@hystudio/dsh-quota-pill 0.1.0 → 0.2.0

package/AGENTS.md

@@ -30,9 +30,15 @@ There are **two credential families**, and this matters for every step:
 
 | Family | Providers | What the user needs |
 |---|---|---|
+| DSH Platform sign-in | `deepseek` | **nothing** — works if they are signed in to DeepSeek Platform in DSH |
 | API key | `kimi`, `opencode`, `commandcode` | a key pasted into `~/.dsh/.credentials.yaml` |
 | OAuth via CLIProxyAPI | `xai`, `codex`, `agy` | **CLIProxyAPI installed and logged in once** |
 
+**Check DeepSeek first.** It is the official account and needs no setup beyond a
+DSH Platform sign-in, so it is usually the one the user actually wants. If it
+reports `none` with "not signed in to DeepSeek Platform", tell them to use the
+DSH account menu, then re-run step 5.
+
 ---
 
 ## 1. Verify the sidecar runs
@@ -81,6 +87,7 @@ Do **not** guess. Ask, in one message, listing the options with what each needs:
 
 > I can read quota for six providers. Which do you have?
 >
+> - **DeepSeek** — works already if you are signed in to DeepSeek Platform in DSH
 > - **Kimi Coding** — needs a `KIMI_CODING_API_KEY`
 > - **OpenCode Go** — needs an `OPENCODE_GO_API_KEY`
 > - **Command Code** — needs a `COMMANDCODE_API_KEY`
@@ -170,7 +177,7 @@ For each provider look at `kind`:
 | `subscription-quota` | working — `remainingPct` and `windows` are populated |
 | `none` | not configured — the `error` field says exactly what to add |
 | `probe-failed` | configured but the upstream call failed — see `error` |
-| `payg` | metered billing with no ceiling; no percentage exists |
+| `payg` | prepaid/metered — no ceiling, so no percentage. If `credits.remain` is set, that is the balance to report |
 
 Cross-check one provider against its official dashboard if the human is unsure.
 **The plugin reports remaining quota, not used.**

package/README.md

@@ -15,6 +15,7 @@ into the live number.
 
 | Provider | Credential |
 |---|---|
+| **DeepSeek** (official) | the Platform sign-in DSH already holds — nothing to add |
 | **Kimi Coding** | `refs.KIMI_CODING_API_KEY` in `~/.dsh/.credentials.yaml` |
 | **OpenCode Go** | `refs.OPENCODE_GO_API_KEY` |
 | **Command Code** | `refs.COMMANDCODE_API_KEY` |
@@ -22,6 +23,9 @@ into the live number.
 | **Codex (ChatGPT Plus)** | same — and CLIProxyAPI must be **running** |
 | **Antigravity** | same |
 
+**DeepSeek works with no setup at all** if you are signed in to DeepSeek Platform
+in DSH — that is the official account, and it is the one most users care about.
+
 The three API-key providers need nothing but the key. The three OAuth providers
 need CLIProxyAPI installed and logged in, because that is what holds the tokens;
 this plugin only reads them and never runs an OAuth flow itself.
@@ -39,6 +43,9 @@ dsh plugin add @hystudio/dsh-quota-pill
 npx @hystudio/dsh-quota-pill
 ```
 
+> The npm package is `@hystudio/...` while the repo lives at `598934321/...` —
+> they are the same author under two account names.
+
 The pill shows **"quota service is not running"** with that exact command until
 the sidecar is up. Keep it running in the background — see
 [Running it as a service](#running-it-as-a-service).
@@ -183,6 +190,14 @@ would flicker between models you do not even have configured.
 `monthlyCap = weekly.cap × 2`, an identity verified against two different plans
 (31.6 + 38.4 = 70 with `weekly.cap` 35; 0.225 + 9.775 = 10 with `weekly.cap` 6).
 
+**DeepSeek** is a prepaid CNY wallet, so there is no percentage to show — the pill
+shows the balance and, separately, any bonus credit. Two traps worth recording:
+the stored credential is a *Platform login grant*, not an `api.deepseek.com` API
+key (sending it there returns 401), and calling `platform.deepseek.com` directly
+returns 429 from Cloudflare. The balance is therefore read through DSH's own
+`account/getBalance` RPC, which already holds the grant and projects the response
+down to wallet currency and balance. We never handle the Platform token ourselves.
+
 ## Privacy
 
 - Credentials are read from disk, used for the upstream call, and never logged.

package/client.js

@@ -221,6 +221,8 @@ window.__ModuleLoader__.load({
       spendUnit: (req, tok) => [`${req} 次 · ${tok}`, `${req} reqs · ${tok}`],
       poolStatus: ['状态未知', 'Status unknown'],
       noSource: ['无数据源', 'No source'],
+      balanceLeft: ['余额剩余', 'Balance left'],
+      bonusBalance: ['赠金余额', 'Bonus balance'],
       offlineTitle: ['额度服务未启动', 'Quota service is not running'],
       offlineHint: ['在本机运行下面的命令即可（保持后台）', 'Start it locally in the background:'],
       creditsAll: ['全部积分', 'All credits'],
@@ -408,7 +410,15 @@ window.__ModuleLoader__.load({
       }
       // v.label 来自 adapter，本身就是双语无关的短词，优先用它。
       if (kind === 'free-usable') return { text: v.label || pick(lang, 'free'), tone: 'ok', pct: null };
-      if (kind === 'payg') return { text: v.label || pick(lang, 'payg'), tone: 'muted', pct: null };
+      if (kind === 'payg') {
+        // Prepaid wallets (e.g. the official DeepSeek account) have a real
+        // balance to show. Only fall back to the label when there is no amount.
+        const c = v.credits;
+        if (c && typeof c.remain === 'number') {
+          return { text: money(c.remain, c.unit), tone: 'ok', pct: null };
+        }
+        return { text: v.label || pick(lang, 'payg'), tone: 'muted', pct: null };
+      }
       // `none` = 这个 provider 当前取不到任何读数（渠道被删、插件被卸、没凭据）。
       // 之前没有这个分支，会掉到最后的 String(kind)，界面上直接显示字面量 "none"。
       if (kind === 'none') {
@@ -979,13 +989,23 @@ window.__ModuleLoader__.load({
     }
 
     function paygBody(data, lang) {
+      const c = data && data.credits;
+      const hasBalance = c && typeof c.remain === 'number';
       return h(React.Fragment, null,
         h('div', { className: 'quota-pill-header' },
-          h('span', { className: 'quota-pill-headline' }, (data && data.label) ? String(data.label) : pick(lang, 'payg')),
-          h('span', { className: 'quota-pill-figures' }, (data && data.note) ? String(data.note) : pick(lang, 'noCeiling')),
+          h('span', { className: 'quota-pill-headline' },
+            hasBalance ? pick(lang, 'balanceLeft') : ((data && data.label) ? String(data.label) : pick(lang, 'payg'))),
+          hasBalance
+            ? h('span', { className: 'quota-pill-figures' }, money(c.remain, c.unit))
+            : h('span', { className: 'quota-pill-figures' }, (data && data.note) ? String(data.note) : pick(lang, 'noCeiling')),
         ),
         h('dl', { className: 'quota-pill-rows' },
-          data.account && statRow(pick(lang, 'account'), String(data.account)),
+          // A prepaid wallet's bonus is worth showing separately: it is spendable
+          // but not the same money, and mixing it into the balance would overstate.
+          data.bonus && typeof data.bonus.amount === 'number'
+            ? statRow(pick(lang, 'bonusBalance'), money(data.bonus.amount, data.bonus.unit))
+            : null,
+          !hasBalance && data.account && statRow(pick(lang, 'account'), String(data.account)),
           data.usedAmount != null && statRow(pick(lang, 'usedThisPeriod'), String(data.usedAmount) + pick(lang, 'usedRaw')),
           data.monthlyLimit != null && statRow(pick(lang, 'monthlyCap'), String(data.monthlyLimit)),
           data.resetAt && statRow(pick(lang, 'nextReset'), String(data.resetAt).slice(0, 10)),
@@ -1092,6 +1112,17 @@ window.__ModuleLoader__.load({
     }
 
     /** 到期时间：积分包给的是「哪天到期」，用绝对日期比「X 天后重置」贴切。 */
+    /**
+     * Currency amount. Uses a symbol for the few currencies we may see and a
+     * bare code otherwise, so we never imply a currency we did not get.
+     */
+    function money(amount, unit) {
+      if (typeof amount !== 'number' || !Number.isFinite(amount)) return '';
+      const sym = { CNY: '\u00a5', USD: '$', EUR: '\u20ac' }[String(unit || '').toUpperCase()];
+      const n = Math.abs(amount) >= 100 ? amount.toFixed(1) : amount.toFixed(2);
+      return sym ? sym + n : n + (unit ? ' ' + unit : '');
+    }
+
     function fmtExpiry(iso, lang) {
       if (!iso) return '';
       const d = new Date(iso);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hystudio/dsh-quota-pill",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "private": false,
   "type": "module",
   "description": "Quota pill for DeepSeek Harness: remaining quota for every LLM subscription you have, in one collapsible pill",

package/src/adapters-deepseek.js

@@ -0,0 +1,230 @@
+/**
+ * DeepSeek Platform (the official account).
+ *
+ * The credential in ~/.dsh/.credentials.yaml is a **Platform login grant**, not
+ * an api.deepseek.com API key. Two consequences, both verified:
+ *
+ *   1. Sending it to api.deepseek.com/user/balance returns 401 — those are
+ *      different systems.
+ *   2. Calling platform.deepseek.com/api/v0/users/get_user_summary directly
+ *      returns 429 from Cloudflare (non-browser TLS).
+ *
+ * So the balance is read through DSH's own `account/getBalance` RPC, which
+ * already holds the grant, derives the right headers, and projects the answer
+ * down to just wallet currency + balance. That is also the most conservative
+ * route: we never handle a Platform token ourselves.
+ *
+ * The RPC needs a signed session cookie:
+ *   name  = "dsh-auth-" + base64url(sha256(authority))
+ *   value = "v1." + base64url(JSON payload) + "." + base64url(HMAC-SHA256(secret, body))
+ *   payload = { version: 1, authority, issuedAt, expiresAt }   ← milliseconds
+ */
+import crypto from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { URL } from 'node:url';
+import { deepseekGrant, browserSessionSecret } from './credentials.js';
+
+const RPC_PORT_GUESSES = [8319, 8080, 3000];
+const DSH_BASE_ENV = process.env.DSH_RPC_BASE || process.env.QUOTA_PILL_DSH_BASE || null;
+
+const b64u = (buf) => Buffer.from(buf).toString('base64url');
+
+/** Find the DSH web server port. macOS/Linux: ask lsof; otherwise try env then guesses. */
+function findDshBase() {
+  if (DSH_BASE_ENV) return DSH_BASE_ENV.replace(/\/$/, '');
+  if (process.env.QUOTA_PILL_DSH_PORT) {
+    return `http://127.0.0.1:${process.env.QUOTA_PILL_DSH_PORT}`;
+  }
+  try {
+    const out = execFileSync('lsof', ['-nP', '-iTCP', '-sTCP:LISTEN'], {
+      encoding: 'utf8',
+      timeout: 4000,
+    });
+    for (const line of out.split('\n')) {
+      // The DSH process shows up under its app name; match on the command column.
+      if (!/DeepSeek|dsh/i.test(line)) continue;
+      const m = /127\.0\.0\.1:(\d+)/.exec(line);
+      if (m) return `http://127.0.0.1:${m[1]}`;
+    }
+  } catch {
+    /* lsof missing or blocked — fall through */
+  }
+  return null;
+}
+
+/** Build the signed session cookie DSH expects. */
+function signCookie(base, secretB64) {
+  const authority = new URL(base).host;
+  let raw;
+  try {
+    raw = Buffer.from(secretB64, 'base64url');
+  } catch {
+    raw = Buffer.from(secretB64, 'utf8');
+  }
+  const name = 'dsh-auth-' + b64u(crypto.createHash('sha256').update(authority).digest());
+  const now = Date.now();
+  const payload = {
+    version: 1,
+    authority,
+    issuedAt: now,
+    expiresAt: now + 3600 * 1000,
+  };
+  const body = b64u(JSON.stringify(payload));
+  const sig = b64u(crypto.createHmac('sha256', raw).update(body).digest());
+  return { name, value: `v1.${body}.${sig}` };
+}
+
+/** POST one RPC to DSH and return its result payload. */
+async function dshRpc(method, args, base) {
+  const secret = browserSessionSecret();
+  if (!secret) return { ok: false, error: 'no browser-session secret in credentials' };
+
+  const { name, value } = signCookie(base, secret);
+  const body = JSON.stringify({
+    type: 'client-request',
+    rpcId: 'quota-pill-' + method,
+    method,
+    payload: { args },
+  });
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 15000);
+  try {
+    const res = await fetch(base + '/api/' + method.replace(/\./g, '/'), {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+        Cookie: `${name}=${value}`,
+      },
+      body,
+      signal: controller.signal,
+    });
+    const text = await res.text();
+    if (!res.ok) {
+      return { ok: false, status: res.status, error: `dsh rpc http ${res.status}: ${text.slice(0, 120)}` };
+    }
+    let env;
+    try {
+      env = JSON.parse(text);
+    } catch {
+      return { ok: false, error: 'dsh rpc returned unparsable json' };
+    }
+    const result = (env && env.result) || {};
+    if (result.ok === false) {
+      const e = result.error || {};
+      return { ok: false, error: `${e.code || 'rpc-failed'}: ${e.message || ''}`.trim() };
+    }
+    return { ok: true, value: result.value };
+  } catch (e) {
+    return { ok: false, error: String((e && e.message) || e) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * Official DeepSeek balance.
+ *
+ * Reported as a `payg` reading: it is a prepaid CNY wallet, not a percentage
+ * against a ceiling. `remainingPct` is deliberately null — inventing a
+ * percentage from a balance we cannot divide by anything would be a fake number.
+ */
+export async function deepseek() {
+  const grant = deepseekGrant();
+  if (!grant) {
+    return {
+      kind: 'none',
+      provider: 'deepseek',
+      error: 'not signed in to DeepSeek Platform '
+        + '(no deepseek-account-platform/default grant in ~/.dsh/.credentials.yaml)',
+      setup: { kind: 'dsh-account', hint: 'Sign in to DeepSeek Platform from the DSH account menu.' },
+    };
+  }
+
+  const base = findDshBase();
+  if (!base) {
+    return {
+      kind: 'none',
+      provider: 'deepseek',
+      error: 'cannot locate the DSH web server (needed to read Platform balance)',
+      setup: { kind: 'dsh-account', hint: 'Set QUOTA_PILL_DSH_PORT or DSH_RPC_BASE.' },
+    };
+  }
+
+  // The client metadata identifies the calling UI. `version` is a string here,
+  // not a number — the strict wire codec rejects a numeric version.
+  const res = await dshRpc('account/getBalance', {
+    client: { version: '1', locale: 'zh-CN', timezoneOffsetSeconds: -new Date().getTimezoneOffset() * 60 },
+  }, base);
+
+  if (!res.ok) {
+    return {
+      kind: 'probe-failed',
+      provider: 'deepseek',
+      error: res.error,
+      setup: { kind: 'dsh-account' },
+    };
+  }
+
+  const value = res.value;
+  // DSH returns {status:'ready', value:[{currency,balance}], bonusWallets:[...]}
+  if (!value || value.status !== 'ready') {
+    return {
+      kind: 'none',
+      provider: 'deepseek',
+      error: 'Platform balance unavailable (status: '
+        + ((value && value.status) || 'unknown') + ')',
+    };
+  }
+
+  const wallets = Array.isArray(value.value) ? value.value : [];
+  const bonus = Array.isArray(value.bonusWallets) ? value.bonusWallets : [];
+  if (!wallets.length && !bonus.length) {
+    return { kind: 'none', provider: 'deepseek', error: 'Platform returned no wallets' };
+  }
+
+  const primary = wallets[0] || bonus[0] || {};
+  const toNum = (v) => {
+    const n = Number(v);
+    return Number.isFinite(n) ? n : null;
+  };
+  const currency = primary.currency || 'CNY';
+  const balance = toNum(primary.balance);
+  const bonusTotal = bonus.reduce((sum, w) => {
+    const n = toNum(w && w.balance);
+    return n == null ? sum : sum + n;
+  }, 0);
+
+  return {
+    kind: 'payg',
+    provider: 'deepseek',
+    account: currency,
+    label: 'prepaid',
+    note: `prepaid balance ${balance == null ? '?' : balance.toFixed(2)} ${currency}`
+      + (bonusTotal > 0 ? ` (+${bonusTotal.toFixed(2)} bonus)` : ''),
+    remainingPct: null,
+    usedPct: null,
+    // Amounts are kept separately so the UI can show a currency figure.
+    credits: {
+      remain: balance,
+      total: null,
+      unit: currency,
+    },
+    windows: balance == null ? [] : [{
+      key: 'balance',
+      remainPct: null,
+      amount: balance,
+      unit: currency,
+      resetAt: null,
+    }],
+    bonus: bonusTotal > 0
+      ? { amount: bonusTotal, unit: currency }
+      : null,
+    raw: {
+      source: 'DSH account/getBalance (Platform grant)',
+      wallets,
+      bonusWallets: bonus,
+    },
+  };
+}

package/src/credentials.js

@@ -161,3 +161,38 @@ export function credentialSource(provider) {
   };
   return { kind: 'api-key', dir: null, ref: refByProvider[provider] || null };
 }
+
+/**
+ * Read a `records` entry (grants and session material live here, not in refs).
+ * Returns the record's payload object, or null.
+ */
+export function readRecord(name) {
+  try {
+    const doc = parseCredentialsYaml(fs.readFileSync(CREDENTIALS_FILE, 'utf8'));
+    const rec = (doc.records || {})[name];
+    return rec && rec.payload ? rec.payload : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The DeepSeek Platform grant.
+ *
+ * Note this is NOT an api.deepseek.com API key — it is a Platform login grant,
+ * used as an `x-dsh-auth-token` header against platform.deepseek.com. Sending it
+ * to api.deepseek.com fails with 401 (verified), so the balance must be read
+ * through DSH's own account/getBalance RPC.
+ */
+export function deepseekGrant() {
+  const p = readRecord('deepseek-account-platform/default');
+  if (!p || typeof p.token !== 'string' || !p.token) return null;
+  return { token: p.token, issuer: p.issuer || 'https://platform.deepseek.com' };
+}
+
+/** The browser-session secret, used to sign DSH RPC cookies. */
+export function browserSessionSecret() {
+  const p = readRecord('client-connection/browser-session');
+  if (!p || typeof p.secret !== 'string' || !p.secret) return null;
+  return p.secret;
+}

package/src/server.js

@@ -22,16 +22,20 @@
 import http from 'node:http';
 import { kimi, opencode, commandcode } from './adapters-apikey.js';
 import { xai, codex, agy } from './adapters-cliproxy.js';
+import { deepseek } from './adapters-deepseek.js';
 import { credentialSource, hasCliProxy, CLI_PROXY_DIR, CREDENTIALS_FILE } from './credentials.js';
 
 const PORT = Number(process.env.QUOTA_PILL_PORT || 8319);
 const HOST = process.env.QUOTA_PILL_HOST || '127.0.0.1';
 const CACHE_TTL_MS = Number(process.env.QUOTA_PILL_CACHE_TTL || 60) * 1000;
 
-const ADAPTERS = { kimi, opencode, commandcode, xai, codex, agy };
+// Order matters: the pill lists providers in this order, and the official
+// DeepSeek account is the one most people look for first.
+const ADAPTERS = { deepseek, kimi, opencode, commandcode, xai, codex, agy };
 
 /** Display names. Deliberately small: the table stays in sync with ADAPTERS. */
 const DISPLAY_NAMES = {
+  deepseek: 'DeepSeek',
   kimi: 'Kimi Coding',
   opencode: 'OpenCode Go',
   commandcode: 'Command Code',
@@ -52,6 +56,7 @@ const PREFIX_ALIASES = {
   codex: 'codex',
   antigravity: 'agy',
   agy: 'agy',
+  deepseek: 'deepseek',
 };
 
 /** provider|model → { at, payload }. Keyed by model because readings differ per model. */