@goodandready/dsh-key-rotation 0.8.66 → 0.8.68

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 0.8.68 - 2026-10-19
+
+### Features
+- **24h Error Breakdown & Load Distribution Analytics (#505)**:
+  - Rolling 24-hour analytics engine (`lib/ops-analytics.js`): tracks sliding 24-hour request outcomes, key load distribution percentages, failovers, and cascade occurrences without memory leaks via bounded ring buffers.
+  - Multi-category failure classification: categorizes upstream errors into `429 Rate Limit`, `5xx Server`, `Timeout`, `Quota`, `Auth`, and `Other`.
+  - Health Index indicator: calculates the percentage of requests served clean on first attempt without failovers or retries (`cleanRequests / totalRequests * 100%`).
+  - Cooldown recovery telemetry: computes the average recovery time (`avgCooldownRecoveryMs`) from recent failure and recovery events.
+  - Settings Card UI: renders interactive Health Index badges (`🛡️ Health Index: 98% (clean)`), 24h error breakdown pills (`429: 2`, `5xx: 1`, `Timeout: 0`), cascade counters (`🔀 Cascades: X`), and average recovery time pills.
+- **Prompt Cache Savings Dashboard & Calculator (#497)**:
+  - Multi-provider prompt cache parser (`lib/prompt-cache.js`): extracts prefix cache hit and miss tokens across streaming and non-streaming responses from DeepSeek (`prompt_cache_hit_tokens`), Anthropic (`cache_read_input_tokens`), and OpenAI (`prompt_tokens_details.cached_tokens`).
+  - Financial savings engine: computes real-time USD cost savings based on provider-specific token discount tariffs (~90% discount on cache hits).
+  - Multi-window rolling aggregation: aggregates cached tokens, total input tokens, hit ratio (%), and dollar savings across 24h (`d1`), 7d (`d7`), and 30d (`d30`) sliding windows, plus per-model and per-key breakdowns.
+  - Settings Card Widget: compact «⚡ Prompt Cache Savings» card displaying 24h, 7d, and 30d cache hit tokens, effective cache hit ratio (%), and cumulative dollar savings.
+  - Telemetry & reporting: exposes prompt cache summaries and 24h analytics in `/dsh-key-rotation/status` and `/dsh-key-rotation/usage`.
+
+## 0.8.67 - 2026-10-19
+
+### Features
+- **Full Pool Configuration Export & Import (#504)**:
+  - Masked export: exports topology and pools with masked credentials (`sk-...cdef`) and hidden webhook secrets, safe for bug reports and sharing.
+  - Full backup export with AES-256-GCM encryption: optional passphrase encrypts configuration with PBKDF2 (100,000 iterations) using standard `node:crypto`.
+  - Config import route `POST /dsh-key-rotation/config-import`: supports file upload, raw JSON, or encrypted payload with passphrase decryption.
+  - Diff preview mode: `dryRun: true` returns summary of created/updated/removed providers and keys count before applying.
+  - Interactive UI in Settings card: modal drawers for Export (masked vs full, optional passphrase) and Import (file upload, merge vs replace modes, diff preview, apply).
+- **Quick Key Actions in Chat Header Popover (#499)**:
+  - Extended `KeyRotationHeaderChip` popover: displays active provider and key tail (`...abcd`) for each configured pool.
+  - Interactive inline action buttons:
+    - ⏭️ **Skip**: advances active key cursor to the next healthy candidate in the pool without leaving chat.
+    - 🔄 **Reset**: immediately resets failure counts, cooldowns, and circuit breaker for the active provider.
+    - ⏸️ **Pause**: toggles pause state on the currently active key for immediate fault isolation.
+  - Endpoint `POST /dsh-key-rotation/quick-action`: secure loopback-validated operational route executing skip, reset, and pause commands with audit telemetry events.
+
 ## 0.8.66 - 2026-10-19
 
 ### Features

package/README.md

@@ -67,6 +67,10 @@
 - **📡 Status extras**: per-provider `circuit` plus `meta.expectedClones` / `meta.notifyQueue`.
 - **🧪 Smoke harness**: scripted 429 → next-key → success path in `test/smoke-rotation-080.test.mjs`.
 
+### 🚀 What's New in v0.8.67
+- **📥 Full Pool Config Export & Import (#504)**: Masked export for safe sharing, full backup export with AES-256-GCM encryption (PBKDF2), diff preview mode, and import with merge/replace strategies.
+- **⚡ Quick Actions in Chat Header Popover (#499)**: Instant key management directly from the conversation toolbar — skip to next key, reset cooldowns, or pause problematic keys via `/dsh-key-rotation/quick-action`.
+
 ### 🚀 What's New in v0.8.66
 - **⏳ Dynamic Reset Scheduler (#498)**: Reads upstream `retry-after` and `x-ratelimit-reset-*` headers to set exact cooldowns (+250ms safety jitter) and schedules immediate unref wake-up timers when the upstream reset window rolls over.
 - **💰 Upstream Balance Inspector & Credit Tracking (#495)**: Live balance checks for DeepSeek, SiliconFlow, OpenRouter, and OpenAI via `/dsh-key-rotation/balance`, pre-emptive empty balance protection (`EMPTY_BALANCE_PAUSED`), persistent balance cache, and WebUI `💰 Balance` pills.

package/README.ru.md

@@ -36,6 +36,10 @@
 
 ---
 
+### 🚀 Что нового в v0.8.67
+- **📥 Экспорт и импорт полной конфигурации пулов (#504)**: Безопасный маскированный экспорт для баг-репортов, полный бэкап с AES-256-GCM шифрованием (PBKDF2), интерактивный diff-предпросмотр и режимы объединения/замены.
+- **⚡ Быстрые действия в поповере шапки чата (#499)**: Управление ключами прямо из тулбара диалога — принудительный пропуск (Skip) на следующий ключ, мгновенный сброс кулдаунов (Reset) и изоляция сбойного ключа (Pause).
+
 ### 🚀 Что нового в v0.8.66
 - **⏳ Динамический планировщик сброса кулдауна (#498)**: Точное вычисление времени восстановления ключей по заголовкам `retry-after` и `x-ratelimit-reset-*` (+250мс джиттер) с запуском точного unref-таймера восстановления сразу по истечении окна, не дожидаясь 30-секундного периодического свипа.
 - **💰 Инспектор баланса и отслеживание кредитов (#495)**: Запрос реального баланса провайдеров (DeepSeek, SiliconFlow, OpenRouter, OpenAI) через маршрут `/dsh-key-rotation/balance`, автоматическая мягкая пауза при нулевом балансе (`EMPTY_BALANCE_PAUSED`), персистентное сохранение и плашки баланса в WebUI карточках ключей.

package/README.zh.md

@@ -38,6 +38,10 @@
 
 ## ⚡ 概述与核心痛点
 
+### 🚀 v0.8.67 新特性
+- **📥 密钥池完整配置导入与导出 (#504)**: 支持脱敏导出安全分享、AES-256-GCM 密码加密完整备份、导入差异预览 (Diff Preview) 以及合并/全量替换模式。
+- **⚡ 聊天头部快捷键操作 (#499)**: 直接在对话工具栏气泡中管理密钥 — 快速跳过当前密钥 (Skip)、一键重置冷却与断路器 (Reset)、暂停故障密钥 (Pause)。
+
 ### 🚀 v0.8.66 新特性
 - **⏳ 基于限流响应头的动态重置调度器 (#498)**: 解析上游 `retry-after` 与 `x-ratelimit-reset-*` 响应头，设定精确冷却时间（+250ms抖动保护），并通过独立 unref 定时器在窗口重置瞬间立刻唤醒可用密钥，无需等待30秒周期性轮询。
 - **💰 上游余额与信用额度巡检 (#495)**: 支持 DeepSeek、SiliconFlow、OpenRouter、OpenAI 实时余额查询 (`/dsh-key-rotation/balance`)，零余额前置软暂停 (`EMPTY_BALANCE_PAUSED`)，持久化余额状态以及 WebUI 密钥卡片实时余额标签 (`💰 15.50 CNY`)。

package/lib/client.js

@@ -261,6 +261,37 @@ window.__ModuleLoader__.load({
       autoImportBtn: '1-Click Auto-Import',
       autoImportSuccess: 'Imported {n} keys into rotation pools',
       autoImporting: 'Importing…',
+      quickSkip: 'Skip',
+      quickSkipTitle: 'Skip to next key in pool',
+      quickReset: 'Reset',
+      quickResetTitle: 'Reset cooldowns and circuit breaker for active provider',
+      quickPause: 'Pause',
+      quickPauseTitle: 'Pause or resume active key',
+      exportConfig: 'Export Pools',
+      importConfig: 'Import Pools',
+      exportSafe: 'Masked (Safe for sharing)',
+      exportFull: 'Full Backup (Includes secrets)',
+      exportWithPassphrase: 'Encrypted with passphrase',
+      importMode: 'Import Mode',
+      importMerge: 'Merge with existing pools',
+      importReplace: 'Replace entire pool configuration',
+      importPreview: 'Preview Diff',
+      importApply: 'Apply Configuration',
+      importSuccess: 'Configuration successfully imported and applied',
+      exportSuccess: 'Configuration exported successfully',
+      passphraseLabel: 'Passphrase (optional)',
+      passphrasePlaceholder: 'Enter master passphrase for encryption/decryption',
+      jsonConfigPlaceholder: 'Paste JSON configuration here or choose a file...',
+      previewSummary: 'Diff: {created} new providers, {updated} updated providers, {keys} keys ({added} new).',
+      promptCacheTitle: 'Prompt Cache Savings',
+      promptCacheDesc: 'Tokens served from prefix cache across sessions and estimated cost savings.',
+      promptCacheHitRatio: 'Hit Ratio',
+      promptCacheSaved: 'saved',
+      analytics24hTitle: '24h Pool Health & Load Balance',
+      healthIndex: 'Health Index',
+      cleanRequests: 'clean',
+      errorBreakdown: '24h Errors',
+      avgRecovery: 'Avg Recovery',
     };
 
     const zh = {
@@ -472,6 +503,37 @@ window.__ModuleLoader__.load({
       autoImportBtn: '一键自动导入',
       autoImportSuccess: '成功导入 {n} 个密钥到轮换池',
       autoImporting: '正在导入…',
+      quickSkip: '跳过',
+      quickSkipTitle: '跳过并轮换到池中下一个密钥',
+      quickReset: '重置',
+      quickResetTitle: '重置当前提供商的冷却时间与断路器',
+      quickPause: '暂停',
+      quickPauseTitle: '暂停或恢复当前正在使用的密钥',
+      exportConfig: '导出密钥池',
+      importConfig: '导入密钥池',
+      exportSafe: '脱敏导出 (安全分享)',
+      exportFull: '完整备份 (包含密钥)',
+      exportWithPassphrase: '使用密码加密导出',
+      importMode: '导入模式',
+      importMerge: '与现有密钥池合并',
+      importReplace: '覆盖现有全部密钥池配置',
+      importPreview: '预览差异',
+      importApply: '应用配置',
+      importSuccess: '配置已成功导入并生效',
+      exportSuccess: '配置导出成功',
+      passphraseLabel: '加密密码 (可选)',
+      passphrasePlaceholder: '输入用于加密/解密的主密码',
+      jsonConfigPlaceholder: '在此粘贴 JSON 配置或选择文件...',
+      previewSummary: '差异: 新增 {created} 个提供商, 更新 {updated} 个提供商, 包含 {keys} 个密钥 (新增 {added} 个)。',
+      promptCacheTitle: 'Prompt 缓存节省',
+      promptCacheDesc: '会话间前缀缓存命中 Token 及预估节省成本。',
+      promptCacheHitRatio: '缓存命中率',
+      promptCacheSaved: '已节省',
+      analytics24hTitle: '24小时池健康度与负载分布',
+      healthIndex: '健康指数',
+      cleanRequests: '无重试',
+      errorBreakdown: '24小时错误',
+      avgRecovery: '平均恢复',
     };
 
     // Codes worth switching on. Host list is DEFAULT_SWITCH_CODES; config may
@@ -1186,6 +1248,111 @@ window.__ModuleLoader__.load({
 
       // Test Matrix State (#490)
       const [testMatrixRunning, setTestMatrixRunning] = React.useState(false);
+      const [exportModal, setExportModal] = React.useState(false);
+      const [exportMasked, setExportMasked] = React.useState(true);
+      const [exportPassphrase, setExportPassphrase] = React.useState('');
+      const [exportError, setExportError] = React.useState('');
+      const [importModal, setImportModal] = React.useState(false);
+      const [importText, setImportText] = React.useState('');
+      const [importPassphrase, setImportPassphrase] = React.useState('');
+      const [importMode, setImportMode] = React.useState('merge');
+      const [importPreview, setImportPreview] = React.useState(null);
+      const [importError, setImportError] = React.useState('');
+      const [importRunning, setImportRunning] = React.useState(false);
+
+      const runExport = async () => {
+        setExportError('');
+        try {
+          const q = new URLSearchParams();
+          q.set('masked', exportMasked ? 'true' : 'false');
+          if (exportPassphrase.trim()) q.set('passphrase', exportPassphrase.trim());
+          const res = await fetch(`/dsh-key-rotation/export?${q.toString()}`, {
+            headers: { accept: 'application/json' },
+            signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
+          });
+          const data = await res.json();
+          if (!res.ok || !data.ok) throw new Error(data?.error?.message || 'Export failed');
+          const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' });
+          const url = URL.createObjectURL(blob);
+          const a = document.createElement('a');
+          a.href = url;
+          a.download = `dsh-key-rotation-${exportMasked ? 'masked' : 'full'}-${Date.now()}.json`;
+          a.click();
+          URL.revokeObjectURL(url);
+          setExportModal(false);
+        } catch (err) {
+          setExportError(String(err?.message ?? err));
+        }
+      };
+
+      const runImportPreview = async () => {
+        setImportError('');
+        setImportPreview(null);
+        setImportRunning(true);
+        try {
+          let parsed;
+          try { parsed = JSON.parse(importText); } catch (_) { throw new Error('Invalid JSON format'); }
+          const res = await fetch('/dsh-key-rotation/config-import', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', accept: 'application/json' },
+            body: JSON.stringify({
+              config: parsed.config || (parsed.providers ? parsed : undefined),
+              ciphertext: parsed.ciphertext,
+              salt: parsed.salt,
+              iv: parsed.iv,
+              tag: parsed.tag,
+              encrypted: parsed.encrypted,
+              passphrase: importPassphrase.trim() || undefined,
+              mode: importMode,
+              dryRun: true,
+            }),
+            signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
+          });
+          const data = await res.json();
+          if (!res.ok || !data.ok) throw new Error(data?.error?.message || 'Import preview failed');
+          setImportPreview(data.preview);
+        } catch (err) {
+          setImportError(String(err?.message ?? err));
+        } finally {
+          setImportRunning(false);
+        }
+      };
+
+      const runImportApply = async () => {
+        setImportError('');
+        setImportRunning(true);
+        try {
+          let parsed;
+          try { parsed = JSON.parse(importText); } catch (_) { throw new Error('Invalid JSON format'); }
+          const res = await fetch('/dsh-key-rotation/config-import', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', accept: 'application/json' },
+            body: JSON.stringify({
+              config: parsed.config || (parsed.providers ? parsed : undefined),
+              ciphertext: parsed.ciphertext,
+              salt: parsed.salt,
+              iv: parsed.iv,
+              tag: parsed.tag,
+              encrypted: parsed.encrypted,
+              passphrase: importPassphrase.trim() || undefined,
+              mode: importMode,
+              dryRun: false,
+            }),
+            signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
+          });
+          const data = await res.json();
+          if (!res.ok || !data.ok) throw new Error(data?.error?.message || 'Import apply failed');
+          setImportModal(false);
+          setImportPreview(null);
+          setImportText('');
+          void load();
+        } catch (err) {
+          setImportError(String(err?.message ?? err));
+        } finally {
+          setImportRunning(false);
+        }
+      };
+
       const [testMatrixResults, setTestMatrixResults] = React.useState(null);
       const [testMatrixModal, setTestMatrixModal] = React.useState(false);
 
@@ -2333,7 +2500,55 @@ window.__ModuleLoader__.load({
             total > 0 && keyUsages.length > 1 ? h('div', { style: { marginTop: '8px', display: 'flex', alignItems: 'center', gap: '8px' } },
               h('span', { style: { fontSize: '11px', color: 'var(--dsw-alias-label-secondary)' } }, '📈 ' + t('sparklineTraffic') + ':'),
               h(Sparkline, { points: keyUsages.map(x => x.usage), width: 140, height: 20 })
-            ) : null
+            ) : null,
+            (() => {
+              const an = ps && ps.analytics24h ? ps.analytics24h : null;
+              if (!an || an.totalRequests === 0) return null;
+              const hColor = an.healthIndexPct >= 80 ? 'var(--dsw-alias-state-success-primary)' : an.healthIndexPct >= 50 ? 'var(--dsw-alias-state-warn-primary)' : 'var(--dsw-alias-state-error-primary)';
+              return h('div', { style: { marginTop: '8px', display: 'flex', flexWrap: 'wrap', alignItems: 'center', gap: '6px' } },
+                h('span', { className: 'krot-badge', style: { color: hColor, fontWeight: 700 } }, '🛡️ ' + t('healthIndex') + ': ' + an.healthIndexPct + '% (' + an.firstAttemptSuccesses + '/' + an.totalRequests + ' ' + t('cleanRequests') + ')'),
+                an.errorBreakdown.rateLimit > 0 ? h('span', { className: 'krot-badge krot-badge-warn' }, '429: ' + an.errorBreakdown.rateLimit) : null,
+                an.errorBreakdown.server > 0 ? h('span', { className: 'krot-badge krot-badge-warn' }, '5xx: ' + an.errorBreakdown.server) : null,
+                an.errorBreakdown.timeout > 0 ? h('span', { className: 'krot-badge krot-badge-warn' }, 'Timeout: ' + an.errorBreakdown.timeout) : null,
+                an.errorBreakdown.quota > 0 ? h('span', { className: 'krot-badge krot-badge-warn' }, 'Quota: ' + an.errorBreakdown.quota) : null,
+                an.cascades > 0 ? h('span', { className: 'krot-badge' }, '🔀 Cascades: ' + an.cascades) : null,
+                an.avgCooldownRecoveryMs > 0 ? h('span', { className: 'krot-badge' }, '⏱️ ' + t('avgRecovery') + ': ' + Math.round(an.avgCooldownRecoveryMs / 1000) + 's') : null
+              );
+            })()
+          );
+        })();
+
+        const promptCacheWidget = (() => {
+          const ps = status[entry.provider];
+          const pc = ps && ps.promptCache ? ps.promptCache : null;
+          if (!pc || (!pc.d30?.cachedTokens && !pc.allTime?.cachedTokens)) return null;
+          const d1 = pc.d1 || { cachedTokens: 0, savingsUsd: 0, hitRatioPct: 0 };
+          const d7 = pc.d7 || { cachedTokens: 0, savingsUsd: 0, hitRatioPct: 0 };
+          const d30 = pc.d30 || { cachedTokens: 0, savingsUsd: 0, hitRatioPct: 0 };
+          const savedStr = d30.savingsUsd > 0 ? '$' + d30.savingsUsd.toFixed(2) : '$0.00';
+          return h('div', {
+            className: 'krot-prompt-cache-card',
+            style: {
+              marginTop: '6px',
+              marginBottom: '6px',
+              padding: '8px 10px',
+              background: 'var(--dsw-alias-bg-layer-2)',
+              borderRadius: '6px',
+              border: '1px solid var(--dsw-alias-border-subtle)',
+              display: 'flex',
+              flexDirection: 'column',
+              gap: '4px'
+            }
+          },
+            h('div', { style: { display: 'flex', alignItems: 'center', justifyContent: 'space-between' } },
+              h('span', { style: { fontWeight: 600, fontSize: '12px' } }, '⚡ ' + t('promptCacheTitle')),
+              h('span', { className: 'krot-badge krot-badge-ok', style: { fontSize: '11px', fontWeight: 600 } }, savedStr + ' ' + t('promptCacheSaved'))
+            ),
+            h('div', { style: { display: 'flex', flexWrap: 'wrap', gap: '10px', fontSize: '11px', color: 'var(--dsw-alias-label-secondary)' } },
+              h('span', null, h('strong', { style: { color: 'var(--dsw-alias-label-primary)' } }, '24h: '), (d1.cachedTokens || 0).toLocaleString() + ' tok (' + d1.hitRatioPct + '%)'),
+              h('span', null, h('strong', { style: { color: 'var(--dsw-alias-label-primary)' } }, '7d: '), (d7.cachedTokens || 0).toLocaleString() + ' tok (' + d7.hitRatioPct + '%)'),
+              h('span', null, h('strong', { style: { color: 'var(--dsw-alias-label-primary)' } }, '30d: '), (d30.cachedTokens || 0).toLocaleString() + ' tok (' + d30.hitRatioPct + '%)')
+            )
           );
         })();
 
@@ -2497,6 +2712,7 @@ window.__ModuleLoader__.load({
           ),
           filterBar,
           loadChart,
+          promptCacheWidget,
           h('div', { className: 'krot-keys' }, keyRows),
           modelPools,
       h('div', { className: 'krot-foot' },
@@ -2782,7 +2998,91 @@ window.__ModuleLoader__.load({
           h('span', null, '💾 ' + t('sectionBackup')),
         ),
         h('div', { className: 'krot-section-desc' }, t('sectionBackupDesc')),
-        h('div', { className: 'krot-row' },
+        exportModal ? h('div', { className: 'krot-box', style: { marginBottom: '12px', padding: '12px', border: '1px solid var(--dsw-alias-border-l2)', borderRadius: '6px', background: 'var(--dsw-alias-bg-hover)' } },
+          h('div', { style: { fontWeight: 600, marginBottom: '8px' } }, '📥 ' + (t('exportConfig') || 'Export Pools')),
+          h('label', { style: { display: 'flex', alignItems: 'center', gap: '6px', fontSize: '13px', cursor: 'pointer', marginBottom: '8px' } },
+            h('input', { type: 'checkbox', checked: exportMasked, onChange: (e) => setExportMasked(e.target.checked) }),
+            t('exportSafe') || 'Masked (Safe for sharing)'
+          ),
+          h('div', { style: { display: 'flex', flexDirection: 'column', gap: '4px', marginBottom: '10px' } },
+            h('span', { style: { fontSize: '12px', color: 'var(--dsw-alias-label-secondary)' } }, t('passphraseLabel') || 'Passphrase (optional)'),
+            h('input', {
+              type: 'password',
+              className: 'krot-input',
+              value: exportPassphrase,
+              onChange: (e) => setExportPassphrase(e.target.value),
+              placeholder: t('passphrasePlaceholder') || 'Enter passphrase for AES-256-GCM encryption',
+              style: { maxWidth: '360px' }
+            })
+          ),
+          exportError ? h('div', { className: 'krot-alert krot-alert-bad', style: { marginBottom: '8px' } }, exportError) : null,
+          h('div', { style: { display: 'flex', gap: '8px' } },
+            btn('⬇️ ' + (t('exportConfig') || 'Download JSON'), runExport, { primary: true }),
+            btn(t('cancel'), () => setExportModal(false))
+          )
+        ) : null,
+        importModal ? h('div', { className: 'krot-box', style: { marginBottom: '12px', padding: '12px', border: '1px solid var(--dsw-alias-border-l2)', borderRadius: '6px', background: 'var(--dsw-alias-bg-hover)' } },
+          h('div', { style: { fontWeight: 600, marginBottom: '8px' } }, '📤 ' + (t('importConfig') || 'Import Pools')),
+          h('div', { style: { display: 'flex', gap: '8px', alignItems: 'center', marginBottom: '8px' } },
+            h('label', { className: 'krot-btn', style: { cursor: 'pointer', fontSize: '12px' } },
+              '📁 Choose File',
+              h('input', {
+                type: 'file',
+                accept: '.json',
+                style: { display: 'none' },
+                onChange: (e) => {
+                  const file = e.target.files?.[0];
+                  if (!file) return;
+                  const reader = new FileReader();
+                  reader.onload = (ev) => { setImportText(String(ev.target?.result || '')); };
+                  reader.readAsText(file);
+                }
+              })
+            ),
+            h('span', { style: { fontSize: '12px', opacity: 0.7 } }, 'or paste JSON below')
+          ),
+          h('textarea', {
+            className: 'krot-input',
+            rows: 6,
+            value: importText,
+            onChange: (e) => { setImportText(e.target.value); setImportPreview(null); },
+            placeholder: t('jsonConfigPlaceholder') || 'Paste JSON configuration here...',
+            style: { width: '100%', fontFamily: 'monospace', fontSize: '11px', marginBottom: '8px' }
+          }),
+          h('div', { style: { display: 'flex', gap: '16px', alignItems: 'center', marginBottom: '8px' } },
+            h('label', { style: { display: 'flex', alignItems: 'center', gap: '4px', fontSize: '12px' } },
+              h('input', { type: 'radio', name: 'importMode', checked: importMode === 'merge', onChange: () => setImportMode('merge') }),
+              t('importMerge') || 'Merge'
+            ),
+            h('label', { style: { display: 'flex', alignItems: 'center', gap: '4px', fontSize: '12px' } },
+              h('input', { type: 'radio', name: 'importMode', checked: importMode === 'replace', onChange: () => setImportMode('replace') }),
+              t('importReplace') || 'Replace'
+            )
+          ),
+          h('div', { style: { display: 'flex', flexDirection: 'column', gap: '4px', marginBottom: '10px' } },
+            h('span', { style: { fontSize: '12px', color: 'var(--dsw-alias-label-secondary)' } }, t('passphraseLabel') || 'Passphrase (if encrypted)'),
+            h('input', {
+              type: 'password',
+              className: 'krot-input',
+              value: importPassphrase,
+              onChange: (e) => setImportPassphrase(e.target.value),
+              placeholder: t('passphrasePlaceholder') || 'Enter passphrase for decryption',
+              style: { maxWidth: '360px' }
+            })
+          ),
+          importError ? h('div', { className: 'krot-alert krot-alert-bad', style: { marginBottom: '8px' } }, importError) : null,
+          importPreview ? h('div', { className: 'krot-alert krot-alert-ok', style: { marginBottom: '8px', fontSize: '12px' } },
+            `Preview: ${importPreview.createdProviders?.length || 0} created, ${importPreview.updatedProviders?.length || 0} updated, ${importPreview.keysAdded || 0} keys added, ${importPreview.totalKeys || 0} total keys.`
+          ) : null,
+          h('div', { style: { display: 'flex', gap: '8px' } },
+            btn('🔍 ' + (t('importPreview') || 'Preview Diff'), runImportPreview, { disabled: !importText.trim() || importRunning }),
+            btn('✅ ' + (t('importApply') || 'Apply Configuration'), runImportApply, { primary: true, disabled: !importText.trim() || importRunning }),
+            btn(t('cancel'), () => { setImportModal(false); setImportPreview(null); })
+          )
+        ) : null,
+        h('div', { className: 'krot-row', style: { display: 'flex', gap: '8px', flexWrap: 'wrap' } },
+          btn('📥 ' + (t('exportConfig') || 'Export Pools'), () => { setExportModal((v) => !v); setImportModal(false); }, { primary: exportModal }),
+          btn('📤 ' + (t('importConfig') || 'Import Pools'), () => { setImportModal((v) => !v); setExportModal(false); }, { primary: importModal }),
           btn(t('exportPools'), () => {
             const data = JSON.stringify(val.providers ?? [], null, 2);
             const blob = new Blob([data], { type: 'application/json' });
@@ -3001,31 +3301,34 @@ window.__ModuleLoader__.load({
 
 
 
-    // (issue 201) header chip: one dot + counts for all pools. Green = all healthy,
-    // amber = some keys cooling, red = a pool fully exhausted. Click opens the
-    // same summary the floating dashboard shows.
+    // (issue 201, #499) header chip: one dot + counts for all pools. Green = all healthy,
+    // amber = some keys cooling, red = a pool fully exhausted. Click opens quick actions popover.
     function KeyRotationHeaderChip(props) {
       const t = resolveT(props);
       const [snap, setSnap] = React.useState(null);
       const [open, setOpen] = React.useState(false);
       const [, setTick] = React.useState(0);
+      const [busy, setBusy] = React.useState(false);
       const ref = React.useRef(null);
 
+      const load = () => {
+        if (typeof document !== 'undefined' && document.visibilityState !== 'visible') return;
+        fetch('/dsh-key-rotation/health', {
+          headers: { accept: 'application/json' },
+          credentials: 'same-origin',
+          signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(8000) : undefined
+        })
+          .then((r) => (r.ok ? r.json() : null))
+          .then((d) => { if (d) setSnap(d); })
+          .catch((e) => { void e; });
+      };
+
       React.useEffect(() => {
-        let alive = true;
-        const load = () => {
-          if (typeof document !== 'undefined' && document.visibilityState !== 'visible') return;
-          fetch('/dsh-key-rotation/health', { headers: { accept: 'application/json' }, credentials: 'same-origin', signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(8000) : undefined })
-            .then((r) => (r.ok ? r.json() : null))
-            .then((d) => { if (alive) setSnap(d); })
-            .catch((e) => { void e; });
-        };
         load();
         const id = setInterval(load, 5000);
         const onVis = () => { if (typeof document !== 'undefined' && document.visibilityState === 'visible') load(); };
         if (typeof document !== 'undefined') document.addEventListener('visibilitychange', onVis);
         return () => {
-          alive = false;
           clearInterval(id);
           if (typeof document !== 'undefined') document.removeEventListener('visibilitychange', onVis);
         };
@@ -3047,6 +3350,21 @@ window.__ModuleLoader__.load({
         return () => document.removeEventListener('click', onDocClick);
       }, [open]);
 
+      const runAction = (action, provider, keyRef) => {
+        setBusy(true);
+        fetch('/dsh-key-rotation/quick-action', {
+          method: 'POST',
+          headers: { 'content-type': 'application/json', accept: 'application/json' },
+          body: JSON.stringify({ action, provider, ref: keyRef }),
+          credentials: 'same-origin',
+          signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(5000) : undefined,
+        })
+          .then((r) => r.json())
+          .then(() => { load(); })
+          .catch((err) => { void err; })
+          .finally(() => { setBusy(false); });
+      };
+
       let settingsVal = null;
       try {
         const sSnap = props?.settingsSource?.getSnapshot?.()?.service?.getSnapshot?.();
@@ -3076,17 +3394,45 @@ window.__ModuleLoader__.load({
           label,
           h('span', { style: { fontSize: '9px', opacity: 0.6 } }, open ? '▲' : '▼')
         ),
-        open ? h('div', { className: 'krot-popover' },
+        open ? h('div', { className: 'krot-popover', style: { minWidth: '220px' } },
           h('div', { className: 'krot-pop-title' }, t('headerPoolsTitle')),
           !poolEntries.length ? h('div', { style: { fontSize: '12px', color: 'var(--dsw-alias-label-tertiary)' } }, t('noActivePools')) : null,
           poolEntries.map(([name, p]) => {
             const c = p.exhausted ? 'var(--dsw-alias-state-error-primary)' : (p.healthy < p.total ? 'var(--dsw-alias-state-warn-primary)' : 'var(--dsw-alias-state-success-primary)');
-            return h('div', { key: name, className: 'krot-pop-row' },
-              h('div', { className: 'krot-pop-name' },
-                h('span', { style: { width: '7px', height: '7px', borderRadius: '50%', background: c, flex: 'none' } }),
-                name
+            const provName = p.providerName || name;
+            const tail = p.lastUsedTail;
+            return h('div', { key: name, className: 'krot-pop-row', style: { display: 'flex', flexDirection: 'column', gap: '4px', padding: '6px 0', borderBottom: '1px solid var(--dsw-alias-border-subtle)' } },
+              h('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center' } },
+                h('div', { className: 'krot-pop-name' },
+                  h('span', { style: { width: '7px', height: '7px', borderRadius: '50%', background: c, flex: 'none' } }),
+                  name,
+                  tail ? h('span', { style: { marginLeft: '6px', fontSize: '11px', color: 'var(--dsw-alias-label-tertiary)', fontFeatureSettings: '"tnum"', fontFamily: 'monospace' } }, `...${tail}`) : null
+                ),
+                h('div', { className: 'krot-pop-count', style: { color: c, fontWeight: 600 } }, `${p.healthy}/${p.total}`)
               ),
-              h('div', { className: 'krot-pop-count', style: { color: c } }, `${p.healthy}/${p.total}`)
+              h('div', { style: { display: 'flex', gap: '4px', marginTop: '2px' } },
+                h('button', {
+                  type: 'button',
+                  disabled: busy,
+                  onClick: (e) => { e.stopPropagation(); runAction('skip', provName, p.lastUsed); },
+                  title: t('quickSkipTitle'),
+                  style: { padding: '2px 6px', fontSize: '11px', borderRadius: '4px', border: '1px solid var(--dsw-alias-border-subtle)', background: 'transparent', cursor: 'pointer', color: 'inherit' }
+                }, `⏭️ ${t('quickSkip')}`),
+                h('button', {
+                  type: 'button',
+                  disabled: busy,
+                  onClick: (e) => { e.stopPropagation(); runAction('reset', provName, p.lastUsed); },
+                  title: t('quickResetTitle'),
+                  style: { padding: '2px 6px', fontSize: '11px', borderRadius: '4px', border: '1px solid var(--dsw-alias-border-subtle)', background: 'transparent', cursor: 'pointer', color: 'inherit' }
+                }, `🔄 ${t('quickReset')}`),
+                h('button', {
+                  type: 'button',
+                  disabled: busy || !p.lastUsed,
+                  onClick: (e) => { e.stopPropagation(); runAction('pause', provName, p.lastUsed); },
+                  title: t('quickPauseTitle'),
+                  style: { padding: '2px 6px', fontSize: '11px', borderRadius: '4px', border: '1px solid var(--dsw-alias-border-subtle)', background: 'transparent', cursor: 'pointer', color: 'inherit' }
+                }, `⏸️ ${t('quickPause')}`)
+              )
             );
           })
         ) : null