@goodandready/dsh-model-sync 0.5.8 → 0.5.10

package/lib/adapter-registry.js

@@ -97,14 +97,32 @@ function mappedRows(provider, rows, descriptor) {
 }
 
 function parseRows(provider, payload, descriptor) {
+  if (payload && (payload.error || payload.errors)) {
+    const message = typeof payload.error === 'string'
+      ? payload.error
+      : payload.error?.message || (Array.isArray(payload.errors) ? payload.errors.map(e => e?.message || e).join(', ') : 'endpoint returned error payload')
+    const err = new Error(`endpoint returned error payload: ${message}`)
+    err.adapterCode = 'schema'
+    throw err
+  }
   const parserKind = descriptor.parse || descriptor.parser
   if (parserKind === 'clinebot-plan') {
     const plan = payload?.data?.plan || payload?.data || payload?.plan || payload
     const included = plan?.features?.included || plan?.includedModels || []
+    if (!Array.isArray(included)) {
+      const err = new Error('model catalog response does not contain plan features')
+      err.adapterCode = 'schema'
+      throw err
+    }
     return parseClinePassModels(included)
   }
   if (parserKind === 'google') {
-    const rows = Array.isArray(payload?.models) ? payload.models : []
+    const rows = payload?.models
+    if (!Array.isArray(rows)) {
+      const err = new Error('model catalog response does not contain models array')
+      err.adapterCode = 'schema'
+      throw err
+    }
     return normalizeModels(provider, rows.map((row) => ({
       ...row,
       id: String(row.name ?? '').replace(/^models\//, ''),
@@ -113,8 +131,13 @@ function parseRows(provider, payload, descriptor) {
       maxTokens: row.outputTokenLimit,
     })))
   }
-  const rows = pathValue(payload, descriptor.modelsPath) ?? payload?.data ?? payload?.models ?? payload?.availableModels
-  return normalizeModels(provider, Array.isArray(rows) ? mappedRows(provider, rows, descriptor) : [])
+  const rows = pathValue(payload, descriptor.modelsPath) ?? (Array.isArray(payload) ? payload : (payload?.data ?? payload?.models ?? payload?.availableModels))
+  if (!Array.isArray(rows)) {
+    const err = new Error('model catalog response does not contain models array')
+    err.adapterCode = 'schema'
+    throw err
+  }
+  return normalizeModels(provider, mappedRows(provider, rows, descriptor))
 }
 
 function privateHttpHost(hostname) {

package/lib/client.js

@@ -600,6 +600,7 @@ window.__ModuleLoader__.load({
         setBusy(true); setWebhookErr(''); setWebhookMsg('')
         try {
           await scope.set('diffWebhookUrl', webhookDraft.diffWebhookUrl || '')
+          await scope.set('diffWebhookSecretRef', webhookDraft.diffWebhookSecretRef || webhookDraft.diffWebhookSecret || '')
           await scope.set('diffWebhookSecret', webhookDraft.diffWebhookSecret || '')
           await scope.set('notifyOnModelAdded', !!webhookDraft.notifyOnModelAdded)
           await scope.set('notifyOnModelDeprecated', !!webhookDraft.notifyOnModelDeprecated)
@@ -622,6 +623,7 @@ window.__ModuleLoader__.load({
             body: JSON.stringify({
               url: webhookDraft.diffWebhookUrl,
               secret: webhookDraft.diffWebhookSecret || '',
+              secretRef: webhookDraft.diffWebhookSecretRef || webhookDraft.diffWebhookSecret || '',
             }),
           })
           const body = await res.json()

package/lib/credentials.js

@@ -38,9 +38,18 @@ function safeCode(error) {
   return 'credential-error'
 }
 
+export function sanitizeSecretString(value) {
+  if (value === null || value === undefined) return ''
+  return String(value)
+    .replace(/(authorization)\s*[:=]\s*(?:bearer|basic|token)\s+[^\s,;&]+/gi, '$1=[redacted]')
+    .replace(/(api[_-]?key|token|secret|authorization|password)\s*[:=]\s*[^\s,;&]+/gi, '$1=[redacted]')
+    .replace(/\b(bearer\s+)[A-Za-z0-9._~+/-]+=*/gi, '$1[redacted]')
+    .replace(/([?&](?:key|token|api[_-]?key|access[_-]?token|secret)=)[^&#\s]+/gi, '$1[redacted]')
+}
+
 function safeMessage(error) {
   const source = error instanceof Error ? error.message : String(error ?? '')
-  return source.replace(/(api[_-]?key|token|secret|authorization|password)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]').slice(0, 160)
+  return sanitizeSecretString(source).slice(0, 160)
 }
 
 export function createCredentialResolver(ctx) {

package/lib/diff-notifier.js

@@ -104,6 +104,43 @@ export function extractDiffEvents(results, options = {}) {
   }
 }
 
+export function isLoopbackIPv4(address) {
+  if (typeof address !== 'string' || !address.startsWith('127.')) return false
+  const parts = address.split('.')
+  if (parts.length !== 4) return false
+  return parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) >= 0 && Number(part) <= 255)
+}
+
+export function isForbiddenWebhookHost(rawHostname) {
+  const host = String(rawHostname || '').toLowerCase().replace(/^\[|\]$/g, '')
+  if (host === '169.254.169.254' || host.startsWith('169.254.')) return true
+  if (host.startsWith('::ffff:')) {
+    const v4 = host.slice('::ffff:'.length)
+    if (v4.startsWith('169.254.') || v4.startsWith('a9fe:')) return true
+    if (v4 === '100.100.100.200' || v4 === '6464:64c8') return true
+  }
+  if (host.startsWith('fe80:') || host.startsWith('fe80::')) return true
+  if (host === '100.100.100.200') return true
+  if (host === '0.0.0.0' || host === '255.255.255.255' || host === '::' || host === '0:0:0:0:0:0:0:0') return true
+  if (
+    host === 'metadata.google.internal' ||
+    host === 'instance-data' ||
+    host === 'metadata' ||
+    host.endsWith('.metadata.google.internal') ||
+    host.endsWith('.metadata')
+  ) return true
+  return false
+}
+
+export function isLoopbackHost(rawHostname) {
+  const host = String(rawHostname || '').toLowerCase().replace(/^\[|\]$/g, '')
+  if (host === '127.0.0.1' || host === 'localhost' || host === 'localhost.' || host === '::1') return true
+  if (host.startsWith('::ffff:')) {
+    return isLoopbackIPv4(host.slice('::ffff:'.length))
+  }
+  return isLoopbackIPv4(host)
+}
+
 export async function sendWebhookNotification(url, secret, payload, { fetchImpl = globalThis.fetch, timeoutMs = 5000 } = {}) {
   if (typeof url !== "string" || !url.trim()) {
     return { ok: false, error: "URL is required" }
@@ -115,16 +152,10 @@ export async function sendWebhookNotification(url, secret, payload, { fetchImpl
       return { ok: false, error: "URL must use http or https protocol" }
     }
     const hostname = parsedUrl.hostname.toLowerCase().replace(/^\[|\]$/g, '')
-    if (
-      hostname === '169.254.169.254' ||
-      hostname.startsWith('169.254.') ||
-      hostname === 'metadata.google.internal' ||
-      hostname === '0.0.0.0' ||
-      hostname === '255.255.255.255'
-    ) {
+    if (isForbiddenWebhookHost(hostname)) {
       return { ok: false, error: "webhook url targets a forbidden metadata or link-local address" }
     }
-    const isLoopback = hostname === '127.0.0.1' || hostname === 'localhost' || hostname === '::1' || hostname.startsWith('127.') || hostname.startsWith('::ffff:127.')
+    const isLoopback = isLoopbackHost(hostname)
     if (parsedUrl.protocol === "http:" && !isLoopback) {
       return { ok: false, error: "insecure http webhook url is only permitted on loopback" }
     }
@@ -195,17 +226,37 @@ export async function dispatchDiffNotifications(ctx, config, results, { fetchImp
 
   let webhookResult = null
   if (config?.diffWebhookUrl && typeof config.diffWebhookUrl === "string" && config.diffWebhookUrl.trim()) {
-    let secret = config.diffWebhookSecret || ''
-    const secretRef = config.diffWebhookSecretRef || (typeof config.diffWebhookSecret === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(config.diffWebhookSecret) ? config.diffWebhookSecret : '')
+    let secret = ''
+    const secretRef = (config.diffWebhookSecretRef || '').trim()
     if (secretRef) {
+      let resolvedSecret = ''
       try {
-        const res = await (ctx?.credentials?.resolve ? ctx.credentials.resolve(secretRef) : ctx?.get?.('credentials')?.resolve?.(secretRef))
-        if (res) secret = typeof res === 'string' ? res : res?.value || secret
+        const creds = ctx?.credentials || ctx?.get?.('credentials')
+        if (creds?.resolve) {
+          const res = await creds.resolve(secretRef)
+          resolvedSecret = typeof res === 'string' ? res : res?.value || ''
+        }
       } catch (err) {
-        if (typeof ctx?.logger?.debug === 'function') {
-          ctx.logger.debug('[dsh-model-sync] webhook secret resolution fallback:', err)
+        if (typeof ctx?.logger?.warn === 'function') {
+          ctx.logger.warn('[dsh-model-sync] webhook secret resolution failed:', err)
+        }
+      }
+      if (!resolvedSecret) {
+        // FAIL-CLOSED: do not dispatch unsigned webhook when secret was expected (#204)
+        if (typeof ctx?.logger?.warn === 'function') {
+          ctx.logger.warn(`[dsh-model-sync] webhook secret resolution failed for '${secretRef}', skipping webhook dispatch (fail-closed)`)
+        }
+        return {
+          ok: false,
+          error: 'credential_resolution_failed',
+          message: `Failed to resolve webhook secret credential reference '${secretRef}'`,
+          events,
+          dispatched: false,
         }
       }
+      secret = resolvedSecret
+    } else if (config.diffWebhookSecret) {
+      secret = String(config.diffWebhookSecret).trim()
     }
     webhookResult = await sendWebhookNotification(
       config.diffWebhookUrl,

package/lib/generic-adapter.js

@@ -75,8 +75,21 @@ async function readBody(response) {
 }
 
 function rowsFrom(payload) {
-  const rows = payload?.data ?? payload?.models ?? payload?.availableModels
-  return Array.isArray(rows) ? rows : []
+  if (payload && (payload.error || payload.errors)) {
+    const message = typeof payload.error === 'string'
+      ? payload.error
+      : payload.error?.message || (Array.isArray(payload.errors) ? payload.errors.map(e => e?.message || e).join(', ') : 'endpoint returned error payload')
+    const err = new Error(`endpoint returned error payload: ${message}`)
+    err.adapterCode = 'schema'
+    throw err
+  }
+  const rows = Array.isArray(payload) ? payload : (payload?.data ?? payload?.models ?? payload?.availableModels)
+  if (!Array.isArray(rows)) {
+    const err = new Error('model catalog response does not contain models array')
+    err.adapterCode = 'schema'
+    throw err
+  }
+  return rows
 }
 
 export function canUseGenericAdapter(profile) {

package/lib/history.js

@@ -1,3 +1,4 @@
+import { sanitizeSecretString } from './credentials.js'
 import { normalizeModels } from './models.js'
 
 export const DEFAULT_HISTORY_LIMIT = 50
@@ -27,6 +28,11 @@ function cloneModel(provider, model) {
   if (normalized.pricing) compact.pricing = normalized.pricing
   if (normalized.contextWindow !== undefined) compact.contextWindow = normalized.contextWindow
   if (normalized.maxTokens !== undefined) compact.maxTokens = normalized.maxTokens
+  if (normalized.input !== undefined) compact.input = normalized.input
+  if (normalized.compat !== undefined) compact.compat = normalized.compat
+  if (normalized.tags !== undefined) compact.tags = normalized.tags
+  if (normalized.aliases !== undefined && normalized.aliases.length > 0) compact.aliases = normalized.aliases
+  if (normalized.lifecycle !== undefined) compact.lifecycle = normalized.lifecycle
   return compact
 }
 
@@ -36,7 +42,7 @@ function catalog(provider, models) {
 
 function message(value) {
   if (value === undefined || value === null) return undefined
-  return String(value).replace(/(api[_-]?key|token|secret|authorization|password)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]').slice(0, MAX_MESSAGE_LENGTH)
+  return sanitizeSecretString(value).slice(0, MAX_MESSAGE_LENGTH)
 }
 
 function diffFor(provider, diff) {

package/lib/http.js

@@ -1,3 +1,4 @@
+import { isForbiddenWebhookHost, isLoopbackHost } from './diff-notifier.js'
 import crypto from 'node:crypto'
 import { validateAliasName } from './alias-resolver.js'
 import { validatePolicy } from './policy.js'
@@ -15,22 +16,17 @@ function normalizeWebhookTestRequest(body) {
     throw Object.assign(new Error("URL must use http or https protocol"), { code: "INVALID_REQUEST" })
   }
   const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '')
-  const isLoopback = hostname === '127.0.0.1' || hostname === 'localhost' || hostname === '::1' || hostname.startsWith('127.') || hostname.startsWith('::ffff:127.')
+  if (isForbiddenWebhookHost(hostname)) {
+    throw Object.assign(new Error("webhook url targets a forbidden metadata or link-local address"), { code: "INVALID_REQUEST" })
+  }
+  const isLoopback = isLoopbackHost(hostname)
   if (parsed.protocol === "http:" && !isLoopback) {
     throw Object.assign(new Error("insecure http webhook url is only permitted on loopback"), { code: "INVALID_REQUEST" })
   }
-  if (
-    hostname === '169.254.169.254' ||
-    hostname.startsWith('169.254.') ||
-    hostname === 'metadata.google.internal' ||
-    hostname === '0.0.0.0' ||
-    hostname === '255.255.255.255'
-  ) {
-    throw Object.assign(new Error("webhook url targets a forbidden metadata or link-local address"), { code: "INVALID_REQUEST" })
-  }
   return {
     url: parsed.toString(),
     secret: typeof body.secret === "string" ? body.secret.trim() : "",
+    ...(body.secretRef && typeof body.secretRef === "string" ? { secretRef: body.secretRef.trim() } : {}),
   }
 }
 
@@ -42,14 +38,17 @@ function json(res, status, body) {
 }
 
 export function isLoopbackAddress(ip) {
-  if (!ip || typeof ip !== 'string') return false
-  const clean = ip.toLowerCase().replace(/^\[|\]$/g, '')
-  if (clean === '127.0.0.1' || clean === '::1' || clean === '::ffff:127.0.0.1' || clean === 'localhost') return true
-  if (clean.startsWith('127.') || clean.startsWith('::ffff:127.')) return true
-  return false
+  return isLoopbackHost(ip)
 }
 
-export function trusted(req, { requireLoopback = false } = {}) {
+export function trusted(req, { requireLoopback = false, ctx = null } = {}) {
+  // 1. Core connection rejection check (#237)
+  const conn = ctx?.connection || ctx?.get?.('connection') || req?.connection
+  if (conn && typeof conn.requestRejection === 'function') {
+    const rejection = conn.requestRejection(req)
+    if (rejection !== undefined) return false
+  }
+
   const remoteAddress = req?.socket?.remoteAddress
   if (requireLoopback || req?.method === 'POST') {
     if (remoteAddress && !isLoopbackAddress(remoteAddress)) return false
@@ -66,7 +65,7 @@ export function trusted(req, { requireLoopback = false } = {}) {
       const url = new URL(origin)
       if (url.host !== host) return false
       if (requireLoopback || req?.method === 'POST') {
-        if (!isLoopbackAddress(url.hostname) && url.hostname !== 'localhost') return false
+        if (!isLoopbackAddress(url.hostname)) return false
       }
     } catch { return false }
   }
@@ -77,7 +76,7 @@ export function trusted(req, { requireLoopback = false } = {}) {
       const url = new URL(referer)
       if (url.host !== host) return false
       if (requireLoopback || req?.method === 'POST') {
-        if (!isLoopbackAddress(url.hostname) && url.hostname !== 'localhost') return false
+        if (!isLoopbackAddress(url.hostname)) return false
       }
     } catch { return false }
   }
@@ -273,8 +272,18 @@ export function registerHttpApi(ctx, synchronizer, { getSchedulerStatus = () =>
     return []
   }
   const makeHandler = (route) => async (req, res) => {
+    // 1. Core connection check on all routes (#237)
+    const conn = ctx?.connection || ctx?.get?.('connection') || req?.connection
+    if (conn && typeof conn.requestRejection === 'function') {
+      const rejection = conn.requestRejection(req)
+      if (rejection !== undefined) {
+        const statusCode = typeof rejection === 'number' ? rejection : 401
+        return json(res, statusCode, { error: { code: 'unauthorized', message: 'dsh-model-sync: core connection rejected request' } })
+      }
+    }
+
     const isPublicStatus = route === 'status' && req.method === 'GET'
-    if (!trusted(req, { requireLoopback: !isPublicStatus })) return json(res, 403, { error: { code: 'forbidden', message: 'dsh-model-sync: cross-origin or non-loopback request rejected' } })
+    if (!trusted(req, { requireLoopback: !isPublicStatus, ctx })) return json(res, 403, { error: { code: 'forbidden', message: 'dsh-model-sync: cross-origin or non-loopback request rejected' } })
     if (route === 'status') {
       if (req.method !== 'GET') return json(res, 405, { error: { code: 'method', message: 'GET only' } })
       const payload = { ...synchronizer.status(), scheduler: getSchedulerStatus(), providers: synchronizer.listProviders() }

package/lib/index.js

@@ -44,7 +44,7 @@ export const Config = Schema.object({
     title: Schema.string().required(),
     message: Schema.string().required(),
     providers: Schema.array(Schema.object({}).loose()).default([]),
-  }).loose()).default([]),
+  }).loose()).default([]).volatile(),
   staleGraceRuns: Schema.number().default(2).volatile(),
   lifecycleRetentionRuns: Schema.number().default(20).volatile(),
   lifecycleRevision: Schema.number().default(0).volatile(),
@@ -54,14 +54,14 @@ export const Config = Schema.object({
     firstMissingAt: Schema.number().default(0),
     lastSeenAt: Schema.number().default(0),
     lastObservedRun: Schema.number().default(0),
-  }).loose())).default({}),
+  }).loose())).default({}).volatile(),
   history: Schema.array(Schema.object({
     id: Schema.string().required(),
     version: Schema.number().required(),
     startedAt: Schema.number().required(),
     finishedAt: Schema.number().required(),
     providers: Schema.array(Schema.object({}).loose()).default([]),
-  }).loose()).default([]),
+  }).loose()).default([]).volatile(),
   providers: Schema.array(Schema.object({
     provider: Schema.string().required(),
     enabled: Schema.boolean().default(true),
@@ -69,7 +69,7 @@ export const Config = Schema.object({
     jitterMinutes: Schema.number().default(0),
     ttlMinutes: Schema.number().default(0),
     autoApply: Schema.boolean().default(false),
-  })).default([]),
+  })).default([]).volatile(),
   aliases: Schema.dict(Schema.object({
     provider: Schema.string(),
     model: Schema.string(),
@@ -79,7 +79,7 @@ export const Config = Schema.object({
     })),
     strategy: Schema.string(),
     updatedAt: Schema.number().default(0),
-  }).loose()).default({}),
+  }).loose()).default({}).volatile(),
   modelSelections: Schema.dict(Schema.array(Schema.string())).default({}).volatile(),
   adapterRegistry: Schema.dict(Schema.object({
     enabled: Schema.boolean().default(true),
@@ -90,7 +90,7 @@ export const Config = Schema.object({
     fields: Schema.any().default({}),
     capabilityMap: Schema.any().default({}),
     headers: Schema.dict(Schema.string()).default({}),
-  }).loose()).default({}),
+  }).loose()).default({}).volatile(),
   modelPolicies: Schema.dict(Schema.object({
     include: Schema.array(Schema.string()).default([]),
     exclude: Schema.array(Schema.string()).default([]),
@@ -100,7 +100,7 @@ export const Config = Schema.object({
     maxPricePerMillion: Schema.number(),
     enableContextFilter: Schema.boolean().default(false),
     minContextTokens: Schema.number(),
-  }).loose()).default({}),
+  }).loose()).default({}).volatile(),
   // Full catalogs are cached separately from the allowlist applied to DSH.
   // This keeps the model picker useful after a restart without widening the
   // active llm-pi-ai catalog.
@@ -108,7 +108,7 @@ export const Config = Schema.object({
     provider: Schema.string().required(),
     id: Schema.string().required(),
     name: Schema.string().required(),
-  }).loose())).default({}),
+  }).loose())).default({}).volatile(),
 })
 
 // DSH serves a namespace's settings form from the volatile fields of its profile
@@ -123,6 +123,7 @@ export function plainConfig(value) {
 }
 
 export function apply(ctx, config) {
+  let liveConfig = undefined
   const baseConfig = structuredClone(plainConfig(config || {}))
   const resolveConfig = (value) => {
     try {
@@ -134,7 +135,7 @@ export function apply(ctx, config) {
       return liveConfig ?? baseConfig
     }
   }
-  let liveConfig = resolveConfig(baseConfig)
+  liveConfig = resolveConfig(baseConfig)
   let reconfigure = () => {}
   let saveConfigImpl = async (patch) => {
     const plainPatch = plainConfig(patch)
@@ -146,14 +147,16 @@ export function apply(ctx, config) {
         ctx.logger.debug('[dsh-model-sync] settings service read failed:', err)
       }
     }
-    if (settings && typeof settings.update === 'function') {
-      try {
-        await settings.update(NS, plainPatch)
-      } catch (err) {
-        if (typeof ctx.logger?.warn === 'function') {
-          ctx.logger.warn('[dsh-model-sync] settings.update failed:', err)
-        }
+    if (!settings || typeof settings.update !== 'function') {
+      throw Object.assign(new Error('dsh-model-sync settings are not writable'), { code: 'CONFIG_UNAVAILABLE' })
+    }
+    try {
+      await settings.update(NS, plainPatch)
+    } catch (err) {
+      if (typeof ctx.logger?.warn === 'function') {
+        ctx.logger.warn('[dsh-model-sync] settings.update failed:', err)
       }
+      throw err
     }
     liveConfig = resolveConfig({ ...liveConfig, ...plainPatch })
     reconfigure()

package/lib/models.js

@@ -273,6 +273,7 @@ function normalizePricing(row) {
   }
   if (typeof source.currency === 'string' && source.currency.trim()) pricing.currency = source.currency.trim()
   if (typeof source.unit === 'string' && source.unit.trim()) pricing.unit = source.unit.trim()
+  if (typeof source.source === 'string' && source.source.trim()) pricing.source = source.source.trim()
   return pricing
 }
 

package/lib/policy.js

@@ -41,6 +41,12 @@ function isDangerousPattern(pattern) {
   if (/\([^\)]*([+*]|\{[0-9]+,[0-9]*\})[^\)]*\)([+*]|\{[0-9]+,[0-9]*\})/.test(pattern)) return true
   // Check for multiple consecutive open-ended wildcards (e.g. .*.*)
   if (/(\.\*|\.\+){2,}/.test(pattern)) return true
+  // Check for quantified alternation groups like (a|aa)+, (a|b)+, (a|b)*, (a|aa){2,}
+  let simplified = pattern
+  while (/\(\(([^()]+)\)\)/.test(simplified)) {
+    simplified = simplified.replace(/\(\(([^()]+)\)\)/g, '($1)')
+  }
+  if (/\((?:[^()]*\|)+[^()]*\)\s*([+*]|\{[0-9]+,[0-9]*\})/.test(simplified)) return true
   return false
 }
 

package/lib/reporting.js

@@ -1,3 +1,4 @@
+import { sanitizeSecretString } from './credentials.js'
 import { createHash } from 'node:crypto'
 
 export const DEFAULT_NOTIFICATION_LIMIT = 50
@@ -14,10 +15,7 @@ export function notificationLimit(value) {
 }
 
 function safeMessage(value) {
-  return String(value ?? '')
-    .replace(/(api[_-]?key|token|secret|authorization|password)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]')
-    .replace(/([?&](?:key|token|api[_-]?key|access[_-]?token)=)[^&#\s]+/gi, '$1[redacted]')
-    .slice(0, 240)
+  return sanitizeSecretString(value).slice(0, 240)
 }
 
 function stable(value) {

package/lib/synchronizer-helpers.js

@@ -1,3 +1,4 @@
+import { sanitizeSecretString } from './credentials.js'
 import { statusOfError } from './reliability.js'
 import { historyEntry } from './history.js'
 import { normalizeModels } from './models.js'
@@ -89,7 +90,7 @@ export function errorMessage(error) {
 }
 
 export function diagnosticMessage(error) {
-  return errorMessage(error).replace(/(api[_-]?key|token|secret|authorization|password)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]').slice(0, 160)
+  return sanitizeSecretString(errorMessage(error)).slice(0, 160)
 }
 
 export function adapterErrorType(error) {

package/lib/synchronizer.js

@@ -159,12 +159,18 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
       recordCredentialOutcome(row.provider, { status: 'ok', retries })
       if (result && result.notModified) {
         const config = getConfig() ?? {}
-        const cached = normalizeModels(row.provider, config.modelCatalogs?.[row.provider] ?? row.models ?? [])
+        const existing = providerHttpMeta.get(row.provider)
+        if (existing && (result.etag || result.lastModified)) {
+          if (result.etag) existing.etag = result.etag
+          if (result.lastModified) existing.lastModified = result.lastModified
+        }
+        const memoryModels = existing?.models
+        const cached = normalizeModels(row.provider, memoryModels ?? config.modelCatalogs?.[row.provider] ?? row.models ?? [])
         return { provider: row.provider, status: 'ok', models: cached, retries, notModified: true }
       }
       const models = Array.isArray(result) ? result : []
       if (result?.__httpMeta) {
-        providerHttpMeta.set(row.provider, result.__httpMeta)
+        providerHttpMeta.set(row.provider, { ...result.__httpMeta, models })
       }
       return { provider: row.provider, status: 'ok', models, retries }
     } catch (error) {
@@ -332,7 +338,10 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
         const advertised = selectedModels.length
           ? policyModels.filter((model) => selectedModels.includes(model.id))
           : policyModels
-        const explicitRemoveIds = new Set(lifecycle.removedIds)
+        const policyExcludedIds = current
+          .filter((model) => !filterModels([model], policy).length || (selectedModels.length && !selectedModels.includes(model.id)))
+          .map((model) => model.id)
+        const explicitRemoveIds = new Set([...lifecycle.removedIds, ...policyExcludedIds])
         const reconciliation = reconcileModels(row.provider, current, advertised, { removeMissing: false, removeIds: explicitRemoveIds })
         results.push({
           ...discovered,
@@ -562,14 +571,18 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
     notifications: notificationLedger,
     updateNotification: updateNotificationState,
     rollbackHistory,
-    testWebhook: async ({ url, secret }) => {
+    testWebhook: async ({ url, secret, secretRef }) => {
       let resolvedSecret = secret || ''
-      if (typeof secret === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(secret)) {
+      const targetRef = (secretRef || (typeof secret === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(secret) ? secret : '')).trim()
+      if (targetRef) {
         try {
-          const res = await (ctx?.credentials?.resolve ? ctx.credentials.resolve(secret) : ctx?.get?.('credentials')?.resolve?.(secret))
-          if (res) resolvedSecret = typeof res === 'string' ? res : res?.value || resolvedSecret
+          const res = await (ctx?.credentials?.resolve ? ctx.credentials.resolve(targetRef) : ctx?.get?.('credentials')?.resolve?.(targetRef))
+          if (res) resolvedSecret = typeof res === 'string' ? res : res?.value || ''
         } catch (err) {
-          ctx?.logger?.debug?.('[dsh-model-sync] secret ref resolution fallback:', err)
+          ctx?.logger?.warn?.('[dsh-model-sync] secret ref resolution failed in testWebhook:', err)
+        }
+        if (!resolvedSecret && secretRef) {
+          return { ok: false, error: `Failed to resolve webhook secret credential reference '${secretRef}'` }
         }
       }
       return sendWebhookNotification(url, resolvedSecret, { event: 'model-sync.test', timestamp: Date.now(), test: true })

package/lib/updater.js

@@ -20,19 +20,33 @@ function header(request, name) {
   return Array.isArray(value) ? value[0] : value
 }
 
+function isLoopbackIPv4(address) {
+  if (typeof address !== 'string' || !address.startsWith('127.')) return false
+  const parts = address.split('.')
+  if (parts.length !== 4) return false
+  return parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) >= 0 && Number(part) <= 255)
+}
+
 export function isLoopback(value) {
-  const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
-  return (
-    address === 'localhost' ||
-    address === 'localhost.' ||
-    address === '::1' ||
-    address?.startsWith('127.') === true ||
-    address?.startsWith('::ffff:127.') === true
-  )
+  if (typeof value !== 'string') return false
+  const address = value.toLowerCase().replace(/^\[|\]$/g, '')
+  if (address === 'localhost' || address === 'localhost.' || address === '::1') return true
+  if (address.startsWith('::ffff:')) {
+    return isLoopbackIPv4(address.slice('::ffff:'.length))
+  }
+  return isLoopbackIPv4(address)
 }
 
-export function isTrustedUpdateRequest(request) {
+export function isTrustedUpdateRequest(request, targetCtx = null) {
   if (header(request, UPDATE_HEADER) !== '1') return false
+
+  // 1. Core connection rejection check (#237)
+  const conn = targetCtx?.connection || targetCtx?.get?.('connection') || request?.connection
+  if (conn && typeof conn.requestRejection === 'function') {
+    const rejection = conn.requestRejection(request)
+    if (rejection !== undefined) return false
+  }
+
   const remote = request.socket?.remoteAddress
   if (!isLoopback(remote)) return false
   const site = header(request, 'sec-fetch-site')
@@ -295,6 +309,21 @@ export function registerPluginUpdater(ctx, options = {}) {
 
   const handler = async (request, response) => {
     try {
+      // 1. Core connection rejection check on all updater routes (#237)
+      const conn = ctx?.connection || ctx?.get?.('connection') || request?.connection
+      if (conn && typeof conn.requestRejection === 'function') {
+        const rejection = conn.requestRejection(request)
+        if (rejection !== undefined) {
+          const status = typeof rejection === 'number' ? rejection : 401
+          response.writeHead(status, {
+            'content-type': 'application/json; charset=utf-8',
+            'cache-control': 'no-store',
+          })
+          response.end(JSON.stringify({ error: 'unauthorized', code: status }))
+          return
+        }
+      }
+
       const target = runtime()
       if (request.method === 'GET' || request.method === 'HEAD') {
         const isFresh = Boolean(
@@ -317,7 +346,7 @@ export function registerPluginUpdater(ctx, options = {}) {
         response.end()
         return
       }
-      if (!isTrustedUpdateRequest(request)) {
+      if (!isTrustedUpdateRequest(request, ctx)) {
         json(response, 403, { error: 'Rejected non-local or cross-origin update request.' })
         return
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-model-sync",
-  "version": "0.5.8",
+  "version": "0.5.10",
   "description": "Automatic model catalog synchronization for API-key DeepSeek Harness providers.",
   "keywords": [
     "deepseek-harness",