@goodandready/dsh-key-rotation 0.8.8 → 0.8.11

package/lib/clock.js

@@ -20,5 +20,3 @@ export function nowMono() {
   return performance.timeOrigin + performance.now();
 }
 
-/** Default clock injectable into pure helpers. */
-export const defaultClock = { nowWall, nowMono };

package/lib/concurrency.js

@@ -40,6 +40,15 @@ export class ConcurrencyTracker {
     e.lastAcquired = now;
   }
 
+  getActive(ref, now) {
+    now = now || Date.now();
+    if (!ref) return 0;
+    const e = this._inFlight.get(ref);
+    if (!e) return 0;
+    if (now - e.lastAcquired > this._staleMs) return 0;
+    return e.count;
+  }
+
   snapshot() {
     const out = {};
     for (const [k, v] of this._inFlight) out[k] = { count: v.count };

package/lib/error-taxonomy.js

@@ -61,6 +61,3 @@ export function classifyFailure(failureOrPayload) {
 }
 
 /** True when classification says switch to next key. */
-export function shouldSwitch(failureOrPayload) {
-  return classifyFailure(failureOrPayload).action === 'switch';
-}

package/lib/heal.js

@@ -33,3 +33,50 @@ export function healIdleCooldowns(pools, idleMs, now = Date.now()) {
   }
   return healed;
 }
+
+/**
+ * Background auto-recovery for keys in brokenUntil status.
+ * Tests broken keys with a lightweight free probe (e.g. probeModels).
+ * If the probe succeeds, clears broken and failure states and records a 'heal' event.
+ *
+ * @param {Array} pools
+ * @param {Function} probeFn async (ref) => { ok: boolean, code?: string, status?: number }
+ * @param {number} [now=Date.now()]
+ * @returns {Promise<Array<{ ref: string, poolBase: string, ok: boolean }>>}
+ */
+export async function autoUnbreakBrokenKeys(pools, probeFn, now = Date.now()) {
+  if (!Array.isArray(pools) || pools.length === 0 || typeof probeFn !== 'function') return [];
+  const results = [];
+  for (const pool of pools) {
+    if (!pool || !pool.state || !pool.base) continue;
+    const bu = pool.state.brokenUntil;
+    if (!bu || bu.size === 0) continue;
+    const brokenRefs = [];
+    for (const [ref, until] of bu.entries()) {
+      if (Number.isFinite(until) && until > now) {
+        brokenRefs.push(ref);
+      }
+    }
+    for (const ref of brokenRefs) {
+      try {
+        const res = await probeFn(ref);
+        if (res && res.ok) {
+          bu.delete(ref);
+          pool.state.failedUntil?.delete(ref);
+          pool.state.failCounts?.delete(ref);
+          pool.state.authFailCounts?.delete(ref);
+          if (Array.isArray(pool.state.events)) {
+            pool.state.events.push({ at: now, ref, reason: 'auto-unbreak', cooldownMs: 0, type: 'heal' });
+            if (pool.state.events.length > 50) pool.state.events.shift();
+          }
+          results.push({ ref, poolBase: pool.base, ok: true });
+        } else {
+          results.push({ ref, poolBase: pool.base, ok: false });
+        }
+      } catch (_) {
+        results.push({ ref, poolBase: pool.base, ok: false });
+      }
+    }
+  }
+  return results;
+}

package/lib/http-bridge.js

@@ -78,13 +78,6 @@ export function providerCatalog(ctx, cloneIds) {
   return out;
 }
 
-export function guardLocal(req, res, label) {
-  if (!isTrustedBridgeRequest(req)) {
-    json(res, 403, { error: { code: 'forbidden', message: `dsh-key-rotation: ${label} is local-only` } });
-    return false;
-  }
-  return true;
-}
 
 export function scanForLiveSecrets(section) {
   const masked = structuredClone(section);

package/lib/index.js

@@ -27,8 +27,9 @@ const HEALTH_PATH = '/dsh-key-rotation/health';
 const USAGE_PATH = '/dsh-key-rotation/usage';
 const TEST_PATH = '/dsh-key-rotation/test';
 const SANDBOX_CACHE_PATH = '/dsh-key-rotation/sandbox-cache';
+import { sortAttemptList } from './pool.js';
 import { LastTestCache, SandboxRunner } from './sandbox.js';
-import { healIdleCooldowns } from './heal.js';
+import { healIdleCooldowns, autoUnbreakBrokenKeys } from './heal.js';
 import { LatencyHistogram } from './histogram.js';
 import { pickCascadeFallback } from './cascade.js';
 import { ConcurrencyTracker } from './concurrency.js';
@@ -51,6 +52,7 @@ import { safeParseJson } from './atomic-io.js';
 import { registerOpsRoutes } from './routes-ops.js';
 import { StatePersistence, resolveStatePath } from './persistence.js';
 import path from 'node:path';
+import { registerPluginUpdater } from './plugin-updater.js'
 
 /** The llm-pi-ai namespace whose provider profiles map providers to pools. */
 const PIAI_NS = 'llm-pi-ai';
@@ -199,6 +201,9 @@ export const Config = Schema.object({
     hour: Schema.number().default(0),
   }),
   rateLimitThreshold: Schema.number().default(0.1),
+  proactiveRateLimitGuard: Schema.boolean().default(true),
+  selfHealingIntervalMinutes: Schema.number().default(30),
+  routingStrategy: Schema.union(['round-robin', 'least-loaded', 'lowest-latency']).default('round-robin'),
   rpmLimit: Schema.number().default(0),
   webhookActionToken: Schema.string().role('secret').default(''),
   expiryWarnDays: Schema.number().default(7),
@@ -230,6 +235,8 @@ export const Config = Schema.object({
     })).default({}),
     cooldownMs: Schema.number(),
     maxCooldownMs: Schema.number(),
+    routingStrategy: Schema.union(['round-robin', 'least-loaded', 'lowest-latency']),
+    proactiveRateLimitGuard: Schema.boolean(),
   })).default([...DEFAULT_PROVIDERS]),
 });
 
@@ -339,8 +346,34 @@ export function apply(ctx, config = {}) {
     if (snap) statePersistence.save(snap);
   }
 
+    // Auto-healing / auto-unbreak for broken keys (#303)
   ctx.effect(() => {
-    const timer = setInterval(() => { try { schedulePersist(); } catch (_) {} }, 15000);
+    const cfg = getConfig();
+    const intervalMin = cfg?.selfHealingIntervalMinutes ?? 30;
+    if (!intervalMin || intervalMin <= 0) return () => {};
+    const intervalMs = intervalMin * 60 * 1000;
+    const timer = setInterval(async () => {
+      try {
+        const c = getConfig();
+        if (!c || !c.selfHealingIntervalMinutes || c.selfHealingIntervalMinutes <= 0) return;
+        const { pools } = buildRuntime();
+        const runner = ensureSandboxRunner(ctx);
+        await autoUnbreakBrokenKeys(pools, async (ref) => {
+          let val = (await ctx.credentials?.resolve?.(ref))?.value;
+          if (!val) return { ok: false };
+          return runner.probeModels(ref, val);
+        });
+      } catch (e) { ctx.logger?.warn?.('[dsh-key-rotation] auto-unbreak failed', e); }
+    }, intervalMs);
+    if (typeof timer.unref === 'function') timer.unref();
+    return () => clearInterval(timer);
+  }, 'dsh-key-rotation: auto-unbreak');
+
+  ctx.effect(() => {
+    const timer = setInterval(() => {
+      try { schedulePersist(); }
+      catch (e) { ctx.logger?.warn?.('[dsh-key-rotation] periodic persist failed', e); }
+    }, 15000);
     if (typeof timer.unref === 'function') timer.unref();
     return () => {
       clearInterval(timer);
@@ -354,7 +387,9 @@ export function apply(ctx, config = {}) {
           }
           statePersistence.dispose();
         }
-      } catch (_) {}
+      } catch (e) {
+        ctx.logger?.warn?.('[dsh-key-rotation] dispose persist failed', e);
+      }
     };
   }, 'dsh-key-rotation: state persistence');
   // Periodic sweep of expired cooldowns — keeps health probe cheap and avoids waiting for next user request
@@ -372,9 +407,10 @@ export function apply(ctx, config = {}) {
           }
         }
       }
-      const n = sweepExpired(poolState, now);
-      if (n > 0) console.warn(`[dsh-key-rotation] sweep: cleared ${n} expired cooldown(s)`);
       const runtime = buildRuntime();
+      const allActiveRefs = Array.from(runtime.poolByRef.keys());
+      const n = sweepExpired(poolState, now, allActiveRefs);
+      if (n > 0) console.warn(`[dsh-key-rotation] sweep: cleared ${n} expired cooldown(s)`);
       for (const pool of runtime.poolByRef.values()) {
         compactUsage(pool, 30, now);
       }
@@ -564,7 +600,7 @@ export function apply(ctx, config = {}) {
       if (typeof v === 'string' && v.length > 0) { const ts = Date.parse(v); return Number.isNaN(ts) ? undefined : ts; }
       return undefined;
     };
-    const buildPool = (base, keys, weights, poolCooldown, poolMax, expiresAt) => {
+    const buildPool = (base, keys, weights, poolCooldown, poolMax, expiresAt, poolStrategy, poolGuard) => {
       const refs = (keys ?? []).filter((ref) => typeof ref === 'string' && ref.length > 0);
       if (refs.length === 0) return null;
       const w = Array.isArray(weights) ? weights : [];
@@ -582,7 +618,7 @@ export function apply(ctx, config = {}) {
       }
       return { base, refs, weights: refs.map((_, i) => (typeof w[i] === 'number' && w[i] > 0 ? Math.floor(w[i]) : 1)),
                weightedRefs: weightedRefs.length > 0 ? weightedRefs : refs,
-               state: makeState(base), cooldownMs: poolCooldown, maxCooldownMs: poolMax, expiresAt: parsedExpiry, rpmLimit };
+               state: makeState(base), cooldownMs: poolCooldown, maxCooldownMs: poolMax, expiresAt: parsedExpiry, rpmLimit, routingStrategy: poolStrategy, proactiveRateLimitGuard: poolGuard };
     };
     for (const p of cfg.providers ?? []) {
       const poolCooldown = typeof p.cooldownMs === 'number' ? p.cooldownMs : (cfg.cooldownMs ?? 60000);
@@ -656,7 +692,10 @@ export function apply(ctx, config = {}) {
         }
       }
     }
-    cachedRuntime = { switchCodes, cooldownMs, maxCooldownMs, notifyWebhook, notifyThreshold, concurrencyLimit, cascade, quotaResetWindow, rateLimitThreshold, rpmLimit, webhookActionToken, expiryWarnDays: cfg.expiryWarnDays ?? 7, switchNotify: cfg.switchNotify ?? false, verboseLogging: cfg.verboseLogging ?? false, switchNotifyThrottleMs: cfg.switchNotifyThrottleMs ?? 60000, warnBelowHealthy: cfg.warnBelowHealthy ?? 0, latencySloMs: cfg.latencySloMs ?? 0, providerTags, providerBudgets, poolByRef, providerToPool, modelPoolByProvider, cloneIds, expectedClones,
+    cachedRuntime = { switchCodes, cooldownMs, maxCooldownMs, notifyWebhook, notifyThreshold, concurrencyLimit, cascade, quotaResetWindow, rateLimitThreshold, rpmLimit, webhookActionToken, expiryWarnDays: cfg.expiryWarnDays ?? 7, switchNotify: cfg.switchNotify ?? false, verboseLogging: cfg.verboseLogging ?? false,
+      proactiveRateLimitGuard: cfg.proactiveRateLimitGuard ?? true,
+      selfHealingIntervalMinutes: cfg.selfHealingIntervalMinutes ?? 30,
+      routingStrategy: cfg.routingStrategy ?? 'round-robin', switchNotifyThrottleMs: cfg.switchNotifyThrottleMs ?? 60000, warnBelowHealthy: cfg.warnBelowHealthy ?? 0, latencySloMs: cfg.latencySloMs ?? 0, providerTags, providerBudgets, poolByRef, providerToPool, modelPoolByProvider, cloneIds, expectedClones,
       circuitBreakerEnabled: cfg.circuitBreakerEnabled ?? true,
       circuitBreakerThreshold: cfg.circuitBreakerThreshold ?? 5,
       circuitBreakerOpenMs: cfg.circuitBreakerOpenMs ?? 30000,
@@ -684,8 +723,12 @@ export function apply(ctx, config = {}) {
       const pool = poolByRef.get(ref);
       if (!pool) return original(ref);
       const now = Date.now();
-      const list = pool.weightedRefs ?? pool.refs;
-      const start = pool.state.pointer ?? 0;
+      const strat = pool.routingStrategy ?? buildRuntime().routingStrategy ?? 'round-robin';
+      let list = pool.weightedRefs ?? pool.refs;
+      if (strat === 'lowest-latency' || strat === 'least-loaded') {
+        list = sortAttemptList(list, strat, { latencyHistogram, concurrencyTracker });
+      }
+      const start = (strat === 'round-robin') ? (pool.state.pointer ?? 0) : 0;
       for (let i = 0; i < list.length; i++) {
         const index = (start + i) % list.length;
         const candidate = list[index];
@@ -805,6 +848,7 @@ export function apply(ctx, config = {}) {
     notifySwitch: (runtime, pool, info) => notifySwitch(runtime, pool, info, { webhookSender, notifyQueue: moduleNotifyQueue, now: () => Date.now() }),
     notifyExhaustion,
     recordLatency,
+    latencyHistogram,
     concurrencyTracker,
     MARKER,
     finishError,
@@ -819,6 +863,7 @@ export function apply(ctx, config = {}) {
   // the resolve patch hands out the next key on each dispatch.
   // Operational routes (status/usage/snapshot/key/import/test/health/webhook) (#253)
   registerOpsRoutes(ctx, {
+
     buildRuntime,
     latencyHistogram,
     lastTestCache,
@@ -830,6 +875,16 @@ export function apply(ctx, config = {}) {
     quotaStore,
   });
 
+  // One-click plugin updater (#307). GET status / POST install exact registry version.
+  ctx.effect(() => {
+    if (typeof ctx.webServer?.register !== 'function') return;
+    registerPluginUpdater(ctx, {
+      endpoint: '/api/dsh-key-rotation/update',
+      packageName: '@goodandready/dsh-key-rotation',
+      manifestUrl: new URL('../package.json', import.meta.url),
+    });
+  }, 'dsh-key-rotation: plugin updater');
+
   ctx.effect(() => ctx.on('llm/stream', (options, next) => {
     if (options[MARKER]) return next();
     if (rotationDisabled) return next(); // #199: disabled via webhook action

package/lib/plugin-updater.js

@@ -0,0 +1,277 @@
+import { spawn } from 'node:child_process'
+import { existsSync, readFileSync } from 'node:fs'
+import { readFile } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { basename, dirname, isAbsolute, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+/**
+ * Host-side one-click updater for a DSH Web plugin.
+ *
+ * Mount from apply():
+ *
+ * registerPluginUpdater(ctx, {
+ *   endpoint: '/dsh-key-rotation/update',
+ *   packageName: '@goodandready/dsh-key-rotation',
+ *   manifestUrl: new URL('../package.json', import.meta.url),
+ * })
+ *
+ * GET returns status. POST is accepted only from the local same-origin UI and
+ * installs the exact registry version through the normal DSH CLI.
+ */
+
+const UPDATE_HEADER = 'x-dsh-plugin-update'
+const UPDATE_TIMEOUT_MS = 10 * 60_000
+const VERSION_CACHE_MS = 5 * 60_000
+let latestCache
+
+function header(request, name) {
+  const value = request.headers?.[name]
+  return Array.isArray(value) ? value[0] : value
+}
+
+function isLoopback(value) {
+  const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
+  return address === 'localhost' || address === 'localhost.' || address === '::1'
+    || address?.startsWith('127.') === true
+    || address?.startsWith('::ffff:127.') === true
+}
+
+export function isTrustedUpdateRequest(request) {
+  if (header(request, UPDATE_HEADER) !== '1') return false
+  if (!isLoopback(request.socket?.remoteAddress)) return false
+  const site = header(request, 'sec-fetch-site')
+  if (site !== undefined && site !== 'same-origin') return false
+  const origin = header(request, 'origin')
+  const host = header(request, 'host')
+  if (origin === undefined || host === undefined) return false
+  try {
+    const url = new URL(origin)
+    return (url.protocol === 'http:' || url.protocol === 'https:')
+      && isLoopback(url.hostname) && url.host === host
+  } catch {
+    return false
+  }
+}
+
+function validProfileName(value) {
+  return typeof value === 'string' && value !== '' && value !== '.' && value !== '..'
+    && !value.includes('/') && !value.includes('\\') && !/[\0-\x1f\x7f]/.test(value)
+}
+
+function profileNameFromArgv(argv) {
+  for (let index = 2; index < argv.length; index += 1) {
+    if (argv[index] === '--profile') return argv[index + 1]
+    if (argv[index]?.startsWith('--profile=')) return argv[index].slice('--profile='.length)
+  }
+  return argv[2] === 'web' ? 'web' : undefined
+}
+
+function findDshCliEntry() {
+  const value = process.argv[1]
+  if (value === undefined || value === '') return undefined
+  const entry = value.startsWith('file:') ? fileURLToPath(value) : resolve(process.cwd(), value)
+  if (!existsSync(entry)) return undefined
+  for (let directory = dirname(entry); ; directory = dirname(directory)) {
+    const manifestPath = resolve(directory, 'package.json')
+    if (existsSync(manifestPath)) {
+      try {
+        const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'))
+        const bin = typeof manifest.bin === 'string'
+          ? manifest.bin
+          : typeof manifest.bin === 'object' && manifest.bin !== null
+            ? manifest.bin.dsh
+            : undefined
+        if (manifest.name === '@deepseek-ai/dsh' && typeof bin === 'string'
+          && !isAbsolute(bin) && resolve(directory, bin) === resolve(entry)) return entry
+      } catch {
+        // Continue searching parent package directories.
+      }
+    }
+    const parent = dirname(directory)
+    if (parent === directory) return undefined
+  }
+}
+
+function runtime() {
+  const profileDir = resolve(process.env.DSH_PROFILE_DIR
+    ?? resolve(homedir(), '.dsh', 'profiles', 'web'))
+  const selected = profileNameFromArgv(process.argv)
+  const profileName = validProfileName(selected)
+    ? selected
+    : validProfileName(basename(profileDir)) ? basename(profileDir) : 'web'
+  const cliEntry = findDshCliEntry()
+  return cliEntry === undefined ? { profileName, profileDir } : { profileName, profileDir, cliEntry }
+}
+
+function parseSemver(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value)
+  if (match === null) return undefined
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4]?.split('.') ?? [],
+  }
+}
+
+function comparePrerelease(left, right) {
+  if (left.length === 0 || right.length === 0) return left.length === right.length ? 0 : left.length === 0 ? 1 : -1
+  const length = Math.max(left.length, right.length)
+  for (let index = 0; index < length; index += 1) {
+    const a = left[index]
+    const b = right[index]
+    if (a === undefined || b === undefined) return a === b ? 0 : a === undefined ? -1 : 1
+    if (a === b) continue
+    const aNumeric = /^\d+$/.test(a)
+    const bNumeric = /^\d+$/.test(b)
+    if (aNumeric && bNumeric) {
+      const aNumber = BigInt(a)
+      const bNumber = BigInt(b)
+      if (aNumber !== bNumber) return aNumber > bNumber ? 1 : -1
+      continue
+    }
+    if (aNumeric !== bNumeric) return aNumeric ? -1 : 1
+    return a > b ? 1 : -1
+  }
+  return 0
+}
+
+export function isNewerVersion(currentValue, candidateValue) {
+  const current = parseSemver(currentValue)
+  const candidate = parseSemver(candidateValue)
+  if (current === undefined || candidate === undefined) return false
+  for (let index = 0; index < 3; index += 1) {
+    if (candidate.core[index] !== current.core[index]) return candidate.core[index] > current.core[index]
+  }
+  return comparePrerelease(candidate.prerelease, current.prerelease) > 0
+}
+
+async function latestVersion(packageName, registry) {
+  if (latestCache?.packageName === packageName && latestCache.registry === registry && Date.now() < latestCache.expiresAt) return latestCache.version
+  try {
+    const response = await fetch(`${registry.replace(/\/$/, '')}/${encodeURIComponent(packageName)}/latest`, {
+      signal: AbortSignal.timeout(8_000),
+    })
+    if (!response.ok) return undefined
+    const value = await response.json()
+    if (typeof value.version !== 'string' || value.version === '') return undefined
+    latestCache = { packageName, registry, version: value.version, expiresAt: Date.now() + VERSION_CACHE_MS }
+    return value.version
+  } catch {
+    return undefined
+  }
+}
+
+async function currentVersion(manifestUrl) {
+  const value = JSON.parse(await readFile(manifestUrl, 'utf8'))
+  if (typeof value.version !== 'string' || value.version === '') throw new Error('Cannot read current plugin version.')
+  return value.version
+}
+
+async function status(options, target) {
+  const current = await currentVersion(options.manifestUrl)
+  const latest = await latestVersion(options.packageName, options.registry ?? 'https://registry.npmjs.org')
+  return {
+    packageName: options.packageName,
+    currentVersion: current,
+    ...(latest === undefined ? {} : { latestVersion: latest }),
+    latestCheckFailed: latest === undefined,
+    updateAvailable: latest !== undefined && isNewerVersion(current, latest),
+    profileName: target.profileName,
+    canAutoUpdate: target.cliEntry !== undefined,
+  }
+}
+
+async function installExact(target, packageSpec, options) {
+  if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.')
+  await new Promise((resolvePromise, reject) => {
+    const child = spawn(process.execPath, [
+      target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
+      '--config.minimumReleaseAge=0', packageSpec,
+      `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
+    ], {
+      cwd: target.profileDir,
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, NO_COLOR: '1' },
+    })
+    let detail = ''
+    child.stdout?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000) })
+    child.stderr?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000) })
+    const timer = setTimeout(() => {
+      child.kill()
+      reject(new Error('Update timed out; use the normal DSH update flow.'))
+    }, UPDATE_TIMEOUT_MS)
+    child.once('error', error => { clearTimeout(timer); reject(error) })
+    child.once('exit', code => {
+      clearTimeout(timer)
+      if (code === 0) resolvePromise()
+      else reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`))
+    })
+  })
+}
+
+function json(response, statusCode, value) {
+  response.writeHead(statusCode, {
+    'content-type': 'application/json; charset=utf-8',
+    'cache-control': 'no-store',
+  })
+  response.end(JSON.stringify(value))
+}
+
+export function registerPluginUpdater(ctx, options) {
+  let installing = false
+  return ctx.webServer.register({
+    kind: 'exact',
+    path: options.endpoint,
+    handler: async (request, response) => {
+      try {
+        const target = runtime()
+        if (request.method === 'GET' || request.method === 'HEAD') {
+          const payload = await status(options, target)
+          response.writeHead(200, {
+            'content-type': 'application/json; charset=utf-8',
+            'cache-control': 'no-store',
+          })
+          response.end(request.method === 'HEAD' ? undefined : JSON.stringify(payload))
+          return
+        }
+        if (request.method !== 'POST') {
+          response.writeHead(405, { allow: 'GET, HEAD, POST' })
+          response.end()
+          return
+        }
+        if (!isTrustedUpdateRequest(request)) {
+          json(response, 403, { error: 'Rejected non-local or cross-origin update request.' })
+          return
+        }
+        if (installing) {
+          json(response, 409, { error: 'This plugin is already updating.' })
+          return
+        }
+        installing = true
+        try {
+          const before = await status(options, target)
+          if (before.latestVersion === undefined) {
+            json(response, 503, { error: 'The latest version is temporarily unavailable.' })
+            return
+          }
+          if (!before.updateAvailable) {
+            json(response, 200, before)
+            return
+          }
+          await installExact(target, `${options.packageName}@${before.latestVersion}`, options)
+          json(response, 200, {
+            ...before,
+            updatedVersion: before.latestVersion,
+            restartRequired: true,
+          })
+        } finally {
+          installing = false
+        }
+      } catch (error) {
+        ctx.logger?.warn?.(`plugin updater failed: ${String(error)}`)
+        json(response, 503, { error: 'Plugin update failed; see server logs.' })
+      }
+    },
+  })
+}