@kenz1117/dsh-ui-usage-billing 0.9.9 → 0.9.10

package/lib/index.js

@@ -1129,6 +1129,7 @@ function foldSession(events, subscriptionProviders, officialProviderIds, routes
 		byDay: /* @__PURE__ */ new Map(),
 		byDayModels: /* @__PURE__ */ new Map(),
 		bySite: /* @__PURE__ */ new Map(),
+		unpricedModels: /* @__PURE__ */ new Set(),
 		planCalls: /* @__PURE__ */ new Map(),
 		turns: [],
 		perf: [],
@@ -1214,6 +1215,7 @@ function foldSession(events, subscriptionProviders, officialProviderIds, routes
 		if (usage === void 0) continue;
 		const modelKey = key;
 		const day = dayStamp(event.time);
+		if (!subscription && !isPriced(modelKey)) fold.unpricedModels.add(modelKey);
 		foldUsage(fold.total, usage, modelKey, subscription, event.time, official);
 		foldUsage(usageCell(fold.byModel, modelKey), usage, modelKey, subscription, event.time, official);
 		foldUsage(usageCell(fold.byDay, day), usage, modelKey, subscription, event.time, official);
@@ -1402,6 +1404,7 @@ function createUsageAggregator(persistence, options = {}) {
 		const byDay = /* @__PURE__ */ new Map();
 		const byDayModels = /* @__PURE__ */ new Map();
 		const bySite = /* @__PURE__ */ new Map();
+		const unpricedModels = /* @__PURE__ */ new Set();
 		const planCalls = /* @__PURE__ */ new Map();
 		const sessionRows = [];
 		const turnRows = [];
@@ -1425,6 +1428,7 @@ function createUsageAggregator(persistence, options = {}) {
 			for (const [day, cell] of fold.byDay) mergeUsageInto(usageCell(byDay, day), cell);
 			for (const [day, models] of fold.byDayModels) for (const [modelKey, cell] of models) mergeUsageInto(modelDayCell(byDayModels, day, modelKey), cell);
 			for (const [siteKey, cell] of fold.bySite) mergeUsageInto(usageCell(bySite, siteKey), cell);
+			for (const id of fold.unpricedModels) unpricedModels.add(id);
 			for (const [modelKey, count] of fold.planCalls) planCalls.set(modelKey, (planCalls.get(modelKey) ?? 0) + count);
 			for (const sample of fold.perf) {
 				let modelAccum = perfModel.get(sample.model);
@@ -1521,6 +1525,7 @@ function createUsageAggregator(persistence, options = {}) {
 			byTurn: turnRows.slice(0, 200),
 			byWorkspace: workspaces.slice(0, 100),
 			...bySite.size === 0 ? {} : { bySite: toRecord(bySite) },
+			...unpricedModels.size === 0 ? {} : { unpricedModels: [...unpricedModels].sort() },
 			...perf === void 0 ? {} : { perf },
 			byRole: (() => {
 				const chars = roles.userChars + roles.toolChars;
@@ -2911,6 +2916,10 @@ const relayGate = createCooldownGate({
 });
 /** Abort a relay fetch when the upstream hangs beyond this budget. */
 const FETCH_TIMEOUT_MS = 8e3;
+/** 指纹识别缓存 TTL（毫秒）：识别结果低频变化，5 分钟内同 origin 不再重复探测。 */
+const FINGERPRINT_TTL_MS = 300 * 1e3;
+/** 每 origin 的识别结果缓存：`kind` 是识别出的中转站程序，`at` 是探测时刻。 */
+const fingerprintCache = /* @__PURE__ */ new Map();
 /** Number, or null when the value is not a finite number (nor numeric string). */
 function numberOrNull(value) {
 	if (typeof value === "number" && Number.isFinite(value)) return value;
@@ -3054,7 +3063,8 @@ async function queryRelayQuota(ctx, route) {
 		origin: originOf(route.baseURL),
 		displayName: route.displayName ?? route.route
 	};
-	if (!relayGate.check(route.baseURL)) return {
+	const gateKey = `${route.baseURL}::${route.apiKeyEnv}`;
+	if (!relayGate.check(gateKey)) return {
 		...base,
 		kind: "unknown",
 		status: "unavailable"
@@ -3065,12 +3075,22 @@ async function queryRelayQuota(ctx, route) {
 		kind: "unknown",
 		status: "not-configured"
 	};
+	const cached = fingerprintCache.get(base.origin);
+	if (cached !== void 0 && Date.now() - cached.at < FINGERPRINT_TTL_MS) return {
+		...base,
+		kind: cached.kind,
+		status: "ok"
+	};
 	try {
 		const sub2 = await fetchRelayJson(endpointOf(route.baseURL, "/v1/usage"), hit.value);
 		if (sub2.ok) {
 			const parsed = parseSub2ApiUsage(sub2.data);
 			if (parsed !== null) {
-				relayGate.success(route.baseURL);
+				relayGate.success(gateKey);
+				fingerprintCache.set(base.origin, {
+					kind: "sub2api",
+					at: Date.now()
+				});
 				return {
 					...base,
 					kind: "sub2api",
@@ -3079,7 +3099,7 @@ async function queryRelayQuota(ctx, route) {
 					...parsed.windows !== void 0 ? { windows: parsed.windows } : {}
 				};
 			}
-			relayGate.fail(route.baseURL);
+			relayGate.fail(gateKey);
 			return {
 				...base,
 				kind: "sub2api",
@@ -3087,7 +3107,7 @@ async function queryRelayQuota(ctx, route) {
 			};
 		}
 		if (sub2.status === 401 || sub2.status === 403) {
-			relayGate.fail(route.baseURL);
+			relayGate.fail(gateKey);
 			return {
 				...base,
 				kind: "unknown",
@@ -3096,7 +3116,7 @@ async function queryRelayQuota(ctx, route) {
 		}
 		const na = await fetchRelayJson(endpointOf(route.baseURL, "/api/status"), hit.value);
 		if (na.status === 401 || na.status === 403) {
-			relayGate.fail(route.baseURL);
+			relayGate.fail(gateKey);
 			return {
 				...base,
 				kind: "unknown",
@@ -3106,7 +3126,11 @@ async function queryRelayQuota(ctx, route) {
 		if (na.ok) {
 			const parsed = parseNewApiStatus(na.data);
 			if (parsed !== null) {
-				relayGate.success(route.baseURL);
+				relayGate.success(gateKey);
+				fingerprintCache.set(base.origin, {
+					kind: "new-api",
+					at: Date.now()
+				});
 				return {
 					...base,
 					kind: "new-api",
@@ -3114,21 +3138,21 @@ async function queryRelayQuota(ctx, route) {
 					...parsed.windows !== void 0 ? { windows: parsed.windows } : {}
 				};
 			}
-			relayGate.fail(route.baseURL);
+			relayGate.fail(gateKey);
 			return {
 				...base,
 				kind: "new-api",
 				status: "invalid-response"
 			};
 		}
-		relayGate.fail(route.baseURL);
+		relayGate.fail(gateKey);
 		return {
 			...base,
 			kind: "unknown",
 			status: "unavailable"
 		};
 	} catch (error) {
-		relayGate.fail(route.baseURL);
+		relayGate.fail(gateKey);
 		return {
 			...base,
 			kind: "unknown",
@@ -3172,6 +3196,35 @@ const ENABLE_USAGE_STATS_TOOL_FIELD = "enableUsageStatsTool";
 * missing file answers `{ error }` so the dashboard shows zeros, never
 * fabricated samples.
 */
+/** Peer 地址是否为回环（本地）。回环防护：本插件的端点只供本机浏览器用，
+*  局域网/远端请求一律拒绝，避免面板数据（含中转站 origin 与余额）外泄。 */
+function isLoopbackPeer(req) {
+	const address = req.socket.remoteAddress;
+	if (address === void 0) return false;
+	return address === "::1" || address.startsWith("127.") || address.startsWith("::ffff:127.");
+}
+/** 校验 Host 头是本机回环（127.x / ::1 / localhost 或空，供 curl 不带 Host 的极简请求）。 */
+function isLoopbackHost(req) {
+	const host = req.headers.host;
+	if (host === void 0 || host === "") return true;
+	const name = host.split(":")[0];
+	return name === "localhost" || name === "::1" || name !== void 0 && name.startsWith("127.");
+}
+/**
+* 回环防护守卫：仅接受回环 GET 请求（peer socket 地址 + Host 头同时校验）。
+* 不满足时返回 403 并结束响应；调用方在 handler 顶部调用，返回 false 即已拒绝。
+* @param req - 当前请求。
+* @param res - 当前响应。
+* @returns 是否放行；false = 已拒绝并结束响应。
+*/
+function guardLoopback(req, res) {
+	if (!(req.method === "GET" || req.method === "POST") || !isLoopbackPeer(req) || !isLoopbackHost(req)) {
+		res.writeHead(403, { "content-type": "application/json; charset=utf-8" });
+		res.end(JSON.stringify({ error: "forbidden: loopback only" }));
+		return false;
+	}
+	return true;
+}
 /** usage_stats 工具开关的设置命名空间 id（下端与 node 共用同一常量）。 */
 const usageBillingSettingsNs = settingsNamespace(BILLING_SETTINGS_NAMESPACE);
 /** 该命名空间的 wire schema：`enableUsageStatsTool` 布尔，默认关闭（issue 诉求）。 */
@@ -3428,10 +3481,12 @@ function apply(ctx, config = {}) {
 						"today",
 						"month",
 						"session",
-						"all"
+						"all",
+						"bySite",
+						"relay"
 					],
 					required: true,
-					description: "统计范围：today / month / session / all"
+					description: "统计范围：today / month / session / all / bySite / relay"
 				} },
 				output: {
 					schema: {
@@ -3484,6 +3539,26 @@ function apply(ctx, config = {}) {
 						input: stats.total.input,
 						output: stats.total.output
 					};
+					if (args.range === "bySite" || args.range === "relay") {
+						const bySite = stats.bySite ?? {};
+						let cost = 0;
+						let calls = 0;
+						let input = 0;
+						let output = 0;
+						for (const usage of Object.values(bySite)) {
+							cost += usage.cost;
+							calls += usage.calls;
+							input += usage.input;
+							output += usage.output;
+						}
+						return {
+							range: args.range,
+							cost,
+							calls,
+							input,
+							output
+						};
+					}
 					if (args.range === "today") {
 						const day = stats.byDay[dayStamp(Date.now())];
 						return day === void 0 ? zero : {
@@ -3556,7 +3631,8 @@ function apply(ctx, config = {}) {
 	ctx.effect(() => ctx.webServer.register({
 		kind: "exact",
 		path: "/api/billing/pricing",
-		handler: async (_req, res) => {
+		handler: async (req, res) => {
+			if (!guardLoopback(req, res)) return;
 			res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
 			res.end(JSON.stringify(live));
 		}
@@ -3564,7 +3640,8 @@ function apply(ctx, config = {}) {
 	ctx.effect(() => ctx.webServer.register({
 		kind: "exact",
 		path: "/api/billing/balance",
-		handler: async (_req, res) => {
+		handler: async (req, res) => {
+			if (!guardLoopback(req, res)) return;
 			res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
 			const providers = { ...await readPiAiProviders(ctx.settings) };
 			if (providers["deepseek"] === void 0) providers["deepseek"] = { apiKeyEnv: config.balanceApiKeyEnv ?? DEFAULT_BALANCE_API_KEY_ENV };
@@ -3578,6 +3655,7 @@ function apply(ctx, config = {}) {
 		kind: "exact",
 		path: "/api/billing/usage-tool",
 		handler: async (req, res) => {
+			if (!guardLoopback(req, res)) return;
 			res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
 			const enabled = usageSettingsScope?.get().enableUsageStatsTool ?? false;
 			if (req.method === "GET") {
@@ -3642,7 +3720,8 @@ function apply(ctx, config = {}) {
 	ctx.effect(() => ctx.webServer.register({
 		kind: "exact",
 		path: "/api/billing/subscriptions",
-		handler: async (_req, res) => {
+		handler: async (req, res) => {
+			if (!guardLoopback(req, res)) return;
 			res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
 			if (Date.now() - quotaCache.at >= SUBSCRIPTION_CACHE_MS) await refreshQuotas();
 			res.end(JSON.stringify({ quotas: quotaCache.quotas }));
@@ -3672,16 +3751,26 @@ function apply(ctx, config = {}) {
 	ctx.effect(() => ctx.webServer.register({
 		kind: "exact",
 		path: "/api/billing/relay-quotas",
-		handler: async (_req, res) => {
+		handler: async (req, res) => {
+			if (!guardLoopback(req, res)) return;
 			res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
 			if (Date.now() - relayCache.at >= SUBSCRIPTION_CACHE_MS) await refreshRelay();
-			res.end(JSON.stringify({ quotas: relayCache.quotas }));
+			const diagnostics = relayCache.quotas.map((row) => ({
+				route: row.route,
+				origin: row.origin,
+				kind: row.kind
+			}));
+			res.end(JSON.stringify({
+				quotas: relayCache.quotas,
+				diagnostics
+			}));
 		}
 	}), "usage-billing: relay-quotas route");
 	ctx.effect(() => ctx.webServer.register({
 		kind: "exact",
 		path: "/api/billing/usage-stats",
-		handler: async (_req, res) => {
+		handler: async (req, res) => {
+			if (!guardLoopback(req, res)) return;
 			res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
 			try {
 				const stats = await aggregator.aggregate();
@@ -3714,4 +3803,4 @@ function apply(ctx, config = {}) {
 	}), "usage-billing: usage-stats route");
 }
 //#endregion
-export { apply, inject, readPiAiProviderRoutes, resolveSubscriptionKeys };
+export { apply, guardLoopback, inject, readPiAiProviderRoutes, resolveSubscriptionKeys };

package/lib/types/aggregate.d.ts

@@ -147,6 +147,8 @@ export interface UsageStatsDocument {
      * 属估算口径，UI 需标注）。旧快照可能缺失。
      */
     byRole?: RoleCost;
+    /** 不可计价的模型 id（未收录 / 无价，费用按 0 计）；供面板提示用户自查与反馈。 */
+    unpricedModels?: readonly string[];
     /**
      * 性能指标（TTFT / 生成速度 / 总延迟）按模型与按小时聚合；旧快照可能缺失。
      * 口径：TTFT = request/header → 首个内容 chunk；生成速度 = 输出 token ÷ 生成时长；
@@ -269,6 +271,8 @@ interface SessionFold {
     byDayModels: Map<string, Map<string, ModelUsage>>;
     /** 中转站归组：按 provider 路由归类到站点/直连/未知路由（key = {@link siteBucketKey}）。 */
     bySite: Map<string, ModelUsage>;
+    /** 不可计价模型 id（未收录/无价，且非订阅）集合；跨会话合并后输出给面板提示。 */
+    unpricedModels: Set<string>;
     /** 每个模型 key 在本会话内走订阅通道的调用数（合并时跨会话累加判定 plan）。 */
     planCalls: Map<string, number>;
     /** 每轮费用明细（按轮次号升序，不含 sessionId）；sessionId 在合并时补齐。 */

package/lib/types/client/UsageBilling.d.ts

@@ -59,6 +59,8 @@ export declare const PROVIDER_ALIASES: Readonly<Record<string, readonly string[]
  * 导出供守卫测试：短别名（mi/yi）仅允许前缀形式，防止 minimax 等误吞。
  */
 export declare function providerFromModelKey(modelKey: string): string | undefined;
+/** 仅供测试：暴露厂商映射表（subscriptionVendorOf 仍是唯一消费入口）。 */
+export declare const SUBSCRIPTION_VENDORS_FOR_TEST: Readonly<Record<string, string>>;
 /**
  * 本月预计总花费：按本月已有记录的平均日消耗 × 本月天数外推；无本月记录时
  * 回退为最近 7 天日均 × 本月天数；无任何记录时返回 0（调用方不展示）。
@@ -200,6 +202,8 @@ export interface UsageStats {
         cost: number;
         reasoning: number;
     }>;
+    /** 不可计价模型 id（未收录/无价，费用按 0 计）；旧快照可能缺失。 */
+    unpricedModels?: readonly string[];
     /** 按角色费用归因（估算口径：输出实测，输入按消息长度摊分）；旧快照可能缺失。 */
     byRole?: {
         user: number;

package/lib/types/client/export.d.ts

@@ -24,6 +24,8 @@ export interface SessionExportRow {
 }
 /** 按日 CSV：日期,调用,输入,输出,缓存命中,缓存未命中,费用(元)。 */
 export declare function dayRowsCsv(byDay: Record<string, DayExportRow>): string;
+/** 按站点（中转站/直连/未知路由）CSV：站点,类别,调用,费用(元)。 */
+export declare function siteRowsCsv(bySite: Record<string, DayExportRow>): string;
 /** 按会话 CSV：会话 id,标题,项目,调用,费用(元),最后活跃(ISO)。 */
 export declare function sessionRowsCsv(rows: readonly SessionExportRow[]): string;
 /** 导出文件名：带日期范围（usage-2026-08-01_2026-08-22.csv）；无日期时只带前缀。 */

package/lib/types/client/locales.d.ts

@@ -1,5 +1,5 @@
 /** Locale dictionaries for the usage billing surface. */
-export type UsageBillingKey = 'billing.title' | 'billing.subtitle' | 'billing.cost' | 'billing.todayCost' | 'billing.monthCost' | 'billing.yearCost' | 'billing.monthProjected' | 'billing.liveTurn' | 'billing.liveSession' | 'billing.totalCost' | 'billing.calls' | 'billing.cacheHitRate' | 'billing.tokens' | 'billing.inputTokens' | 'billing.outputTokens' | 'billing.avgCost' | 'billing.trend' | 'billing.trend7d' | 'billing.trend30d' | 'billing.trendEmpty' | 'billing.budget' | 'billing.sessions' | 'billing.project' | 'billing.lastActive' | 'billing.sessionOverflow' | 'billing.budgetTierBody' | 'billing.models' | 'billing.providerBilling' | 'billing.estimated' | 'billing.actual' | 'billing.pricing' | 'billing.showPricing' | 'billing.hidePricing' | 'billing.pricePerM' | 'billing.input' | 'billing.output' | 'billing.cacheHit' | 'billing.peak' | 'billing.offPeak' | 'billing.flat' | 'billing.peakHours' | 'billing.band' | 'billing.openDashboard' | 'billing.close' | 'billing.lastUpdated' | 'billing.noData' | 'billing.todayRate' | 'billing.rateLive' | 'billing.rateBuiltin' | 'billing.pricingTip' | 'billing.balance' | 'billing.balanceUnconfigured' | 'billing.balanceUnauthorized' | 'billing.balanceUnreachable' | 'billing.uncatalogued' | 'billing.estimatedPricing' | 'billing.balanceDays' | 'billing.balanceLowBody' | 'billing.subscriptions' | 'billing.subscriptionNotConfigured' | 'billing.subscriptionUnauthorized' | 'billing.subscriptionUnavailable' | 'billing.subscriptionInvalid' | 'billing.subscriptionRateLimited' | 'billing.subscriptionSession' | 'billing.subscriptionWeekly' | 'billing.subscriptionMonthly' | 'billing.subscriptionBilling' | 'billing.subscriptionRemaining' | 'billing.subscriptionExhausted' | 'billing.subscriptionReset' | 'billing.subscriptionNoApi' | 'billing.heatmapLess' | 'billing.heatmapMore' | 'billing.currency' | 'billing.currencyCny' | 'billing.currencyUsd' | 'billing.heatmap' | 'billing.rounds' | 'billing.anomaly' | 'billing.workspaces' | 'billing.plan' | 'billing.remaining' | 'billing.unknownModel' | 'billing.model' | 'billing.currentRound' | 'billing.costAbbr' | 'billing.tabOverview' | 'billing.tabTrends' | 'billing.tabProviders' | 'billing.tabDetails' | 'billing.tabPricing' | 'billing.tabSettings' | 'billing.settingsHead' | 'billing.settingsHint' | 'billing.budgetHint' | 'billing.peakAlertHint' | 'billing.peakAlertDescPeak' | 'billing.peakAlertDescOff' | 'billing.export' | 'billing.exportCsvDay' | 'billing.exportCsvSession' | 'billing.exportJson' | 'billing.peakShare' | 'billing.peakShareHint' | 'billing.weekCost' | 'billing.roleCost' | 'billing.roleUser' | 'billing.roleAssistant' | 'billing.roleTool' | 'billing.roleHint' | 'billing.tierPeak' | 'billing.tierOff' | 'billing.tierToPeak' | 'billing.tierToOff' | 'billing.tierAlertEnterPeak' | 'billing.tierAlertEnterOff' | 'billing.peakAlertTitlePeak' | 'billing.peakAlertTitleOff' | 'billing.peakAlert' | 'billing.peakAlertLeadMin' | 'billing.peakAlertPosCorner' | 'billing.peakAlertPosCenter' | 'billing.peakAlertModePeak' | 'billing.peakAlertModeOff' | 'billing.peakAlertModeBoth' | 'billing.peakAlertWebNotify' | 'billing.peakAlertPreview' | 'billing.planTypeCode' | 'billing.planTypeToken' | 'billing.subscriptionFeePerMonth' | 'billing.triggerToday' | 'billing.triggerMonth' | 'billing.subscriptionIncluded' | 'billing.free' | 'billing.official' | 'billing.thirdParty' | 'billing.officialCost' | 'billing.thirdPartyCost' | 'billing.perfSamples' | 'billing.perfTtft' | 'billing.perfP50' | 'billing.perfP90' | 'billing.perfTps' | 'billing.perfLatency' | 'billing.perfEstimated' | 'billing.perfEmpty' | 'billing.perfTpsUnit' | 'billing.perfTitle' | 'billing.perfHint' | 'billing.heatmapYear' | 'billing.heatmapMonth' | 'billing.activeDays' | 'billing.streakDays' | 'billing.subscriptionAutoDetect' | 'billing.pluginInfo' | 'billing.pluginName' | 'billing.pluginDescription' | 'billing.pluginVersion' | 'billing.pluginAuthor' | 'billing.pluginRepository' | 'billing.pluginNpm' | 'billing.pluginLicense' | 'billing.tabToken' | 'billing.tokenExport' | 'billing.tokenExportCsv' | 'billing.tokenCacheHitRate' | 'billing.tokenReasoningShare' | 'billing.tokenReasoningShort' | 'billing.tokenIo' | 'billing.tokenPeak' | 'billing.tokenDaily' | 'billing.tokenByModel' | 'billing.tokenMiss' | 'billing.tokenHit' | 'billing.tokenOutput' | 'billing.tokenTotal' | 'billing.tokenShare' | 'billing.usageStatsTool' | 'billing.usageStatsToolHint' | 'billing.balanceGranted' | 'billing.balanceTopped' | 'billing.balanceDaily' | 'billing.balanceDaysLong' | 'billing.balanceDaysUnit' | 'billing.popTodayModel' | 'billing.popNoConsumption' | 'billing.popQuotaAlert' | 'billing.popRiskNone' | 'billing.popTitle' | 'billing.popDirectLead' | 'billing.popSubLead' | 'billing.popBalanceNormal' | 'billing.popBalanceLow' | 'billing.popQuotaNormal' | 'billing.popQuotaLow' | 'billing.alertBalanceLow' | 'billing.alertQuotaLow' | 'billing.panelRelay' | 'billing.relaySite' | 'billing.relayDirect' | 'billing.relayUnknown' | 'billing.panelRelayQuota' | 'billing.relayBalance' | 'billing.relayNoQuota' | 'billing.relayWindowUsed' | 'billing.relayKindNewApi' | 'billing.relayKindSub2Api' | 'billing.relayKindUnknown' | 'billing.relayCalls';
+export type UsageBillingKey = 'billing.title' | 'billing.subtitle' | 'billing.cost' | 'billing.todayCost' | 'billing.monthCost' | 'billing.yearCost' | 'billing.monthProjected' | 'billing.liveTurn' | 'billing.liveSession' | 'billing.totalCost' | 'billing.calls' | 'billing.cacheHitRate' | 'billing.tokens' | 'billing.inputTokens' | 'billing.outputTokens' | 'billing.avgCost' | 'billing.trend' | 'billing.trend7d' | 'billing.trend30d' | 'billing.trendEmpty' | 'billing.budget' | 'billing.sessions' | 'billing.project' | 'billing.lastActive' | 'billing.sessionOverflow' | 'billing.budgetTierBody' | 'billing.models' | 'billing.providerBilling' | 'billing.estimated' | 'billing.actual' | 'billing.pricing' | 'billing.showPricing' | 'billing.hidePricing' | 'billing.pricePerM' | 'billing.input' | 'billing.output' | 'billing.cacheHit' | 'billing.peak' | 'billing.offPeak' | 'billing.flat' | 'billing.peakHours' | 'billing.band' | 'billing.openDashboard' | 'billing.close' | 'billing.lastUpdated' | 'billing.noData' | 'billing.todayRate' | 'billing.rateLive' | 'billing.rateBuiltin' | 'billing.pricingTip' | 'billing.balance' | 'billing.balanceUnconfigured' | 'billing.balanceUnauthorized' | 'billing.balanceUnreachable' | 'billing.uncatalogued' | 'billing.estimatedPricing' | 'billing.balanceDays' | 'billing.balanceLowBody' | 'billing.subscriptions' | 'billing.subscriptionNotConfigured' | 'billing.subscriptionUnauthorized' | 'billing.subscriptionUnavailable' | 'billing.subscriptionInvalid' | 'billing.subscriptionRateLimited' | 'billing.subscriptionSession' | 'billing.subscriptionWeekly' | 'billing.subscriptionMonthly' | 'billing.subscriptionBilling' | 'billing.subscriptionRemaining' | 'billing.subscriptionExhausted' | 'billing.subscriptionReset' | 'billing.subscriptionNoApi' | 'billing.heatmapLess' | 'billing.heatmapMore' | 'billing.currency' | 'billing.currencyCny' | 'billing.currencyUsd' | 'billing.heatmap' | 'billing.rounds' | 'billing.anomaly' | 'billing.workspaces' | 'billing.plan' | 'billing.remaining' | 'billing.unknownModel' | 'billing.model' | 'billing.currentRound' | 'billing.costAbbr' | 'billing.tabOverview' | 'billing.tabTrends' | 'billing.tabProviders' | 'billing.tabDetails' | 'billing.tabPricing' | 'billing.tabSettings' | 'billing.settingsHead' | 'billing.settingsHint' | 'billing.budgetHint' | 'billing.peakAlertHint' | 'billing.peakAlertDescPeak' | 'billing.peakAlertDescOff' | 'billing.export' | 'billing.exportCsvDay' | 'billing.exportCsvSession' | 'billing.exportJson' | 'billing.peakShare' | 'billing.peakShareHint' | 'billing.weekCost' | 'billing.roleCost' | 'billing.roleUser' | 'billing.roleAssistant' | 'billing.roleTool' | 'billing.roleHint' | 'billing.tierPeak' | 'billing.tierOff' | 'billing.tierToPeak' | 'billing.tierToOff' | 'billing.tierAlertEnterPeak' | 'billing.tierAlertEnterOff' | 'billing.peakAlertTitlePeak' | 'billing.peakAlertTitleOff' | 'billing.peakAlert' | 'billing.peakAlertLeadMin' | 'billing.peakAlertPosCorner' | 'billing.peakAlertPosCenter' | 'billing.peakAlertModePeak' | 'billing.peakAlertModeOff' | 'billing.peakAlertModeBoth' | 'billing.peakAlertWebNotify' | 'billing.peakAlertPreview' | 'billing.planTypeCode' | 'billing.planTypeToken' | 'billing.subscriptionFeePerMonth' | 'billing.triggerToday' | 'billing.triggerMonth' | 'billing.subscriptionIncluded' | 'billing.free' | 'billing.official' | 'billing.thirdParty' | 'billing.officialCost' | 'billing.thirdPartyCost' | 'billing.perfSamples' | 'billing.perfTtft' | 'billing.perfP50' | 'billing.perfP90' | 'billing.perfTps' | 'billing.perfLatency' | 'billing.perfEstimated' | 'billing.perfEmpty' | 'billing.perfTpsUnit' | 'billing.perfTitle' | 'billing.perfHint' | 'billing.heatmapYear' | 'billing.heatmapMonth' | 'billing.activeDays' | 'billing.streakDays' | 'billing.subscriptionAutoDetect' | 'billing.pluginInfo' | 'billing.pluginName' | 'billing.pluginDescription' | 'billing.pluginVersion' | 'billing.pluginAuthor' | 'billing.pluginRepository' | 'billing.pluginNpm' | 'billing.pluginLicense' | 'billing.tabToken' | 'billing.tokenExport' | 'billing.tokenExportCsv' | 'billing.tokenCacheHitRate' | 'billing.tokenReasoningShare' | 'billing.tokenReasoningShort' | 'billing.tokenIo' | 'billing.tokenPeak' | 'billing.tokenDaily' | 'billing.tokenByModel' | 'billing.tokenMiss' | 'billing.tokenHit' | 'billing.tokenOutput' | 'billing.tokenTotal' | 'billing.tokenShare' | 'billing.usageStatsTool' | 'billing.usageStatsToolHint' | 'billing.balanceGranted' | 'billing.balanceTopped' | 'billing.balanceDaily' | 'billing.balanceDaysLong' | 'billing.balanceDaysUnit' | 'billing.popTodayModel' | 'billing.popNoConsumption' | 'billing.popQuotaAlert' | 'billing.popRiskNone' | 'billing.popTitle' | 'billing.popDirectLead' | 'billing.popSubLead' | 'billing.popBalanceNormal' | 'billing.popBalanceLow' | 'billing.popQuotaNormal' | 'billing.popQuotaLow' | 'billing.alertBalanceLow' | 'billing.alertQuotaLow' | 'billing.unpricedHint' | 'billing.exportCsvSite' | 'billing.panelRelay' | 'billing.relaySite' | 'billing.relayDirect' | 'billing.relayUnknown' | 'billing.panelRelayQuota' | 'billing.relayBalance' | 'billing.relayNoQuota' | 'billing.relayWindowUsed' | 'billing.relayKindNewApi' | 'billing.relayKindSub2Api' | 'billing.relayKindUnknown' | 'billing.relayCalls';
 export declare const NS = "usageBilling";
 export declare const zh: Record<UsageBillingKey, string>;
 export declare const en: Record<UsageBillingKey, string>;

package/lib/types/index.d.ts

@@ -9,11 +9,20 @@
  * missing file answers `{ error }` so the dashboard shows zeros, never
  * fabricated samples.
  */
+import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { Context } from '@deepseek-ai/cordis';
 import type { CredentialProvider } from '@deepseek-ai/dsh-credentials';
 import { type SettingsProvider } from '@deepseek-ai/dsh-settings';
 import type { CustomBalanceConfig, SubscriptionPlanConfig } from './pricing-shared.ts';
 import { type IdentifiedSubscriptionPlan, type SubscriptionKeys } from './subscriptions.ts';
+/**
+ * 回环防护守卫：仅接受回环 GET 请求（peer socket 地址 + Host 头同时校验）。
+ * 不满足时返回 403 并结束响应；调用方在 handler 顶部调用，返回 false 即已拒绝。
+ * @param req - 当前请求。
+ * @param res - 当前响应。
+ * @returns 是否放行；false = 已拒绝并结束响应。
+ */
+export declare function guardLoopback(req: IncomingMessage, res: ServerResponse): boolean;
 /** Plugin configuration. */
 export interface UsageBillingConfig {
     /** Absolute path to a `.dsh-usage-stats.json` fallback file. */

package/lib/types/pricing-shared.d.ts

@@ -123,6 +123,17 @@ export interface RelayQuota {
 /** Response of `/api/billing/relay-quotas`. */
 export interface RelayResponse {
     quotas: readonly RelayQuota[];
+    /** 诊断：每条路由的归类（route / origin / kind / unknown），供「我的中转站为什么不显示」自查。 */
+    diagnostics?: readonly RelayDiagnostic[];
+}
+/** 一条路由的归类诊断（供面板/日志定位中转站识别结果）。 */
+export interface RelayDiagnostic {
+    /** llm-pi-ai providers 路由名。 */
+    route: string;
+    /** 站点 origin（baseURL 归一化）。 */
+    origin: string;
+    /** 识别结果：new-api / sub2api（有额度读出）或 unknown（读不出）。 */
+    kind: 'new-api' | 'sub2api' | 'unknown';
 }
 /** Config for one subscription adapter (validated in apply). */
 export interface SubscriptionPlanConfig {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kenz1117/dsh-ui-usage-billing",
   "description": "Usage billing dashboard for DeepSeek Harness: sidebar cost metrics plus a full dashboard modal, priced from a current multi-provider catalog with real usage aggregated from session logs.",
-  "version": "0.9.9",
+  "version": "0.9.10",
   "publishConfig": {
     "access": "public"
   },