@goodandready/dsh-model-sync 0.5.5 → 0.5.7

package/lib/adapter-registry.js

@@ -137,6 +137,24 @@ export function normalizeAdapterConfig(config, profile = {}) {
   if (endpoint.protocol === 'http:' && !privateHttpHost(endpoint.hostname)) {
     throw Object.assign(new Error('adapter endpoint must use https outside loopback'), { code: 'ADAPTER_CONFIG_INVALID' })
   }
+  if (profile?.provider && PROVIDER_ADAPTERS[profile.provider]) {
+    const defaultEndpoint = PROVIDER_ADAPTERS[profile.provider].endpoint
+    let defaultUrl
+    try { defaultUrl = new URL(defaultEndpoint) } catch (_err) { defaultUrl = null }
+    if (defaultUrl) {
+      const knownHost = defaultUrl.hostname.toLowerCase()
+      const targetHost = endpoint.hostname.toLowerCase()
+      const isDomainMatch = targetHost === knownHost || targetHost.endsWith('.' + knownHost.replace(/^api\./, ''))
+      const isLoopback = privateHttpHost(targetHost)
+      const isExplicitlyAllowed = source.allowCustomHost === true || source.allowCustomEndpoint === true
+      if (!isDomainMatch && !isLoopback && !isExplicitlyAllowed) {
+        throw Object.assign(
+          new Error(`adapter endpoint host "${endpoint.hostname}" does not match known provider domain for "${profile.provider}"`),
+          { code: 'ADAPTER_HOST_MISMATCH' }
+        )
+      }
+    }
+  }
   const auth = source.auth === undefined ? 'bearer' : String(source.auth)
   if (!SAFE_AUTH.has(auth)) throw Object.assign(new Error('adapter auth mode is unsupported'), { code: 'ADAPTER_CONFIG_INVALID' })
   const parse = source.parser === undefined ? 'openai' : String(source.parser)

package/lib/alias-resolver.js

@@ -1,9 +1,12 @@
 export const VIRTUAL_STRATEGIES = Object.freeze(['fastest', 'cheapest', 'best-code'])
 
-export function isVirtualAlias(name) {
+export const VIRTUAL_ALIASES = Object.freeze(new Set(['@fast', '@cheap', '@best-code']))
+
+export function isVirtualAlias(name, strategy) {
+  if (strategy && VIRTUAL_STRATEGIES.includes(typeof strategy === 'string' ? strategy.trim() : '')) return true
   if (typeof name !== 'string') return false
   const clean = name.trim().toLowerCase()
-  return clean === '@fast' || clean === '@cheap' || clean === '@best-code' || clean.startsWith('@')
+  return VIRTUAL_ALIASES.has(clean)
 }
 
 export function validateAliasName(name) {
@@ -135,11 +138,22 @@ export function resolveAlias(aliasName, {
     }
 
     if (strategy === 'fastest') {
-      const scored = available.map((item) => ({
-        ...item,
-        latencyMs: estimateLatency(item.provider, item.model, modelProbes),
-      }))
-      scored.sort((a, b) => a.latencyMs - b.latencyMs)
+      const scored = available.map((item) => {
+        const probeKey = `${item.provider}:${item.model.id}`
+        const probe = modelProbes[probeKey]
+        const measured = probe?.latencyMs && Number.isFinite(probe.latencyMs) && probe.ok !== false
+        const latencyMs = measured ? Math.round(probe.latencyMs) : estimateLatency(item.provider, item.model, modelProbes)
+        return {
+          ...item,
+          latencyMs,
+          measured: Boolean(measured),
+        }
+      })
+      scored.sort((a, b) => {
+        if (a.measured && !b.measured) return -1
+        if (!a.measured && b.measured) return 1
+        return a.latencyMs - b.latencyMs
+      })
       const best = scored[0]
       return {
         alias: clean,
@@ -149,7 +163,7 @@ export function resolveAlias(aliasName, {
         name: best.model.name || best.model.id,
         latencyMs: best.latencyMs,
         fallbackUsed: false,
-        reason: 'lowest_latency',
+        reason: best.measured ? 'lowest_latency' : 'estimated_lowest_latency',
       }
     }
 

package/lib/diff-notifier.js

@@ -74,7 +74,7 @@ export function extractDiffEvents(results, options = {}) {
         const bp = pair?.before?.pricing
         const ap = pair?.after?.pricing
         if (bp || ap) {
-          const inputDiff = bp?.inputPerToken !== ap?.outputPerToken && bp?.inputPerToken !== ap?.inputPerToken
+          const inputDiff = bp?.inputPerToken !== ap?.inputPerToken
           const outputDiff = bp?.outputPerToken !== ap?.outputPerToken
           if (inputDiff || outputDiff) {
             priceChanged.push({
@@ -114,6 +114,20 @@ export async function sendWebhookNotification(url, secret, payload, { fetchImpl
     if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
       return { ok: false, error: "URL must use http or https protocol" }
     }
+    const hostname = parsedUrl.hostname.toLowerCase().replace(/^\[|\]$/g, '')
+    if (
+      hostname === '169.254.169.254' ||
+      hostname.startsWith('169.254.') ||
+      hostname === 'metadata.google.internal' ||
+      hostname === '0.0.0.0' ||
+      hostname === '255.255.255.255'
+    ) {
+      return { ok: false, error: "webhook url targets a forbidden metadata or link-local address" }
+    }
+    const isLoopback = hostname === '127.0.0.1' || hostname === 'localhost' || hostname === '::1' || hostname.startsWith('127.') || hostname.startsWith('::ffff:127.')
+    if (parsedUrl.protocol === "http:" && !isLoopback) {
+      return { ok: false, error: "insecure http webhook url is only permitted on loopback" }
+    }
   } catch (err) {
     return { ok: false, error: "Invalid URL: " + (err?.message || String(err)) }
   }
@@ -181,9 +195,21 @@ export async function dispatchDiffNotifications(ctx, config, results, { fetchImp
 
   let webhookResult = null
   if (config?.diffWebhookUrl && typeof config.diffWebhookUrl === "string" && config.diffWebhookUrl.trim()) {
+    let secret = config.diffWebhookSecret || ''
+    const secretRef = config.diffWebhookSecretRef || (typeof config.diffWebhookSecret === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(config.diffWebhookSecret) ? config.diffWebhookSecret : '')
+    if (secretRef) {
+      try {
+        const res = await (ctx?.credentials?.resolve ? ctx.credentials.resolve(secretRef) : ctx?.get?.('credentials')?.resolve?.(secretRef))
+        if (res) secret = typeof res === 'string' ? res : res?.value || secret
+      } catch (err) {
+        if (typeof ctx?.logger?.debug === 'function') {
+          ctx.logger.debug('[dsh-model-sync] webhook secret resolution fallback:', err)
+        }
+      }
+    }
     webhookResult = await sendWebhookNotification(
       config.diffWebhookUrl,
-      config.diffWebhookSecret,
+      secret,
       {
         event: "model-sync.diff",
         ...events,

package/lib/http.js

@@ -2,8 +2,31 @@ import { validateAliasName } from './alias-resolver.js'
 function normalizeWebhookTestRequest(body) {
   if (!body || typeof body !== "object") throw Object.assign(new Error("body is required"), { code: "INVALID_REQUEST" })
   if (typeof body.url !== "string" || !body.url.trim()) throw Object.assign(new Error("url is required"), { code: "INVALID_REQUEST" })
+  let parsed
+  try {
+    parsed = new URL(body.url.trim())
+  } catch (err) {
+    throw Object.assign(new Error("Invalid URL: " + (err?.message || String(err))), { code: "INVALID_REQUEST" })
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw Object.assign(new Error("URL must use http or https protocol"), { code: "INVALID_REQUEST" })
+  }
+  const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '')
+  const isLoopback = hostname === '127.0.0.1' || hostname === 'localhost' || hostname === '::1' || hostname.startsWith('127.') || hostname.startsWith('::ffff:127.')
+  if (parsed.protocol === "http:" && !isLoopback) {
+    throw Object.assign(new Error("insecure http webhook url is only permitted on loopback"), { code: "INVALID_REQUEST" })
+  }
+  if (
+    hostname === '169.254.169.254' ||
+    hostname.startsWith('169.254.') ||
+    hostname === 'metadata.google.internal' ||
+    hostname === '0.0.0.0' ||
+    hostname === '255.255.255.255'
+  ) {
+    throw Object.assign(new Error("webhook url targets a forbidden metadata or link-local address"), { code: "INVALID_REQUEST" })
+  }
   return {
-    url: body.url.trim(),
+    url: parsed.toString(),
     secret: typeof body.secret === "string" ? body.secret.trim() : "",
   }
 }
@@ -28,7 +51,9 @@ export function isLoopbackAddress(ip) {
 export function trusted(req, { requireLoopback = false } = {}) {
   const remoteAddress = req?.socket?.remoteAddress
   if (requireLoopback || req?.method === 'POST') {
-    if (!isLoopbackAddress(remoteAddress)) return false
+    if (remoteAddress && !isLoopbackAddress(remoteAddress)) return false
+    if (!remoteAddress && req?.socket) return false
+    if (!remoteAddress && !isLoopbackAddress(req?.headers?.host?.split(':')[0])) return false
   }
   const fetchSite = req.headers?.['sec-fetch-site']
   if (fetchSite === 'cross-site') return false
@@ -59,8 +84,10 @@ export function trusted(req, { requireLoopback = false } = {}) {
   if (fetchSite === 'same-origin' || fetchSite === 'same-site') return true
   // If sec-fetch-mode is present but origin/referer missing on a cross-site request, reject
   if (req.headers?.['sec-fetch-mode'] && !host) return false
-  // For POST write requests without any browser origin/referer headers, require explicit loopback remoteAddress
-  if (req?.method === 'POST' && !origin && !referer && !isLoopbackAddress(remoteAddress)) return false
+  // For requests requiring loopback or POST without any browser origin/referer headers, require explicit loopback
+  if ((requireLoopback || req?.method === 'POST') && !origin && !referer) {
+    if (!isLoopbackAddress(remoteAddress ?? (req?.headers?.host ? req.headers.host.split(':')[0] : ''))) return false
+  }
   return true
 }
 
@@ -247,7 +274,8 @@ export function registerHttpApi(ctx, synchronizer, { getSchedulerStatus = () =>
     return []
   }
   const makeHandler = (route) => async (req, res) => {
-    if (!trusted(req, { requireLoopback: req.method === 'POST' })) return json(res, 403, { error: { code: 'forbidden', message: 'dsh-model-sync: cross-origin or non-loopback request rejected' } })
+    const isPublicStatus = route === 'status' && req.method === 'GET'
+    if (!trusted(req, { requireLoopback: !isPublicStatus })) return json(res, 403, { error: { code: 'forbidden', message: 'dsh-model-sync: cross-origin or non-loopback request rejected' } })
     if (route === 'status') {
       if (req.method !== 'GET') return json(res, 405, { error: { code: 'method', message: 'GET only' } })
       const payload = { ...synchronizer.status(), scheduler: getSchedulerStatus(), providers: synchronizer.listProviders() }

package/lib/index.js

@@ -27,7 +27,8 @@ export const Config = Schema.object({
   historyLimit: Schema.number().default(50).volatile(),
   notificationLimit: Schema.number().default(50).volatile(),
   diffWebhookUrl: Schema.string().default().volatile(),
-  diffWebhookSecret: Schema.string().default().volatile(),
+  diffWebhookSecretRef: Schema.string().role('credential-ref').default('').volatile(),
+  diffWebhookSecret: Schema.string().role('credential-ref').default('').volatile(),
   notifyOnModelAdded: Schema.boolean().default(true).volatile(),
   notifyOnModelDeprecated: Schema.boolean().default(true).volatile(),
   notifyOnPriceChanged: Schema.boolean().default(true).volatile(),

package/lib/policy.js

@@ -33,9 +33,21 @@ export function normalizePolicy(policy) {
   return res
 }
 
+function isDangerousPattern(pattern) {
+  if (typeof pattern !== 'string') return false
+  // Check for nested quantifiers like (a+)+, (a*)*, (a+)*, (a{1,2})+
+  if (/(\([^)]*[+*]\)[+*?{])|(\([^)]*\{[0-9]+,[0-9]*\}\)[+*?{])/.test(pattern)) return true
+  // Check for quantified groups containing quantified inner constructs
+  if (/\([^\)]*([+*]|\{[0-9]+,[0-9]*\})[^\)]*\)([+*]|\{[0-9]+,[0-9]*\})/.test(pattern)) return true
+  // Check for multiple consecutive open-ended wildcards (e.g. .*.*)
+  if (/(\.\*|\.\+){2,}/.test(pattern)) return true
+  return false
+}
+
 function compilePatterns(patterns, field) {
   return patterns.map((pattern) => {
     if (pattern.length > MAX_PATTERN_LENGTH) throw Object.assign(new Error(`${field} pattern is too long`), { code: 'INVALID_POLICY' })
+    if (isDangerousPattern(pattern)) throw Object.assign(new Error(`${field} pattern has catastrophic backtracking risk: ${pattern}`), { code: 'INVALID_POLICY' })
     try {
       return new RegExp(pattern, 'i')
     } catch {
@@ -53,10 +65,12 @@ export function validatePolicy(policy) {
 
 export function hasPolicy(policy) {
   const normalized = normalizePolicy(policy)
+  const hasRequire = Object.values(normalized.requireCapabilities).some((v) => v === true)
+  const hasDeny = Object.values(normalized.denyCapabilities).some((v) => v === true)
   return normalized.include.length > 0
     || normalized.exclude.length > 0
-    || Object.keys(normalized.requireCapabilities).length > 0
-    || Object.keys(normalized.denyCapabilities).length > 0
+    || hasRequire
+    || hasDeny
     || (normalized.enableCostFilter && normalized.maxPricePerMillion !== undefined)
     || (normalized.enableContextFilter && normalized.minContextTokens !== undefined)
 }
@@ -74,10 +88,10 @@ export function filterModels(models, policy) {
     if (exclude.some((pattern) => pattern.test(haystack))) return false
     const modelCapabilities = model?.capabilities ?? {}
     for (const [key, expected] of Object.entries(normalized.requireCapabilities)) {
-      if (modelCapabilities[key] !== expected) return false
+      if (expected === true && modelCapabilities[key] !== true) return false
     }
     for (const [key, denied] of Object.entries(normalized.denyCapabilities)) {
-      if (modelCapabilities[key] === denied) return false
+      if (denied === true && modelCapabilities[key] === true) return false
     }
     if (normalized.enableCostFilter && normalized.maxPricePerMillion !== undefined) {
       const inputPrice = model?.pricing?.inputPerToken

package/lib/pricing-database.js

@@ -100,14 +100,13 @@ export function lookupReferencePricing(provider, modelId) {
   const rawId = modelId.toLowerCase().trim()
   const cleaned = cleanId(rawId)
 
-  // 1. Direct check in provider table
+  // 1. Direct check in provider table (exact match or date-cleaned match)
   const table = REFERENCE_PRICING[provKey]
   if (table) {
     if (table[rawId]) return { ...table[rawId] }
     if (table[cleaned]) return { ...table[cleaned] }
-    for (const [key, val] of Object.entries(table)) {
-      if (rawId.startsWith(key) || cleaned.startsWith(key)) return { ...val }
-    }
+    // If the provider has a dedicated pricing table, do not search other providers' tables
+    return undefined
   }
 
   // 2. Vendor prefix check (e.g. "openai/gpt-4o" or "anthropic/claude-3-5-sonnet")
@@ -120,18 +119,12 @@ export function lookupReferencePricing(provider, modelId) {
     if (subTable) {
       if (subTable[subId]) return { ...subTable[subId] }
       if (subTable[subCleaned]) return { ...subTable[subCleaned] }
-      for (const [key, val] of Object.entries(subTable)) {
-        if (subId.startsWith(key) || subCleaned.startsWith(key)) return { ...val }
-      }
     }
   }
 
-  // 3. Fallback search across all tables if cleaned matches well-known key
+  // 3. Fallback search across tables ONLY for unknown/aggregator providers without a dedicated table
   for (const [p, t] of Object.entries(REFERENCE_PRICING)) {
     if (t[cleaned]) return { ...t[cleaned] }
-    for (const [key, val] of Object.entries(t)) {
-      if (cleaned.startsWith(key)) return { ...val }
-    }
   }
 
   return undefined

package/lib/reporting.js

@@ -127,7 +127,7 @@ export function appendNotification(existing, report, { limit = DEFAULT_NOTIFICAT
     rows.push({
       ...current,
       updatedAt: now,
-      occurrences: boundedInteger(current.occurrences, 1, 1, 1000000) + 1,
+      occurrences: boundedInteger(Number(current.occurrences || 0) + 1, 1, 1, 1000000),
     })
   } else {
     rows.push(notification)

package/lib/scheduler.js

@@ -82,6 +82,7 @@ export function createSyncScheduler(sync, {
   async function tick() {
     const config = getConfig() ?? {}
     if (config.enabled === false || config.scheduleEnabled === false || running) return
+    resetStates(config)
     const rows = scheduleRows(config)
     if (rows.length === 0) return
     const now = nowFn()
@@ -131,8 +132,6 @@ export function createSyncScheduler(sync, {
   }
 
   function status() {
-    const config = getConfig() ?? {}
-    resetStates(config)
     const values = [...state.values()]
     const nextAt = (timer !== null && values.length > 0) ? Math.min(...values.map((row) => row.nextAt)) : null
     const lastRunAt = values.filter((row) => row.lastRunAt).reduce((max, row) => Math.max(max, row.lastRunAt), 0) || null

package/lib/synchronizer-prober.js

@@ -1,40 +1,92 @@
-export function createModelProber({ health }) {
+export function createModelProber({ health, getProviderCatalog = () => [] } = {}) {
+  const modelProbes = new Map()
+
   async function tryModel({ provider, model } = {}) {
     if (typeof provider !== 'string' || !provider) throw new Error('provider is required')
     if (typeof model !== 'string' || !model) throw new Error('model is required')
     const start = Date.now()
     const result = await health({ provider })
     const entry = result?.results?.find((r) => r.provider === provider)
-    return {
+    const providerOk = entry?.status === 'ok'
+
+    // Verify model in provider catalog if catalog is available
+    const catalog = typeof getProviderCatalog === 'function' ? getProviderCatalog(provider) : []
+    const hasCatalog = Array.isArray(catalog) && catalog.length > 0
+    const inCatalog = !hasCatalog || catalog.some((m) => (typeof m === 'string' ? m : m?.id) === model)
+
+    const ok = Boolean(providerOk && inCatalog)
+    const latencyMs = Date.now() - start
+    const status = !providerOk ? (entry?.status ?? 'error') : (!inCatalog ? 'model_not_found' : 'ok')
+    const errorMsg = !providerOk
+      ? (entry?.message || entry?.status || 'probe failed')
+      : (!inCatalog ? `model "${model}" not found in provider catalog` : undefined)
+
+    const probeResult = {
       provider,
       model,
-      ok: entry?.status === 'ok',
-      latencyMs: Date.now() - start,
-      status: entry?.status ?? 'unknown',
-      ...(entry?.status !== 'ok' ? { error: entry?.message || entry?.status || 'probe failed' } : {}),
+      ok,
+      latencyMs,
+      status,
+      ...(errorMsg ? { error: errorMsg } : {}),
     }
+
+    modelProbes.set(`${provider}:${model}`, {
+      latencyMs,
+      ok,
+      status,
+      timestamp: Date.now(),
+    })
+
+    return probeResult
   }
 
   async function batchTryModels({ provider, models } = {}) {
     if (typeof provider !== 'string' || !provider) throw new Error('provider is required')
     if (!Array.isArray(models)) throw new Error('models must be an array')
     const list = [...new Set(models.filter((m) => typeof m === 'string' && m.trim()).map((m) => m.trim()))].slice(0, 50)
+
+    // Probe provider health ONCE for the entire batch rather than per-model
+    const start = Date.now()
+    const healthResult = await health({ provider })
+    const entry = healthResult?.results?.find((r) => r.provider === provider)
+    const providerOk = entry?.status === 'ok'
+    const catalog = typeof getProviderCatalog === 'function' ? getProviderCatalog(provider) : []
+    const hasCatalog = Array.isArray(catalog) && catalog.length > 0
+    const baseLatency = Date.now() - start
+
     const results = []
-    const concurrency = 3
+    const concurrency = 5
     for (let i = 0; i < list.length; i += concurrency) {
       const chunk = list.slice(i, i + concurrency)
-      const chunkResults = await Promise.all(
-        chunk.map((model) => tryModel({ provider, model }).catch((err) => ({
+      const chunkResults = chunk.map((model) => {
+        const inCatalog = !hasCatalog || catalog.some((m) => (typeof m === 'string' ? m : m?.id) === model)
+        const ok = Boolean(providerOk && inCatalog)
+        const status = !providerOk ? (entry?.status ?? 'error') : (!inCatalog ? 'model_not_found' : 'ok')
+        const errorMsg = !providerOk
+          ? (entry?.message || entry?.status || 'probe failed')
+          : (!inCatalog ? `model "${model}" not found in provider catalog` : undefined)
+
+        const itemResult = {
           provider,
           model,
-          ok: false,
-          latencyMs: 0,
-          status: 'error',
-          error: err instanceof Error ? err.message : String(err)
-        })))
-      )
+          ok,
+          latencyMs: baseLatency,
+          status,
+          ...(errorMsg ? { error: errorMsg } : {}),
+        }
+
+        modelProbes.set(`${provider}:${model}`, {
+          latencyMs: baseLatency,
+          ok,
+          status,
+          timestamp: Date.now(),
+        })
+
+        return itemResult
+      })
       results.push(...chunkResults)
     }
+
     const reachable = results.filter((r) => r.ok).length
     return {
       provider,
@@ -43,8 +95,13 @@ export function createModelProber({ health }) {
     }
   }
 
+  function getModelProbes() {
+    return Object.fromEntries(modelProbes)
+  }
+
   return {
     tryModel,
     batchTryModels,
+    getModelProbes,
   }
 }

package/lib/synchronizer-transfer.js

@@ -74,7 +74,7 @@ export function createConfigTransfer({
             const strat = v.strategy.trim()
             if (VIRTUAL_STRATEGIES.includes(strat)) {
               entry.strategy = strat
-              entry.isVirtual = isVirtualAlias(k)
+              entry.isVirtual = isVirtualAlias(k, strat)
             } else {
               continue
             }
@@ -125,7 +125,7 @@ export function createConfigTransfer({
       }
       currentAliases[trimmedAlias] = {
         strategy: cleanStrategy,
-        isVirtual: isVirtualAlias(trimmedAlias),
+        isVirtual: isVirtualAlias(trimmedAlias, cleanStrategy),
         updatedAt: Date.now(),
       }
     } else {

package/lib/synchronizer.js

@@ -452,7 +452,13 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
     return transientNotifications.find((row) => row.id === id)
   }
 
-  const prober = createModelProber({ health })
+  const prober = createModelProber({
+    health,
+    getProviderCatalog: (p) => {
+      const row = providers().find((item) => item.provider === p)
+      return row?.availableModels || row?.models || []
+    },
+  })
 
   const rollbackHistory = (opts) => performHistoryRollback({ ctx, config: getConfig() ?? {}, providers: providers(), ...opts })
 
@@ -533,6 +539,7 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
     validatePolicy,
     isCircuitOpen: (p) => Boolean(circuits.get(p)?.blockedUntil > Date.now()),
     getHealthResults: () => lastHealth?.results ?? [],
+    getModelProbes: () => prober.getModelProbes(),
   })
 
   return Object.freeze({
@@ -547,6 +554,7 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
     listPolicies,
     health,
     ...prober,
+    getModelProbes: prober.getModelProbes,
     ...transfer,
     credentialDiagnostics,
     history,
@@ -554,7 +562,18 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
     notifications: notificationLedger,
     updateNotification: updateNotificationState,
     rollbackHistory,
-    testWebhook: async ({ url, secret }) => sendWebhookNotification(url, secret, { event: 'model-sync.test', timestamp: Date.now(), test: true }),
+    testWebhook: async ({ url, secret }) => {
+      let resolvedSecret = secret || ''
+      if (typeof secret === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(secret)) {
+        try {
+          const res = await (ctx?.credentials?.resolve ? ctx.credentials.resolve(secret) : ctx?.get?.('credentials')?.resolve?.(secret))
+          if (res) resolvedSecret = typeof res === 'string' ? res : res?.value || resolvedSecret
+        } catch (err) {
+          ctx?.logger?.debug?.('[dsh-model-sync] secret ref resolution fallback:', err)
+        }
+      }
+      return sendWebhookNotification(url, resolvedSecret, { event: 'model-sync.test', timestamp: Date.now(), test: true })
+    },
     status: () => ({ running: Boolean(running), lastRun, lastHealth, lastReport: structuredClone(lastReport), notifications: notificationLedger(), history: history(), policies: listPolicies(), lifecycle: structuredClone(getConfig()?.modelLifecycle ?? {}), aliases: structuredClone(getConfig()?.aliases ?? {}) }),
   })
 }

package/lib/updater.js

@@ -237,7 +237,6 @@ export async function installExact(target, packageSpec, options = {}) {
         '--profile',
         target.profileName,
         'add',
-        '--config.minimumReleaseAge=0',
         packageSpec,
         `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-model-sync",
-  "version": "0.5.5",
+  "version": "0.5.7",
   "description": "Automatic model catalog synchronization for API-key DeepSeek Harness providers.",
   "keywords": [
     "deepseek-harness",