@goodandready/dsh-key-rotation 0.8.73 → 0.8.75

package/lib/safe-fetch.js

@@ -2,7 +2,6 @@
 import net from 'node:net';
 import dns from 'node:dns/promises';
 import nodeDns from 'node:dns';
-import { Agent } from 'undici';
 
 export const MAX_IMPORT_BYTES = 1024 * 1024; // 1 MB limit
 export const MAX_REDIRECTS = 5;
@@ -105,33 +104,36 @@ export function isPrivateOrReservedIp(ip) {
  * @returns {Agent}
  */
 export function createSafeDispatcher({ lookupImpl = nodeDns.lookup } = {}) {
-  return new Agent({
-    connect: {
-      lookup: (hostname, options, callback) => {
-        const cb = typeof options === 'function' ? options : callback;
-        const opts = typeof options === 'function' ? {} : (typeof options === 'number' ? { family: options } : (options || {}));
-        lookupImpl(hostname, { ...opts, all: true }, (err, addresses) => {
-          if (err) return cb(err);
-          const list = Array.isArray(addresses) ? addresses : [addresses];
-          for (const item of list) {
-            const addr = typeof item === 'string' ? item : item.address;
-            if (isPrivateOrReservedIp(addr)) {
-              const ssrfErr = new Error(`dsh-key-rotation: connect blocked: host ${hostname} resolves to private or reserved IP ${addr}`);
-              ssrfErr.code = 'SSRF_BLOCKED';
-              return cb(ssrfErr);
-            }
-          }
-          if (!opts.all) {
-            const first = list[0];
-            const addr = typeof first === 'string' ? first : first?.address;
-            const fam = typeof first === 'object' && first?.family ? first.family : (net.isIP(addr) || 4);
-            return cb(null, addr, fam);
-          }
-          return cb(null, addresses);
-        });
-      },
+  const lookup = (hostname, options, callback) => {
+    const cb = typeof options === 'function' ? options : callback;
+    const opts = typeof options === 'function' ? {} : (typeof options === 'number' ? { family: options } : (options || {}));
+    lookupImpl(hostname, { ...opts, all: true }, (err, addresses) => {
+      if (err) return cb(err);
+      const list = Array.isArray(addresses) ? addresses : [addresses];
+      for (const item of list) {
+        const addr = typeof item === 'string' ? item : item.address;
+        if (isPrivateOrReservedIp(addr)) {
+          const ssrfErr = new Error(`dsh-key-rotation: connect blocked: host ${hostname} resolves to private or reserved IP ${addr}`);
+          ssrfErr.code = 'SSRF_BLOCKED';
+          return cb(ssrfErr);
+        }
+      }
+      if (!opts.all) {
+        const first = list[0];
+        const addr = typeof first === 'string' ? first : first?.address;
+        const fam = typeof first === 'object' && first?.family ? first.family : (net.isIP(addr) || 4);
+        return cb(null, addr, fam);
+      }
+      return cb(null, addresses);
+    });
+  };
+
+  return {
+    options: {
+      connect: { lookup },
     },
-  });
+    connect: { lookup },
+  };
 }
 
 /**
@@ -270,7 +272,7 @@ export async function safeFetchJson(url, {
   redirectsLeft = MAX_REDIRECTS,
   dispatcher,
 } = {}) {
-  const safeDispatcher = dispatcher ?? (fetchImpl === globalThis.fetch ? createSafeDispatcher() : undefined);
+  const safeDispatcher = dispatcher;
   let currentUrl = url;
   while (true) {
     await assertSafeUrl(currentUrl, { lookupImpl });

package/lib/selection-trace.js

@@ -1,10 +1,33 @@
-// lib/selection-trace.js — Request-scoped key selection explanation and attempt history (#461).
+// lib/selection-trace.js — Request-scoped key selection explanation and attempt history (#461, #544).
 // Provides auditable reasoning for key skips, selection, failovers, and cascade with strict secret redaction.
 
 import { keyTail } from './pool.js';
 
 const TRACE_BUFFER_LIMIT = 100;
-const traces = [];
+
+export class SelectionTraceStore {
+  constructor(limit = TRACE_BUFFER_LIMIT) {
+    this.limit = limit;
+    this.traces = [];
+  }
+
+  push(summary) {
+    if (this.traces.length >= this.limit) {
+      this.traces.shift();
+    }
+    this.traces.push(summary);
+  }
+
+  get(limit = 50) {
+    return this.traces.slice(-Math.max(1, Math.min(this.limit, limit)));
+  }
+
+  clear() {
+    this.traces.length = 0;
+  }
+}
+
+const defaultSelectionTraceStore = new SelectionTraceStore();
 
 /**
  * Redacts any sensitive tokens from string / object representation (#537).
@@ -30,10 +53,11 @@ export function sanitizeTraceDetails(str) {
     .slice(0, 300);
 }
 
-export function createSelectionTrace(requestId, options = {}) {
+export function createSelectionTrace(requestId, options = {}, store = null) {
   const reqId = requestId || `req-${Date.now()}-${Math.random().toString(36).slice(2, 7)}`;
   const startTime = Date.now();
   const events = [];
+  const targetStore = store || defaultSelectionTraceStore;
 
   return {
     requestId: reqId,
@@ -73,19 +97,16 @@ export function createSelectionTrace(requestId, options = {}) {
         steps: events,
       };
 
-      if (traces.length >= TRACE_BUFFER_LIMIT) {
-        traces.shift();
-      }
-      traces.push(summary);
+      targetStore.push(summary);
       return summary;
     }
   };
 }
 
-export function getSelectionTraces(limit = 50) {
-  return traces.slice(-Math.max(1, Math.min(100, limit)));
+export function getSelectionTraces(limit = 50, store = null) {
+  return (store || defaultSelectionTraceStore).get(limit);
 }
 
-export function clearSelectionTraces() {
-  traces.length = 0;
+export function clearSelectionTraces(store = null) {
+  (store || defaultSelectionTraceStore).clear();
 }

package/lib/simulator.js

@@ -37,18 +37,24 @@ export function simulateRouting(params = {}) {
     throw new Error('simulateRouting: valid pool with refs is required');
   }
 
-  // Clone pool state into isolated mock state so real runtime is never touched
+  // Clone pool state into isolated mock state so real runtime is never touched (#534)
   const mockFailedUntil = new Map(pool.state?.failedUntil || []);
   const mockFailCounts = new Map(pool.state?.failCounts || []);
   const mockRevokedRefs = new Set(pool.state?.revokedRefs || []);
+  const mockBrokenUntil = new Map(pool.state?.brokenUntil || []);
+  const mockTokenUsage = pool.state?.tokenUsage ? new Map(pool.state.tokenUsage) : new Map();
+  const mockQuotaWindows = pool.state?.quotaWindows ? new Map(pool.state.quotaWindows) : new Map();
 
   const simPool = {
     ...pool,
     state: {
+      ...pool.state,
       failedUntil: mockFailedUntil,
       failCounts: mockFailCounts,
       revokedRefs: mockRevokedRefs,
-      brokenUntil: new Map(),
+      brokenUntil: mockBrokenUntil,
+      tokenUsage: mockTokenUsage,
+      quotaWindows: mockQuotaWindows,
     },
   };
 

package/lib/traffic-smoother.js

@@ -1,21 +1,26 @@
-// lib/traffic-smoother.js — leaky bucket micro-queue traffic smoother (#496).
+// lib/traffic-smoother.js — GCRA leaky bucket micro-queue traffic smoother (#496, #538).
 // Absorbs momentary request bursts without tripping upstream per-second/per-minute rate limits.
+// Uses Generic Cell Rate Algorithm to ensure atomic slot reservation and burst compliance.
 
 export class TrafficSmoother {
   constructor({ maxQueueWaitMs = 800, now = Date.now, sleep = null } = {}) {
     this.maxQueueWaitMs = maxQueueWaitMs;
     this.now = now;
     this.sleep = sleep || ((ms, signal) => new Promise((resolve, reject) => {
-      if (signal?.aborted) return reject(signal.reason ?? new Error('aborted'));
+      if (signal?.aborted) {
+        const err = (signal.reason instanceof Error) ? signal.reason : Object.assign(new Error('This operation was aborted'), { name: 'AbortError' });
+        return reject(err);
+      }
       const timer = setTimeout(resolve, ms);
       if (signal) {
         signal.addEventListener('abort', () => {
           clearTimeout(timer);
-          reject(signal.reason ?? new Error('aborted'));
+          const err = (signal.reason instanceof Error) ? signal.reason : Object.assign(new Error('This operation was aborted'), { name: 'AbortError' });
+          reject(err);
         }, { once: true });
       }
     }));
-    // Map<ref, { lastTime: number, tokens: number, lastUpdate: number }>
+    // Map<ref, { virtualTime: number }>
     this._buckets = new Map();
   }
 
@@ -45,35 +50,41 @@ export class TrafficSmoother {
 
     let bucket = this._buckets.get(ref);
     if (!bucket) {
-      bucket = { tokens: capacity, lastUpdate: curNow, nextSlot: curNow };
+      bucket = { virtualTime: curNow - capacity * intervalMs };
       this._buckets.set(ref, bucket);
     }
 
-    // Replenish tokens based on elapsed time
-    const elapsed = Math.max(0, curNow - bucket.lastUpdate);
-    const addedTokens = elapsed * (ratePerSec / 1000);
-    bucket.tokens = Math.min(capacity, bucket.tokens + addedTokens);
-    bucket.lastUpdate = curNow;
+    // GCRA: virtualTime cannot fall behind (curNow - capacity * intervalMs)
+    const minVirtualTime = curNow - capacity * intervalMs;
+    const vTime = Math.max(minVirtualTime, bucket.virtualTime);
+    const targetSlot = vTime + intervalMs;
 
-    if (bucket.tokens >= 1) {
-      bucket.tokens -= 1;
-      bucket.nextSlot = Math.max(curNow, bucket.nextSlot);
+    if (targetSlot <= curNow) {
+      // Immediate acquisition within available burst capacity
+      bucket.virtualTime = targetSlot;
       return { allowed: true, delayed: false, delayMs: 0, overflow: false };
     }
 
-    // Burst is exhausted: calculate delay required for next available slot
-    const targetSlot = Math.max(curNow, bucket.nextSlot) + intervalMs;
-    const delayMs = Math.max(0, targetSlot - curNow);
+    // Queue delay required
+    const delayMs = targetSlot - curNow;
 
     if (delayMs > maxWait) {
       // Exceeds max micro-queue wait: signal overflow so caller rotates to next candidate
       return { allowed: false, delayed: false, delayMs, overflow: true };
     }
 
-    bucket.nextSlot = targetSlot;
+    // Atomically reserve the slot ahead of sleeping (#538)
+    bucket.virtualTime = targetSlot;
 
-    // Wait for the scheduled slot
-    await this.sleep(delayMs, signal);
+    try {
+      await this.sleep(delayMs, signal);
+    } catch (err) {
+      // Rollback reservation if this was the last queued request
+      if (bucket.virtualTime === targetSlot) {
+        bucket.virtualTime = Math.max(minVirtualTime, targetSlot - intervalMs);
+      }
+      throw err;
+    }
 
     return { allowed: true, delayed: true, delayMs, overflow: false };
   }
@@ -83,7 +94,7 @@ export class TrafficSmoother {
     const b = this._buckets.get(ref);
     if (!b) return 0;
     const curNow = this.now();
-    const wait = Math.max(0, b.nextSlot - curNow);
+    const wait = Math.max(0, b.virtualTime - curNow);
     return wait > 0 ? Math.ceil(wait / 100) : 0;
   }
 

package/package.json

@@ -1,7 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.73",
-  "packageManager": "pnpm@10.33.2",
+  "version": "0.8.75",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [
     "deepseek-harness",
@@ -60,13 +59,6 @@
     "@deepseek-ai/dsh-llm": "^0.1.7-rc.2 || >=0.2.0-rc.1 <0.2.1-0 || >=0.2.1-alpha.1 <0.2.2-0",
     "@deepseek-ai/schemastery": "^3.18.4"
   },
-  "scripts": {
-    "test": "node tools/test.mjs",
-    "test:core": "node tools/test.mjs --core",
-    "check": "node tools/check.mjs",
-    "build:client": "node scripts/build-client.mjs",
-    "pretest": "node scripts/build-client.mjs"
-  },
   "devDependencies": {
     "react": "18.3.1",
     "react-test-renderer": "18.3.1",
@@ -75,7 +67,12 @@
     "@deepseek-ai/schemastery": "^3.18.4",
     "semver": "^7.6.3"
   },
-  "dependencies": {
-    "undici": "^6.29.0"
+  "dependencies": {},
+  "scripts": {
+    "test": "node tools/test.mjs",
+    "test:core": "node tools/test.mjs --core",
+    "check": "node tools/check.mjs",
+    "build:client": "node scripts/build-client.mjs",
+    "pretest": "node scripts/build-client.mjs"
   }
-}
+}