@goodandready/dsh-key-rotation 0.8.72 → 0.8.74

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 0.8.74 (2026-10-30)
+
+### Rotation & Routing Reliability (Block 2 Release)
+- **Error Status Normalization (Issue #545)**: `isSwitchableError` now normalizes string and numeric `code: "429"` / `429` to HTTP 429 when `status` is absent, ensuring default `switchCodes` trigger key rotation.
+- **Quick Action Skip (Issue #540)**: Quick action skip now atomically synchronizes both `targetPool.state.pointer` and `cursor`, ensuring resolver round-robin picks the newly advanced key immediately.
+- **Tiers & Tier-Priority Routing (Issue #541)**: Propagate `p.tiers` to `pool-builder` options, fix `typeof tiers === 'object'` syntax error, and add `tier-priority` strategy to Schemastery and resolver.
+- **Traffic Smoothing Leaky Bucket (Issue #538)**: Implemented Generic Cell Rate Algorithm (GCRA) in `TrafficSmoother` to atomically reserve micro-queue slots ahead of sleep, preventing two concurrent requests from claiming the same time slot.
+- **Simulator Quota & Broken Key Parity (Issue #534)**: `simulateRouting` now clones `brokenUntil`, `tokenUsage`, and `quotaWindows` into simulator pool state, properly filtering out unavailable keys.
+- **Simulator Provider Map Lookup (Issue #536)**: Corrected `runtime.providerToPool` Map resolution in `ops-telemetry` simulator route, returning 404 for unrecognized providers.
+- **Config Import Concurrency (Issue #553)**: Added optimistic revision check via `expectedRevision` in `handleConfigImport`, returning 409 Conflict upon concurrent modification.
+- **Config Import Fail-Closed (Issue #533)**: `handleConfigImport` fails closed with 503 Service Unavailable when `settings.replace` is unavailable, preventing false-positive `{ applied: true }`.
+- **Instance & Context Isolation (Issue #544)**: Introduced `KeyDrainManager`, `SelectionTraceStore`, and `DiagBuffer` classes with per-context lifecycle binding; disposal of one plugin instance cleanly purges only its own draining keys and telemetry without corrupting peer instances.
+
+## 0.8.73 (2026-10-30)
+
+### Security & Hardening (Block 1 Security Release)
+- **Origin & Bridge Guard**: Reject unauthenticated mutating requests without Origin/Referer (#516).
+- **Key Endpoint Protection**: Forbid plaintext credential reveal via `GET /dsh-key-rotation/key` (403 Forbidden) (#543).
+- **Safe Export Webhook Masking**: Mask real `notifyWebhook` URLs and embedded credentials during masked config exports (#532).
+- **Secure Export Passphrase Transport**: Passphrase for encrypted exports is now transmitted via `POST` JSON body instead of URL query string (#552).
+- **Selection Trace Sanitization**: Redact upstream API tokens and error details before recording steps to selection trace (#537).
+- **Fail-Closed Balance & Probe Inspection**: Prevent sending ciphertext credentials (`enc:v1:...`) upstream if decryption fails (#539).
+- **PBKDF2 Iteration Bounds & Async KDF**: Enforce strict iteration limits (`10000..200000`) and async derivation to eliminate event-loop blocking DoS (#542).
+
 ## [0.8.72] — 2026-10-23
 
 ### Security

package/lib/balance-inspector.js

@@ -169,7 +169,15 @@ export async function inspectBalanceForRef(ctx, ref, provider, { testValue, fetc
   let rawValue = testValue || hit?.value;
   if (!rawValue && process.env[ref]) rawValue = process.env[ref];
   if (typeof rawValue === 'string' && rawValue.startsWith('enc:v1:')) {
-    rawValue = decryptSecret(rawValue);
+    try {
+      const dec = decryptSecret(rawValue);
+      if (!dec || dec === rawValue || dec.startsWith('enc:v1:')) {
+        return { ok: false, error: 'failed to decrypt credential: missing or invalid DSH_KEY_SECRET' };
+      }
+      rawValue = dec;
+    } catch (err) {
+      return { ok: false, error: `failed to decrypt credential: ${err.message}` };
+    }
   }
   if (!rawValue) return { ok: false, error: 'no credential' };
   return checkProviderBalance(provider, rawValue, { fetchImpl, timeoutMs });

package/lib/client.js

@@ -1276,13 +1276,24 @@ window.__ModuleLoader__.load({
       const runExport = async () => {
         setExportError('');
         try {
-          const q = new URLSearchParams();
-          q.set('masked', exportMasked ? 'true' : 'false');
-          if (exportPassphrase.trim()) q.set('passphrase', exportPassphrase.trim());
-          const res = await fetch(`/dsh-key-rotation/export?${q.toString()}`, {
-            headers: { accept: 'application/json' },
-            signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
-          });
+          const passphrase = exportPassphrase.trim();
+          let res;
+          if (passphrase) {
+            // Secure POST transmission for encrypted export (#552)
+            res = await fetch('/dsh-key-rotation/export', {
+              method: 'POST',
+              headers: { 'content-type': 'application/json', accept: 'application/json' },
+              body: JSON.stringify({ masked: exportMasked, passphrase }),
+              signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
+            });
+          } else {
+            const q = new URLSearchParams();
+            q.set('masked', exportMasked ? 'true' : 'false');
+            res = await fetch(`/dsh-key-rotation/export?${q.toString()}`, {
+              headers: { accept: 'application/json' },
+              signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
+            });
+          }
           const data = await res.json();
           if (!res.ok || !data.ok) throw new Error(data?.error?.message || 'Export failed');
           const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' });

package/lib/clone-lifecycle.js

@@ -148,7 +148,7 @@ export class CloneLifecycleManager {
   startDrain(cloneId, provider, onDeregister) {
     if (this.drainingClones.has(cloneId)) return;
 
-    markKeyDraining(cloneId, provider);
+    markKeyDraining(cloneId, provider, this.keyDrainManager);
     const entry = {
       cloneId,
       provider,
@@ -176,7 +176,7 @@ export class CloneLifecycleManager {
 
     if (inFlight === 0) {
       this.drainingClones.delete(cloneId);
-      cancelKeyDrain(cloneId);
+      cancelKeyDrain(cloneId, this.keyDrainManager);
       if (this.logger?.info) {
         this.logger.info(`[dsh-key-rotation] clone ${cloneId} (${entry.provider}) drained cleanly; safe to deregister`);
       }
@@ -191,11 +191,11 @@ export class CloneLifecycleManager {
 
   cancelDrain(cloneId) {
     this.drainingClones.delete(cloneId);
-    cancelKeyDrain(cloneId);
+    cancelKeyDrain(cloneId, this.keyDrainManager);
   }
 
   isDraining(cloneId) {
-    return this.drainingClones.has(cloneId) || isKeyDraining(cloneId);
+    return this.drainingClones.has(cloneId) || isKeyDraining(cloneId, this.keyDrainManager);
   }
 
   getDrainingList() {
@@ -209,7 +209,7 @@ export class CloneLifecycleManager {
 
   destroy() {
     for (const cloneId of this.drainingClones.keys()) {
-      cancelKeyDrain(cloneId);
+      cancelKeyDrain(cloneId, this.keyDrainManager);
     }
     this.drainingClones.clear();
   }

package/lib/crypto-storage.js

@@ -47,3 +47,28 @@ export function decryptSecret(ciphertext, secretKey = process.env.DSH_KEY_SECRET
     return ciphertext;
   }
 }
+
+/**
+ * Decrypt ciphertext using AES-256-GCM.
+ * Fails closed by throwing or returning null if decryption fails or secretKey is missing.
+ */
+export function decryptSecretFailClosed(ciphertext, secretKey = process.env.DSH_KEY_SECRET) {
+  if (!ciphertext || typeof ciphertext !== 'string') return ciphertext;
+  if (!ciphertext.startsWith('enc:v1:')) return ciphertext; // plaintext is allowed as-is
+  if (!secretKey) {
+    throw new Error('DSH_KEY_SECRET is required to decrypt credential');
+  }
+  const parts = ciphertext.slice('enc:v1:'.length).split(':');
+  if (parts.length !== 3) {
+    throw new Error('Malformed encrypted secret payload');
+  }
+  const [ivHex, tagHex, dataHex] = parts;
+  const key = crypto.createHash('sha256').update(String(secretKey)).digest();
+  const iv = Buffer.from(ivHex, 'hex');
+  const authTag = Buffer.from(tagHex, 'hex');
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+  decipher.setAuthTag(authTag);
+  let decrypted = decipher.update(dataHex, 'hex', 'utf8');
+  decrypted += decipher.final('utf8');
+  return decrypted;
+}

package/lib/index.js

@@ -1,3 +1,6 @@
+import { KeyDrainManager } from './key-drain.js';
+import { SelectionTraceStore } from './selection-trace.js';
+import { DiagBuffer } from './ops-telemetry.js';
 import { createResolver } from './resolver.js';
 import { decryptSecret } from './crypto-storage.js';
 // dsh-key-rotation — per-provider API key rotation for DeepSeek Harness.
@@ -98,7 +101,7 @@ const SettingsSchema = Schema.object({
   rateLimitThreshold: Schema.number().default(0.1),
   proactiveRateLimitGuard: Schema.boolean().default(true),
   selfHealingIntervalMinutes: Schema.number().default(30),
-  routingStrategy: Schema.union(['round-robin', 'least-loaded', 'lowest-latency', 'sticky']).default('round-robin'),
+  routingStrategy: Schema.union(['round-robin', 'least-loaded', 'lowest-latency', 'sticky', 'tier-priority']).default('round-robin'),
   rpmLimit: Schema.number().default(0),
   tpmLimit: Schema.number().default(0),
   webhookActionToken: Schema.string().role('secret').default(''),
@@ -148,7 +151,7 @@ const SettingsSchema = Schema.object({
     })).default({}),
     cooldownMs: Schema.number(),
     maxCooldownMs: Schema.number(),
-    routingStrategy: Schema.union(['round-robin', 'least-loaded', 'lowest-latency', 'sticky']),
+    routingStrategy: Schema.union(['round-robin', 'least-loaded', 'lowest-latency', 'sticky', 'tier-priority']),
     proactiveRateLimitGuard: Schema.boolean(),
     rpmLimit: Schema.number(),
     tpmLimit: Schema.number(),
@@ -196,13 +199,16 @@ export function apply(ctx, config = {}) {
   const latencyHistogram = new LatencyHistogram();
   const quotaStore = new QuotaStore();
   const concurrencyTracker = new ConcurrencyTracker();
+  const keyDrainManager = new KeyDrainManager();
+  const selectionTraceStore = new SelectionTraceStore();
+  const diagBuffer = new DiagBuffer();
 
   const moduleBreaker = new CircuitBreaker({ threshold: 5, openMs: 30000, halfOpenProbes: 1, now: nowMono });
   const webhookSender = new WebhookSender({ fetchImpl: globalThis.fetch });
   const alertDebouncer = new AlertDebouncer({ sender: webhookSender, debounceMs: 2000 });
   const moduleNotifyQueue = new NotifyQueue({ send: (url, payload) => alertDebouncer.enqueue(url, payload) });
   const trafficSmoother = new TrafficSmoother({ maxQueueWaitMs: 800 });
-  const cloneLifecycle = new CloneLifecycleManager({ concurrencyTracker, logger });
+  const cloneLifecycle = new CloneLifecycleManager({ concurrencyTracker, logger, keyDrainManager });
   ctx.effect(() => () => { cloneLifecycle.destroy(); }, 'dsh-key-rotation: clone lifecycle cleanup');
 
   const sandboxService = createSandboxService({ getRuntime: () => buildRuntime() });
@@ -214,7 +220,11 @@ export function apply(ctx, config = {}) {
 
   setupIdleHealEffect(ctx, getConfig, buildRuntime);
   setupProactiveHealthProbeEffect(ctx, getConfig, buildRuntime, ensureSandboxRunner, logger);
-  setupKeyDrainEffect(ctx);
+  setupKeyDrainEffect(ctx, keyDrainManager);
+  ctx.effect(() => () => {
+    selectionTraceStore.clear();
+    diagBuffer.clear();
+  }, 'dsh-key-rotation: telemetry cleanup');
 
   const poolState = new Map();
   const { schedulePersist, persistenceSnapshot } = setupPersistence(ctx, {
@@ -461,6 +471,9 @@ export function apply(ctx, config = {}) {
     circuitBreaker: moduleBreaker,
     notifyQueue: moduleNotifyQueue,
     quotaStore,
+    keyDrainManager,
+    selectionTraceStore,
+    diagBuffer,
   });
 
   ctx.effect(() => {

package/lib/key-drain.js

@@ -1,56 +1,91 @@
-// lib/key-drain.js — Managed key draining and graceful replacement (#463, #502).
+// lib/key-drain.js — Managed key draining and graceful replacement (#463, #502, #544).
 // Allows draining an old key ref (no new dispatches assigned) while letting
 // in-flight active streams complete cleanly before permanent removal.
+// KeyDrainManager provides instance-level isolation (#544).
 
-const drainingKeys = new Map(); // ref -> { provider, startedAt, inFlightCount }
+export class KeyDrainManager {
+  constructor() {
+    this.drainingKeys = new Map(); // ref -> { provider, startedAt, inFlightCount }
+  }
+
+  markKeyDraining(ref, provider = '') {
+    if (!ref) return false;
+    this.drainingKeys.set(ref, {
+      ref,
+      provider,
+      startedAt: Date.now(),
+    });
+    return true;
+  }
+
+  isKeyDraining(ref) {
+    if (!ref) return false;
+    return this.drainingKeys.has(ref);
+  }
+
+  cancelKeyDrain(ref) {
+    if (!ref) return false;
+    return this.drainingKeys.delete(ref);
+  }
+
+  getDrainingStatus(ref, concurrencyTracker) {
+    if (!ref || !this.drainingKeys.has(ref)) return null;
+    const entry = this.drainingKeys.get(ref);
+    const inFlight = concurrencyTracker && typeof concurrencyTracker.getActive === 'function'
+      ? concurrencyTracker.getActive(ref)
+      : (concurrencyTracker && typeof concurrencyTracker.getInFlight === 'function'
+        ? concurrencyTracker.getInFlight(ref)
+        : 0);
+
+    return {
+      ref,
+      provider: entry.provider,
+      startedAt: entry.startedAt,
+      elapsedMs: Date.now() - entry.startedAt,
+      inFlight,
+      canComplete: inFlight === 0,
+    };
+  }
+
+  getAllDrainingKeys(concurrencyTracker) {
+    const result = [];
+    for (const ref of this.drainingKeys.keys()) {
+      result.push(this.getDrainingStatus(ref, concurrencyTracker));
+    }
+    return result;
+  }
 
-export function markKeyDraining(ref, provider = '') {
-  if (!ref) return false;
-  drainingKeys.set(ref, {
-    ref,
-    provider,
-    startedAt: Date.now(),
-  });
-  return true;
+  clearAllDraining() {
+    this.drainingKeys.clear();
+  }
 }
 
-export function isKeyDraining(ref) {
-  if (!ref) return false;
-  return drainingKeys.has(ref);
+const defaultDrainManager = new KeyDrainManager();
+
+export function markKeyDraining(ref, provider = '', manager = null) {
+  return (manager || defaultDrainManager).markKeyDraining(ref, provider);
 }
 
-export function cancelKeyDrain(ref) {
-  if (!ref) return false;
-  return drainingKeys.delete(ref);
+export function isKeyDraining(ref, manager = null) {
+  return (manager || defaultDrainManager).isKeyDraining(ref);
 }
 
-export function getDrainingStatus(ref, concurrencyTracker) {
-  if (!ref || !drainingKeys.has(ref)) return null;
-  const entry = drainingKeys.get(ref);
-  const inFlight = concurrencyTracker && typeof concurrencyTracker.getActive === 'function'
-    ? concurrencyTracker.getActive(ref)
-    : (concurrencyTracker && typeof concurrencyTracker.getInFlight === 'function'
-      ? concurrencyTracker.getInFlight(ref)
-      : 0);
-
-  return {
-    ref,
-    provider: entry.provider,
-    startedAt: entry.startedAt,
-    elapsedMs: Date.now() - entry.startedAt,
-    inFlight,
-    canComplete: inFlight === 0,
-  };
+export function cancelKeyDrain(ref, manager = null) {
+  return (manager || defaultDrainManager).cancelKeyDrain(ref);
 }
 
-export function getAllDrainingKeys(concurrencyTracker) {
-  const result = [];
-  for (const ref of drainingKeys.keys()) {
-    result.push(getDrainingStatus(ref, concurrencyTracker));
-  }
-  return result;
+export function getDrainingStatus(ref, concurrencyTracker, manager = null) {
+  return (manager || defaultDrainManager).getDrainingStatus(ref, concurrencyTracker);
+}
+
+export function getAllDrainingKeys(concurrencyTracker, manager = null) {
+  return (manager || defaultDrainManager).getAllDrainingKeys(concurrencyTracker);
 }
 
-export function clearAllDraining() {
-  drainingKeys.clear();
+export function clearAllDraining(manager = null) {
+  if (manager) {
+    manager.clearAllDraining();
+  } else {
+    defaultDrainManager.clearAllDraining();
+  }
 }

package/lib/lifecycle.js

@@ -251,10 +251,10 @@ export function setupProactiveHealthProbeEffect(ctx, getConfig, buildRuntime, en
   }, 'dsh-key-rotation: proactive health probing');
 }
 
-export function setupKeyDrainEffect(ctx) {
+export function setupKeyDrainEffect(ctx, keyDrainManager = null) {
   return ctx.effect(() => {
     return () => {
-      clearAllDraining();
+      clearAllDraining(keyDrainManager);
     };
   }, 'dsh-key-rotation: clear draining keys on teardown');
 }

package/lib/ops-config-io.js

@@ -12,9 +12,43 @@ import { CONFIG_EXPORT_PATH, CONFIG_IMPORT_PATH, IMPORT_PATH } from './ops-paths
 import { keyTail } from './pool.js';
 import { plainConfig } from './index.js';
 
+export const MAX_PBKDF2_ITERATIONS = 200000;
+export const MIN_PBKDF2_ITERATIONS = 10000;
+export const DEFAULT_PBKDF2_ITERATIONS = 100000;
+
+export function deriveKeyAsync(passphrase, salt, iterations) {
+  return new Promise((resolve, reject) => {
+    crypto.pbkdf2(passphrase, salt, iterations, 32, 'sha256', (err, derivedKey) => {
+      if (err) reject(err);
+      else resolve(derivedKey);
+    });
+  });
+}
+
+function validateAndExtractCryptoParams(payload) {
+  if (!payload || typeof payload !== 'object') {
+    throw new Error('Invalid encrypted config payload structure');
+  }
+  if (!payload.salt || !payload.iv || !payload.tag || !payload.ciphertext) {
+    throw new Error('Missing salt, iv, tag or ciphertext in payload');
+  }
+  const iters = Number(payload.iterations) || DEFAULT_PBKDF2_ITERATIONS;
+  if (!Number.isFinite(iters) || iters < MIN_PBKDF2_ITERATIONS || iters > MAX_PBKDF2_ITERATIONS) {
+    throw new Error(`PBKDF2 iterations must be between ${MIN_PBKDF2_ITERATIONS} and ${MAX_PBKDF2_ITERATIONS}`);
+  }
+  const salt = Buffer.from(payload.salt, 'hex');
+  const iv = Buffer.from(payload.iv, 'hex');
+  const tag = Buffer.from(payload.tag, 'hex');
+  const ciphertext = Buffer.from(payload.ciphertext, 'hex');
+  if (salt.length !== 16 || iv.length !== 12 || tag.length !== 16) {
+    throw new Error('Malformed salt, iv or auth tag length in encrypted payload');
+  }
+  return { iters, salt, iv, tag, ciphertext };
+}
+
 export function encryptConfig(plainText, passphrase) {
   const salt = crypto.randomBytes(16);
-  const key = crypto.pbkdf2Sync(passphrase, salt, 100000, 32, 'sha256');
+  const key = crypto.pbkdf2Sync(passphrase, salt, DEFAULT_PBKDF2_ITERATIONS, 32, 'sha256');
   const iv = crypto.randomBytes(12);
   const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
   const encrypted = Buffer.concat([cipher.update(plainText, 'utf8'), cipher.final()]);
@@ -23,7 +57,7 @@ export function encryptConfig(plainText, passphrase) {
     encrypted: true,
     algorithm: 'aes-256-gcm',
     kdf: 'pbkdf2',
-    iterations: 100000,
+    iterations: DEFAULT_PBKDF2_ITERATIONS,
     salt: salt.toString('hex'),
     iv: iv.toString('hex'),
     tag: tag.toString('hex'),
@@ -32,14 +66,17 @@ export function encryptConfig(plainText, passphrase) {
 }
 
 export function decryptConfig(payload, passphrase) {
-  if (!payload || !payload.salt || !payload.iv || !payload.tag || !payload.ciphertext) {
-    throw new Error('Invalid encrypted config payload structure');
-  }
-  const salt = Buffer.from(payload.salt, 'hex');
-  const iv = Buffer.from(payload.iv, 'hex');
-  const tag = Buffer.from(payload.tag, 'hex');
-  const ciphertext = Buffer.from(payload.ciphertext, 'hex');
-  const key = crypto.pbkdf2Sync(passphrase, salt, payload.iterations || 100000, 32, 'sha256');
+  const { iters, salt, iv, tag, ciphertext } = validateAndExtractCryptoParams(payload);
+  const key = crypto.pbkdf2Sync(passphrase, salt, iters, 32, 'sha256');
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+  decipher.setAuthTag(tag);
+  const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return decrypted.toString('utf8');
+}
+
+export async function decryptConfigAsync(payload, passphrase) {
+  const { iters, salt, iv, tag, ciphertext } = validateAndExtractCryptoParams(payload);
+  const key = await deriveKeyAsync(passphrase, salt, iters);
   const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
   decipher.setAuthTag(tag);
   const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
@@ -65,19 +102,30 @@ export function maskConfig(config) {
       }
     }
   }
-  if (clone.webhookUrl && typeof clone.webhookUrl === 'string') {
+  function maskWebhookString(val) {
+    if (!val || typeof val !== 'string') return val;
     try {
-      const u = new URL(clone.webhookUrl);
+      const u = new URL(val);
+      if (u.username) u.username = '***';
+      if (u.password) u.password = '***';
+      if (u.search) u.search = '?token=***';
       const parts = u.pathname.split('/');
       if (parts.length > 2) {
         parts[parts.length - 1] = '***';
         u.pathname = parts.join('/');
       }
-      clone.webhookUrl = u.toString();
+      return u.toString();
     } catch (_) {
-      clone.webhookUrl = '***';
+      return '***';
     }
   }
+
+  if (clone.webhookUrl) {
+    clone.webhookUrl = maskWebhookString(clone.webhookUrl);
+  }
+  if (clone.notifyWebhook) {
+    clone.notifyWebhook = maskWebhookString(clone.notifyWebhook);
+  }
   if (clone.webhookActionToken) clone.webhookActionToken = '***';
   return clone;
 }
@@ -138,13 +186,13 @@ export function diffConfigs(currentConfig, incomingConfig, mode = 'merge') {
 }
 
 export function registerConfigIoRoutes(ctx, deps) {
-  // ── GET /dsh-key-rotation/export ──
+  // ── GET & POST /dsh-key-rotation/export (#552: support POST for safe passphrase transmission) ──
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: CONFIG_EXPORT_PATH,
     handler: async (req, res) => {
-      if (req.method !== 'GET') {
-        json(res, 405, { error: { code: 'method', message: 'GET only' } });
+      if (req.method !== 'GET' && req.method !== 'POST') {
+        json(res, 405, { error: { code: 'method', message: 'GET or POST only' } });
         return;
       }
       if (!isTrustedBridgeRequest(req)) {
@@ -152,12 +200,31 @@ export function registerConfigIoRoutes(ctx, deps) {
         return;
       }
 
-      const urlObj = new URL(req.url, 'http://127.0.0.1');
-      const maskedParam = urlObj.searchParams.get('masked');
-      const masked = maskedParam === null ? true : maskedParam !== 'false';
-      const passphrase = urlObj.searchParams.get('passphrase') || null;
+      let masked = true;
+      let passphrase = null;
 
-      const settings = ctx.get('settings');
+      if (req.method === 'POST') {
+        let body = {};
+        try {
+          body = await readJson(req);
+        } catch (_) {
+          body = {};
+        }
+        masked = body.masked !== false;
+        passphrase = typeof body.passphrase === 'string' && body.passphrase.trim() ? body.passphrase.trim() : null;
+      } else {
+        const urlObj = new URL(req.url, 'http://127.0.0.1');
+        const maskedParam = urlObj.searchParams.get('masked');
+        masked = maskedParam === null ? true : maskedParam !== 'false';
+        if (urlObj.searchParams.has('passphrase')) {
+          passphrase = urlObj.searchParams.get('passphrase') || null;
+          try {
+            res.setHeader?.('X-Deprecated-Security-Warning', 'Passphrase in query string is deprecated and will be removed; use POST /dsh-key-rotation/export with body');
+          } catch (_) {}
+        }
+      }
+
+      const settings = typeof ctx?.get === 'function' ? ctx.get('settings') : (ctx?.settings || null);
       let currentConfig = {};
       try {
         if (settings && typeof settings.get === 'function') {
@@ -176,16 +243,21 @@ export function registerConfigIoRoutes(ctx, deps) {
       const exportData = masked ? maskConfig(rawConfig) : rawConfig;
 
       if (passphrase) {
-        const encryptedPayload = encryptConfig(JSON.stringify(exportData), passphrase);
-        json(res, 200, {
-          ok: true,
-          version: PLUGIN_VERSION,
-          exportedAt: new Date().toISOString(),
-          masked,
-          encrypted: true,
-          ...encryptedPayload,
-        });
-        return;
+        try {
+          const encryptedPayload = await encryptConfig(JSON.stringify(exportData), passphrase);
+          json(res, 200, {
+            ok: true,
+            version: PLUGIN_VERSION,
+            exportedAt: new Date().toISOString(),
+            masked,
+            encrypted: true,
+            ...encryptedPayload,
+          });
+          return;
+        } catch (err) {
+          json(res, 500, { error: { code: 'encryption-failed', message: err.message } });
+          return;
+        }
       }
 
       json(res, 200, {
@@ -227,7 +299,7 @@ export function registerConfigIoRoutes(ctx, deps) {
         return;
       }
       try {
-        const decryptedStr = decryptConfig(body, passphrase);
+        const decryptedStr = await decryptConfigAsync(body, passphrase);
         incomingConfig = JSON.parse(decryptedStr);
       } catch (err) {
         json(res, 400, { error: { code: 'decryption-failed', message: `Decryption failed: ${err.message}` } });
@@ -250,28 +322,54 @@ export function registerConfigIoRoutes(ctx, deps) {
     const mode = body.mode === 'replace' ? 'replace' : 'merge';
     const dryRun = Boolean(body.dryRun);
 
-    const settings = ctx.get('settings');
+    const settings = typeof ctx?.get === 'function' ? ctx.get('settings') : (ctx?.settings || null);
+    if (!settings || typeof settings.replace !== 'function') {
+      // Fail closed when settings service is missing or lacks replace (#533)
+      json(res, 503, { error: { code: 'settings-unavailable', message: 'Settings service is not available or does not support writing configuration' } });
+      return;
+    }
+
     let currentConfig = {};
+    let currentRevision = null;
     try {
-      if (settings && typeof settings.get === 'function') {
-        currentConfig = settings.get(NS) || {};
-      } else if (settings && typeof settings.describe === 'function') {
+      if (typeof settings.describe === 'function') {
         const desc = settings.describe({ redactSecrets: false })?.find((c) => c.ns === NS);
-        currentConfig = desc?.value || {};
-      } else {
-        currentConfig = deps.buildRuntime().cfg0 || {};
+        if (desc) {
+          currentConfig = desc.value || {};
+          currentRevision = desc.revision ?? null;
+        }
+      }
+      if (!currentConfig || Object.keys(currentConfig).length === 0) {
+        if (typeof settings.get === 'function') {
+          currentConfig = settings.get(NS) || {};
+        }
       }
     } catch (_) {
       currentConfig = deps.buildRuntime().cfg0 || {};
     }
     const rawCurrent = plainConfig(currentConfig);
 
+    // Concurrency control: if client provided expectedRevision, reject if stale (#553)
+    if (typeof body.expectedRevision === 'number' && currentRevision !== null) {
+      if (body.expectedRevision !== currentRevision) {
+        json(res, 409, {
+          error: {
+            code: 'conflict',
+            message: `Configuration has been modified concurrently (expected revision ${body.expectedRevision}, current is ${currentRevision})`,
+            currentRevision,
+          }
+        });
+        return;
+      }
+    }
+
     const preview = diffConfigs(rawCurrent, incomingConfig, mode);
 
     if (dryRun) {
       json(res, 200, {
         ok: true,
         dryRun: true,
+        revision: currentRevision,
         preview,
       });
       return;
@@ -307,19 +405,18 @@ export function registerConfigIoRoutes(ctx, deps) {
       mergedConfig.providers = curProviders;
     }
 
-    if (settings && typeof settings.replace === 'function') {
-      try {
-        await settings.replace(NS, mergedConfig);
-      } catch (err) {
-        json(res, 500, { error: { code: 'settings-write-failed', message: err.message } });
-        return;
-      }
+    try {
+      await settings.replace(NS, mergedConfig, currentRevision ?? undefined);
+    } catch (err) {
+      json(res, 500, { error: { code: 'settings-write-failed', message: err.message } });
+      return;
     }
 
     json(res, 200, {
       ok: true,
       applied: true,
       mode,
+      revision: typeof currentRevision === 'number' ? currentRevision + 1 : undefined,
       preview,
     });
   };

package/lib/ops-keys.js

@@ -165,17 +165,18 @@ ctx.effect(() => ctx.webServer.register({
       return;
     }
     const concurrency = deps.concurrencyTracker;
+    const keyDrainManager = deps.keyDrainManager;
 
     if (req.method === 'GET') {
       const url = new URL(req.url ?? DRAIN_PATH, 'http://localhost');
       const ref = url.searchParams.get('ref');
       if (ref) {
-        const status = getDrainingStatus(ref, concurrency);
+        const status = getDrainingStatus(ref, concurrency, keyDrainManager);
         if (!status) { json(res, 404, { error: { code: 'not-found', message: `Key ${ref} is not currently draining` } }); return; }
         json(res, 200, { ok: true, draining: status });
         return;
       }
-      json(res, 200, { ok: true, draining: getAllDrainingKeys(concurrency) });
+      json(res, 200, { ok: true, draining: getAllDrainingKeys(concurrency, keyDrainManager) });
       return;
     }
 
@@ -187,8 +188,8 @@ ctx.effect(() => ctx.webServer.register({
       }
       const ref = body?.ref;
       if (!ref) { json(res, 400, { error: { code: 'bad-request', message: 'Missing ref' } }); return; }
-      markKeyDraining(ref, body?.provider || '');
-      json(res, 200, { ok: true, status: getDrainingStatus(ref, concurrency) });
+      markKeyDraining(ref, body?.provider || '', keyDrainManager);
+      json(res, 200, { ok: true, status: getDrainingStatus(ref, concurrency, keyDrainManager) });
       return;
     }
 
@@ -196,7 +197,7 @@ ctx.effect(() => ctx.webServer.register({
       const url = new URL(req.url ?? DRAIN_PATH, 'http://localhost');
       const ref = url.searchParams.get('ref');
       if (!ref) { json(res, 400, { error: { code: 'bad-request', message: 'Missing ref query parameter' } }); return; }
-      const cancelled = cancelKeyDrain(ref);
+      const cancelled = cancelKeyDrain(ref, keyDrainManager);
       json(res, 200, { ok: true, cancelled });
       return;
     }
@@ -232,27 +233,8 @@ ctx.effect(() => ctx.webServer.register({
     }
     const credentialsService = ctx.get('credentials');
     if (req.method === 'GET') {
-      const url = new URL(req.url, 'http://127.0.0.1');
-      const ref = url.searchParams.get('ref')?.trim();
-      if (!isValidRef(ref)) {
-        json(res, 400, { error: { code: 'bad-ref', message: 'dsh-key-rotation: ref must be an environment variable name' } });
-        return;
-      }
-      try {
-        let hit = await (credentialsService?.__dshKeyRotationOriginalResolve ?? credentialsService?.resolve)?.call(credentialsService, ref);
-        let raw = hit?.value;
-        if (!raw) {
-          raw = envValue(ref);
-        }
-        if (!raw) {
-          json(res, 404, { error: { code: 'not-found', message: `dsh-key-rotation: secret for "${ref}" not found` } });
-          return;
-        }
-        const plain = decryptSecret(raw);
-        json(res, 200, { ref, plaintext: plain, tail: keyTail(plain) });
-      } catch (err) {
-        json(res, 500, { error: { code: 'reveal-failed', message: String(err?.message ?? err) } });
-      }
+      // Disallow plaintext key reveal without authorized session (#543)
+      json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: plaintext key extraction via GET is forbidden' } });
       return;
     }
     if (!credentialsService || typeof credentialsService.set !== 'function') {

package/lib/ops-quick-action.js

@@ -66,10 +66,11 @@ export function registerQuickActionRoutes(ctx, deps) {
           json(res, 400, { error: { code: 'no-keys', message: 'Pool has no keys to rotate' } });
           return;
         }
-        const currentCursor = targetPool.state.cursor ?? 0;
-        const nextCursor = (currentCursor + 1) % total;
-        targetPool.state.cursor = nextCursor;
-        const nextRef = targetPool.refs[nextCursor];
+        const currentPointer = targetPool.state.pointer ?? targetPool.state.cursor ?? 0;
+        const nextPointer = (currentPointer + 1) % total;
+        targetPool.state.pointer = nextPointer;
+        targetPool.state.cursor = nextPointer;
+        const nextRef = targetPool.refs[nextPointer];
         targetPool.state.lastUsed = nextRef;
 
         if (typeof pushEvent === 'function') {
@@ -80,7 +81,7 @@ export function registerQuickActionRoutes(ctx, deps) {
           ok: true,
           action: 'skip',
           provider,
-          cursor: nextCursor,
+          cursor: nextPointer,
           activeRef: nextRef,
           activeTail: keyTail(nextRef),
         });

package/lib/ops-telemetry.js

@@ -30,20 +30,40 @@ import { getPromptCacheSummary } from './prompt-cache.js';
  */
 
 const DIAG_BUFFER_LIMIT = 200;
-const diagBuffer = [];
 
-export function pushDiag(entry) {
-  if (diagBuffer.length >= DIAG_BUFFER_LIMIT) {
-    diagBuffer.shift();
+export class DiagBuffer {
+  constructor(limit = DIAG_BUFFER_LIMIT) {
+    this.limit = limit;
+    this.buffer = [];
   }
-  diagBuffer.push({
-    timestamp: Date.now(),
-    ...entry,
-  });
+
+  push(entry) {
+    if (this.buffer.length >= this.limit) {
+      this.buffer.shift();
+    }
+    this.buffer.push({
+      timestamp: Date.now(),
+      ...entry,
+    });
+  }
+
+  get() {
+    return this.buffer.slice();
+  }
+
+  clear() {
+    this.buffer.length = 0;
+  }
+}
+
+const defaultDiagBuffer = new DiagBuffer();
+
+export function pushDiag(entry, buffer = null) {
+  (buffer || defaultDiagBuffer).push(entry);
 }
 
-export function getDiagBuffer() {
-  return diagBuffer.slice();
+export function getDiagBuffer(buffer = null) {
+  return (buffer || defaultDiagBuffer).get();
 }
 
 export function registerTelemetryRoutes(ctx, deps) {
@@ -185,11 +205,25 @@ ctx.effect(() => ctx.webServer.register({
     }
 
     const runtime = buildRuntime();
-    const provider = body?.provider || (runtime.pools?.[0]?.base ?? '');
-    const pool = runtime.providerToPool?.[provider] || runtime.pools?.[0];
+    const provider = body?.provider?.trim();
+    if (!provider) {
+      json(res, 400, { error: { code: 'bad-request', message: 'provider is required for simulation' } });
+      return;
+    }
+
+    let pool = null;
+    if (runtime.providerToPool instanceof Map) {
+      pool = runtime.providerToPool.get(provider);
+    } else if (runtime.providerToPool && typeof runtime.providerToPool === 'object') {
+      pool = runtime.providerToPool[provider];
+    }
+    if (!pool) {
+      const pools = runtime.pools ?? [];
+      pool = pools.find(p => p.provider === provider || p.base === provider);
+    }
 
     if (!pool) {
-      json(res, 404, { error: { code: 'not-found', message: `Provider '${provider}' not found` } });
+      json(res, 404, { error: { code: 'not-found', message: `Provider '${provider}' not found in configured pools` } });
       return;
     }
 
@@ -234,7 +268,7 @@ ctx.effect(() => ctx.webServer.register({
       json(res, 200, { ok: true, count: diagBuffer.length });
       return;
     }
-    json(res, 200, { diag: getDiagBuffer() });
+    json(res, 200, { diag: deps.diagBuffer ? deps.diagBuffer.get() : getDiagBuffer() });
   },
 }), 'dsh-key-rotation: diag route');
 

package/lib/ops-test.js

@@ -171,7 +171,15 @@ ctx.effect(() => ctx.webServer.register({
             const ev = envValue(ref);
             if (ev !== undefined) rawValue = ev;
           }
-          let effectiveValue = rawValue ? decryptSecret(rawValue) : rawValue;
+          if (typeof rawValue === 'string' && rawValue.startsWith('enc:v1:')) {
+            const dec = decryptSecret(rawValue);
+            if (!dec || dec === rawValue || dec.startsWith('enc:v1:')) {
+              results.push({ provider, ref, keyTail: '', ok: false, code: 'decryption-failed', message: 'failed to decrypt credential', latencyMs: 0 });
+              continue;
+            }
+            rawValue = dec;
+          }
+          let effectiveValue = rawValue;
           const tail = effectiveValue ? keyTail(effectiveValue) : '';
           if (!effectiveValue) {
             results.push({ provider, ref, keyTail: tail, ok: false, code: 'no-credential', latencyMs: 0 });

package/lib/pool-builder.js

@@ -89,7 +89,7 @@ export function buildPoolItem({
   
   const tiersMap = {};
   for (let i = 0; i < refs.length; i++) {
-    const val = Array.isArray(tiers) ? tiers[indexed[i].index] : (tiers && typeof tiers ===  object ? tiers[refs[i]] : undefined);
+    const val = Array.isArray(tiers) ? tiers[indexed[i].index] : (tiers && typeof tiers === 'object' ? tiers[refs[i]] : undefined);
     tiersMap[refs[i]] = Number.isFinite(val) && val >= 1 ? Math.floor(val) : 1;
   }
 const weightsMap = {};
@@ -182,6 +182,7 @@ export function buildPools({ cfg = {}, poolState = new Map(), defaultState = ini
       provider: p.provider,
       model: null,
       labels: p.labels,
+      tiers: p.tiers,
       pinnedRef: p.pinnedRef ?? p.useKeyRef,
       trafficSmoothingBurst: p.trafficSmoothingBurst ?? cfg.trafficSmoothingBurst,
       maxQueueWaitMs: p.maxQueueWaitMs ?? cfg.maxQueueWaitMs,

package/lib/pool.js

@@ -63,11 +63,13 @@ export function isTrustedBridgeRequest(req) {
   if (!(isLoopbackAddress(hostName) || hostName === 'localhost')) return false;
 
   const origin = req?.headers?.origin;
+  const referer = req?.headers?.referer;
+
   if (origin !== undefined) {
     if (!origin) return false; // Explicit empty string or null-like falsy
     try {
       const originUrl = new URL(origin);
-      // Official Desktop build shell origin
+      // Official Desktop build shell origin (#22, #465, #516)
       if (originUrl.protocol === 'dsh-app:' && (originUrl.host === 'app' || originUrl.hostname === 'app' || originUrl.host === 'localhost')) {
         return true;
       }
@@ -87,12 +89,11 @@ export function isTrustedBridgeRequest(req) {
     return true;
   }
 
-  // Mutating requests without Origin: allow only authenticated Desktop shell or valid Referer (#516).
+  // Mutating requests without Origin: allow authentic Desktop shell requests (#516, #465) or valid Referer.
   if (isDesktopShellRequest(req)) {
     return true;
   }
 
-  const referer = req?.headers?.referer;
   if (referer) {
     try {
       const refUrl = new URL(referer);
@@ -467,14 +468,20 @@ export function isSwitchableError(failureOrPayload, switchCodes = new Set(DEFAUL
   // and DEFAULT_SWITCH_CODES is exported as an array); normalize before .has().
   if (!(switchCodes instanceof Set)) switchCodes = new Set(Array.isArray(switchCodes) ? switchCodes : DEFAULT_SWITCH_CODES);
   const failure = failureOrPayload.failure ?? failureOrPayload;
-  const status = Number(failure.status ?? failure.statusCode ?? failure.httpStatus ?? 0);
-  let code = String(failure.code ?? failure.reason ?? '').toUpperCase();
+  let status = Number(failure.status ?? failure.statusCode ?? failure.httpStatus ?? 0);
+  let rawCode = String(failure.code ?? failure.reason ?? '').trim();
+  let code = rawCode.toUpperCase();
   if (code && SOCKET_TRANSPORT_CODES.has(code)) code = 'TRANSPORT';
   const message = String(failure.message ?? failureOrPayload.message ?? '');
 
-  // 1. Direct HTTP status codes (#267: also 408/425 transient)
+  // Treat numeric failure.code (e.g. code: "429") as HTTP status if status was not set (#545)
+  if (!status && /^\d{3}$/.test(rawCode)) {
+    status = Number(rawCode);
+  }
+
+  // 1. Direct HTTP status codes (#267: also 408/425 transient, #545: numeric status/code mapped to semantic switch codes)
   if ((status === 429 || status === 408 || status === 425) && (switchCodes.has('RATE_LIMIT') || switchCodes.has('QUOTA') || switchCodes.has('429') || switchCodes.has('TIMEOUT') || switchCodes.has(String(status)))) return true;
-  if ((status === 401 || status === 403) && (switchCodes.has('AUTH') || switchCodes.has('401'))) return true;
+  if ((status === 401 || status === 403) && (switchCodes.has('AUTH') || switchCodes.has('401') || switchCodes.has('403') || switchCodes.has(String(status)))) return true;
   if ((status >= 500 && status <= 504) && (switchCodes.has('SERVER') || switchCodes.has(String(status)))) return true;
 
   // 2. Standard gRPC / cloud error codes

package/lib/resolver.js

@@ -121,7 +121,7 @@ export function createResolver({
     const strategy = pool.routingStrategy ?? runtime.routingStrategy ?? 'round-robin';
     const sessionId = resolveOpts?.sessionId ?? resolveOpts?.session ?? resolveOpts?.metadata?.sessionId ?? currentSession?.();
     let list = pool.weightedRefs ?? pool.refs;
-    if (strategy === 'lowest-latency' || strategy === 'least-loaded' || strategy === 'sticky') {
+    if (strategy === 'lowest-latency' || strategy === 'least-loaded' || strategy === 'sticky' || strategy === 'tier-priority') {
       list = sortAttemptList(list, strategy, {
         latencyHistogram,
         concurrencyTracker,

package/lib/rotate.js

@@ -80,6 +80,8 @@ export function createRotate(deps) {
     logger,
     schedulePersist,
     trafficSmoother,
+    keyDrainManager,
+    selectionTraceStore,
     now = nowMono,
   } = deps;
 
@@ -102,7 +104,7 @@ export function createRotate(deps) {
       const trace = options.__selectionTrace || createSelectionTrace(options.requestId, {
         provider: options.provider,
         model: options.model,
-      });
+      }, selectionTraceStore);
       const isTraceOwner = !options.__selectionTrace;
       const { switchCodes, cooldownMs, maxCooldownMs, switchNotify, rateLimitThreshold } = runtime0;
       let lastFailure = null;
@@ -114,7 +116,7 @@ export function createRotate(deps) {
       const wallNow = Date.now();
       const quotaManaged = hasModelQuotaConfig(pool);
       let attemptList = (pool.weightedRefs ?? pool.refs).slice();
-      attemptList = attemptList.filter((r) => !isKeyPaused(pool, r) && !isKeyRevoked(pool, r) && !isKeyBroken(pool, r, wallNow) && !isKeyDraining(r));
+      attemptList = attemptList.filter((r) => !isKeyPaused(pool, r) && !isKeyRevoked(pool, r) && !isKeyBroken(pool, r, wallNow) && !isKeyDraining(r, keyDrainManager));
       // Issue #500: filter candidate keys by confirmed model capabilities
       if (options.model && pool.state.modelCapabilities) {
         attemptList = attemptList.filter((ref) => {

package/lib/selection-trace.js

@@ -1,13 +1,36 @@
-// lib/selection-trace.js — Request-scoped key selection explanation and attempt history (#461).
+// lib/selection-trace.js — Request-scoped key selection explanation and attempt history (#461, #544).
 // Provides auditable reasoning for key skips, selection, failovers, and cascade with strict secret redaction.
 
 import { keyTail } from './pool.js';
 
 const TRACE_BUFFER_LIMIT = 100;
-const traces = [];
+
+export class SelectionTraceStore {
+  constructor(limit = TRACE_BUFFER_LIMIT) {
+    this.limit = limit;
+    this.traces = [];
+  }
+
+  push(summary) {
+    if (this.traces.length >= this.limit) {
+      this.traces.shift();
+    }
+    this.traces.push(summary);
+  }
+
+  get(limit = 50) {
+    return this.traces.slice(-Math.max(1, Math.min(this.limit, limit)));
+  }
+
+  clear() {
+    this.traces.length = 0;
+  }
+}
+
+const defaultSelectionTraceStore = new SelectionTraceStore();
 
 /**
- * Redacts any sensitive tokens from string / object representation.
+ * Redacts any sensitive tokens from string / object representation (#537).
  */
 export function redactSecret(val) {
   if (typeof val !== 'string') return val;
@@ -19,10 +42,22 @@ export function redactSecret(val) {
   return val;
 }
 
-export function createSelectionTrace(requestId, options = {}) {
+/**
+ * Aggressively sanitizes arbitrary error/details strings to prevent token/secret leaks in traces (#537).
+ */
+export function sanitizeTraceDetails(str) {
+  if (typeof str !== 'string') return '';
+  return str
+    .replace(/(?:sk-|key-|Bearer\s+|ghp_|token[=:\s]+|api[_-]?key[=:\s]+)[a-zA-Z0-9_\-\.]{8,}/gi, '[REDACTED_SECRET]')
+    .replace(/https?:\/\/[^\s/$.?#].[^\s]*[?&](?:token|key|api_key|secret|password)=[^\s&]+/gi, '[REDACTED_URL]')
+    .slice(0, 300);
+}
+
+export function createSelectionTrace(requestId, options = {}, store = null) {
   const reqId = requestId || `req-${Date.now()}-${Math.random().toString(36).slice(2, 7)}`;
   const startTime = Date.now();
   const events = [];
+  const targetStore = store || defaultSelectionTraceStore;
 
   return {
     requestId: reqId,
@@ -43,7 +78,7 @@ export function createSelectionTrace(requestId, options = {}) {
         ref: redactSecret(ref),
         decision,
         reasonCode,
-        details: String(details).slice(0, 300),
+        details: sanitizeTraceDetails(details),
       });
     },
 
@@ -62,19 +97,16 @@ export function createSelectionTrace(requestId, options = {}) {
         steps: events,
       };
 
-      if (traces.length >= TRACE_BUFFER_LIMIT) {
-        traces.shift();
-      }
-      traces.push(summary);
+      targetStore.push(summary);
       return summary;
     }
   };
 }
 
-export function getSelectionTraces(limit = 50) {
-  return traces.slice(-Math.max(1, Math.min(100, limit)));
+export function getSelectionTraces(limit = 50, store = null) {
+  return (store || defaultSelectionTraceStore).get(limit);
 }
 
-export function clearSelectionTraces() {
-  traces.length = 0;
+export function clearSelectionTraces(store = null) {
+  (store || defaultSelectionTraceStore).clear();
 }

package/lib/simulator.js

@@ -37,18 +37,24 @@ export function simulateRouting(params = {}) {
     throw new Error('simulateRouting: valid pool with refs is required');
   }
 
-  // Clone pool state into isolated mock state so real runtime is never touched
+  // Clone pool state into isolated mock state so real runtime is never touched (#534)
   const mockFailedUntil = new Map(pool.state?.failedUntil || []);
   const mockFailCounts = new Map(pool.state?.failCounts || []);
   const mockRevokedRefs = new Set(pool.state?.revokedRefs || []);
+  const mockBrokenUntil = new Map(pool.state?.brokenUntil || []);
+  const mockTokenUsage = pool.state?.tokenUsage ? new Map(pool.state.tokenUsage) : new Map();
+  const mockQuotaWindows = pool.state?.quotaWindows ? new Map(pool.state.quotaWindows) : new Map();
 
   const simPool = {
     ...pool,
     state: {
+      ...pool.state,
       failedUntil: mockFailedUntil,
       failCounts: mockFailCounts,
       revokedRefs: mockRevokedRefs,
-      brokenUntil: new Map(),
+      brokenUntil: mockBrokenUntil,
+      tokenUsage: mockTokenUsage,
+      quotaWindows: mockQuotaWindows,
     },
   };
 

package/lib/traffic-smoother.js

@@ -1,21 +1,26 @@
-// lib/traffic-smoother.js — leaky bucket micro-queue traffic smoother (#496).
+// lib/traffic-smoother.js — GCRA leaky bucket micro-queue traffic smoother (#496, #538).
 // Absorbs momentary request bursts without tripping upstream per-second/per-minute rate limits.
+// Uses Generic Cell Rate Algorithm to ensure atomic slot reservation and burst compliance.
 
 export class TrafficSmoother {
   constructor({ maxQueueWaitMs = 800, now = Date.now, sleep = null } = {}) {
     this.maxQueueWaitMs = maxQueueWaitMs;
     this.now = now;
     this.sleep = sleep || ((ms, signal) => new Promise((resolve, reject) => {
-      if (signal?.aborted) return reject(signal.reason ?? new Error('aborted'));
+      if (signal?.aborted) {
+        const err = (signal.reason instanceof Error) ? signal.reason : Object.assign(new Error('This operation was aborted'), { name: 'AbortError' });
+        return reject(err);
+      }
       const timer = setTimeout(resolve, ms);
       if (signal) {
         signal.addEventListener('abort', () => {
           clearTimeout(timer);
-          reject(signal.reason ?? new Error('aborted'));
+          const err = (signal.reason instanceof Error) ? signal.reason : Object.assign(new Error('This operation was aborted'), { name: 'AbortError' });
+          reject(err);
         }, { once: true });
       }
     }));
-    // Map<ref, { lastTime: number, tokens: number, lastUpdate: number }>
+    // Map<ref, { virtualTime: number }>
     this._buckets = new Map();
   }
 
@@ -45,35 +50,41 @@ export class TrafficSmoother {
 
     let bucket = this._buckets.get(ref);
     if (!bucket) {
-      bucket = { tokens: capacity, lastUpdate: curNow, nextSlot: curNow };
+      bucket = { virtualTime: curNow - capacity * intervalMs };
       this._buckets.set(ref, bucket);
     }
 
-    // Replenish tokens based on elapsed time
-    const elapsed = Math.max(0, curNow - bucket.lastUpdate);
-    const addedTokens = elapsed * (ratePerSec / 1000);
-    bucket.tokens = Math.min(capacity, bucket.tokens + addedTokens);
-    bucket.lastUpdate = curNow;
+    // GCRA: virtualTime cannot fall behind (curNow - capacity * intervalMs)
+    const minVirtualTime = curNow - capacity * intervalMs;
+    const vTime = Math.max(minVirtualTime, bucket.virtualTime);
+    const targetSlot = vTime + intervalMs;
 
-    if (bucket.tokens >= 1) {
-      bucket.tokens -= 1;
-      bucket.nextSlot = Math.max(curNow, bucket.nextSlot);
+    if (targetSlot <= curNow) {
+      // Immediate acquisition within available burst capacity
+      bucket.virtualTime = targetSlot;
       return { allowed: true, delayed: false, delayMs: 0, overflow: false };
     }
 
-    // Burst is exhausted: calculate delay required for next available slot
-    const targetSlot = Math.max(curNow, bucket.nextSlot) + intervalMs;
-    const delayMs = Math.max(0, targetSlot - curNow);
+    // Queue delay required
+    const delayMs = targetSlot - curNow;
 
     if (delayMs > maxWait) {
       // Exceeds max micro-queue wait: signal overflow so caller rotates to next candidate
       return { allowed: false, delayed: false, delayMs, overflow: true };
     }
 
-    bucket.nextSlot = targetSlot;
+    // Atomically reserve the slot ahead of sleeping (#538)
+    bucket.virtualTime = targetSlot;
 
-    // Wait for the scheduled slot
-    await this.sleep(delayMs, signal);
+    try {
+      await this.sleep(delayMs, signal);
+    } catch (err) {
+      // Rollback reservation if this was the last queued request
+      if (bucket.virtualTime === targetSlot) {
+        bucket.virtualTime = Math.max(minVirtualTime, targetSlot - intervalMs);
+      }
+      throw err;
+    }
 
     return { allowed: true, delayed: true, delayMs, overflow: false };
   }
@@ -83,7 +94,7 @@ export class TrafficSmoother {
     const b = this._buckets.get(ref);
     if (!b) return 0;
     const curNow = this.now();
-    const wait = Math.max(0, b.nextSlot - curNow);
+    const wait = Math.max(0, b.virtualTime - curNow);
     return wait > 0 ? Math.ceil(wait / 100) : 0;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.72",
+  "version": "0.8.74",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [