@duke-dsh-plugins/dsh-token-stats 1.4.0 → 1.5.0

package/README.md

@@ -27,7 +27,7 @@
 | 🗂 汇总卡片 | 区间总 Tokens / 输入(含缓存) / 输出 |
 | 💾 本地持久化 | 聚合结果落盘 `<DSH_HOME>/data/dsh-token-stats/stats.json`，冷启动只扫描新会话、秒开；删除该文件可强制全量重扫 |
 | ⏱ 自动刷新 | 页面打开期间每 30s 刷新；历史回填期间每 2s 轮询进度 |
-| 💰 套餐余额 | 输入框工具行（model 选择器左侧）内联显示当前 provider 的**余额/套餐用量**，跟随当前模型自动切换；支持 minimax / deepseek / kimi / openrouter / zhipu；60s 轮询，点击立即刷新 |
+| 💰 套餐余额 | 输入框工具行（model 选择器左侧）内联显示当前 provider 的**余额/套餐用量**，跟随当前模型自动切换；支持 minimax / deepseek / kimi / openrouter / zhipu / mimo（小米）；60s 轮询，点击立即刷新 |
 | 🌗 主题适配 | 全部使用 DSH 设计 token，明暗主题自动跟随 |
 
 > 套餐余额功能参考自 [dsh-musage](https://github.com/Thedeergod666/dsh-musage)（MIT），API Key 直接复用 DSH 模型设置里已配置的凭据（`credentials` 服务），无需重复配置。
@@ -43,7 +43,7 @@
 dsh plugin --profile web add /path/to/dsh-token-stats
 
 # 正式发布：从 GitHub Release tarball 安装
-dsh plugin --profile web add https://github.com/MoonlitDropOfBlood/dsh-token-stats/releases/download/v1.4.0/dsh-token-stats-1.4.0.tgz
+dsh plugin --profile web add https://github.com/MoonlitDropOfBlood/dsh-token-stats/releases/download/v1.4.0/duke-dsh-plugins-dsh-token-stats-1.4.0.tgz
 ```
 
 重启 DSH 后，打开 DSH Web UI 的设置（侧栏底部），左侧导航会出现 **Token 统计** 页。
@@ -61,9 +61,12 @@ dsh plugin --profile web add https://github.com/MoonlitDropOfBlood/dsh-token-sta
 4. **会话输入框工具行**（model 选择器左侧）内联显示当前 provider 的套餐余额：
    - DeepSeek / OpenRouter 显示余额（如 `¥43.97` / `$12.50`）；
    - MiniMax / Kimi / 智谱 显示 `5h X% | 7d Y%`（5 小时 / 7 天窗口已用百分比，悬停查看重置时间）；
+   - 小米 MiMo 显示 `套餐 X% | 本月 Y%`（Token Plan 已用百分比，悬停查看重置时间；需在凭据里配 platform.xiaomimimo.com 的登录 Cookie，见下）；
    - 切换模型时自动切换 provider；每 60s 自动刷新，**点击读数立即强制刷新**；
    - 未配置对应 API Key 或拉取失败时显示 `⚠`（悬停查看原因）；当前 provider 不在支持列表时不占位。
 
+> **MiMo（小米）配置**：MiMo 的用量走 dashboard admin API（非公开 endpoint），纯 API Key（Bearer）实测会被 401 拒绝，可靠凭证是浏览器登录 Cookie。打开 platform.xiaomimimo.com → 订阅管理，F12 → Network 任一 `/api/v1/tokenPlan/*` 请求 → 复制完整 `Cookie` 请求头值，粘到 DSH 凭据的 `XIAOMI_MIMO_COOKIE`（或把 API Key 配到 `XIAOMI_MIMO_API_KEY`，插件会先 Bearer 后 Cookie 自动重试）。
+
 ## 工作原理
 
 ```

package/client.js

@@ -209,21 +209,55 @@ window.__ModuleLoader__.load({
     };
 
     async function apply(ctx) {
+      // 0.1.7-rc.1 hardening: a client bundle that rejects can keep the whole
+      // web app from reaching the conversation page. Every optional step below
+      // degrades independently so this plugin never blocks DSH boot; the last
+      // resort catch keeps apply() itself from rejecting.
+      try {
+        await applyInner(ctx);
+      } catch (e) {
+        // eslint-disable-next-line no-console
+        (typeof console !== "undefined" && console.error ? console.error : () => {})(
+          "[dsh-token-stats] client apply failed; plugin disabled for this session:",
+          e,
+        );
+      }
+    }
+
+    async function applyInner(ctx) {
       // Mount the tokenStats namespace before anything touches it; the mount's
-      // lifetime is bound to this plugin's context by $mount itself.
-      await ctx.remote.$mount(CLIENT_REMOTE);
+      // lifetime is bound to this plugin's context by $mount itself. A mount
+      // failure (descriptor schema drift in a future dsh) downgrades the UI to
+      // an error state instead of failing the whole bundle.
+      let remote = null;
+      try {
+        await ctx.remote.$mount(CLIENT_REMOTE);
+        remote = ctx.get("remote.tokenStats") || null;
+      } catch (e) {
+        // eslint-disable-next-line no-console
+        (typeof console !== "undefined" && console.warn ? console.warn : () => {})(
+          "[dsh-token-stats] remote.$mount failed; stats page will show an error state:",
+          e,
+        );
+      }
 
-      const styleTag = document.createElement("style");
-      styleTag.textContent = CSS;
-      document.head.appendChild(styleTag);
-      ctx.effect(() => () => styleTag.remove());
+      let styleTag = null;
+      try {
+        styleTag = document.createElement("style");
+        styleTag.textContent = CSS;
+        document.head.appendChild(styleTag);
+        ctx.effect(() => () => styleTag && styleTag.remove());
+      } catch (e) {
+        /* cosmetic only */
+      }
 
       // Mark our settings-nav row so the CSS above replaces the shell's
       // fallback gear (no icon field exists in settings.section yet).
-      ctx.effect(() => registerSettingsNavIcon(SETTINGS_LABEL));
-
-      // ctx.get() reads the service without the property-accessor inject guard.
-      const remote = ctx.get("remote.tokenStats");
+      try {
+        ctx.effect(() => registerSettingsNavIcon(SETTINGS_LABEL));
+      } catch (e) {
+        /* cosmetic only */
+      }
 
       const PALETTE = [
         "#5b8cff", "#f26d7a", "#3ecf8e", "#f5b942", "#a78bfa", "#38bdf8",
@@ -603,8 +637,12 @@ window.__ModuleLoader__.load({
         "openrouter": "openrouter",
         "zai-coding-cn": "zhipu",
         "zhipu": "zhipu",
+        // Xiaomi MiMo：route id 由用户添加 provider 时命名，覆盖常见拼法。
+        "xiaomi-mimo": "mimo",
+        "xiaomimimo": "mimo",
+        "mimo": "mimo",
       };
-      const QUOTA_PROVIDER_ORDER = ["minimax", "deepseek", "kimi", "openrouter", "zhipu"];
+      const QUOTA_PROVIDER_ORDER = ["minimax", "deepseek", "kimi", "openrouter", "zhipu", "mimo"];
 
       function quotaProviderLabel(p) {
         if (p === "minimax") return "MiniMax";
@@ -612,6 +650,7 @@ window.__ModuleLoader__.load({
         if (p === "kimi") return "Kimi";
         if (p === "openrouter") return "OpenRouter";
         if (p === "zhipu") return "Zhipu";
+        if (p === "mimo") return "MiMo";
         return p;
       }
 
@@ -632,7 +671,20 @@ window.__ModuleLoader__.load({
           const txt = d.balanceText || (typeof d.balanceUsd === "number" ? "$" + d.balanceUsd.toFixed(2) : "—");
           return [labelEl, React.createElement("span", { key: "b", style: strong }, txt)];
         }
-        // minimax / kimi / zhipu: 5h + 7d 窗口已用百分比
+        if (provider === "mimo") {
+          // MiMo Token Plan：套餐已用% + 本月总额度%（detail 缺失时可能只有一行）
+          const parts = [labelEl];
+          if (typeof d.fiveHrPct === "number") {
+            parts.push(React.createElement("span", { key: "plan", style: strong }, "套餐 " + d.fiveHrPct + "%"));
+          }
+          if (typeof d.weeklyPct === "number") {
+            if (parts.length > 1) parts.push(React.createElement("span", { key: "sep", style: { opacity: 0.5, fontSize: 10 } }, "|"));
+            parts.push(React.createElement("span", { key: "month", style: strong }, "本月 " + d.weeklyPct + "%"));
+          }
+          if (parts.length === 1) parts.push(React.createElement("span", { key: "na", style: strong }, "—"));
+          return parts;
+        }
+        // minimax / kimi / zhipu: 5h + 7d 双窗口套餐
         const five = typeof d.fiveHrPct === "number" ? d.fiveHrPct + "%" : "—";
         const week = typeof d.weeklyPct === "number" ? d.weeklyPct + "%" : "—";
         return [
@@ -658,10 +710,16 @@ window.__ModuleLoader__.load({
               ),
             );
           }
-          const windows = [
-            ["5h 窗口", d.fiveHrPct, d.fiveHrResetsIn],
-            ["7d 窗口", d.weeklyPct, d.weeklyResetsIn],
-          ];
+          const windows =
+            props.provider === "mimo"
+              ? [
+                  ["套餐已用", d.fiveHrPct, d.fiveHrResetsIn],
+                  ["本月总额度", d.weeklyPct, d.weeklyResetsIn],
+                ]
+              : [
+                  ["5h 窗口", d.fiveHrPct, d.fiveHrResetsIn],
+                  ["7d 窗口", d.weeklyPct, d.weeklyResetsIn],
+                ];
           for (const w of windows) {
             if (typeof w[1] !== "number") continue;
             rows.push(
@@ -866,10 +924,16 @@ window.__ModuleLoader__.load({
             React.createElement("div", { className: "ts-quota-card-value" }, d.balanceText),
           );
         }
-        const windows = [
-          ["5h 窗口", d.fiveHrPct, d.fiveHrResetsIn],
-          ["7d 窗口", d.weeklyPct, d.weeklyResetsIn],
-        ];
+        const windows =
+          p === "mimo"
+            ? [
+                ["套餐已用", d.fiveHrPct, d.fiveHrResetsIn],
+                ["本月总额度", d.weeklyPct, d.weeklyResetsIn],
+              ]
+            : [
+                ["5h 窗口", d.fiveHrPct, d.fiveHrResetsIn],
+                ["7d 窗口", d.weeklyPct, d.weeklyResetsIn],
+              ];
         return React.createElement(
           "div", { className: "ts-card ts-quota-card" },
           React.createElement(
@@ -952,6 +1016,10 @@ window.__ModuleLoader__.load({
 
         const load = React.useCallback(async () => {
           try {
+            if (!remote) {
+              setError("tokenStats Remote 未就绪（宿主插件可能加载失败）");
+              return;
+            }
             const res = await remote.getStats();
             if (res && res.ok) {
               // The Remote gateway returns `res.value` = the Host method's full
@@ -1093,12 +1161,20 @@ window.__ModuleLoader__.load({
       }
 
       // Settings entry: a full page under the sidebar Settings panel.
-      ctx.slots.inject("settings.section", () =>
-        ctx.slots.register(
-          { name: "settings.section", id: "token-stats", order: 25, label: () => SETTINGS_LABEL },
-          TokenStatsPage,
-        ),
-      );
+      try {
+        ctx.slots.inject("settings.section", () =>
+          ctx.slots.register(
+            { name: "settings.section", id: "token-stats", order: 25, label: () => SETTINGS_LABEL },
+            TokenStatsPage,
+          ),
+        );
+      } catch (e) {
+        // eslint-disable-next-line no-console
+        (typeof console !== "undefined" && console.warn ? console.warn : () => {})(
+          "[dsh-token-stats] settings.section registration failed:",
+          e,
+        );
+      }
 
       // Composer quota readout (余额/套餐用量), same seat as dsh-musage:
       // `conversation.input.right`, immediately left of the model select. Only
@@ -1106,18 +1182,34 @@ window.__ModuleLoader__.load({
       // per-session model directory the readout follows); scoped inject keeps
       // deployments without it completely unaffected.
       if (typeof ctx.inject === "function") {
-        ctx.inject(["slots", "modelDirectories"], (scope) => {
-          scope.slots.inject("conversation.input.right", () =>
-            scope.slots.register(
-              { name: "conversation.input.right", id: "token-stats-quota", order: 0, label: "Token quota" },
-              (props) =>
-                React.createElement(QuotaReadout, {
-                  sessionId: props && props.sessionId,
-                  models: scope.modelDirectories,
-                }),
-            ),
+        try {
+          ctx.inject(["slots", "modelDirectories"], (scope) => {
+            try {
+              scope.slots.inject("conversation.input.right", () =>
+                scope.slots.register(
+                  { name: "conversation.input.right", id: "token-stats-quota", order: 0, label: "Token quota" },
+                  (props) =>
+                    React.createElement(QuotaReadout, {
+                      sessionId: props && props.sessionId,
+                      models: scope.modelDirectories,
+                    }),
+                ),
+              );
+            } catch (e) {
+              // eslint-disable-next-line no-console
+              (typeof console !== "undefined" && console.warn ? console.warn : () => {})(
+                "[dsh-token-stats] conversation.input.right registration failed:",
+                e,
+              );
+            }
+          });
+        } catch (e) {
+          // eslint-disable-next-line no-console
+          (typeof console !== "undefined" && console.warn ? console.warn : () => {})(
+            "[dsh-token-stats] modelDirectories scoped inject failed:",
+            e,
           );
-        });
+        }
       }
     }
 

package/index.js

@@ -27,9 +27,9 @@
  * (`<provider>::<model>`), which is exactly what the Client charts consume.
  *
  * A second Remote method, `getQuota(provider, force)`, reports one provider's
- * coding-plan quota / balance (minimax / deepseek / kimi / openrouter / zhipu)
- * for the composer readout — adapted from dsh-musage (MIT). It resolves the
- * user-configured API key through the `credentials` service, GETs the
+ * coding-plan quota / balance (minimax / deepseek / kimi / openrouter / zhipu /
+ * mimo) for the composer readout — adapted from dsh-musage (MIT). It resolves
+ * the user-configured API key through the `credentials` service, GETs the
  * provider's endpoint (global fetch, curl via `subprocess` as fallback), and
  * caches per provider (30 s TTL, exponential backoff on failure). In-memory
  * only; nothing below touches the persisted stats store.
@@ -142,8 +142,27 @@ const QUOTA_PROVIDERS = {
     // 智谱特殊: Authorization 不加 "Bearer " 前缀 (来自 Musage zhipu.rs 注释)
     authStyle: "raw",
   },
+  // Xiaomi MiMo Token Plan — dashboard admin API（非公开 endpoint）：
+  // Bearer 实测 401（session 守护），可靠路径是登录 Cookie；单个凭证值先
+  // Bearer 后 Cookie 自动重试（对齐 Musage xiaomi.rs 的 BearerThenCookie）。
+  // 在 DSH 凭据里把浏览器 DevTools 复制的完整 Cookie 或 API Key 配到
+  // XIAOMI_MIMO_API_KEY / XIAOMI_MIMO_COOKIE（或 MIMO_*）任一 ref。
+  mimo: {
+    refs: ["XIAOMI_MIMO_API_KEY", "XIAOMI_MIMO_COOKIE", "MIMO_API_KEY", "MIMO_COOKIE"],
+    urls: {
+      XIAOMI_MIMO_API_KEY: "https://platform.xiaomimimo.com/api/v1/tokenPlan/usage",
+      XIAOMI_MIMO_COOKIE: "https://platform.xiaomimimo.com/api/v1/tokenPlan/usage",
+      MIMO_API_KEY: "https://platform.xiaomimimo.com/api/v1/tokenPlan/usage",
+      MIMO_COOKIE: "https://platform.xiaomimimo.com/api/v1/tokenPlan/usage",
+    },
+    parse: parseMimoResponse,
+  },
 };
 
+/** Xiaomi MiMo dashboard admin API endpoints（usage + detail，鉴权同一凭证）。 */
+const MIMO_USAGE_URL = "https://platform.xiaomimimo.com/api/v1/tokenPlan/usage";
+const MIMO_DETAIL_URL = "https://platform.xiaomimimo.com/api/v1/tokenPlan/detail";
+
 function quotaBackoffMs(streak) {
   if (streak <= 0) return 0;
   return Math.min(QUOTA_BACKOFF_MAX_MS, QUOTA_BACKOFF_BASE_MS * Math.pow(2, streak - 1));
@@ -402,6 +421,127 @@ function formatBalance(n, currency) {
   return symbol + (n >= 100 ? n.toFixed(0) : n.toFixed(2));
 }
 
+// ----- xiaomi mimo (小米 MiMo Token Plan) parser -----
+//   { "code": 0,
+//     "data": {
+//       "usage":      { "items": [ {"name":"plan_total_token","percent":0.13}, ... ] },
+//       "monthUsage": { "items": [ {"name":"month_total_token","percent":0.42} ] } } }
+// percent 是 0-1 小数（×100 得百分比）；detail 端给 currentPeriodEnd（UTC 字符串）
+// 与 expired。套餐/总额度相差 <0.5pt 视为同一份额度（去重，对齐 Musage）。
+// 业务 code 40100..40199 等价于 HTTP 401（凭据失效）。
+
+function mimoItemPct(item) {
+  if (!item || typeof item !== "object") return null;
+  if (typeof item.percent === "number" && isFinite(item.percent)) {
+    return Math.max(0, Math.min(100, Math.round(item.percent * 100)));
+  }
+  const used = Number(item.used);
+  const limit = Number(item.limit);
+  if (isFinite(used) && isFinite(limit) && limit > 0) {
+    return Math.max(0, Math.min(100, Math.round((used / limit) * 100)));
+  }
+  return null;
+}
+
+function parseMimoResponse(body, detailBody) {
+  let json;
+  try {
+    json = typeof body === "string" ? JSON.parse(body) : body;
+  } catch {
+    return { ok: false, provider: "mimo", kind: "parse", message: "JSON 解析失败" };
+  }
+  if (!json || typeof json !== "object") {
+    return { ok: false, provider: "mimo", kind: "parse", message: "MiMo 响应不是对象" };
+  }
+  if (typeof json.code === "number" && json.code !== 0) {
+    if (json.code >= 40100 && json.code < 40200) {
+      return {
+        ok: false,
+        provider: "mimo",
+        kind: "auth_failed",
+        message: "MiMo 凭据已失效（Cookie 过期或未登录），请到 platform.xiaomimimo.com 重新复制",
+      };
+    }
+    return {
+      ok: false,
+      provider: "mimo",
+      kind: "server_error",
+      message: "MiMo 业务错误 code=" + json.code + " · " + (json.message || ""),
+    };
+  }
+  const data = json.data;
+  if (!data || typeof data !== "object") {
+    return { ok: false, provider: "mimo", kind: "parse", message: "MiMo 响应缺少 data 字段" };
+  }
+
+  let resetsAt = null;
+  let expired = false;
+  if (detailBody) {
+    let detail;
+    try {
+      detail = typeof detailBody === "string" ? JSON.parse(detailBody) : detailBody;
+    } catch {
+      detail = null;
+    }
+    const dd = detail && detail.data;
+    if (dd && typeof dd === "object") {
+      if (dd.expired === true) expired = true;
+      if (typeof dd.currentPeriodEnd === "string" && dd.currentPeriodEnd) {
+        const t = Date.parse(dd.currentPeriodEnd.replace(" ", "T") + "Z");
+        if (!isNaN(t)) resetsAt = t;
+      }
+    }
+  }
+  if (expired) {
+    return {
+      ok: false,
+      provider: "mimo",
+      kind: "plan_expired",
+      message: "MiMo Token 套餐已过期，请到 platform.xiaomimimo.com 续费",
+    };
+  }
+
+  const usageItems = data.usage && Array.isArray(data.usage.items) ? data.usage.items : [];
+  const monthItems = data.monthUsage && Array.isArray(data.monthUsage.items) ? data.monthUsage.items : [];
+  const findPct = (items, name) => {
+    const hit = items.find((it) => it && it.name === name);
+    return hit ? mimoItemPct(hit) : null;
+  };
+  let planPct = findPct(usageItems, "plan_total_token");
+  let monthPct = findPct(monthItems, "month_total_token");
+
+  if (planPct === null && monthPct === null) {
+    if (usageItems.length > 0 || monthItems.length > 0) {
+      const names = usageItems.concat(monthItems).map((it) => it && it.name).filter(Boolean).join(",");
+      return {
+        ok: false,
+        provider: "mimo",
+        kind: "schema_unknown",
+        message: "MiMo 响应字段都不认识（items: " + names + "）",
+      };
+    }
+    return { ok: false, provider: "mimo", kind: "parse", message: "MiMo usage.items 为空（套餐可能已过期）" };
+  }
+  // 套餐与月度总额度是同一份额度时只显示一行（Musage 0.5pt 去重阈值）
+  if (planPct !== null && monthPct !== null && Math.abs(monthPct - planPct) < 0.5) {
+    monthPct = null;
+  }
+  const resetsIn = resetsAt ? formatResetsIn(resetsAt) : null;
+  return {
+    ok: true,
+    provider: "mimo",
+    display: {
+      fiveHrPct: planPct,
+      weeklyPct: monthPct,
+      fiveHrResetsIn: planPct !== null ? resetsIn : null,
+      weeklyResetsIn: monthPct !== null ? resetsIn : null,
+      balanceText: null,
+      balanceUsd: null,
+      currency: null,
+    },
+  };
+}
+
 function formatResetsIn(resetsAtMs) {
   if (typeof resetsAtMs !== "number" || !resetsAtMs) return "";
   const ms = resetsAtMs - Date.now();
@@ -474,13 +614,18 @@ export class TokenStatsService extends TypertRemoteService {
 
   /**
    * Cordis class-plugin initializer: runs right after construction, before the
-   * service is published. Mark the Remote method, then start collecting.
+   * service is published. Mark the Remote methods, then start collecting.
+   *
+   * 0.1.7-rc.1 hardening: with dsh 0.1.7, a required plugin whose activation
+   * rejects can take the whole profile down (the startup page names the failing
+   * plugin and DSH never reaches the chat). So every step after the state
+   * fields are initialized is best-effort: a failure leaves the service
+   * registered and answering (getStats reports the error) instead of failing
+   * activation.
    */
   [Service.init]() {
-    markRemoteMethod(this, "getStats", "getStats");
-    markRemoteMethod(this, "getQuota", "getQuota");
-    markRemoteMethod(this, "getAllQuotas", "getAllQuotas");
-
+    // State first: whatever later step fails, the Remote methods below must
+    // always find consistent in-memory state to answer with.
     /** dayKey ('YYYY-MM-DD', local) -> Map<modelKey, day aggregate>. */
     this._byDay = new Map();
     /** modelKey -> { key, name, provider }. */
@@ -500,22 +645,55 @@ export class TokenStatsService extends TypertRemoteService {
     this._quotaActiveRef = Object.create(null);
     this._curlPath = null;
 
+    try {
+      markRemoteMethod(this, "getStats", "getStats");
+    } catch (e) {
+      this._backfill.error = "getStats 未发布: " + String((e && e.message) || e);
+    }
+    try {
+      markRemoteMethod(this, "getQuota", "getQuota");
+    } catch (e) {
+      this._backfill.error = "getQuota 未发布: " + String((e && e.message) || e);
+    }
+    try {
+      markRemoteMethod(this, "getAllQuotas", "getAllQuotas");
+    } catch (e) {
+      this._backfill.error = "getAllQuotas 未发布: " + String((e && e.message) || e);
+    }
+
     // Restore the previous run's aggregates so a cold start only scans new sessions.
-    this._loadStore();
+    try {
+      this._loadStore();
+    } catch (e) {
+      /* missing or corrupt store: start empty and let backfill do a full scan */
+    }
 
     // Best-effort synchronous flush when the plugin fiber is disposed.
-    this.ctx.effect(() => () => {
-      if (this._saveTimer) {
-        clearTimeout(this._saveTimer);
-        this._saveTimer = null;
-      }
-      if (this._dirty) this._saveSync();
-    });
+    try {
+      this.ctx.effect(() => () => {
+        if (this._saveTimer) {
+          clearTimeout(this._saveTimer);
+          this._saveTimer = null;
+        }
+        if (this._dirty) this._saveSync();
+      });
+    } catch (e) {
+      this._backfill.error = "持久化刷新未注册: " + String((e && e.message) || e);
+    }
 
     // Live capture: every committed session append.
-    this.ctx.on("session/event", (session, event) => this._onSessionEvent(session, event));
+    try {
+      this.ctx.on("session/event", (session, event) => this._onSessionEvent(session, event));
+    } catch (e) {
+      this._backfill.error = "实时采集未注册: " + String((e && e.message) || e);
+    }
 
-    this._startBackfill();
+    try {
+      const backfill = this._startBackfill();
+      if (backfill && typeof backfill.catch === "function") backfill.catch(() => {});
+    } catch (e) {
+      this._backfill.error = "历史回填启动失败: " + String((e && e.message) || e);
+    }
   }
 
   // ---- data helpers ---------------------------------------------------------
@@ -893,7 +1071,12 @@ export class TokenStatsService extends TypertRemoteService {
       return { ok: false, kind: "network", message: "subprocess service 不可用, 且宿主无全局 fetch" };
     }
     const c = await this._resolveCurl();
-    const authHeader = authStyle === "raw" ? "Authorization: " + key : "Authorization: Bearer " + key;
+    const authHeader =
+      authStyle === "raw"
+        ? "Authorization: " + key
+        : authStyle === "cookie"
+          ? "Cookie: " + key
+          : "Authorization: Bearer " + key;
     const handle = subprocess.spawn({
       argv: [
         c, "-sS",
@@ -940,12 +1123,14 @@ export class TokenStatsService extends TypertRemoteService {
   async _httpGet(url, key, authStyle) {
     if (typeof fetch === "function") {
       try {
+        const headers = { accept: "application/json" };
+        // authStyle: undefined → Bearer； "raw" → 原样 Authorization（智谱）；
+        // "cookie" → 整串 Cookie 头（小米 MiMo dashboard admin API）。
+        if (authStyle === "cookie") headers.cookie = key;
+        else headers.authorization = authStyle === "raw" ? key : "Bearer " + key;
         const res = await fetch(url, {
           method: "GET",
-          headers: {
-            authorization: authStyle === "raw" ? key : "Bearer " + key,
-            accept: "application/json",
-          },
+          headers,
           signal: AbortSignal.timeout(QUOTA_REQUEST_TIMEOUT_MS),
         });
         const body = await res.text();
@@ -979,12 +1164,31 @@ export class TokenStatsService extends TypertRemoteService {
         message: "未配置 " + provider + " API Key (在 DSH 模型设置里配置对应 provider)",
       };
     }
+    if (provider === "mimo") return this._fetchMimoQuota(key);
     const url = cfg.urls[ref] || cfg.urls[cfg.refs[0]];
     const raw = await this._httpGet(url, key, cfg.authStyle);
     if (!raw.ok) return { ...raw, provider };
     return cfg.parse(raw.body);
   }
 
+  /**
+   * Xiaomi MiMo Token Plan（dashboard admin API，契约来自 Musage xiaomi.rs）：
+   * 同一凭证值先按 Bearer 试，401/403 时原样改 `Cookie:` 头重试；usage 成功
+   * 后再 best-effort 拉一次 detail（周期结束时间 / 过期标记）。detail 失败
+   * 不影响 usage 结果（只是没有重置倒计时）。
+   */
+  async _fetchMimoQuota(key) {
+    let raw = await this._httpGet(MIMO_USAGE_URL, key, undefined);
+    let cookie = false;
+    if (!raw.ok && (raw.httpStatus === 401 || raw.httpStatus === 403)) {
+      raw = await this._httpGet(MIMO_USAGE_URL, key, "cookie");
+      cookie = true;
+    }
+    if (!raw.ok) return { ...raw, provider: "mimo" };
+    const detail = await this._httpGet(MIMO_DETAIL_URL, key, cookie ? "cookie" : undefined);
+    return parseMimoResponse(raw.body, detail && detail.ok ? detail.body : null);
+  }
+
   /**
    * Cached per-provider quota read. Success caches for 30 s; failures cache
    * with exponential backoff (5 s → 30 min cap) so a broken provider is not
@@ -1006,8 +1210,8 @@ export class TokenStatsService extends TypertRemoteService {
 
   /**
    * Plan quota / balance for one provider (`minimax` | `deepseek` | `kimi` |
-   * `openrouter` | `zhipu`). The composer readout in the Client half calls
-   * this for the session's active provider (and on click with force=true).
+   * `openrouter` | `zhipu` | `mimo`). The composer readout in the Client half
+   * calls this for the session's active provider (and on click with force=true).
    */
   async getQuota(provider, force) {
     const p = typeof provider === "string" ? provider : "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@duke-dsh-plugins/dsh-token-stats",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Token usage statistics for DeepSeek Harness (7/30-day per-model charts + yearly heatmap) plus an inline coding-plan balance/quota readout in the composer (minimax/deepseek/kimi/openrouter/zhipu).",
   "repository": {
     "type": "git",
@@ -26,6 +26,9 @@
     "cordis.patch.yml"
   ],
   "license": "MIT",
+  "engines": {
+    "dsh": ">=0.1.4-rc.2 <0.2.0"
+  },
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
@@ -36,6 +39,7 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh": ">=0.1.4-rc.2 <0.2.0",
     "@deepseek-ai/dsh-typert-protocol": "^0.1.0-rc.7"
   },
   "dependencies": {
@@ -44,6 +48,7 @@
   "scripts": {
     "check": "node --check index.js && node --check client.js && node --check typert.host.js",
     "smoke": "node scripts/smoke-store.mjs",
-    "smoke:quota": "node scripts/smoke-quota.mjs"
+    "smoke:quota": "node scripts/smoke-quota.mjs",
+    "smoke:robust": "node scripts/smoke-robust-host.mjs && node scripts/smoke-robust-client.mjs"
   }
 }