@goodandready/dsh-key-rotation 0.8.71 → 0.8.73

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 0.8.73 (2026-10-30)
+
+### Security & Hardening (Block 1 Security Release)
+- **Origin & Bridge Guard**: Reject unauthenticated mutating requests without Origin/Referer (#516).
+- **Key Endpoint Protection**: Forbid plaintext credential reveal via `GET /dsh-key-rotation/key` (403 Forbidden) (#543).
+- **Safe Export Webhook Masking**: Mask real `notifyWebhook` URLs and embedded credentials during masked config exports (#532).
+- **Secure Export Passphrase Transport**: Passphrase for encrypted exports is now transmitted via `POST` JSON body instead of URL query string (#552).
+- **Selection Trace Sanitization**: Redact upstream API tokens and error details before recording steps to selection trace (#537).
+- **Fail-Closed Balance & Probe Inspection**: Prevent sending ciphertext credentials (`enc:v1:...`) upstream if decryption fails (#539).
+- **PBKDF2 Iteration Bounds & Async KDF**: Enforce strict iteration limits (`10000..200000`) and async derivation to eliminate event-loop blocking DoS (#542).
+
+## [0.8.72] — 2026-10-23
+
+### Security
+- **Fail-closed write-origin guard (#516):** Mutating HTTP methods (`POST`, `PUT`, `PATCH`, `DELETE`) without `Origin` header are now rejected with `403 Forbidden` unless positively identified as the Desktop shell (UA contains `@deepseek-ai/dsh-desktop/` AND Cookie contains `dsh-auth-`). Previously, any LAN/Tailscale client whose requests were forwarded via `dsh-lanmode` (loopback socket) could bypass source validation on all write routes.
+- **`/auto-import` fail-closed body validation (#516):** Invalid JSON body now returns `400 Bad Request` instead of silently importing all discovered keys. Auto-import requires explicit `refs` array or `all: true`.
+
+### Added
+- `isDesktopShellRequest(req)` predicate in `lib/pool.js` for positive Desktop shell identification.
+- `test/issue-516-write-origin-guard.test.mjs` — dedicated regression test suite (3 tests).
+
+### Changed
+- `isTrustedBridgeRequest` in `lib/pool.js`: absent Origin on write requests now checks Desktop shell credentials or same-origin Referer before passing.
+- Client card `runAutoImport` sends `{ all: true }` instead of `{}`.
+- Updated 7 existing test files to match new fail-closed semantics.
+- Updated `README.md`, `README.zh.md`, `docs/design/DESIGN.md`.
+
 ## 0.8.71 - 2026-10-22
 
 ### Bug Fixes

package/README.md

@@ -303,7 +303,7 @@ Access full visual management under **Settings → Key Rotation** or via the Hea
 * **Zero Plaintext Secrets in Plugin Config**: Configuration files store only environment variable reference names (e.g. `MY_PROVIDER_API_KEY`).
 * **Secure Vault Storage**: Actual secret values reside securely in `$DSH_HOME/.credentials.yaml` managed by the DSH `Credentials` service.
 * **5-Character Masking (`keyTail`)**: Full secret values are never sent to the client browser; only the trailing 5 characters are exposed for visual identification. Short keys (<= 5 characters) return a fixed masked placeholder (`***`) to prevent credential disclosure.
-* **Fail-Closed Loopback & Same-Origin Fencing**: Administrative endpoints strictly enforce loopback checks (`isTrustedBridgeRequest`): the socket peer and the `Host` header must both be loopback (`127.0.0.1`, `::1`, `localhost`), and `sec-fetch-site: cross-site` is always refused. An attached `Origin` must be an http(s) loopback origin matching `Host` exactly. `Origin` is required on `POST`/`PUT`/`PATCH`/`DELETE` but optional on `GET`/`HEAD`/`OPTIONS`, because browsers omit it on same-origin reads — requiring it there would reject the Settings card's own requests.
+* **Fail-Closed Loopback, Same-Origin & Write-Origin Guard**: Administrative endpoints strictly enforce loopback checks (`isTrustedBridgeRequest`): the socket peer and the `Host` header must both be loopback (`127.0.0.1`, `::1`, `localhost`), and `sec-fetch-site: cross-site` is always refused. An attached `Origin` must be an http(s) loopback origin matching `Host` exactly. `Origin` is required on mutating methods (`POST`/`PUT`/`PATCH`/`DELETE`) — requests without `Origin` pass only if they carry positive Desktop shell identification (`@deepseek-ai/dsh-desktop/` in `User-Agent` AND `dsh-auth-` session cookie) or a same-origin `Referer`. `GET`/`HEAD`/`OPTIONS` remain unrestricted as browsers omit `Origin` on same-origin reads.
 * **Fail-Closed Resolver on Pool Exhaustion**: When all credentials in a managed pool are exhausted, paused, expired, or blocked by RPM/TPM limits, the resolver fails closed with `LOCAL_POOL_EXHAUSTED` error rather than falling back to leaking unmanaged credentials.
 * **SSRF Protection & Rebinding Guard**: Remote provider pool import strictly enforces HTTPS-only URLs, validates all resolved IP addresses including IPv4-mapped and IPv4-compatible IPv6 addresses (`::ffff:127.0.0.1`, `::ffff:7f00:1`, `64:ff9b::/96`), and enforces connect-time DNS validation via undici agent dispatchers to prevent TOCTOU DNS rebinding.
 * **Cross-Pool Revocation & Inheritance**: Model pools automatically inherit pause, revoke, and expiry states from their base provider; runtime 401 permanent authentication failures revoke the credential across all shared pools immediately.

package/README.zh.md

@@ -265,7 +265,7 @@ claude-sonnet 请求
 * **配置零明文**：插件配置仅保存环境变量引用名（如 `MY_PROVIDER_API_KEY`）。
 * **宿主安全存储**：真实密钥持久化保存在 `$DSH_HOME/.credentials.yaml`。
 * **前台 5 字符脱敏**：前端仅展示密钥后 5 位字符进行视觉区分。对于长度 <= 5 的短密钥，返回统一脱敏占位符 (`***`)，防止凭证完整泄露。
-* **Fail-Closed 环回同源安全隔离**：管理接口严格通过 `isTrustedBridgeRequest` 校验：套接字对端与 `Host` 头必须均为环回地址（`127.0.0.1`、`::1`、`localhost`），并始终拒绝 `sec-fetch-site: cross-site`。若请求携带 `Origin`，则必须是 http(s) 环回源且与 `Host` 完全一致。`POST`/`PUT`/`PATCH`/`DELETE` 必须携带 `Origin`，而 `GET`/`HEAD`/`OPTIONS` 允许省略——因为浏览器在同源读取请求中不会发送该头，强制要求会连带拒绝设置面板自身的请求。
+* **Fail-Closed 环回同源安全隔离及写操作 Origin 守卫**：管理接口严格通过 `isTrustedBridgeRequest` 校验：套接字对端与 `Host` 头必须均为环回地址（`127.0.0.1`、`::1`、`localhost`），并始终拒绝 `sec-fetch-site: cross-site`。若请求携带 `Origin`，则必须是 http(s) 环回源且与 `Host` 完全一致。变更方法（`POST`/`PUT`/`PATCH`/`DELETE`）无 `Origin` 时，仅允许通过明确 Desktop 外壳身份识别（`User-Agent` 含 `@deepseek-ai/dsh-desktop/` 且 Cookie 含 `dsh-auth-`）或同源 `Referer` 的请求。`GET`/`HEAD`/`OPTIONS` 保持不限制，因为浏览器同源读取时不发送 `Origin`。
 * **凭证池耗尽 Fail-Closed 熔断**：当受管凭证池中所有密钥均被耗尽、暂停、过期或触发 RPM/TPM 限制时，解析器立即返回 `LOCAL_POOL_EXHAUSTED` 错误熔断，杜绝静默回退泄漏未受控原始密钥。
 * **SSRF 与 DNS 重绑定防护**：远程配置导入严格仅支持 HTTPS，全面校验解析 IP 并拦截 IPv4-mapped/IPv4-compatible 等各类 IPv6 环回变体（如 `::ffff:127.0.0.1`、`::ffff:7f00:1`、`64:ff9b::/96`），并通过 undici 调度器执行连接时（connect-time）DNS 校验，从根本上防御 TOCTOU DNS 重绑定。
 * **跨池吊销与状态继承**：模型子池自动继承基础提供商的暂停、吊销与过期时间；运行时 401 永久认证失败将即时在所有关联共享池中统一标记吊销。

package/lib/balance-inspector.js

@@ -169,7 +169,15 @@ export async function inspectBalanceForRef(ctx, ref, provider, { testValue, fetc
   let rawValue = testValue || hit?.value;
   if (!rawValue && process.env[ref]) rawValue = process.env[ref];
   if (typeof rawValue === 'string' && rawValue.startsWith('enc:v1:')) {
-    rawValue = decryptSecret(rawValue);
+    try {
+      const dec = decryptSecret(rawValue);
+      if (!dec || dec === rawValue || dec.startsWith('enc:v1:')) {
+        return { ok: false, error: 'failed to decrypt credential: missing or invalid DSH_KEY_SECRET' };
+      }
+      rawValue = dec;
+    } catch (err) {
+      return { ok: false, error: `failed to decrypt credential: ${err.message}` };
+    }
   }
   if (!rawValue) return { ok: false, error: 'no credential' };
   return checkProviderBalance(provider, rawValue, { fetchImpl, timeoutMs });

package/lib/client.js

@@ -1276,13 +1276,24 @@ window.__ModuleLoader__.load({
       const runExport = async () => {
         setExportError('');
         try {
-          const q = new URLSearchParams();
-          q.set('masked', exportMasked ? 'true' : 'false');
-          if (exportPassphrase.trim()) q.set('passphrase', exportPassphrase.trim());
-          const res = await fetch(`/dsh-key-rotation/export?${q.toString()}`, {
-            headers: { accept: 'application/json' },
-            signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
-          });
+          const passphrase = exportPassphrase.trim();
+          let res;
+          if (passphrase) {
+            // Secure POST transmission for encrypted export (#552)
+            res = await fetch('/dsh-key-rotation/export', {
+              method: 'POST',
+              headers: { 'content-type': 'application/json', accept: 'application/json' },
+              body: JSON.stringify({ masked: exportMasked, passphrase }),
+              signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
+            });
+          } else {
+            const q = new URLSearchParams();
+            q.set('masked', exportMasked ? 'true' : 'false');
+            res = await fetch(`/dsh-key-rotation/export?${q.toString()}`, {
+              headers: { accept: 'application/json' },
+              signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
+            });
+          }
           const data = await res.json();
           if (!res.ok || !data.ok) throw new Error(data?.error?.message || 'Export failed');
           const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' });
@@ -1410,7 +1421,7 @@ window.__ModuleLoader__.load({
           const res = await fetch('/dsh-key-rotation/auto-import', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({}),
+            body: JSON.stringify({ all: true }),
             signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(8000) : undefined,
           });
           const data = await res.json();

package/lib/crypto-storage.js

@@ -47,3 +47,28 @@ export function decryptSecret(ciphertext, secretKey = process.env.DSH_KEY_SECRET
     return ciphertext;
   }
 }
+
+/**
+ * Decrypt ciphertext using AES-256-GCM.
+ * Fails closed by throwing or returning null if decryption fails or secretKey is missing.
+ */
+export function decryptSecretFailClosed(ciphertext, secretKey = process.env.DSH_KEY_SECRET) {
+  if (!ciphertext || typeof ciphertext !== 'string') return ciphertext;
+  if (!ciphertext.startsWith('enc:v1:')) return ciphertext; // plaintext is allowed as-is
+  if (!secretKey) {
+    throw new Error('DSH_KEY_SECRET is required to decrypt credential');
+  }
+  const parts = ciphertext.slice('enc:v1:'.length).split(':');
+  if (parts.length !== 3) {
+    throw new Error('Malformed encrypted secret payload');
+  }
+  const [ivHex, tagHex, dataHex] = parts;
+  const key = crypto.createHash('sha256').update(String(secretKey)).digest();
+  const iv = Buffer.from(ivHex, 'hex');
+  const authTag = Buffer.from(tagHex, 'hex');
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+  decipher.setAuthTag(authTag);
+  let decrypted = decipher.update(dataHex, 'hex', 'utf8');
+  decrypted += decipher.final('utf8');
+  return decrypted;
+}

package/lib/http-bridge.js

@@ -1,7 +1,7 @@
 // lib/http-bridge.js — shared HTTP helpers for dsh-key-rotation routes.
 import { findSecrets } from './keycheck.js';
-import { isTrustedBridgeRequest } from './pool.js';
-export { isTrustedBridgeRequest };
+import { isTrustedBridgeRequest, isDesktopShellRequest } from './pool.js';
+export { isTrustedBridgeRequest, isDesktopShellRequest };
 import { mutateSettings, plainObject, requireRevision, sectionOps, validateOps } from './settings-write.js';
 
 export const NS = 'dsh-key-rotation';

package/lib/index.js

@@ -10,7 +10,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 import Schema from '@deepseek-ai/schemastery';
 import { createConfigReader, createProviderProfilesReader } from './config-compat.js';
 import {
-  keyTail, KEY_TAIL_CHARS, KEY_TAIL_PLACEHOLDER, isLoopbackAddress, isTrustedBridgeRequest, SWITCHABLE_MESSAGE_PATTERN,
+  keyTail, KEY_TAIL_CHARS, KEY_TAIL_PLACEHOLDER, isLoopbackAddress, isTrustedBridgeRequest, isDesktopShellRequest, SWITCHABLE_MESSAGE_PATTERN,
   DEFAULT_SWITCH_CODES, isValidRef, pickNext, applyCooldown, recordFailure,
   recordSuccess, computeBackoff, envValue, sweepExpired, parseRetryAfter,
   computeHealthScore, extractRateLimit, isRateLimited, selectPool, isSwitchableError,
@@ -52,7 +52,7 @@ import { setupIdleHealEffect, setupAutoUnbreakEffect, setupPersistence, setupPro
 
 export const name = '@goodandready/dsh-key-rotation';
 export const inject = ['llm', 'webServer', 'settings', 'credentials'];
-export { keyTail, KEY_TAIL_CHARS, KEY_TAIL_PLACEHOLDER, isLoopbackAddress, isTrustedBridgeRequest, DEFAULT_SWITCH_CODES, isSwitchableError, formatExhaustionMessage, getRuntime };
+export { keyTail, KEY_TAIL_CHARS, KEY_TAIL_PLACEHOLDER, isLoopbackAddress, isTrustedBridgeRequest, isDesktopShellRequest, DEFAULT_SWITCH_CODES, isSwitchableError, formatExhaustionMessage, getRuntime };
 export { notifySwitch, notifyExhaustion, notifyEarlyWarning };
 
 const NS = 'dsh-key-rotation';

package/lib/ops-config-io.js

@@ -12,9 +12,43 @@ import { CONFIG_EXPORT_PATH, CONFIG_IMPORT_PATH, IMPORT_PATH } from './ops-paths
 import { keyTail } from './pool.js';
 import { plainConfig } from './index.js';
 
+export const MAX_PBKDF2_ITERATIONS = 200000;
+export const MIN_PBKDF2_ITERATIONS = 10000;
+export const DEFAULT_PBKDF2_ITERATIONS = 100000;
+
+export function deriveKeyAsync(passphrase, salt, iterations) {
+  return new Promise((resolve, reject) => {
+    crypto.pbkdf2(passphrase, salt, iterations, 32, 'sha256', (err, derivedKey) => {
+      if (err) reject(err);
+      else resolve(derivedKey);
+    });
+  });
+}
+
+function validateAndExtractCryptoParams(payload) {
+  if (!payload || typeof payload !== 'object') {
+    throw new Error('Invalid encrypted config payload structure');
+  }
+  if (!payload.salt || !payload.iv || !payload.tag || !payload.ciphertext) {
+    throw new Error('Missing salt, iv, tag or ciphertext in payload');
+  }
+  const iters = Number(payload.iterations) || DEFAULT_PBKDF2_ITERATIONS;
+  if (!Number.isFinite(iters) || iters < MIN_PBKDF2_ITERATIONS || iters > MAX_PBKDF2_ITERATIONS) {
+    throw new Error(`PBKDF2 iterations must be between ${MIN_PBKDF2_ITERATIONS} and ${MAX_PBKDF2_ITERATIONS}`);
+  }
+  const salt = Buffer.from(payload.salt, 'hex');
+  const iv = Buffer.from(payload.iv, 'hex');
+  const tag = Buffer.from(payload.tag, 'hex');
+  const ciphertext = Buffer.from(payload.ciphertext, 'hex');
+  if (salt.length !== 16 || iv.length !== 12 || tag.length !== 16) {
+    throw new Error('Malformed salt, iv or auth tag length in encrypted payload');
+  }
+  return { iters, salt, iv, tag, ciphertext };
+}
+
 export function encryptConfig(plainText, passphrase) {
   const salt = crypto.randomBytes(16);
-  const key = crypto.pbkdf2Sync(passphrase, salt, 100000, 32, 'sha256');
+  const key = crypto.pbkdf2Sync(passphrase, salt, DEFAULT_PBKDF2_ITERATIONS, 32, 'sha256');
   const iv = crypto.randomBytes(12);
   const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
   const encrypted = Buffer.concat([cipher.update(plainText, 'utf8'), cipher.final()]);
@@ -23,7 +57,7 @@ export function encryptConfig(plainText, passphrase) {
     encrypted: true,
     algorithm: 'aes-256-gcm',
     kdf: 'pbkdf2',
-    iterations: 100000,
+    iterations: DEFAULT_PBKDF2_ITERATIONS,
     salt: salt.toString('hex'),
     iv: iv.toString('hex'),
     tag: tag.toString('hex'),
@@ -32,14 +66,17 @@ export function encryptConfig(plainText, passphrase) {
 }
 
 export function decryptConfig(payload, passphrase) {
-  if (!payload || !payload.salt || !payload.iv || !payload.tag || !payload.ciphertext) {
-    throw new Error('Invalid encrypted config payload structure');
-  }
-  const salt = Buffer.from(payload.salt, 'hex');
-  const iv = Buffer.from(payload.iv, 'hex');
-  const tag = Buffer.from(payload.tag, 'hex');
-  const ciphertext = Buffer.from(payload.ciphertext, 'hex');
-  const key = crypto.pbkdf2Sync(passphrase, salt, payload.iterations || 100000, 32, 'sha256');
+  const { iters, salt, iv, tag, ciphertext } = validateAndExtractCryptoParams(payload);
+  const key = crypto.pbkdf2Sync(passphrase, salt, iters, 32, 'sha256');
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+  decipher.setAuthTag(tag);
+  const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return decrypted.toString('utf8');
+}
+
+export async function decryptConfigAsync(payload, passphrase) {
+  const { iters, salt, iv, tag, ciphertext } = validateAndExtractCryptoParams(payload);
+  const key = await deriveKeyAsync(passphrase, salt, iters);
   const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
   decipher.setAuthTag(tag);
   const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
@@ -65,19 +102,30 @@ export function maskConfig(config) {
       }
     }
   }
-  if (clone.webhookUrl && typeof clone.webhookUrl === 'string') {
+  function maskWebhookString(val) {
+    if (!val || typeof val !== 'string') return val;
     try {
-      const u = new URL(clone.webhookUrl);
+      const u = new URL(val);
+      if (u.username) u.username = '***';
+      if (u.password) u.password = '***';
+      if (u.search) u.search = '?token=***';
       const parts = u.pathname.split('/');
       if (parts.length > 2) {
         parts[parts.length - 1] = '***';
         u.pathname = parts.join('/');
       }
-      clone.webhookUrl = u.toString();
+      return u.toString();
     } catch (_) {
-      clone.webhookUrl = '***';
+      return '***';
     }
   }
+
+  if (clone.webhookUrl) {
+    clone.webhookUrl = maskWebhookString(clone.webhookUrl);
+  }
+  if (clone.notifyWebhook) {
+    clone.notifyWebhook = maskWebhookString(clone.notifyWebhook);
+  }
   if (clone.webhookActionToken) clone.webhookActionToken = '***';
   return clone;
 }
@@ -138,13 +186,13 @@ export function diffConfigs(currentConfig, incomingConfig, mode = 'merge') {
 }
 
 export function registerConfigIoRoutes(ctx, deps) {
-  // ── GET /dsh-key-rotation/export ──
+  // ── GET & POST /dsh-key-rotation/export (#552: support POST for safe passphrase transmission) ──
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: CONFIG_EXPORT_PATH,
     handler: async (req, res) => {
-      if (req.method !== 'GET') {
-        json(res, 405, { error: { code: 'method', message: 'GET only' } });
+      if (req.method !== 'GET' && req.method !== 'POST') {
+        json(res, 405, { error: { code: 'method', message: 'GET or POST only' } });
         return;
       }
       if (!isTrustedBridgeRequest(req)) {
@@ -152,10 +200,29 @@ export function registerConfigIoRoutes(ctx, deps) {
         return;
       }
 
-      const urlObj = new URL(req.url, 'http://127.0.0.1');
-      const maskedParam = urlObj.searchParams.get('masked');
-      const masked = maskedParam === null ? true : maskedParam !== 'false';
-      const passphrase = urlObj.searchParams.get('passphrase') || null;
+      let masked = true;
+      let passphrase = null;
+
+      if (req.method === 'POST') {
+        let body = {};
+        try {
+          body = await readJson(req);
+        } catch (_) {
+          body = {};
+        }
+        masked = body.masked !== false;
+        passphrase = typeof body.passphrase === 'string' && body.passphrase.trim() ? body.passphrase.trim() : null;
+      } else {
+        const urlObj = new URL(req.url, 'http://127.0.0.1');
+        const maskedParam = urlObj.searchParams.get('masked');
+        masked = maskedParam === null ? true : maskedParam !== 'false';
+        if (urlObj.searchParams.has('passphrase')) {
+          passphrase = urlObj.searchParams.get('passphrase') || null;
+          try {
+            res.setHeader?.('X-Deprecated-Security-Warning', 'Passphrase in query string is deprecated and will be removed; use POST /dsh-key-rotation/export with body');
+          } catch (_) {}
+        }
+      }
 
       const settings = ctx.get('settings');
       let currentConfig = {};
@@ -176,16 +243,21 @@ export function registerConfigIoRoutes(ctx, deps) {
       const exportData = masked ? maskConfig(rawConfig) : rawConfig;
 
       if (passphrase) {
-        const encryptedPayload = encryptConfig(JSON.stringify(exportData), passphrase);
-        json(res, 200, {
-          ok: true,
-          version: PLUGIN_VERSION,
-          exportedAt: new Date().toISOString(),
-          masked,
-          encrypted: true,
-          ...encryptedPayload,
-        });
-        return;
+        try {
+          const encryptedPayload = await encryptConfig(JSON.stringify(exportData), passphrase);
+          json(res, 200, {
+            ok: true,
+            version: PLUGIN_VERSION,
+            exportedAt: new Date().toISOString(),
+            masked,
+            encrypted: true,
+            ...encryptedPayload,
+          });
+          return;
+        } catch (err) {
+          json(res, 500, { error: { code: 'encryption-failed', message: err.message } });
+          return;
+        }
       }
 
       json(res, 200, {
@@ -227,7 +299,7 @@ export function registerConfigIoRoutes(ctx, deps) {
         return;
       }
       try {
-        const decryptedStr = decryptConfig(body, passphrase);
+        const decryptedStr = await decryptConfigAsync(body, passphrase);
         incomingConfig = JSON.parse(decryptedStr);
       } catch (err) {
         json(res, 400, { error: { code: 'decryption-failed', message: `Decryption failed: ${err.message}` } });

package/lib/ops-keys.js

@@ -232,27 +232,8 @@ ctx.effect(() => ctx.webServer.register({
     }
     const credentialsService = ctx.get('credentials');
     if (req.method === 'GET') {
-      const url = new URL(req.url, 'http://127.0.0.1');
-      const ref = url.searchParams.get('ref')?.trim();
-      if (!isValidRef(ref)) {
-        json(res, 400, { error: { code: 'bad-ref', message: 'dsh-key-rotation: ref must be an environment variable name' } });
-        return;
-      }
-      try {
-        let hit = await (credentialsService?.__dshKeyRotationOriginalResolve ?? credentialsService?.resolve)?.call(credentialsService, ref);
-        let raw = hit?.value;
-        if (!raw) {
-          raw = envValue(ref);
-        }
-        if (!raw) {
-          json(res, 404, { error: { code: 'not-found', message: `dsh-key-rotation: secret for "${ref}" not found` } });
-          return;
-        }
-        const plain = decryptSecret(raw);
-        json(res, 200, { ref, plaintext: plain, tail: keyTail(plain) });
-      } catch (err) {
-        json(res, 500, { error: { code: 'reveal-failed', message: String(err?.message ?? err) } });
-      }
+      // Disallow plaintext key reveal without authorized session (#543)
+      json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: plaintext key extraction via GET is forbidden' } });
       return;
     }
     if (!credentialsService || typeof credentialsService.set !== 'function') {
@@ -464,19 +445,24 @@ ctx.effect(() => ctx.webServer.register({
       json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: auto-import is local-only' } });
       return;
     }
-    let body = {};
-    try { body = await readJson(req); } catch (_) { body = {}; }
+    let body;
+    try {
+      body = await readJson(req);
+    } catch (e) {
+      json(res, 400, { error: { code: 'bad-request', message: e.message || 'invalid request body' } });
+      return;
+    }
+    const hasRefs = Array.isArray(body?.refs) && body.refs.length > 0;
+    if (!hasRefs && body?.all !== true) {
+      json(res, 400, { error: { code: 'bad-request', message: 'auto-import requires explicit "refs" array or "all: true"' } });
+      return;
+    }
 
     try {
       const runtime = deps.buildRuntime?.() ?? {};
       const discovered = await discoverUnconfiguredKeys(ctx, runtime.pools || []);
-      const targetRefs = Array.isArray(body?.refs) && body.refs.length > 0
-        ? new Set(body.refs)
-        : null;
-
-      const toImport = targetRefs
-        ? discovered.filter((d) => targetRefs.has(d.ref))
-        : discovered;
+      const targetRefs = hasRefs ? new Set(body.refs) : null;
+      const toImport = targetRefs ? discovered.filter((d) => targetRefs.has(d.ref)) : discovered;
 
       if (toImport.length === 0) {
         json(res, 200, { ok: true, importedCount: 0, message: 'No unassigned keys to import' });

package/lib/ops-test.js

@@ -171,7 +171,15 @@ ctx.effect(() => ctx.webServer.register({
             const ev = envValue(ref);
             if (ev !== undefined) rawValue = ev;
           }
-          let effectiveValue = rawValue ? decryptSecret(rawValue) : rawValue;
+          if (typeof rawValue === 'string' && rawValue.startsWith('enc:v1:')) {
+            const dec = decryptSecret(rawValue);
+            if (!dec || dec === rawValue || dec.startsWith('enc:v1:')) {
+              results.push({ provider, ref, keyTail: '', ok: false, code: 'decryption-failed', message: 'failed to decrypt credential', latencyMs: 0 });
+              continue;
+            }
+            rawValue = dec;
+          }
+          let effectiveValue = rawValue;
           const tail = effectiveValue ? keyTail(effectiveValue) : '';
           if (!effectiveValue) {
             results.push({ provider, ref, keyTail: tail, ok: false, code: 'no-credential', latencyMs: 0 });

package/lib/pool.js

@@ -39,12 +39,20 @@ export function isLoopbackAddress(ip) {
   return false;
 }
 
+/** Check if an incoming HTTP request is from the Desktop shell (#516). */
+export function isDesktopShellRequest(req) {
+  const agent = req?.headers?.['user-agent'] || '';
+  const cookie = req?.headers?.cookie || '';
+  return typeof agent === 'string' && agent.includes('@deepseek-ai/dsh-desktop/') &&
+         typeof cookie === 'string' && cookie.includes('dsh-auth-');
+}
+
 /** Strip an optional :port and IPv6 brackets from a Host header value. */
 function hostNameOf(hostHeader) {
   return String(hostHeader).replace(/:\d+$/, '').replace(/^\[|\]$/g, '').toLowerCase();
 }
 
-/** Check if an incoming HTTP request is from a trusted local bridge origin (#353 fail-closed, #378 method-aware). */
+/** Check if an incoming HTTP request is from a trusted local bridge origin (#353 fail-closed, #378 method-aware, #516 write-origin-guard). */
 export function isTrustedBridgeRequest(req) {
   const remoteAddress = req?.socket?.remoteAddress;
   if (!isLoopbackAddress(remoteAddress)) return false;
@@ -55,25 +63,52 @@ export function isTrustedBridgeRequest(req) {
   if (!(isLoopbackAddress(hostName) || hostName === 'localhost')) return false;
 
   const origin = req?.headers?.origin;
-  if (origin === undefined) {
-    // Official Desktop build forwards requests via forwardWebRequest which strips Origin (#465 / GitHub #22).
-    // Real browsers unconditionally send Origin on cross-origin mutations, so an absent Origin cannot originate
-    // from a malicious website. Peer address and Host header are already verified loopback above.
+  const referer = req?.headers?.referer;
+
+  if (origin !== undefined) {
+    if (!origin) return false; // Explicit empty string or null-like falsy
+    try {
+      const originUrl = new URL(origin);
+      // Official Desktop build shell origin (#22, #465, #516)
+      if (originUrl.protocol === 'dsh-app:' && (originUrl.host === 'app' || originUrl.hostname === 'app' || originUrl.host === 'localhost')) {
+        return true;
+      }
+      if (originUrl.host !== hostHeader) return false;
+      const hostname = originUrl.hostname.replace(/^\[|\]$/g, '');
+      return ['http:', 'https:'].includes(originUrl.protocol) && (isLoopbackAddress(hostname) || hostname === 'localhost');
+    } catch (_) {
+      return false;
+    }
+  }
+
+  // Absent Origin:
+  const method = String(req?.method || 'GET').toUpperCase();
+  const mutating = method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS';
+  if (!mutating) {
+    // Browsers omit Origin on same-origin read navigations (GET/HEAD/OPTIONS).
     return true;
   }
-  if (!origin) return false; // Explicit empty string or null-like falsy
-  try {
-    const originUrl = new URL(origin);
-    // Official Desktop build shell origin
-    if (originUrl.protocol === 'dsh-app:' && (originUrl.host === 'app' || originUrl.hostname === 'app')) {
-      return true;
+
+  // Mutating requests without Origin: allow authentic Desktop shell requests (#516, #465) or valid Referer.
+  if (isDesktopShellRequest(req)) {
+    return true;
+  }
+
+  if (referer) {
+    try {
+      const refUrl = new URL(referer);
+      if (refUrl.protocol === 'dsh-app:' && (refUrl.host === 'app' || refUrl.hostname === 'app' || refUrl.host === 'localhost')) {
+        return true;
+      }
+      if (refUrl.host !== hostHeader) return false;
+      const hostname = refUrl.hostname.replace(/^\[|\]$/g, '');
+      return ['http:', 'https:'].includes(refUrl.protocol) && (isLoopbackAddress(hostname) || hostname === 'localhost');
+    } catch (_) {
+      return false;
     }
-    if (originUrl.host !== hostHeader) return false;
-    const hostname = originUrl.hostname.replace(/^\[|\]$/g, '');
-    return ['http:', 'https:'].includes(originUrl.protocol) && (isLoopbackAddress(hostname) || hostname === 'localhost');
-  } catch (_) {
-    return false;
   }
+
+  return false;
 }
 
 /** Regex matching error phrases that warrant switching to the next key. */

package/lib/selection-trace.js

@@ -7,7 +7,7 @@ const TRACE_BUFFER_LIMIT = 100;
 const traces = [];
 
 /**
- * Redacts any sensitive tokens from string / object representation.
+ * Redacts any sensitive tokens from string / object representation (#537).
  */
 export function redactSecret(val) {
   if (typeof val !== 'string') return val;
@@ -19,6 +19,17 @@ export function redactSecret(val) {
   return val;
 }
 
+/**
+ * Aggressively sanitizes arbitrary error/details strings to prevent token/secret leaks in traces (#537).
+ */
+export function sanitizeTraceDetails(str) {
+  if (typeof str !== 'string') return '';
+  return str
+    .replace(/(?:sk-|key-|Bearer\s+|ghp_|token[=:\s]+|api[_-]?key[=:\s]+)[a-zA-Z0-9_\-\.]{8,}/gi, '[REDACTED_SECRET]')
+    .replace(/https?:\/\/[^\s/$.?#].[^\s]*[?&](?:token|key|api_key|secret|password)=[^\s&]+/gi, '[REDACTED_URL]')
+    .slice(0, 300);
+}
+
 export function createSelectionTrace(requestId, options = {}) {
   const reqId = requestId || `req-${Date.now()}-${Math.random().toString(36).slice(2, 7)}`;
   const startTime = Date.now();
@@ -43,7 +54,7 @@ export function createSelectionTrace(requestId, options = {}) {
         ref: redactSecret(ref),
         decision,
         reasonCode,
-        details: String(details).slice(0, 300),
+        details: sanitizeTraceDetails(details),
       });
     },
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.71",
+  "version": "0.8.73",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [