@iasiv5/dsh-quota-watch 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 iasiv5
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,48 @@
+# DSH Quota Watch
+
+[English summary](#english-summary)
+
+个人版 DSH Web 侧栏配额监控插件，集中显示 GLM Coding Plan 窗口与 GitHub Copilot 的 GitHub 返回额度快照。它不统计 DSH 会话 token、不保存历史，也不需要在浏览器输入任何 provider 密钥。
+
+## 功能
+
+- 在侧栏 Settings 行上方显示一个可折叠卡片；没有单独的设置分区。
+- GLM Coding Plan：展示套餐名、5 小时 / 每周 / 每月窗口、已用百分比、进度条和重置时间；兼容 Token / Credit 套餐，忽略 MCP `TIME_LIMIT`。
+- GitHub Copilot：读取 `premium_interactions` quota snapshot；只有 GitHub 返回有限、有效的 `remaining` 时才显示可用额度和百分比。若余额字段无效或账号被标记为 unlimited，则显示“余额暂不可用”；`credits_used` 如存在会单独标为已用量，绝不用于推算余额。
+- 宿主默认每 60 秒探测；profile patch 可将 `pollIntervalSec` 设置在 30–3600 秒。浏览器页签可见时每 30 秒刷新视图，隐藏时暂停；刷新按钮可立即请求宿主探测。
+- 探测失败时保留最后一次成功数据并标记可能过期；缺少凭据时显示未配置状态。
+
+## 兼容与配置
+
+- 要求 DSH `0.1.7-rc.2` 或更高。
+- GLM 从 `llm-pi-ai` profile 中配置的 provider `apiKeyEnv` credential reference 解析当前 key。支持 `zai-coding-cn`（国内）与 `zai` / `zai-coding`（国际）路由。每次探测都重新解析引用，用户轮换凭据后下一轮读取新值。
+- Copilot 使用内置 `llm-pi-ai/github-copilot` OAuth grant 的 `payload.refresh` 访问用户配额快照；不使用给模型请求的短期 `payload.access`，不使用 `COPILOT_GITHUB_TOKEN` 环境引用。每轮重新读取 grant，以支持用户重新授权或轮换。
+- 如需修改宿主周期，在 profile 的 `quota-watch` row 配置 `pollIntervalSec`；禁用插件请使用 DSH 插件管理器。
+
+## 数据来源与语义
+
+- GLM 查询 `https://open.bigmodel.cn/api/monitor/usage/quota/limit` 或 `https://api.z.ai/api/monitor/usage/quota/limit`。该接口按 raw API key 鉴权，不加 Bearer 前缀。
+- Copilot 查询 `https://api.github.com/copilot_internal/user`。这是 GitHub Copilot 内部、非公开稳定契约的端点，字段可能变更；插件在无法确认额度含义时显示不可用，不猜测或计算余额。
+- 对企业 / 组织管理的 Copilot seat，GitHub AI Credits 可能属于共享计费池。侧栏呈现的是 GitHub 用户 quota snapshot 中的可用额度，不保证等同组织账单的总余额。
+- 凭据只在 DSH 宿主进程解析并用于 HTTPS 请求；浏览器只接收规范化后的额度字段。插件不把 key、OAuth grant 或原始 provider 响应写入磁盘，也不保存额度历史。
+
+## 安全
+
+- API 路由只允许 loopback 或已配对的浏览器访问；响应禁用缓存。
+- 本仓库、测试 fixtures 与 npm 包不得包含任何真实 key、OAuth grant、临时 token、原始账号响应或个人余额。测试仅使用合成响应。
+- npm 包采用显式 `files` 白名单；`npm run security:check` 会扫描工作树和实际 pack 文件，诊断只报告路径和规则名，不打印匹配值。
+- 首次 bootstrap 发布真实插件 `0.0.1` 后配置 npm Trusted Publishing；后续 tag release 使用 GitHub Actions OIDC 与 provenance，不保存长期 npm token。
+
+## 安装
+
+安装到 `web` profile：
+
+```sh
+dsh plugin --profile web add @iasiv5/dsh-quota-watch
+```
+
+插件管理器会应用包内 `cordis.patch.yml`。宿主半区的插件变更需要重启 `dsh web` 后生效；客户端 bundle 随插件加载。禁用插件请使用 DSH 插件管理器。默认探测周期为 60 秒；需要调整时，在 profile 的 `quota-watch` Cordis row 设置 `config.pollIntervalSec`（30–3600）。
+
+## English summary
+
+DSH Quota Watch is a personal DSH Web sidebar card for GLM Coding Plan windows and GitHub Copilot's provider-reported quota snapshot. It resolves credentials on every host-side probe, sends only normalized values to the browser, keeps no usage history, and never infers a Copilot balance from credits used. The Copilot endpoint is undocumented and may change; invalid or unlimited quota snapshots are shown as unavailable rather than guessed.

package/cordis.patch.yml

@@ -0,0 +1,6 @@
+# Mount the host-side quota watcher; the browser half is supplied by dsh.client.
+- insert:
+    - id: quota-watch
+      name: '@iasiv5/dsh-quota-watch'
+      config:
+        pollIntervalSec: 60

package/lib/client.js

@@ -0,0 +1,407 @@
+window.__ModuleLoader__.load({
+	id: "@iasiv5/dsh-quota-watch",
+	factory: (require) => {
+		var module = { exports: {} };
+		var exports = module.exports;
+		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name2 in all)
+    __defProp(target, name2, { get: all[name2], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client.mjs
+var client_exports = {};
+__export(client_exports, {
+  apply: () => apply,
+  inject: () => inject,
+  mountQuotaCard: () => mountQuotaCard,
+  name: () => name
+});
+module.exports = __toCommonJS(client_exports);
+
+// src/shared.mjs
+var API_PREFIX = "/api/dsh-quota-watch";
+var ROUTES = Object.freeze({
+  overview: `${API_PREFIX}/overview`,
+  refresh: `${API_PREFIX}/refresh`
+});
+var CLIENT_ROUTES = Object.freeze({
+  overview: `${API_PREFIX.slice(1)}/overview`,
+  refresh: `${API_PREFIX.slice(1)}/refresh`
+});
+var PROVIDER_IDS = Object.freeze({
+  glmDomestic: "zai-coding-cn",
+  glmInternational: "zai",
+  glmInternationalLegacy: "zai-coding",
+  copilot: "github-copilot"
+});
+var CLIENT_POLL_INTERVAL_MS = 3e4;
+
+// src/client.mjs
+var name = "quota-watch-client";
+var inject = [];
+var CARD_SELECTOR = "[data-dsh-quota-watch-card]";
+var COLLAPSE_KEY = "dsh-quota-watch:collapsed";
+var FETCH_TIMEOUT_MS = 15e3;
+var COPY = {
+  zh: {
+    title: "\u5957\u9910\u76D1\u63A7",
+    refresh: "\u5237\u65B0",
+    collapse: "\u6536\u8D77",
+    expand: "\u5C55\u5F00",
+    loading: "\u8BFB\u53D6\u4E2D",
+    updated: "\u66F4\u65B0",
+    notConfigured: "\u672A\u914D\u7F6E",
+    noPlan: "\u6682\u65E0\u5957\u9910\u7A97\u53E3",
+    failed: "\u67E5\u8BE2\u5931\u8D25",
+    stale: "\u6570\u636E\u53EF\u80FD\u5DF2\u8FC7\u671F",
+    requestFailed: "\u5237\u65B0\u5931\u8D25\uFF0C\u663E\u793A\u4E0A\u6B21\u6210\u529F\u6570\u636E",
+    available: "\u53EF\u7528\u989D\u5EA6",
+    used: "\u672C\u671F\u5DF2\u7528",
+    balanceUnavailable: "\u4F59\u989D\u6682\u4E0D\u53EF\u7528",
+    reset: "\u91CD\u7F6E",
+    windows: { "5h": "5 \u5C0F\u65F6", week: "\u6BCF\u5468", month: "\u6BCF\u6708" }
+  },
+  en: {
+    title: "Quota Watch",
+    refresh: "Refresh",
+    collapse: "Collapse",
+    expand: "Expand",
+    loading: "Loading",
+    updated: "Updated",
+    notConfigured: "Not configured",
+    noPlan: "No plan windows",
+    failed: "Query failed",
+    stale: "Data may be stale",
+    requestFailed: "Refresh failed; showing last successful data",
+    available: "Available credits",
+    used: "Used this cycle",
+    balanceUnavailable: "Balance unavailable",
+    reset: "Resets",
+    windows: { "5h": "5 hours", week: "Weekly", month: "Monthly" }
+  }
+};
+var STYLE_TEXT = `
+[data-dsh-quota-watch-card] { box-sizing: border-box; width: 100%; margin: 0 0 8px; color: var(--dsw-alias-label-primary, inherit); font: inherit; }
+[data-dsh-quota-watch-card] *, [data-dsh-quota-watch-card] *::before, [data-dsh-quota-watch-card] *::after { box-sizing: border-box; }
+.dqw-card { border: 1px solid var(--dsw-alias-border-secondary, rgba(128,128,128,.35)); border-radius: 10px; background: var(--dsw-alias-bg-base, rgba(128,128,128,.08)); padding: 8px; display: flex; flex-direction: column; gap: 7px; }
+.dqw-head { display: flex; align-items: center; gap: 4px; min-width: 0; }
+.dqw-title { flex: 1; min-width: 0; margin: 0; font-size: 12px; font-weight: 600; line-height: 18px; }
+.dqw-button { border: 0; border-radius: 6px; background: transparent; color: inherit; cursor: pointer; font: inherit; font-size: 11px; line-height: 18px; padding: 1px 4px; }
+.dqw-button:hover { background: var(--dsw-alias-bg-hover, rgba(128,128,128,.16)); }
+.dqw-button:disabled { cursor: wait; opacity: .6; }
+.dqw-meta { margin: 0; font-size: 10px; line-height: 14px; opacity: .7; }
+.dqw-provider { border-top: 1px solid var(--dsw-alias-border-secondary, rgba(128,128,128,.25)); padding-top: 6px; display: flex; flex-direction: column; gap: 4px; }
+.dqw-provider-title { margin: 0; font-size: 11px; font-weight: 600; line-height: 16px; }
+.dqw-row { display: flex; flex-direction: column; gap: 2px; }
+.dqw-row-head { display: flex; justify-content: space-between; gap: 5px; font-size: 10px; line-height: 14px; }
+.dqw-bar { display: block; height: 4px; overflow: hidden; border-radius: 4px; background: var(--dsw-alias-bg-tertiary, rgba(128,128,128,.2)); }
+.dqw-bar-fill { display: block; height: 100%; border-radius: inherit; background: var(--dsw-alias-button-primary-fill, #5b8def); }
+.dqw-muted { margin: 0; font-size: 10px; line-height: 14px; opacity: .7; }
+.dqw-error { margin: 0; font-size: 10px; line-height: 14px; color: var(--dsw-alias-label-warning, #b46900); }
+.dqw-credit { margin: 0; font-size: 10px; line-height: 14px; font-variant-numeric: tabular-nums; }
+`;
+function localeFor(win) {
+  return String(win?.navigator?.language ?? "zh").toLowerCase().startsWith("zh") ? "zh" : "en";
+}
+function formatNumber(value, locale) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return "";
+  return new Intl.NumberFormat(locale === "zh" ? "zh-CN" : "en-US", { maximumFractionDigits: 1 }).format(value);
+}
+function formatPercent(value, locale) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return "";
+  const clamped = Math.max(0, Math.min(100, value));
+  const rounded = clamped >= 10 ? Math.round(clamped) : Number(clamped.toFixed(1));
+  return `${formatNumber(rounded, locale)}%`;
+}
+function formatTime(value, locale) {
+  if (typeof value !== "string" || value === "") return "";
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) return "";
+  return new Intl.DateTimeFormat(locale === "zh" ? "zh-CN" : "en-US", {
+    dateStyle: "short",
+    timeStyle: "short"
+  }).format(date);
+}
+function text(doc, tag, className, value) {
+  const node = doc.createElement(tag);
+  if (className) node.className = className;
+  node.textContent = String(value ?? "");
+  return node;
+}
+function progress(doc, label, percent, locale) {
+  const row = doc.createElement("div");
+  row.className = "dqw-row";
+  const head = doc.createElement("div");
+  head.className = "dqw-row-head";
+  head.append(text(doc, "span", "", label), text(doc, "span", "", formatPercent(percent, locale)));
+  const bar = doc.createElement("span");
+  bar.className = "dqw-bar";
+  bar.setAttribute("role", "progressbar");
+  bar.setAttribute("aria-valuemin", "0");
+  bar.setAttribute("aria-valuemax", "100");
+  bar.setAttribute("aria-valuenow", String(Math.max(0, Math.min(100, percent))));
+  const fill = doc.createElement("span");
+  fill.className = "dqw-bar-fill";
+  fill.style.width = `${Math.max(0, Math.min(100, percent))}%`;
+  bar.append(fill);
+  row.append(head, bar);
+  return row;
+}
+function providerSection(doc, key, heading) {
+  const section = doc.createElement("section");
+  section.className = "dqw-provider";
+  section.dataset.provider = key;
+  section.append(text(doc, "h4", "dqw-provider-title", heading));
+  const content = doc.createElement("div");
+  content.dataset.role = "content";
+  content.className = "dqw-content";
+  section.append(content);
+  return section;
+}
+function appendStaleError(doc, content, provider, copy) {
+  if (provider.status === "stale") content.append(text(doc, "p", "dqw-error", `${copy.stale}: ${provider.error ?? ""}`));
+  else if (provider.status === "error") content.append(text(doc, "p", "dqw-error", provider.error ?? copy.failed));
+}
+function renderGlm(doc, section, provider, copy, locale) {
+  const content = section.querySelector('[data-role="content"]');
+  content.replaceChildren();
+  appendStaleError(doc, content, provider, copy);
+  if (provider.status === "missing") {
+    content.append(text(doc, "p", "dqw-muted", copy.notConfigured));
+    return;
+  }
+  if (provider.status === "loading") {
+    content.append(text(doc, "p", "dqw-muted", copy.loading));
+    return;
+  }
+  if (!provider.plan?.windows?.length) {
+    if (provider.status !== "error") content.append(text(doc, "p", "dqw-muted", copy.noPlan));
+    return;
+  }
+  const planName = provider.plan.planName;
+  if (planName) content.append(text(doc, "p", "dqw-muted", planName));
+  for (const window of provider.plan.windows) {
+    const label = window.name || copy.windows[window.key] || window.key;
+    if (typeof window.percent === "number" && Number.isFinite(window.percent)) {
+      content.append(progress(doc, label, window.percent, locale));
+    } else {
+      content.append(text(doc, "p", "dqw-muted", label));
+    }
+    const reset = formatTime(window.resetsAt, locale);
+    if (reset) content.append(text(doc, "p", "dqw-muted", `${copy.reset}: ${reset}`));
+  }
+}
+function renderCopilot(doc, section, provider, copy, locale) {
+  const content = section.querySelector('[data-role="content"]');
+  content.replaceChildren();
+  appendStaleError(doc, content, provider, copy);
+  if (provider.status === "missing") {
+    content.append(text(doc, "p", "dqw-muted", copy.notConfigured));
+    return;
+  }
+  if (provider.status === "loading") {
+    content.append(text(doc, "p", "dqw-muted", copy.loading));
+    return;
+  }
+  const quota = provider.quota;
+  if (quota?.planName) content.append(text(doc, "p", "dqw-muted", quota.planName));
+  if (quota?.balanceAvailable === true) {
+    content.append(text(doc, "p", "dqw-credit", `${copy.available}: ${formatNumber(quota.remaining, locale)} / ${formatNumber(quota.entitlement, locale)}`));
+    if (typeof quota.percentRemaining === "number") {
+      content.append(progress(doc, copy.available, quota.percentRemaining, locale));
+    }
+  } else {
+    content.append(text(doc, "p", "dqw-muted", copy.balanceUnavailable));
+  }
+  if (typeof quota?.creditsUsed === "number") {
+    content.append(text(doc, "p", "dqw-muted", `${copy.used}: ${formatNumber(quota.creditsUsed, locale)}`));
+  }
+  const reset = formatTime(quota?.resetsAt, locale);
+  if (reset) content.append(text(doc, "p", "dqw-muted", `${copy.reset}: ${reset}`));
+}
+function footArea(doc) {
+  const sidebar = doc.querySelector('[data-pane="sidebar"], [class*="sidebarCol"]');
+  return sidebar?.querySelector('[class*="footArea"]') ?? void 0;
+}
+function readCollapsed(win) {
+  try {
+    return win.localStorage.getItem(COLLAPSE_KEY) === "1";
+  } catch {
+    return false;
+  }
+}
+function writeCollapsed(win, value) {
+  try {
+    win.localStorage.setItem(COLLAPSE_KEY, value ? "1" : "0");
+  } catch {
+  }
+}
+async function fetchJson(fetchImpl, path, method) {
+  const response = await fetchImpl(path, {
+    ...method === "POST" ? { method: "POST" } : {},
+    cache: "no-store",
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+  });
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  return response.json();
+}
+function mountQuotaCard({
+  doc = globalThis.document,
+  win = globalThis.window,
+  fetchImpl = globalThis.fetch,
+  pollIntervalMs = CLIENT_POLL_INTERVAL_MS
+} = {}) {
+  if (!doc?.body || typeof fetchImpl !== "function") return () => {
+  };
+  if (doc.querySelector(CARD_SELECTOR)) return () => {
+  };
+  const locale = localeFor(win);
+  const copy = COPY[locale];
+  const container = doc.createElement("div");
+  container.dataset.dshQuotaWatchCard = "";
+  container.dataset.dshPlugin = "quota-watch";
+  container.dataset.dshPart = "sidebar-card";
+  const style = text(doc, "style", "", STYLE_TEXT);
+  const card = doc.createElement("section");
+  card.className = "dqw-card";
+  card.setAttribute("aria-label", copy.title);
+  const header = doc.createElement("header");
+  header.className = "dqw-head";
+  header.append(text(doc, "h3", "dqw-title", copy.title));
+  const refreshButton = text(doc, "button", "dqw-button", "\u21BB");
+  refreshButton.type = "button";
+  refreshButton.title = copy.refresh;
+  refreshButton.setAttribute("aria-label", copy.refresh);
+  refreshButton.dataset.action = "refresh";
+  const collapseButton = text(doc, "button", "dqw-button", "\u2212");
+  collapseButton.type = "button";
+  collapseButton.dataset.action = "collapse";
+  const body = doc.createElement("div");
+  body.className = "dqw-body";
+  const lastUpdated = text(doc, "p", "dqw-meta", copy.loading);
+  lastUpdated.dataset.role = "updated";
+  const glmSection = providerSection(doc, "glm", "GLM Coding Plan");
+  const copilotSection = providerSection(doc, "copilot", "GitHub Copilot");
+  body.append(lastUpdated, glmSection, copilotSection);
+  header.append(refreshButton, collapseButton);
+  card.append(header, body);
+  container.append(style, card);
+  let collapsed = readCollapsed(win);
+  let snapshot;
+  let requestSequence = 0;
+  let timer;
+  let disposed = false;
+  let queuedPlace = false;
+  const applyCollapsed = () => {
+    body.hidden = collapsed;
+    collapseButton.textContent = collapsed ? "+" : "\u2212";
+    collapseButton.title = collapsed ? copy.expand : copy.collapse;
+    collapseButton.setAttribute("aria-label", collapseButton.title);
+    collapseButton.setAttribute("aria-expanded", String(!collapsed));
+  };
+  const render = (next) => {
+    snapshot = next;
+    const glm = next?.providers?.find((provider) => provider.key === "glm");
+    const copilot = next?.providers?.find((provider) => provider.key === "copilot");
+    if (glm) renderGlm(doc, glmSection, glm, copy, locale);
+    if (copilot) renderCopilot(doc, copilotSection, copilot, copy, locale);
+    const updated = formatTime(next?.updatedAt ? new Date(next.updatedAt).toISOString() : "", locale);
+    lastUpdated.textContent = updated ? `${copy.updated}: ${updated}` : copy.loading;
+  };
+  const showTransportError = () => {
+    if (snapshot) lastUpdated.textContent = copy.requestFailed;
+    else lastUpdated.textContent = copy.failed;
+  };
+  const poll = async (force) => {
+    if (disposed) return;
+    const sequence = ++requestSequence;
+    refreshButton.disabled = force === true;
+    try {
+      const next = await fetchJson(fetchImpl, force ? CLIENT_ROUTES.refresh : CLIENT_ROUTES.overview, force ? "POST" : "GET");
+      if (sequence === requestSequence && !disposed) render(next);
+    } catch {
+      if (sequence === requestSequence && !disposed) showTransportError();
+    } finally {
+      if (!disposed && sequence === requestSequence) refreshButton.disabled = false;
+    }
+  };
+  const place = () => {
+    const foot = footArea(doc);
+    if (!foot) return;
+    const settings = foot.querySelector('[class*="settingsArea"]');
+    if (settings) {
+      if (container.parentElement !== foot || container.nextElementSibling !== settings) foot.insertBefore(container, settings);
+    } else if (container.parentElement !== foot || foot.lastElementChild !== container) {
+      foot.append(container);
+    }
+  };
+  const schedulePlace = () => {
+    if (queuedPlace || disposed) return;
+    queuedPlace = true;
+    queueMicrotask(() => {
+      queuedPlace = false;
+      if (!disposed) place();
+    });
+  };
+  const observer = new win.MutationObserver(schedulePlace);
+  observer.observe(doc.body, { childList: true, subtree: true });
+  place();
+  applyCollapsed();
+  const startPolling = () => {
+    if (timer !== void 0 || doc.visibilityState === "hidden" || disposed) return;
+    void poll(false);
+    timer = win.setInterval(() => {
+      void poll(false);
+    }, pollIntervalMs);
+  };
+  const stopPolling = () => {
+    if (timer !== void 0) win.clearInterval(timer);
+    timer = void 0;
+  };
+  const onVisibilityChange = () => {
+    if (doc.visibilityState === "hidden") stopPolling();
+    else startPolling();
+  };
+  const onRefresh = () => {
+    void poll(true);
+  };
+  const onCollapse = () => {
+    collapsed = !collapsed;
+    writeCollapsed(win, collapsed);
+    applyCollapsed();
+  };
+  refreshButton.addEventListener("click", onRefresh);
+  collapseButton.addEventListener("click", onCollapse);
+  doc.addEventListener("visibilitychange", onVisibilityChange);
+  startPolling();
+  return () => {
+    disposed = true;
+    stopPolling();
+    observer.disconnect();
+    doc.removeEventListener("visibilitychange", onVisibilityChange);
+    refreshButton.removeEventListener("click", onRefresh);
+    collapseButton.removeEventListener("click", onCollapse);
+    container.remove();
+  };
+}
+function apply(ctx) {
+  ctx.effect(() => mountQuotaCard(), "dsh-quota-watch: sidebar");
+}
+
+		return module.exports;
+	}
+});

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@iasiv5/dsh-quota-watch",
+  "version": "0.0.1",
+  "description": "DSH Web sidebar monitor for GLM Coding Plan quotas and GitHub Copilot credits",
+  "type": "module",
+  "main": "./src/host.mjs",
+  "exports": {
+    ".": "./src/host.mjs",
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "src/**/*.mjs",
+    "lib/client.js",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/iasiv5/dsh-quota-watch"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "dependencies": {
+    "@deepseek-ai/dsh-credentials": "0.1.7-rc.2"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2"
+  },
+  "devDependencies": {
+    "esbuild": "^0.28.2",
+    "jsdom": "^29.1.1",
+    "yaml": "^2.5.0"
+  },
+  "dsh": {
+    "engines": {
+      "dsh": ">=0.1.7-rc.2"
+    },
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": []
+    }
+  },
+  "scripts": {
+    "build": "node scripts/build-client.mjs",
+    "test": "node --test",
+    "security:check": "node scripts/check-public-package.mjs",
+    "prepack": "npm run build && npm run security:check"
+  }
+}

package/src/access.mjs

@@ -0,0 +1,67 @@
+function isIPv4Loopback(address) {
+  const parts = address.split('.')
+  return parts.length === 4
+    && parts[0] === '127'
+    && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255)
+}
+
+function isLoopbackAddress(address) {
+  if (typeof address !== 'string') return false
+  const normalized = address.toLowerCase()
+  if (normalized === '::1') return true
+  if (normalized.startsWith('::ffff:')) return isIPv4Loopback(normalized.slice('::ffff:'.length))
+  return isIPv4Loopback(normalized)
+}
+
+function isLoopbackHostname(hostname) {
+  if (hostname === 'localhost' || hostname === '[::1]') return true
+  return isIPv4Loopback(hostname)
+}
+
+export function isSameOriginRequest(request) {
+  if (request.headers?.['sec-fetch-site'] === 'cross-site') return false
+  const origin = request.headers?.origin
+  if (origin === undefined || origin === null || origin === '') return true
+  const host = request.headers?.host
+  if (typeof host !== 'string' || host === '') return false
+  try {
+    return new URL(origin).host === host
+  } catch {
+    return false
+  }
+}
+
+export function isLoopbackRequest(request) {
+  if (!isLoopbackAddress(request.socket?.remoteAddress)) return false
+  const host = request.headers?.host
+  if (typeof host !== 'string' || host === '') return false
+  let hostname
+  try {
+    hostname = new URL(`http://${host}`).hostname
+  } catch {
+    return false
+  }
+  return isLoopbackHostname(hostname) && isSameOriginRequest(request)
+}
+
+function pairingService(ctx) {
+  try {
+    const fromGet = typeof ctx.get === 'function' ? ctx.get('remoteWebUiPairing', false) : undefined
+    if (fromGet && typeof fromGet.isPairedDevice === 'function') return fromGet
+  } catch {
+    // Missing optional pairing service stays loopback-only.
+  }
+  const direct = ctx.remoteWebUiPairing
+  return direct && typeof direct.isPairedDevice === 'function' ? direct : undefined
+}
+
+/** Allow the local desktop or a browser session explicitly paired by the host. */
+export function isPairedOrLoopbackAllowed(ctx, request) {
+  if (isLoopbackRequest(request)) return true
+  if (!isSameOriginRequest(request)) return false
+  try {
+    return pairingService(ctx)?.isPairedDevice(request) === true
+  } catch {
+    return false
+  }
+}