@goodandready/dsh-key-rotation 0.8.7 → 0.8.10

package/lib/routes-ops.js

@@ -8,6 +8,7 @@ import {
   NS,
 } from './http-bridge.js';
 import {
+  isLoopbackAddress,
   isTrustedBridgeRequest,
   keyTail,
   envValue,
@@ -48,6 +49,7 @@ export function registerOpsRoutes(ctx, deps) {
     getRotationDisabled,
     setRotationDisabled,
     circuitBreaker,
+    quotaStore,
   } = deps;
 
   // ── status route: what the settings card cannot know on its own ──
@@ -149,7 +151,7 @@ export function registerOpsRoutes(ctx, deps) {
           totalUsage: (() => { let s = 0; if (pool.state.usageCounts) for (const v of pool.state.usageCounts.values()) s += v; return s; })(),
           // #225: aggregate p95 across the pool's keys
           p95: (() => {
-            const vals = (pool.refs ?? []).map((r) => latencyHistogram.snapshot(r)).filter((s) => s && s.p95 != null).map((s) => s.p95);
+            const vals = (pool.refs ?? []).map((r) => (typeof latencyHistogram?.snapshot === 'function' ? latencyHistogram.snapshot(r) : null)).filter((s) => s && s.p95 != null).map((s) => s.p95);
             return vals.length ? Math.round(Math.max(...vals)) : null;
           })(),
           latencySloMs,
@@ -158,9 +160,11 @@ export function registerOpsRoutes(ctx, deps) {
           // #208: today/week spend + configured budget for the card
           todayCost: costForDay(pool.state.costDays),
           weeklyCost: costForWeek(pool.state.costDays, now),
-          budgetDaily: providerBudgets.get(pool.base)?.costBudgetDaily ?? 0,
-          budgetWeekly: providerBudgets.get(pool.base)?.costBudgetWeekly ?? 0,
-          pauseOnBudget: providerBudgets.get(pool.base)?.pauseOnBudget ?? false,
+          budgetDaily: (providerBudgets?.get ? providerBudgets.get(pool.base) : providerBudgets?.[pool.base])?.costBudgetDaily ?? 0,
+          budgetWeekly: (providerBudgets?.get ? providerBudgets.get(pool.base) : providerBudgets?.[pool.base])?.costBudgetWeekly ?? 0,
+          pauseOnBudget: (providerBudgets?.get ? providerBudgets.get(pool.base) : providerBudgets?.[pool.base])?.pauseOnBudget ?? false,
+          routingStrategy: pool.routingStrategy ?? runtime.routingStrategy ?? 'round-robin',
+          proactiveRateLimitGuard: pool.proactiveRateLimitGuard ?? runtime.proactiveRateLimitGuard ?? true,
         });
         } catch (e) {
           console.warn(`[dsh-key-rotation] status: pool ${pool.base} failed: ${String(e?.message ?? e)} ${e?.stack ?? ''}`);
@@ -305,6 +309,14 @@ export function registerOpsRoutes(ctx, deps) {
       try {
         if (req.method === 'DELETE') {
           await credentialsService.unset(ref);
+          for (const st of poolState.values()) {
+            st.failedUntil?.delete(ref);
+            st.failCounts?.delete(ref);
+            st.authFailCounts?.delete(ref);
+            st.brokenUntil?.delete(ref);
+            if (st.lastUsed === ref) st.lastUsed = undefined;
+          }
+          try { lastTestCache?.delete?.(ref); } catch (_) {}
           json(res, 200, { ok: true, ref });
           return;
         }
@@ -366,8 +378,8 @@ export function registerOpsRoutes(ctx, deps) {
       if (ref) {
         let found = false;
         for (const st of poolState.values()) {
-          if (st.failedUntil.has(ref) || st.failCounts?.has(ref)) {
-            st.failedUntil.delete(ref);
+          if (st.failedUntil?.has(ref) || st.failCounts?.has(ref) || st.authFailCounts?.has(ref) || st.brokenUntil?.has(ref)) {
+            st.failedUntil?.delete(ref);
             st.failCounts?.delete(ref);
             st.authFailCounts?.delete(ref);
             st.brokenUntil?.delete(ref);
@@ -445,7 +457,7 @@ export function registerOpsRoutes(ctx, deps) {
         if (exhausted) exhaustedAny = true;
         pools[pool.base] = { healthy, total, exhausted, healthScore: computeHealthScore(pool.state) };
       }
-      json(res, 200, { status: exhaustedAny ? 'degraded' : 'ok', pools, exhaustedAny, latency: latencyHistogram.snapshotAll(), quota: quotaStore.snapshot() });
+      json(res, 200, { status: exhaustedAny ? 'degraded' : 'ok', pools, exhaustedAny, latency: latencyHistogram.snapshotAll(), quota: typeof quotaStore?.snapshot === 'function' ? quotaStore.snapshot() : null });
     },
   }), 'dsh-key-rotation: health');
 
@@ -513,7 +525,10 @@ export function registerOpsRoutes(ctx, deps) {
     path: SANDBOX_CACHE_PATH,
     handler: (req, res) => {
       if (!isTrustedBridgeRequest(req)) { json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: cache is local-only' } }); return; }
-      json(res, 200, lastTestCache.snapshot());
+      const cacheSnap = typeof lastTestCache?.snapshot === 'function'
+        ? lastTestCache.snapshot()
+        : (lastTestCache instanceof Map ? Object.fromEntries(lastTestCache) : (lastTestCache ?? {}));
+      json(res, 200, cacheSnap);
     },
   }), 'dsh-key-rotation: sandbox cache');
 
@@ -594,9 +609,21 @@ export function registerOpsRoutes(ctx, deps) {
             return;
           }
           const cleared = st.failedUntil.size;
-          st.failedUntil.clear(); st.failCounts?.clear(); st.brokenUntil?.clear();
-          console.warn(`[dsh-key-rotation] pool ${provider} RESET via webhook action`);
-          json(res, 200, { ok: true, action, provider, cleared });
+          st.failedUntil.clear();
+          st.failCounts?.clear();
+          st.authFailCounts?.clear();
+          st.brokenUntil?.clear();
+          st.switches = 0;
+          st.lastReason = undefined;
+          st.lastSwitchAt = undefined;
+          let circuitReset = false;
+          const br = circuitBreaker ?? buildRuntime().breaker;
+          if (br) {
+            if (typeof br.reset === 'function') { br.reset(provider); circuitReset = true; }
+            else if (typeof br.onSuccess === 'function') { br.onSuccess(provider); circuitReset = true; }
+          }
+          console.warn(`[dsh-key-rotation] pool ${provider} RESET via webhook action (circuitReset=${circuitReset})`);
+          json(res, 200, { ok: true, action, provider, cleared, circuitReset });
           return;
         }
         json(res, 400, { error: { code: 'unknown-action', message: `dsh-key-rotation: unknown action '${action}'` } });

package/lib/sandbox.js

@@ -83,7 +83,15 @@ export class SandboxRunner {
         res = await doFetch();
       } catch (e) {
         if (e && e.name === 'AbortError') return { ok: false, code: 'timeout', latencyMs: Date.now() - started };
-        return { ok: false, code: 'network', latencyMs: Date.now() - started };
+        // ponytail: 1 retry on transient socket network errors before marking broken
+        await new Promise((r) => setTimeout(r, PROBE_RETRY_DELAY_MS));
+        if (ctrl.signal.aborted) return { ok: false, code: 'timeout', latencyMs: Date.now() - started };
+        try {
+          res = await doFetch();
+        } catch (e2) {
+          if (e2 && e2.name === 'AbortError') return { ok: false, code: 'timeout', latencyMs: Date.now() - started };
+          return { ok: false, code: 'network', latencyMs: Date.now() - started };
+        }
       }
       // ponytail: 1 retry on 5xx — naive; classifier refines if needed
       if (res.status >= 500 && res.status < 600) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.7",
+  "version": "0.8.10",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [