@goodandready/dsh-key-rotation 0.8.84 → 0.8.85

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.8.85 (2026-11-03)
+
+### Inter-Token Stall & Zombie Stream Detector (Block 12 Release)
+- **Watchdog Stream Protection (Issue #569)**: Added `withStreamWatchdog` and `StreamStallError` (`src/stream-watchdog.js`) to continuously monitor active token streams and protect against zombie HTTP connections and provider gateway hangs.
+- **Differentiated Reasoning & Inter-Token Timeouts**: Configurable `stallInitialTimeoutMs` (default: 30s) prevents false positives during initial reasoning generation for DeepSeek R1 and OpenAI o1/o3, while `stallTimeoutMs` (default: 15s) immediately aborts stalled streams when tokens stop arriving mid-response.
+- **Failover & Cooldown Integration (`src/rotate.js`)**: If a stall occurs before any token has yielded, the key is penalized and failover immediately rotates to the next available provider candidate. If a mid-stream stall occurs after partial output, the key is penalized and a structured `STREAM_STALLED` terminal chunk is delivered, keeping the conversation from hanging.
+- **Config & Taxonomy Support**: Added `stallDetectionEnabled`, `stallTimeoutMs`, and `stallInitialTimeoutMs` to Schemastery `SettingsSchema` and `PoolConfig` types, and integrated `STREAM_STALLED` into error taxonomy and 24-hour operations analytics as a recoverable `TIMEOUT`.
+
+## 0.8.84 (2026-10-31)
+
+### DSH 0.2.2 Cordis Service Isolation Compatibility (Hotfix Release)
+- **DSH 0.2.2 Strict Isolation (Issue #567, #568, GitHub #27)**: Resolved Cordis service access without explicit inject by introducing scoped inject guards for `webServer`, `settings`, and optional services across all HTTP routes, lifecycle hooks, and plugin updater.
+- **Zero-Breakage Backward Compatibility**: Retained full compatibility with DSH 0.2.1 and headless environments while ensuring strict adherence to Cordis 0.2.2+ isolation rules.
+
 ## 0.8.83 (2026-10-31)
 
 ### TypeScript Migration & Type-Safe Core Architecture (Block 11 Release)

package/lib/error-taxonomy.js

@@ -95,7 +95,7 @@ export function classifyFailure(failureOrPayload) {
   if (SURFACE_STATUS.has(status)) {
     return { action: 'surface', code: String(status), soft: false, reason: 'client' };
   }
-  if (code === 'TIMEOUT' || code === 'DEADLINE_EXCEEDED' || /timeout/i.test(message)) {
+  if (code === 'TIMEOUT' || code === 'DEADLINE_EXCEEDED' || code === 'STREAM_STALLED' || /timeout|stream stalled/i.test(message)) {
     return { action: 'switch', code: 'TIMEOUT', soft: true, reason: 'timeout' };
   }
   if (SOCKET_SWITCH.has(code) || /ECONNRESET|ECONNREFUSED|ETIMEDOUT|socket hang up|premature close/i.test(message)) {

package/lib/index.js

@@ -137,6 +137,9 @@ const SettingsSchema = Schema.object({
   warnBelowHealthy: Schema.number().default(0),
   latencySloMs: Schema.number().default(0),
   showChatHeaderChip: Schema.boolean().default(true),
+  stallDetectionEnabled: Schema.boolean().default(true),
+  stallTimeoutMs: Schema.number().default(15000),
+  stallInitialTimeoutMs: Schema.number().default(30000),
   providers: Schema.array(Schema.object({
     provider: Schema.string().required(),
     keys: Schema.array(Schema.string()).default([]),
@@ -166,6 +169,9 @@ const SettingsSchema = Schema.object({
     proactiveRateLimitGuard: Schema.boolean(),
     rpmLimit: Schema.number(),
     tpmLimit: Schema.number(),
+    stallDetectionEnabled: Schema.boolean(),
+    stallTimeoutMs: Schema.number(),
+    stallInitialTimeoutMs: Schema.number(),
   })).default([...DEFAULT_PROVIDERS]),
 });
 

package/lib/ops-analytics.js

@@ -18,7 +18,7 @@ export function classifyErrorCategory(code, message = '') {
   if (/^5\d\d$/.test(c) || c === 'SERVER' || c === 'BAD_GATEWAY' || c === 'SERVICE_UNAVAILABLE' || m.includes('internal server error')) {
     return 'server';
   }
-  if (c.includes('TIMEOUT') || c === 'ETIMEDOUT' || c === 'ESOCKETTIMEDOUT' || m.includes('timeout') || m.includes('timed out')) {
+  if (c.includes('TIMEOUT') || c.includes('STALL') || c === 'ETIMEDOUT' || c === 'ESOCKETTIMEDOUT' || m.includes('timeout') || m.includes('timed out') || m.includes('stalled')) {
     return 'timeout';
   }
   if (c === 'QUOTA' || c === '402' || c.includes('QUOTA') || m.includes('quota') || m.includes('credit') || m.includes('insufficient_quota')) {

package/lib/pool-builder.js

@@ -41,6 +41,9 @@ export function buildPoolItem({
   maxQueueWaitMs = null,
   maxAttempts = null,
   maxDurationMs = null,
+  stallDetectionEnabled = true,
+  stallTimeoutMs = 15000,
+  stallInitialTimeoutMs = 30000,
 }) {
   const seen = new Set();
   const indexed = (Array.isArray(keys) ? keys : []).map((key, index) => ({ ref: typeof key === 'string' ? key.trim() : '', index }))
@@ -151,6 +154,9 @@ const weightsMap = {};
     maxDurationMs: typeof maxDurationMs === 'number' && Number.isFinite(maxDurationMs) && maxDurationMs > 0
       ? Math.floor(maxDurationMs)
       : 0,
+    stallDetectionEnabled: stallDetectionEnabled ?? true,
+    stallTimeoutMs: typeof stallTimeoutMs === 'number' && Number.isFinite(stallTimeoutMs) && stallTimeoutMs > 0 ? Math.floor(stallTimeoutMs) : 15000,
+    stallInitialTimeoutMs: typeof stallInitialTimeoutMs === 'number' && Number.isFinite(stallInitialTimeoutMs) && stallInitialTimeoutMs > 0 ? Math.floor(stallInitialTimeoutMs) : 30000,
   };
 }
 
@@ -198,6 +204,9 @@ export function buildPools({ cfg = {}, poolState = new Map(), defaultState = ini
       maxQueueWaitMs: p.maxQueueWaitMs ?? cfg.maxQueueWaitMs,
       maxAttempts: poolAttempts,
       maxDurationMs: poolDuration,
+      stallDetectionEnabled: p.stallDetectionEnabled ?? cfg.stallDetectionEnabled ?? true,
+      stallTimeoutMs: p.stallTimeoutMs ?? cfg.stallTimeoutMs ?? 15000,
+      stallInitialTimeoutMs: p.stallInitialTimeoutMs ?? cfg.stallInitialTimeoutMs ?? 30000,
     }, provRpm, provTpm, provConcurrency);
     if (pool) {
       for (const ref of pool.refs) {
@@ -230,6 +239,9 @@ export function buildPools({ cfg = {}, poolState = new Map(), defaultState = ini
         maxQueueWaitMs: mp.maxQueueWaitMs ?? p.maxQueueWaitMs ?? cfg.maxQueueWaitMs,
         maxAttempts: typeof mp.maxAttempts === 'number' ? mp.maxAttempts : poolAttempts,
         maxDurationMs: typeof mp.maxDurationMs === 'number' ? mp.maxDurationMs : poolDuration,
+        stallDetectionEnabled: mp.stallDetectionEnabled ?? p.stallDetectionEnabled ?? cfg.stallDetectionEnabled ?? true,
+        stallTimeoutMs: mp.stallTimeoutMs ?? p.stallTimeoutMs ?? cfg.stallTimeoutMs ?? 15000,
+        stallInitialTimeoutMs: mp.stallInitialTimeoutMs ?? p.stallInitialTimeoutMs ?? cfg.stallInitialTimeoutMs ?? 30000,
       }, modelRpm, modelTpm, modelConcurrency);
       if (!mpool) continue;
       mpool.basePool = pool;

package/lib/pool.js

@@ -491,6 +491,7 @@ export function isSwitchableError(failureOrPayload, switchCodes = new Set(DEFAUL
   let rawCode = String(failure.code ?? failure.reason ?? '').trim();
   let code = rawCode.toUpperCase();
   if (code && SOCKET_TRANSPORT_CODES.has(code)) code = 'TRANSPORT';
+  if (code === 'STREAM_STALLED' || code === 'STALL_TIMEOUT' || code === 'INTER_TOKEN_STALL') code = 'TIMEOUT';
   const message = String(failure.message ?? failureOrPayload.message ?? '');
 
   // Treat numeric failure.code (e.g. code: "429") as HTTP status if status was not set (#545)

package/lib/rotate.js

@@ -26,6 +26,7 @@ import {
 
 import { LOCAL_POOL_EXHAUSTED_CODE, resolveKeyDirectly } from './resolver.js';
 import { recordStreamSuccessMetrics, preserveDispatchContext } from './stream-metrics.js';
+import { withStreamWatchdog, StreamStallError } from './stream-watchdog.js';
 import { penalizeKey } from './rotate-penalty.js';
 import { recordPromptCache } from './prompt-cache.js';
 import { recordRequestOutcome, recordFailureCategory } from './ops-analytics.js';
@@ -310,8 +311,33 @@ export function createRotate(deps) {
           }
 
           const _pickedRef = reqStore.pickedRef ?? pool.state.lastUsed;
+          let stallAbort = null;
+          if (typeof AbortController !== 'undefined') {
+            stallAbort = new AbortController();
+            if (budget?.signal) {
+              if (budget.signal.aborted) {
+                try { stallAbort.abort(budget.signal.reason); } catch {}
+              } else {
+                budget.signal.addEventListener('abort', () => {
+                  try { stallAbort?.abort(budget.signal.reason); } catch {}
+                }, { once: true });
+              }
+            }
+          }
+          const guardedStream = withStreamWatchdog(
+            preserveDispatchContext(inner, dispatchStorage, reqStore),
+            {
+              stallDetectionEnabled: pool.stallDetectionEnabled ?? runtime0.stallDetectionEnabled ?? true,
+              stallTimeoutMs: pool.stallTimeoutMs ?? runtime0.stallTimeoutMs ?? 15000,
+              stallInitialTimeoutMs: pool.stallInitialTimeoutMs ?? runtime0.stallInitialTimeoutMs ?? 30000,
+              abortController: stallAbort,
+              onStall: (err) => {
+                logWarn(`[dsh-key-rotation] ${options.provider}: key ${String(_pickedRef ?? '?')} stalled (${err.message})`);
+              },
+            }
+          );
           try {
-            for await (const chunk of preserveDispatchContext(inner, dispatchStorage, reqStore)) {
+            for await (const chunk of guardedStream) {
                 if (!reqStore.concurrencyRef && typeof concurrencyTracker?.acquire === 'function') {
                   const fallbackRef = reqStore.pickedRef ?? _pickedRef;
                   if (fallbackRef) {
@@ -434,33 +460,36 @@ export function createRotate(deps) {
             } catch (e) {
               const effectiveSwitchCodes = pool.switchCodes ?? switchCodes;
               const activeRef = _pickedRef ?? reqStore.pickedRef ?? pool.state.lastUsed ?? attemptList[attempt];
+              const isStall = e instanceof StreamStallError || e?.code === 'STREAM_STALLED' || e?.isStall;
               if (!yielded && isSwitchableError(e, effectiveSwitchCodes)) {
+                const failCode = isStall ? 'STREAM_STALLED' : (e?.code ?? 'TRANSPORT');
+                const catCode = isStall ? 'TIMEOUT' : failCode;
                 preTokenBuffer.length = 0; // Discard metadata from failed attempt (#527)
-                penalizeRef(activeRef, e?.code ?? 'TRANSPORT', String(e?.message ?? e), e?.headers ?? e?.response?.headers ?? pool.state.detectedLimits?.get?.(activeRef));
-                recordFailureCategory(pool, e?.code ?? 'TRANSPORT', String(e?.message ?? e), activeRef, now());
+                penalizeRef(activeRef, catCode, String(e?.message ?? e), e?.headers ?? e?.response?.headers ?? pool.state.detectedLimits?.get?.(activeRef));
+                recordFailureCategory(pool, catCode, String(e?.message ?? e), activeRef, now());
                 pool.state.switches = (pool.state.switches ?? 0) + 1;
-                pool.state.lastReason = String(e?.code ?? 'TRANSPORT');
+                pool.state.lastReason = failCode;
                 pool.state.lastSwitchAt = now();
-                lastFailure = finishError(e?.code ?? 'TRANSPORT', String(e?.message ?? e));
-                logWarn(`[dsh-key-rotation] ${options.provider}: key ${String(activeRef ?? '?')} stream threw before first token ${String(e?.code ?? e?.message ?? e)} - failover to next key`);
+                lastFailure = finishError(failCode, String(e?.message ?? e));
+                logWarn(`[dsh-key-rotation] ${options.provider}: key ${String(activeRef ?? '?')} stream threw before first token ${failCode} - failover to next key`);
                 if (switchNotify && activeRef) {
                   notifySwitch(runtime0, pool, {
                     provider: options.provider,
                     from: activeRef,
-                    code: String(e?.code ?? 'TRANSPORT'),
+                    code: failCode,
                     at: pool.state.lastSwitchAt,
                   });
                 }
                 continue; // Failover to next key!
               }
-              if (yielded && isSwitchableError(e, effectiveSwitchCodes)) {
-                penalizeRef(activeRef, e?.code ?? 'TRANSPORT', String(e?.message ?? e), e?.headers ?? e?.response?.headers ?? pool.state.detectedLimits?.get?.(activeRef));
+              if (yielded && (isStall || isSwitchableError(e, effectiveSwitchCodes))) {
+                penalizeRef(activeRef, isStall ? 'TIMEOUT' : (e?.code ?? 'TRANSPORT'), String(e?.message ?? e), e?.headers ?? e?.response?.headers ?? pool.state.detectedLimits?.get?.(activeRef));
               }
               if (!yielded) {
                 for (const prev of preTokenBuffer) yield prev;
                 preTokenBuffer.length = 0;
               }
-              yield finishError(e?.code ?? 'TRANSPORT', String(e?.message ?? e));
+              yield finishError(isStall ? 'STREAM_STALLED' : (e?.code ?? 'TRANSPORT'), String(e?.message ?? e));
               return;
             }
 

package/lib/stream-watchdog.js

@@ -0,0 +1,99 @@
+// lib/stream-watchdog.js — Inter-token stall & zombie stream detector (#569).
+// Monitors streaming chunk intervals and TTFT to prevent infinite agent hangs.
+
+export class StreamStallError extends Error {
+  constructor(message, elapsedMs, chunkCount) {
+    super(message || `Stream stalled: no tokens received for ${elapsedMs}ms`);
+    this.name = 'StreamStallError';
+    this.code = 'STREAM_STALLED';
+    this.elapsedMs = elapsedMs;
+    this.chunkCount = chunkCount;
+    this.isStall = true;
+  }
+}
+
+/**
+ * Wraps an async iterable stream with an inter-chunk stall watchdog.
+ *
+ * @param {AsyncIterable<any>} innerStream
+ * @param {object} [options]
+ * @param {number} [options.stallTimeoutMs=15000]
+ * @param {number} [options.stallInitialTimeoutMs=30000]
+ * @param {boolean} [options.stallDetectionEnabled=true]
+ * @param {AbortController} [options.abortController]
+ * @param {Function} [options.onStall]
+ * @returns {AsyncGenerator<any>}
+ */
+export async function* withStreamWatchdog(innerStream, options = {}) {
+  const {
+    stallTimeoutMs = 15000,
+    stallInitialTimeoutMs = 30000,
+    stallDetectionEnabled = true,
+    abortController = null,
+    onStall = null,
+  } = options;
+
+  if (!stallDetectionEnabled || (!stallTimeoutMs && !stallInitialTimeoutMs)) {
+    yield* innerStream;
+    return;
+  }
+
+  const iterator = innerStream[Symbol.asyncIterator]();
+  let chunksCount = 0;
+
+  try {
+    while (true) {
+      const currentTimeout = chunksCount === 0
+        ? (stallInitialTimeoutMs || stallTimeoutMs || 30000)
+        : (stallTimeoutMs || 15000);
+
+      let timerId = null;
+
+      const timerPromise = new Promise((_, reject) => {
+        timerId = setTimeout(() => {
+          const err = new StreamStallError(
+            `Stream stalled: no tokens received for ${currentTimeout}ms (chunks: ${chunksCount})`,
+            currentTimeout,
+            chunksCount
+          );
+          if (abortController && typeof abortController.abort === 'function') {
+            try { abortController.abort(err); } catch {}
+          }
+          if (typeof onStall === 'function') {
+            try { onStall(err); } catch {}
+          }
+          reject(err);
+        }, currentTimeout);
+      });
+
+      // Suppress unhandled rejection if iterator.next() finishes first
+      timerPromise.catch(() => {});
+
+      let result;
+      try {
+        result = await Promise.race([
+          iterator.next(),
+          timerPromise,
+        ]);
+      } finally {
+        if (timerId !== null) {
+          clearTimeout(timerId);
+          timerId = null;
+        }
+      }
+
+      if (result.done) {
+        break;
+      }
+
+      chunksCount++;
+      yield result.value;
+    }
+  } finally {
+    if (typeof iterator.return === 'function') {
+      try {
+        await iterator.return();
+      } catch {}
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.84",
+  "version": "0.8.85",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [