@gehennawu/dsh-service 0.22.0 → 0.24.0

package/README.en.md

@@ -38,7 +38,7 @@ The plugin also appears under **Plugins → Plugin configuration**, with six hos
 
 - 7-day stacked bar chart of input/output/cache tokens with blue/orange/teal legend
 - Filter by project; hover for exact values
-- Model breakdown as horizontal stacked bars (same legend colors), sorted by total tokens, largest first; each row keeps `x times · Cache hit x% · Input xM token · Output xM token`
+- Model breakdown as horizontal stacked bars (same legend colors) with a "Today / Last 7 days / All time" toggle on the right of the list header (default: last 7 days): Today aggregates only the current day, Last 7 days ranks within the chart's window, and All time covers every date in the index (bounded by session retention); each row keeps `x times · Cache hit x% · Input xM token · Output xM token`
 - Steps whose provider reports no token usage are excluded from the statistics
 - Last-24-hour model/tool error statistics, collapsed by default
 
@@ -48,6 +48,8 @@ The plugin also appears under **Plugins → Plugin configuration**, with six hos
 - A quota ring inside the conversation composer follows the provider selected by the current session and shows the tightest budget window as a percentage (green below 80%, amber at or above); clicking opens a panel headed by the provider name, with a bar and used percentage for each window and reset times on their own lines; on narrow viewports (phones) the panel switches to a viewport-centered floating layer — fully visible, scrolling internally when too tall — and rotates or resizing wider flips it back to the anchored placement above the ring
 - A "Show a remote quota entry in the settings left navigation" switch lives in the Quota lookup tab (off by default), mirroring the Restart entry
 - Built-in adaptations: **OpenCode Go** (`{baseURL}/usage`), **Zhipu GLM Coding Plan / zai-coding-cn** (official monitor `quota/limit` endpoint with three windows — 5-hour rolling tokens, weekly tokens, monthly MCP quota; an idle 5-hour window hides its reset time, matching the official console), **OpenRouter** (credits used %), **Kimi/Moonshot** and **SiliconFlow** (CNY balance text); dialects that natively report remaining percentage flip the panel word to "Remaining" and invert the warn threshold; transient network errors retry automatically and the Zhipu dual-domain candidate chain switches automatically; the provider-to-kind mapping lives in `DSH_HOME/dsh-service-quota.json`, and known services are auto-detected from their baseURL (e.g. opencode.ai, bigmodel.cn) with no manual picking; no upstream request is ever made for unadapted or disabled providers; disabling can be done via "Disable" in a card's footer or by writing `"<provider>": null` in the config file (both are equivalent). Zhipu reset cards have no API-key-queryable endpoint yet — you can add any number of them via each provider card's "Add reset card" button on the tab (name plus expiry time, down to the minute), and remove each one independently — the ring panel shows them too (stored in the same config file); expired cards are flagged automatically
+- **CLIProxyAPI accounts (cliproxy)**: queries the **official remaining quota** of each OAuth upstream account inside a CLIProxyAPI (CPA) deployment (Codex 5-hour/weekly windows, per-model quotas for GeminiCLI and Antigravity) — not proxy-key usage. Prerequisites: CPA's `remote-management.secret-key` must be set (the whole management API is unavailable without it), remote access requires `allow-remote-management`, and the management secret goes into the DSH credential store as `CPA_MANAGEMENT_KEY` or an environment variable of the same name — it is independent of the proxy API key, and the plugin never sends the proxy key to the management plane. When you save the "CLIProxyAPI accounts" adaptation, the plugin pins the hostname of that provider's settings baseURL into the config file and afterwards only sends requests to that pinned domain (re-save the adaptation after changing baseURL); a single refresh queries at most 8 accounts (disabled accounts and account types without a supported quota endpoint are skipped automatically), and failures on some accounts do not affect the rest. Note that CPA's management plane has built-in key throttling — 5 wrong attempts ban your IP for 30 minutes — so make sure the secret is correct before testing
+- Credential fill-in form: when an adapted provider shows "credential missing", its card offers an inline **"Set API credential"** form — the credential name comes from a host-derived whitelist per adaptation type (CLIProxyAPI only ever offers `CPA_MANAGEMENT_KEY`/`CLIPROXY_MANAGEMENT_KEY` — these are **alias slots for the same secret; storing one is enough**, discovery takes the first configured value in order; the primary name is marked and the form defaults to a configured slot. Never the proxy key); saving writes the value into the DSH credential provider (the `refs:` section of `$DSH_HOME/.credentials.yaml`, hot-effective without restarts) and then force-refreshes that provider; the form can also clear a stored file-layer credential in one click. If a process environment variable is currently shadowing that name, the host refuses the write (credential-store contract) — change the environment variable itself instead
 - Anti-rate-limit pacing is enforced by the host: successful results are cached for 60 seconds (shared across tabs), failures back off exponentially (30 s doubling, capped at 15 minutes), upstream timeout is 15 s; the panel can set auto query to manual only / 1 / 2 / 5 / 10 minutes (manual only by default), paused automatically while the page is hidden
 - API keys are resolved and used only inside the host process — the browser receives normalized percentages only; data flows through the plugin's own loopback RPC with no webServer routes exposed
 

package/README.md

@@ -38,7 +38,7 @@
 
 - 近 7 天输入/输出/缓存 token 堆叠柱图，蓝/橙/青图例
 - 按项目筛选，鼠标悬停显示精确数值
-- 模型明细为横向堆叠柱形图（沿用主图图例配色），按 token 总量从多到少排序；每行附「x次 · 缓存命中 x% · 输入 xM token · 输出 xM token」明细
+- 模型明细为横向堆叠柱形图（沿用主图图例配色），列表头部右侧提供「今日 / 近 7 天 / 累计」切换标签（默认近 7 天）：今日只聚合当天，近 7 天按主图同窗口排序，累计覆盖索引内全部日期（受会话持久化留存范围限制）；每行附「x次 · 缓存命中 x% · 输入 xM token · 输出 xM token」明细
 - 提供方未上报 token 用量的模型步骤不纳入统计
 - 最近 24 小时模型/工具报错统计，默认折叠
 
@@ -48,6 +48,8 @@
 - 对话输入框内一枚额度圆环，跟随当前会话所选模型的供应商，显示最紧预算窗口的已用百分比（<80% 绿色、≥80% 黄色）；点击弹出面板——头部标明供应商，各窗口带独立进度条与已用百分比、重置时间单独一行；手机等窄屏上面板自动切换为视口居中的浮层（完整可见、超高时内部滚动），旋转或拖宽窗口即时切回圆环上方锚定
 - 可在「额度查询」标签开启「设置页左列显示入口」开关（默认关闭），开启后在设置页左侧标签列底部显示「额度查询」快捷入口（与「重启」入口同模式）
 - 内置适配：**OpenCode Go**（`{baseURL}/usage`）、**智谱 GLM Coding Plan / zai-coding-cn**（官方监控端点 `quota/limit`，含 5 小时滚动 Token、每周 Token、MCP 月度配额三个窗口，5 小时窗口空闲时与官网一致地不显示重置时间）、**OpenRouter**（credits 已用%）、**Kimi/Moonshot** 与 **硅基流动**（人民币余额）；原生报「剩余百分比」的方言会自动把面板头部切换为「剩余」并把预警阈值反向；上游瞬时网络错误自动重试，智谱双域候选链自动切换；供应商与适配类型的对应关系保存在 `DSH_HOME/dsh-service-quota.json`，已知服务商按 baseURL 自动识别适配（如 opencode.ai、bigmodel.cn），无需手选；未适配或已停用的供应商不会被发起任何上游请求，停用可在卡片脚部选「停用查询」或在配置文件写 `"<provider>": null`（两者等价）。智谱的重置卡暂无 API Key 可查的接口，可在「额度查询」标签内点各供应商卡片的「添加重置卡」填写名称与到期时间（可精确到分钟），可连续添加多条、每条独立移除；圆环面板同步显示（数据存入同一配置文件），过期自动标注
+- **CLIProxyAPI 账号额度（cliproxy）**：查询 CLIProxyAPI（CPA）部署内各 OAuth 上游账号的**官方剩余额度**（Codex 的 5 小时/本周窗口、GeminiCLI 与 Antigravity 的各模型配额），而不是代理 key 的用量。前置条件：CPA 配置 `remote-management.secret-key` 非空（为空时管理面整体不可用）、远程访问需开启 `allow-remote-management`；管理密钥放入 DSH 凭据库 `CPA_MANAGEMENT_KEY` 或同名环境变量——它与代理用的 API key 相互独立，插件绝不会把代理 key 发往管理面。在「手动适配」中选择「CLIProxyAPI 账号额度」保存时，插件会把该供应商 settings baseURL 的域名钉进配置文件，此后外呼只发往这个域（修改 baseURL 后需重新保存适配）；单次刷新最多查询 8 个账号（已禁用或无受支持配额端点的账号自动跳过），部分账号失败不影响其余账号的结果。请注意 CPA 管理面对错误密钥有内建封禁（连续错 5 次封 IP 30 分钟），务必填对再测
+- 凭据填写窗口：已适配供应商因缺凭据显示「凭据未配置」时，卡片上会出现**「填写 API 密钥」**内联表单——凭据名称由宿主按适配类型派生白名单（CLIProxyAPI 只会出现 `CPA_MANAGEMENT_KEY`/`CLIPROXY_MANAGEMENT_KEY`——两者是同一密钥的**别名存放槽，二选一即可**，查找按顺序取第一个已配置的值；主名带「主名」标记且表单默认选中已配置的槽位。绝不混入代理 key），输入密钥值保存即写入 DSH 凭据提供方（`$DSH_HOME/.credentials.yaml` 的 `refs:` 分节，热生效无需重启），随后自动强制重拉该供应商；表单里还能一键清除已存的文件层凭据。进程环境变量正在遮蔽该名字时宿主会拒绝写入（凭据库契约），此时请改环境变量本身
 - 防风控节律由宿主统一控制：成功结果缓存 60 秒（多标签共享）、失败指数退避（30 秒起 ×2、封顶 15 分钟）、上游超时 15 秒；面板可把自动查询调成仅手动 / 1 / 2 / 5 / 10 分钟（默认仅手动），页面不可见时自动暂停
 - API key 只在宿主进程内解析使用，浏览器只会收到归一化后的百分比数字；数据走插件自有 loopback RPC，不在 webServer 上暴露任何路由
 

package/client.js

@@ -313,8 +313,15 @@ window.__ModuleLoader__.load({
       'usage.axis': 'token 纵轴',
       'usage.models.more': '展开其余 {count} 个模型',
       'usage.models.less': '收起模型列表',
-      'usage.modelSortHint': '按 token 总量从多到少排列',
-      'usage.modelBar': '{model}：共 {total} token',
+      'usage.modelScope.today': '今日',
+      'usage.modelScope.week': '近 7 天',
+      'usage.modelScope.all': '累计',
+      'usage.modelSortHint.today': '按今日 token 从多到少排列',
+      'usage.modelSortHint.week': '按近 7 天 token 从多到少排列',
+      'usage.modelSortHint.all': '按累计 token 从多到少排列',
+      'usage.modelBar.today': '{model}：今日 {total} token',
+      'usage.modelBar.week': '{model}：近 7 天 {total} token',
+      'usage.modelBar.all': '{model}：累计 {total} token',
       'usage.refresh': '刷新统计',
       'usage.refreshing': '刷新中…',
       'usage.empty': '尚未建立使用统计索引。点击刷新统计开始只读建立索引。',
@@ -374,6 +381,10 @@ window.__ModuleLoader__.load({
       'quota.window.balance': '余额',
       'quota.window.weekly': '本周',
       'quota.window.monthly': '本月',
+      'quota.window.codex-5h': 'Codex 5 小时窗',
+      'quota.window.codex-day': 'Codex 日窗口',
+      'quota.window.codex-week': 'Codex 本周窗',
+      'quota.window.codex-month': 'Codex 本月窗口',
       'quota.panel.title': '额度用量',
       'quota.panel.used': '已用',
       'quota.panel.remaining': '剩余',
@@ -399,6 +410,7 @@ window.__ModuleLoader__.load({
       'quota.kind.openrouter': 'OpenRouter',
       'quota.kind.kimi': 'Kimi / Moonshot',
       'quota.kind.siliconflow': '硅基流动',
+      'quota.kind.cliproxy': 'CLIProxyAPI 账号额度',
       'quota.kindAuto': '自动识别',
       'quota.noAdapted': '暂无已适配的供应商，可在下方手动适配',
       'quota.disable': '停用查询',
@@ -416,6 +428,22 @@ window.__ModuleLoader__.load({
       'quota.error.network-transient': '网络不稳定（已自动重试）',
       'quota.error.timeout': '请求超时',
       'quota.error.bad-payload': '响应格式异常',
+      'quota.error.mgmt-disabled': 'CLIProxyAPI 管理面未启用（未设置 remote-management secret-key）',
+      'quota.error.host-not-pinned': 'baseURL 与适配时记录的域名不一致，请重新保存适配',
+      'quota.error.upstream-status': '上游官方接口返回错误状态',
+      'quota.credential.edit': '填写 API 密钥',
+      'quota.credential.nameLabel': '凭据名称',
+      'quota.credential.valueLabel': '密钥值',
+      'quota.credential.save': '保存',
+      'quota.credential.primary': '主名（别名存一即可）',
+      'quota.credential.clear': '清除已存',
+      'quota.credential.clearConfirm': '再次点击清除',
+      'quota.credential.configured': '已配置',
+      'quota.credential.notConfigured': '未配置',
+      'quota.credential.saveFailed': '凭据保存失败：{error}',
+      'quota.credential.unknown-hint': '未知凭据名',
+      'quota.credential.invalid-value': '密钥值不能为空',
+      'quota.credential.credentials-unavailable': '凭据服务不可用',
       'quota.error.unknown': '未知错误',
       'quota.unadapted': '该供应商未适配，请先在下方选择类型',
       'quota.unit.day': '{count} 天',
@@ -727,8 +755,15 @@ window.__ModuleLoader__.load({
       'usage.axis': 'token vertical axis',
       'usage.models.more': 'Show {count} more models',
       'usage.models.less': 'Collapse model list',
-      'usage.modelSortHint': 'Sorted by total tokens, largest first',
-      'usage.modelBar': '{model}: {total} tokens in total',
+      'usage.modelScope.today': 'Today',
+      'usage.modelScope.week': 'Last 7 days',
+      'usage.modelScope.all': 'All time',
+      'usage.modelSortHint.today': 'Sorted by tokens used today, largest first',
+      'usage.modelSortHint.week': 'Sorted by tokens in the last 7 days, largest first',
+      'usage.modelSortHint.all': 'Sorted by all-time tokens, largest first',
+      'usage.modelBar.today': '{model}: {total} tokens today',
+      'usage.modelBar.week': '{model}: {total} tokens in the last 7 days',
+      'usage.modelBar.all': '{model}: {total} tokens in total',
       'usage.refresh': 'Refresh usage',
       'usage.refreshing': 'Refreshing…',
       'usage.empty': 'No usage index yet. Select Refresh usage to build the read-only index.',
@@ -788,6 +823,10 @@ window.__ModuleLoader__.load({
       'quota.window.balance': 'Balance',
       'quota.window.weekly': 'This week',
       'quota.window.monthly': 'This month',
+      'quota.window.codex-5h': 'Codex 5-hour window',
+      'quota.window.codex-day': 'Codex daily window',
+      'quota.window.codex-week': 'Codex weekly window',
+      'quota.window.codex-month': 'Codex monthly window',
       'quota.panel.title': 'Quota usage',
       'quota.panel.used': 'Used',
       'quota.panel.remaining': 'Remaining',
@@ -813,6 +852,7 @@ window.__ModuleLoader__.load({
       'quota.kind.openrouter': 'OpenRouter',
       'quota.kind.kimi': 'Kimi / Moonshot',
       'quota.kind.siliconflow': 'SiliconFlow',
+      'quota.kind.cliproxy': 'CLIProxyAPI accounts',
       'quota.kindAuto': 'Auto-detected',
       'quota.noAdapted': 'No adapted providers yet — adapt manually below',
       'quota.disable': 'Disable',
@@ -830,6 +870,22 @@ window.__ModuleLoader__.load({
       'quota.error.network-transient': 'Unstable network (auto-retried)',
       'quota.error.timeout': 'Request timed out',
       'quota.error.bad-payload': 'Unexpected response format',
+      'quota.error.mgmt-disabled': 'CLIProxyAPI management API disabled (remote-management secret-key not set)',
+      'quota.error.host-not-pinned': 'baseURL differs from the domain recorded when adapting; save the adapter again',
+      'quota.error.upstream-status': 'Upstream official API returned an error status',
+      'quota.credential.edit': 'Set API credential',
+      'quota.credential.nameLabel': 'Credential name',
+      'quota.credential.valueLabel': 'Secret value',
+      'quota.credential.save': 'Save',
+      'quota.credential.primary': 'primary (one alias is enough)',
+      'quota.credential.clear': 'Clear stored',
+      'quota.credential.clearConfirm': 'Click again to clear',
+      'quota.credential.configured': 'configured',
+      'quota.credential.notConfigured': 'not set',
+      'quota.credential.saveFailed': 'Failed to save credential: {error}',
+      'quota.credential.unknown-hint': 'Unknown credential name',
+      'quota.credential.invalid-value': 'Secret value must not be empty',
+      'quota.credential.credentials-unavailable': 'Credential service unavailable',
       'quota.error.unknown': 'Unknown error',
       'quota.unadapted': 'Not adapted: pick a provider kind below first',
       'quota.unit.day': '{count} d',
@@ -1615,7 +1671,7 @@ window.__ModuleLoader__.load({
       const QUOTA_POLL_KEY = 'dsh-service-quota-poll'
       const QUOTA_POLL_CHOICES = [0, 1, 2, 5, 10]
       // 适配类型下拉选项：与宿主 QUOTA_KINDS 白名单保持一致（词典键 quota.kind.<kind>）。
-      const QUOTA_KIND_OPTIONS = ['opencode-go', 'zai-coding-cn', 'openrouter', 'kimi', 'siliconflow']
+      const QUOTA_KIND_OPTIONS = ['opencode-go', 'zai-coding-cn', 'openrouter', 'kimi', 'siliconflow', 'cliproxy']
       function readQuotaPollMinutes() {
         try {
           const raw = Number.parseInt(localStorage.getItem(QUOTA_POLL_KEY), 10)
@@ -1777,6 +1833,25 @@ window.__ModuleLoader__.load({
         const byType = translate(`quota.window.${prefix}`)
         return byType === `quota.window.${prefix}` ? id : byType
       }
+      /** 窗口展示文案（v0.24 cliproxy 起支持两段式）：宿主下发 label（账号标识，纯数据）与
+       * kindKey（稳定代码），本地化拼接「<账号> · <窗口名>」在客户端完成——宿主不拼用户可见句子
+       * （双语教义）。无 kindKey 的旧窗口走 quotaWindowLabel 原解析链；kindKey 未收录时裸用
+       * 模型名兜底（比拼凑 id 可读）。 */
+      function quotaWindowDisplayLabel(window, translate) {
+        const hasKindKey = typeof window.kindKey === 'string' && window.kindKey !== ''
+        const kindSource = hasKindKey ? window.kindKey : window.id
+        let kindText = translate(`quota.window.${kindSource}`)
+        if (kindText === `quota.window.${kindSource}`) {
+          if (hasKindKey) {
+            const byId = translate(`quota.window.${window.id}`)
+            kindText = byId !== `quota.window.${window.id}` ? byId : kindSource
+          } else {
+            kindText = quotaWindowLabel(window.id, translate)
+          }
+        }
+        const account = typeof window.label === 'string' ? window.label.trim() : ''
+        return account !== '' ? `${account} · ${kindText}` : kindText
+      }
       function humanizeDuration(ms, translate) {
         // 官网口径：取最显着的两个非零单位（28 天 22 小时 / 4 小时 1 分钟），不足 1 分钟显示 0 分钟。
         const totalMinutes = Math.max(0, Math.floor(ms / 60000))
@@ -1846,16 +1921,19 @@ window.__ModuleLoader__.load({
        * testid 约定：面板 quota-text|quota-window-bar|quota-reset-<id>；卡片 quota-card-window|bar|text|reset-<provider>-<id>。 */
       function renderQuotaWindowRow(window, translate, provider) {
         const inCard = provider !== null && provider !== undefined
+        // 标签可能很长（cliproxy 是「账号 · 窗口名」两段式）：标签溢出省略，百分比整体不换行、不被挤压。
+        const labelStyle = { color: 'var(--dsw-alias-label-secondary)', minWidth: 0, overflow: 'hidden', textOverflow: 'ellipsis', whiteSpace: 'nowrap' }
+        const valueStyle = { color: 'var(--dsw-alias-label-primary)', fontWeight: 500, fontVariantNumeric: 'tabular-nums', whiteSpace: 'nowrap', flexShrink: 0 }
         if (typeof window.text === 'string') {
           return React.createElement('div', {
             key: window.id,
             ...(inCard ? { 'data-testid': `quota-card-window-${provider}-${window.id}` } : {}),
             style: { display: 'flex', justifyContent: 'space-between', gap: '10px', fontSize: '12px', lineHeight: '18px' },
           },
-          React.createElement('span', { style: { color: 'var(--dsw-alias-label-secondary)' } }, quotaWindowLabel(window.id, translate)),
+          React.createElement('span', { style: labelStyle }, quotaWindowDisplayLabel(window, translate)),
           React.createElement('span', {
             'data-testid': inCard ? `quota-card-text-${provider}-${window.id}` : `quota-text-${window.id}`,
-            style: { color: 'var(--dsw-alias-label-primary)', fontWeight: 500, fontVariantNumeric: 'tabular-nums' },
+            style: valueStyle,
           }, window.text))
         }
         let resetNode = null
@@ -1873,8 +1951,8 @@ window.__ModuleLoader__.load({
           ...(inCard ? { 'data-testid': `quota-card-window-${provider}-${window.id}` } : {}),
         },
         React.createElement('div', { 'data-value': window.percent, style: { display: 'flex', justifyContent: 'space-between', gap: '10px', fontSize: '12px', lineHeight: '18px' } },
-          React.createElement('span', { style: { color: 'var(--dsw-alias-label-secondary)' } }, quotaWindowLabel(window.id, translate)),
-          React.createElement('span', { style: { color: 'var(--dsw-alias-label-primary)', fontWeight: 500, fontVariantNumeric: 'tabular-nums' } }, `${window.percent}%`)),
+          React.createElement('span', { style: labelStyle }, quotaWindowDisplayLabel(window, translate)),
+          React.createElement('span', { style: valueStyle }, `${window.percent}%`)),
         quotaBar(inCard ? `quota-card-bar-${provider}-${window.id}` : `quota-window-bar-${window.id}`, window.percent, '4px', window.remaining === true),
         resetNode)
       }
@@ -2546,6 +2624,63 @@ window.__ModuleLoader__.load({
           setCardEditor({ provider: row.provider })
           setCardDraft({ expiresAt: '', label: '' })
         }
+        // 凭据填写窗口（v0.24）：未配置行的「填写 API 密钥」内联表单；宿主写入凭据库后立即强制
+        // 重拉该 provider（清退避闸），密钥值只随保存请求发出、绝不回显。
+        const [credEditor, setCredEditor] = useState(null)
+        const [credDraft, setCredDraft] = useState({ name: '', value: '' })
+        // 清除已存凭据的两段式确认武装态（skill 开关同款）：3 秒无第二击自动复位。
+        const [credClearArmed, setCredClearArmed] = useState(false)
+        useEffect(() => {
+          if (!credClearArmed) return undefined
+          const handle = setTimeout(() => setCredClearArmed(false), 3000)
+          return () => clearTimeout(handle)
+        }, [credClearArmed])
+        const closeCredEditor = () => {
+          setCredEditor(null)
+          setCredDraft({ name: '', value: '' })
+          setCredClearArmed(false)
+        }
+        const openCredEditor = (row) => {
+          const hints = Array.isArray(row.credentialHints) ? row.credentialHints : []
+          // 默认选中「已配置」的那个槽位（别名链里可能已有生效值）；全空才落回主名。
+          setCardEditor(null)
+          setCredEditor({ provider: row.provider })
+          setCredDraft({ name: (hints.find((hint) => hint.configured === true) ?? hints[0])?.name ?? '', value: '' })
+          setCredClearArmed(false)
+        }
+        const credentialFailCopy = (res) => {
+          const code = String(res?.error ?? '')
+          const known = ['unknown-hint', 'invalid-value', 'credentials-unavailable']
+          const reason = known.includes(code) ? translate(`quota.credential.${code}`) : `${code}${res?.detail ? ` (${res.detail})` : ''}`
+          return translate('quota.credential.saveFailed', { error: reason })
+        }
+        const saveCredential = async (providerName) => {
+          setConfigError('')
+          try {
+            const res = await ctx.connection.rpc.call('/dsh-service', 'quota-credential-set', { provider: providerName, name: credDraft.name, value: credDraft.value })
+            if (res?.ok !== true) {
+              setConfigError(credentialFailCopy(res))
+              return
+            }
+            closeCredEditor()
+            await refreshProvider(providerName)
+          } catch (_) {
+            setConfigError(translate('quota.saveFailed', { error: 'network' }))
+          }
+        }
+        const clearCredential = async (providerName, name) => {
+          setConfigError('')
+          try {
+            const res = await ctx.connection.rpc.call('/dsh-service', 'quota-credential-unset', { provider: providerName, name })
+            if (res?.ok !== true) {
+              setConfigError(credentialFailCopy(res))
+              return
+            }
+            await refreshProvider(providerName)
+          } catch (_) {
+            setConfigError(translate('quota.saveFailed', { error: 'network' }))
+          }
+        }
         const saveResetCard = async () => {
           if (cardEditor === null) return
           setConfigError('')
@@ -2727,6 +2862,49 @@ window.__ModuleLoader__.load({
                           ? React.createElement('span', { style: { fontSize: '11px', color: 'var(--dsw-alias-label-tertiary)' } }, translate('quota.updated', { time: formatClockTime(row.fetchedAt) }))
                           : null)),
                     body,
+                    ...(row.status === 'unconfigured' && Array.isArray(row.credentialHints) && row.credentialHints.length > 0
+                      ? (() => {
+                          const editingCred = credEditor !== null && credEditor.provider === row.provider
+                          const hints = row.credentialHints
+                          const selectedName = hints.some((hint) => hint.name === credDraft.name) ? credDraft.name : (hints[0]?.name ?? '')
+                          const selectedHint = hints.find((hint) => hint.name === selectedName)
+                          return [editingCred
+                            ? React.createElement('div', { key: 'cred-editor', 'data-testid': `quota-cred-editor-${row.provider}`, style: { display: 'flex', flexWrap: 'wrap', gap: '10px', alignItems: 'flex-end', padding: '8px 10px', borderRadius: '8px', background: 'var(--dsw-alias-bg-layer-2)' } },
+                                hints.length > 1
+                                  ? React.createElement('label', { style: { display: 'flex', flexDirection: 'column', gap: '2px', fontSize: '11px', color: 'var(--dsw-alias-label-secondary)' } },
+                                      translate('quota.credential.nameLabel'),
+                                      React.createElement('select', {
+                                        'data-testid': 'quota-cred-name-select',
+                                        value: selectedName,
+                                        onChange: (event) => { setCredDraft({ ...credDraft, name: event.target.value }); setCredClearArmed(false) },
+                                        style: quotaSelectStyle,
+                                      },
+                                      // 别名链说明：多个名字是同一密钥的备用存放槽（发现按序取第一个已配置的值），主名带「主名」标记。
+                                      hints.map((hint, hintIndex) => React.createElement('option', { key: hint.name, value: hint.name }, `${hint.name}${hintIndex === 0 ? ` · ${translate('quota.credential.primary')}` : ''} · ${hint.configured === true ? translate('quota.credential.configured') : translate('quota.credential.notConfigured')}`))))
+                                  : React.createElement('span', { style: { fontSize: '11px', color: 'var(--dsw-alias-label-tertiary)', alignSelf: 'center' } }, `${selectedName}${selectedHint?.configured === true ? ` · ${translate('quota.credential.configured')}` : ''}`),
+                                React.createElement('label', { style: { display: 'flex', flexDirection: 'column', gap: '2px', fontSize: '11px', color: 'var(--dsw-alias-label-secondary)' } },
+                                  translate('quota.credential.valueLabel'),
+                                  React.createElement('input', {
+                                    type: 'password',
+                                    'data-testid': 'quota-cred-input-value',
+                                    value: credDraft.value,
+                                    onChange: (event) => setCredDraft({ ...credDraft, value: event.target.value }),
+                                    autoComplete: 'off',
+                                    style: inputStyle,
+                                  })),
+                                React.createElement('button', { type: 'button', 'data-testid': 'quota-cred-save', onClick: () => saveCredential(row.provider), disabled: credDraft.value.trim() === '', style: { minHeight: '28px', padding: '4px 12px', borderRadius: '7px', border: '1px solid var(--dsw-alias-brand-primary)', background: credDraft.value.trim() === '' ? 'transparent' : 'var(--dsw-alias-brand-primary)', color: credDraft.value.trim() === '' ? 'var(--dsw-alias-label-tertiary)' : '#fff', cursor: credDraft.value.trim() === '' ? 'default' : 'pointer', fontSize: '12px' } }, translate('quota.credential.save')),
+                                ...(selectedHint?.configured === true && selectedHint?.writable !== false ? [React.createElement('button', { type: 'button', key: 'cred-clear', 'data-testid': 'quota-cred-clear', title: credClearArmed ? translate('quota.credential.clearConfirm') : undefined, onClick: () => { if (!credClearArmed) { setCredClearArmed(true); return } setCredClearArmed(false); void clearCredential(row.provider, selectedName) }, style: { minHeight: '28px', padding: '4px 12px', borderRadius: '7px', border: '1px solid var(--dsw-alias-state-error-primary)', background: credClearArmed ? 'var(--dsw-alias-state-error-primary)' : 'transparent', color: credClearArmed ? '#fff' : 'var(--dsw-alias-state-error-primary)', cursor: 'pointer', fontSize: '12px', whiteSpace: 'nowrap' } }, translate(credClearArmed ? 'quota.credential.clearConfirm' : 'quota.credential.clear'))] : []),
+                                React.createElement('button', { type: 'button', 'data-testid': 'quota-cred-cancel', onClick: closeCredEditor, style: { minHeight: '28px', padding: '4px 12px', borderRadius: '7px', border: '1px solid var(--dsw-alias-border-l2)', background: 'transparent', color: 'var(--dsw-alias-label-secondary)', cursor: 'pointer', fontSize: '12px' } }, translate('quota.resetCard.cancel')),
+                              )
+                            : React.createElement('div', { key: 'cred-entry', style: { display: 'flex' } },
+                                React.createElement('button', {
+                                  type: 'button',
+                                  'data-testid': `quota-cred-edit-${row.provider}`,
+                                  onClick: () => openCredEditor(row),
+                                  style: { fontSize: '12px', lineHeight: '20px', padding: '4px 14px', borderRadius: 999, border: '1px solid var(--dsw-alias-brand-primary)', background: 'transparent', color: 'var(--dsw-alias-brand-primary)', cursor: 'pointer', width: 'auto', minWidth: 0, overflow: 'visible', flex: '0 0 auto', whiteSpace: 'nowrap' },
+                                }, translate('quota.credential.edit')))]
+                        })()
+                      : []),
                     ...resetCardNodes,
                     ...(editingThis ? [React.createElement('div', { key: 'reset-editor', 'data-testid': `quota-reset-editor-${row.provider}`, style: { display: 'flex', flexWrap: 'wrap', gap: '10px', alignItems: 'flex-end', padding: '8px 10px', borderRadius: '8px', background: 'var(--dsw-alias-bg-layer-2)' } },
                       resetField(translate('quota.resetCard.dateLabel'), 'quota-reset-input-date', 'datetime-local', 'expiresAt'),
@@ -2820,6 +2998,8 @@ window.__ModuleLoader__.load({
         const [modelErrorsOpen, setModelErrorsOpen] = useState(false)
         const [toolErrorsOpen, setToolErrorsOpen] = useState(false)
         const [modelsOpen, setModelsOpen] = useState(false)
+        // 模型列表口径：today=仅今日 / week=近 7 天（默认，保持既有视图）/ all=宿主索引内全部日期累计。
+        const [modelScope, setModelScope] = useState('week')
         const [activeTab, setActiveTab] = useState('overview')
         // 版本详情行内展开（不用浮层：弹层会被设置模态盖住）
         const [channelOpen, setChannelOpen] = useState(false)
@@ -3152,6 +3332,8 @@ window.__ModuleLoader__.load({
         const tabPanel = { padding: '14px 2px 2px', color: 'var(--dsw-alias-label-primary)' }
         const inlineTab = { background: 'transparent', color: 'var(--dsw-alias-label-secondary)', border: 0, borderBottom: '2px solid transparent', padding: '8px 10px', cursor: 'pointer', fontSize: '13px', fontWeight: 550, transition: 'color 120ms, border-color 120ms' }
         const inlineTabActive = { color: 'var(--dsw-alias-brand-primary)', borderBottom: '2px solid var(--dsw-alias-brand-primary)', fontWeight: 700 }
+        // 模型列表头部的紧凑口径切换：沿用下划线标签语言，但按 11px 行高缩比。
+        const compactTab = Object.assign({}, inlineTab, { padding: '3px 6px', fontSize: '11px' })
         const sectionTitle = { fontSize: '14px', fontWeight: 700, margin: '0 0 8px', color: 'var(--dsw-alias-label-primary)' }
 
         const formatSize = (bytes) => {
@@ -3242,23 +3424,34 @@ window.__ModuleLoader__.load({
         const selectedProjects = usageProject === 'all'
           ? (usage?.projects || []).map((project) => project.id)
           : [usageProject]
-        const modelTotals = new Map()
-        for (const day of usageDays) {
-          const source = usage?.days?.[day.key]
-          if (!source) continue
+        const emptyModelTotals = (id) => ({ id, steps: 0, inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0 })
+        const accumulateModelTotals = (buckets, model) => {
+          const existing = buckets.get(model.id) || emptyModelTotals(model.id)
+          existing.steps += model.totals.steps || 0
+          existing.inputTokens += model.totals.inputTokens || 0
+          existing.outputTokens += model.totals.outputTokens || 0
+          existing.cacheReadTokens += model.totals.cacheReadTokens || 0
+          existing.cacheWriteTokens += model.totals.cacheWriteTokens || 0
+          buckets.set(model.id, existing)
+        }
+        const modelTodayTotals = new Map()
+        const modelWeekTotals = new Map()
+        const modelAllTotals = new Map()
+        const weekDayKeys = new Set(usageDays.map((day) => day.key))
+        const todayDayKey = usageDays[usageDays.length - 1].key
+        // 累计口径遍历宿主下发的全部日期键（可早于 7 天窗口）；周/今日按窗口命中累积。
+        for (const [dayKey, source] of Object.entries(usage?.days || {})) {
+          const targets = [modelAllTotals]
+          if (weekDayKeys.has(dayKey)) targets.push(modelWeekTotals)
+          if (dayKey === todayDayKey) targets.push(modelTodayTotals)
           for (const project of source.projects) {
             if (!selectedProjects.includes(project.id)) continue
             for (const model of project.models) {
-              const existing = modelTotals.get(model.id) || { id: model.id, steps: 0, inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0 }
-              existing.steps += model.totals.steps || 0
-              existing.inputTokens += model.totals.inputTokens || 0
-              existing.outputTokens += model.totals.outputTokens || 0
-              existing.cacheReadTokens += model.totals.cacheReadTokens || 0
-              existing.cacheWriteTokens += model.totals.cacheWriteTokens || 0
-              modelTotals.set(model.id, existing)
+              for (const buckets of targets) accumulateModelTotals(buckets, model)
             }
           }
         }
+        const scopedModelTotals = modelScope === 'today' ? modelTodayTotals : modelScope === 'all' ? modelAllTotals : modelWeekTotals
         const diagnosticDetail = (check) => {
           const detail = String(check.detail ?? '')
           if (check.id === 'session-storage' && check.status === 'ok') return translate('health.detail.session-storage.ok', { count: detail })
@@ -3297,7 +3490,7 @@ window.__ModuleLoader__.load({
             React.createElement('span', { style: { color: 'var(--dsw-alias-label-secondary)' } }, translate(label)),
             React.createElement('span', { style: { fontWeight: 650 } }, value)))
         )
-        const sortedModels = [...modelTotals.values()].sort((a, b) => modelTotalTokens(b) - modelTotalTokens(a) || b.steps - a.steps || a.id.localeCompare(b.id))
+        const sortedModels = [...scopedModelTotals.values()].sort((a, b) => modelTotalTokens(b) - modelTotalTokens(a) || b.steps - a.steps || a.id.localeCompare(b.id))
         const visibleModels = modelsOpen ? sortedModels : sortedModels.slice(0, 3)
         const hiddenModelCount = Math.max(0, sortedModels.length - 3)
         const maxModelTokens = Math.max(1, ...visibleModels.map((model) => modelTotalTokens(model)))
@@ -3360,7 +3553,15 @@ window.__ModuleLoader__.load({
                   summaryBlock('today', 'usage.today', todayTotals),
                   summaryBlock('seven', 'usage.sevenDays', sevenTotals)),
                 React.createElement('div', { 'data-testid': 'usage-model-list', style: { marginTop: '10px', padding: '8px 10px', borderRadius: '8px', background: 'var(--dsw-alias-bg-layer-2)', border: '1px solid var(--dsw-alias-border-l1)' } },
-                  React.createElement('div', { style: { fontSize: '11px', color: 'var(--dsw-alias-label-secondary)', marginBottom: '4px' } }, translate('usage.modelSortHint')),
+                  React.createElement('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center', gap: '8px', flexWrap: 'wrap', marginBottom: '4px' } },
+                    React.createElement('div', { 'data-testid': 'usage-model-sort-hint', style: { fontSize: '11px', color: 'var(--dsw-alias-label-secondary)' } }, translate(`usage.modelSortHint.${modelScope}`)),
+                    React.createElement('div', { 'data-testid': 'usage-model-scope-tabs', style: { display: 'flex', gap: '2px' } },
+                      ['today', 'week', 'all'].map((scopeId) => React.createElement('button', {
+                        key: scopeId,
+                        'data-testid': `usage-model-scope-${scopeId}`,
+                        style: Object.assign({}, compactTab, modelScope === scopeId ? inlineTabActive : { color: 'var(--dsw-alias-label-secondary)', borderBottom: '2px solid transparent' }),
+                        onClick: () => setModelScope(scopeId),
+                      }, translate(`usage.modelScope.${scopeId}`))))),
                   visibleModels.map((model, index) => {
                     const total = modelTotalTokens(model)
                     const fillWidth = `${Math.round(total / maxModelTokens * 10000) / 100}%`
@@ -3368,7 +3569,7 @@ window.__ModuleLoader__.load({
                       React.createElement('div', { style: { display: 'flex', justifyContent: 'space-between', gap: '12px', alignItems: 'baseline', fontSize: '12px' } },
                         React.createElement('span', { style: { overflowWrap: 'anywhere' } }, model.id),
                         React.createElement('span', { style: { fontWeight: 650, whiteSpace: 'nowrap' } }, formatTokenValue(total))),
-                      React.createElement('div', { 'data-testid': `usage-model-bar-${model.id}`, 'data-value': total, 'aria-label': translate('usage.modelBar', { model: model.id, total: formatTokenValue(total) }), style: { height: '8px', borderRadius: '4px', marginTop: '6px', overflow: 'hidden', background: 'var(--dsw-alias-border-l1)' } },
+                      React.createElement('div', { 'data-testid': `usage-model-bar-${model.id}`, 'data-value': total, 'aria-label': translate(`usage.modelBar.${modelScope}`, { model: model.id, total: formatTokenValue(total) }), style: { height: '8px', borderRadius: '4px', marginTop: '6px', overflow: 'hidden', background: 'var(--dsw-alias-border-l1)' } },
                         React.createElement('div', { style: { display: 'flex', height: '100%', width: fillWidth } },
                           usageSegments.map(([metricName, , color]) => {
                             const value = modelSegmentValue(model, metricName)

package/index.js

@@ -107,6 +107,19 @@ const KIND_REGISTRY = {
     keyHints: ['SILICONFLOW_API_KEY'],
     hosts: ['siliconflow.cn'],
   },
+  // CLIProxyAPI（router-for-me/CLIProxyAPI）管理面：查它托管的 OAuth 上游账号官方额度。
+  // 无固定 endpoints / 全局 hosts——每个部署一个域名，保存适配时把 settings baseURL 的
+  // hostname 钉进配置 allowedHosts[provider]（见 quota-config 写入口），外呼前复验精确命中。
+  // managementPlane:true 表示凭据是 remote-management.secret-key（线索 CPA_MANAGEMENT_KEY），
+  // 绝不使用也不回退 settings 的 apiKeyEnv——那是代理 key，发去管理面等于拿错钥匙撞 fail2ban
+  // （CPA 内建：管理面错 key 满 5 次封 IP 30 分钟，源码核实）。
+  cliproxy: {
+    fetcher: fetchCliproxyUsage,
+    fetcherGuard: cliproxyFetchGuard,
+    keyHints: ['CPA_MANAGEMENT_KEY', 'CLIPROXY_MANAGEMENT_KEY'],
+    hosts: [],
+    managementPlane: true,
+  },
 }
 const QUOTA_KINDS = Object.keys(KIND_REGISTRY)
 const QUOTA_UPSTREAM_TIMEOUT_MS = 15000
@@ -125,6 +138,12 @@ const MAX_QUOTA_PROVIDER_NAME = 128
 const MAX_QUOTA_RESET_CARDS = 500
 const MAX_QUOTA_RESET_CARDS_PER_PROVIDER = 10
 const MAX_QUOTA_ERROR_DETAIL = 256
+// CLIProxyAPI 编排参数（v0.24）：账号数 / api-call 总次数（antigravity 候选 URL 也计入）/
+// 并发 / 窗口总数上限。数值只在此处与 TODO.md 里程碑两处出现。
+const MAX_QUOTA_CPA_ACCOUNTS = 8
+const MAX_QUOTA_CPA_CALLS = 12
+const QUOTA_CPA_CONCURRENCY = 3
+const MAX_QUOTA_CPA_WINDOWS = 32
 
 // 升级目标白名单：命令与包名全部来自宿主常量，浏览器不传任何输入。
 // TARGET_RE 与 dsh-market 同源：只放行「包名@版本」这一种形状的字符集。
@@ -559,7 +578,45 @@ async function saveUsageIndex(dshHome, index) {
 // ── 远端额度（v0.18）：kind 映射存取、方言解析、节流状态机 ─────────────
 
 function createEmptyQuotaConfig() {
-  return { version: QUOTA_CONFIG_VERSION, kinds: {}, resetCards: [] }
+  return { version: QUOTA_CONFIG_VERSION, kinds: {}, resetCards: [], allowedHosts: {} }
+}
+
+/** 钉住表主机名归一：小写、去尾点；拒绝 IP 字面量与非法形状。合法返回归一值，否则 undefined。 */
+function normalizeQuotaHostname(value) {
+  if (typeof value !== 'string') return undefined
+  const host = value.trim().toLowerCase().replace(/\.$/, '')
+  if (host.length === 0 || host.length > 253) return undefined
+  if (host.includes(':')) return undefined
+  // IP 字面量的全部数值编码一并拒收：getaddrinfo 对十六进制（0x7f000001 / 0x7f.0.0.1）、纯整数
+  // （2130706433）、八进制（0177.0.0.1）标签都会解析成 IP——「每个标签都是纯数字或 0x 十六进制」
+  // 即按 IP 对待；数字标签混在真域名里（如 127.0.0.1.nip.io）不受影响。
+  if (host.split('.').every((label) => /^(0x[0-9a-f]+|\d+)$/.test(label))) return undefined
+  if (!/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/.test(host)) return undefined
+  return host
+}
+
+/** 解析磁盘上的 allowedHosts（cliproxy 等「每部署一个域名」kind 的钉住表）：
+ * provider 键沿用 kinds 白名单形状，每家最多 4 条去重主机名；非法条目整键丢弃。 */
+function normalizeQuotaAllowedHosts(raw) {
+  if (typeof raw !== 'object' || raw === null) return {}
+  const out = {}
+  let count = 0
+  for (const [provider, hosts] of Object.entries(raw)) {
+    if (count >= MAX_QUOTA_PROVIDERS) break
+    if (typeof provider !== 'string' || provider.length === 0 || provider.length > MAX_QUOTA_PROVIDER_NAME) continue
+    if (!Array.isArray(hosts)) continue
+    const normalized = []
+    for (const candidate of hosts) {
+      if (normalized.length >= 4) break
+      const host = normalizeQuotaHostname(candidate)
+      if (host !== undefined && !normalized.includes(host)) normalized.push(host)
+    }
+    if (normalized.length > 0) {
+      out[provider] = normalized
+      count += 1
+    }
+  }
+  return out
 }
 
 /**
@@ -607,7 +664,7 @@ function parseQuotaConfigText(text) {
       kindCount += 1
     }
   }
-  return { version: QUOTA_CONFIG_VERSION, kinds, resetCards: normalizeResetCards(parsed.resetCards) }
+  return { version: QUOTA_CONFIG_VERSION, kinds, resetCards: normalizeResetCards(parsed.resetCards), allowedHosts: normalizeQuotaAllowedHosts(parsed.allowedHosts) }
 }
 
 async function loadQuotaConfig(dshHome) {
@@ -634,10 +691,15 @@ async function saveQuotaConfig(dshHome, config) {
 }
 
 function copyQuotaConfig(config) {
+  const allowedHosts = {}
+  for (const [provider, hosts] of Object.entries(config?.allowedHosts ?? {})) {
+    allowedHosts[provider] = Array.isArray(hosts) ? [...hosts] : []
+  }
   return {
     version: QUOTA_CONFIG_VERSION,
     kinds: { ...(config?.kinds ?? {}) },
     resetCards: Array.isArray(config?.resetCards) ? config.resetCards.map((card) => ({ ...card })) : [],
+    allowedHosts,
   }
 }
 
@@ -723,6 +785,41 @@ function inferQuotaKind(baseURL) {
   return hits.length === 1 ? hits[0][0] : undefined
 }
 
+/** 保存适配时的钉住派生（服务端从 settings baseURL 取值，浏览器零输入）：
+ * 仅接受 HTTPS、无 userinfo、默认端口、DNS 域名（拒 IP 字面量）；不合格返回 undefined。 */
+function cliproxyPinHostFromBaseURL(baseURL) {
+  let parsed
+  try { parsed = new URL(String(baseURL ?? '').trim()) } catch (_) { return undefined }
+  if (parsed.protocol !== 'https:' || parsed.username !== '' || parsed.password !== '') return undefined
+  if (parsed.port !== '' && parsed.port !== '443') return undefined
+  return normalizeQuotaHostname(parsed.hostname)
+}
+
+/**
+ * CLIProxyAPI 管理面 origin 守卫：baseURL 必须整体 HTTPS，且 hostname 与保存适配时
+ * 钉入 allowedHosts[provider] 的记录**精确相等**——不做子串/子域猜测，管理密钥只发往
+ * 用户钉过的那个域；settings 里改了 baseURL 就必须重新保存适配才恢复外呼。
+ * 返回规范化 origin（scheme://host[:443]，无路径）或 undefined。
+ */
+function safeCliproxyOrigin(baseURL, pinnedHosts) {
+  if (!Array.isArray(pinnedHosts) || pinnedHosts.length === 0) return undefined
+  let parsed
+  try { parsed = new URL(String(baseURL ?? '').trim()) } catch (_) { return undefined }
+  if (parsed.protocol !== 'https:' || parsed.username !== '' || parsed.password !== '') return undefined
+  if (parsed.port !== '' && parsed.port !== '443') return undefined
+  const host = normalizeQuotaHostname(parsed.hostname)
+  if (host === undefined || !pinnedHosts.includes(host)) return undefined
+  return parsed.origin
+}
+
+/** fetcher 类 kind 的外呼前置守卫：返回稳定错误码或 null（放行）。在解凭据之前跑，省一次凭据查找。 */
+function cliproxyFetchGuard(profile, config) {
+  const base = String(profile?.baseURL ?? '').trim()
+  if (base === '') return 'no-base-url'
+  const pinned = Array.isArray(config?.allowedHosts?.[profile.name]) ? config.allowedHosts[profile.name] : []
+  return safeCliproxyOrigin(base, pinned) === undefined ? 'host-not-pinned' : null
+}
+
 /**
  * 单个 provider 的 kind 解析（quota 与 quota-refresh 共用）。
  * 优先序：配置显式 kind > 配置 null（手动停用，永不外呼）> baseURL 自动推断；未命中返回空对象。
@@ -758,6 +855,22 @@ function normalizeResetTimestamp(value) {
   return new Date(n > 1e12 ? n : n * 1000).toISOString()
 }
 
+/**
+ * 凭据线索名清单（与发现链同一顺序）：settings 声明的 apiKeyEnv 在前、kind keyHints 殿后，去重。
+ * 凭据填写窗口（quota-credential-set/unset）只接受这份清单里的名字——零输入拼接：浏览器传来的
+ * 名字必须命中宿主派生的白名单，顺带保证 CredentialRef 文法（POSIX shell 标识符）合法。
+ */
+function quotaCredentialHintNames(kind, profile) {
+  const names = []
+  // 管理面 kind（cliproxy）的凭据独立于模型代理 key：settings 的 apiKeyEnv 指向代理 key，
+  // 发去管理面等于拿错钥匙撞 fail2ban（CPA 错 5 次封 IP 30 分钟）——不尝试、不回退。
+  if (KIND_REGISTRY[kind]?.managementPlane !== true && profile.apiKeyEnv !== '') names.push(profile.apiKeyEnv)
+  for (const name of KIND_REGISTRY[kind]?.keyHints ?? []) {
+    if (!names.includes(name)) names.push(name)
+  }
+  return names
+}
+
 /**
  * Key 发现链：settings 声明的 apiKeyEnv → DSH 凭据库按 kind 线索名 → 环境变量（含旧名兼容）。
  * 全部落空返回 undefined（调用方转为 credential-missing）；settings 显式声明了 apiKeyEnv
@@ -765,13 +878,7 @@ function normalizeResetTimestamp(value) {
  * 与「从未配置」的 credential-missing 区分。
  */
 async function discoverQuotaCredential(ctx, kind, profile) {
-  const hints = KIND_REGISTRY[kind]?.keyHints ?? []
-  const attempted = []
-  if (profile.apiKeyEnv !== '') attempted.push(profile.apiKeyEnv)
-  for (const name of hints) {
-    if (attempted.includes(name)) continue
-    attempted.push(name)
-  }
+  const attempted = quotaCredentialHintNames(kind, profile)
   const envHas = (name) => typeof process.env[name] === 'string' && process.env[name].trim() !== ''
   const credentials = ctx.get('credentials')
   if (credentials !== undefined && typeof credentials.resolve === 'function') {
@@ -859,6 +966,252 @@ function normalizeSiliconFlowInfo(payload) {
   return { windows: [{ id: 'balance', text: `¥${(Math.round(n * 100) / 100).toFixed(2)}` }] }
 }
 
+// ─── CLIProxyAPI（cliproxy）管理面编排 ──────────────────────────────────────
+// 上游官方额度端点注册表（经 CPA api-call 代调，header 的 $TOKEN$ 由 CPA 替换为对应账号凭据）。
+// 形状来源：muyouzhi6/astrbot_plugin_cliproxy_stats + CPA main 分支源码（2026-08 核实）；
+// 全部折算成统一「已用 %」口径（remainingFraction 类字段做纯 clamp，不做 ≤1 启发式——教训见 KNOWLEDGE.md）。
+const CLIPROXY_CODEX_USAGE_URL = 'https://chatgpt.com/backend-api/wham/usage'
+const CLIPROXY_GEMINI_QUOTA_URL = 'https://cloudcode-pa.googleapis.com/v1internal:retrieveUserQuota'
+const CLIPROXY_ANTIGRAVITY_QUOTA_URLS = [
+  'https://daily-cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels',
+  'https://daily-cloudcode-pa.sandbox.googleapis.com/v1internal:fetchAvailableModels',
+  'https://cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels',
+]
+const CLIPROXY_SUPPORTED_ACCOUNT_KINDS = new Set(['codex', 'gemini', 'gemini-cli', 'antigravity'])
+
+/** Codex 窗口长度 → 展示桶位代码：按上游下发的实际秒数判，绝不按 primary/secondary 位置猜
+ * （真实部署里主槽位完全可能就是周额度——2026-08-25 用户实测踩中）。 */
+function codexWindowCode(key, window) {
+  const seconds = Number(window.limit_window_seconds)
+  if (Number.isFinite(seconds) && seconds > 0) {
+    if (seconds <= 6 * 3600) return 'codex-5h'
+    if (seconds <= 24 * 3600) return 'codex-day'
+    if (seconds <= 8 * 24 * 3600) return 'codex-week'
+    return 'codex-month'
+  }
+  // 上游没带窗口长度时的位置兜底：primary 常见为短周期、secondary 为长周期。
+  return key === 'primary_window' ? 'codex-primary' : 'codex-secondary'
+}
+
+/** Codex wham/usage 的 rate_limit → 窗口（used_percent 已用口径；reset_at 为 unix 秒）。
+ * secondary_window 可为 null（真实上游行为）；窗口名由 limit_window_seconds 推导。 */
+function normalizeCodexRateLimit(rateLimit) {
+  const windows = []
+  if (rateLimit === null || typeof rateLimit !== 'object') return windows
+  for (const key of ['primary_window', 'secondary_window']) {
+    const window = rateLimit[key]
+    if (window === null || typeof window !== 'object') continue
+    const percent = normalizePercentValue(window.used_percent)
+    if (percent === null) continue
+    const code = codexWindowCode(key, window)
+    const resetsAt = normalizeResetTimestamp(window.reset_at)
+    windows.push({ id: code, kindKey: code, percent, ...(resetsAt !== undefined ? { resetsAt } : {}) })
+  }
+  // 已用多的排前面（与 gemini/antigravity 解析器同一关注序）。
+  return windows.sort((a, b) => b.percent - a.percent)
+}
+
+/** GeminiCLI retrieveUserQuota 的 buckets → 窗口（remainingFraction∈[0,1] 折算为已用 %）。 */
+function normalizeGeminiBuckets(buckets) {
+  const windows = []
+  if (!Array.isArray(buckets)) return windows
+  for (const bucket of buckets) {
+    if (bucket === null || typeof bucket !== 'object') continue
+    const modelId = typeof bucket.modelId === 'string' && bucket.modelId.trim() !== '' ? bucket.modelId.trim() : ''
+    const remaining = Number(bucket.remainingFraction)
+    if (modelId === '' || !Number.isFinite(remaining)) continue
+    const fraction = Math.max(0, Math.min(1, remaining))
+    const resetsAt = normalizeResetTimestamp(bucket.resetTime)
+    windows.push({
+      id: modelId.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '') || 'model',
+      kindKey: modelId,
+      percent: Math.round((1 - fraction) * 100),
+      ...(resetsAt !== undefined ? { resetsAt } : {}),
+    })
+  }
+  // 剩得最少的排前面（最值得关注）：已用 % 降序。
+  return windows.sort((a, b) => b.percent - a.percent)
+}
+
+/** Antigravity fetchAvailableModels 的 models{} → 窗口（quotaInfo.remainingFraction 折算已用 %）。 */
+function normalizeAntigravityModels(models) {
+  const windows = []
+  if (models === null || typeof models !== 'object') return windows
+  for (const [modelId, entry] of Object.entries(models)) {
+    if (entry === null || typeof entry !== 'object') continue
+    const info = entry.quotaInfo !== null && typeof entry.quotaInfo === 'object' ? entry.quotaInfo
+      : entry.quota_info !== null && typeof entry.quota_info === 'object' ? entry.quota_info : null
+    if (info === null) continue
+    const remaining = Number(info.remainingFraction ?? info.remaining_fraction)
+    if (!Number.isFinite(remaining)) continue
+    const fraction = Math.max(0, Math.min(1, remaining))
+    const resetsAt = normalizeResetTimestamp(info.resetTime ?? info.reset_time)
+    windows.push({
+      id: String(modelId).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '') || 'model',
+      kindKey: modelId,
+      percent: Math.round((1 - fraction) * 100),
+      ...(resetsAt !== undefined ? { resetsAt } : {}),
+    })
+  }
+  // 剩得最少的排前面（最值得关注）：已用 % 降序。
+  return windows.sort((a, b) => b.percent - a.percent)
+}
+
+/** api-call 信封解包：{status_code:int, body:string|object} → {statusCode, payload}。 */
+function unwrapCliproxyApiCallEnvelope(envelope) {
+  if (envelope === null || typeof envelope !== 'object') return { statusCode: 0, payload: null }
+  const rawStatus = Number(envelope.status_code)
+  let payload = envelope.body
+  if (typeof payload === 'string') {
+    try { payload = JSON.parse(payload) } catch (_) { payload = null }
+  }
+  if (payload === null || typeof payload !== 'object') payload = null
+  return { statusCode: Number.isFinite(rawStatus) ? rawStatus : 0, payload }
+}
+
+/** GeminiCLI project 提取：优先 auth-files 条目的 project_id 字段，回落文件名 gemini-{email}-{project}.json。 */
+function cliproxyProjectFor(entry) {
+  const direct = typeof entry?.project_id === 'string' ? entry.project_id.trim() : ''
+  if (direct !== '') return direct
+  const name = typeof entry?.name === 'string' ? entry.name.trim().replace(/\.json$/i, '') : ''
+  if (/^gemini-[^@]+@/.test(name)) {
+    const afterAt = name.slice(name.lastIndexOf('@') + 1)
+    const dash = afterAt.indexOf('-')
+    if (dash > 0 && dash + 1 < afterAt.length) return afterAt.slice(dash + 1)
+  }
+  return ''
+}
+
+/** auth-files 条目 → api-call 计划；不支持的类型或缺关键参数（如 project 推不出）返回 null 跳过。 */
+function buildCliproxyAccountPlan(entry) {
+  const provider = String(entry?.provider ?? entry?.type ?? '').toLowerCase()
+  if (!CLIPROXY_SUPPORTED_ACCOUNT_KINDS.has(provider)) return null
+  const baseHeaders = { Authorization: 'Bearer $TOKEN$', 'Content-Type': 'application/json' }
+  if (provider === 'codex') {
+    return { provider, calls: [{ method: 'GET', url: CLIPROXY_CODEX_USAGE_URL, header: baseHeaders, data: '' }] }
+  }
+  if (provider === 'antigravity') {
+    // 候选 URL 顺试到首个成功；每次尝试都计入 api-call 预算。
+    return {
+      provider,
+      calls: CLIPROXY_ANTIGRAVITY_QUOTA_URLS.map((url) => ({
+        method: 'POST',
+        url,
+        header: { ...baseHeaders, 'User-Agent': 'antigravity/1.11.5 windows/amd64' },
+        data: '{}',
+      })),
+    }
+  }
+  const project = cliproxyProjectFor(entry)
+  if (project === '') return null
+  return {
+    provider,
+    calls: [{ method: 'POST', url: CLIPROXY_GEMINI_QUOTA_URL, header: baseHeaders, data: JSON.stringify({ project }) }],
+  }
+}
+
+/** 按账号类型分发上游 payload 解析。 */
+function parseCliproxyUpstream(provider, payload) {
+  if (provider === 'codex') return normalizeCodexRateLimit(payload?.rate_limit)
+  if (provider === 'antigravity') {
+    const models = payload?.models
+    return models !== null && typeof models === 'object' ? normalizeAntigravityModels(models) : []
+  }
+  return normalizeGeminiBuckets(payload?.buckets)
+}
+
+/**
+ * CLIProxyAPI 编排：auth-files 列账号 → 小并发池逐账号 api-call 代调上游官方额度 → 合并窗口。
+ * 预算：账号 ≤8、api-call 总次数 ≤12、并发 3、窗口总数 ≤32；部分账号失败不拖垮整行
+ * （有成功窗口即返回），全部失败抛首个稳定错误码。守卫与凭据由 kickQuotaRefresh 先行完成。
+ */
+async function fetchCliproxyUsage({ profile, config, authorization, signal }) {
+  const pinned = Array.isArray(config?.allowedHosts?.[profile.name]) ? config.allowedHosts[profile.name] : []
+  const origin = safeCliproxyOrigin(profile.baseURL, pinned)
+  if (origin === undefined) throw new Error('host-not-pinned')
+  let filesPayload
+  try {
+    filesPayload = await requestQuotaJson(`${origin}/v0/management/auth-files`, { authorization, signal })
+  } catch (error) {
+    // 管理路由未注册（secret-key 为空）时 CPA 整体 404——单独成码，别让用户猜。
+    // 注意用完整 message 比较：quotaErrorCode 会把 http-status:404 截成 http-status。
+    if (error?.message === 'http-status:404') throw new Error('mgmt-disabled')
+    throw error
+  }
+  const files = Array.isArray(filesPayload?.files) ? filesPayload.files : []
+  const accounts = []
+  for (const entry of files) {
+    if (entry === null || typeof entry !== 'object') continue
+    if (entry.disabled === true || entry.unavailable === true) continue
+    if (typeof entry.auth_index !== 'string' || entry.auth_index.trim() === '') continue
+    const plan = buildCliproxyAccountPlan(entry)
+    if (plan === null) continue
+    const label = typeof entry.email === 'string' && entry.email.trim() !== '' ? entry.email.trim()
+      : typeof entry.name === 'string' && entry.name.trim() !== '' ? entry.name.trim() : ''
+    const slugSource = `${label !== '' ? label : plan.provider}-${accounts.length}`
+    const slug = slugSource.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 48) || `acct-${accounts.length}`
+    accounts.push({ authIndex: entry.auth_index, provider: plan.provider, label, slug, calls: plan.calls })
+    if (accounts.length >= MAX_QUOTA_CPA_ACCOUNTS) break
+  }
+  if (accounts.length === 0) return []
+
+  const windows = []
+  const failures = []
+  const seenWindowIds = new Set()
+  let callBudget = MAX_QUOTA_CPA_CALLS
+  const runAccount = async (account) => {
+    for (const call of account.calls) {
+      if (callBudget <= 0 || signal?.aborted === true) return
+      callBudget -= 1
+      let envelope
+      try {
+        envelope = await requestQuotaJson(`${origin}/v0/management/api-call`, {
+          method: 'POST',
+          authorization,
+          signal,
+          body: JSON.stringify({ auth_index: account.authIndex, method: call.method, url: call.url, header: call.header, data: call.data }),
+        })
+      } catch (error) {
+        failures.push(quotaErrorCode(error))
+        return
+      }
+      const { statusCode, payload } = unwrapCliproxyApiCallEnvelope(envelope)
+      const parsed = statusCode === 200 && payload !== null ? parseCliproxyUpstream(account.provider, payload) : []
+      if (parsed.length > 0) {
+        for (const window of parsed) {
+          if (windows.length >= MAX_QUOTA_CPA_WINDOWS) return
+          // 窗口 id 必须全局唯一：同账号两窗撞码（如 codex primary/secondary 恰好同秒长度折算同桶）
+          // 或不同模型名 slug 化撞名，都会复制出重复的 React key/testid——后缀 ~ 保持唯一；
+          // kindKey 不动，展示名仍按窗口码本地化。
+          let windowId = `${account.slug}-${window.id}`
+          while (seenWindowIds.has(windowId)) windowId += '~'
+          seenWindowIds.add(windowId)
+          windows.push({
+            id: windowId,
+            kindKey: window.kindKey ?? window.id,
+            ...(account.label !== '' ? { label: account.label } : {}),
+            percent: window.percent,
+            ...(window.resetsAt !== undefined ? { resetsAt: window.resetsAt } : {}),
+          })
+        }
+        return
+      }
+      failures.push(statusCode === 200 ? 'bad-payload:shape' : `upstream-status:${statusCode}`)
+      // antigravity 候选链：当前候选失败换下一个；其余单调用类型直接结束该账号。
+      if (account.provider !== 'antigravity') return
+    }
+  }
+  const queue = [...accounts]
+  await Promise.all(Array.from({ length: Math.min(QUOTA_CPA_CONCURRENCY, queue.length) }, async () => {
+    while (queue.length > 0 && signal?.aborted !== true && windows.length < MAX_QUOTA_CPA_WINDOWS) {
+      await runAccount(queue.shift())
+    }
+  }))
+  if (signal?.aborted === true) throw new Error('cancelled')
+  if (windows.length === 0 && failures.length > 0) throw new Error(failures[0])
+  return windows
+}
+
 /** 稳定错误码提取：fetchProviderUsage 抛错时 message 即错误码（可带 :detail）。 */
 function quotaErrorCode(error) {
   const raw = typeof error?.message === 'string' && error.message.length > 0 ? error.message : String(error ?? '')
@@ -958,13 +1311,13 @@ function abortableDelay(delay, signal) {
   })
 }
 
-/** 带重试的上游 GET：仅瞬时网络错误退避重试（共 3 次尝试，300/600ms），支持整体取消。 */
-async function fetchProviderUsage(endpoint, authorization, options = {}) {
+/** 瞬时错误退避重试骨架：共 3 次尝试、300/600ms 退避，仅 quotaTransient 错误续命；支持整体取消。 */
+async function retryQuotaTransient(attempt, signal) {
   let lastError
-  for (let attempt = 1; attempt <= 3; attempt++) {
-    if (attempt > 1) await abortableDelay(300 * (attempt - 1), options.signal)
+  for (let attemptNo = 1; attemptNo <= 3; attemptNo++) {
+    if (attemptNo > 1) await abortableDelay(300 * (attemptNo - 1), signal)
     try {
-      return await fetchProviderUsageOnce(endpoint, authorization, options)
+      return await attempt()
     } catch (error) {
       lastError = error
       if (error?.quotaTransient !== true) break
@@ -973,6 +1326,85 @@ async function fetchProviderUsage(endpoint, authorization, options = {}) {
   throw lastError
 }
 
+/** 带重试的上游 GET：仅瞬时网络错误退避重试（共 3 次尝试，300/600ms），支持整体取消。 */
+async function fetchProviderUsage(endpoint, authorization, options = {}) {
+  return retryQuotaTransient(() => fetchProviderUsageOnce(endpoint, authorization, options), options.signal)
+}
+
+/**
+ * 单次 JSON 请求（GET/POST，POST 带 JSON body）：CLIProxyAPI 管理面专用（GET auth-files +
+ * POST api-call）。与 GET 版同样的 15s 超时、64KB 上限、瞬时错误白名单；body 只接受已序列化字符串。
+ */
+function requestQuotaJsonOnce(endpoint, options = {}) {
+  return new Promise((resolve, reject) => {
+    let settled = false
+    const fail = (code, transient = false) => {
+      if (settled) return
+      settled = true
+      const error = new Error(code)
+      error.quotaTransient = transient
+      reject(error)
+    }
+    if (options.signal?.aborted === true) { fail('cancelled'); return }
+    const body = typeof options.body === 'string' ? options.body : ''
+    const request = https.request(endpoint, {
+      method: options.method === 'POST' ? 'POST' : 'GET',
+      timeout: QUOTA_UPSTREAM_TIMEOUT_MS,
+      signal: options.signal,
+      headers: {
+        Accept: 'application/json',
+        'user-agent': `dsh-service/${pluginVersion} (DeepSeek Harness plugin)`,
+        ...(body === '' ? {} : { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }),
+        ...(options.authorization === undefined || options.authorization === '' ? {} : { Authorization: options.authorization }),
+      },
+    }, (response) => {
+      const status = response.statusCode || 0
+      if (status < 200 || status >= 300) {
+        response.resume()
+        fail(`http-status:${status}`)
+        return
+      }
+      let payload = ''
+      let bytes = 0
+      response.setEncoding('utf8')
+      response.on('data', (chunk) => {
+        bytes += Buffer.byteLength(chunk)
+        if (bytes > MAX_QUOTA_RESPONSE_BYTES) {
+          fail('bad-payload:oversize')
+          request.destroy()
+          return
+        }
+        payload += chunk
+      })
+      response.on('error', () => fail('network'))
+      response.on('end', () => {
+        try {
+          resolve(JSON.parse(payload))
+        } catch (_) {
+          fail('bad-payload:json')
+        }
+      })
+    })
+    request.on('error', (error) => {
+      const code = error?.cause?.code ?? error?.code
+      if (options.signal?.aborted === true || code === 'ABORT_ERR') { fail('cancelled'); return }
+      fail(typeof code === 'string' && QUOTA_TRANSIENT_CODES.has(code) ? 'network-transient' : 'network',
+        typeof code === 'string' && QUOTA_TRANSIENT_CODES.has(code))
+    })
+    request.on('timeout', () => {
+      request.destroy()
+      fail('timeout', true)
+    })
+    if (body !== '') request.write(body)
+    request.end()
+  })
+}
+
+/** 带重试的 JSON 请求：与 GET 版同一套瞬时错误白名单退避。 */
+async function requestQuotaJson(endpoint, options = {}) {
+  return retryQuotaTransient(() => requestQuotaJsonOnce(endpoint, options), options.signal)
+}
+
 /**
  * 每 provider 节流状态机（内存态，重启清零）。一切来源共用同一判定，优先序：
  * 单飞去重 > 失败指数退避（30s ×2 封顶 15min）> 成功 TTL 60s > 最小上游间隔 15s——
@@ -2487,13 +2919,35 @@ function apply(ctx) {
     return true
   }
   // 远端额度：后台补拉一次。是否真的发上游由节流器判定；跨 provider 经小型并发池调度。
-  const kickQuotaRefresh = (profile, kind) => {
+  // config 供 fetcher 类 kind（cliproxy）做钉住域守卫；经典 kind 忽略该参数。
+  const kickQuotaRefresh = (profile, kind, config) => {
     const decision = quotaThrottle.attempt(profile.name)
     if (!decision.ok) return
-    const parser = KIND_REGISTRY[kind]?.parser
+    const registered = KIND_REGISTRY[kind]
     const queued = enqueueQuotaWork(async () => {
       try {
-        if (parser === undefined) throw new Error('bad-payload:kind')
+        if (registered === undefined || (registered.parser === undefined && registered.fetcher === undefined)) throw new Error('bad-payload:kind')
+        if (registered.fetcher !== undefined) {
+          // 编排类 kind（cliproxy）：端点守卫 → 凭据 → fetcher 合并多账号窗口，无候选链。
+          const guard = registered.fetcherGuard?.(profile, config) ?? null
+          if (guard !== null) throw new Error(guard)
+          const authorization = await discoverQuotaCredential(ctx, kind, profile)
+          if (authorization === undefined) throw new Error('credential-missing')
+          const controller = new AbortController()
+          quotaAbortControllers.add(controller)
+          const deadline = setTimeout(() => controller.abort(), QUOTA_PROVIDER_DEADLINE_MS)
+          let produced
+          try {
+            produced = await registered.fetcher({ profile, config, authorization, signal: controller.signal })
+          } finally {
+            clearTimeout(deadline)
+            quotaAbortControllers.delete(controller)
+          }
+          if (!Array.isArray(produced)) throw new Error('bad-payload:shape')
+          if (!quotaDisposed) quotaThrottle.settle(profile.name, { ok: true, windows: produced })
+          return
+        }
+        const parser = registered.parser
         // 端点候选链先于凭据解析：baseURL 缺失是更明确的配置错误（也省一次凭据查找）。
         const candidates = quotaEndpointFor(kind, profile.baseURL)
         if (candidates.length === 0) throw new Error('no-base-url')
@@ -3080,11 +3534,34 @@ function apply(ctx) {
             rows.push({ provider: profile.name, displayName: profile.displayName, adapted: false })
             continue
           }
-          if (refreshAll || requestedProviders.has(profile.name)) kickQuotaRefresh(profile, kind)
+          if (refreshAll || requestedProviders.has(profile.name)) kickQuotaRefresh(profile, kind, config)
           const view = quotaThrottle.view(profile.name)
           const windows = Array.isArray(view.windows) ? view.windows : []
           const credentialClass = view.lastError === 'credential-missing' || view.lastError === 'no-base-url' || view.lastError === 'credentials-unavailable'
           const providerResetCards = resetCardsByProvider.get(profile.name) ?? []
+          // 凭据填写窗口的数据源：仅对「缺凭据」的未配置行附带候选线索名的配置状态（describe 只回
+          // 配置与否/来源/可写，绝不带值）；凭据服务缺席时省略字段——客户端隐藏窗口退回文案指引。
+          let credentialHints
+          if (credentialClass && !view.refreshing && (view.lastError === 'credential-missing' || view.lastError === 'credentials-unavailable')) {
+            const credentials = ctx.get('credentials')
+            if (credentials !== undefined && typeof credentials.describe === 'function') {
+              const described = []
+              for (const name of quotaCredentialHintNames(kind, profile)) {
+                try {
+                  const info = await Promise.resolve(credentials.describe(name))
+                  described.push({
+                    name,
+                    configured: info?.configured === true,
+                    ...(typeof info?.source === 'string' ? { source: info.source } : {}),
+                    ...(info?.writable === false ? { writable: false } : {}),
+                  })
+                } catch (_) {
+                  described.push({ name, configured: false })
+                }
+              }
+              credentialHints = described
+            }
+          }
           rows.push({
             provider: profile.name,
             displayName: profile.displayName,
@@ -3098,6 +3575,7 @@ function apply(ctx) {
             ...(view.lastErrorDetail !== undefined ? { errorDetail: view.lastErrorDetail } : {}),
             nextAllowedAt: view.nextAllowedAt,
             ...(providerResetCards.length > 0 ? { resetCards: providerResetCards } : {}),
+            ...(credentialHints !== undefined ? { credentialHints } : {}),
           })
         }
         return { ok: true, value: { providers: rows, serverTime: Date.now() } }
@@ -3122,7 +3600,7 @@ function apply(ctx) {
           if (forced.reason === 'inflight') return { ok: true }
           return { ok: false, error: forced.reason === 'cooldown' ? 'refresh-cooldown' : 'refresh-backoff', nextAllowedAt: forced.nextAllowedAt }
         }
-        kickQuotaRefresh(profile, kind)
+        kickQuotaRefresh(profile, kind, config)
         return { ok: true }
       } catch (error) {
         return { ok: false, error: error?.message || String(error) }
@@ -3140,11 +3618,24 @@ function apply(ctx) {
         return await serializeQuotaConfigWrite(async (config) => {
           if (payload?.clear === true) {
             delete config.kinds[providerName]
+            delete config.allowedHosts[providerName]
           } else {
             const kind = payload?.kind
             if (kind !== null && !QUOTA_KINDS.includes(kind)) return { save: false, value: { ok: false, error: 'unknown-kind' } }
-            if (kind !== null && Array.isArray(KIND_REGISTRY[kind]?.endpoints) === false && quotaEndpointFor(kind, profileForProvider.baseURL).length === 0) {
-              return { save: false, value: { ok: false, error: 'unsafe-provider-endpoint' } }
+            if (kind !== null && KIND_REGISTRY[kind]?.managementPlane === true) {
+              // 管理面 kind：把 settings baseURL 的 host 钉进本条目（服务端派生，浏览器零输入）。
+              // 外呼时复验同一张表——之后改 baseURL 必须重新保存适配才恢复外呼。
+              const host = cliproxyPinHostFromBaseURL(profileForProvider.baseURL)
+              if (host === undefined) {
+                return { save: false, value: { ok: false, error: profileForProvider.baseURL === '' ? 'no-base-url' : 'unsafe-provider-endpoint' } }
+              }
+              config.allowedHosts[providerName] = [host]
+            } else {
+              if (kind !== null && Array.isArray(KIND_REGISTRY[kind]?.endpoints) === false && quotaEndpointFor(kind, profileForProvider.baseURL).length === 0) {
+                return { save: false, value: { ok: false, error: 'unsafe-provider-endpoint' } }
+              }
+              // 非管理面 kind（含显式停用/清除）不保留钉住记录，避免陈旧域残留。
+              delete config.allowedHosts[providerName]
             }
             config.kinds[providerName] = kind
           }
@@ -3155,6 +3646,47 @@ function apply(ctx) {
       }
     }
 
+    // 凭据填写窗口（v0.24）：面板输入密钥 → 宿主写进凭据提供方（dsh-credentials-local 即
+    // $DSH_HOME/.credentials.yaml 的 refs 分节，热生效无需重启）。名字只收宿主派生的线索白名单，
+    // 值只在写入方向流动——describe/快照永远不回传密钥内容。unset 供清除文件层存量。
+    if (endpoint === 'quota-credential-set' || endpoint === 'quota-credential-unset') {
+      if (!featureEnabled('quotaLookup')) return { ok: false, error: 'feature-disabled' }
+      try {
+        const providerName = typeof payload?.provider === 'string' ? payload.provider : ''
+        const profileForProvider = readLlmProviders(ctx.get('settings')).find((candidate) => candidate.name === providerName)
+        if (profileForProvider === undefined) return { ok: false, error: 'unknown-provider' }
+        const config = await refreshQuotaConfigCache()
+        const { kind } = resolveQuotaKind(config, profileForProvider)
+        if (kind === undefined) return { ok: false, error: 'not-adapted' }
+        const name = typeof payload?.name === 'string' ? payload.name : ''
+        if (!quotaCredentialHintNames(kind, profileForProvider).includes(name)) return { ok: false, error: 'unknown-hint' }
+        const credentials = ctx.get('credentials')
+        if (credentials === undefined) return { ok: false, error: 'credentials-unavailable' }
+        if (endpoint === 'quota-credential-set') {
+          if (typeof credentials.set !== 'function') return { ok: false, error: 'credentials-unavailable' }
+          // 去掉粘贴带入的首尾空白；空值与超长值在宿主侧拦下（凭据库本身也拒绝空串）。
+          const value = typeof payload?.value === 'string' ? payload.value.trim() : ''
+          if (value === '' || value.length > 4096) return { ok: false, error: 'invalid-value' }
+          try {
+            await credentials.set(name, value)
+          } catch (error) {
+            // 典型拒绝：进程环境层正在遮蔽该名字（describe().writable=false）——seam 契约的显式报错。
+            return { ok: false, error: 'credential-write-failed', detail: sanitizeQuotaErrorDetail(error?.message) }
+          }
+          return { ok: true }
+        }
+        if (typeof credentials.unset !== 'function') return { ok: false, error: 'credentials-unavailable' }
+        try {
+          await credentials.unset(name)
+        } catch (error) {
+          return { ok: false, error: 'credential-write-failed', detail: sanitizeQuotaErrorDetail(error?.message) }
+        }
+        return { ok: true }
+      } catch (error) {
+        return { ok: false, error: error?.message || String(error) }
+      }
+    }
+
     if (endpoint === 'quota-reset-card') {
       if (!featureEnabled('quotaLookup')) return { ok: false, error: 'feature-disabled' }
       try {
@@ -3209,60 +3741,82 @@ function apply(ctx) {
 export {
   SKILL_SOURCE_RANK,
   apply,
+  buildCliproxyAccountPlan,
+  cliproxyFetchGuard,
+  cliproxyPinHostFromBaseURL,
+  cliproxyProjectFor,
   createQuotaThrottle,
   detectRuntimeEnv,
   evaluateSkillFile,
   extractSkillDraftJson,
+  fetchCliproxyUsage,
   fetchProviderUsage,
   fixLegacySkillInvocationKeys,
   inferQuotaKind,
   inject,
   locateSkillFrontmatter,
   name,
+  normalizeAntigravityModels,
+  normalizeCodexRateLimit,
+  normalizeGeminiBuckets,
   normalizeKimiBalance,
-  normalizeOpenRouterCredits,
   normalizeOpencodeUsage,
+  normalizeOpenRouterCredits,
   normalizeSiliconFlowInfo,
   normalizeZaiCodingUsage,
   parseQuotaConfigText,
   parseSkillFrontmatterData,
+  quotaCredentialHintNames,
   quotaEndpointFor,
   quotaErrorCode,
   readLlmProviders,
   resolveSkillInvocationState,
   runtimeEnvCheck,
+  safeCliproxyOrigin,
   sanitizeSkillDraftText,
   selectSkillBatchCandidates,
   setSkillInvocationKey,
   skillIdFor,
+  unwrapCliproxyApiCallEnvelope,
 }
 export default {
   SKILL_SOURCE_RANK,
   apply,
+  buildCliproxyAccountPlan,
+  cliproxyFetchGuard,
+  cliproxyPinHostFromBaseURL,
+  cliproxyProjectFor,
   createQuotaThrottle,
   detectRuntimeEnv,
   evaluateSkillFile,
   extractSkillDraftJson,
+  fetchCliproxyUsage,
   fetchProviderUsage,
   fixLegacySkillInvocationKeys,
   inferQuotaKind,
   inject,
   locateSkillFrontmatter,
   name,
+  normalizeAntigravityModels,
+  normalizeCodexRateLimit,
+  normalizeGeminiBuckets,
   normalizeKimiBalance,
-  normalizeOpenRouterCredits,
   normalizeOpencodeUsage,
+  normalizeOpenRouterCredits,
   normalizeSiliconFlowInfo,
   normalizeZaiCodingUsage,
   parseQuotaConfigText,
   parseSkillFrontmatterData,
+  quotaCredentialHintNames,
   quotaEndpointFor,
   quotaErrorCode,
   readLlmProviders,
   resolveSkillInvocationState,
   runtimeEnvCheck,
+  safeCliproxyOrigin,
   sanitizeSkillDraftText,
   selectSkillBatchCandidates,
   setSkillInvocationKey,
   skillIdFor,
+  unwrapCliproxyApiCallEnvelope,
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gehennawu/dsh-service",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "description": "DSH Web 自托管运维面板：安全重启、健康监控、备份和 Linux 权限维护。",
   "type": "module",
   "scripts": {