@goodandready/dsh-key-rotation 0.8.72 → 0.8.73

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.8.73 (2026-10-30)
+
+### Security & Hardening (Block 1 Security Release)
+- **Origin & Bridge Guard**: Reject unauthenticated mutating requests without Origin/Referer (#516).
+- **Key Endpoint Protection**: Forbid plaintext credential reveal via `GET /dsh-key-rotation/key` (403 Forbidden) (#543).
+- **Safe Export Webhook Masking**: Mask real `notifyWebhook` URLs and embedded credentials during masked config exports (#532).
+- **Secure Export Passphrase Transport**: Passphrase for encrypted exports is now transmitted via `POST` JSON body instead of URL query string (#552).
+- **Selection Trace Sanitization**: Redact upstream API tokens and error details before recording steps to selection trace (#537).
+- **Fail-Closed Balance & Probe Inspection**: Prevent sending ciphertext credentials (`enc:v1:...`) upstream if decryption fails (#539).
+- **PBKDF2 Iteration Bounds & Async KDF**: Enforce strict iteration limits (`10000..200000`) and async derivation to eliminate event-loop blocking DoS (#542).
+
 ## [0.8.72] — 2026-10-23
 
 ### Security

package/lib/balance-inspector.js

@@ -169,7 +169,15 @@ export async function inspectBalanceForRef(ctx, ref, provider, { testValue, fetc
   let rawValue = testValue || hit?.value;
   if (!rawValue && process.env[ref]) rawValue = process.env[ref];
   if (typeof rawValue === 'string' && rawValue.startsWith('enc:v1:')) {
-    rawValue = decryptSecret(rawValue);
+    try {
+      const dec = decryptSecret(rawValue);
+      if (!dec || dec === rawValue || dec.startsWith('enc:v1:')) {
+        return { ok: false, error: 'failed to decrypt credential: missing or invalid DSH_KEY_SECRET' };
+      }
+      rawValue = dec;
+    } catch (err) {
+      return { ok: false, error: `failed to decrypt credential: ${err.message}` };
+    }
   }
   if (!rawValue) return { ok: false, error: 'no credential' };
   return checkProviderBalance(provider, rawValue, { fetchImpl, timeoutMs });

package/lib/client.js

@@ -1276,13 +1276,24 @@ window.__ModuleLoader__.load({
       const runExport = async () => {
         setExportError('');
         try {
-          const q = new URLSearchParams();
-          q.set('masked', exportMasked ? 'true' : 'false');
-          if (exportPassphrase.trim()) q.set('passphrase', exportPassphrase.trim());
-          const res = await fetch(`/dsh-key-rotation/export?${q.toString()}`, {
-            headers: { accept: 'application/json' },
-            signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
-          });
+          const passphrase = exportPassphrase.trim();
+          let res;
+          if (passphrase) {
+            // Secure POST transmission for encrypted export (#552)
+            res = await fetch('/dsh-key-rotation/export', {
+              method: 'POST',
+              headers: { 'content-type': 'application/json', accept: 'application/json' },
+              body: JSON.stringify({ masked: exportMasked, passphrase }),
+              signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
+            });
+          } else {
+            const q = new URLSearchParams();
+            q.set('masked', exportMasked ? 'true' : 'false');
+            res = await fetch(`/dsh-key-rotation/export?${q.toString()}`, {
+              headers: { accept: 'application/json' },
+              signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
+            });
+          }
           const data = await res.json();
           if (!res.ok || !data.ok) throw new Error(data?.error?.message || 'Export failed');
           const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' });

package/lib/crypto-storage.js

@@ -47,3 +47,28 @@ export function decryptSecret(ciphertext, secretKey = process.env.DSH_KEY_SECRET
     return ciphertext;
   }
 }
+
+/**
+ * Decrypt ciphertext using AES-256-GCM.
+ * Fails closed by throwing or returning null if decryption fails or secretKey is missing.
+ */
+export function decryptSecretFailClosed(ciphertext, secretKey = process.env.DSH_KEY_SECRET) {
+  if (!ciphertext || typeof ciphertext !== 'string') return ciphertext;
+  if (!ciphertext.startsWith('enc:v1:')) return ciphertext; // plaintext is allowed as-is
+  if (!secretKey) {
+    throw new Error('DSH_KEY_SECRET is required to decrypt credential');
+  }
+  const parts = ciphertext.slice('enc:v1:'.length).split(':');
+  if (parts.length !== 3) {
+    throw new Error('Malformed encrypted secret payload');
+  }
+  const [ivHex, tagHex, dataHex] = parts;
+  const key = crypto.createHash('sha256').update(String(secretKey)).digest();
+  const iv = Buffer.from(ivHex, 'hex');
+  const authTag = Buffer.from(tagHex, 'hex');
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+  decipher.setAuthTag(authTag);
+  let decrypted = decipher.update(dataHex, 'hex', 'utf8');
+  decrypted += decipher.final('utf8');
+  return decrypted;
+}

package/lib/ops-config-io.js

@@ -12,9 +12,43 @@ import { CONFIG_EXPORT_PATH, CONFIG_IMPORT_PATH, IMPORT_PATH } from './ops-paths
 import { keyTail } from './pool.js';
 import { plainConfig } from './index.js';
 
+export const MAX_PBKDF2_ITERATIONS = 200000;
+export const MIN_PBKDF2_ITERATIONS = 10000;
+export const DEFAULT_PBKDF2_ITERATIONS = 100000;
+
+export function deriveKeyAsync(passphrase, salt, iterations) {
+  return new Promise((resolve, reject) => {
+    crypto.pbkdf2(passphrase, salt, iterations, 32, 'sha256', (err, derivedKey) => {
+      if (err) reject(err);
+      else resolve(derivedKey);
+    });
+  });
+}
+
+function validateAndExtractCryptoParams(payload) {
+  if (!payload || typeof payload !== 'object') {
+    throw new Error('Invalid encrypted config payload structure');
+  }
+  if (!payload.salt || !payload.iv || !payload.tag || !payload.ciphertext) {
+    throw new Error('Missing salt, iv, tag or ciphertext in payload');
+  }
+  const iters = Number(payload.iterations) || DEFAULT_PBKDF2_ITERATIONS;
+  if (!Number.isFinite(iters) || iters < MIN_PBKDF2_ITERATIONS || iters > MAX_PBKDF2_ITERATIONS) {
+    throw new Error(`PBKDF2 iterations must be between ${MIN_PBKDF2_ITERATIONS} and ${MAX_PBKDF2_ITERATIONS}`);
+  }
+  const salt = Buffer.from(payload.salt, 'hex');
+  const iv = Buffer.from(payload.iv, 'hex');
+  const tag = Buffer.from(payload.tag, 'hex');
+  const ciphertext = Buffer.from(payload.ciphertext, 'hex');
+  if (salt.length !== 16 || iv.length !== 12 || tag.length !== 16) {
+    throw new Error('Malformed salt, iv or auth tag length in encrypted payload');
+  }
+  return { iters, salt, iv, tag, ciphertext };
+}
+
 export function encryptConfig(plainText, passphrase) {
   const salt = crypto.randomBytes(16);
-  const key = crypto.pbkdf2Sync(passphrase, salt, 100000, 32, 'sha256');
+  const key = crypto.pbkdf2Sync(passphrase, salt, DEFAULT_PBKDF2_ITERATIONS, 32, 'sha256');
   const iv = crypto.randomBytes(12);
   const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
   const encrypted = Buffer.concat([cipher.update(plainText, 'utf8'), cipher.final()]);
@@ -23,7 +57,7 @@ export function encryptConfig(plainText, passphrase) {
     encrypted: true,
     algorithm: 'aes-256-gcm',
     kdf: 'pbkdf2',
-    iterations: 100000,
+    iterations: DEFAULT_PBKDF2_ITERATIONS,
     salt: salt.toString('hex'),
     iv: iv.toString('hex'),
     tag: tag.toString('hex'),
@@ -32,14 +66,17 @@ export function encryptConfig(plainText, passphrase) {
 }
 
 export function decryptConfig(payload, passphrase) {
-  if (!payload || !payload.salt || !payload.iv || !payload.tag || !payload.ciphertext) {
-    throw new Error('Invalid encrypted config payload structure');
-  }
-  const salt = Buffer.from(payload.salt, 'hex');
-  const iv = Buffer.from(payload.iv, 'hex');
-  const tag = Buffer.from(payload.tag, 'hex');
-  const ciphertext = Buffer.from(payload.ciphertext, 'hex');
-  const key = crypto.pbkdf2Sync(passphrase, salt, payload.iterations || 100000, 32, 'sha256');
+  const { iters, salt, iv, tag, ciphertext } = validateAndExtractCryptoParams(payload);
+  const key = crypto.pbkdf2Sync(passphrase, salt, iters, 32, 'sha256');
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+  decipher.setAuthTag(tag);
+  const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return decrypted.toString('utf8');
+}
+
+export async function decryptConfigAsync(payload, passphrase) {
+  const { iters, salt, iv, tag, ciphertext } = validateAndExtractCryptoParams(payload);
+  const key = await deriveKeyAsync(passphrase, salt, iters);
   const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
   decipher.setAuthTag(tag);
   const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
@@ -65,19 +102,30 @@ export function maskConfig(config) {
       }
     }
   }
-  if (clone.webhookUrl && typeof clone.webhookUrl === 'string') {
+  function maskWebhookString(val) {
+    if (!val || typeof val !== 'string') return val;
     try {
-      const u = new URL(clone.webhookUrl);
+      const u = new URL(val);
+      if (u.username) u.username = '***';
+      if (u.password) u.password = '***';
+      if (u.search) u.search = '?token=***';
       const parts = u.pathname.split('/');
       if (parts.length > 2) {
         parts[parts.length - 1] = '***';
         u.pathname = parts.join('/');
       }
-      clone.webhookUrl = u.toString();
+      return u.toString();
     } catch (_) {
-      clone.webhookUrl = '***';
+      return '***';
     }
   }
+
+  if (clone.webhookUrl) {
+    clone.webhookUrl = maskWebhookString(clone.webhookUrl);
+  }
+  if (clone.notifyWebhook) {
+    clone.notifyWebhook = maskWebhookString(clone.notifyWebhook);
+  }
   if (clone.webhookActionToken) clone.webhookActionToken = '***';
   return clone;
 }
@@ -138,13 +186,13 @@ export function diffConfigs(currentConfig, incomingConfig, mode = 'merge') {
 }
 
 export function registerConfigIoRoutes(ctx, deps) {
-  // ── GET /dsh-key-rotation/export ──
+  // ── GET & POST /dsh-key-rotation/export (#552: support POST for safe passphrase transmission) ──
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: CONFIG_EXPORT_PATH,
     handler: async (req, res) => {
-      if (req.method !== 'GET') {
-        json(res, 405, { error: { code: 'method', message: 'GET only' } });
+      if (req.method !== 'GET' && req.method !== 'POST') {
+        json(res, 405, { error: { code: 'method', message: 'GET or POST only' } });
         return;
       }
       if (!isTrustedBridgeRequest(req)) {
@@ -152,10 +200,29 @@ export function registerConfigIoRoutes(ctx, deps) {
         return;
       }
 
-      const urlObj = new URL(req.url, 'http://127.0.0.1');
-      const maskedParam = urlObj.searchParams.get('masked');
-      const masked = maskedParam === null ? true : maskedParam !== 'false';
-      const passphrase = urlObj.searchParams.get('passphrase') || null;
+      let masked = true;
+      let passphrase = null;
+
+      if (req.method === 'POST') {
+        let body = {};
+        try {
+          body = await readJson(req);
+        } catch (_) {
+          body = {};
+        }
+        masked = body.masked !== false;
+        passphrase = typeof body.passphrase === 'string' && body.passphrase.trim() ? body.passphrase.trim() : null;
+      } else {
+        const urlObj = new URL(req.url, 'http://127.0.0.1');
+        const maskedParam = urlObj.searchParams.get('masked');
+        masked = maskedParam === null ? true : maskedParam !== 'false';
+        if (urlObj.searchParams.has('passphrase')) {
+          passphrase = urlObj.searchParams.get('passphrase') || null;
+          try {
+            res.setHeader?.('X-Deprecated-Security-Warning', 'Passphrase in query string is deprecated and will be removed; use POST /dsh-key-rotation/export with body');
+          } catch (_) {}
+        }
+      }
 
       const settings = ctx.get('settings');
       let currentConfig = {};
@@ -176,16 +243,21 @@ export function registerConfigIoRoutes(ctx, deps) {
       const exportData = masked ? maskConfig(rawConfig) : rawConfig;
 
       if (passphrase) {
-        const encryptedPayload = encryptConfig(JSON.stringify(exportData), passphrase);
-        json(res, 200, {
-          ok: true,
-          version: PLUGIN_VERSION,
-          exportedAt: new Date().toISOString(),
-          masked,
-          encrypted: true,
-          ...encryptedPayload,
-        });
-        return;
+        try {
+          const encryptedPayload = await encryptConfig(JSON.stringify(exportData), passphrase);
+          json(res, 200, {
+            ok: true,
+            version: PLUGIN_VERSION,
+            exportedAt: new Date().toISOString(),
+            masked,
+            encrypted: true,
+            ...encryptedPayload,
+          });
+          return;
+        } catch (err) {
+          json(res, 500, { error: { code: 'encryption-failed', message: err.message } });
+          return;
+        }
       }
 
       json(res, 200, {
@@ -227,7 +299,7 @@ export function registerConfigIoRoutes(ctx, deps) {
         return;
       }
       try {
-        const decryptedStr = decryptConfig(body, passphrase);
+        const decryptedStr = await decryptConfigAsync(body, passphrase);
         incomingConfig = JSON.parse(decryptedStr);
       } catch (err) {
         json(res, 400, { error: { code: 'decryption-failed', message: `Decryption failed: ${err.message}` } });

package/lib/ops-keys.js

@@ -232,27 +232,8 @@ ctx.effect(() => ctx.webServer.register({
     }
     const credentialsService = ctx.get('credentials');
     if (req.method === 'GET') {
-      const url = new URL(req.url, 'http://127.0.0.1');
-      const ref = url.searchParams.get('ref')?.trim();
-      if (!isValidRef(ref)) {
-        json(res, 400, { error: { code: 'bad-ref', message: 'dsh-key-rotation: ref must be an environment variable name' } });
-        return;
-      }
-      try {
-        let hit = await (credentialsService?.__dshKeyRotationOriginalResolve ?? credentialsService?.resolve)?.call(credentialsService, ref);
-        let raw = hit?.value;
-        if (!raw) {
-          raw = envValue(ref);
-        }
-        if (!raw) {
-          json(res, 404, { error: { code: 'not-found', message: `dsh-key-rotation: secret for "${ref}" not found` } });
-          return;
-        }
-        const plain = decryptSecret(raw);
-        json(res, 200, { ref, plaintext: plain, tail: keyTail(plain) });
-      } catch (err) {
-        json(res, 500, { error: { code: 'reveal-failed', message: String(err?.message ?? err) } });
-      }
+      // Disallow plaintext key reveal without authorized session (#543)
+      json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: plaintext key extraction via GET is forbidden' } });
       return;
     }
     if (!credentialsService || typeof credentialsService.set !== 'function') {

package/lib/ops-test.js

@@ -171,7 +171,15 @@ ctx.effect(() => ctx.webServer.register({
             const ev = envValue(ref);
             if (ev !== undefined) rawValue = ev;
           }
-          let effectiveValue = rawValue ? decryptSecret(rawValue) : rawValue;
+          if (typeof rawValue === 'string' && rawValue.startsWith('enc:v1:')) {
+            const dec = decryptSecret(rawValue);
+            if (!dec || dec === rawValue || dec.startsWith('enc:v1:')) {
+              results.push({ provider, ref, keyTail: '', ok: false, code: 'decryption-failed', message: 'failed to decrypt credential', latencyMs: 0 });
+              continue;
+            }
+            rawValue = dec;
+          }
+          let effectiveValue = rawValue;
           const tail = effectiveValue ? keyTail(effectiveValue) : '';
           if (!effectiveValue) {
             results.push({ provider, ref, keyTail: tail, ok: false, code: 'no-credential', latencyMs: 0 });

package/lib/pool.js

@@ -63,11 +63,13 @@ export function isTrustedBridgeRequest(req) {
   if (!(isLoopbackAddress(hostName) || hostName === 'localhost')) return false;
 
   const origin = req?.headers?.origin;
+  const referer = req?.headers?.referer;
+
   if (origin !== undefined) {
     if (!origin) return false; // Explicit empty string or null-like falsy
     try {
       const originUrl = new URL(origin);
-      // Official Desktop build shell origin
+      // Official Desktop build shell origin (#22, #465, #516)
       if (originUrl.protocol === 'dsh-app:' && (originUrl.host === 'app' || originUrl.hostname === 'app' || originUrl.host === 'localhost')) {
         return true;
       }
@@ -87,12 +89,11 @@ export function isTrustedBridgeRequest(req) {
     return true;
   }
 
-  // Mutating requests without Origin: allow only authenticated Desktop shell or valid Referer (#516).
+  // Mutating requests without Origin: allow authentic Desktop shell requests (#516, #465) or valid Referer.
   if (isDesktopShellRequest(req)) {
     return true;
   }
 
-  const referer = req?.headers?.referer;
   if (referer) {
     try {
       const refUrl = new URL(referer);

package/lib/selection-trace.js

@@ -7,7 +7,7 @@ const TRACE_BUFFER_LIMIT = 100;
 const traces = [];
 
 /**
- * Redacts any sensitive tokens from string / object representation.
+ * Redacts any sensitive tokens from string / object representation (#537).
  */
 export function redactSecret(val) {
   if (typeof val !== 'string') return val;
@@ -19,6 +19,17 @@ export function redactSecret(val) {
   return val;
 }
 
+/**
+ * Aggressively sanitizes arbitrary error/details strings to prevent token/secret leaks in traces (#537).
+ */
+export function sanitizeTraceDetails(str) {
+  if (typeof str !== 'string') return '';
+  return str
+    .replace(/(?:sk-|key-|Bearer\s+|ghp_|token[=:\s]+|api[_-]?key[=:\s]+)[a-zA-Z0-9_\-\.]{8,}/gi, '[REDACTED_SECRET]')
+    .replace(/https?:\/\/[^\s/$.?#].[^\s]*[?&](?:token|key|api_key|secret|password)=[^\s&]+/gi, '[REDACTED_URL]')
+    .slice(0, 300);
+}
+
 export function createSelectionTrace(requestId, options = {}) {
   const reqId = requestId || `req-${Date.now()}-${Math.random().toString(36).slice(2, 7)}`;
   const startTime = Date.now();
@@ -43,7 +54,7 @@ export function createSelectionTrace(requestId, options = {}) {
         ref: redactSecret(ref),
         decision,
         reasonCode,
-        details: String(details).slice(0, 300),
+        details: sanitizeTraceDetails(details),
       });
     },
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.72",
+  "version": "0.8.73",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [