@goodandready/dsh-key-rotation 0.8.84 → 0.8.86

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.8.86 (2026-11-03)
+
+### Pre-emptive Token & Request Yield before 429 (Block 13 Release)
+- **Pre-emptive Yield Module (Issue #571)**: Introduced `src/preemptive-yield.js` to evaluate active token and request headroom across provider keys using upstream `x-ratelimit-remaining-tokens`, `x-ratelimit-remaining-requests`, and reset window headers (`x-ratelimit-reset-tokens`).
+- **Zero-Round-Trip Proactive Rotation**: Keys with low token balance (`< preemptiveSafetyMarginTokens`, default: 4000) or low request count (`<= preemptiveSafetyMarginRequests`, default: 2) yield execution priority to candidate keys with ample quota before any HTTP `429 Too Many Requests` or `insufficient_quota` failure occurs.
+- **Graceful Degradation & Reset Recovery**: When upstream reset windows expire, capacity automatically restores to full priority. If all candidate keys in a pool are running on low quota, requests proceed using the key with highest remaining tokens or soonest reset time, avoiding false exhaustion.
+- **Config & Schemastery Support**: Added `preemptiveRotationEnabled`, `preemptiveSafetyMarginTokens`, and `preemptiveSafetyMarginRequests` across Schemastery configuration, pool builders, and TypeScript types.
+
+## 0.8.85 (2026-11-03)
+
+### Inter-Token Stall & Zombie Stream Detector (Block 12 Release)
+- **Watchdog Stream Protection (Issue #569)**: Added `withStreamWatchdog` and `StreamStallError` (`src/stream-watchdog.js`) to continuously monitor active token streams and protect against zombie HTTP connections and provider gateway hangs.
+- **Differentiated Reasoning & Inter-Token Timeouts**: Configurable `stallInitialTimeoutMs` (default: 30s) prevents false positives during initial reasoning generation for DeepSeek R1 and OpenAI o1/o3, while `stallTimeoutMs` (default: 15s) immediately aborts stalled streams when tokens stop arriving mid-response.
+- **Failover & Cooldown Integration (`src/rotate.js`)**: If a stall occurs before any token has yielded, the key is penalized and failover immediately rotates to the next available provider candidate. If a mid-stream stall occurs after partial output, the key is penalized and a structured `STREAM_STALLED` terminal chunk is delivered, keeping the conversation from hanging.
+- **Config & Taxonomy Support**: Added `stallDetectionEnabled`, `stallTimeoutMs`, and `stallInitialTimeoutMs` to Schemastery `SettingsSchema` and `PoolConfig` types, and integrated `STREAM_STALLED` into error taxonomy and 24-hour operations analytics as a recoverable `TIMEOUT`.
+
+## 0.8.84 (2026-10-31)
+
+### DSH 0.2.2 Cordis Service Isolation Compatibility (Hotfix Release)
+- **DSH 0.2.2 Strict Isolation (Issue #567, #568, GitHub #27)**: Resolved Cordis service access without explicit inject by introducing scoped inject guards for `webServer`, `settings`, and optional services across all HTTP routes, lifecycle hooks, and plugin updater.
+- **Zero-Breakage Backward Compatibility**: Retained full compatibility with DSH 0.2.1 and headless environments while ensuring strict adherence to Cordis 0.2.2+ isolation rules.
+
 ## 0.8.83 (2026-10-31)
 
 ### TypeScript Migration & Type-Safe Core Architecture (Block 11 Release)

package/lib/error-taxonomy.js

@@ -95,7 +95,7 @@ export function classifyFailure(failureOrPayload) {
   if (SURFACE_STATUS.has(status)) {
     return { action: 'surface', code: String(status), soft: false, reason: 'client' };
   }
-  if (code === 'TIMEOUT' || code === 'DEADLINE_EXCEEDED' || /timeout/i.test(message)) {
+  if (code === 'TIMEOUT' || code === 'DEADLINE_EXCEEDED' || code === 'STREAM_STALLED' || /timeout|stream stalled/i.test(message)) {
     return { action: 'switch', code: 'TIMEOUT', soft: true, reason: 'timeout' };
   }
   if (SOCKET_SWITCH.has(code) || /ECONNRESET|ECONNREFUSED|ETIMEDOUT|socket hang up|premature close/i.test(message)) {

package/lib/index.js

@@ -137,6 +137,12 @@ const SettingsSchema = Schema.object({
   warnBelowHealthy: Schema.number().default(0),
   latencySloMs: Schema.number().default(0),
   showChatHeaderChip: Schema.boolean().default(true),
+  stallDetectionEnabled: Schema.boolean().default(true),
+  stallTimeoutMs: Schema.number().default(15000),
+  stallInitialTimeoutMs: Schema.number().default(30000),
+  preemptiveRotationEnabled: Schema.boolean().default(true),
+  preemptiveSafetyMarginTokens: Schema.number().default(4000),
+  preemptiveSafetyMarginRequests: Schema.number().default(2),
   providers: Schema.array(Schema.object({
     provider: Schema.string().required(),
     keys: Schema.array(Schema.string()).default([]),
@@ -166,6 +172,12 @@ const SettingsSchema = Schema.object({
     proactiveRateLimitGuard: Schema.boolean(),
     rpmLimit: Schema.number(),
     tpmLimit: Schema.number(),
+    stallDetectionEnabled: Schema.boolean(),
+    stallTimeoutMs: Schema.number(),
+    stallInitialTimeoutMs: Schema.number(),
+    preemptiveRotationEnabled: Schema.boolean(),
+    preemptiveSafetyMarginTokens: Schema.number(),
+    preemptiveSafetyMarginRequests: Schema.number(),
   })).default([...DEFAULT_PROVIDERS]),
 });
 

package/lib/ops-analytics.js

@@ -18,7 +18,7 @@ export function classifyErrorCategory(code, message = '') {
   if (/^5\d\d$/.test(c) || c === 'SERVER' || c === 'BAD_GATEWAY' || c === 'SERVICE_UNAVAILABLE' || m.includes('internal server error')) {
     return 'server';
   }
-  if (c.includes('TIMEOUT') || c === 'ETIMEDOUT' || c === 'ESOCKETTIMEDOUT' || m.includes('timeout') || m.includes('timed out')) {
+  if (c.includes('TIMEOUT') || c.includes('STALL') || c === 'ETIMEDOUT' || c === 'ESOCKETTIMEDOUT' || m.includes('timeout') || m.includes('timed out') || m.includes('stalled')) {
     return 'timeout';
   }
   if (c === 'QUOTA' || c === '402' || c.includes('QUOTA') || m.includes('quota') || m.includes('credit') || m.includes('insufficient_quota')) {

package/lib/pool-builder.js

@@ -41,6 +41,12 @@ export function buildPoolItem({
   maxQueueWaitMs = null,
   maxAttempts = null,
   maxDurationMs = null,
+  stallDetectionEnabled = true,
+  stallTimeoutMs = 15000,
+  stallInitialTimeoutMs = 30000,
+  preemptiveRotationEnabled = true,
+  preemptiveSafetyMarginTokens = 4000,
+  preemptiveSafetyMarginRequests = 2,
 }) {
   const seen = new Set();
   const indexed = (Array.isArray(keys) ? keys : []).map((key, index) => ({ ref: typeof key === 'string' ? key.trim() : '', index }))
@@ -151,6 +157,15 @@ const weightsMap = {};
     maxDurationMs: typeof maxDurationMs === 'number' && Number.isFinite(maxDurationMs) && maxDurationMs > 0
       ? Math.floor(maxDurationMs)
       : 0,
+    stallDetectionEnabled: stallDetectionEnabled ?? true,
+    stallTimeoutMs: typeof stallTimeoutMs === 'number' && Number.isFinite(stallTimeoutMs) && stallTimeoutMs > 0 ? Math.floor(stallTimeoutMs) : 15000,
+    stallInitialTimeoutMs: typeof stallInitialTimeoutMs === 'number' && Number.isFinite(stallInitialTimeoutMs) && stallInitialTimeoutMs > 0 ? Math.floor(stallInitialTimeoutMs) : 30000,
+    preemptiveRotationEnabled: preemptiveRotationEnabled ?? true,
+    preemptiveSafetyMarginTokens: typeof preemptiveSafetyMarginTokens === 'number' && Number.isFinite(preemptiveSafetyMarginTokens) && preemptiveSafetyMarginTokens >= 0 ? Math.floor(preemptiveSafetyMarginTokens) : 4000,
+    preemptiveSafetyMarginRequests: typeof preemptiveSafetyMarginRequests === 'number' && Number.isFinite(preemptiveSafetyMarginRequests) && preemptiveSafetyMarginRequests >= 0 ? Math.floor(preemptiveSafetyMarginRequests) : 2,
+    preemptiveRotationEnabled: preemptiveRotationEnabled ?? true,
+    preemptiveSafetyMarginTokens: typeof preemptiveSafetyMarginTokens === 'number' && Number.isFinite(preemptiveSafetyMarginTokens) && preemptiveSafetyMarginTokens >= 0 ? Math.floor(preemptiveSafetyMarginTokens) : 4000,
+    preemptiveSafetyMarginRequests: typeof preemptiveSafetyMarginRequests === 'number' && Number.isFinite(preemptiveSafetyMarginRequests) && preemptiveSafetyMarginRequests >= 0 ? Math.floor(preemptiveSafetyMarginRequests) : 2,
   };
 }
 
@@ -198,6 +213,15 @@ export function buildPools({ cfg = {}, poolState = new Map(), defaultState = ini
       maxQueueWaitMs: p.maxQueueWaitMs ?? cfg.maxQueueWaitMs,
       maxAttempts: poolAttempts,
       maxDurationMs: poolDuration,
+      stallDetectionEnabled: p.stallDetectionEnabled ?? cfg.stallDetectionEnabled ?? true,
+      stallTimeoutMs: p.stallTimeoutMs ?? cfg.stallTimeoutMs ?? 15000,
+      stallInitialTimeoutMs: p.stallInitialTimeoutMs ?? cfg.stallInitialTimeoutMs ?? 30000,
+      preemptiveRotationEnabled: p.preemptiveRotationEnabled ?? cfg.preemptiveRotationEnabled ?? true,
+      preemptiveSafetyMarginTokens: p.preemptiveSafetyMarginTokens ?? cfg.preemptiveSafetyMarginTokens ?? 4000,
+      preemptiveSafetyMarginRequests: p.preemptiveSafetyMarginRequests ?? cfg.preemptiveSafetyMarginRequests ?? 2,
+      preemptiveRotationEnabled: p.preemptiveRotationEnabled ?? cfg.preemptiveRotationEnabled ?? true,
+      preemptiveSafetyMarginTokens: p.preemptiveSafetyMarginTokens ?? cfg.preemptiveSafetyMarginTokens ?? 4000,
+      preemptiveSafetyMarginRequests: p.preemptiveSafetyMarginRequests ?? cfg.preemptiveSafetyMarginRequests ?? 2,
     }, provRpm, provTpm, provConcurrency);
     if (pool) {
       for (const ref of pool.refs) {
@@ -230,6 +254,15 @@ export function buildPools({ cfg = {}, poolState = new Map(), defaultState = ini
         maxQueueWaitMs: mp.maxQueueWaitMs ?? p.maxQueueWaitMs ?? cfg.maxQueueWaitMs,
         maxAttempts: typeof mp.maxAttempts === 'number' ? mp.maxAttempts : poolAttempts,
         maxDurationMs: typeof mp.maxDurationMs === 'number' ? mp.maxDurationMs : poolDuration,
+        stallDetectionEnabled: mp.stallDetectionEnabled ?? p.stallDetectionEnabled ?? cfg.stallDetectionEnabled ?? true,
+        stallTimeoutMs: mp.stallTimeoutMs ?? p.stallTimeoutMs ?? cfg.stallTimeoutMs ?? 15000,
+        stallInitialTimeoutMs: mp.stallInitialTimeoutMs ?? p.stallInitialTimeoutMs ?? cfg.stallInitialTimeoutMs ?? 30000,
+        preemptiveRotationEnabled: mp.preemptiveRotationEnabled ?? p.preemptiveRotationEnabled ?? cfg.preemptiveRotationEnabled ?? true,
+        preemptiveSafetyMarginTokens: mp.preemptiveSafetyMarginTokens ?? p.preemptiveSafetyMarginTokens ?? cfg.preemptiveSafetyMarginTokens ?? 4000,
+        preemptiveSafetyMarginRequests: mp.preemptiveSafetyMarginRequests ?? p.preemptiveSafetyMarginRequests ?? cfg.preemptiveSafetyMarginRequests ?? 2,
+        preemptiveRotationEnabled: mp.preemptiveRotationEnabled ?? p.preemptiveRotationEnabled ?? cfg.preemptiveRotationEnabled ?? true,
+        preemptiveSafetyMarginTokens: mp.preemptiveSafetyMarginTokens ?? p.preemptiveSafetyMarginTokens ?? cfg.preemptiveSafetyMarginTokens ?? 4000,
+        preemptiveSafetyMarginRequests: mp.preemptiveSafetyMarginRequests ?? p.preemptiveSafetyMarginRequests ?? cfg.preemptiveSafetyMarginRequests ?? 2,
       }, modelRpm, modelTpm, modelConcurrency);
       if (!mpool) continue;
       mpool.basePool = pool;

package/lib/pool.js

@@ -491,6 +491,7 @@ export function isSwitchableError(failureOrPayload, switchCodes = new Set(DEFAUL
   let rawCode = String(failure.code ?? failure.reason ?? '').trim();
   let code = rawCode.toUpperCase();
   if (code && SOCKET_TRANSPORT_CODES.has(code)) code = 'TRANSPORT';
+  if (code === 'STREAM_STALLED' || code === 'STALL_TIMEOUT' || code === 'INTER_TOKEN_STALL') code = 'TIMEOUT';
   const message = String(failure.message ?? failureOrPayload.message ?? '');
 
   // Treat numeric failure.code (e.g. code: "429") as HTTP status if status was not set (#545)

package/lib/preemptive-yield.js

@@ -0,0 +1,129 @@
+// src/preemptive-yield.js — Pre-emptive Token & Request Yield before 429 (#571).
+// Pure module: zero runtime dependencies, strictly < 600 lines.
+
+export const DEFAULT_PREEMPTIVE_SAFETY_MARGIN_TOKENS = 4000;
+export const DEFAULT_PREEMPTIVE_SAFETY_MARGIN_REQUESTS = 2;
+
+/**
+ * Evaluates whether a key has low remaining quota and should yield to other candidates.
+ * @param {object} pool - Pool definition carrying state
+ * @param {string} ref - Key reference
+ * @param {object} [options]
+ * @param {number} [options.now] - Current timestamp in ms
+ * @param {number} [options.safetyMarginTokens]
+ * @param {number} [options.safetyMarginRequests]
+ * @param {boolean} [options.enabled]
+ * @returns {{ yielding: boolean, reason?: string, remainingTokens?: number, remainingRequests?: number, resetInMs?: number }}
+ */
+export function isPreemptiveYielding(pool, ref, options = {}) {
+  const enabled = options.enabled ?? pool?.preemptiveRotationEnabled ?? true;
+  if (!enabled || !pool || !ref) return { yielding: false };
+
+  const limits = pool.state?.detectedLimits?.get?.(ref);
+  if (!limits) return { yielding: false };
+
+  const now = options.now ?? Date.now();
+  const recordedAt = limits.at || now;
+
+  // Window reset calculation
+  const resetMs = limits.tpmResetMs || limits.rpmResetMs || (typeof limits.resetTokens === 'number' ? limits.resetTokens * 1000 : (typeof limits.resetRequests === 'number' ? limits.resetRequests * 1000 : 0));
+
+  if (resetMs > 0 && now >= recordedAt + resetMs) {
+    // Window has already passed and refreshed upstream
+    return { yielding: false };
+  }
+
+  const remainingTokens = limits.remainingTokens ?? limits.tpmRemaining;
+  const remainingRequests = limits.remainingRequests ?? limits.rpmRemaining;
+
+  const marginTokens = options.safetyMarginTokens ?? pool.preemptiveSafetyMarginTokens ?? DEFAULT_PREEMPTIVE_SAFETY_MARGIN_TOKENS;
+  const marginRequests = options.safetyMarginRequests ?? pool.preemptiveSafetyMarginRequests ?? DEFAULT_PREEMPTIVE_SAFETY_MARGIN_REQUESTS;
+
+  const lowTokens = typeof remainingTokens === 'number' && remainingTokens < marginTokens;
+  const lowRequests = typeof remainingRequests === 'number' && remainingRequests <= marginRequests;
+
+  if (lowTokens || lowRequests) {
+    const resetInMs = resetMs > 0 ? Math.max(0, (recordedAt + resetMs) - now) : 0;
+    return {
+      yielding: true,
+      reason: lowTokens ? `LOW_REMAINING_TOKENS (${remainingTokens} < ${marginTokens})` : `LOW_REMAINING_REQUESTS (${remainingRequests} <= ${marginRequests})`,
+      remainingTokens,
+      remainingRequests,
+      resetInMs,
+    };
+  }
+
+  return { yielding: false, remainingTokens, remainingRequests };
+}
+
+/**
+ * Reorders candidate attempts list so that keys with ample token/request headroom
+ * are attempted first, while yielding keys yield priority.
+ * Gracefully degrades if all candidate keys are low on headroom.
+ * @param {string[]} attemptList
+ * @param {object} pool
+ * @param {object} [options]
+ * @returns {string[]}
+ */
+export function applyPreemptiveYield(attemptList, pool, options = {}) {
+  if (!Array.isArray(attemptList) || attemptList.length <= 1 || !pool) {
+    return (attemptList ?? []).slice();
+  }
+
+  const enabled = options.enabled ?? pool.preemptiveRotationEnabled ?? true;
+  if (!enabled) return attemptList.slice();
+
+  const now = options.now ?? Date.now();
+  const ample = [];
+  const yielding = [];
+
+  for (const ref of attemptList) {
+    // Pinned keys stay first if explicitly configured and not overridden
+    if (ref === pool.pinnedRef && options.preservePinned !== false) {
+      ample.push({ ref, info: { yielding: false } });
+      continue;
+    }
+
+    const info = isPreemptiveYielding(pool, ref, { ...options, now });
+    if (info.yielding) {
+      yielding.push({ ref, info });
+      if (options.trace && typeof options.trace.addStep === 'function') {
+        options.trace.addStep(ref, 'DEPRIORITIZED', 'PREEMPTIVE_YIELD', info.reason);
+      }
+      if (options.pushEvent && typeof options.pushEvent === 'function') {
+        options.pushEvent(pool, ref, 'PREEMPTIVE_YIELD', info);
+      }
+    } else {
+      ample.push({ ref, info });
+    }
+  }
+
+  if (yielding.length === 0) {
+    return attemptList.slice();
+  }
+
+  // Record yield counter in pool state
+  if (pool.state) {
+    pool.state.preemptiveYields = (pool.state.preemptiveYields ?? 0) + yielding.length;
+  }
+
+  // Sort yielding keys among themselves: highest remaining tokens first, then soonest reset
+  yielding.sort((a, b) => {
+    const ta = a.info.remainingTokens ?? -1;
+    const tb = b.info.remainingTokens ?? -1;
+    if (ta !== tb) return tb - ta; // Descending tokens
+    const ra = a.info.resetInMs ?? Infinity;
+    const rb = b.info.resetInMs ?? Infinity;
+    return ra - rb; // Ascending reset duration (soonest reset first)
+  });
+
+  if (ample.length === 0) {
+    // Graceful degradation: all keys are yielding; pick the best yielding key first
+    if (options.logWarn && typeof options.logWarn === 'function') {
+      options.logWarn(`[dsh-key-rotation] ${pool.provider ?? '-'}: all candidate keys are yielding (low quota) — proceeding with highest remaining headroom`);
+    }
+    return yielding.map(y => y.ref);
+  }
+
+  return ample.map(a => a.ref).concat(yielding.map(y => y.ref));
+}

package/lib/resolver.js

@@ -11,6 +11,7 @@
 import { bucketAllow, bucketRetryMs, tpmAllow, tpmRetryMs } from './bucket.js';
 import { envValue, sortAttemptList, isKeyPaused, isKeyRevoked, isKeyBroken, costForDay, costForWeek, budgetVerdict, getSessionSticky, setSessionSticky } from './pool.js';
 import { decryptSecret } from './crypto-storage.js';
+import { applyPreemptiveYield } from './preemptive-yield.js';
 import { resolveRefPool, isQuotaManagedRequest, providerOfBase, basePoolForBase } from './pool-index.js';
 import {
   isModelQuotaAvailable,
@@ -132,6 +133,8 @@ export function createResolver({
         lastUsed: pool.state.lastUsed,
       });
     }
+    // Issue #571: Pre-emptive Token & Request Yield before 429
+    list = applyPreemptiveYield(list, pool, { now: Date.now() });
     // Fail closed: when this request is managed by a model pool that has local
     // token budgets, an exhausted candidate may not be dispatched and the
     // original credential must never be used as a bypass. Decided once, before

package/lib/rotate.js

@@ -26,6 +26,8 @@ import {
 
 import { LOCAL_POOL_EXHAUSTED_CODE, resolveKeyDirectly } from './resolver.js';
 import { recordStreamSuccessMetrics, preserveDispatchContext } from './stream-metrics.js';
+import { withStreamWatchdog, StreamStallError } from './stream-watchdog.js';
+import { applyPreemptiveYield } from './preemptive-yield.js';
 import { penalizeKey } from './rotate-penalty.js';
 import { recordPromptCache } from './prompt-cache.js';
 import { recordRequestOutcome, recordFailureCategory } from './ops-analytics.js';
@@ -202,6 +204,14 @@ export function createRotate(deps) {
         }
       }
 
+      // Issue #571: Pre-emptive Token & Request Yield before 429
+      attemptList = applyPreemptiveYield(attemptList, pool, {
+        now: wallNow,
+        trace,
+        pushEvent,
+        logWarn,
+      });
+
       const penalizeRef = (targetRef, errCode, errMsg, rawHeaders) => {
         penalizeKey(targetRef, errCode, errMsg, rawHeaders, {
           pool,
@@ -310,8 +320,33 @@ export function createRotate(deps) {
           }
 
           const _pickedRef = reqStore.pickedRef ?? pool.state.lastUsed;
+          let stallAbort = null;
+          if (typeof AbortController !== 'undefined') {
+            stallAbort = new AbortController();
+            if (budget?.signal) {
+              if (budget.signal.aborted) {
+                try { stallAbort.abort(budget.signal.reason); } catch {}
+              } else {
+                budget.signal.addEventListener('abort', () => {
+                  try { stallAbort?.abort(budget.signal.reason); } catch {}
+                }, { once: true });
+              }
+            }
+          }
+          const guardedStream = withStreamWatchdog(
+            preserveDispatchContext(inner, dispatchStorage, reqStore),
+            {
+              stallDetectionEnabled: pool.stallDetectionEnabled ?? runtime0.stallDetectionEnabled ?? true,
+              stallTimeoutMs: pool.stallTimeoutMs ?? runtime0.stallTimeoutMs ?? 15000,
+              stallInitialTimeoutMs: pool.stallInitialTimeoutMs ?? runtime0.stallInitialTimeoutMs ?? 30000,
+              abortController: stallAbort,
+              onStall: (err) => {
+                logWarn(`[dsh-key-rotation] ${options.provider}: key ${String(_pickedRef ?? '?')} stalled (${err.message})`);
+              },
+            }
+          );
           try {
-            for await (const chunk of preserveDispatchContext(inner, dispatchStorage, reqStore)) {
+            for await (const chunk of guardedStream) {
                 if (!reqStore.concurrencyRef && typeof concurrencyTracker?.acquire === 'function') {
                   const fallbackRef = reqStore.pickedRef ?? _pickedRef;
                   if (fallbackRef) {
@@ -434,33 +469,36 @@ export function createRotate(deps) {
             } catch (e) {
               const effectiveSwitchCodes = pool.switchCodes ?? switchCodes;
               const activeRef = _pickedRef ?? reqStore.pickedRef ?? pool.state.lastUsed ?? attemptList[attempt];
+              const isStall = e instanceof StreamStallError || e?.code === 'STREAM_STALLED' || e?.isStall;
               if (!yielded && isSwitchableError(e, effectiveSwitchCodes)) {
+                const failCode = isStall ? 'STREAM_STALLED' : (e?.code ?? 'TRANSPORT');
+                const catCode = isStall ? 'TIMEOUT' : failCode;
                 preTokenBuffer.length = 0; // Discard metadata from failed attempt (#527)
-                penalizeRef(activeRef, e?.code ?? 'TRANSPORT', String(e?.message ?? e), e?.headers ?? e?.response?.headers ?? pool.state.detectedLimits?.get?.(activeRef));
-                recordFailureCategory(pool, e?.code ?? 'TRANSPORT', String(e?.message ?? e), activeRef, now());
+                penalizeRef(activeRef, catCode, String(e?.message ?? e), e?.headers ?? e?.response?.headers ?? pool.state.detectedLimits?.get?.(activeRef));
+                recordFailureCategory(pool, catCode, String(e?.message ?? e), activeRef, now());
                 pool.state.switches = (pool.state.switches ?? 0) + 1;
-                pool.state.lastReason = String(e?.code ?? 'TRANSPORT');
+                pool.state.lastReason = failCode;
                 pool.state.lastSwitchAt = now();
-                lastFailure = finishError(e?.code ?? 'TRANSPORT', String(e?.message ?? e));
-                logWarn(`[dsh-key-rotation] ${options.provider}: key ${String(activeRef ?? '?')} stream threw before first token ${String(e?.code ?? e?.message ?? e)} - failover to next key`);
+                lastFailure = finishError(failCode, String(e?.message ?? e));
+                logWarn(`[dsh-key-rotation] ${options.provider}: key ${String(activeRef ?? '?')} stream threw before first token ${failCode} - failover to next key`);
                 if (switchNotify && activeRef) {
                   notifySwitch(runtime0, pool, {
                     provider: options.provider,
                     from: activeRef,
-                    code: String(e?.code ?? 'TRANSPORT'),
+                    code: failCode,
                     at: pool.state.lastSwitchAt,
                   });
                 }
                 continue; // Failover to next key!
               }
-              if (yielded && isSwitchableError(e, effectiveSwitchCodes)) {
-                penalizeRef(activeRef, e?.code ?? 'TRANSPORT', String(e?.message ?? e), e?.headers ?? e?.response?.headers ?? pool.state.detectedLimits?.get?.(activeRef));
+              if (yielded && (isStall || isSwitchableError(e, effectiveSwitchCodes))) {
+                penalizeRef(activeRef, isStall ? 'TIMEOUT' : (e?.code ?? 'TRANSPORT'), String(e?.message ?? e), e?.headers ?? e?.response?.headers ?? pool.state.detectedLimits?.get?.(activeRef));
               }
               if (!yielded) {
                 for (const prev of preTokenBuffer) yield prev;
                 preTokenBuffer.length = 0;
               }
-              yield finishError(e?.code ?? 'TRANSPORT', String(e?.message ?? e));
+              yield finishError(isStall ? 'STREAM_STALLED' : (e?.code ?? 'TRANSPORT'), String(e?.message ?? e));
               return;
             }
 

package/lib/stream-watchdog.js

@@ -0,0 +1,99 @@
+// lib/stream-watchdog.js — Inter-token stall & zombie stream detector (#569).
+// Monitors streaming chunk intervals and TTFT to prevent infinite agent hangs.
+
+export class StreamStallError extends Error {
+  constructor(message, elapsedMs, chunkCount) {
+    super(message || `Stream stalled: no tokens received for ${elapsedMs}ms`);
+    this.name = 'StreamStallError';
+    this.code = 'STREAM_STALLED';
+    this.elapsedMs = elapsedMs;
+    this.chunkCount = chunkCount;
+    this.isStall = true;
+  }
+}
+
+/**
+ * Wraps an async iterable stream with an inter-chunk stall watchdog.
+ *
+ * @param {AsyncIterable<any>} innerStream
+ * @param {object} [options]
+ * @param {number} [options.stallTimeoutMs=15000]
+ * @param {number} [options.stallInitialTimeoutMs=30000]
+ * @param {boolean} [options.stallDetectionEnabled=true]
+ * @param {AbortController} [options.abortController]
+ * @param {Function} [options.onStall]
+ * @returns {AsyncGenerator<any>}
+ */
+export async function* withStreamWatchdog(innerStream, options = {}) {
+  const {
+    stallTimeoutMs = 15000,
+    stallInitialTimeoutMs = 30000,
+    stallDetectionEnabled = true,
+    abortController = null,
+    onStall = null,
+  } = options;
+
+  if (!stallDetectionEnabled || (!stallTimeoutMs && !stallInitialTimeoutMs)) {
+    yield* innerStream;
+    return;
+  }
+
+  const iterator = innerStream[Symbol.asyncIterator]();
+  let chunksCount = 0;
+
+  try {
+    while (true) {
+      const currentTimeout = chunksCount === 0
+        ? (stallInitialTimeoutMs || stallTimeoutMs || 30000)
+        : (stallTimeoutMs || 15000);
+
+      let timerId = null;
+
+      const timerPromise = new Promise((_, reject) => {
+        timerId = setTimeout(() => {
+          const err = new StreamStallError(
+            `Stream stalled: no tokens received for ${currentTimeout}ms (chunks: ${chunksCount})`,
+            currentTimeout,
+            chunksCount
+          );
+          if (abortController && typeof abortController.abort === 'function') {
+            try { abortController.abort(err); } catch {}
+          }
+          if (typeof onStall === 'function') {
+            try { onStall(err); } catch {}
+          }
+          reject(err);
+        }, currentTimeout);
+      });
+
+      // Suppress unhandled rejection if iterator.next() finishes first
+      timerPromise.catch(() => {});
+
+      let result;
+      try {
+        result = await Promise.race([
+          iterator.next(),
+          timerPromise,
+        ]);
+      } finally {
+        if (timerId !== null) {
+          clearTimeout(timerId);
+          timerId = null;
+        }
+      }
+
+      if (result.done) {
+        break;
+      }
+
+      chunksCount++;
+      yield result.value;
+    }
+  } finally {
+    if (typeof iterator.return === 'function') {
+      try {
+        await iterator.return();
+      } catch {}
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.84",
+  "version": "0.8.86",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [