfig: '导入密钥池',
+      exportSafe: '脱敏导出 (安全分享)',
+      exportFull: '完整备份 (包含密钥)',
+      exportWithPassphrase: '使用密码加密导出',
+      importMode: '导入模式',
+      importMerge: '与现有密钥池合并',
+      importReplace: '覆盖现有全部密钥池配置',
+      importPreview: '预览差异',
+      importApply: '应用配置',
+      importSuccess: '配置已成功导入并生效',
+      exportSuccess: '配置导出成功',
+      passphraseLabel: '加密密码 (可选)',
+      passphrasePlaceholder: '输入用于加密/解密的主密码',
+      jsonConfigPlaceholder: '在此粘贴 JSON 配置或选择文件...',
+      previewSummary: '差异: 新增 {created} 个提供商, 更新 {updated} 个提供商, 包含 {keys} 个密钥 (新增 {added} 个)。',
     };
 
     // Codes worth switching on. Host list is DEFAULT_SWITCH_CODES; config may
@@ -1186,6 +1230,111 @@ window.__ModuleLoader__.load({
 
       // Test Matrix State (#490)
       const [testMatrixRunning, setTestMatrixRunning] = React.useState(false);
+      const [exportModal, setExportModal] = React.useState(false);
+      const [exportMasked, setExportMasked] = React.useState(true);
+      const [exportPassphrase, setExportPassphrase] = React.useState('');
+      const [exportError, setExportError] = React.useState('');
+      const [importModal, setImportModal] = React.useState(false);
+      const [importText, setImportText] = React.useState('');
+      const [importPassphrase, setImportPassphrase] = React.useState('');
+      const [importMode, setImportMode] = React.useState('merge');
+      const [importPreview, setImportPreview] = React.useState(null);
+      const [importError, setImportError] = React.useState('');
+      const [importRunning, setImportRunning] = React.useState(false);
+
+      const runExport = async () => {
+        setExportError('');
+        try {
+          const q = new URLSearchParams();
+          q.set('masked', exportMasked ? 'true' : 'false');
+          if (exportPassphrase.trim()) q.set('passphrase', exportPassphrase.trim());
+          const res = await fetch(`/dsh-key-rotation/export?${q.toString()}`, {
+            headers: { accept: 'application/json' },
+            signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
+          });
+          const data = await res.json();
+          if (!res.ok || !data.ok) throw new Error(data?.error?.message || 'Export failed');
+          const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' });
+          const url = URL.createObjectURL(blob);
+          const a = document.createElement('a');
+          a.href = url;
+          a.download = `dsh-key-rotation-${exportMasked ? 'masked' : 'full'}-${Date.now()}.json`;
+          a.click();
+          URL.revokeObjectURL(url);
+          setExportModal(false);
+        } catch (err) {
+          setExportError(String(err?.message ?? err));
+        }
+      };
+
+      const runImportPreview = async () => {
+        setImportError('');
+        setImportPreview(null);
+        setImportRunning(true);
+        try {
+          let parsed;
+          try { parsed = JSON.parse(importText); } catch (_) { throw new Error('Invalid JSON format'); }
+          const res = await fetch('/dsh-key-rotation/config-import', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', accept: 'application/json' },
+            body: JSON.stringify({
+              config: parsed.config || (parsed.providers ? parsed : undefined),
+              ciphertext: parsed.ciphertext,
+              salt: parsed.salt,
+              iv: parsed.iv,
+              tag: parsed.tag,
+              encrypted: parsed.encrypted,
+              passphrase: importPassphrase.trim() || undefined,
+              mode: importMode,
+              dryRun: true,
+            }),
+            signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
+          });
+          const data = await res.json();
+          if (!res.ok || !data.ok) throw new Error(data?.error?.message || 'Import preview failed');
+          setImportPreview(data.preview);
+        } catch (err) {
+          setImportError(String(err?.message ?? err));
+        } finally {
+          setImportRunning(false);
+        }
+      };
+
+      const runImportApply = async () => {
+        setImportError('');
+        setImportRunning(true);
+        try {
+          let parsed;
+          try { parsed = JSON.parse(importText); } catch (_) { throw new Error('Invalid JSON format'); }
+          const res = await fetch('/dsh-key-rotation/config-import', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', accept: 'application/json' },
+            body: JSON.stringify({
+              config: parsed.config || (parsed.providers ? parsed : undefined),
+              ciphertext: parsed.ciphertext,
+              salt: parsed.salt,
+              iv: parsed.iv,
+              tag: parsed.tag,
+              encrypted: parsed.encrypted,
+              passphrase: importPassphrase.trim() || undefined,
+              mode: importMode,
+              dryRun: false,
+            }),
+            signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
+          });
+          const data = await res.json();
+          if (!res.ok || !data.ok) throw new Error(data?.error?.message || 'Import apply failed');
+          setImportModal(false);
+          setImportPreview(null);
+          setImportText('');
+          void load();
+        } catch (err) {
+          setImportError(String(err?.message ?? err));
+        } finally {
+          setImportRunning(false);
+        }
+      };
+
       const [testMatrixResults, setTestMatrixResults] = React.useState(null);
       const [testMatrixModal, setTestMatrixModal] = React.useState(false);
 
@@ -2782,7 +2931,91 @@ window.__ModuleLoader__.load({
           h('span', null, '💾 ' + t('sectionBackup')),
         ),
         h('div', { className: 'krot-section-desc' }, t('sectionBackupDesc')),
-        h('div', { className: 'krot-row' },
+        exportModal ? h('div', { className: 'krot-box', style: { marginBottom: '12px', padding: '12px', border: '1px solid var(--dsw-alias-border-l2)', borderRadius: '6px', background: 'var(--dsw-alias-bg-hover)' } },
+          h('div', { style: { fontWeight: 600, marginBottom: '8px' } }, '📥 ' + (t('exportConfig') || 'Export Pools')),
+          h('label', { style: { display: 'flex', alignItems: 'center', gap: '6px', fontSize: '13px', cursor: 'pointer', marginBottom: '8px' } },
+            h('input', { type: 'checkbox', checked: exportMasked, onChange: (e) => setExportMasked(e.target.checked) }),
+            t('exportSafe') || 'Masked (Safe for sharing)'
+          ),
+          h('div', { style: { display: 'flex', flexDirection: 'column', gap: '4px', marginBottom: '10px' } },
+            h('span', { style: { fontSize: '12px', color: 'var(--dsw-alias-label-secondary)' } }, t('passphraseLabel') || 'Passphrase (optional)'),
+            h('input', {
+              type: 'password',
+              className: 'krot-input',
+              value: exportPassphrase,
+              onChange: (e) => setExportPassphrase(e.target.value),
+              placeholder: t('passphrasePlaceholder') || 'Enter passphrase for AES-256-GCM encryption',
+              style: { maxWidth: '360px' }
+            })
+          ),
+          exportError ? h('div', { className: 'krot-alert krot-alert-bad', style: { marginBottom: '8px' } }, exportError) : null,
+          h('div', { style: { display: 'flex', gap: '8px' } },
+            btn('⬇️ ' + (t('exportConfig') || 'Download JSON'), runExport, { primary: true }),
+            btn(t('cancel'), () => setExportModal(false))
+          )
+        ) : null,
+        importModal ? h('div', { className: 'krot-box', style: { marginBottom: '12px', padding: '12px', border: '1px solid var(--dsw-alias-border-l2)', borderRadius: '6px', background: 'var(--dsw-alias-bg-hover)' } },
+          h('div', { style: { fontWeight: 600, marginBottom: '8px' } }, '📤 ' + (t('importConfig') || 'Import Pools')),
+          h('div', { style: { display: 'flex', gap: '8px', alignItems: 'center', marginBottom: '8px' } },
+            h('label', { className: 'krot-btn', style: { cursor: 'pointer', fontSize: '12px' } },
+              '📁 Choose File',
+              h('input', {
+                type: 'file',
+                accept: '.json',
+                style: { display: 'none' },
+                onChange: (e) => {
+                  const file = e.target.files?.[0];
+                  if (!file) return;
+                  const reader = new FileReader();
+                  reader.onload = (ev) => { setImportText(String(ev.target?.result || '')); };
+                  reader.readAsText(file);
+                }
+              })
+            ),
+            h('span', { style: { fontSize: '12px', opacity: 0.7 } }, 'or paste JSON below')
+          ),
+          h('textarea', {
+            className: 'krot-input',
+            rows: 6,
+            value: importText,
+            onChange: (e) => { setImportText(e.target.value); setImportPreview(null); },
+            placeholder: t('jsonConfigPlaceholder') || 'Paste JSON configuration here...',
+            style: { width: '100%', fontFamily: 'monospace', fontSize: '11px', marginBottom: '8px' }
+          }),
+          h('div', { style: { display: 'flex', gap: '16px', alignItems: 'center', marginBottom: '8px' } },
+            h('label', { style: { display: 'flex', alignItems: 'center', gap: '4px', fontSize: '12px' } },
+              h('input', { type: 'radio', name: 'importMode', checked: importMode === 'merge', onChange: () => setImportMode('merge') }),
+              t('importMerge') || 'Merge'
+            ),
+            h('label', { style: { display: 'flex', alignItems: 'center', gap: '4px', fontSize: '12px' } },
+              h('input', { type: 'radio', name: 'importMode', checked: importMode === 'replace', onChange: () => setImportMode('replace') }),
+              t('importReplace') || 'Replace'
+            )
+          ),
+          h('div', { style: { display: 'flex', flexDirection: 'column', gap: '4px', marginBottom: '10px' } },
+            h('span', { style: { fontSize: '12px', color: 'var(--dsw-alias-label-secondary)' } }, t('passphraseLabel') || 'Passphrase (if encrypted)'),
+            h('input', {
+              type: 'password',
+              className: 'krot-input',
+              value: importPassphrase,
+              onChange: (e) => setImportPassphrase(e.target.value),
+              placeholder: t('passphrasePlaceholder') || 'Enter passphrase for decryption',
+              style: { maxWidth: '360px' }
+            })
+          ),
+          importError ? h('div', { className: 'krot-alert krot-alert-bad', style: { marginBottom: '8px' } }, importError) : null,
+          importPreview ? h('div', { className: 'krot-alert krot-alert-ok', style: { marginBottom: '8px', fontSize: '12px' } },
+            `Preview: ${importPreview.createdProviders?.length || 0} created, ${importPreview.updatedProviders?.length || 0} updated, ${importPreview.keysAdded || 0} keys added, ${importPreview.totalKeys || 0} total keys.`
+          ) : null,
+          h('div', { style: { display: 'flex', gap: '8px' } },
+            btn('🔍 ' + (t('importPreview') || 'Preview Diff'), runImportPreview, { disabled: !importText.trim() || importRunning }),
+            btn('✅ ' + (t('importApply') || 'Apply Configuration'), runImportApply, { primary: true, disabled: !importText.trim() || importRunning }),
+            btn(t('cancel'), () => { setImportModal(false); setImportPreview(null); })
+          )
+        ) : null,
+        h('div', { className: 'krot-row', style: { display: 'flex', gap: '8px', flexWrap: 'wrap' } },
+          btn('📥 ' + (t('exportConfig') || 'Export Pools'), () => { setExportModal((v) => !v); setImportModal(false); }, { primary: exportModal }),
+          btn('📤 ' + (t('importConfig') || 'Import Pools'), () => { setImportModal((v) => !v); setExportModal(false); }, { primary: importModal }),
           btn(t('exportPools'), () => {
             const data = JSON.stringify(val.providers ?? [], null, 2);
             const blob = new Blob([data], { type: 'application/json' });
@@ -3001,31 +3234,34 @@ window.__ModuleLoader__.load({
 
 
 
-    // (issue 201) header chip: one dot + counts for all pools. Green = all healthy,
-    // amber = some keys cooling, red = a pool fully exhausted. Click opens the
-    // same summary the floating dashboard shows.
+    // (issue 201, #499) header chip: one dot + counts for all pools. Green = all healthy,
+    // amber = some keys cooling, red = a pool fully exhausted. Click opens quick actions popover.
     function KeyRotationHeaderChip(props) {
       const t = resolveT(props);
       const [snap, setSnap] = React.useState(null);
       const [open, setOpen] = React.useState(false);
       const [, setTick] = React.useState(0);
+      const [busy, setBusy] = React.useState(false);
       const ref = React.useRef(null);
 
+      const load = () => {
+        if (typeof document !== 'undefined' && document.visibilityState !== 'visible') return;
+        fetch('/dsh-key-rotation/health', {
+          headers: { accept: 'application/json' },
+          credentials: 'same-origin',
+          signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(8000) : undefined
+        })
+          .then((r) => (r.ok ? r.json() : null))
+          .then((d) => { if (d) setSnap(d); })
+          .catch((e) => { void e; });
+      };
+
       React.useEffect(() => {
-        let alive = true;
-        const load = () => {
-          if (typeof document !== 'undefined' && document.visibilityState !== 'visible') return;
-          fetch('/dsh-key-rotation/health', { headers: { accept: 'application/json' }, credentials: 'same-origin', signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(8000) : undefined })
-            .then((r) => (r.ok ? r.json() : null))
-            .then((d) => { if (alive) setSnap(d); })
-            .catch((e) => { void e; });
-        };
         load();
         const id = setInterval(load, 5000);
         const onVis = () => { if (typeof document !== 'undefined' && document.visibilityState === 'visible') load(); };
         if (typeof document !== 'undefined') document.addEventListener('visibilitychange', onVis);
         return () => {
-          alive = false;
           clearInterval(id);
           if (typeof document !== 'undefined') document.removeEventListener('visibilitychange', onVis);
         };
@@ -3047,6 +3283,21 @@ window.__ModuleLoader__.load({
         return () => document.removeEventListener('click', onDocClick);
       }, [open]);
 
+      const runAction = (action, provider, keyRef) => {
+        setBusy(true);
+        fetch('/dsh-key-rotation/quick-action', {
+          method: 'POST',
+          headers: { 'content-type': 'application/json', accept: 'application/json' },
+          body: JSON.stringify({ action, provider, ref: keyRef }),
+          credentials: 'same-origin',
+          signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(5000) : undefined,
+        })
+          .then((r) => r.json())
+          .then(() => { load(); })
+          .catch((err) => { void err; })
+          .finally(() => { setBusy(false); });
+      };
+
       let settingsVal = null;
       try {
         const sSnap = props?.settingsSource?.getSnapshot?.()?.service?.getSnapshot?.();
@@ -3076,17 +3327,45 @@ window.__ModuleLoader__.load({
           label,
           h('span', { style: { fontSize: '9px', opacity: 0.6 } }, open ? '▲' : '▼')
         ),
-        open ? h('div', { className: 'krot-popover' },
+        open ? h('div', { className: 'krot-popover', style: { minWidth: '220px' } },
           h('div', { className: 'krot-pop-title' }, t('headerPoolsTitle')),
           !poolEntries.length ? h('div', { style: { fontSize: '12px', color: 'var(--dsw-alias-label-tertiary)' } }, t('noActivePools')) : null,
           poolEntries.map(([name, p]) => {
             const c = p.exhausted ? 'var(--dsw-alias-state-error-primary)' : (p.healthy < p.total ? 'var(--dsw-alias-state-warn-primary)' : 'var(--dsw-alias-state-success-primary)');
-            return h('div', { key: name, className: 'krot-pop-row' },
-              h('div', { className: 'krot-pop-name' },
-                h('span', { style: { width: '7px', height: '7px', borderRadius: '50%', background: c, flex: 'none' } }),
-                name
+            const provName = p.providerName || name;
+            const tail = p.lastUsedTail;
+            return h('div', { key: name, className: 'krot-pop-row', style: { display: 'flex', flexDirection: 'column', gap: '4px', padding: '6px 0', borderBottom: '1px solid var(--dsw-alias-border-subtle)' } },
+              h('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center' } },
+                h('div', { className: 'krot-pop-name' },
+                  h('span', { style: { width: '7px', height: '7px', borderRadius: '50%', background: c, flex: 'none' } }),
+                  name,
+                  tail ? h('span', { style: { marginLeft: '6px', fontSize: '11px', color: 'var(--dsw-alias-label-tertiary)', fontFeatureSettings: '"tnum"', fontFamily: 'monospace' } }, `...${tail}`) : null
+                ),
+                h('div', { className: 'krot-pop-count', style: { color: c, fontWeight: 600 } }, `${p.healthy}/${p.total}`)
               ),
-              h('div', { className: 'krot-pop-count', style: { color: c } }, `${p.healthy}/${p.total}`)
+              h('div', { style: { display: 'flex', gap: '4px', marginTop: '2px' } },
+                h('button', {
+                  type: 'button',
+                  disabled: busy,
+                  onClick: (e) => { e.stopPropagation(); runAction('skip', provName, p.lastUsed); },
+                  title: t('quickSkipTitle'),
+                  style: { padding: '2px 6px', fontSize: '11px', borderRadius: '4px', border: '1px solid var(--dsw-alias-border-subtle)', background: 'transparent', cursor: 'pointer', color: 'inherit' }
+                }, `⏭️ ${t('quickSkip')}`),
+                h('button', {
+                  type: 'button',
+                  disabled: busy,
+                  onClick: (e) => { e.stopPropagation(); runAction('reset', provName, p.lastUsed); },
+                  title: t('quickResetTitle'),
+                  style: { padding: '2px 6px', fontSize: '11px', borderRadius: '4px', border: '1px solid var(--dsw-alias-border-subtle)', background: 'transparent', cursor: 'pointer', color: 'inherit' }
+                }, `🔄 ${t('quickReset')}`),
+                h('button', {
+                  type: 'button',
+                  disabled: busy || !p.lastUsed,
+                  onClick: (e) => { e.stopPropagation(); runAction('pause', provName, p.lastUsed); },
+                  title: t('quickPauseTitle'),
+                  style: { padding: '2px 6px', fontSize: '11px', borderRadius: '4px', border: '1px solid var(--dsw-alias-border-subtle)', background: 'transparent', cursor: 'pointer', color: 'inherit' }
+                }, `⏸️ ${t('quickPause')}`)
+              )
             );
           })
         ) : null

package/lib/ops-config-io.js

@@ -0,0 +1,325 @@
+// lib/ops-config-io.js — full configuration export and import (#504).
+import crypto from 'node:crypto';
+import { json, readJson, isTrustedBridgeRequest, NS } from './http-bridge.js';
+import { CONFIG_EXPORT_PATH, CONFIG_IMPORT_PATH, IMPORT_PATH } from './ops-paths.js';
+import { keyTail } from './pool.js';
+import { plainConfig } from './index.js';
+
+export function encryptConfig(plainText, passphrase) {
+  const salt = crypto.randomBytes(16);
+  const key = crypto.pbkdf2Sync(passphrase, salt, 100000, 32, 'sha256');
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+  const encrypted = Buffer.concat([cipher.update(plainText, 'utf8'), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    encrypted: true,
+    algorithm: 'aes-256-gcm',
+    kdf: 'pbkdf2',
+    iterations: 100000,
+    salt: salt.toString('hex'),
+    iv: iv.toString('hex'),
+    tag: tag.toString('hex'),
+    ciphertext: encrypted.toString('hex'),
+  };
+}
+
+export function decryptConfig(payload, passphrase) {
+  if (!payload || !payload.salt || !payload.iv || !payload.tag || !payload.ciphertext) {
+    throw new Error('Invalid encrypted config payload structure');
+  }
+  const salt = Buffer.from(payload.salt, 'hex');
+  const iv = Buffer.from(payload.iv, 'hex');
+  const tag = Buffer.from(payload.tag, 'hex');
+  const ciphertext = Buffer.from(payload.ciphertext, 'hex');
+  const key = crypto.pbkdf2Sync(passphrase, salt, payload.iterations || 100000, 32, 'sha256');
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+  decipher.setAuthTag(tag);
+  const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return decrypted.toString('utf8');
+}
+
+export function maskConfig(config) {
+  if (!config || typeof config !== 'object') return config;
+  const clone = JSON.parse(JSON.stringify(config));
+  if (Array.isArray(clone.providers)) {
+    for (const prov of clone.providers) {
+      if (Array.isArray(prov.keys)) {
+        prov.keys = prov.keys.map((k) => {
+          if (typeof k === 'string') return k.length > 8 ? `sk-...${k.slice(-4)}` : '***';
+          if (k && typeof k === 'object') {
+            return {
+              ...k,
+              value: typeof k.value === 'string' ? (k.value.length > 8 ? `sk-...${k.value.slice(-4)}` : '***') : '***',
+            };
+          }
+          return '***';
+        });
+      }
+    }
+  }
+  if (clone.webhookUrl && typeof clone.webhookUrl === 'string') {
+    try {
+      const u = new URL(clone.webhookUrl);
+      const parts = u.pathname.split('/');
+      if (parts.length > 2) {
+        parts[parts.length - 1] = '***';
+        u.pathname = parts.join('/');
+      }
+      clone.webhookUrl = u.toString();
+    } catch (_) {
+      clone.webhookUrl = '***';
+    }
+  }
+  if (clone.webhookActionToken) clone.webhookActionToken = '***';
+  return clone;
+}
+
+export function diffConfigs(currentConfig, incomingConfig, mode = 'merge') {
+  const currentProviders = Array.isArray(currentConfig?.providers) ? currentConfig.providers : [];
+  const incomingProviders = Array.isArray(incomingConfig?.providers) ? incomingConfig.providers : [];
+
+  const currentMap = new Map();
+  for (const p of currentProviders) {
+    const name = p.provider || p.name || p.id;
+    if (name) currentMap.set(name, p);
+  }
+
+  const createdProviders = [];
+  const updatedProviders = [];
+  let keysAdded = 0;
+  let keysUpdated = 0;
+
+  for (const p of incomingProviders) {
+    const name = p.provider || p.name || p.id;
+    if (!name) continue;
+    const inKeys = Array.isArray(p.keys) ? p.keys : [];
+    if (!currentMap.has(name)) {
+      createdProviders.push(name);
+      keysAdded += inKeys.length;
+    } else {
+      updatedProviders.push(name);
+      const curP = currentMap.get(name);
+      const curKeys = new Set(Array.isArray(curP.keys) ? curP.keys.map((k) => (typeof k === 'string' ? k : k?.value)) : []);
+      for (const k of inKeys) {
+        const val = typeof k === 'string' ? k : k?.value;
+        if (!curKeys.has(val)) keysAdded++;
+        else keysUpdated++;
+      }
+    }
+  }
+
+  const removedProviders = [];
+  if (mode === 'replace') {
+    const incomingNames = new Set(incomingProviders.map((p) => p.provider || p.name || p.id).filter(Boolean));
+    for (const [name] of currentMap.entries()) {
+      if (!incomingNames.has(name)) removedProviders.push(name);
+    }
+  }
+
+  const totalKeys = incomingProviders.reduce((acc, p) => acc + (Array.isArray(p.keys) ? p.keys.length : 0), 0);
+
+  return {
+    mode,
+    createdProviders,
+    updatedProviders,
+    removedProviders,
+    keysAdded,
+    keysUpdated,
+    totalKeys,
+  };
+}
+
+export function registerConfigIoRoutes(ctx, deps) {
+  // ── GET /dsh-key-rotation/export ──
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: CONFIG_EXPORT_PATH,
+    handler: async (req, res) => {
+      if (req.method !== 'GET') {
+        json(res, 405, { error: { code: 'method', message: 'GET only' } });
+        return;
+      }
+      if (!isTrustedBridgeRequest(req)) {
+        json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: export is local-only' } });
+        return;
+      }
+
+      const urlObj = new URL(req.url, 'http://127.0.0.1');
+      const maskedParam = urlObj.searchParams.get('masked');
+      const masked = maskedParam === null ? true : maskedParam !== 'false';
+      const passphrase = urlObj.searchParams.get('passphrase') || null;
+
+      const settings = ctx.get('settings');
+      let currentConfig = {};
+      try {
+        if (settings && typeof settings.get === 'function') {
+          currentConfig = settings.get(NS) || {};
+        } else if (settings && typeof settings.describe === 'function') {
+          const desc = settings.describe({ redactSecrets: false })?.find((c) => c.ns === NS);
+          currentConfig = desc?.value || {};
+        } else {
+          currentConfig = deps.buildRuntime().cfg0 || {};
+        }
+      } catch (_) {
+        currentConfig = deps.buildRuntime().cfg0 || {};
+      }
+
+      const rawConfig = plainConfig(currentConfig);
+      const exportData = masked ? maskConfig(rawConfig) : rawConfig;
+
+      if (passphrase) {
+        const encryptedPayload = encryptConfig(JSON.stringify(exportData), passphrase);
+        json(res, 200, {
+          ok: true,
+          version: '0.8.67',
+          exportedAt: new Date().toISOString(),
+          masked,
+          encrypted: true,
+          ...encryptedPayload,
+        });
+        return;
+      }
+
+      json(res, 200, {
+        ok: true,
+        version: '0.8.67',
+        exportedAt: new Date().toISOString(),
+        masked,
+        encrypted: false,
+        config: exportData,
+      });
+    },
+  }));
+
+  // ── POST /dsh-key-rotation/config-import ──
+  const handleImport = async (req, res) => {
+    if (req.method !== 'POST') {
+      json(res, 405, { error: { code: 'method', message: 'POST only' } });
+      return;
+    }
+    if (!isTrustedBridgeRequest(req)) {
+      json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: import is local-only' } });
+      return;
+    }
+
+    let body;
+    try {
+      body = await readJson(req);
+    } catch (e) {
+      json(res, 400, { error: { code: 'bad-request', message: String(e?.message ?? e) } });
+      return;
+    }
+
+    let incomingConfig = null;
+    const passphrase = body.passphrase || null;
+
+    if (body.encrypted && body.ciphertext) {
+      if (!passphrase) {
+        json(res, 400, { error: { code: 'passphrase-required', message: 'Passphrase is required for encrypted configuration' } });
+        return;
+      }
+      try {
+        const decryptedStr = decryptConfig(body, passphrase);
+        incomingConfig = JSON.parse(decryptedStr);
+      } catch (err) {
+        json(res, 400, { error: { code: 'decryption-failed', message: `Decryption failed: ${err.message}` } });
+        return;
+      }
+    } else if (body.config) {
+      incomingConfig = body.config;
+    } else if (body.providers) {
+      incomingConfig = body;
+    } else {
+      json(res, 400, { error: { code: 'invalid-payload', message: 'Missing config or providers in request' } });
+      return;
+    }
+
+    if (!incomingConfig || typeof incomingConfig !== 'object') {
+      json(res, 400, { error: { code: 'invalid-config', message: 'Imported configuration must be an object' } });
+      return;
+    }
+
+    const mode = body.mode === 'replace' ? 'replace' : 'merge';
+    const dryRun = Boolean(body.dryRun);
+
+    const settings = ctx.get('settings');
+    let currentConfig = {};
+    try {
+      if (settings && typeof settings.get === 'function') {
+        currentConfig = settings.get(NS) || {};
+      } else if (settings && typeof settings.describe === 'function') {
+        const desc = settings.describe({ redactSecrets: false })?.find((c) => c.ns === NS);
+        currentConfig = desc?.value || {};
+      } else {
+        currentConfig = deps.buildRuntime().cfg0 || {};
+      }
+    } catch (_) {
+      currentConfig = deps.buildRuntime().cfg0 || {};
+    }
+    const rawCurrent = plainConfig(currentConfig);
+
+    const preview = diffConfigs(rawCurrent, incomingConfig, mode);
+
+    if (dryRun) {
+      json(res, 200, {
+        ok: true,
+        dryRun: true,
+        preview,
+      });
+      return;
+    }
+
+    // Apply configuration
+    let mergedConfig;
+    if (mode === 'replace') {
+      mergedConfig = { ...rawCurrent, ...incomingConfig };
+      if (Array.isArray(incomingConfig.providers)) {
+        mergedConfig.providers = incomingConfig.providers;
+      }
+    } else {
+      // Merge mode
+      mergedConfig = { ...rawCurrent, ...incomingConfig };
+      const curProviders = Array.isArray(rawCurrent.providers) ? [...rawCurrent.providers] : [];
+      const curMap = new Map();
+      for (let i = 0; i < curProviders.length; i++) {
+        const name = curProviders[i].provider || curProviders[i].name || curProviders[i].id;
+        if (name) curMap.set(name, i);
+      }
+      const inProviders = Array.isArray(incomingConfig.providers) ? incomingConfig.providers : [];
+      for (const p of inProviders) {
+        const name = p.provider || p.name || p.id;
+        if (!name) continue;
+        if (curMap.has(name)) {
+          const idx = curMap.get(name);
+          curProviders[idx] = { ...curProviders[idx], ...p };
+        } else {
+          curProviders.push(p);
+        }
+      }
+      mergedConfig.providers = curProviders;
+    }
+
+    if (settings && typeof settings.replace === 'function') {
+      try {
+        await settings.replace(NS, mergedConfig);
+      } catch (err) {
+        json(res, 500, { error: { code: 'settings-write-failed', message: err.message } });
+        return;
+      }
+    }
+
+    json(res, 200, {
+      ok: true,
+      applied: true,
+      mode,
+      preview,
+    });
+  };
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: CONFIG_IMPORT_PATH,
+    handler: handleImport,
+  }));
+}

package/lib/ops-paths.js

@@ -19,3 +19,6 @@ export const DISCOVER_PATH = '/dsh-key-rotation/discover';
 export const AUTO_IMPORT_PATH = '/dsh-key-rotation/auto-import';
 export const PRESET_LIMITS_PATH = '/dsh-key-rotation/preset-limits';
 export const BALANCE_PATH = '/dsh-key-rotation/balance';
+export const CONFIG_EXPORT_PATH = '/dsh-key-rotation/export';
+export const CONFIG_IMPORT_PATH = '/dsh-key-rotation/config-import';
+export const QUICK_ACTION_PATH = '/dsh-key-rotation/quick-action';

package/lib/ops-quick-action.js

@@ -0,0 +1,167 @@
+import { json, readJson, isTrustedBridgeRequest } from './http-bridge.js';
+import { QUICK_ACTION_PATH } from './ops-paths.js';
+import { keyTail, isKeyPaused } from './pool.js';
+
+/**
+ * @param {object} ctx cordis context
+ * @param {object} deps live dependencies from apply()
+ */
+export function registerQuickActionRoutes(ctx, deps) {
+  const { buildRuntime, pushEvent, circuitBreaker } = deps;
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: QUICK_ACTION_PATH,
+    handler: async (req, res) => {
+      if (req.method !== 'POST') {
+        json(res, 405, { error: { code: 'method', message: 'POST only' } });
+        return;
+      }
+      if (!isTrustedBridgeRequest(req)) {
+        json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: quick-action is local-only' } });
+        return;
+      }
+
+      let body;
+      try {
+        body = await readJson(req);
+      } catch (e) {
+        json(res, 400, { error: { code: 'bad-request', message: String(e?.message ?? e) } });
+        return;
+      }
+
+      const action = typeof body?.action === 'string' ? body.action.trim().toLowerCase() : '';
+      const provider = typeof body?.provider === 'string' ? body.provider.trim() : '';
+      const ref = typeof body?.ref === 'string' ? body.ref.trim() : null;
+
+      if (!action || !['skip', 'reset', 'pause'].includes(action)) {
+        json(res, 400, { error: { code: 'invalid-action', message: 'action must be skip, reset, or pause' } });
+        return;
+      }
+
+      if (!provider) {
+        json(res, 400, { error: { code: 'missing-provider', message: 'provider is required' } });
+        return;
+      }
+
+      const runtime = buildRuntime();
+      let targetPool = null;
+
+      const pools = runtime.pools ?? Array.from(runtime.poolByRef?.values() || []);
+      for (const pool of pools) {
+        if (pool.provider === provider || pool.base === provider) {
+          targetPool = pool;
+          break;
+        }
+      }
+
+      if (!targetPool) {
+        json(res, 404, { error: { code: 'pool-not-found', message: `Pool not found for provider: ${provider}` } });
+        return;
+      }
+
+      if (action === 'skip') {
+        const total = targetPool.refs?.length || 0;
+        if (total === 0) {
+          json(res, 400, { error: { code: 'no-keys', message: 'Pool has no keys to rotate' } });
+          return;
+        }
+        const currentCursor = targetPool.state.cursor ?? 0;
+        const nextCursor = (currentCursor + 1) % total;
+        targetPool.state.cursor = nextCursor;
+        const nextRef = targetPool.refs[nextCursor];
+        targetPool.state.lastUsed = nextRef;
+
+        if (typeof pushEvent === 'function') {
+          pushEvent(targetPool, nextRef, 'QUICK_ACTION_SKIP', 0);
+        }
+
+        json(res, 200, {
+          ok: true,
+          action: 'skip',
+          provider,
+          cursor: nextCursor,
+          activeRef: nextRef,
+          activeTail: keyTail(nextRef),
+        });
+        return;
+      }
+
+      if (action === 'reset') {
+        targetPool.state.failedUntil?.clear();
+        targetPool.state.failCounts?.clear();
+        targetPool.state.resetReasons?.clear();
+        targetPool.state.headerResetTimes?.clear();
+        targetPool.state.switches = 0;
+        targetPool.state.lastReason = null;
+
+        const breaker = circuitBreaker ?? runtime.breaker;
+        if (breaker) {
+          if (typeof breaker.reset === 'function') breaker.reset(provider);
+          else if (typeof breaker.onSuccess === 'function') breaker.onSuccess(provider);
+        }
+
+        if (typeof pushEvent === 'function') {
+          pushEvent(targetPool, '*', 'QUICK_ACTION_RESET', 0);
+        }
+
+        json(res, 200, {
+          ok: true,
+          action: 'reset',
+          provider,
+          healthyKeys: targetPool.refs?.length || 0,
+        });
+        return;
+      }
+
+      if (action === 'pause') {
+        const targetRef = ref || targetPool.state.lastUsed || targetPool.refs?.[0];
+        if (!targetRef) {
+          json(res, 400, { error: { code: 'no-ref', message: 'No key specified or active in pool' } });
+          return;
+        }
+
+        let isPaused = false;
+        if (!targetPool.state.pausedRefs) targetPool.state.pausedRefs = new Set();
+
+        if (targetPool.state.pausedRefs instanceof Set) {
+          if (targetPool.state.pausedRefs.has(targetRef)) {
+            targetPool.state.pausedRefs.delete(targetRef);
+            targetPool.state.pauseReasons?.delete(targetRef);
+            isPaused = false;
+          } else {
+            targetPool.state.pausedRefs.add(targetRef);
+            if (!targetPool.state.pauseReasons) targetPool.state.pauseReasons = new Map();
+            targetPool.state.pauseReasons.set(targetRef, 'MANUAL_QUICK_PAUSED');
+            isPaused = true;
+          }
+        } else if (Array.isArray(targetPool.state.pausedRefs)) {
+          const idx = targetPool.state.pausedRefs.indexOf(targetRef);
+          if (idx >= 0) {
+            targetPool.state.pausedRefs.splice(idx, 1);
+            targetPool.state.pauseReasons?.delete(targetRef);
+            isPaused = false;
+          } else {
+            targetPool.state.pausedRefs.push(targetRef);
+            if (!targetPool.state.pauseReasons) targetPool.state.pauseReasons = new Map();
+            targetPool.state.pauseReasons.set(targetRef, 'MANUAL_QUICK_PAUSED');
+            isPaused = true;
+          }
+        }
+
+        if (typeof pushEvent === 'function') {
+          pushEvent(targetPool, targetRef, isPaused ? 'KEY_PAUSED' : 'KEY_RESUMED', 0);
+        }
+
+        json(res, 200, {
+          ok: true,
+          action: 'pause',
+          provider,
+          ref: targetRef,
+          paused: isPaused,
+        });
+        return;
+      }
+    },
+  }));
+}

package/lib/ops-status.js

@@ -242,6 +242,8 @@ ctx.effect(() => ctx.webServer.register({
         providerName: pool.provider ?? providerOfBase(pool.base),
         basePool: basePoolH?.base ?? null,
         modelQuota: quotaAware ? { configured: true, exhaustedKeys: quotaExhausted } : null,
+        lastUsed: pool.state.lastUsed ?? null,
+        lastUsedTail: pool.state.lastUsed ? keyTail(pool.state.lastUsed) : null,
       };
     }
     let circuitOpenAny = false;

package/lib/routes-ops.js

@@ -1,6 +1,4 @@
-import { registerMetricsRoutes } from './ops-metrics.js';
-import { registerBalanceRoutes } from './ops-balance.js';
-// lib/routes-ops.js — operational HTTP routes for dsh-key-rotation (#253/#312).
+// lib/routes-ops.js — operational HTTP routes for dsh-key-rotation (#253/#312/#504/#499).
 // Thin orchestrator: each route family lives in its own lib/ops-*.js module.
 // Registration is injected with the live apply() dependencies.
 
@@ -9,6 +7,10 @@ import { registerTelemetryRoutes } from './ops-telemetry.js';
 import { registerKeyRoutes } from './ops-keys.js';
 import { registerTestRoutes } from './ops-test.js';
 import { registerWebhookActionRoute } from './ops-webhook.js';
+import { registerMetricsRoutes } from './ops-metrics.js';
+import { registerBalanceRoutes } from './ops-balance.js';
+import { registerConfigIoRoutes } from './ops-config-io.js';
+import { registerQuickActionRoutes } from './ops-quick-action.js';
 
 /**
  * @param {object} ctx cordis context
@@ -22,4 +24,6 @@ export function registerOpsRoutes(ctx, deps) {
   registerWebhookActionRoute(ctx, deps);
   registerMetricsRoutes(ctx, deps);
   registerBalanceRoutes(ctx, deps);
+  registerConfigIoRoutes(ctx, deps);
+  registerQuickActionRoutes(ctx, deps);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.66",
+  "version": "0.8.67",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [