@kenz1117/dsh-ui-usage-billing 1.4.1 → 1.4.3

package/lib/index.js

@@ -317,7 +317,7 @@ function tierAtWithBounds(timeMs, bounds) {
 }
 /** 时刻是否落在北京时间周末（周六/周日）。 */
 function isBeijingWeekend(timeMs) {
-	const day = new Date(timeMs + 288e5).getUTCDay();
+	const day = new Date(timeMs + 8 * 36e5).getUTCDay();
 	return day === 0 || day === 6;
 }
 /** 峰谷切换边界（北京时间的当日分钟数）：09:00 / 12:00 / 14:00 / 18:00。 */
@@ -329,7 +329,7 @@ const TIER_BOUNDARY_MINUTES = [
 ];
 /** 北京时间的当日毫秒数（0–86,400,000）。 */
 function beijingMillisOfDay(timeMs) {
-	return ((timeMs + 288e5) % 864e5 + 864e5) % 864e5;
+	return ((timeMs + 8 * 36e5) % 864e5 + 864e5) % 864e5;
 }
 /**
 * Built-in catalog of current mainstream models as of 2026-08-16, priced from
@@ -3116,8 +3116,8 @@ function createUsageAggregator(persistence, options = {}) {
 		};
 		const toModelDayRecord = (map) => Object.fromEntries([...map].map(([day, models]) => [day, Object.fromEntries(models)]));
 		const toModelDaySiteRecord = (map) => Object.fromEntries([...map].map(([day, models]) => [day, Object.fromEntries([...models].map(([model, sites]) => [model, Object.fromEntries(sites)]))]));
-		const modelKeys = /* @__PURE__ */ new Set([...perfModel.keys(), ...perfModelDigest.keys()]);
-		const hourKeys = /* @__PURE__ */ new Set([...perfHourModel.keys(), ...perfHourDigest.keys()]);
+		const modelKeys = new Set([...perfModel.keys(), ...perfModelDigest.keys()]);
+		const hourKeys = new Set([...perfHourModel.keys(), ...perfHourDigest.keys()]);
 		const perf = modelKeys.size === 0 && hourKeys.size === 0 ? void 0 : {
 			byModel: Object.fromEntries([...modelKeys].map((model) => {
 				const live = perfModel.get(model);
@@ -3128,7 +3128,7 @@ function createUsageAggregator(persistence, options = {}) {
 			byHourModel: Object.fromEntries([...hourKeys].sort().map((hour) => {
 				const liveModels = perfHourModel.get(hour);
 				const digestModels = perfHourDigest.get(hour);
-				const modelKeysInHour = /* @__PURE__ */ new Set([...liveModels?.keys() ?? [], ...digestModels?.keys() ?? []]);
+				const modelKeysInHour = new Set([...liveModels?.keys() ?? [], ...digestModels?.keys() ?? []]);
 				return [hour, Object.fromEntries([...modelKeysInHour].map((model) => {
 					const live = liveModels?.get(model);
 					const restored = digestModels?.get(model);
@@ -3331,11 +3331,7 @@ function tc3Authorization(secretId, secretKey, payload, timestamp) {
 	const canonicalRequest = `POST\n/\n\n${`content-type:application/json; charset=utf-8\nhost:${TOKENHUB_HOST}\n`}\ncontent-type;host\n${createHash("sha256").update(payload).digest("hex")}`;
 	const hashedCanonical = createHash("sha256").update(canonicalRequest).digest("hex");
 	const stringToSign = `TC3-HMAC-SHA256\n${String(timestamp)}\n${date}/${TOKENHUB_SERVICE}/tc3_request\n${hashedCanonical}`;
-	const kDate = createHmac("sha256", date).update(secretKey).digest();
-	const kService = createHmac("sha256", kDate).update(TOKENHUB_SERVICE).digest();
-	const kSigning = createHmac("sha256", kService).update("tc3_request").digest();
-	const signature = createHmac("sha256", kSigning).update(stringToSign).digest("hex");
-	return `TC3-HMAC-SHA256 Credential=${secretId}/${date}/${TOKENHUB_SERVICE}/tc3_request, SignedHeaders=content-type;host, Signature=${signature}`;
+	return `TC3-HMAC-SHA256 Credential=${secretId}/${date}/${TOKENHUB_SERVICE}/tc3_request, SignedHeaders=content-type;host, Signature=${createHmac("sha256", createHmac("sha256", createHmac("sha256", createHmac("sha256", date).update(secretKey).digest()).update(TOKENHUB_SERVICE).digest()).update("tc3_request").digest()).update(stringToSign).digest("hex")}`;
 }
 /**
 * 调用一次 TokenHub 管控面接口：TC3 签名 + 超时保护，返回响应 JSON 的 `Response`。
@@ -4099,7 +4095,7 @@ const declaredGate = createCooldownGate({
 	cooldownMs: 6e4
 });
 /** 会触及原型链的路径段：一律拒绝（读结果不是文档自带字段）。 */
-const FORBIDDEN_SEGMENTS = /* @__PURE__ */ new Set([
+const FORBIDDEN_SEGMENTS = new Set([
 	"__proto__",
 	"constructor",
 	"prototype"
@@ -4640,6 +4636,29 @@ function buildPrices(models) {
 function asPrice(value) {
 	return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : void 0;
 }
+/** models.dev 常把同一模型收录在多个 provider 下（厂商 + 转售）。这些 id 是模型
+*  自身的厂商，其报价视为权威：转售可能加价，也可能省略 cache_read 而落到下方
+*  `input * 0.1` 的猜测值。去重时优先采用。 */
+const FIRST_PARTY_PRICE_SOURCES = new Set([
+	"anthropic",
+	"openai",
+	"google",
+	"mistral",
+	"deepseek",
+	"moonshotai",
+	"zhipuai",
+	"alibaba",
+	"alibaba-cn",
+	"xai",
+	"meta",
+	"cohere",
+	"ai21",
+	"minimax",
+	"stepfun",
+	"upstage",
+	"perplexity",
+	"morph"
+]);
 /**
 * models.dev 响应 → 目录外补充条目。不再按厂商白名单过滤：凡是有有效
 * cost 的模型都纳入（探活模型可能来自任何预制厂商，白名单会漏掉）。厂商
@@ -4649,12 +4668,16 @@ function asPrice(value) {
 */
 function buildExtraModels(data) {
 	if (data === null || typeof data !== "object") return [];
-	const catalogKeys = /* @__PURE__ */ new Set([...MODEL_CATALOG.map((entry) => entry.key.toLowerCase()), ...Object.keys(MODEL_KEY_ALIASES).map((key) => MODEL_KEY_ALIASES[key]?.toLowerCase() ?? key.toLowerCase())]);
-	const extras = [];
+	const catalogKeys = new Set([...MODEL_CATALOG.map((entry) => entry.key.toLowerCase()), ...Object.keys(MODEL_KEY_ALIASES).map((key) => MODEL_KEY_ALIASES[key]?.toLowerCase() ?? key.toLowerCase())]);
+	const offers = /* @__PURE__ */ new Map();
+	const familyVendorVotes = /* @__PURE__ */ new Map();
 	for (const [providerId, providerDoc] of Object.entries(data)) {
 		if (providerDoc === null || typeof providerDoc !== "object") continue;
 		const models = providerDoc.models;
 		if (models === null || typeof models !== "object") continue;
+		const providerKey = providerId.toLowerCase();
+		const providerName = providerDoc.name;
+		const providerDisplay = MODELS_DEV_PROVIDERS[providerKey] ?? (typeof providerName === "string" && providerName !== "" ? providerName : providerId);
 		for (const [modelId, modelDoc] of Object.entries(models)) {
 			const catalogKey = (MODEL_KEY_ALIASES[modelId] ?? modelId).toLowerCase();
 			if (catalogKeys.has(catalogKey)) continue;
@@ -4665,20 +4688,87 @@ function buildExtraModels(data) {
 			const input = asPrice(cost.input);
 			const output = asPrice(cost.output);
 			if (input === void 0 || output === void 0) continue;
-			const cacheRead = asPrice(cost.cache_read) ?? input * .1;
+			const declaredCacheRead = asPrice(cost.cache_read);
+			const cacheRead = declaredCacheRead ?? input * .1;
 			const name = modelDoc.name;
-			extras.push({
-				key,
-				name: typeof name === "string" && name !== "" ? name : modelId,
-				provider: MODELS_DEV_PROVIDERS[providerId.toLowerCase()] ?? providerId,
-				price: {
-					input,
-					cacheHit: cacheRead,
-					output
+			const familyValue = modelDoc.family;
+			const family = typeof familyValue === "string" && familyValue !== "" ? familyValue : void 0;
+			const slash = modelId.indexOf("/");
+			const namespace = slash > 0 ? modelId.slice(0, slash).toLowerCase() : "";
+			const firstParty = FIRST_PARTY_PRICE_SOURCES.has(providerKey) || namespace !== "" && namespace === providerKey;
+			if (firstParty && family !== void 0) {
+				let votes = familyVendorVotes.get(family);
+				if (votes === void 0) {
+					votes = /* @__PURE__ */ new Map();
+					familyVendorVotes.set(family, votes);
 				}
+				votes.set(providerDisplay, (votes.get(providerDisplay) ?? 0) + 1);
+			}
+			let list = offers.get(key);
+			if (list === void 0) {
+				list = [];
+				offers.set(key, list);
+			}
+			list.push({
+				entry: {
+					key,
+					name: typeof name === "string" && name !== "" ? name : modelId,
+					provider: providerDisplay,
+					price: {
+						input,
+						cacheHit: cacheRead,
+						output
+					}
+				},
+				input,
+				output,
+				pair: `${input}/${output}`,
+				firstParty,
+				declared: declaredCacheRead !== void 0,
+				namespace,
+				...family === void 0 ? {} : { family },
+				providerDisplay
 			});
 		}
 	}
+	const familyVendor = /* @__PURE__ */ new Map();
+	for (const [family, votes] of familyVendorVotes) {
+		let winner;
+		let winnerVotes = 0;
+		for (const [vendor, count] of votes) if (count > winnerVotes) {
+			winnerVotes = count;
+			winner = vendor;
+		}
+		if (winner !== void 0) familyVendor.set(family, winner);
+	}
+	const extras = [];
+	for (const list of offers.values()) {
+		const firstPartyRow = list.find((candidate) => candidate.firstParty);
+		let pool;
+		if (firstPartyRow !== void 0) pool = list.filter((candidate) => candidate.firstParty);
+		else {
+			const tally = /* @__PURE__ */ new Map();
+			for (const candidate of list) tally.set(candidate.pair, (tally.get(candidate.pair) ?? 0) + 1);
+			let consensus;
+			let consensusCount = 0;
+			for (const [pair, count] of tally) if (count > consensusCount) {
+				consensusCount = count;
+				consensus = pair;
+			}
+			if (consensusCount > 1) pool = list.filter((candidate) => candidate.pair === consensus);
+			else {
+				const sorted = [...list].sort((a, b) => a.input - b.input || a.output - b.output);
+				const median = sorted[Math.floor((sorted.length - 1) / 2)];
+				pool = median === void 0 ? [] : [median];
+			}
+		}
+		const best = pool.find((candidate) => candidate.declared) ?? pool[0];
+		if (best === void 0) continue;
+		const familyName = list.find((candidate) => candidate.family !== void 0)?.family;
+		const learnedVendor = familyName === void 0 ? void 0 : familyVendor.get(familyName);
+		best.entry.provider = learnedVendor ?? (best.firstParty ? best.providerDisplay : best.namespace !== "" ? MODELS_DEV_PROVIDERS[best.namespace] ?? best.namespace : familyName !== void 0 ? familyName.charAt(0).toUpperCase() + familyName.slice(1) : best.providerDisplay);
+		extras.push(best.entry);
+	}
 	return extras;
 }
 /**
@@ -5499,7 +5589,7 @@ const relayGate = createCooldownGate({
 /** Abort a relay fetch when the upstream hangs beyond this budget. */
 const FETCH_TIMEOUT_MS = 8e3;
 /** 指纹识别缓存 TTL（毫秒）：识别结果低频变化，5 分钟内同 origin 不再重复探测。 */
-const FINGERPRINT_TTL_MS = 3e5;
+const FINGERPRINT_TTL_MS = 300 * 1e3;
 /** 每 origin 的识别结果缓存：`kind` 是识别出的中转站程序，`at` 是探测时刻。 */
 const fingerprintCache = /* @__PURE__ */ new Map();
 /** Number, or null when the value is not a finite number (nor numeric string). */
@@ -5635,7 +5725,7 @@ function originOf(baseURL) {
 * 子路径只会得到 404/非中转站格式，因而面板应排除它们，避免误判为
 * 「未识别」。中转站面板只列真正的第三方中转程序。
 */
-const OFFICIAL_HOSTS = /* @__PURE__ */ new Set([
+const OFFICIAL_HOSTS = new Set([
 	"api.deepseek.com",
 	"api.openai.com",
 	"open.bigmodel.cn",
@@ -5839,11 +5929,23 @@ function isLoopbackPeer(req) {
 /** 校验 Host 头是本机回环（精确 127.0.0.0/8 / ::1 / localhost 或空，供 curl 不带 Host 的极简请求）。
 *  拒绝 `127.0.0.1.attacker.com` 这类以 `127.` 开头但解析到外部的 DNS rebinding 域名：
 *  只用 `startsWith('127.')` 会被它穿透，必须精确匹配回环 IP 的字面量。 */
-function isLoopbackHost(req) {
+/**
+* 信任主机名归一化：去空白、去端口、转小写，丢弃空项。与请求侧
+* `host.split(':')[0].toLowerCase()` 同口径，因此匹配忽略大小写与端口。
+* @param hosts - 配置里的原始名单。
+* @returns 归一化后的主机名集合（空集 = 与历史版本行为一致）。
+*/
+function normalizeTrustedHosts(hosts) {
+	if (hosts === void 0) return /* @__PURE__ */ new Set();
+	const names = hosts.filter((host) => typeof host === "string").map((host) => host.trim().split(":")[0]?.toLowerCase() ?? "").filter((host) => host !== "");
+	return new Set(names);
+}
+function isLoopbackHost(req, trustedHosts = /* @__PURE__ */ new Set()) {
 	const host = req.headers.host;
 	if (host === void 0 || host === "") return true;
 	const name = host.split(":")[0];
-	return name === "localhost" || name === "::1" || name !== void 0 && /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(name);
+	if (name === "localhost" || name === "::1" || name !== void 0 && /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(name)) return true;
+	return name !== void 0 && trustedHosts.has(name.toLowerCase());
 }
 /** 校验 Origin 头是否回环（写操作用，防止跨站表单/fetch 改写设置）。Origin 缺失
 *  （curl 或同源 fetch 不带）视为放行，交给下方的 Content-Type 校验兜底；Origin 存在
@@ -5864,10 +5966,15 @@ function isLoopbackOrigin(origin) {
 * @param res - 当前响应。
 * @returns 是否放行；false = 已拒绝并结束响应。
 */
-function guardLoopback(req, res) {
-	if (!(req.method === "GET" || req.method === "POST") || !isLoopbackPeer(req) || !isLoopbackHost(req)) {
+function guardLoopback(req, res, trustedHosts = /* @__PURE__ */ new Set()) {
+	const methodOk = req.method === "GET" || req.method === "POST";
+	const peerOk = isLoopbackPeer(req);
+	const hostOk = isLoopbackHost(req, trustedHosts);
+	if (!methodOk || !peerOk || !hostOk) {
 		res.writeHead(403, { "content-type": "application/json; charset=utf-8" });
-		res.end(JSON.stringify({ error: "forbidden: loopback only" }));
+		const host = req.headers.host;
+		const hint = methodOk && peerOk && typeof host === "string" && host !== "" ? ` (host "${host.slice(0, 80)}" not in trustedHosts)` : "";
+		res.end(JSON.stringify({ error: `forbidden: loopback only${hint}` }));
 		return false;
 	}
 	return true;
@@ -5888,13 +5995,13 @@ const usageBillingSettingsNs = validateSettingsNamespace(BILLING_SETTINGS_NAMESP
 /** 该命名空间的 wire schema：`enableUsageStatsTool` 布尔，默认关闭（issue 诉求）。 */
 const UsageBillingSettingsSchema = z.object({ [ENABLE_USAGE_STATS_TOOL_FIELD]: z.boolean().default(false) });
 /** 实时定价的后台刷新间隔（毫秒）：汇率/模型价低频变化，6 小时一次足够。 */
-const PRICING_REFRESH_INTERVAL_MS = 216e5;
+const PRICING_REFRESH_INTERVAL_MS = 360 * 60 * 1e3;
 /** 历史回放预热的延迟：等宿主启动高峰（插件加载 / 路由挂载）过去再全量折叠，
 *  避免抢启动期的 CPU；纯延迟不阻塞任何请求，面板提前打开也只会提前聚合。 */
 const WARMUP_DELAY_MS = 3e3;
 /** 订阅套餐额度缓存时长（毫秒）：上游配额 API 低频变化，5 分钟足够。 */
-const SUBSCRIPTION_CACHE_MS = 3e5;
-const BALANCE_CACHE_MS = 3e5;
+const SUBSCRIPTION_CACHE_MS = 300 * 1e3;
+const BALANCE_CACHE_MS = 300 * 1e3;
 /** DeepSeek 余额查询的默认凭据引用（与 llm-deepseek 的默认引用一致）。 */
 const DEFAULT_BALANCE_API_KEY_ENV = "DEEPSEEK_API_KEY";
 /**
@@ -5911,7 +6018,7 @@ const SNAPSHOT_INTERVAL_MS = 3e5;
 *  轻量用户暖缓存下的聚合是毫秒级，预算几乎不会触发。 */
 const RESPONSE_BUDGET_MS = 1500;
 /** 鉴权失败告警冷却（毫秒）：同一 provider 在窗口内只提示一次，避免 30 秒轮询刷屏。 */
-const AUTH_WARN_COOLDOWN_MS = 18e5;
+const AUTH_WARN_COOLDOWN_MS = 1800 * 1e3;
 /**
 * 鉴权失败分类告警（P1-5）：余额 / 订阅查询返回 unauthorized 时，按
 * `source:provider` 去重并冷却告警，提示检查 llm-pi-ai 里该 provider 的 apiKeyEnv。
@@ -6243,6 +6350,7 @@ function adaptSessionPersistence(raw) {
 * @param config - optional statsPath override.
 */
 function apply(ctx, config = {}) {
+	const trustedHosts = normalizeTrustedHosts(config.trustedHosts);
 	let usageSettingsScope;
 	const cwd = process.cwd();
 	const dshHome = resolveDshHome();
@@ -6261,8 +6369,7 @@ function apply(ctx, config = {}) {
 	})();
 	const persistReconcileRef = () => {
 		if (reconcileRef === null) return;
-		const payload = JSON.stringify({ ref: reconcileRef });
-		writeFileAtomic(reconcilePath, payload, {
+		writeFileAtomic(reconcilePath, JSON.stringify({ ref: reconcileRef }), {
 			mode: 384,
 			dirMode: 448
 		}).catch(() => {});
@@ -6280,8 +6387,9 @@ function apply(ctx, config = {}) {
 	ctx.effect(() => () => {
 		aggregator.flush();
 	}, "usage-billing: ledger flush on dispose");
+	let pricingReady;
 	const warmupTimer = setTimeout(() => {
-		aggregator.aggregate().then(() => {
+		Promise.resolve(pricingReady).catch(() => {}).then(() => aggregator.aggregate()).then(() => {
 			console.info("[usage-billing] historical replay warmed up; ledger ready");
 		}).catch((error) => {
 			console.warn("[usage-billing] historical replay warmup failed; will fold on first dashboard request:", error);
@@ -6334,7 +6442,7 @@ function apply(ctx, config = {}) {
 		kind: "exact",
 		path: "/api/billing/notify-claim",
 		handler: async (req, res) => {
-			if (!guardLoopback(req, res)) return;
+			if (!guardLoopback(req, res, trustedHosts)) return;
 			if (req.method !== "POST") {
 				res.writeHead(405, { "content-type": "application/json; charset=utf-8" });
 				res.end(JSON.stringify({ error: "method not allowed" }));
@@ -6544,7 +6652,7 @@ function apply(ctx, config = {}) {
 		pricingSyncedAt = Date.now();
 		applyLivePricing(live);
 	};
-	refreshPricing();
+	pricingReady = refreshPricing();
 	ctx.effect(() => {
 		const timer = setInterval(() => {
 			refreshPricing();
@@ -6557,7 +6665,7 @@ function apply(ctx, config = {}) {
 		kind: "exact",
 		path: "/api/billing/pricing",
 		handler: async (req, res) => {
-			if (!guardLoopback(req, res)) return;
+			if (!guardLoopback(req, res, trustedHosts)) return;
 			res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
 			res.end(JSON.stringify({
 				...live,
@@ -6569,7 +6677,7 @@ function apply(ctx, config = {}) {
 		kind: "exact",
 		path: "/api/billing/pricing/refresh",
 		handler: async (req, res) => {
-			if (!guardLoopback(req, res)) return;
+			if (!guardLoopback(req, res, trustedHosts)) return;
 			if (req.method !== "POST") {
 				res.writeHead(405, { "content-type": "application/json; charset=utf-8" });
 				res.end(JSON.stringify({ error: "method not allowed" }));
@@ -6601,7 +6709,7 @@ function apply(ctx, config = {}) {
 		kind: "exact",
 		path: "/api/billing/balance",
 		handler: async (req, res) => {
-			if (!guardLoopback(req, res)) return;
+			if (!guardLoopback(req, res, trustedHosts)) return;
 			res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
 			const piProviders = await readPiAiProviders(ctx.settings);
 			const providers = { ...piProviders };
@@ -6663,7 +6771,7 @@ function apply(ctx, config = {}) {
 		kind: "exact",
 		path: "/api/billing/usage-tool",
 		handler: async (req, res) => {
-			if (!guardLoopback(req, res)) return;
+			if (!guardLoopback(req, res, trustedHosts)) return;
 			res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
 			const enabled = usageSettingsScope?.get().enableUsageStatsTool ?? false;
 			if (req.method === "GET") {
@@ -6750,7 +6858,7 @@ function apply(ctx, config = {}) {
 		kind: "exact",
 		path: "/api/billing/subscriptions",
 		handler: async (req, res) => {
-			if (!guardLoopback(req, res)) return;
+			if (!guardLoopback(req, res, trustedHosts)) return;
 			res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
 			if (Date.now() - quotaCache.at >= SUBSCRIPTION_CACHE_MS) try {
 				await refreshQuotas();
@@ -6786,7 +6894,7 @@ function apply(ctx, config = {}) {
 		kind: "exact",
 		path: "/api/billing/relay-quotas",
 		handler: async (req, res) => {
-			if (!guardLoopback(req, res)) return;
+			if (!guardLoopback(req, res, trustedHosts)) return;
 			res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
 			if (Date.now() - relayCache.at >= SUBSCRIPTION_CACHE_MS) try {
 				await refreshRelay();
@@ -6808,7 +6916,7 @@ function apply(ctx, config = {}) {
 		kind: "exact",
 		path: "/api/billing/usage-stats",
 		handler: async (req, res) => {
-			if (!guardLoopback(req, res)) return;
+			if (!guardLoopback(req, res, trustedHosts)) return;
 			res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
 			const decorate = (doc) => ({
 				...doc,
@@ -6845,4 +6953,4 @@ function apply(ctx, config = {}) {
 	}), "usage-billing: usage-stats route");
 }
 //#endregion
-export { adaptSessionPersistence, apply, createFileUsageLedgerStore, guardLoopback, inject, readPiAiProviderRoutes, resolveSubscriptionKeys };
+export { adaptSessionPersistence, apply, createFileUsageLedgerStore, guardLoopback, inject, normalizeTrustedHosts, readPiAiProviderRoutes, resolveSubscriptionKeys };

package/lib/types/client/usage-billing-settings.d.ts

@@ -6,7 +6,7 @@
  * client 半区在「设置」Tab 渲染开关并写入同一命名空间。缺省的默认行为是关闭——
  * 避免该工具默认占用模型每次请求的上下文（coding 场景通常在仪表盘看用量）。
  */
-import type { UserPriceEntry } from './pricing.ts';
+import type { CostCurrency, UserPriceEntry } from './pricing.ts';
 /** 设置命名空间 id（小写 kebab-case）。 */
 export declare const BILLING_SETTINGS_NAMESPACE = "ui-usage-billing";
 /** 该命名空间下用户可编辑的字段名。 */
@@ -107,6 +107,20 @@ export declare const LIVE_COST_BAR_PREF_EVENT = "dsh.ui-usage-billing.livecost-p
 export declare function loadLiveCostBarPrefs(): LiveCostBarPrefs;
 /** 写入即时代费条偏好。失败静默（展示偏好非关键）。 */
 export declare function saveLiveCostBarPrefs(prefs: LiveCostBarPrefs): void;
+/**
+ * 显示币种（¥ / ≈$）。纯 client 偏好，存 localStorage；仪表盘、侧边栏卡片与
+ * 输入框胶囊分属不同 React 树，跨树同步走 localStorage + `CURRENCY_PREF_EVENT`
+ * CustomEvent（同文档即时生效，跨标签页靠 storage 事件）——与即时代费条偏好同一套做法。
+ */
+export declare const CURRENCY_STORAGE_KEY = "dsh.ui-usage-billing.currency";
+/** 币种切换后派发的 CustomEvent 名（另一棵树监听它即时重读）。 */
+export declare const CURRENCY_PREF_EVENT = "dsh.ui-usage-billing.currency-pref";
+/** 默认币种：人民币（保持历史行为）。 */
+export declare const DEFAULT_CURRENCY: CostCurrency;
+/** 读取显示币种（损坏/缺失/非法值一律回退默认）。仅在浏览器半区调用。 */
+export declare function loadCurrency(): CostCurrency;
+/** 写入显示币种。失败静默（展示偏好非关键）。 */
+export declare function saveCurrency(currency: CostCurrency): void;
 /** 用户自定义单价（与 client/pricing.ts 的 `UserPriceEntry` 同形；type import，无运行时依赖）。 */
 export type StoredUserPrice = UserPriceEntry;
 /** 自定义价表：模型（+可选来源）→ 单价，条目列表（支持同名模型绑定不同中转站 origin）。 */

package/lib/types/index.d.ts

@@ -19,6 +19,16 @@ import type { SettingsProvider } from '@deepseek-ai/dsh-settings';
 import { type UsageLedgerStore, type UsagePersistence } from './aggregate.ts';
 import type { CustomBalanceConfig, DeclaredEndpointConfig, SubscriptionPlanConfig } from './pricing-shared.ts';
 import { type IdentifiedSubscriptionPlan, type SubscriptionKeys } from './subscriptions.ts';
+/** 校验 Host 头是本机回环（精确 127.0.0.0/8 / ::1 / localhost 或空，供 curl 不带 Host 的极简请求）。
+ *  拒绝 `127.0.0.1.attacker.com` 这类以 `127.` 开头但解析到外部的 DNS rebinding 域名：
+ *  只用 `startsWith('127.')` 会被它穿透，必须精确匹配回环 IP 的字面量。 */
+/**
+ * 信任主机名归一化：去空白、去端口、转小写，丢弃空项。与请求侧
+ * `host.split(':')[0].toLowerCase()` 同口径，因此匹配忽略大小写与端口。
+ * @param hosts - 配置里的原始名单。
+ * @returns 归一化后的主机名集合（空集 = 与历史版本行为一致）。
+ */
+export declare function normalizeTrustedHosts(hosts: readonly string[] | undefined): ReadonlySet<string>;
 /**
  * 回环防护守卫：仅接受回环 GET 请求（peer socket 地址 + Host 头同时校验）。
  * 不满足时返回 403 并结束响应；调用方在 handler 顶部调用，返回 false 即已拒绝。
@@ -26,7 +36,7 @@ import { type IdentifiedSubscriptionPlan, type SubscriptionKeys } from './subscr
  * @param res - 当前响应。
  * @returns 是否放行；false = 已拒绝并结束响应。
  */
-export declare function guardLoopback(req: IncomingMessage, res: ServerResponse): boolean;
+export declare function guardLoopback(req: IncomingMessage, res: ServerResponse, trustedHosts?: ReadonlySet<string>): boolean;
 /** Plugin configuration. */
 export interface UsageBillingConfig {
     /** Absolute path to a `.dsh-usage-stats.json` fallback file. */
@@ -60,6 +70,14 @@ export interface UsageBillingConfig {
      * 写死在 declarative.ts。缺省空。
      */
     declaredEndpoints?: readonly DeclaredEndpointConfig[];
+    /**
+     * 允许通过 Host 头校验的额外主机名（反向代理场景）；缺省空，行为与历史版本完全一致。
+     * 仅在 peer socket 已通过回环校验后才参考：socket 校验仍为强制且不受本字段影响，
+     * 本名单只放宽「纵深防御」的第二层。匹配为**精确主机名**，忽略大小写与端口；
+     * 不支持后缀 / 通配符，因此 `evil.com` 永远无法满足 `trusted.com`。
+     * 例：`['llm.example.com']`。
+     */
+    trustedHosts?: string[];
     /** `usage_stats` 工具注入的组合 base（默认 false：不注入）；与设置命名空间同字段，
      *  作为用户设置（设置 Tab 开关）的组合兜底。该工具占用每次请求的上下文，coding 场景多在仪表盘查看。 */
     enableUsageStatsTool?: boolean;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kenz1117/dsh-ui-usage-billing",
   "description": "Usage billing dashboard for DeepSeek Harness: sidebar cost metrics plus a full dashboard modal, priced from a current multi-provider catalog with real usage aggregated from session logs.",
-  "version": "1.4.1",
+  "version": "1.4.3",
   "keywords": [
     "deepseek-harness",
     "deepseek",
@@ -66,7 +66,8 @@
         "0.1.5-alpha.2": "compatible",
         "0.1.5-rc.1": "compatible",
         "0.1.5-rc.2": "compatible",
-        "0.1.6-alpha.1": "compatible"
+        "0.1.6-alpha.1": "compatible",
+        "0.1.6-alpha.2": "compatible"
       }
     }
   },