@goodandready/dsh-key-rotation 0.8.75 → 0.8.77

package/lib/pool.js

@@ -1,16 +1,20 @@
 // lib/pool.js — pure pool arithmetic and selection logic for dsh-key-rotation.
 import {
   MAX_SESSION_STICKY_ENTRIES, setSessionSticky, getSessionSticky, clearSessionSticky,
+  unstickFailedKey, SessionRouter, defaultSessionRouter, MAX_SESSIONS, SESSION_TTL_MS,
   selectPool, sortAttemptList, expiringSoon, shouldNotifyDaily,
   costForDay, costForWeek, budgetVerdict,
 } from './pool-selection.js';
 
 export {
   MAX_SESSION_STICKY_ENTRIES, setSessionSticky, getSessionSticky, clearSessionSticky,
+  unstickFailedKey, SessionRouter, defaultSessionRouter, MAX_SESSIONS, SESSION_TTL_MS,
   selectPool, sortAttemptList, expiringSoon, shouldNotifyDaily,
   costForDay, costForWeek, budgetVerdict,
 };
 
+import { classifyResponseError, CONTEXT_WINDOW_EXCEEDED_CODE } from './errors.js';
+export { classifyResponseError };
 import { resetModelQuotaIfNeeded } from './model-quota.js';
 import { decryptSecret } from './crypto-storage.js';
 import { bestEffort } from './best-effort.js';
@@ -39,8 +43,23 @@ export function isLoopbackAddress(ip) {
   return false;
 }
 
-/** Check if an incoming HTTP request is from the Desktop shell (#516). */
+/** Check if request contains non-loopback forwarding headers (e.g. proxied from LAN/Tailscale) (#516). */
+export function hasNonLoopbackForwarding(req) {
+  const xff = req?.headers?.['x-forwarded-for'];
+  if (xff && typeof xff === 'string') {
+    const ips = xff.split(',').map((s) => s.trim());
+    if (ips.some((ip) => ip && !isLoopbackAddress(ip))) return true;
+  }
+  const xRealIp = req?.headers?.['x-real-ip'];
+  if (xRealIp && typeof xRealIp === 'string' && !isLoopbackAddress(xRealIp.trim())) {
+    return true;
+  }
+  return false;
+}
+
+/** Check if an incoming HTTP request is from an authentic local Desktop shell (#516). */
 export function isDesktopShellRequest(req) {
+  if (hasNonLoopbackForwarding(req)) return false;
   const agent = req?.headers?.['user-agent'] || '';
   const cookie = req?.headers?.cookie || '';
   return typeof agent === 'string' && agent.includes('@deepseek-ai/dsh-desktop/') &&
@@ -69,9 +88,9 @@ export function isTrustedBridgeRequest(req) {
     if (!origin) return false; // Explicit empty string or null-like falsy
     try {
       const originUrl = new URL(origin);
-      // Official Desktop build shell origin (#22, #465, #516)
+      // Official Desktop build shell origin (#22, #465, #516) - requires authentic local Desktop shell (rejects LAN forwarding)
       if (originUrl.protocol === 'dsh-app:' && (originUrl.host === 'app' || originUrl.hostname === 'app' || originUrl.host === 'localhost')) {
-        return true;
+        return !hasNonLoopbackForwarding(req);
       }
       if (originUrl.host !== hostHeader) return false;
       const hostname = originUrl.hostname.replace(/^\[|\]$/g, '');
@@ -89,7 +108,7 @@ export function isTrustedBridgeRequest(req) {
     return true;
   }
 
-  // Mutating requests without Origin: allow authentic Desktop shell requests (#516, #465) or valid Referer.
+  // Mutating requests without Origin: allow authentic local Desktop shell requests (#516, #465)
   if (isDesktopShellRequest(req)) {
     return true;
   }
@@ -98,7 +117,7 @@ export function isTrustedBridgeRequest(req) {
     try {
       const refUrl = new URL(referer);
       if (refUrl.protocol === 'dsh-app:' && (refUrl.host === 'app' || refUrl.hostname === 'app' || refUrl.host === 'localhost')) {
-        return true;
+        return !hasNonLoopbackForwarding(req);
       }
       if (refUrl.host !== hostHeader) return false;
       const hostname = refUrl.hostname.replace(/^\[|\]$/g, '');
@@ -175,6 +194,7 @@ export function pickNext(pool, now, refsCount = pool.refs.length) {
 
 /** Apply a failed-key cooldown to pool state. Pure: returns next state shape. */
 export function applyCooldown(pool, ref, cooldownMs, now = Date.now()) {
+  unstickFailedKey(pool, ref);
   return {
     ...pool,
     state: {
@@ -203,6 +223,7 @@ export function computeBackoff(baseMs, failCount, maxMs, isSoft = false) {
 
 /** Record a failure for `ref` in `pool.state`. */
 export function recordFailure(pool, ref, now, baseMs, maxMs, isSoft = false, jitter = false) {
+  unstickFailedKey(pool, ref);
   if (!pool.state.failCounts) pool.state.failCounts = new Map();
   let next = pool.state.failCounts.get(ref) ?? 0;
   if (!isSoft) {
@@ -479,6 +500,18 @@ export function isSwitchableError(failureOrPayload, switchCodes = new Set(DEFAUL
     status = Number(rawCode);
   }
 
+  // 0. Structured response error classification (#547)
+  if (status || failure.body || message.startsWith('{') || (code && code !== 'ERROR')) {
+    const typed = classifyResponseError(status, failure.body ?? message, failure.headers ?? failure.response?.headers);
+    if (typed.code === CONTEXT_WINDOW_EXCEEDED_CODE) return false;
+    if ((typed.code === 'QUOTA' || typed.code === 'ACCOUNT_QUOTA') && (switchCodes.has('QUOTA') || switchCodes.has('RATE_LIMIT') || switchCodes.has('429'))) return true;
+    if (typed.code === 'RATE_LIMIT' && (switchCodes.has('RATE_LIMIT') || switchCodes.has('429'))) return true;
+    if ((typed.code === 'AUTH' || typed.code === 'INVALID_CREDENTIAL') && (switchCodes.has('AUTH') || switchCodes.has('401') || switchCodes.has('403'))) return true;
+    if (typed.code === 'SERVER' && (switchCodes.has('SERVER') || (status >= 500 && status <= 504 && switchCodes.has(String(status))))) return true;
+    if (typed.code === 'TIMEOUT' && (switchCodes.has('TIMEOUT') || switchCodes.has('408') || switchCodes.has('504'))) return true;
+    if (switchCodes.has(typed.code)) return true;
+  }
+
   // 1. Direct HTTP status codes (#267: also 408/425 transient, #545: numeric status/code mapped to semantic switch codes)
   if ((status === 429 || status === 408 || status === 425) && (switchCodes.has('RATE_LIMIT') || switchCodes.has('QUOTA') || switchCodes.has('429') || switchCodes.has('TIMEOUT') || switchCodes.has(String(status)))) return true;
   if ((status === 401 || status === 403) && (switchCodes.has('AUTH') || switchCodes.has('401') || switchCodes.has('403') || switchCodes.has(String(status)))) return true;
@@ -561,3 +594,4 @@ export function isKeyBroken(pool, ref, now = Date.now()) {
   if (pool.basePool) return isKeyBroken(pool.basePool, ref, now);
   return false;
 }
+

package/lib/rotate.js

@@ -15,6 +15,7 @@ import {
   getSessionSticky,
   setSessionSticky,
   clearSessionSticky,
+  unstickFailedKey,
 } from './pool.js';
 import { pickCascadeFallback, CASCADE_MAX_DEPTH } from './cascade.js';
 import { createRequestBudget, BUDGET_EXHAUSTED_TIMEOUT, BUDGET_EXHAUSTED_ATTEMPTS } from './request-budget.js';
@@ -210,6 +211,7 @@ export function createRotate(deps) {
       const penalizeRef = (targetRef, errCode, errMsg, rawHeaders) => {
         if (!targetRef) return;
         if (sessionId) clearSessionSticky(pool, sessionId);
+        unstickFailedKey(pool, targetRef);
         if (errCode === LOCAL_QUOTA_CODE) return;
         let headerResetMs = null;
         if (rawHeaders) {
@@ -411,6 +413,7 @@ export function createRotate(deps) {
           let yielded = false;
           let switching = false;
           let inner;
+          const preTokenBuffer = [];
           try {
             // #464 & #461: Record attempt & trace dispatch
             budget.recordAttempt();
@@ -450,10 +453,13 @@ export function createRotate(deps) {
                     if (ok) reqStore.concurrencyRef = fallbackRef;
                   }
                 }
-                // Only actual content deltas lock the stream (no more rotation).
-                // Structural/metadata chunks (block-start/end, usage) do not.
-                if (chunk && (chunk.type === 'text-delta' || chunk.type === 'reasoning-delta' || chunk.type === 'tool-call-delta')) {
-                  yielded = true;
+                // Pre-First-Token Failover (#527): Lock the stream only upon first content delta.
+                if (chunk && isContentChunk(chunk)) {
+                  if (!yielded) {
+                    yielded = true;
+                    for (const prev of preTokenBuffer) yield prev;
+                    preTokenBuffer.length = 0;
+                  }
                   yield chunk;
                   continue;
                 }
@@ -465,15 +471,16 @@ export function createRotate(deps) {
                   const message = failure?.message ?? '';
                   const effectiveSwitchCodes = pool.switchCodes ?? switchCodes;
                   const switchable = !yielded && kind === 'error' && isSwitchableError(failure, effectiveSwitchCodes);
-                  const activeRef = reqStore.pickedRef ?? pool.state.lastUsed;
+                  const activeRef = reqStore.pickedRef ?? pool.state.lastUsed ?? attemptList[attempt];
                   if (switchable) {
+                    preTokenBuffer.length = 0; // Discard metadata from aborted attempt (#527)
                     penalizeRef(activeRef, code ?? 'UNKNOWN', message, rawHdrs ?? failure?.headers ?? pool.state.detectedLimits?.get?.(activeRef));
                     recordFailureCategory(pool, code ?? 'UNKNOWN', message, activeRef, now());
                     pool.state.switches = (pool.state.switches ?? 0) + 1;
                     pool.state.lastReason = String(code ?? 'UNKNOWN');
                     pool.state.lastSwitchAt = now();
                     lastFailure = chunk;
-                    logWarn(`[dsh-key-rotation] ${options.provider}: key ${String(activeRef ?? '?')} failed (${String(code)} ${String(message).slice(0, 100)}) - next key`);
+                    logWarn(`[dsh-key-rotation] ${options.provider}: key ${String(activeRef ?? '?')} failed before first token (${String(code)} ${String(message).slice(0, 100)}) - failover to next key`);
                     // #216: per-switch webhook (opt-in switchNotify), deduped per provider
                     if (switchNotify && activeRef) {
                       notifySwitch(runtime0, pool, {
@@ -492,6 +499,10 @@ export function createRotate(deps) {
                     if (kind === 'error' && isSwitchableError(failure, effectiveSwitchCodes)) {
                       penalizeRef(activeRef, code ?? 'UNKNOWN', message, rawHdrs ?? failure?.headers ?? pool.state.detectedLimits?.get?.(activeRef));
                     }
+                    if (!yielded) {
+                      for (const prev of preTokenBuffer) yield prev;
+                      preTokenBuffer.length = 0;
+                    }
                     yield chunk;
                     return;
                   }
@@ -539,24 +550,33 @@ export function createRotate(deps) {
                     });
                   }
                   recordLatency(pool, reqStore);
-                  activePermit?.success();
+                  if (typeof activePermit?.success === 'function') activePermit.success();
                   if (isTraceOwner) trace.finish('SUCCESS', activeRef);
+                  if (!yielded) {
+                    for (const prev of preTokenBuffer) yield prev;
+                    preTokenBuffer.length = 0;
+                  }
                   yield chunk;
                   return;
                 }
-                yield chunk;
+                if (yielded) {
+                  yield chunk;
+                } else {
+                  preTokenBuffer.push(chunk);
+                }
               }
             } catch (e) {
               const effectiveSwitchCodes = pool.switchCodes ?? switchCodes;
-              const activeRef = _pickedRef ?? reqStore.pickedRef ?? pool.state.lastUsed;
+              const activeRef = _pickedRef ?? reqStore.pickedRef ?? pool.state.lastUsed ?? attemptList[attempt];
               if (!yielded && isSwitchableError(e, effectiveSwitchCodes)) {
+                preTokenBuffer.length = 0; // Discard metadata from failed attempt (#527)
                 penalizeRef(activeRef, e?.code ?? 'TRANSPORT', String(e?.message ?? e), e?.headers ?? e?.response?.headers ?? pool.state.detectedLimits?.get?.(activeRef));
                 recordFailureCategory(pool, e?.code ?? 'TRANSPORT', String(e?.message ?? e), activeRef, now());
                 pool.state.switches = (pool.state.switches ?? 0) + 1;
                 pool.state.lastReason = String(e?.code ?? 'TRANSPORT');
                 pool.state.lastSwitchAt = now();
                 lastFailure = finishError(e?.code ?? 'TRANSPORT', String(e?.message ?? e));
-                logWarn(`[dsh-key-rotation] ${options.provider}: key ${String(activeRef ?? '?')} stream threw ${String(e?.code ?? e?.message ?? e)} - failover to next key`);
+                logWarn(`[dsh-key-rotation] ${options.provider}: key ${String(activeRef ?? '?')} stream threw before first token ${String(e?.code ?? e?.message ?? e)} - failover to next key`);
                 if (switchNotify && activeRef) {
                   notifySwitch(runtime0, pool, {
                     provider: options.provider,
@@ -570,16 +590,24 @@ export function createRotate(deps) {
               if (yielded && isSwitchableError(e, effectiveSwitchCodes)) {
                 penalizeRef(activeRef, e?.code ?? 'TRANSPORT', String(e?.message ?? e), e?.headers ?? e?.response?.headers ?? pool.state.detectedLimits?.get?.(activeRef));
               }
+              if (!yielded) {
+                for (const prev of preTokenBuffer) yield prev;
+                preTokenBuffer.length = 0;
+              }
               yield finishError(e?.code ?? 'TRANSPORT', String(e?.message ?? e));
               return;
             }
 
             if (switching) continue; // try the next key
+            if (!yielded && preTokenBuffer.length > 0) {
+              for (const prev of preTokenBuffer) yield prev;
+              preTokenBuffer.length = 0;
+            }
             if (yielded) {
               const activeRef = reqStore.pickedRef ?? _pickedRef ?? pool.state.lastUsed;
               if (activeRef) recordSuccess(pool, activeRef, now());
               recordLatency(pool, reqStore);
-              activePermit?.success();
+              if (typeof activePermit?.success === 'function') activePermit.success();
               if (isTraceOwner) trace.finish('SUCCESS', activeRef);
             } else if (isTraceOwner) {
               trace.finish('COMPLETED', reqStore.pickedRef ?? _pickedRef ?? pool.state.lastUsed);
@@ -626,3 +654,25 @@ export function createRotate(deps) {
 
   return rotate;
 }
+
+/**
+ * Whether a chunk carries a model-visible content delta (#527).
+ * @param {Record<string, unknown>} chunk
+ * @returns {boolean}
+ */
+export function isContentChunk(chunk) {
+  if (!chunk || typeof chunk !== 'object') return false;
+  if (chunk.type === 'text-delta' || chunk.type === 'reasoning-delta' || chunk.type === 'tool-call-delta') {
+    return true;
+  }
+  if (chunk.delta !== undefined || chunk.text !== undefined || chunk.content !== undefined || chunk.choices !== undefined) {
+    return true;
+  }
+  if (chunk.type === 'start' || chunk.type === 'block-start' || chunk.type === 'block-stop' ||
+      chunk.type === 'metadata' || chunk.type === 'response-metadata' || chunk.type === 'usage' ||
+      chunk.type === 'finish') {
+    return false;
+  }
+  return false;
+}
+

package/lib/safe-fetch.js

@@ -1,7 +1,10 @@
-// lib/safe-fetch.js — SSRF-protected HTTP fetch with DNS and IP validation (#354, #411).
+// lib/safe-fetch.js — SSRF-protected HTTP fetch with DNS and IP validation (#354, #411, #557).
 import net from 'node:net';
 import dns from 'node:dns/promises';
 import nodeDns from 'node:dns';
+import https from 'node:https';
+import http from 'node:http';
+import { URL } from 'node:url';
 
 export const MAX_IMPORT_BYTES = 1024 * 1024; // 1 MB limit
 export const MAX_REDIRECTS = 5;
@@ -30,7 +33,7 @@ export function parseIpv6Words(ip) {
   const halves = s.split('::');
   if (halves.length > 2) return null;
   const left = halves[0] ? halves[0].split(':').map(x => parseInt(x, 16)) : [];
-  const right = halves.length === 2 && halves[1] ? halves[1].split(':').map(x => parseInt(x, 16)) : [];
+  const right = halves[1] && halves[1] ? halves[1].split(':').map(x => parseInt(x, 16)) : [];
   if (left.some(isNaN) || right.some(isNaN)) return null;
   const missing = 8 - (left.length + right.length);
   if (halves.length === 1 && missing !== 0) return null;
@@ -98,13 +101,14 @@ export function isPrivateOrReservedIp(ip) {
 }
 
 /**
- * Creates an undici Agent with connect-time lookup validation against DNS rebinding / TOCTOU (#411).
+ * Creates a connect-time lookup function that rejects private/reserved IPs on socket establishment (#411, #557).
+ * Prevents DNS Rebinding (TOCTOU) by validating the IP address right when the socket connects.
  * @param {object} [opts]
  * @param {Function} [opts.lookupImpl]
- * @returns {Agent}
+ * @returns {Function}
  */
-export function createSafeDispatcher({ lookupImpl = nodeDns.lookup } = {}) {
-  const lookup = (hostname, options, callback) => {
+export function createSafeLookup({ lookupImpl = nodeDns.lookup } = {}) {
+  return function safeLookup(hostname, options, callback) {
     const cb = typeof options === 'function' ? options : callback;
     const opts = typeof options === 'function' ? {} : (typeof options === 'number' ? { family: options } : (options || {}));
     lookupImpl(hostname, { ...opts, all: true }, (err, addresses) => {
@@ -127,7 +131,16 @@ export function createSafeDispatcher({ lookupImpl = nodeDns.lookup } = {}) {
       return cb(null, addresses);
     });
   };
+}
 
+/**
+ * Creates an agent/dispatcher with connect-time lookup validation against DNS rebinding / TOCTOU (#411, #557).
+ * @param {object} [opts]
+ * @param {Function} [opts.lookupImpl]
+ * @returns {object}
+ */
+export function createSafeDispatcher({ lookupImpl = nodeDns.lookup } = {}) {
+  const lookup = createSafeLookup({ lookupImpl });
   return {
     options: {
       connect: { lookup },
@@ -137,9 +150,12 @@ export function createSafeDispatcher({ lookupImpl = nodeDns.lookup } = {}) {
 }
 
 /**
- * Validates a target URL and its hostname/IP against SSRF.
+ * Validates that a URL is safe to fetch before making any network connections.
+ * Requires HTTPS protocol and verifies hostname does not resolve to private/reserved IPs.
  * @param {string} urlString
- * @param {object} options
+ * @param {object} [options]
+ * @param {Function} [options.lookupImpl]
+ * @returns {Promise<URL>}
  */
 export async function assertSafeUrl(urlString, { lookupImpl = dns.lookup } = {}) {
   let urlObj;
@@ -260,37 +276,161 @@ export async function readBoundedJson(resp, maxBytes = MAX_IMPORT_BYTES) {
 }
 
 /**
- * Fetches JSON from a URL with SSRF protection, connect-time rebinding guard, redirect verification, and size bounding.
+ * Performs native HTTPS/HTTP request with connect-time DNS validation against rebinding (#557).
+ */
+function fetchNativeJson(urlObj, { lookup, maxBytes, signal, ca, rejectUnauthorized }) {
+  return new Promise((resolve, reject) => {
+    const isHttps = urlObj.protocol === 'https:';
+    const transport = isHttps ? https : http;
+
+    const reqOpts = {
+      method: 'GET',
+      headers: {
+        accept: 'application/json, text/plain, */*',
+        'user-agent': 'dsh-key-rotation/0.8',
+      },
+      lookup,
+      signal,
+    };
+    if (ca !== undefined) reqOpts.ca = ca;
+    if (rejectUnauthorized !== undefined) reqOpts.rejectUnauthorized = rejectUnauthorized;
+
+    const req = transport.request(urlObj, reqOpts, (res) => {
+      const status = res.statusCode || 0;
+      if ([301, 302, 303, 307, 308].includes(status)) {
+        res.resume(); // discard body
+        return resolve({
+          status,
+          headers: {
+            get: (name) => res.headers[name.toLowerCase()] || null,
+          },
+        });
+      }
+
+      if (status < 200 || status >= 300) {
+        res.resume();
+        const err = new Error(`dsh-key-rotation: fetch returned ${status}`);
+        err.code = 'FETCH_FAILED';
+        err.status = status;
+        return reject(err);
+      }
+
+      const cl = Number(res.headers['content-length']);
+      if (!isNaN(cl) && cl > maxBytes) {
+        res.resume();
+        const err = new Error(`dsh-key-rotation: response exceeds maximum size of ${maxBytes} bytes`);
+        err.code = 'PAYLOAD_TOO_LARGE';
+        return reject(err);
+      }
+
+      const chunks = [];
+      let total = 0;
+      res.on('data', (chunk) => {
+        total += chunk.length;
+        if (total > maxBytes) {
+          res.destroy();
+          const err = new Error(`dsh-key-rotation: response exceeds maximum size of ${maxBytes} bytes`);
+          err.code = 'PAYLOAD_TOO_LARGE';
+          return reject(err);
+        }
+        chunks.push(chunk);
+      });
+
+      res.on('end', () => {
+        try {
+          const bodyStr = Buffer.concat(chunks).toString('utf8');
+          const data = JSON.parse(bodyStr);
+          resolve({ status: 200, ok: true, data });
+        } catch (e) {
+          reject(new Error(`dsh-key-rotation: invalid JSON response: ${e.message}`));
+        }
+      });
+
+      res.on('error', reject);
+    });
+
+    req.on('error', (err) => {
+      reject(err);
+    });
+
+    req.end();
+  });
+}
+
+function isNativeFetch(fn) {
+  if (typeof fn !== 'function') return false;
+  if (fn.mock && typeof fn.mock === 'object') return false;
+  if (fn.constructor?.name === 'AsyncFunction') return false;
+  try {
+    const s = fn.toString();
+    return s.includes('undici') || s.includes('[native code]');
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Fetches JSON from a URL with SSRF protection, connect-time rebinding guard, redirect verification, and size bounding (#411, #557).
  * @param {string} url
  * @param {object} options
  */
 export async function safeFetchJson(url, {
   signal,
-  fetchImpl = globalThis.fetch,
+  fetchImpl,
   lookupImpl = dns.lookup,
   maxBytes = MAX_IMPORT_BYTES,
   redirectsLeft = MAX_REDIRECTS,
   dispatcher,
+  ca,
+  rejectUnauthorized,
 } = {}) {
-  const safeDispatcher = dispatcher;
   let currentUrl = url;
+  const mockFetch = fetchImpl || (globalThis.fetch && !isNativeFetch(globalThis.fetch) ? globalThis.fetch : null);
+
+  const safeLookup = dispatcher?.connect?.lookup || dispatcher?.options?.connect?.lookup || createSafeLookup({});
+
   while (true) {
-    await assertSafeUrl(currentUrl, { lookupImpl });
-    const fetchOpts = {
-      signal,
-      redirect: 'manual',
-    };
-    if (safeDispatcher) fetchOpts.dispatcher = safeDispatcher;
-    const resp = await fetchImpl(currentUrl, fetchOpts);
+    const urlObj = await assertSafeUrl(currentUrl, { lookupImpl });
+
+    // If custom test mock fetch is provided or globalThis.fetch was mocked in test
+    if (mockFetch) {
+      const resp = await mockFetch(currentUrl, { signal, redirect: 'manual', dispatcher });
+      if ([301, 302, 303, 307, 308].includes(resp.status)) {
+        if (redirectsLeft <= 0) {
+          const err = new Error('dsh-key-rotation: too many redirects');
+          err.code = 'TOO_MANY_REDIRECTS';
+          throw err;
+        }
+        redirectsLeft--;
+        const loc = resp.headers?.get?.('location');
+        if (!loc) {
+          const err = new Error('dsh-key-rotation: redirect missing Location header');
+          err.code = 'BAD_REDIRECT';
+          throw err;
+        }
+        currentUrl = new URL(loc, currentUrl).href;
+        continue;
+      }
+      if (!resp.ok) {
+        const err = new Error(`dsh-key-rotation: fetch returned ${resp.status}`);
+        err.code = 'FETCH_FAILED';
+        err.status = resp.status;
+        throw err;
+      }
+      return await readBoundedJson(resp, maxBytes);
+    }
+
+    // Native safe request with socket-connect lookup pinning against DNS rebinding (#557)
+    const result = await fetchNativeJson(urlObj, { lookup: safeLookup, maxBytes, signal, ca, rejectUnauthorized });
 
-    if ([301, 302, 303, 307, 308].includes(resp.status)) {
+    if ([301, 302, 303, 307, 308].includes(result.status)) {
       if (redirectsLeft <= 0) {
         const err = new Error('dsh-key-rotation: too many redirects');
         err.code = 'TOO_MANY_REDIRECTS';
         throw err;
       }
       redirectsLeft--;
-      const loc = resp.headers?.get?.('location');
+      const loc = result.headers?.get?.('location');
       if (!loc) {
         const err = new Error('dsh-key-rotation: redirect missing Location header');
         err.code = 'BAD_REDIRECT';
@@ -300,13 +440,6 @@ export async function safeFetchJson(url, {
       continue;
     }
 
-    if (!resp.ok) {
-      const err = new Error(`dsh-key-rotation: fetch returned ${resp.status}`);
-      err.code = 'FETCH_FAILED';
-      err.status = resp.status;
-      throw err;
-    }
-
-    return await readBoundedJson(resp, maxBytes);
+    return result.data;
   }
 }