@goodandready/dsh-model-sync 0.5.9 → 0.5.10

package/lib/client.js

@@ -600,6 +600,7 @@ window.__ModuleLoader__.load({
         setBusy(true); setWebhookErr(''); setWebhookMsg('')
         try {
           await scope.set('diffWebhookUrl', webhookDraft.diffWebhookUrl || '')
+          await scope.set('diffWebhookSecretRef', webhookDraft.diffWebhookSecretRef || webhookDraft.diffWebhookSecret || '')
           await scope.set('diffWebhookSecret', webhookDraft.diffWebhookSecret || '')
           await scope.set('notifyOnModelAdded', !!webhookDraft.notifyOnModelAdded)
           await scope.set('notifyOnModelDeprecated', !!webhookDraft.notifyOnModelDeprecated)
@@ -622,6 +623,7 @@ window.__ModuleLoader__.load({
             body: JSON.stringify({
               url: webhookDraft.diffWebhookUrl,
               secret: webhookDraft.diffWebhookSecret || '',
+              secretRef: webhookDraft.diffWebhookSecretRef || webhookDraft.diffWebhookSecret || '',
             }),
           })
           const body = await res.json()

package/lib/credentials.js

@@ -38,9 +38,18 @@ function safeCode(error) {
   return 'credential-error'
 }
 
+export function sanitizeSecretString(value) {
+  if (value === null || value === undefined) return ''
+  return String(value)
+    .replace(/(authorization)\s*[:=]\s*(?:bearer|basic|token)\s+[^\s,;&]+/gi, '$1=[redacted]')
+    .replace(/(api[_-]?key|token|secret|authorization|password)\s*[:=]\s*[^\s,;&]+/gi, '$1=[redacted]')
+    .replace(/\b(bearer\s+)[A-Za-z0-9._~+/-]+=*/gi, '$1[redacted]')
+    .replace(/([?&](?:key|token|api[_-]?key|access[_-]?token|secret)=)[^&#\s]+/gi, '$1[redacted]')
+}
+
 function safeMessage(error) {
   const source = error instanceof Error ? error.message : String(error ?? '')
-  return source.replace(/(api[_-]?key|token|secret|authorization|password)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]').slice(0, 160)
+  return sanitizeSecretString(source).slice(0, 160)
 }
 
 export function createCredentialResolver(ctx) {

package/lib/diff-notifier.js

@@ -104,6 +104,43 @@ export function extractDiffEvents(results, options = {}) {
   }
 }
 
+export function isLoopbackIPv4(address) {
+  if (typeof address !== 'string' || !address.startsWith('127.')) return false
+  const parts = address.split('.')
+  if (parts.length !== 4) return false
+  return parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) >= 0 && Number(part) <= 255)
+}
+
+export function isForbiddenWebhookHost(rawHostname) {
+  const host = String(rawHostname || '').toLowerCase().replace(/^\[|\]$/g, '')
+  if (host === '169.254.169.254' || host.startsWith('169.254.')) return true
+  if (host.startsWith('::ffff:')) {
+    const v4 = host.slice('::ffff:'.length)
+    if (v4.startsWith('169.254.') || v4.startsWith('a9fe:')) return true
+    if (v4 === '100.100.100.200' || v4 === '6464:64c8') return true
+  }
+  if (host.startsWith('fe80:') || host.startsWith('fe80::')) return true
+  if (host === '100.100.100.200') return true
+  if (host === '0.0.0.0' || host === '255.255.255.255' || host === '::' || host === '0:0:0:0:0:0:0:0') return true
+  if (
+    host === 'metadata.google.internal' ||
+    host === 'instance-data' ||
+    host === 'metadata' ||
+    host.endsWith('.metadata.google.internal') ||
+    host.endsWith('.metadata')
+  ) return true
+  return false
+}
+
+export function isLoopbackHost(rawHostname) {
+  const host = String(rawHostname || '').toLowerCase().replace(/^\[|\]$/g, '')
+  if (host === '127.0.0.1' || host === 'localhost' || host === 'localhost.' || host === '::1') return true
+  if (host.startsWith('::ffff:')) {
+    return isLoopbackIPv4(host.slice('::ffff:'.length))
+  }
+  return isLoopbackIPv4(host)
+}
+
 export async function sendWebhookNotification(url, secret, payload, { fetchImpl = globalThis.fetch, timeoutMs = 5000 } = {}) {
   if (typeof url !== "string" || !url.trim()) {
     return { ok: false, error: "URL is required" }
@@ -115,16 +152,10 @@ export async function sendWebhookNotification(url, secret, payload, { fetchImpl
       return { ok: false, error: "URL must use http or https protocol" }
     }
     const hostname = parsedUrl.hostname.toLowerCase().replace(/^\[|\]$/g, '')
-    if (
-      hostname === '169.254.169.254' ||
-      hostname.startsWith('169.254.') ||
-      hostname === 'metadata.google.internal' ||
-      hostname === '0.0.0.0' ||
-      hostname === '255.255.255.255'
-    ) {
+    if (isForbiddenWebhookHost(hostname)) {
       return { ok: false, error: "webhook url targets a forbidden metadata or link-local address" }
     }
-    const isLoopback = hostname === '127.0.0.1' || hostname === 'localhost' || hostname === '::1' || hostname.startsWith('127.') || hostname.startsWith('::ffff:127.')
+    const isLoopback = isLoopbackHost(hostname)
     if (parsedUrl.protocol === "http:" && !isLoopback) {
       return { ok: false, error: "insecure http webhook url is only permitted on loopback" }
     }
@@ -195,17 +226,37 @@ export async function dispatchDiffNotifications(ctx, config, results, { fetchImp
 
   let webhookResult = null
   if (config?.diffWebhookUrl && typeof config.diffWebhookUrl === "string" && config.diffWebhookUrl.trim()) {
-    let secret = config.diffWebhookSecret || ''
-    const secretRef = config.diffWebhookSecretRef || (typeof config.diffWebhookSecret === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(config.diffWebhookSecret) ? config.diffWebhookSecret : '')
+    let secret = ''
+    const secretRef = (config.diffWebhookSecretRef || '').trim()
     if (secretRef) {
+      let resolvedSecret = ''
       try {
-        const res = await (ctx?.credentials?.resolve ? ctx.credentials.resolve(secretRef) : ctx?.get?.('credentials')?.resolve?.(secretRef))
-        if (res) secret = typeof res === 'string' ? res : res?.value || secret
+        const creds = ctx?.credentials || ctx?.get?.('credentials')
+        if (creds?.resolve) {
+          const res = await creds.resolve(secretRef)
+          resolvedSecret = typeof res === 'string' ? res : res?.value || ''
+        }
       } catch (err) {
-        if (typeof ctx?.logger?.debug === 'function') {
-          ctx.logger.debug('[dsh-model-sync] webhook secret resolution fallback:', err)
+        if (typeof ctx?.logger?.warn === 'function') {
+          ctx.logger.warn('[dsh-model-sync] webhook secret resolution failed:', err)
+        }
+      }
+      if (!resolvedSecret) {
+        // FAIL-CLOSED: do not dispatch unsigned webhook when secret was expected (#204)
+        if (typeof ctx?.logger?.warn === 'function') {
+          ctx.logger.warn(`[dsh-model-sync] webhook secret resolution failed for '${secretRef}', skipping webhook dispatch (fail-closed)`)
+        }
+        return {
+          ok: false,
+          error: 'credential_resolution_failed',
+          message: `Failed to resolve webhook secret credential reference '${secretRef}'`,
+          events,
+          dispatched: false,
         }
       }
+      secret = resolvedSecret
+    } else if (config.diffWebhookSecret) {
+      secret = String(config.diffWebhookSecret).trim()
     }
     webhookResult = await sendWebhookNotification(
       config.diffWebhookUrl,

package/lib/history.js

@@ -1,3 +1,4 @@
+import { sanitizeSecretString } from './credentials.js'
 import { normalizeModels } from './models.js'
 
 export const DEFAULT_HISTORY_LIMIT = 50
@@ -41,7 +42,7 @@ function catalog(provider, models) {
 
 function message(value) {
   if (value === undefined || value === null) return undefined
-  return String(value).replace(/(api[_-]?key|token|secret|authorization|password)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]').slice(0, MAX_MESSAGE_LENGTH)
+  return sanitizeSecretString(value).slice(0, MAX_MESSAGE_LENGTH)
 }
 
 function diffFor(provider, diff) {

package/lib/http.js

@@ -1,3 +1,4 @@
+import { isForbiddenWebhookHost, isLoopbackHost } from './diff-notifier.js'
 import crypto from 'node:crypto'
 import { validateAliasName } from './alias-resolver.js'
 import { validatePolicy } from './policy.js'
@@ -15,22 +16,17 @@ function normalizeWebhookTestRequest(body) {
     throw Object.assign(new Error("URL must use http or https protocol"), { code: "INVALID_REQUEST" })
   }
   const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '')
-  const isLoopback = hostname === '127.0.0.1' || hostname === 'localhost' || hostname === '::1' || hostname.startsWith('127.') || hostname.startsWith('::ffff:127.')
+  if (isForbiddenWebhookHost(hostname)) {
+    throw Object.assign(new Error("webhook url targets a forbidden metadata or link-local address"), { code: "INVALID_REQUEST" })
+  }
+  const isLoopback = isLoopbackHost(hostname)
   if (parsed.protocol === "http:" && !isLoopback) {
     throw Object.assign(new Error("insecure http webhook url is only permitted on loopback"), { code: "INVALID_REQUEST" })
   }
-  if (
-    hostname === '169.254.169.254' ||
-    hostname.startsWith('169.254.') ||
-    hostname === 'metadata.google.internal' ||
-    hostname === '0.0.0.0' ||
-    hostname === '255.255.255.255'
-  ) {
-    throw Object.assign(new Error("webhook url targets a forbidden metadata or link-local address"), { code: "INVALID_REQUEST" })
-  }
   return {
     url: parsed.toString(),
     secret: typeof body.secret === "string" ? body.secret.trim() : "",
+    ...(body.secretRef && typeof body.secretRef === "string" ? { secretRef: body.secretRef.trim() } : {}),
   }
 }
 
@@ -42,14 +38,17 @@ function json(res, status, body) {
 }
 
 export function isLoopbackAddress(ip) {
-  if (!ip || typeof ip !== 'string') return false
-  const clean = ip.toLowerCase().replace(/^\[|\]$/g, '')
-  if (clean === '127.0.0.1' || clean === '::1' || clean === '::ffff:127.0.0.1' || clean === 'localhost') return true
-  if (clean.startsWith('127.') || clean.startsWith('::ffff:127.')) return true
-  return false
+  return isLoopbackHost(ip)
 }
 
-export function trusted(req, { requireLoopback = false } = {}) {
+export function trusted(req, { requireLoopback = false, ctx = null } = {}) {
+  // 1. Core connection rejection check (#237)
+  const conn = ctx?.connection || ctx?.get?.('connection') || req?.connection
+  if (conn && typeof conn.requestRejection === 'function') {
+    const rejection = conn.requestRejection(req)
+    if (rejection !== undefined) return false
+  }
+
   const remoteAddress = req?.socket?.remoteAddress
   if (requireLoopback || req?.method === 'POST') {
     if (remoteAddress && !isLoopbackAddress(remoteAddress)) return false
@@ -66,7 +65,7 @@ export function trusted(req, { requireLoopback = false } = {}) {
       const url = new URL(origin)
       if (url.host !== host) return false
       if (requireLoopback || req?.method === 'POST') {
-        if (!isLoopbackAddress(url.hostname) && url.hostname !== 'localhost') return false
+        if (!isLoopbackAddress(url.hostname)) return false
       }
     } catch { return false }
   }
@@ -77,7 +76,7 @@ export function trusted(req, { requireLoopback = false } = {}) {
       const url = new URL(referer)
       if (url.host !== host) return false
       if (requireLoopback || req?.method === 'POST') {
-        if (!isLoopbackAddress(url.hostname) && url.hostname !== 'localhost') return false
+        if (!isLoopbackAddress(url.hostname)) return false
       }
     } catch { return false }
   }
@@ -273,8 +272,18 @@ export function registerHttpApi(ctx, synchronizer, { getSchedulerStatus = () =>
     return []
   }
   const makeHandler = (route) => async (req, res) => {
+    // 1. Core connection check on all routes (#237)
+    const conn = ctx?.connection || ctx?.get?.('connection') || req?.connection
+    if (conn && typeof conn.requestRejection === 'function') {
+      const rejection = conn.requestRejection(req)
+      if (rejection !== undefined) {
+        const statusCode = typeof rejection === 'number' ? rejection : 401
+        return json(res, statusCode, { error: { code: 'unauthorized', message: 'dsh-model-sync: core connection rejected request' } })
+      }
+    }
+
     const isPublicStatus = route === 'status' && req.method === 'GET'
-    if (!trusted(req, { requireLoopback: !isPublicStatus })) return json(res, 403, { error: { code: 'forbidden', message: 'dsh-model-sync: cross-origin or non-loopback request rejected' } })
+    if (!trusted(req, { requireLoopback: !isPublicStatus, ctx })) return json(res, 403, { error: { code: 'forbidden', message: 'dsh-model-sync: cross-origin or non-loopback request rejected' } })
     if (route === 'status') {
       if (req.method !== 'GET') return json(res, 405, { error: { code: 'method', message: 'GET only' } })
       const payload = { ...synchronizer.status(), scheduler: getSchedulerStatus(), providers: synchronizer.listProviders() }

package/lib/policy.js

@@ -41,6 +41,12 @@ function isDangerousPattern(pattern) {
   if (/\([^\)]*([+*]|\{[0-9]+,[0-9]*\})[^\)]*\)([+*]|\{[0-9]+,[0-9]*\})/.test(pattern)) return true
   // Check for multiple consecutive open-ended wildcards (e.g. .*.*)
   if (/(\.\*|\.\+){2,}/.test(pattern)) return true
+  // Check for quantified alternation groups like (a|aa)+, (a|b)+, (a|b)*, (a|aa){2,}
+  let simplified = pattern
+  while (/\(\(([^()]+)\)\)/.test(simplified)) {
+    simplified = simplified.replace(/\(\(([^()]+)\)\)/g, '($1)')
+  }
+  if (/\((?:[^()]*\|)+[^()]*\)\s*([+*]|\{[0-9]+,[0-9]*\})/.test(simplified)) return true
   return false
 }
 

package/lib/reporting.js

@@ -1,3 +1,4 @@
+import { sanitizeSecretString } from './credentials.js'
 import { createHash } from 'node:crypto'
 
 export const DEFAULT_NOTIFICATION_LIMIT = 50
@@ -14,10 +15,7 @@ export function notificationLimit(value) {
 }
 
 function safeMessage(value) {
-  return String(value ?? '')
-    .replace(/(api[_-]?key|token|secret|authorization|password)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]')
-    .replace(/([?&](?:key|token|api[_-]?key|access[_-]?token)=)[^&#\s]+/gi, '$1[redacted]')
-    .slice(0, 240)
+  return sanitizeSecretString(value).slice(0, 240)
 }
 
 function stable(value) {

package/lib/synchronizer-helpers.js

@@ -1,3 +1,4 @@
+import { sanitizeSecretString } from './credentials.js'
 import { statusOfError } from './reliability.js'
 import { historyEntry } from './history.js'
 import { normalizeModels } from './models.js'
@@ -89,7 +90,7 @@ export function errorMessage(error) {
 }
 
 export function diagnosticMessage(error) {
-  return errorMessage(error).replace(/(api[_-]?key|token|secret|authorization|password)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]').slice(0, 160)
+  return sanitizeSecretString(errorMessage(error)).slice(0, 160)
 }
 
 export function adapterErrorType(error) {

package/lib/synchronizer.js

@@ -571,14 +571,18 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
     notifications: notificationLedger,
     updateNotification: updateNotificationState,
     rollbackHistory,
-    testWebhook: async ({ url, secret }) => {
+    testWebhook: async ({ url, secret, secretRef }) => {
       let resolvedSecret = secret || ''
-      if (typeof secret === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(secret)) {
+      const targetRef = (secretRef || (typeof secret === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(secret) ? secret : '')).trim()
+      if (targetRef) {
         try {
-          const res = await (ctx?.credentials?.resolve ? ctx.credentials.resolve(secret) : ctx?.get?.('credentials')?.resolve?.(secret))
-          if (res) resolvedSecret = typeof res === 'string' ? res : res?.value || resolvedSecret
+          const res = await (ctx?.credentials?.resolve ? ctx.credentials.resolve(targetRef) : ctx?.get?.('credentials')?.resolve?.(targetRef))
+          if (res) resolvedSecret = typeof res === 'string' ? res : res?.value || ''
         } catch (err) {
-          ctx?.logger?.debug?.('[dsh-model-sync] secret ref resolution fallback:', err)
+          ctx?.logger?.warn?.('[dsh-model-sync] secret ref resolution failed in testWebhook:', err)
+        }
+        if (!resolvedSecret && secretRef) {
+          return { ok: false, error: `Failed to resolve webhook secret credential reference '${secretRef}'` }
         }
       }
       return sendWebhookNotification(url, resolvedSecret, { event: 'model-sync.test', timestamp: Date.now(), test: true })

package/lib/updater.js

@@ -20,19 +20,33 @@ function header(request, name) {
   return Array.isArray(value) ? value[0] : value
 }
 
+function isLoopbackIPv4(address) {
+  if (typeof address !== 'string' || !address.startsWith('127.')) return false
+  const parts = address.split('.')
+  if (parts.length !== 4) return false
+  return parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) >= 0 && Number(part) <= 255)
+}
+
 export function isLoopback(value) {
-  const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
-  return (
-    address === 'localhost' ||
-    address === 'localhost.' ||
-    address === '::1' ||
-    address?.startsWith('127.') === true ||
-    address?.startsWith('::ffff:127.') === true
-  )
+  if (typeof value !== 'string') return false
+  const address = value.toLowerCase().replace(/^\[|\]$/g, '')
+  if (address === 'localhost' || address === 'localhost.' || address === '::1') return true
+  if (address.startsWith('::ffff:')) {
+    return isLoopbackIPv4(address.slice('::ffff:'.length))
+  }
+  return isLoopbackIPv4(address)
 }
 
-export function isTrustedUpdateRequest(request) {
+export function isTrustedUpdateRequest(request, targetCtx = null) {
   if (header(request, UPDATE_HEADER) !== '1') return false
+
+  // 1. Core connection rejection check (#237)
+  const conn = targetCtx?.connection || targetCtx?.get?.('connection') || request?.connection
+  if (conn && typeof conn.requestRejection === 'function') {
+    const rejection = conn.requestRejection(request)
+    if (rejection !== undefined) return false
+  }
+
   const remote = request.socket?.remoteAddress
   if (!isLoopback(remote)) return false
   const site = header(request, 'sec-fetch-site')
@@ -295,6 +309,21 @@ export function registerPluginUpdater(ctx, options = {}) {
 
   const handler = async (request, response) => {
     try {
+      // 1. Core connection rejection check on all updater routes (#237)
+      const conn = ctx?.connection || ctx?.get?.('connection') || request?.connection
+      if (conn && typeof conn.requestRejection === 'function') {
+        const rejection = conn.requestRejection(request)
+        if (rejection !== undefined) {
+          const status = typeof rejection === 'number' ? rejection : 401
+          response.writeHead(status, {
+            'content-type': 'application/json; charset=utf-8',
+            'cache-control': 'no-store',
+          })
+          response.end(JSON.stringify({ error: 'unauthorized', code: status }))
+          return
+        }
+      }
+
       const target = runtime()
       if (request.method === 'GET' || request.method === 'HEAD') {
         const isFresh = Boolean(
@@ -317,7 +346,7 @@ export function registerPluginUpdater(ctx, options = {}) {
         response.end()
         return
       }
-      if (!isTrustedUpdateRequest(request)) {
+      if (!isTrustedUpdateRequest(request, ctx)) {
         json(response, 403, { error: 'Rejected non-local or cross-origin update request.' })
         return
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-model-sync",
-  "version": "0.5.9",
+  "version": "0.5.10",
   "description": "Automatic model catalog synchronization for API-key DeepSeek Harness providers.",
   "keywords": [
     "deepseek-harness",