@goodandready/dsh-model-sync 0.5.9 → 0.5.11

package/lib/adapter-registry.js

@@ -219,6 +219,9 @@ async function requestSpecific(profile, descriptor, { resolveCredential, fetchIm
   }
   if (response.status === 304) return response
   if (!response.ok) {
+    if (typeof response.body?.cancel === "function") {
+      try { await response.body.cancel() } catch (_err) { /* best-effort cancel */ }
+    }
     const error = catalogRequestError(response.status, response)
     error.adapterCode = [401, 403].includes(response.status) ? 'auth' : response.status === 429 ? 'rate-limit' : 'http'
     throw error
@@ -231,6 +234,9 @@ async function fetchSpecific(profile, descriptor, options) {
   try {
     const response = await requestSpecific(profile, descriptor, options)
     if (response.status === 304) {
+      if (typeof response.body?.cancel === "function") {
+        try { await response.body.cancel() } catch (_err) { /* best-effort cancel */ }
+      }
       return { notModified: true, etag: response.headers?.get?.('etag') || options.etag, lastModified: response.headers?.get?.('last-modified') || options.lastModified }
     }
     const respEtag = response.headers?.get?.('etag') || undefined

package/lib/alias-resolver.js

@@ -53,6 +53,16 @@ function estimateLatency(provider, model, probes = {}) {
   return Math.round(base)
 }
 
+function isProviderEligible(provider, { healthResults = [], isCircuitOpen = () => false } = {}) {
+  if (isCircuitOpen(provider)) return false
+  const health = healthResults.find((h) => h.provider === provider)
+  if (health) {
+    if (health.ok === false) return false
+    if (health.status && health.status !== "ok") return false
+  }
+  return true
+}
+
 export function resolveAlias(aliasName, {
   aliases = {},
   modelCatalogs = {},
@@ -72,7 +82,8 @@ export function resolveAlias(aliasName, {
     for (let i = 0; i < custom.targets.length; i++) {
       const target = custom.targets[i]
       const circuitBlocked = isCircuitOpen(target.provider)
-      const healthFail = healthResults.find((h) => h.provider === target.provider && h.status === 'error')
+      const healthEntry = healthResults.find((h) => h.provider === target.provider)
+      const healthFail = Boolean(healthEntry && (healthEntry.status === "error" || healthEntry.status === "circuit-open" || healthEntry.ok === false || (healthEntry.status && healthEntry.status !== "ok")))
       if (circuitBlocked || healthFail) {
         skipped.push({ ...target, reason: circuitBlocked ? 'circuit_open' : 'health_failed' })
         continue
@@ -101,12 +112,15 @@ export function resolveAlias(aliasName, {
   // 2. Static explicit alias
   if (custom?.provider && custom?.model && !custom.strategy) {
     const circuitBlocked = isCircuitOpen(custom.provider)
+    const healthEntry = healthResults.find((h) => h.provider === custom.provider)
+    const healthFailed = Boolean(healthEntry && (healthEntry.status === "error" || healthEntry.status === "circuit-open" || healthEntry.ok === false || (healthEntry.status && healthEntry.status !== "ok")))
     return {
       alias: clean,
       provider: custom.provider,
       model: custom.model,
       fallbackUsed: false,
       ...(circuitBlocked ? { warning: 'circuit_open', circuitOpen: true } : {}),
+      ...(healthFailed ? { warning: 'health_failed', healthFailed: true } : {}),
     }
   }
 
@@ -125,7 +139,7 @@ export function resolveAlias(aliasName, {
     }
     const available = []
     for (const [provider, models] of Object.entries(modelCatalogs)) {
-      if (isCircuitOpen(provider)) continue
+      if (!isProviderEligible(provider, { healthResults, isCircuitOpen })) continue
       if (!Array.isArray(models)) continue
       for (const m of models) {
         if (!m?.id) continue

package/lib/client.js

@@ -600,6 +600,7 @@ window.__ModuleLoader__.load({
         setBusy(true); setWebhookErr(''); setWebhookMsg('')
         try {
           await scope.set('diffWebhookUrl', webhookDraft.diffWebhookUrl || '')
+          await scope.set('diffWebhookSecretRef', webhookDraft.diffWebhookSecretRef || webhookDraft.diffWebhookSecret || '')
           await scope.set('diffWebhookSecret', webhookDraft.diffWebhookSecret || '')
           await scope.set('notifyOnModelAdded', !!webhookDraft.notifyOnModelAdded)
           await scope.set('notifyOnModelDeprecated', !!webhookDraft.notifyOnModelDeprecated)
@@ -622,6 +623,7 @@ window.__ModuleLoader__.load({
             body: JSON.stringify({
               url: webhookDraft.diffWebhookUrl,
               secret: webhookDraft.diffWebhookSecret || '',
+              secretRef: webhookDraft.diffWebhookSecretRef || webhookDraft.diffWebhookSecret || '',
             }),
           })
           const body = await res.json()

package/lib/credentials.js

@@ -38,9 +38,18 @@ function safeCode(error) {
   return 'credential-error'
 }
 
+export function sanitizeSecretString(value) {
+  if (value === null || value === undefined) return ''
+  return String(value)
+    .replace(/(authorization)\s*[:=]\s*(?:bearer|basic|token)\s+[^\s,;&]+/gi, '$1=[redacted]')
+    .replace(/(api[_-]?key|token|secret|authorization|password)\s*[:=]\s*[^\s,;&]+/gi, '$1=[redacted]')
+    .replace(/\b(bearer\s+)[A-Za-z0-9._~+/-]+=*/gi, '$1[redacted]')
+    .replace(/([?&](?:key|token|api[_-]?key|access[_-]?token|secret)=)[^&#\s]+/gi, '$1[redacted]')
+}
+
 function safeMessage(error) {
   const source = error instanceof Error ? error.message : String(error ?? '')
-  return source.replace(/(api[_-]?key|token|secret|authorization|password)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]').slice(0, 160)
+  return sanitizeSecretString(source).slice(0, 160)
 }
 
 export function createCredentialResolver(ctx) {

package/lib/diff-notifier.js

@@ -104,6 +104,43 @@ export function extractDiffEvents(results, options = {}) {
   }
 }
 
+export function isLoopbackIPv4(address) {
+  if (typeof address !== 'string' || !address.startsWith('127.')) return false
+  const parts = address.split('.')
+  if (parts.length !== 4) return false
+  return parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) >= 0 && Number(part) <= 255)
+}
+
+export function isForbiddenWebhookHost(rawHostname) {
+  const host = String(rawHostname || '').toLowerCase().replace(/^\[|\]$/g, '')
+  if (host === '169.254.169.254' || host.startsWith('169.254.')) return true
+  if (host.startsWith('::ffff:')) {
+    const v4 = host.slice('::ffff:'.length)
+    if (v4.startsWith('169.254.') || v4.startsWith('a9fe:')) return true
+    if (v4 === '100.100.100.200' || v4 === '6464:64c8') return true
+  }
+  if (host.startsWith('fe80:') || host.startsWith('fe80::')) return true
+  if (host === '100.100.100.200') return true
+  if (host === '0.0.0.0' || host === '255.255.255.255' || host === '::' || host === '0:0:0:0:0:0:0:0') return true
+  if (
+    host === 'metadata.google.internal' ||
+    host === 'instance-data' ||
+    host === 'metadata' ||
+    host.endsWith('.metadata.google.internal') ||
+    host.endsWith('.metadata')
+  ) return true
+  return false
+}
+
+export function isLoopbackHost(rawHostname) {
+  const host = String(rawHostname || '').toLowerCase().replace(/^\[|\]$/g, '')
+  if (host === '127.0.0.1' || host === 'localhost' || host === 'localhost.' || host === '::1') return true
+  if (host.startsWith('::ffff:')) {
+    return isLoopbackIPv4(host.slice('::ffff:'.length))
+  }
+  return isLoopbackIPv4(host)
+}
+
 export async function sendWebhookNotification(url, secret, payload, { fetchImpl = globalThis.fetch, timeoutMs = 5000 } = {}) {
   if (typeof url !== "string" || !url.trim()) {
     return { ok: false, error: "URL is required" }
@@ -115,16 +152,10 @@ export async function sendWebhookNotification(url, secret, payload, { fetchImpl
       return { ok: false, error: "URL must use http or https protocol" }
     }
     const hostname = parsedUrl.hostname.toLowerCase().replace(/^\[|\]$/g, '')
-    if (
-      hostname === '169.254.169.254' ||
-      hostname.startsWith('169.254.') ||
-      hostname === 'metadata.google.internal' ||
-      hostname === '0.0.0.0' ||
-      hostname === '255.255.255.255'
-    ) {
+    if (isForbiddenWebhookHost(hostname)) {
       return { ok: false, error: "webhook url targets a forbidden metadata or link-local address" }
     }
-    const isLoopback = hostname === '127.0.0.1' || hostname === 'localhost' || hostname === '::1' || hostname.startsWith('127.') || hostname.startsWith('::ffff:127.')
+    const isLoopback = isLoopbackHost(hostname)
     if (parsedUrl.protocol === "http:" && !isLoopback) {
       return { ok: false, error: "insecure http webhook url is only permitted on loopback" }
     }
@@ -146,18 +177,29 @@ export async function sendWebhookNotification(url, secret, payload, { fetchImpl
   const controller = typeof AbortController !== "undefined" ? new AbortController() : null
   const timer = controller ? setTimeout(() => controller.abort(new Error("Webhook request timed out")), timeoutMs) : null
 
+  let res = null
   try {
-    const res = await fetchImpl(parsedUrl.toString(), {
+    res = await fetchImpl(parsedUrl.toString(), {
       method: "POST",
       headers,
       body,
       ...(controller ? { signal: controller.signal } : {}),
     })
+    if (typeof res?.body?.cancel === "function") {
+      try { await res.body.cancel() } catch (_err) { /* best-effort cancel */ }
+    } else if (typeof res?.arrayBuffer === "function") {
+      try { await res.arrayBuffer() } catch (_err) { /* best-effort cancel */ }
+    }
     if (timer) clearTimeout(timer)
     return { ok: res.ok, status: res.status }
   } catch (err) {
+    if (res && typeof res.body?.cancel === "function") {
+      try { await res.body.cancel() } catch (_err) { /* best-effort cancel */ }
+    }
     if (timer) clearTimeout(timer)
     return { ok: false, error: err?.message || String(err) }
+  } finally {
+    if (timer) clearTimeout(timer)
   }
 }
 
@@ -195,17 +237,37 @@ export async function dispatchDiffNotifications(ctx, config, results, { fetchImp
 
   let webhookResult = null
   if (config?.diffWebhookUrl && typeof config.diffWebhookUrl === "string" && config.diffWebhookUrl.trim()) {
-    let secret = config.diffWebhookSecret || ''
-    const secretRef = config.diffWebhookSecretRef || (typeof config.diffWebhookSecret === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(config.diffWebhookSecret) ? config.diffWebhookSecret : '')
+    let secret = ''
+    const secretRef = (config.diffWebhookSecretRef || '').trim()
     if (secretRef) {
+      let resolvedSecret = ''
       try {
-        const res = await (ctx?.credentials?.resolve ? ctx.credentials.resolve(secretRef) : ctx?.get?.('credentials')?.resolve?.(secretRef))
-        if (res) secret = typeof res === 'string' ? res : res?.value || secret
+        const creds = ctx?.credentials || ctx?.get?.('credentials')
+        if (creds?.resolve) {
+          const res = await creds.resolve(secretRef)
+          resolvedSecret = typeof res === 'string' ? res : res?.value || ''
+        }
       } catch (err) {
-        if (typeof ctx?.logger?.debug === 'function') {
-          ctx.logger.debug('[dsh-model-sync] webhook secret resolution fallback:', err)
+        if (typeof ctx?.logger?.warn === 'function') {
+          ctx.logger.warn('[dsh-model-sync] webhook secret resolution failed:', err)
+        }
+      }
+      if (!resolvedSecret) {
+        // FAIL-CLOSED: do not dispatch unsigned webhook when secret was expected (#204)
+        if (typeof ctx?.logger?.warn === 'function') {
+          ctx.logger.warn(`[dsh-model-sync] webhook secret resolution failed for '${secretRef}', skipping webhook dispatch (fail-closed)`)
+        }
+        return {
+          ok: false,
+          error: 'credential_resolution_failed',
+          message: `Failed to resolve webhook secret credential reference '${secretRef}'`,
+          events,
+          dispatched: false,
         }
       }
+      secret = resolvedSecret
+    } else if (config.diffWebhookSecret) {
+      secret = String(config.diffWebhookSecret).trim()
     }
     webhookResult = await sendWebhookNotification(
       config.diffWebhookUrl,

package/lib/generic-adapter.js

@@ -109,7 +109,12 @@ async function resolveGenericRequest(profile, { resolveCredential, fetchImpl, si
   const apiKey = keyRef ? await resolveCredential(keyRef) : ''
   const response = await fetchImpl(endpointFor(profile.baseURL), { headers: requestHeaders(apiKey, etag, lastModified), signal })
   if (response.status === 304) return response
-  if (!response.ok) throw catalogRequestError(response.status, response)
+  if (!response.ok) {
+    if (typeof response.body?.cancel === "function") {
+      try { await response.body.cancel() } catch (_err) { /* best-effort cancel */ } 
+    }
+    throw catalogRequestError(response.status, response)
+  }
   return response
 }
 
@@ -125,6 +130,9 @@ export async function discoverOpenAIModels(profile, {
   }
   const response = await resolveGenericRequest(profile, { resolveCredential, fetchImpl, signal, etag, lastModified })
   if (response.status === 304) {
+    if (typeof response.body?.cancel === "function") {
+      try { await response.body.cancel() } catch (_err) { /* best-effort cancel */ }
+    }
     return { notModified: true, etag: response.headers?.get?.('etag') || etag, lastModified: response.headers?.get?.('last-modified') || lastModified }
   }
   const respEtag = response.headers?.get?.('etag') || undefined

package/lib/history.js

@@ -1,3 +1,4 @@
+import { sanitizeSecretString } from './credentials.js'
 import { normalizeModels } from './models.js'
 
 export const DEFAULT_HISTORY_LIMIT = 50
@@ -41,7 +42,7 @@ function catalog(provider, models) {
 
 function message(value) {
   if (value === undefined || value === null) return undefined
-  return String(value).replace(/(api[_-]?key|token|secret|authorization|password)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]').slice(0, MAX_MESSAGE_LENGTH)
+  return sanitizeSecretString(value).slice(0, MAX_MESSAGE_LENGTH)
 }
 
 function diffFor(provider, diff) {

package/lib/http.js

@@ -1,3 +1,4 @@
+import { isForbiddenWebhookHost, isLoopbackHost } from './diff-notifier.js'
 import crypto from 'node:crypto'
 import { validateAliasName } from './alias-resolver.js'
 import { validatePolicy } from './policy.js'
@@ -15,22 +16,17 @@ function normalizeWebhookTestRequest(body) {
     throw Object.assign(new Error("URL must use http or https protocol"), { code: "INVALID_REQUEST" })
   }
   const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '')
-  const isLoopback = hostname === '127.0.0.1' || hostname === 'localhost' || hostname === '::1' || hostname.startsWith('127.') || hostname.startsWith('::ffff:127.')
+  if (isForbiddenWebhookHost(hostname)) {
+    throw Object.assign(new Error("webhook url targets a forbidden metadata or link-local address"), { code: "INVALID_REQUEST" })
+  }
+  const isLoopback = isLoopbackHost(hostname)
   if (parsed.protocol === "http:" && !isLoopback) {
     throw Object.assign(new Error("insecure http webhook url is only permitted on loopback"), { code: "INVALID_REQUEST" })
   }
-  if (
-    hostname === '169.254.169.254' ||
-    hostname.startsWith('169.254.') ||
-    hostname === 'metadata.google.internal' ||
-    hostname === '0.0.0.0' ||
-    hostname === '255.255.255.255'
-  ) {
-    throw Object.assign(new Error("webhook url targets a forbidden metadata or link-local address"), { code: "INVALID_REQUEST" })
-  }
   return {
     url: parsed.toString(),
     secret: typeof body.secret === "string" ? body.secret.trim() : "",
+    ...(body.secretRef && typeof body.secretRef === "string" ? { secretRef: body.secretRef.trim() } : {}),
   }
 }
 
@@ -42,14 +38,17 @@ function json(res, status, body) {
 }
 
 export function isLoopbackAddress(ip) {
-  if (!ip || typeof ip !== 'string') return false
-  const clean = ip.toLowerCase().replace(/^\[|\]$/g, '')
-  if (clean === '127.0.0.1' || clean === '::1' || clean === '::ffff:127.0.0.1' || clean === 'localhost') return true
-  if (clean.startsWith('127.') || clean.startsWith('::ffff:127.')) return true
-  return false
+  return isLoopbackHost(ip)
 }
 
-export function trusted(req, { requireLoopback = false } = {}) {
+export function trusted(req, { requireLoopback = false, ctx = null } = {}) {
+  // 1. Core connection rejection check (#237)
+  const conn = ctx?.connection || ctx?.get?.('connection') || req?.connection
+  if (conn && typeof conn.requestRejection === 'function') {
+    const rejection = conn.requestRejection(req)
+    if (rejection !== undefined) return false
+  }
+
   const remoteAddress = req?.socket?.remoteAddress
   if (requireLoopback || req?.method === 'POST') {
     if (remoteAddress && !isLoopbackAddress(remoteAddress)) return false
@@ -66,7 +65,7 @@ export function trusted(req, { requireLoopback = false } = {}) {
       const url = new URL(origin)
       if (url.host !== host) return false
       if (requireLoopback || req?.method === 'POST') {
-        if (!isLoopbackAddress(url.hostname) && url.hostname !== 'localhost') return false
+        if (!isLoopbackAddress(url.hostname)) return false
       }
     } catch { return false }
   }
@@ -77,7 +76,7 @@ export function trusted(req, { requireLoopback = false } = {}) {
       const url = new URL(referer)
       if (url.host !== host) return false
       if (requireLoopback || req?.method === 'POST') {
-        if (!isLoopbackAddress(url.hostname) && url.hostname !== 'localhost') return false
+        if (!isLoopbackAddress(url.hostname)) return false
       }
     } catch { return false }
   }
@@ -273,8 +272,18 @@ export function registerHttpApi(ctx, synchronizer, { getSchedulerStatus = () =>
     return []
   }
   const makeHandler = (route) => async (req, res) => {
+    // 1. Core connection check on all routes (#237)
+    const conn = ctx?.connection || ctx?.get?.('connection') || req?.connection
+    if (conn && typeof conn.requestRejection === 'function') {
+      const rejection = conn.requestRejection(req)
+      if (rejection !== undefined) {
+        const statusCode = typeof rejection === 'number' ? rejection : 401
+        return json(res, statusCode, { error: { code: 'unauthorized', message: 'dsh-model-sync: core connection rejected request' } })
+      }
+    }
+
     const isPublicStatus = route === 'status' && req.method === 'GET'
-    if (!trusted(req, { requireLoopback: !isPublicStatus })) return json(res, 403, { error: { code: 'forbidden', message: 'dsh-model-sync: cross-origin or non-loopback request rejected' } })
+    if (!trusted(req, { requireLoopback: !isPublicStatus, ctx })) return json(res, 403, { error: { code: 'forbidden', message: 'dsh-model-sync: cross-origin or non-loopback request rejected' } })
     if (route === 'status') {
       if (req.method !== 'GET') return json(res, 405, { error: { code: 'method', message: 'GET only' } })
       const payload = { ...synchronizer.status(), scheduler: getSchedulerStatus(), providers: synchronizer.listProviders() }

package/lib/inventory.js

@@ -66,17 +66,25 @@ export function listApiKeyProviders(llm, settings) {
   const seen = new Set()
   for (const entry of directory) {
     let profile = profiles[entry.provider]
+    let configured = Object.prototype.hasOwnProperty.call(profiles, entry.provider)
     if (!profile && (entry.provider === 'commandcode' || entry.settingsNs === 'llm-commandcode')) {
       const cc = sectionOf(settings, 'llm-commandcode')
-      profile = {
-        apiKeyEnv: cc?.apiKeyEnv ?? 'COMMANDCODE_API_KEY',
-        credentialRef: cc?.apiKeyEnv ?? 'COMMANDCODE_API_KEY',
-        baseURL: cc?.apiBase ?? 'https://api.commandcode.ai',
-        models: cc?.visibleModels ?? [],
+      if (cc && typeof cc === 'object' && Object.keys(cc).length > 0) {
+        const hasCredentials = Boolean(cc.apiKey || cc.apiKeyEnv || cc.credentialRef || cc.apiKeyRef)
+        const hasModels = Array.isArray(cc.visibleModels) && cc.visibleModels.length > 0
+        const hasBase = Boolean(cc.apiBase)
+        if (hasCredentials || hasModels || hasBase) {
+          configured = true
+          profile = {
+            apiKeyEnv: cc.apiKeyEnv ?? (hasCredentials ? 'COMMANDCODE_API_KEY' : ''),
+            credentialRef: cc.apiKeyEnv ?? cc.credentialRef ?? '',
+            baseURL: cc.apiBase ?? 'https://api.commandcode.ai',
+            models: cc.visibleModels ?? [],
+          }
+        }
       }
-    } else {
-      profile = profile ?? {}
     }
+    profile = profile ?? {}
     if (!isApiKeyProvider(entry, profile) || seen.has(entry.provider)) continue
     seen.add(entry.provider)
     out.push({
@@ -85,7 +93,7 @@ export function listApiKeyProviders(llm, settings) {
       settingsNs: entry.settingsNs,
       settingsPath: [...(entry.settingsPath ?? [])],
       declared: entry.declared === true,
-      configured: Object.prototype.hasOwnProperty.call(profiles, entry.provider),
+      configured,
       live: live.has(entry.provider),
       apiKeyEnv: profile.apiKeyEnv ?? profile.credentialRef ?? profile.apiKeyRef ?? '',
       credentialRef: profile.credentialRef ?? profile.apiKeyRef ?? profile.apiKeyEnv ?? '',

package/lib/models.js

@@ -140,13 +140,13 @@ function normalizeCapabilities(row) {
 
   // Model ID & name heuristic markers for modern models
   const idStr = String(row?.id ?? row?.slug ?? row?.model ?? '').toLowerCase()
-  if (!result.reasoning && (/(^|[_-])(o1|o3|r1|qwq|deepseek-r1|thinking)($|[_-])/i.test(idStr) || idStr.includes('-r1') || idStr.includes('reasoning') || idStr.includes('thinking'))) {
+  if (result.reasoning === undefined && (/(^|[_-])(o1|o3|r1|qwq|deepseek-r1|thinking)($|[_-])/i.test(idStr) || idStr.includes('-r1') || idStr.includes('reasoning') || idStr.includes('thinking'))) {
     result.reasoning = true
   }
-  if (!result.code && (/(^|[_-])(coder|code|starcoder|codellama)($|[_-])/i.test(idStr) || idStr.includes('coder') || idStr.includes('code-'))) {
+  if (result.code === undefined && (/(^|[_-])(coder|code|starcoder|codellama)($|[_-])/i.test(idStr) || idStr.includes('coder') || idStr.includes('code-'))) {
     result.code = true
   }
-  if (!result.vision && (/(^|[_-])(vision|vl)($|[_-])/i.test(idStr) || idStr.includes('-vl') || idStr.includes('-vision'))) {
+  if (result.vision === undefined && (/(^|[_-])(vision|vl)($|[_-])/i.test(idStr) || idStr.includes('-vl') || idStr.includes('-vision'))) {
     result.vision = true
   }
 

package/lib/policy.js

@@ -41,6 +41,12 @@ function isDangerousPattern(pattern) {
   if (/\([^\)]*([+*]|\{[0-9]+,[0-9]*\})[^\)]*\)([+*]|\{[0-9]+,[0-9]*\})/.test(pattern)) return true
   // Check for multiple consecutive open-ended wildcards (e.g. .*.*)
   if (/(\.\*|\.\+){2,}/.test(pattern)) return true
+  // Check for quantified alternation groups like (a|aa)+, (a|b)+, (a|b)*, (a|aa){2,}
+  let simplified = pattern
+  while (/\(\(([^()]+)\)\)/.test(simplified)) {
+    simplified = simplified.replace(/\(\(([^()]+)\)\)/g, '($1)')
+  }
+  if (/\((?:[^()]*\|)+[^()]*\)\s*([+*]|\{[0-9]+,[0-9]*\})/.test(simplified)) return true
   return false
 }
 

package/lib/reliability.js

@@ -1,5 +1,39 @@
 const RETRYABLE_STATUSES = new Set([408, 425, 429, 500, 502, 503, 504, 522, 524])
-const RETRYABLE_CODES = new Set(['ECONNRESET', 'ECONNREFUSED', 'ETIMEDOUT', 'EAI_AGAIN', 'UND_ERR_CONNECT_TIMEOUT'])
+const RETRYABLE_CODES = new Set([
+  'ECONNRESET',
+  'ECONNREFUSED',
+  'ETIMEDOUT',
+  'EAI_AGAIN',
+  'UND_ERR_CONNECT_TIMEOUT',
+  'UND_ERR_HEADERS_TIMEOUT',
+  'UND_ERR_BODY_TIMEOUT',
+  'UND_ERR_SOCKET',
+  'UND_ERR_DESTROYED',
+  'UND_ERR_CLOSED',
+  'EHOSTUNREACH',
+  'ENETUNREACH',
+  'EPIPE',
+])
+
+function isTimeout(err) {
+  if (!err) return false
+  if (err.name === 'TimeoutError') return true
+  if (
+    err.code === 'ETIMEDOUT' ||
+    err.code === 'UND_ERR_CONNECT_TIMEOUT' ||
+    err.code === 'UND_ERR_HEADERS_TIMEOUT' ||
+    err.code === 'UND_ERR_BODY_TIMEOUT'
+  ) return true
+  const msg = String(err.message || '').toLowerCase()
+  return msg.includes('timed out') || msg.includes('timeout')
+}
+
+function isAbort(err) {
+  if (!err) return false
+  if (err.name === 'AbortError') return true
+  const msg = String(err.message || '').toLowerCase()
+  return msg.includes('aborted') || msg.includes('the operation was aborted')
+}
 
 export function statusOfError(error) {
   const direct = Number(error?.status ?? error?.statusCode)
@@ -10,10 +44,36 @@ export function statusOfError(error) {
 
 export function isRetryableError(error) {
   if (!error) return false
-  if (error.name === 'AbortError' || error.name === 'TimeoutError') return true
-  if (RETRYABLE_CODES.has(error.code)) return true
-  const status = statusOfError(error)
-  return status !== undefined && RETRYABLE_STATUSES.has(status)
+
+  let curr = error
+  let depth = 0
+  let hasTimeout = false
+  let hasAbort = false
+
+  while (curr && depth < 6) {
+    if (isTimeout(curr)) {
+      hasTimeout = true
+      break
+    }
+    if (isAbort(curr)) {
+      hasAbort = true
+    }
+    if (curr.code && RETRYABLE_CODES.has(curr.code)) {
+      return true
+    }
+    const status = statusOfError(curr)
+    if (status !== undefined) {
+      if (RETRYABLE_STATUSES.has(status)) return true
+      if (status >= 400 && status < 500) return false
+    }
+    curr = curr.cause
+    depth++
+  }
+
+  if (hasTimeout) return true
+  if (hasAbort) return false
+
+  return false
 }
 
 export function parseRetryAfter(response) {
@@ -46,7 +106,10 @@ export function catalogRequestError(status, response) {
   const error = new Error(`model catalog request failed with HTTP ${status}`)
   error.status = Number(status)
   const retryAfterMs = parseRetryAfter(response)
-  if (retryAfterMs !== undefined) error.retryAfterMs = retryAfterMs
+  if (retryAfterMs !== undefined) {
+    error.retryAfterMs = retryAfterMs
+    error.retryAt = new Date(Date.now() + retryAfterMs).toISOString()
+  }
   return error
 }
 
@@ -105,6 +168,7 @@ export async function retryWithBackoff(operation, {
   attempts = 3,
   baseDelayMs = 250,
   maxDelayMs = 4000,
+  maxRetryAfterMs = 300000,
   jitter = true,
   signal,
   onRetry,
@@ -116,14 +180,22 @@ export async function retryWithBackoff(operation, {
       return await operation({ attempt })
     } catch (error) {
       if (attempt >= total || !isRetryableError(error)) throw error
-      const exponential = Math.max(0, Number(baseDelayMs) || 0) * (2 ** (attempt - 1))
-      // Full jitter: randomized between [0.5, 1.0] of calculated exponential backoff
-      const jitterFactor = jitter ? (0.5 + Math.random() * 0.5) : 1
-      const calculatedDelayMs = Math.min(Math.max(0, Number(maxDelayMs) || 0), Math.round(exponential * jitterFactor))
       const retryAfterMs = Number(error?.retryAfterMs)
-      const delayMs = (Number.isFinite(retryAfterMs) && retryAfterMs > 0)
-        ? Math.min(Math.max(0, Number(maxDelayMs) || 0), retryAfterMs)
-        : calculatedDelayMs
+      let delayMs
+      if (Number.isFinite(retryAfterMs) && retryAfterMs > 0) {
+        if (retryAfterMs > maxRetryAfterMs) {
+          if (!error.retryAt) {
+            error.retryAt = new Date(Date.now() + retryAfterMs).toISOString()
+          }
+          throw error
+        }
+        delayMs = retryAfterMs
+      } else {
+        const exponential = Math.max(0, Number(baseDelayMs) || 0) * (2 ** (attempt - 1))
+        // Full jitter: randomized between [0.5, 1.0] of calculated exponential backoff
+        const jitterFactor = jitter ? (0.5 + Math.random() * 0.5) : 1
+        delayMs = Math.min(Math.max(0, Number(maxDelayMs) || 0), Math.round(exponential * jitterFactor))
+      }
       onRetry?.({ attempt, nextAttempt: attempt + 1, delayMs, error })
       await delay(delayMs, signal)
     }
@@ -142,4 +214,4 @@ export async function mapWithConcurrency(items, worker, concurrency = 4) {
     }
   }))
   return values
-}
+}

package/lib/reporting.js

@@ -1,3 +1,4 @@
+import { sanitizeSecretString } from './credentials.js'
 import { createHash } from 'node:crypto'
 
 export const DEFAULT_NOTIFICATION_LIMIT = 50
@@ -14,10 +15,7 @@ export function notificationLimit(value) {
 }
 
 function safeMessage(value) {
-  return String(value ?? '')
-    .replace(/(api[_-]?key|token|secret|authorization|password)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]')
-    .replace(/([?&](?:key|token|api[_-]?key|access[_-]?token)=)[^&#\s]+/gi, '$1[redacted]')
-    .slice(0, 240)
+  return sanitizeSecretString(value).slice(0, 240)
 }
 
 function stable(value) {

package/lib/synchronizer-helpers.js

@@ -1,3 +1,4 @@
+import { sanitizeSecretString } from './credentials.js'
 import { statusOfError } from './reliability.js'
 import { historyEntry } from './history.js'
 import { normalizeModels } from './models.js'
@@ -89,7 +90,7 @@ export function errorMessage(error) {
 }
 
 export function diagnosticMessage(error) {
-  return errorMessage(error).replace(/(api[_-]?key|token|secret|authorization|password)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]').slice(0, 160)
+  return sanitizeSecretString(errorMessage(error)).slice(0, 160)
 }
 
 export function adapterErrorType(error) {

package/lib/synchronizer-prober.js

@@ -1,30 +1,94 @@
-export function createModelProber({ health, getProviderCatalog = () => [] } = {}) {
+export function createModelProber({
+  health,
+  getProviderCatalog = () => [],
+  probeModel,
+  inferModel,
+} = {}) {
   const modelProbes = new Map()
+  const probeFn = probeModel ?? inferModel
 
-  async function tryModel({ provider, model } = {}) {
+  async function tryModel({ provider, model, signal } = {}) {
     if (typeof provider !== 'string' || !provider) throw new Error('provider is required')
     if (typeof model !== 'string' || !model) throw new Error('model is required')
-    const start = Date.now()
-    const result = await health({ provider })
-    const entry = result?.results?.find((r) => r.provider === provider)
-    const providerOk = entry?.status === 'ok'
 
     // Verify model in provider catalog if catalog is available
     const catalog = typeof getProviderCatalog === 'function' ? getProviderCatalog(provider) : []
     const hasCatalog = Array.isArray(catalog) && catalog.length > 0
     const inCatalog = !hasCatalog || catalog.some((m) => (typeof m === 'string' ? m : m?.id) === model)
+    if (hasCatalog && !inCatalog) {
+      const probeResult = {
+        provider,
+        model,
+        ok: false,
+        latencyMs: 0,
+        status: 'model_not_found',
+        error: `model "${model}" not found in provider catalog`,
+      }
+      modelProbes.set(`${provider}:${model}`, {
+        latencyMs: 0,
+        ok: false,
+        status: 'model_not_found',
+        timestamp: Date.now(),
+      })
+      return probeResult
+    }
+
+    const start = Date.now()
+    if (typeof probeFn === 'function') {
+      try {
+        const probeRes = await probeFn({ provider, model, signal })
+        const latencyMs = Math.max(1, Date.now() - start)
+        const isOk = probeRes?.ok !== false
+        const status = isOk ? 'ok' : (probeRes?.status || 'error')
+        const errorMsg = isOk ? undefined : (probeRes?.error || 'inference probe failed')
+        const probeResult = {
+          provider,
+          model,
+          ok: isOk,
+          latencyMs,
+          status,
+          ...(errorMsg ? { error: errorMsg } : {}),
+        }
+        modelProbes.set(`${provider}:${model}`, {
+          latencyMs,
+          ok: isOk,
+          status,
+          timestamp: Date.now(),
+        })
+        return probeResult
+      } catch (err) {
+        const latencyMs = Math.max(1, Date.now() - start)
+        const status = err?.status ? `http_${err.status}` : (err?.code || 'error')
+        const probeResult = {
+          provider,
+          model,
+          ok: false,
+          latencyMs,
+          status,
+          error: err?.message || 'inference probe failed',
+        }
+        modelProbes.set(`${provider}:${model}`, {
+          latencyMs,
+          ok: false,
+          status,
+          timestamp: Date.now(),
+        })
+        return probeResult
+      }
+    }
 
-    const ok = Boolean(providerOk && inCatalog)
-    const latencyMs = Date.now() - start
-    const status = !providerOk ? (entry?.status ?? 'error') : (!inCatalog ? 'model_not_found' : 'ok')
-    const errorMsg = !providerOk
-      ? (entry?.message || entry?.status || 'probe failed')
-      : (!inCatalog ? `model "${model}" not found in provider catalog` : undefined)
+    // Fallback if no probeFn provided: check provider health
+    const healthResult = await health?.({ provider, model, signal })
+    const entry = healthResult?.results?.find((r) => r.provider === provider)
+    const providerOk = entry?.status === 'ok'
+    const latencyMs = Math.max(1, Date.now() - start)
+    const status = !providerOk ? (entry?.status ?? 'error') : 'ok'
+    const errorMsg = !providerOk ? (entry?.message || entry?.status || 'probe failed') : undefined
 
     const probeResult = {
       provider,
       model,
-      ok,
+      ok: providerOk,
       latencyMs,
       status,
       ...(errorMsg ? { error: errorMsg } : {}),
@@ -32,7 +96,7 @@ export function createModelProber({ health, getProviderCatalog = () => [] } = {}
 
     modelProbes.set(`${provider}:${model}`, {
       latencyMs,
-      ok,
+      ok: providerOk,
       status,
       timestamp: Date.now(),
     })
@@ -40,58 +104,74 @@ export function createModelProber({ health, getProviderCatalog = () => [] } = {}
     return probeResult
   }
 
-  async function batchTryModels({ provider, models } = {}) {
+  async function batchTryModels({ provider, models, signal, concurrency = 4 } = {}) {
     if (typeof provider !== 'string' || !provider) throw new Error('provider is required')
     if (!Array.isArray(models)) throw new Error('models must be an array')
     const list = [...new Set(models.filter((m) => typeof m === 'string' && m.trim()).map((m) => m.trim()))].slice(0, 50)
 
-    // Probe provider health ONCE for the entire batch rather than per-model
+    if (typeof probeFn === 'function') {
+      // Execute true model-specific probes with bounded concurrency
+      const limit = Math.max(1, Math.min(10, Math.floor(Number(concurrency) || 4)))
+      const results = new Array(list.length)
+      let cursor = 0
+
+      await Promise.all(Array.from({ length: Math.min(limit, list.length || 1) }, async () => {
+        while (cursor < list.length) {
+          if (signal?.aborted) break
+          const index = cursor++
+          results[index] = await tryModel({ provider, model: list[index], signal })
+        }
+      }))
+
+      const reachable = results.filter((r) => r?.ok).length
+      return {
+        provider,
+        results,
+        summary: { total: results.length, reachable, unreachable: results.length - reachable },
+      }
+    }
+
+    // If no probeFn provided, use provider health once (backwards compatibility)
     const start = Date.now()
-    const healthResult = await health({ provider })
+    const healthResult = await health?.({ provider, signal })
     const entry = healthResult?.results?.find((r) => r.provider === provider)
     const providerOk = entry?.status === 'ok'
     const catalog = typeof getProviderCatalog === 'function' ? getProviderCatalog(provider) : []
     const hasCatalog = Array.isArray(catalog) && catalog.length > 0
-    const baseLatency = Date.now() - start
-
-    const results = []
-    const concurrency = 5
-    for (let i = 0; i < list.length; i += concurrency) {
-      const chunk = list.slice(i, i + concurrency)
-      const chunkResults = chunk.map((model) => {
-        const inCatalog = !hasCatalog || catalog.some((m) => (typeof m === 'string' ? m : m?.id) === model)
-        const ok = Boolean(providerOk && inCatalog)
-        const status = !providerOk ? (entry?.status ?? 'error') : (!inCatalog ? 'model_not_found' : 'ok')
-        const errorMsg = !providerOk
-          ? (entry?.message || entry?.status || 'probe failed')
-          : (!inCatalog ? `model "${model}" not found in provider catalog` : undefined)
-
-        const itemResult = {
-          provider,
-          model,
-          ok,
-          latencyMs: baseLatency,
-          status,
-          ...(errorMsg ? { error: errorMsg } : {}),
-        }
+    const baseLatency = Math.max(1, Date.now() - start)
 
-        modelProbes.set(`${provider}:${model}`, {
-          latencyMs: baseLatency,
-          ok,
-          status,
-          timestamp: Date.now(),
-        })
+    const results = list.map((model) => {
+      const inCatalog = !hasCatalog || catalog.some((m) => (typeof m === 'string' ? m : m?.id) === model)
+      const ok = Boolean(providerOk && inCatalog)
+      const status = !providerOk ? (entry?.status ?? 'error') : (!inCatalog ? 'model_not_found' : 'ok')
+      const errorMsg = !providerOk
+        ? (entry?.message || entry?.status || 'probe failed')
+        : (!inCatalog ? `model "${model}" not found in provider catalog` : undefined)
+
+      const itemResult = {
+        provider,
+        model,
+        ok,
+        latencyMs: baseLatency,
+        status,
+        ...(errorMsg ? { error: errorMsg } : {}),
+      }
 
-        return itemResult
+      modelProbes.set(`${provider}:${model}`, {
+        latencyMs: baseLatency,
+        ok,
+        status,
+        timestamp: Date.now(),
       })
-      results.push(...chunkResults)
-    }
+
+      return itemResult
+    })
 
     const reachable = results.filter((r) => r.ok).length
     return {
       provider,
       results,
-      summary: { total: results.length, reachable, unreachable: results.length - reachable }
+      summary: { total: results.length, reachable, unreachable: results.length - reachable },
     }
   }
 
@@ -104,4 +184,4 @@ export function createModelProber({ health, getProviderCatalog = () => [] } = {}
     batchTryModels,
     getModelProbes,
   }
-}
+}

package/lib/synchronizer.js

@@ -31,7 +31,7 @@ import {
 import { createConfigTransfer } from './synchronizer-transfer.js'
 import { createModelProber } from './synchronizer-prober.js'
 
-export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfig = async () => {}, fetchImpl = fetch, adapterImplementations = {} } = {}) {
+export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfig = async () => {}, fetchImpl = fetch, adapterImplementations = {}, probeModel } = {}) {
   const resolveCredential = createCredentialResolver(ctx)
   const registry = createProviderAdapterRegistry({ resolveCredential, fetchImpl, adapters: adapterImplementations })
   let running = null
@@ -467,6 +467,35 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
       const row = providers().find((item) => item.provider === p)
       return row?.availableModels || row?.models || []
     },
+    probeModel: probeModel ?? (async ({ provider, model, signal }) => {
+      const llm = llmOf(ctx)
+      if (typeof llm?.stream === "function") {
+        const stream = await llm.stream({
+          provider,
+          model,
+          messages: [{ role: "user", content: [{ type: "text", text: "ping" }] }],
+        }, { signal })
+        if (stream && typeof stream[Symbol.asyncIterator] === "function") {
+          for await (const _chunk of stream) {
+            break
+          }
+        }
+        return { ok: true }
+      }
+      const profile = profileOf(settingsOf(ctx), provider)
+      const adapter = selectAdapter(profile)
+      if (typeof adapter?.probeModel === "function") {
+        return adapter.probeModel(profile, model, { signal, fetchImpl })
+      }
+      const h = await health({ provider, model, signal })
+      const entry = h?.results?.find((r) => r.provider === provider)
+      if (entry?.status !== "ok") {
+        const err = new Error(entry?.message || "provider health failed: " + entry?.status)
+        if (entry?.status === "circuit-open") err.status = 503
+        throw err
+      }
+      return { ok: true }
+    }),
   })
 
   const rollbackHistory = (opts) => performHistoryRollback({ ctx, config: getConfig() ?? {}, providers: providers(), ...opts })
@@ -571,14 +600,18 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
     notifications: notificationLedger,
     updateNotification: updateNotificationState,
     rollbackHistory,
-    testWebhook: async ({ url, secret }) => {
+    testWebhook: async ({ url, secret, secretRef }) => {
       let resolvedSecret = secret || ''
-      if (typeof secret === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(secret)) {
+      const targetRef = (secretRef || (typeof secret === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(secret) ? secret : '')).trim()
+      if (targetRef) {
         try {
-          const res = await (ctx?.credentials?.resolve ? ctx.credentials.resolve(secret) : ctx?.get?.('credentials')?.resolve?.(secret))
-          if (res) resolvedSecret = typeof res === 'string' ? res : res?.value || resolvedSecret
+          const res = await (ctx?.credentials?.resolve ? ctx.credentials.resolve(targetRef) : ctx?.get?.('credentials')?.resolve?.(targetRef))
+          if (res) resolvedSecret = typeof res === 'string' ? res : res?.value || ''
         } catch (err) {
-          ctx?.logger?.debug?.('[dsh-model-sync] secret ref resolution fallback:', err)
+          ctx?.logger?.warn?.('[dsh-model-sync] secret ref resolution failed in testWebhook:', err)
+        }
+        if (!resolvedSecret && secretRef) {
+          return { ok: false, error: `Failed to resolve webhook secret credential reference '${secretRef}'` }
         }
       }
       return sendWebhookNotification(url, resolvedSecret, { event: 'model-sync.test', timestamp: Date.now(), test: true })

package/lib/updater.js

@@ -20,19 +20,33 @@ function header(request, name) {
   return Array.isArray(value) ? value[0] : value
 }
 
+function isLoopbackIPv4(address) {
+  if (typeof address !== 'string' || !address.startsWith('127.')) return false
+  const parts = address.split('.')
+  if (parts.length !== 4) return false
+  return parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) >= 0 && Number(part) <= 255)
+}
+
 export function isLoopback(value) {
-  const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
-  return (
-    address === 'localhost' ||
-    address === 'localhost.' ||
-    address === '::1' ||
-    address?.startsWith('127.') === true ||
-    address?.startsWith('::ffff:127.') === true
-  )
+  if (typeof value !== 'string') return false
+  const address = value.toLowerCase().replace(/^\[|\]$/g, '')
+  if (address === 'localhost' || address === 'localhost.' || address === '::1') return true
+  if (address.startsWith('::ffff:')) {
+    return isLoopbackIPv4(address.slice('::ffff:'.length))
+  }
+  return isLoopbackIPv4(address)
 }
 
-export function isTrustedUpdateRequest(request) {
+export function isTrustedUpdateRequest(request, targetCtx = null) {
   if (header(request, UPDATE_HEADER) !== '1') return false
+
+  // 1. Core connection rejection check (#237)
+  const conn = targetCtx?.connection || targetCtx?.get?.('connection') || request?.connection
+  if (conn && typeof conn.requestRejection === 'function') {
+    const rejection = conn.requestRejection(request)
+    if (rejection !== undefined) return false
+  }
+
   const remote = request.socket?.remoteAddress
   if (!isLoopback(remote)) return false
   const site = header(request, 'sec-fetch-site')
@@ -186,7 +200,12 @@ export async function latestVersion(packageName, registry = 'https://registry.np
     const response = await fetch(`${registry.replace(/\/$/, '')}/${encodeURIComponent(packageName)}/latest`, {
       signal: typeof AbortSignal !== 'undefined' && AbortSignal.timeout ? AbortSignal.timeout(8000) : undefined,
     })
-    if (!response.ok) return undefined
+    if (!response.ok) {
+      if (typeof response.body?.cancel === "function") {
+        try { await response.body.cancel() } catch (_err) { /* best-effort cancel */ }
+      }
+      return undefined
+    }
     const value = await response.json()
     if (typeof value?.version !== 'string' || value.version === '') return undefined
     latestCache = { packageName, registry, version: value.version, expiresAt: Date.now() + VERSION_CACHE_MS }
@@ -295,6 +314,21 @@ export function registerPluginUpdater(ctx, options = {}) {
 
   const handler = async (request, response) => {
     try {
+      // 1. Core connection rejection check on all updater routes (#237)
+      const conn = ctx?.connection || ctx?.get?.('connection') || request?.connection
+      if (conn && typeof conn.requestRejection === 'function') {
+        const rejection = conn.requestRejection(request)
+        if (rejection !== undefined) {
+          const status = typeof rejection === 'number' ? rejection : 401
+          response.writeHead(status, {
+            'content-type': 'application/json; charset=utf-8',
+            'cache-control': 'no-store',
+          })
+          response.end(JSON.stringify({ error: 'unauthorized', code: status }))
+          return
+        }
+      }
+
       const target = runtime()
       if (request.method === 'GET' || request.method === 'HEAD') {
         const isFresh = Boolean(
@@ -317,7 +351,7 @@ export function registerPluginUpdater(ctx, options = {}) {
         response.end()
         return
       }
-      if (!isTrustedUpdateRequest(request)) {
+      if (!isTrustedUpdateRequest(request, ctx)) {
         json(response, 403, { error: 'Rejected non-local or cross-origin update request.' })
         return
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-model-sync",
-  "version": "0.5.9",
+  "version": "0.5.11",
   "description": "Automatic model catalog synchronization for API-key DeepSeek Harness providers.",
   "keywords": [
     "deepseek-harness",