@goodandready/dsh-key-rotation 0.8.74 → 0.8.76

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.8.76 (2026-10-30)
+
+### Security Hardening, DNS Pinning & Mutation Integrity (Block 4 Release)
+- **SSRF DNS Rebinding Prevention (Issue #557)**: Replaced single-shot DNS precheck with connect-time socket IP validation (`createSafeLookup`) via native HTTPS request handling (`fetchNativeJson`). Enforces loopback and private IP rejection at the exact moment the socket establishes connection across all attempts and redirects, completely neutralizing TOCTOU DNS rebinding with zero runtime dependencies.
+- **Write-Origin Guard & Desktop Spoofing Elimination (Issue #516)**: Added `hasNonLoopbackForwarding` to detect requests proxied through LAN reverse proxies (`x-forwarded-for`, `x-real-ip`). Refused mutating requests (POST/PUT/DELETE/PATCH) lacking Origin or attempting to spoof Desktop headers (`@deepseek-ai/dsh-desktop/` User-Agent, `dsh-auth-` cookies, or `dsh-app://app` Origin) over LAN; ensured `/auto-import` strictly validates bodies and fails closed.
+- **Config Import Optimistic Concurrency & Revision Integrity (Issue #553)**: End-to-end optimistic revision tracking in config import; dry-run preview returns settings revision, WebUI client (`50-card-main.js`) stores preview revision and transmits `expectedRevision` upon apply; backend validates revision match and converts `SETTINGS_CONFLICT` during `settings.replace` into HTTP 409 Conflict with clear preview invalidation guidance instead of generic 500 errors.
+
+## 0.8.75 (2026-10-30)
+
+### Dependencies, Cleanup & Audit Finalization (Block 3 Release)
+- **Zero Runtime Dependencies & Security Hardening (Issues #520, #535)**: Completely removed `undici` dependency and eliminated 5 high/moderate vulnerabilities (`pnpm audit --prod` reports 0 vulnerabilities); `safe-fetch.js` rewritten using standard `globalThis.fetch` and pure Node.js DNS/IP validation.
+- **Atomic I/O Cleanup (Issue #521)**: Crash-safe file writes now safely clean up `.tmp` files on write/sync/rename errors, and `cleanupStaleTmpFiles` purges abandoned temporary files on startup.
+- **Request Budget Inheritance & Signal Management (Issue #464)**: `maxAttempts` and `maxDurationMs` properly propagated from settings to `buildRuntime()` and `pool-builder`; `createRequestBudget` removes caller `AbortSignal` listeners upon `dispose()`; guaranteed cleanup in `rotate.js` `finally` block; traffic smoother now receives `budget.signal`.
+- **Selection Trace Diagnosability (Issue #461)**: Candidate evaluation now logs detailed `SKIPPED` steps (`PAUSED`, `REVOKED`, `BROKEN`, `DRAINING`, `COOLDOWN`, `CAPABILITY_MISMATCH`, `QUOTA_EXHAUSTED`); added interactive Selection Trace UI inspector in settings card.
+- **Managed Key Drain UI & Concurrency Robustness (Issue #463)**: Added interactive Managed Key Drain section in settings card; enhanced `ConcurrencyTracker` with `touch()` and prolonged 30m stale threshold for long-running streaming generation.
+- **Offline Simulator Parity (Issue #462)**: Audit verification finalized following Block 2 quarantine cloning, Map lookup, and per-Context isolation fixes.
+
 ## 0.8.74 (2026-10-30)
 
 ### Rotation & Routing Reliability (Block 2 Release)

package/lib/atomic-io.js

@@ -1,5 +1,6 @@
-// lib/atomic-io.js — crash-safe file writes and safe JSON loads (#264).
+// lib/atomic-io.js — crash-safe file writes and safe JSON loads (#264, #521).
 // Never overwrite a non-empty destination with empty/corrupt parse results.
+// Clean up orphaned temporary files on failure or during startup.
 
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
@@ -8,6 +9,7 @@ import crypto from 'node:crypto';
 
 /**
  * Atomically write data to filePath (temp + rename in same directory).
+ * Cleans up temporary file if open, write, sync, or rename fails (#521).
  * @param {string} filePath
  * @param {string|Buffer} data
  */
@@ -15,14 +17,55 @@ export async function atomicWriteFile(filePath, data) {
   const dir = path.dirname(filePath);
   await fs.mkdir(dir, { recursive: true });
   const tmp = path.join(dir, `.${path.basename(filePath)}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`);
-  const fh = await fs.open(tmp, 'w');
+  let fh = null;
   try {
+    fh = await fs.open(tmp, 'w');
     await fh.writeFile(data);
     await fh.sync();
-  } finally {
     await fh.close();
+    fh = null;
+    await fs.rename(tmp, filePath);
+  } catch (err) {
+    if (fh) {
+      try { await fh.close(); } catch {}
+    }
+    try { await fs.unlink(tmp); } catch {}
+    throw err;
+  }
+}
+
+/**
+ * Clean up stale temporary files left behind by crashed or interrupted writes (#521).
+ * @param {string} filePath
+ * @param {number} [maxAgeMs=3600000]
+ * @returns {Promise<number>} number of files unlinked
+ */
+export async function cleanupStaleTmpFiles(filePath, maxAgeMs = 3600000) {
+  if (!filePath || typeof filePath !== 'string') return 0;
+  try {
+    const dir = path.dirname(filePath);
+    const base = path.basename(filePath);
+    const prefix = `.${base}.`;
+    const entries = await fs.readdir(dir, { withFileTypes: true }).catch(() => []);
+    const now = Date.now();
+    let cleaned = 0;
+    for (const entry of entries) {
+      if (!entry.isFile()) continue;
+      if (entry.name.startsWith(prefix) && entry.name.endsWith('.tmp')) {
+        const fullPath = path.join(dir, entry.name);
+        try {
+          const st = await fs.stat(fullPath);
+          if (now - st.mtimeMs > maxAgeMs) {
+            await fs.unlink(fullPath);
+            cleaned++;
+          }
+        } catch {}
+      }
+    }
+    return cleaned;
+  } catch {
+    return 0;
   }
-  await fs.rename(tmp, filePath);
 }
 
 /**

package/lib/client.js

@@ -61,6 +61,24 @@ window.__ModuleLoader__.load({
       sectionStatsDesc: 'Real-time telemetry of active key pools, healthy credentials, and failover status.',
       sectionFailover: 'Failover Triggers & Error Codes',
       sectionFailoverDesc: 'Select error conditions that trigger automatic switching to the next available key.',
+            maxAttemptsLabel: 'Max Attempts (Budget)',
+      maxDurationLabel: 'Max Duration ms (Budget)',
+      traceTitle: 'Key Selection Traces',
+      traceDesc: 'Candidate evaluation history, skips and selection decisions for requests.',
+      traceRefresh: 'Refresh Traces',
+      traceClear: 'Clear History',
+      traceEmpty: 'No selection traces recorded yet.',
+      traceSelected: 'Selected Key',
+      traceOutcome: 'Outcome',
+      drainTitle: 'Managed Key Drain',
+      drainDesc: 'Safely transition a key out of rotation waiting for active requests to finish.',
+      drainKeyPlaceholder: 'Key ref (e.g. DEEPSEEK_API_KEY_2)',
+      drainStart: 'Start Drain',
+      drainCancel: 'Cancel Drain',
+      drainActiveStreams: 'Active requests',
+      drainCanComplete: 'Ready to remove',
+      drainDraining: 'Draining Keys',
+      drainEmpty: 'No keys currently draining.',
       sectionTiming: 'Timing & Rotation Schedule',
       sectionTimingDesc: 'Configure cooldown durations and scheduled periodic rotation windows.',
       sectionBackup: 'Backup & Snapshots',
@@ -317,6 +335,24 @@ window.__ModuleLoader__.load({
       sectionStatsDesc: '活跃密钥池、健康凭证和故障转移状态的实时遥测。',
       sectionFailover: '故障转移触发器与错误代码',
       sectionFailoverDesc: '选择触发自动切换至下一个可用密钥的错误条件。',
+            maxAttemptsLabel: '最大重试次数 (预算)',
+      maxDurationLabel: '最大超时毫秒 (预算)',
+      traceTitle: '密钥选择追踪 (Trace)',
+      traceDesc: '查看请求的候选密钥评估、跳过原因和最终选择决策。',
+      traceRefresh: '刷新追踪',
+      traceClear: '清空历史',
+      traceEmpty: '暂无选择追踪记录。',
+      traceSelected: '所选密钥',
+      traceOutcome: '结果',
+      drainTitle: '安全下线密钥 (Drain)',
+      drainDesc: '平滑下线密钥并等待当前在途请求完成，避免中途断流。',
+      drainKeyPlaceholder: '密钥标识 (例如 DEEPSEEK_API_KEY_2)',
+      drainStart: '开始下线',
+      drainCancel: '取消下线',
+      drainActiveStreams: '在途请求数',
+      drainCanComplete: '可安全移除',
+      drainDraining: '下线中的密钥',
+      drainEmpty: '当前没有正在下线的密钥。',
       sectionTiming: '时间与轮换计划',
       sectionTimingDesc: '配置冷却持续时间和定期轮换计划窗口。',
       sectionBackup: '备份与快照',
@@ -1257,6 +1293,16 @@ window.__ModuleLoader__.load({
       // Auto-Discovery State (#491)
       const [discoveredKeys, setDiscoveredKeys] = React.useState([]);
       const [autoImporting, setAutoImporting] = React.useState(false);
+
+      // Selection Trace State (#461)
+      const [selectionTraces, setSelectionTraces] = React.useState([]);
+      const [loadingTraces, setLoadingTraces] = React.useState(false);
+
+      // Managed Key Drain State (#463)
+      const [drainingKeys, setDrainingKeys] = React.useState([]);
+      const [drainRefInput, setDrainRefInput] = React.useState('');
+      const [loadingDrain, setLoadingDrain] = React.useState(false);
+      const [drainActionError, setDrainActionError] = React.useState('');
       const [autoImportMsg, setAutoImportMsg] = React.useState('');
 
       // Test Matrix State (#490)
@@ -1270,6 +1316,7 @@ window.__ModuleLoader__.load({
       const [importPassphrase, setImportPassphrase] = React.useState('');
       const [importMode, setImportMode] = React.useState('merge');
       const [importPreview, setImportPreview] = React.useState(null);
+      const [importRevision, setImportRevision] = React.useState(null);
       const [importError, setImportError] = React.useState('');
       const [importRunning, setImportRunning] = React.useState(false);
 
@@ -1312,6 +1359,7 @@ window.__ModuleLoader__.load({
       const runImportPreview = async () => {
         setImportError('');
         setImportPreview(null);
+        setImportRevision(null);
         setImportRunning(true);
         try {
           let parsed;
@@ -1335,6 +1383,7 @@ window.__ModuleLoader__.load({
           const data = await res.json();
           if (!res.ok || !data.ok) throw new Error(data?.error?.message || 'Import preview failed');
           setImportPreview(data.preview);
+          setImportRevision(data.revision ?? null);
         } catch (err) {
           setImportError(String(err?.message ?? err));
         } finally {
@@ -1360,14 +1409,23 @@ window.__ModuleLoader__.load({
               encrypted: parsed.encrypted,
               passphrase: importPassphrase.trim() || undefined,
               mode: importMode,
+              expectedRevision: importRevision !== null ? importRevision : undefined,
               dryRun: false,
             }),
             signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
           });
           const data = await res.json();
-          if (!res.ok || !data.ok) throw new Error(data?.error?.message || 'Import apply failed');
+          if (!res.ok || !data.ok) {
+            if (res.status === 409 || data?.error?.code === 'conflict') {
+              setImportPreview(null);
+              setImportRevision(null);
+              throw new Error(data?.error?.message || 'Configuration was modified concurrently. Please preview again before applying.');
+            }
+            throw new Error(data?.error?.message || 'Import apply failed');
+          }
           setImportModal(false);
           setImportPreview(null);
+          setImportRevision(null);
           setImportText('');
           void load();
         } catch (err) {
@@ -1472,6 +1530,70 @@ window.__ModuleLoader__.load({
         }
       };
 
+      const loadTraces = async () => {
+        setLoadingTraces(true);
+        try {
+          const res = await fetch('/dsh-key-rotation/trace?limit=20');
+          const data = await res.json();
+          if (data && data.ok) {
+            setSelectionTraces(data.traces || []);
+          }
+        } catch (_) {}
+        finally {
+          setLoadingTraces(false);
+        }
+      };
+
+      const clearTraces = async () => {
+        try {
+          await fetch('/dsh-key-rotation/trace', { method: 'DELETE' });
+          setSelectionTraces([]);
+        } catch (_) {}
+      };
+
+      const loadDrainStatus = async () => {
+        setLoadingDrain(true);
+        try {
+          const res = await fetch('/dsh-key-rotation/drain');
+          const data = await res.json();
+          if (data && data.ok) {
+            setDrainingKeys(data.draining || []);
+          }
+        } catch (_) {}
+        finally {
+          setLoadingDrain(false);
+        }
+      };
+
+      const startKeyDrain = async (ref) => {
+        if (!ref || !ref.trim()) return;
+        setDrainActionError('');
+        try {
+          const res = await fetch('/dsh-key-rotation/drain', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ ref: ref.trim() }),
+          });
+          const data = await res.json();
+          if (data && data.ok) {
+            setDrainRefInput('');
+            await loadDrainStatus();
+          } else {
+            setDrainActionError(data?.error?.message || 'Drain request failed');
+          }
+        } catch (e) {
+          setDrainActionError(String(e?.message || e));
+        }
+      };
+
+      const cancelKeyDrain = async (ref) => {
+        if (!ref) return;
+        try {
+          await fetch(`/dsh-key-rotation/drain?ref=${encodeURIComponent(ref)}`, { method: 'DELETE' });
+          await loadDrainStatus();
+        } catch (_) {}
+      };
+
       const [optimisticReset, setOptimisticReset] = React.useState({});
       const [selected, setSelected] = React.useState(new Set());
       const [bulkCooldown, setBulkCooldown] = React.useState('');
@@ -2928,6 +3050,10 @@ window.__ModuleLoader__.load({
           field(t('rpmLimitLabel'), textInput(String(val.rpmLimit ?? 0), (v) => setField((cur) => ({ ...cur, rpmLimit: Number(v) || 0 })))),
           field(t('tpmLimitLabel'), textInput(String(val.tpmLimit ?? 0), (v) => setField((cur) => ({ ...cur, tpmLimit: Number(v) || 0 }))))
         ),
+        h('div', { className: 'krot-grid-2', style: { marginTop: '10px' } },
+          field(t('maxAttemptsLabel'), textInput(String(val.maxAttempts ?? 0), (v) => setField((cur) => ({ ...cur, maxAttempts: Number(v) || 0 })))),
+          field(t('maxDurationLabel'), textInput(String(val.maxDurationMs ?? 0), (v) => setField((cur) => ({ ...cur, maxDurationMs: Number(v) || 0 }))))
+        ),
         h('div', { className: 'krot-grid-3', style: { marginTop: '10px' } },
           field(t('routingStrategyLabel'), h('select', {
             className: 'krot-in',
@@ -3017,6 +3143,68 @@ window.__ModuleLoader__.load({
         ) : null
       );
 
+      const drainSection = h('div', { className: 'krot-section-card' },
+        h('div', { className: 'krot-section-title' },
+          h('span', null, '⏳ ' + t('drainTitle')),
+          h('span', { className: 'krot-badge ' + (drainingKeys.length > 0 ? 'krot-badge-warn' : 'krot-badge-ok') },
+            drainingKeys.length > 0 ? (drainingKeys.length + ' ' + t('drainDraining')) : t('drainEmpty')
+          )
+        ),
+        h('div', { className: 'krot-section-desc' }, t('drainDesc')),
+        h('div', { style: { display: 'flex', gap: '8px', flexWrap: 'wrap', alignItems: 'center', marginTop: '10px' } },
+          h('input', {
+            className: 'krot-in',
+            placeholder: t('drainKeyPlaceholder'),
+            value: drainRefInput,
+            onChange: (e) => setDrainRefInput(e.target.value),
+            style: { maxWidth: '240px' },
+          }),
+          btn(t('drainStart'), () => startKeyDrain(drainRefInput), { primary: true, disabled: !drainRefInput.trim() }),
+          btn(t('traceRefresh'), loadDrainStatus, { disabled: loadingDrain })
+        ),
+        drainActionError ? h('div', { className: 'krot-warn', style: { marginTop: '8px' } }, '⚠ ' + drainActionError) : null,
+        drainingKeys.length > 0 ? h('div', { style: { marginTop: '10px', display: 'flex', flexDirection: 'column', gap: '6px' } },
+          drainingKeys.map((dk) => h('div', { key: dk.ref, className: 'krot-stat-box', style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center', padding: '6px 12px' } },
+            h('span', { style: { fontWeight: 600 } }, dk.ref),
+            h('span', { className: 'krot-badge ' + (dk.canComplete ? 'krot-badge-ok' : 'krot-badge-warn') },
+              dk.canComplete ? t('drainCanComplete') : (t('drainActiveStreams') + ': ' + dk.inFlight)
+            ),
+            btn(t('drainCancel'), () => cancelKeyDrain(dk.ref), { danger: true })
+          ))
+        ) : null
+      );
+
+      const traceSection = h('div', { className: 'krot-section-card' },
+        h('div', { className: 'krot-section-title' },
+          h('span', null, '🧭 ' + t('traceTitle')),
+          h('span', { className: 'krot-badge krot-badge-ok' }, selectionTraces.length + ' traces')
+        ),
+        h('div', { className: 'krot-section-desc' }, t('traceDesc')),
+        h('div', { style: { display: 'flex', gap: '8px', alignItems: 'center', marginTop: '10px' } },
+          btn(loadingTraces ? '...' : t('traceRefresh'), loadTraces, { disabled: loadingTraces }),
+          btn(t('traceClear'), clearTraces, { disabled: selectionTraces.length === 0 })
+        ),
+        selectionTraces.length > 0 ? h('div', { style: { marginTop: '10px', display: 'flex', flexDirection: 'column', gap: '8px', maxHeight: '280px', overflowY: 'auto' } },
+          selectionTraces.slice().reverse().map((tr) => h('div', { key: tr.requestId, style: { border: '1px solid var(--dsw-alias-border-l2)', borderRadius: '6px', padding: '8px', fontSize: '11px' } },
+            h('div', { style: { display: 'flex', justifyContent: 'space-between', marginBottom: '4px' } },
+              h('span', { style: { fontWeight: 600 } }, (tr.provider || 'default') + (tr.model ? ' / ' + tr.model : '')),
+              h('span', { className: 'krot-badge ' + (tr.outcome === 'SUCCESS' ? 'krot-badge-ok' : 'krot-badge-bad') }, tr.outcome)
+            ),
+            h('div', { style: { color: 'var(--dsw-alias-label-secondary)', marginBottom: '4px' } },
+              tr.selectedRef ? (t('traceSelected') + ': ' + tr.selectedRef) : ''
+            ),
+            h('div', { style: { display: 'flex', flexDirection: 'column', gap: '2px', paddingLeft: '8px', borderLeft: '2px solid var(--dsw-alias-border-l2)' } },
+              (tr.steps || []).map((st, i) => h('div', { key: i, style: { display: 'flex', gap: '6px' } },
+                h('span', { style: { color: st.decision === 'SELECTED' ? 'var(--dsw-alias-state-success-primary)' : st.decision === 'SKIPPED' ? 'var(--dsw-alias-label-tertiary)' : 'var(--dsw-alias-state-danger-primary)', fontWeight: 600 } }, st.decision),
+                h('span', { style: { fontWeight: 600 } }, st.ref || '-'),
+                h('span', { style: { color: 'var(--dsw-alias-label-secondary)' } }, st.reasonCode ? ('[' + st.reasonCode + ']') : ''),
+                h('span', null, st.details || '')
+              ))
+            )
+          ))
+        ) : h('div', { className: 'krot-hint', style: { marginTop: '8px' } }, t('traceEmpty'))
+      );
+
       const backupSection = h('div', { className: 'krot-section-card' },
         h('div', { className: 'krot-section-title' },
           h('span', null, '💾 ' + t('sectionBackup')),
@@ -3305,6 +3493,8 @@ window.__ModuleLoader__.load({
           poolsSection,
           failoverSection,
           timingSection,
+          drainSection,
+          traceSection,
           backupSection,
           simulatorSection,
         ),

package/lib/concurrency.js

@@ -1,7 +1,8 @@
-// concurrency.js — per-key in-flight counter + least-connections picking (issues #193, #407).
+// concurrency.js — per-key in-flight counter + least-connections picking (issues #193, #407, #463).
 
 const CONCURRENCY_DEFAULT_LIMIT = 0;
-const CONCURRENCY_STALE_LOCK_MS = 5 * 60 * 1000;
+// Default stale timeout: 30 minutes to support prolonged streaming generation (#463)
+const CONCURRENCY_STALE_LOCK_MS = 30 * 60 * 1000;
 
 export class ConcurrencyTracker {
   constructor(opts) {
@@ -42,6 +43,14 @@ export class ConcurrencyTracker {
     return true;
   }
 
+  touch(ref, now) {
+    now = now || Date.now();
+    const e = this._inFlight.get(ref);
+    if (e && e.count > 0) {
+      e.lastAcquired = now;
+    }
+  }
+
   release(ref, now) {
     now = now || Date.now();
     const e = this._inFlight.get(ref);
@@ -55,13 +64,24 @@ export class ConcurrencyTracker {
     if (!ref) return 0;
     const e = this._inFlight.get(ref);
     if (!e) return 0;
-    if (now - e.lastAcquired > this._staleMs) return 0;
+    if (now - e.lastAcquired > this._staleMs) {
+      e.count = 0;
+      return 0;
+    }
     return e.count;
   }
 
-  snapshot() {
+  snapshot(now) {
+    now = now || Date.now();
     const out = {};
-    for (const [k, v] of this._inFlight) out[k] = { count: v.count };
+    for (const [k, v] of this._inFlight) {
+      let count = v.count;
+      if (now - v.lastAcquired > this._staleMs) {
+        count = 0;
+        v.count = 0;
+      }
+      out[k] = { count };
+    }
     return out;
   }
 

package/lib/index.js

@@ -373,6 +373,8 @@ export function apply(ctx, config = {}) {
       showChatHeaderChip: cfg.showChatHeaderChip !== false,
       switchNotifyThrottleMs: cfg.switchNotifyThrottleMs ?? 60000,
       warnBelowHealthy: cfg.warnBelowHealthy ?? 0, latencySloMs: cfg.latencySloMs ?? 0,
+      maxAttempts: typeof cfg.maxAttempts === 'number' && cfg.maxAttempts > 0 ? Math.floor(cfg.maxAttempts) : 0,
+      maxDurationMs: typeof cfg.maxDurationMs === 'number' && cfg.maxDurationMs > 0 ? Math.floor(cfg.maxDurationMs) : 0,
       index, pools,
       breaker: moduleBreaker, notifyQueue: moduleNotifyQueue, concurrencyTracker, quotaStore, latencyHistogram, trafficSmoother,
       providerTags, providerBudgets, poolByRef, providerToPool, modelPoolByProvider,

package/lib/lifecycle.js

@@ -2,6 +2,7 @@
 import { healIdleCooldowns, autoUnbreakBrokenKeys } from './heal.js';
 import { decryptSecret } from './crypto-storage.js';
 import { StatePersistence, resolveStatePath } from './persistence.js';
+import { cleanupStaleTmpFiles } from './atomic-io.js';
 import path from 'node:path';
 import { envValue } from './pool.js';
 import { clearAllDraining } from './key-drain.js';
@@ -97,6 +98,7 @@ export function setupPersistence(ctx, { cfg0, poolState, moduleBreaker, verboseL
       dataDir: hostDirs[0],
     });
     if (cfg0.persistenceEnabled !== false && resolvedPath) {
+      cleanupStaleTmpFiles(resolvedPath).catch(() => {});
       statePersistence = new StatePersistence({ filePath: resolvedPath });
       statePersistence.load().then((snap) => {
         if (!snap) return;

package/lib/ops-config-io.js

@@ -349,15 +349,24 @@ export function registerConfigIoRoutes(ctx, deps) {
     }
     const rawCurrent = plainConfig(currentConfig);
 
-    // Concurrency control: if client provided expectedRevision, reject if stale (#553)
-    if (typeof body.expectedRevision === 'number' && currentRevision !== null) {
-      if (body.expectedRevision !== currentRevision) {
+    // Concurrency control: validate expectedRevision format and match (#553)
+    if (body.expectedRevision !== undefined && body.expectedRevision !== null) {
+      if (!Number.isSafeInteger(body.expectedRevision) || body.expectedRevision < 0) {
+        json(res, 400, {
+          error: {
+            code: 'bad-request',
+            message: 'expectedRevision must be a non-negative integer',
+          },
+        });
+        return;
+      }
+      if (currentRevision !== null && body.expectedRevision !== currentRevision) {
         json(res, 409, {
           error: {
             code: 'conflict',
             message: `Configuration has been modified concurrently (expected revision ${body.expectedRevision}, current is ${currentRevision})`,
             currentRevision,
-          }
+          },
         });
         return;
       }
@@ -406,8 +415,26 @@ export function registerConfigIoRoutes(ctx, deps) {
     }
 
     try {
-      await settings.replace(NS, mergedConfig, currentRevision ?? undefined);
+      await settings.replace(NS, mergedConfig, body.expectedRevision ?? currentRevision ?? undefined);
     } catch (err) {
+      const isConflict = err?.code === 'SETTINGS_CONFLICT' ||
+        err?.status === 409 ||
+        err?.code === 'CONFLICT' ||
+        /conflict|revision|stale/i.test(err?.message || '');
+      if (isConflict) {
+        let latestRevision = null;
+        try {
+          latestRevision = settings.describe({ redactSecrets: false })?.find((c) => c.ns === NS)?.revision ?? null;
+        } catch (_) {}
+        json(res, 409, {
+          error: {
+            code: 'conflict',
+            message: `Configuration has been modified concurrently: ${err.message}`,
+            currentRevision: latestRevision ?? currentRevision,
+          },
+        });
+        return;
+      }
       json(res, 500, { error: { code: 'settings-write-failed', message: err.message } });
       return;
     }

package/lib/ops-telemetry.js

@@ -174,14 +174,15 @@ ctx.effect(() => ctx.webServer.register({
       json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: trace is local-only' } });
       return;
     }
+    const traceStore = deps.selectionTraceStore || null;
     if (req.method === 'DELETE') {
-      clearSelectionTraces();
+      clearSelectionTraces(traceStore);
       json(res, 200, { ok: true, message: 'trace history cleared' });
       return;
     }
     const url = new URL(req.url ?? TRACE_PATH, 'http://localhost');
     const limit = Math.min(100, Math.max(1, Number(url.searchParams.get('limit')) || 50));
-    json(res, 200, { ok: true, traces: getSelectionTraces(limit) });
+    json(res, 200, { ok: true, traces: getSelectionTraces(limit, traceStore) });
   },
 }), 'dsh-key-rotation: trace route');
 

package/lib/pool-builder.js

@@ -39,6 +39,8 @@ export function buildPoolItem({
   useKeyRef = null,
   trafficSmoothingBurst = null,
   maxQueueWaitMs = null,
+  maxAttempts = null,
+  maxDurationMs = null,
 }) {
   const seen = new Set();
   const indexed = (Array.isArray(keys) ? keys : []).map((key, index) => ({ ref: typeof key === 'string' ? key.trim() : '', index }))
@@ -143,6 +145,12 @@ const weightsMap = {};
     maxQueueWaitMs: typeof maxQueueWaitMs === 'number' && Number.isFinite(maxQueueWaitMs) && maxQueueWaitMs >= 0
       ? Math.floor(maxQueueWaitMs)
       : 800,
+    maxAttempts: typeof maxAttempts === 'number' && Number.isFinite(maxAttempts) && maxAttempts > 0
+      ? Math.floor(maxAttempts)
+      : 0,
+    maxDurationMs: typeof maxDurationMs === 'number' && Number.isFinite(maxDurationMs) && maxDurationMs > 0
+      ? Math.floor(maxDurationMs)
+      : 0,
   };
 }
 
@@ -178,6 +186,8 @@ export function buildPools({ cfg = {}, poolState = new Map(), defaultState = ini
     const provRpm = typeof p.rpmLimit === 'number' ? p.rpmLimit : rpmLimit;
     const provTpm = typeof p.tpmLimit === 'number' ? p.tpmLimit : tpmLimit;
     const provConcurrency = typeof p.concurrencyLimit === 'number' ? p.concurrencyLimit : concurrencyLimit;
+    const poolAttempts = typeof p.maxAttempts === 'number' ? p.maxAttempts : (cfg.maxAttempts ?? 0);
+    const poolDuration = typeof p.maxDurationMs === 'number' ? p.maxDurationMs : (cfg.maxDurationMs ?? 0);
     const pool = buildPool(p.provider, p.keys, p.weights, p.paused, p.revoked, poolCooldown, poolMax, p.expiresAt, p.routingStrategy, p.proactiveRateLimitGuard, {
       provider: p.provider,
       model: null,
@@ -186,6 +196,8 @@ export function buildPools({ cfg = {}, poolState = new Map(), defaultState = ini
       pinnedRef: p.pinnedRef ?? p.useKeyRef,
       trafficSmoothingBurst: p.trafficSmoothingBurst ?? cfg.trafficSmoothingBurst,
       maxQueueWaitMs: p.maxQueueWaitMs ?? cfg.maxQueueWaitMs,
+      maxAttempts: poolAttempts,
+      maxDurationMs: poolDuration,
     }, provRpm, provTpm, provConcurrency);
     if (pool) {
       for (const ref of pool.refs) {
@@ -216,6 +228,8 @@ export function buildPools({ cfg = {}, poolState = new Map(), defaultState = ini
         pinnedRef: mp.pinnedRef ?? mp.useKeyRef ?? p.pinnedRef ?? p.useKeyRef,
         trafficSmoothingBurst: mp.trafficSmoothingBurst ?? p.trafficSmoothingBurst ?? cfg.trafficSmoothingBurst,
         maxQueueWaitMs: mp.maxQueueWaitMs ?? p.maxQueueWaitMs ?? cfg.maxQueueWaitMs,
+        maxAttempts: typeof mp.maxAttempts === 'number' ? mp.maxAttempts : poolAttempts,
+        maxDurationMs: typeof mp.maxDurationMs === 'number' ? mp.maxDurationMs : poolDuration,
       }, modelRpm, modelTpm, modelConcurrency);
       if (!mpool) continue;
       mpool.basePool = pool;

package/lib/pool.js

@@ -39,8 +39,23 @@ export function isLoopbackAddress(ip) {
   return false;
 }
 
-/** Check if an incoming HTTP request is from the Desktop shell (#516). */
+/** Check if request contains non-loopback forwarding headers (e.g. proxied from LAN/Tailscale) (#516). */
+export function hasNonLoopbackForwarding(req) {
+  const xff = req?.headers?.['x-forwarded-for'];
+  if (xff && typeof xff === 'string') {
+    const ips = xff.split(',').map((s) => s.trim());
+    if (ips.some((ip) => ip && !isLoopbackAddress(ip))) return true;
+  }
+  const xRealIp = req?.headers?.['x-real-ip'];
+  if (xRealIp && typeof xRealIp === 'string' && !isLoopbackAddress(xRealIp.trim())) {
+    return true;
+  }
+  return false;
+}
+
+/** Check if an incoming HTTP request is from an authentic local Desktop shell (#516). */
 export function isDesktopShellRequest(req) {
+  if (hasNonLoopbackForwarding(req)) return false;
   const agent = req?.headers?.['user-agent'] || '';
   const cookie = req?.headers?.cookie || '';
   return typeof agent === 'string' && agent.includes('@deepseek-ai/dsh-desktop/') &&
@@ -69,9 +84,9 @@ export function isTrustedBridgeRequest(req) {
     if (!origin) return false; // Explicit empty string or null-like falsy
     try {
       const originUrl = new URL(origin);
-      // Official Desktop build shell origin (#22, #465, #516)
+      // Official Desktop build shell origin (#22, #465, #516) - requires authentic local Desktop shell (rejects LAN forwarding)
       if (originUrl.protocol === 'dsh-app:' && (originUrl.host === 'app' || originUrl.hostname === 'app' || originUrl.host === 'localhost')) {
-        return true;
+        return !hasNonLoopbackForwarding(req);
       }
       if (originUrl.host !== hostHeader) return false;
       const hostname = originUrl.hostname.replace(/^\[|\]$/g, '');
@@ -89,7 +104,7 @@ export function isTrustedBridgeRequest(req) {
     return true;
   }
 
-  // Mutating requests without Origin: allow authentic Desktop shell requests (#516, #465) or valid Referer.
+  // Mutating requests without Origin: allow authentic local Desktop shell requests (#516, #465)
   if (isDesktopShellRequest(req)) {
     return true;
   }
@@ -98,7 +113,7 @@ export function isTrustedBridgeRequest(req) {
     try {
       const refUrl = new URL(referer);
       if (refUrl.protocol === 'dsh-app:' && (refUrl.host === 'app' || refUrl.hostname === 'app' || refUrl.host === 'localhost')) {
-        return true;
+        return !hasNonLoopbackForwarding(req);
       }
       if (refUrl.host !== hostHeader) return false;
       const hostname = refUrl.hostname.replace(/^\[|\]$/g, '');

package/lib/request-budget.js

@@ -22,13 +22,14 @@ export function createRequestBudget(options = {}) {
 
   const controller = new AbortController();
   let timerId = null;
+  let onCallerAbort = null;
 
   // Chain caller signal if provided
   if (options.signal) {
     if (options.signal.aborted) {
       controller.abort(options.signal.reason);
     } else {
-      const onCallerAbort = () => {
+      onCallerAbort = () => {
         controller.abort(options.signal.reason);
         cleanup();
       };
@@ -52,6 +53,12 @@ export function createRequestBudget(options = {}) {
       clearTimeout(timerId);
       timerId = null;
     }
+    if (options.signal && onCallerAbort) {
+      try {
+        options.signal.removeEventListener('abort', onCallerAbort);
+      } catch {}
+      onCallerAbort = null;
+    }
   }
 
   return {