@goodandready/dsh-key-rotation 0.8.73 → 0.8.75

package/lib/ops-config-io.js

@@ -224,7 +224,7 @@ export function registerConfigIoRoutes(ctx, deps) {
         }
       }
 
-      const settings = ctx.get('settings');
+      const settings = typeof ctx?.get === 'function' ? ctx.get('settings') : (ctx?.settings || null);
       let currentConfig = {};
       try {
         if (settings && typeof settings.get === 'function') {
@@ -322,28 +322,54 @@ export function registerConfigIoRoutes(ctx, deps) {
     const mode = body.mode === 'replace' ? 'replace' : 'merge';
     const dryRun = Boolean(body.dryRun);
 
-    const settings = ctx.get('settings');
+    const settings = typeof ctx?.get === 'function' ? ctx.get('settings') : (ctx?.settings || null);
+    if (!settings || typeof settings.replace !== 'function') {
+      // Fail closed when settings service is missing or lacks replace (#533)
+      json(res, 503, { error: { code: 'settings-unavailable', message: 'Settings service is not available or does not support writing configuration' } });
+      return;
+    }
+
     let currentConfig = {};
+    let currentRevision = null;
     try {
-      if (settings && typeof settings.get === 'function') {
-        currentConfig = settings.get(NS) || {};
-      } else if (settings && typeof settings.describe === 'function') {
+      if (typeof settings.describe === 'function') {
         const desc = settings.describe({ redactSecrets: false })?.find((c) => c.ns === NS);
-        currentConfig = desc?.value || {};
-      } else {
-        currentConfig = deps.buildRuntime().cfg0 || {};
+        if (desc) {
+          currentConfig = desc.value || {};
+          currentRevision = desc.revision ?? null;
+        }
+      }
+      if (!currentConfig || Object.keys(currentConfig).length === 0) {
+        if (typeof settings.get === 'function') {
+          currentConfig = settings.get(NS) || {};
+        }
       }
     } catch (_) {
       currentConfig = deps.buildRuntime().cfg0 || {};
     }
     const rawCurrent = plainConfig(currentConfig);
 
+    // Concurrency control: if client provided expectedRevision, reject if stale (#553)
+    if (typeof body.expectedRevision === 'number' && currentRevision !== null) {
+      if (body.expectedRevision !== currentRevision) {
+        json(res, 409, {
+          error: {
+            code: 'conflict',
+            message: `Configuration has been modified concurrently (expected revision ${body.expectedRevision}, current is ${currentRevision})`,
+            currentRevision,
+          }
+        });
+        return;
+      }
+    }
+
     const preview = diffConfigs(rawCurrent, incomingConfig, mode);
 
     if (dryRun) {
       json(res, 200, {
         ok: true,
         dryRun: true,
+        revision: currentRevision,
         preview,
       });
       return;
@@ -379,19 +405,18 @@ export function registerConfigIoRoutes(ctx, deps) {
       mergedConfig.providers = curProviders;
     }
 
-    if (settings && typeof settings.replace === 'function') {
-      try {
-        await settings.replace(NS, mergedConfig);
-      } catch (err) {
-        json(res, 500, { error: { code: 'settings-write-failed', message: err.message } });
-        return;
-      }
+    try {
+      await settings.replace(NS, mergedConfig, currentRevision ?? undefined);
+    } catch (err) {
+      json(res, 500, { error: { code: 'settings-write-failed', message: err.message } });
+      return;
     }
 
     json(res, 200, {
       ok: true,
       applied: true,
       mode,
+      revision: typeof currentRevision === 'number' ? currentRevision + 1 : undefined,
       preview,
     });
   };

package/lib/ops-keys.js

@@ -165,17 +165,18 @@ ctx.effect(() => ctx.webServer.register({
       return;
     }
     const concurrency = deps.concurrencyTracker;
+    const keyDrainManager = deps.keyDrainManager;
 
     if (req.method === 'GET') {
       const url = new URL(req.url ?? DRAIN_PATH, 'http://localhost');
       const ref = url.searchParams.get('ref');
       if (ref) {
-        const status = getDrainingStatus(ref, concurrency);
+        const status = getDrainingStatus(ref, concurrency, keyDrainManager);
         if (!status) { json(res, 404, { error: { code: 'not-found', message: `Key ${ref} is not currently draining` } }); return; }
         json(res, 200, { ok: true, draining: status });
         return;
       }
-      json(res, 200, { ok: true, draining: getAllDrainingKeys(concurrency) });
+      json(res, 200, { ok: true, draining: getAllDrainingKeys(concurrency, keyDrainManager) });
       return;
     }
 
@@ -187,8 +188,8 @@ ctx.effect(() => ctx.webServer.register({
       }
       const ref = body?.ref;
       if (!ref) { json(res, 400, { error: { code: 'bad-request', message: 'Missing ref' } }); return; }
-      markKeyDraining(ref, body?.provider || '');
-      json(res, 200, { ok: true, status: getDrainingStatus(ref, concurrency) });
+      markKeyDraining(ref, body?.provider || '', keyDrainManager);
+      json(res, 200, { ok: true, status: getDrainingStatus(ref, concurrency, keyDrainManager) });
       return;
     }
 
@@ -196,7 +197,7 @@ ctx.effect(() => ctx.webServer.register({
       const url = new URL(req.url ?? DRAIN_PATH, 'http://localhost');
       const ref = url.searchParams.get('ref');
       if (!ref) { json(res, 400, { error: { code: 'bad-request', message: 'Missing ref query parameter' } }); return; }
-      const cancelled = cancelKeyDrain(ref);
+      const cancelled = cancelKeyDrain(ref, keyDrainManager);
       json(res, 200, { ok: true, cancelled });
       return;
     }

package/lib/ops-quick-action.js

@@ -66,10 +66,11 @@ export function registerQuickActionRoutes(ctx, deps) {
           json(res, 400, { error: { code: 'no-keys', message: 'Pool has no keys to rotate' } });
           return;
         }
-        const currentCursor = targetPool.state.cursor ?? 0;
-        const nextCursor = (currentCursor + 1) % total;
-        targetPool.state.cursor = nextCursor;
-        const nextRef = targetPool.refs[nextCursor];
+        const currentPointer = targetPool.state.pointer ?? targetPool.state.cursor ?? 0;
+        const nextPointer = (currentPointer + 1) % total;
+        targetPool.state.pointer = nextPointer;
+        targetPool.state.cursor = nextPointer;
+        const nextRef = targetPool.refs[nextPointer];
         targetPool.state.lastUsed = nextRef;
 
         if (typeof pushEvent === 'function') {
@@ -80,7 +81,7 @@ export function registerQuickActionRoutes(ctx, deps) {
           ok: true,
           action: 'skip',
           provider,
-          cursor: nextCursor,
+          cursor: nextPointer,
           activeRef: nextRef,
           activeTail: keyTail(nextRef),
         });

package/lib/ops-telemetry.js

@@ -30,20 +30,40 @@ import { getPromptCacheSummary } from './prompt-cache.js';
  */
 
 const DIAG_BUFFER_LIMIT = 200;
-const diagBuffer = [];
 
-export function pushDiag(entry) {
-  if (diagBuffer.length >= DIAG_BUFFER_LIMIT) {
-    diagBuffer.shift();
+export class DiagBuffer {
+  constructor(limit = DIAG_BUFFER_LIMIT) {
+    this.limit = limit;
+    this.buffer = [];
   }
-  diagBuffer.push({
-    timestamp: Date.now(),
-    ...entry,
-  });
+
+  push(entry) {
+    if (this.buffer.length >= this.limit) {
+      this.buffer.shift();
+    }
+    this.buffer.push({
+      timestamp: Date.now(),
+      ...entry,
+    });
+  }
+
+  get() {
+    return this.buffer.slice();
+  }
+
+  clear() {
+    this.buffer.length = 0;
+  }
+}
+
+const defaultDiagBuffer = new DiagBuffer();
+
+export function pushDiag(entry, buffer = null) {
+  (buffer || defaultDiagBuffer).push(entry);
 }
 
-export function getDiagBuffer() {
-  return diagBuffer.slice();
+export function getDiagBuffer(buffer = null) {
+  return (buffer || defaultDiagBuffer).get();
 }
 
 export function registerTelemetryRoutes(ctx, deps) {
@@ -154,14 +174,15 @@ ctx.effect(() => ctx.webServer.register({
       json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: trace is local-only' } });
       return;
     }
+    const traceStore = deps.selectionTraceStore || null;
     if (req.method === 'DELETE') {
-      clearSelectionTraces();
+      clearSelectionTraces(traceStore);
       json(res, 200, { ok: true, message: 'trace history cleared' });
       return;
     }
     const url = new URL(req.url ?? TRACE_PATH, 'http://localhost');
     const limit = Math.min(100, Math.max(1, Number(url.searchParams.get('limit')) || 50));
-    json(res, 200, { ok: true, traces: getSelectionTraces(limit) });
+    json(res, 200, { ok: true, traces: getSelectionTraces(limit, traceStore) });
   },
 }), 'dsh-key-rotation: trace route');
 
@@ -185,11 +206,25 @@ ctx.effect(() => ctx.webServer.register({
     }
 
     const runtime = buildRuntime();
-    const provider = body?.provider || (runtime.pools?.[0]?.base ?? '');
-    const pool = runtime.providerToPool?.[provider] || runtime.pools?.[0];
+    const provider = body?.provider?.trim();
+    if (!provider) {
+      json(res, 400, { error: { code: 'bad-request', message: 'provider is required for simulation' } });
+      return;
+    }
+
+    let pool = null;
+    if (runtime.providerToPool instanceof Map) {
+      pool = runtime.providerToPool.get(provider);
+    } else if (runtime.providerToPool && typeof runtime.providerToPool === 'object') {
+      pool = runtime.providerToPool[provider];
+    }
+    if (!pool) {
+      const pools = runtime.pools ?? [];
+      pool = pools.find(p => p.provider === provider || p.base === provider);
+    }
 
     if (!pool) {
-      json(res, 404, { error: { code: 'not-found', message: `Provider '${provider}' not found` } });
+      json(res, 404, { error: { code: 'not-found', message: `Provider '${provider}' not found in configured pools` } });
       return;
     }
 
@@ -234,7 +269,7 @@ ctx.effect(() => ctx.webServer.register({
       json(res, 200, { ok: true, count: diagBuffer.length });
       return;
     }
-    json(res, 200, { diag: getDiagBuffer() });
+    json(res, 200, { diag: deps.diagBuffer ? deps.diagBuffer.get() : getDiagBuffer() });
   },
 }), 'dsh-key-rotation: diag route');
 

package/lib/pool-builder.js

@@ -39,6 +39,8 @@ export function buildPoolItem({
   useKeyRef = null,
   trafficSmoothingBurst = null,
   maxQueueWaitMs = null,
+  maxAttempts = null,
+  maxDurationMs = null,
 }) {
   const seen = new Set();
   const indexed = (Array.isArray(keys) ? keys : []).map((key, index) => ({ ref: typeof key === 'string' ? key.trim() : '', index }))
@@ -89,7 +91,7 @@ export function buildPoolItem({
   
   const tiersMap = {};
   for (let i = 0; i < refs.length; i++) {
-    const val = Array.isArray(tiers) ? tiers[indexed[i].index] : (tiers && typeof tiers ===  object ? tiers[refs[i]] : undefined);
+    const val = Array.isArray(tiers) ? tiers[indexed[i].index] : (tiers && typeof tiers === 'object' ? tiers[refs[i]] : undefined);
     tiersMap[refs[i]] = Number.isFinite(val) && val >= 1 ? Math.floor(val) : 1;
   }
 const weightsMap = {};
@@ -143,6 +145,12 @@ const weightsMap = {};
     maxQueueWaitMs: typeof maxQueueWaitMs === 'number' && Number.isFinite(maxQueueWaitMs) && maxQueueWaitMs >= 0
       ? Math.floor(maxQueueWaitMs)
       : 800,
+    maxAttempts: typeof maxAttempts === 'number' && Number.isFinite(maxAttempts) && maxAttempts > 0
+      ? Math.floor(maxAttempts)
+      : 0,
+    maxDurationMs: typeof maxDurationMs === 'number' && Number.isFinite(maxDurationMs) && maxDurationMs > 0
+      ? Math.floor(maxDurationMs)
+      : 0,
   };
 }
 
@@ -178,13 +186,18 @@ export function buildPools({ cfg = {}, poolState = new Map(), defaultState = ini
     const provRpm = typeof p.rpmLimit === 'number' ? p.rpmLimit : rpmLimit;
     const provTpm = typeof p.tpmLimit === 'number' ? p.tpmLimit : tpmLimit;
     const provConcurrency = typeof p.concurrencyLimit === 'number' ? p.concurrencyLimit : concurrencyLimit;
+    const poolAttempts = typeof p.maxAttempts === 'number' ? p.maxAttempts : (cfg.maxAttempts ?? 0);
+    const poolDuration = typeof p.maxDurationMs === 'number' ? p.maxDurationMs : (cfg.maxDurationMs ?? 0);
     const pool = buildPool(p.provider, p.keys, p.weights, p.paused, p.revoked, poolCooldown, poolMax, p.expiresAt, p.routingStrategy, p.proactiveRateLimitGuard, {
       provider: p.provider,
       model: null,
       labels: p.labels,
+      tiers: p.tiers,
       pinnedRef: p.pinnedRef ?? p.useKeyRef,
       trafficSmoothingBurst: p.trafficSmoothingBurst ?? cfg.trafficSmoothingBurst,
       maxQueueWaitMs: p.maxQueueWaitMs ?? cfg.maxQueueWaitMs,
+      maxAttempts: poolAttempts,
+      maxDurationMs: poolDuration,
     }, provRpm, provTpm, provConcurrency);
     if (pool) {
       for (const ref of pool.refs) {
@@ -215,6 +228,8 @@ export function buildPools({ cfg = {}, poolState = new Map(), defaultState = ini
         pinnedRef: mp.pinnedRef ?? mp.useKeyRef ?? p.pinnedRef ?? p.useKeyRef,
         trafficSmoothingBurst: mp.trafficSmoothingBurst ?? p.trafficSmoothingBurst ?? cfg.trafficSmoothingBurst,
         maxQueueWaitMs: mp.maxQueueWaitMs ?? p.maxQueueWaitMs ?? cfg.maxQueueWaitMs,
+        maxAttempts: typeof mp.maxAttempts === 'number' ? mp.maxAttempts : poolAttempts,
+        maxDurationMs: typeof mp.maxDurationMs === 'number' ? mp.maxDurationMs : poolDuration,
       }, modelRpm, modelTpm, modelConcurrency);
       if (!mpool) continue;
       mpool.basePool = pool;

package/lib/pool.js

@@ -468,14 +468,20 @@ export function isSwitchableError(failureOrPayload, switchCodes = new Set(DEFAUL
   // and DEFAULT_SWITCH_CODES is exported as an array); normalize before .has().
   if (!(switchCodes instanceof Set)) switchCodes = new Set(Array.isArray(switchCodes) ? switchCodes : DEFAULT_SWITCH_CODES);
   const failure = failureOrPayload.failure ?? failureOrPayload;
-  const status = Number(failure.status ?? failure.statusCode ?? failure.httpStatus ?? 0);
-  let code = String(failure.code ?? failure.reason ?? '').toUpperCase();
+  let status = Number(failure.status ?? failure.statusCode ?? failure.httpStatus ?? 0);
+  let rawCode = String(failure.code ?? failure.reason ?? '').trim();
+  let code = rawCode.toUpperCase();
   if (code && SOCKET_TRANSPORT_CODES.has(code)) code = 'TRANSPORT';
   const message = String(failure.message ?? failureOrPayload.message ?? '');
 
-  // 1. Direct HTTP status codes (#267: also 408/425 transient)
+  // Treat numeric failure.code (e.g. code: "429") as HTTP status if status was not set (#545)
+  if (!status && /^\d{3}$/.test(rawCode)) {
+    status = Number(rawCode);
+  }
+
+  // 1. Direct HTTP status codes (#267: also 408/425 transient, #545: numeric status/code mapped to semantic switch codes)
   if ((status === 429 || status === 408 || status === 425) && (switchCodes.has('RATE_LIMIT') || switchCodes.has('QUOTA') || switchCodes.has('429') || switchCodes.has('TIMEOUT') || switchCodes.has(String(status)))) return true;
-  if ((status === 401 || status === 403) && (switchCodes.has('AUTH') || switchCodes.has('401'))) return true;
+  if ((status === 401 || status === 403) && (switchCodes.has('AUTH') || switchCodes.has('401') || switchCodes.has('403') || switchCodes.has(String(status)))) return true;
   if ((status >= 500 && status <= 504) && (switchCodes.has('SERVER') || switchCodes.has(String(status)))) return true;
 
   // 2. Standard gRPC / cloud error codes

package/lib/request-budget.js

@@ -22,13 +22,14 @@ export function createRequestBudget(options = {}) {
 
   const controller = new AbortController();
   let timerId = null;
+  let onCallerAbort = null;
 
   // Chain caller signal if provided
   if (options.signal) {
     if (options.signal.aborted) {
       controller.abort(options.signal.reason);
     } else {
-      const onCallerAbort = () => {
+      onCallerAbort = () => {
         controller.abort(options.signal.reason);
         cleanup();
       };
@@ -52,6 +53,12 @@ export function createRequestBudget(options = {}) {
       clearTimeout(timerId);
       timerId = null;
     }
+    if (options.signal && onCallerAbort) {
+      try {
+        options.signal.removeEventListener('abort', onCallerAbort);
+      } catch {}
+      onCallerAbort = null;
+    }
   }
 
   return {

package/lib/resolver.js

@@ -121,7 +121,7 @@ export function createResolver({
     const strategy = pool.routingStrategy ?? runtime.routingStrategy ?? 'round-robin';
     const sessionId = resolveOpts?.sessionId ?? resolveOpts?.session ?? resolveOpts?.metadata?.sessionId ?? currentSession?.();
     let list = pool.weightedRefs ?? pool.refs;
-    if (strategy === 'lowest-latency' || strategy === 'least-loaded' || strategy === 'sticky') {
+    if (strategy === 'lowest-latency' || strategy === 'least-loaded' || strategy === 'sticky' || strategy === 'tier-priority') {
       list = sortAttemptList(list, strategy, {
         latencyHistogram,
         concurrencyTracker,