@linxin666/dsh-usage 0.3.7 → 0.3.9

package/lib/index.js

@@ -1,206 +1,9 @@
-import { Service } from "@deepseek-ai/cordis";
 import z from "schemastery";
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { mkdir, open, readFile, rename, unlink } from "node:fs/promises";
 import { dirname, isAbsolute, join } from "node:path";
+import "@deepseek-ai/cordis";
 import { homedir } from "node:os";
 import { isAbsolute as isAbsolute$1, join as join$1 } from "node:path/posix";
-//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-settings@file+..+..+.dsh-cohorts+0.1.2-alpha.1+deepseek-ai-dsh-setting_b5034a2f9729f21532041bfd08a6ac26/node_modules/@deepseek-ai/dsh-settings/lib/index.js
-/**
-* Structural secret redaction for settings values. `role('secret')` fields are
-* removed from a value before it crosses a wire boundary; a sidecar records
-* each schema-declared secret position and whether it currently holds a value,
-* so a configuration surface can render a write-only input without ever
-* receiving the secret itself.
-* @module @deepseek-ai/dsh-settings/redact
-*/
-/** Whether a value is a plain data object the walker may recurse into. */
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function walk(node, value, path, secrets) {
-	if (node === void 0) return value;
-	if (node.meta?.role === "secret") {
-		secrets.push({
-			path,
-			set: value !== void 0
-		});
-		return;
-	}
-	switch (node.type) {
-		case "object": {
-			const properties = node.dict ?? {};
-			const source = isRecord(value) ? value : void 0;
-			const rebuilt = {};
-			if (source !== void 0) for (const [key, entry] of Object.entries(source)) {
-				if (key in properties) continue;
-				rebuilt[key] = entry;
-			}
-			for (const [key, child] of Object.entries(properties)) {
-				const stripped = walk(child, source?.[key], [...path, key], secrets);
-				if (stripped !== void 0) rebuilt[key] = stripped;
-			}
-			return source === void 0 && Object.keys(rebuilt).length === 0 ? value : rebuilt;
-		}
-		case "dict": {
-			if (!isRecord(value)) return value;
-			const rebuilt = {};
-			for (const [key, entry] of Object.entries(value)) {
-				const stripped = walk(node.inner, entry, [...path, key], secrets);
-				if (stripped !== void 0) rebuilt[key] = stripped;
-			}
-			return rebuilt;
-		}
-		case "array":
-			if (!Array.isArray(value)) return value;
-			return value.map((entry, index) => walk(node.inner, entry, [...path, String(index)], secrets));
-		default: return value;
-	}
-}
-/**
-* Service Definition for the user-settings capability seam (`ctx.settings`). Providers store one raw document of
-* per-namespace sections; plugins register a namespace schema and read the
-* resolved value, which layers schema defaults, the registrant's composition
-* `base`, and the user document section, in that order.
-* @module @deepseek-ai/dsh-settings
-*/
-const NAMESPACE_PATTERN = /^[a-z][a-z0-9-]*$/;
-/**
-* Brand a raw string as a {@link SettingsNamespace}.
-* @param value - candidate namespace; lowercase kebab-case, as in plugin short names.
-* @returns the branded namespace.
-*/
-function settingsNamespace(value) {
-	if (!NAMESPACE_PATTERN.test(value)) throw new TypeError(`settings namespace "${value}" must match ${String(NAMESPACE_PATTERN)}`);
-	return value;
-}
-/**
-* Deep equality over JSON-compatible data (objects, arrays, primitives) — the
-* Service Definition's single change-detection predicate, exported so the invariant
-* companion checks exactly the implementation's relation.
-* @param a - one JSON-compatible value.
-* @param b - the other JSON-compatible value.
-* @returns whether the two values are structurally equal.
-*/
-function deepEqualJson(a, b) {
-	if (a === b) return true;
-	if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) return false;
-	if (Array.isArray(a) || Array.isArray(b)) {
-		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((entry, index) => deepEqualJson(entry, b[index]));
-	}
-	const left = a;
-	const right = b;
-	const keys = Object.keys(left);
-	if (keys.length !== Object.keys(right).length) return false;
-	return keys.every((key) => key in right && deepEqualJson(left[key], right[key]));
-}
-/** Whether a value is a plain data object (not an array, null, or class instance). */
-function isPlainObject(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-	const proto = Object.getPrototypeOf(value);
-	return proto === Object.prototype || proto === null;
-}
-/** Apply one path op to a detached section, returning the next section. */
-function applyPathOp(section, op) {
-	const [head, ...rest] = op.path;
-	if (head === void 0) {
-		if (op.op === "unset") return {};
-		if (!isPlainObject(op.value)) throw new TypeError("settings mutate: setting the section root requires a plain object");
-		return { ...op.value };
-	}
-	if (rest.length === 0) {
-		if (op.op === "set") return {
-			...section,
-			[head]: op.value
-		};
-		const { [head]: _removed, ...kept } = section;
-		return kept;
-	}
-	const child = section[head];
-	if (!isPlainObject(child)) {
-		if (op.op === "unset") return section;
-		return {
-			...section,
-			[head]: applyPathOp({}, {
-				...op,
-				path: rest
-			})
-		};
-	}
-	return {
-		...section,
-		[head]: applyPathOp(child, {
-			...op,
-			path: rest
-		})
-	};
-}
-/**
-* Layer `over` onto `under`: plain objects merge recursively, every other
-* value (arrays included) replaces the lower layer wholesale. `over` never
-* carries `undefined` entries — sections come from parsed documents and write
-* snapshots pass {@link cloneJsonShaped}, which strips them so a sparse patch
-* cannot erase lower keys.
-*/
-function mergeLayers(under, over) {
-	if (over === void 0) return under;
-	if (!isPlainObject(under) || !isPlainObject(over)) return over;
-	const merged = { ...under };
-	for (const [key, value] of Object.entries(over)) merged[key] = key in merged ? mergeLayers(merged[key], value) : value;
-	return merged;
-}
-/** Recursively freeze one resolved value so handed-out snapshots stay immutable. */
-function deepFreeze(value) {
-	if (typeof value !== "object" || value === null || Object.isFrozen(value)) return value;
-	for (const entry of Object.values(value)) deepFreeze(entry);
-	return Object.freeze(value);
-}
-Service.init;
-/**
-* Value mirror of the `FiberState` members {@link isUnloading} compares
-* against: a const enum has no runtime object to import, and the value is
-* needed at runtime (same rationale as the CLI boot driver's mirror).
-*/
-const FIBER_DISPOSED = 4;
-const FIBER_UNLOADING = 5;
-/** Whether the consumer's own fiber is tearing down (not just losing the settings service). */
-function isUnloading(ctx) {
-	const state = ctx.fiber.state;
-	return state === FIBER_UNLOADING || state === FIBER_DISPOSED;
-}
-/**
-* Install the canonical optional-settings consumer wiring: while a settings
-* service exists, register `ns` with the consumer's composition entry as the
-* `base` layer and point the source thunk at the resolved scope; when the
-* service goes away (disposal, provider reload), fall back to the entry so
-* the consumer keeps working exactly as composed. The registration rides the
-* scoped fiber, so no settings service ever mounted means none of this runs.
-* @param ctx - consumer plugin context owning the wiring.
-* @param ns - the consumer-owned settings namespace.
-* @param schema - schema resolving the namespace (typically the plugin Config).
-* @param entry - the consumer's composition entry config, used as `base`.
-* @param hooks - source sink and change notification.
-*/
-function installSettingsSection(ctx, ns, schema, entry, hooks) {
-	ctx.inject(["settings"], (sctx) => {
-		const scope = sctx.settings.register(ns, schema, {
-			base: entry,
-			...hooks.validate === void 0 ? {} : { validate: hooks.validate }
-		});
-		hooks.setSource(() => scope.get());
-		sctx.effect(() => () => {
-			if (isUnloading(ctx)) return;
-			hooks.setSource(() => entry);
-			hooks.onChange();
-		});
-		hooks.onChange();
-		scope.watch(() => {
-			if (isUnloading(ctx)) return;
-			hooks.onChange();
-		});
-	});
-}
-//#endregion
 //#region src/mount-once.ts
 /**
 * Host single-instance guard shared by the plugin family. The family bundle
@@ -242,7 +45,30 @@ function mountOnce(packageName, fn) {
 	});
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-credentials@file+..+..+.dsh-cohorts+0.1.2-alpha.1+deepseek-ai-dsh-cred_2fd4ad69ebe2ff7cfc47e1238c01d827/node_modules/@deepseek-ai/dsh-credentials/lib/index.js
+//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-brand@0.1.2-alpha.2_@deepseek-ai+cordis@4.0.2_@deepseek-ai+dsh-invaria_1a52edab8cda52d70d5ed37d8a2ca6fd/node_modules/@deepseek-ai/dsh-brand/lib/index.js
+/**
+* Duplicate-install-safe nominal string helpers.
+*
+* A brand makes structurally-identical strings non-interchangeable at the type
+* level: a `SessionId` cannot be passed where a `ToolCallId` is expected, even
+* though both are plain strings at runtime. Comparison, logging, and
+* serialization all behave as ordinary strings.
+*
+* This package owns no concrete id and keeps no runtime identity or mutable
+* state, so independently installed copies produce interchangeable values.
+*
+* @module @deepseek-ai/dsh-brand
+*/
+/**
+* Apply a compile-time string brand without changing the value.
+* @param value - string admitted by the domain that owns the target brand.
+* @returns the same string with the requested compile-time brand.
+*/
+function brandString(value) {
+	return value;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-credentials@0.1.2-alpha.2_@deepseek-ai+cordis@4.0.2_@deepseek-ai+dsh-i_2732fefa2ea8a51d5123e14b95af2051/node_modules/@deepseek-ai/dsh-credentials/lib/index.js
 /**
 * Service Definition for the credential-reference capability seam (`ctx.credentials`). Settings and composition files carry
 * *references* to secrets — environment-variable names — while providers own
@@ -262,7 +88,7 @@ const KEY_SEGMENT_PATTERN = /^[a-z][a-z0-9-]*$/;
 */
 function credentialRef(value) {
 	if (!isCredentialRefName(value)) throw new TypeError(`credential ref "${value}" must match ${String(REF_PATTERN)}`);
-	return value;
+	return brandString(value);
 }
 /**
 * Whether a raw string could name a reference at all. Consumers that receive
@@ -285,7 +111,7 @@ function isCredentialRefName(value) {
 */
 function credentialKey(scope, id) {
 	for (const segment of [scope, id]) if (!KEY_SEGMENT_PATTERN.test(segment)) throw new TypeError(`credential key segment "${segment}" must match ${String(KEY_SEGMENT_PATTERN)}`);
-	return `${scope}/${id}`;
+	return brandString(`${scope}/${id}`);
 }
 //#endregion
 //#region src/dsh-home.ts
@@ -349,8 +175,9 @@ function toIso(value) {
 	}
 	const text = str(value);
 	if (text === void 0) return void 0;
+	if (/^\d+$/.test(text)) return toIso(Number(text));
 	const date = new Date(text);
-	return Number.isNaN(date.getTime()) ? text : date.toISOString();
+	return Number.isNaN(date.getTime()) ? void 0 : date.toISOString();
 }
 /** Used-percent helper guarding zero/absent limits. */
 function usedPercent(used, limit) {
@@ -362,8 +189,14 @@ function usedPercent(used, limit) {
 function bearer(apiKey) {
 	return { authorization: `Bearer ${apiKey}` };
 }
+/**
+* The official pay-as-you-go balance. `deepseek` is the configurable-catalog
+* route key; `deepseek-official` is the live provider route the llm-deepseek
+* adapter registers (sessions and agent-default-model carry it), so both ids
+* must resolve here or the current provider would never be probed.
+*/
 const DEEPSEEK = {
-	ids: ["deepseek"],
+	ids: ["deepseek", "deepseek-official"],
 	displayName: "DeepSeek",
 	balance: {
 		build: ({ apiKey }) => ({
@@ -620,6 +453,79 @@ function siliconFlow(host, ids, currency) {
 		}
 	};
 }
+const ZENMUX = {
+	ids: ["zenmux"],
+	displayName: "ZenMux",
+	balance: {
+		build: ({ apiKey }) => ({
+			url: "https://zenmux.ai/api/v1/management/payg/balance",
+			headers: bearer(apiKey)
+		}),
+		parse: (status, body) => {
+			if (status !== 200 || typeof body !== "object" || body === null) return void 0;
+			const data = body.data;
+			if (typeof data !== "object" || data === null) return void 0;
+			const credits = toNum(data.total_credits);
+			if (credits === void 0) return void 0;
+			return {
+				currency: "USD",
+				totalBalance: money(credits)
+			};
+		}
+	}
+};
+/**
+* OpenAI Codex (ChatGPT subscription) quota over the OAuth access token the
+* pi-ai grant stores — the one plan adapter whose credential is an OAuth
+* token rather than an API key. A 401 here means the stored access token has
+* expired; it refreshes when the harness next runs a Codex request, so the
+* error line tells the user to use Codex once and refresh.
+*/
+const OPENAI_CODEX = {
+	ids: ["openai-codex"],
+	displayName: "Codex (ChatGPT 订阅)",
+	plan: {
+		build: ({ apiKey, accountId }) => ({
+			url: "https://chatgpt.com/backend-api/wham/usage",
+			headers: {
+				authorization: `Bearer ${apiKey}`,
+				"user-agent": "codex-cli",
+				accept: "application/json",
+				...accountId !== void 0 ? { "chatgpt-account-id": accountId } : {}
+			}
+		}),
+		parse: (status, body) => {
+			if (status !== 200 || typeof body !== "object" || body === null) return void 0;
+			const rateLimit = body.rate_limit;
+			if (typeof rateLimit !== "object" || rateLimit === null) return void 0;
+			const windows = [];
+			const rows = rateLimit.primary_window !== void 0 || rateLimit.secondary_window !== void 0 ? [rateLimit.primary_window, rateLimit.secondary_window] : [];
+			for (const entry of rows) {
+				if (typeof entry !== "object" || entry === null) continue;
+				const row = entry;
+				const percent = toNum(row.used_percent);
+				if (percent === void 0) continue;
+				const seconds = toNum(row.limit_window_seconds);
+				windows.push({
+					key: codexWindowKey(seconds),
+					percent: Math.max(0, Math.min(100, percent)),
+					resetsAt: toIso(row.reset_at)
+				});
+			}
+			if (windows.length === 0) return void 0;
+			return { windows };
+		}
+	}
+};
+/** Map a Codex window length in seconds onto the shared window key vocabulary. */
+function codexWindowKey(seconds) {
+	if (seconds === void 0) return "window";
+	if (seconds === 18e3) return "5h";
+	if (seconds === 604800) return "week";
+	if (seconds === 2592e3) return "month";
+	const hours = seconds / 3600;
+	return hours >= 24 ? `${Math.round(hours / 24)}_day` : `${Math.round(hours)}_hour`;
+}
 /**
 * The adapter registry, in no particular order. Route keys come from the
 * pi-ai provider catalog plus the routes this deployment observed in user
@@ -635,36 +541,26 @@ const PROVIDER_ADAPTERS = [
 	OPENCODE_GO,
 	minimaxPlan("api.minimaxi.com", ["minimax-cn"]),
 	minimaxPlan("api.minimax.io", ["minimax"]),
+	OPENAI_CODEX,
 	OPENROUTER,
 	siliconFlow("api.siliconflow.cn", ["siliconflow", "siliconflow-cn"], "CNY"),
 	siliconFlow("api.siliconflow.com", ["siliconflow-intl"], "USD"),
-	{
-		ids: ["zenmux"],
-		displayName: "ZenMux",
-		balance: {
-			build: ({ apiKey }) => ({
-				url: "https://zenmux.ai/api/v1/management/payg/balance",
-				headers: bearer(apiKey)
-			}),
-			parse: (status, body) => {
-				if (status !== 200 || typeof body !== "object" || body === null) return void 0;
-				const data = body.data;
-				if (typeof data !== "object" || data === null) return void 0;
-				const credits = toNum(data.total_credits);
-				if (credits === void 0) return void 0;
-				return {
-					currency: "USD",
-					totalBalance: money(credits)
-				};
-			}
-		}
-	}
+	ZENMUX
 ];
 /** Find the adapter serving a provider route key, if any. */
 function adapterFor(provider) {
 	return PROVIDER_ADAPTERS.find((adapter) => adapter.ids.includes(provider));
 }
 /**
+* Whether a provider route belongs to the official DeepSeek family: the only
+* family with a spend price book and a settings-section-owned env credential
+* (llm-deepseek) rather than a pi-ai profile. Drives the env fallback in
+* credential resolution and the fold-time cost stamping.
+*/
+function isDeepSeekProviderRoute(provider) {
+	return adapterFor(provider) === DEEPSEEK;
+}
+/**
 * Best-effort human message from a provider error body, for the per-provider
 * error line. Never throws; truncated to one short sentence.
 */
@@ -678,6 +574,99 @@ function providerErrorMessage(status, body) {
 	return `HTTP ${status}${message === void 0 ? "" : `: ${message.slice(0, 120)}`}`;
 }
 //#endregion
+//#region src/core/pricing.ts
+/** The published peak windows: weekday 09:00-12:00 and 14:00-18:00. */
+const PEAK_WINDOWS = [{
+	from: 540,
+	to: 720
+}, {
+	from: 840,
+	to: 1080
+}];
+/** Beijing is UTC+8 year-round (no DST), so a fixed shift is exact. */
+const BEIJING_UTC_OFFSET_MS = 8 * 36e5;
+/** deepseek-v4-flash (and the flash-class vision experiment). */
+const FLASH_PRICE = {
+	cacheHit: {
+		offPeak: .05,
+		peak: .1
+	},
+	inputMiss: {
+		offPeak: 1.5,
+		peak: 3
+	},
+	output: {
+		offPeak: 4.5,
+		peak: 9
+	}
+};
+/** deepseek-v4-pro. */
+const PRO_PRICE = {
+	cacheHit: {
+		offPeak: .15,
+		peak: .3
+	},
+	inputMiss: {
+		offPeak: 4.5,
+		peak: 9
+	},
+	output: {
+		offPeak: 13.5,
+		peak: 27
+	}
+};
+function withinWindow(minuteOfDay) {
+	return PEAK_WINDOWS.find((window) => minuteOfDay >= window.from && minuteOfDay < window.to);
+}
+/**
+* The DeepSeek billing period at `ms`, plus when it next flips. The clock is
+* Beijing time regardless of the host timezone (UTC+8 has no DST, so a fixed
+* shift is exact). `boundaryMs` is the instant the current period ends — the
+* window's close while peaking, the next window's open otherwise.
+*/
+function deepseekPeriodAt(ms) {
+	const shifted = new Date(ms + BEIJING_UTC_OFFSET_MS);
+	const weekday = shifted.getUTCDay();
+	const minuteOfDay = shifted.getUTCHours() * 60 + shifted.getUTCMinutes();
+	const current = weekday >= 1 && weekday <= 5 ? withinWindow(minuteOfDay) : void 0;
+	if (current !== void 0) return {
+		peak: true,
+		boundaryMs: ms + (current.to - minuteOfDay) * 6e4 - shifted.getUTCSeconds() * 1e3 - shifted.getUTCMilliseconds()
+	};
+	for (let dayOffset = 0; dayOffset < 8; dayOffset += 1) {
+		const day = new Date(ms + BEIJING_UTC_OFFSET_MS + dayOffset * 864e5);
+		if (day.getUTCDay() < 1 || day.getUTCDay() > 5) continue;
+		const realDayStart = Date.UTC(day.getUTCFullYear(), day.getUTCMonth(), day.getUTCDate()) - BEIJING_UTC_OFFSET_MS;
+		for (const window of PEAK_WINDOWS) {
+			if (dayOffset === 0 && window.from <= minuteOfDay) continue;
+			return {
+				peak: false,
+				boundaryMs: realDayStart + window.from * 6e4
+			};
+		}
+	}
+	return {
+		peak: false,
+		boundaryMs: ms + 864e5
+	};
+}
+/** The price row for a model id; unknown ids take the flash-class row (documented estimate). */
+function priceFor(model) {
+	return model.includes("v4-pro") ? PRO_PRICE : FLASH_PRICE;
+}
+/**
+* Estimate one call's DeepSeek spend in CNY from its token totals, priced in
+* the billing period at `atMs`. Uncatalogued model ids take the flash-class
+* row; ids from other providers never reach this function (the service gates
+* by route family). Rounded to micro-CNY so the ledger stays readable.
+*/
+function deepseekModelSpend(model, totals, atMs) {
+	const price = priceFor(model);
+	const column = deepseekPeriodAt(atMs).peak ? "peak" : "offPeak";
+	const spend = (totals.cacheReadTokens * price.cacheHit[column] + (totals.inputTokens + totals.cacheWriteTokens) * price.inputMiss[column] + totals.outputTokens * price.output[column]) / 1e6;
+	return Math.round(spend * 1e6) / 1e6;
+}
+//#endregion
 //#region src/core/types.ts
 /** A zeroed totals bucket. */
 function emptyTotals() {
@@ -687,7 +676,8 @@ function emptyTotals() {
 		cacheReadTokens: 0,
 		cacheWriteTokens: 0,
 		reasoningTokens: 0,
-		calls: 0
+		calls: 0,
+		cost: 0
 	};
 }
 /** Add `right` into `left` in place. */
@@ -698,6 +688,7 @@ function addTotals(left, right) {
 	left.cacheWriteTokens += right.cacheWriteTokens;
 	left.reasoningTokens += right.reasoningTokens;
 	left.calls += right.calls;
+	left.cost += right.cost;
 	return left;
 }
 //#endregion
@@ -723,10 +714,21 @@ function createLedgerDocument() {
 	};
 }
 /**
+* Bucket keys come from untrusted directions (persisted JSON, provider and
+* model ids out of session events), so they must never collide with
+* `Object.prototype` plumbing: assigning `day['__proto__']` or reading
+* `day['constructor']` would pollute every object in the host process.
+*/
+function isSafeBucketKey(key) {
+	return key !== "__proto__" && key !== "constructor" && key !== "prototype";
+}
+/**
 * Fold one usage report into the ledger in place. `provider` is the route key
-* and `model` the provider-owned model id the step ran under.
+* and `model` the provider-owned model id the step ran under. Reports keyed
+* by prototype-plumbing names are dropped.
 */
 function foldUsage(doc, atMs, provider, model, usage) {
+	if (!isSafeBucketKey(provider) || !isSafeBucketKey(model)) return;
 	if (usage.calls <= 0 && usage.inputTokens + usage.outputTokens + usage.cacheReadTokens + usage.cacheWriteTokens <= 0) return;
 	const dayKey = localDateKey(atMs);
 	const day = doc.days[dayKey] ?? {};
@@ -741,6 +743,51 @@ function foldUsage(doc, atMs, provider, model, usage) {
 function totalTokens(totals) {
 	return totals.inputTokens + totals.cacheReadTokens + totals.cacheWriteTokens + totals.outputTokens;
 }
+/**
+* Aggregate whole per-day maps (each `provider -> model -> totals`) into the
+* per-provider/per-model summary the overview serves for one day or a range:
+* disjoint bucket sums per provider, per-model rows heaviest first, and the
+* grand total. Pure: reads its inputs, allocates fresh buckets.
+*/
+function summarizeDays(days) {
+	const merged = /* @__PURE__ */ new Map();
+	for (const day of days) for (const [provider, models] of Object.entries(day)) {
+		if (!isSafeBucketKey(provider) || typeof models !== "object" || models === null) continue;
+		let modelMap = merged.get(provider);
+		if (modelMap === void 0) {
+			modelMap = /* @__PURE__ */ new Map();
+			merged.set(provider, modelMap);
+		}
+		for (const [model, totals] of Object.entries(models)) {
+			if (typeof totals !== "object" || totals === null) continue;
+			const bucket = modelMap.get(model) ?? emptyTotals();
+			addTotals(bucket, totals);
+			modelMap.set(model, bucket);
+		}
+	}
+	const providers = [];
+	const totals = emptyTotals();
+	for (const [provider, modelMap] of merged) {
+		const providerTotals = emptyTotals();
+		const modelRows = [...modelMap].map(([model, modelTotals]) => ({
+			model,
+			totals: modelTotals
+		}));
+		for (const row of modelRows) addTotals(providerTotals, row.totals);
+		modelRows.sort((a, b) => totalTokens(b.totals) - totalTokens(a.totals));
+		providers.push({
+			provider,
+			totals: providerTotals,
+			models: modelRows.slice(0, 12)
+		});
+	}
+	providers.sort((a, b) => totalTokens(b.totals) - totalTokens(a.totals));
+	for (const row of providers) addTotals(totals, row.totals);
+	return {
+		totals,
+		providers
+	};
+}
 /** All local-date keys in the ledger, ascending. */
 function ledgerDayKeys(doc) {
 	return Object.keys(doc.days).sort();
@@ -770,7 +817,8 @@ function reviveTotals(value) {
 		cacheReadTokens: num("cacheReadTokens"),
 		cacheWriteTokens: num("cacheWriteTokens"),
 		reasoningTokens: num("reasoningTokens"),
-		calls: num("calls")
+		calls: num("calls"),
+		cost: num("cost")
 	};
 }
 /**
@@ -785,11 +833,13 @@ function deserializeLedger(value) {
 	if (typeof days !== "object" || days === null) return doc;
 	for (const [dateKey, providers] of Object.entries(days)) {
 		if (!/^\d{4}-\d{2}-\d{2}$/.test(dateKey) || typeof providers !== "object" || providers === null) continue;
+		const atMs = (/* @__PURE__ */ new Date(dateKey + "T12:00:00")).getTime();
+		if (!Number.isFinite(atMs) || localDateKey(atMs) !== dateKey) continue;
 		for (const [provider, models] of Object.entries(providers)) {
 			if (typeof models !== "object" || models === null) continue;
 			for (const [model, totals] of Object.entries(models)) {
 				const revived = reviveTotals(totals);
-				if (revived !== void 0) foldUsage(doc, (/* @__PURE__ */ new Date(dateKey + "T12:00:00")).getTime(), provider, model, revived);
+				if (revived !== void 0) foldUsage(doc, atMs, provider, model, revived);
 			}
 		}
 	}
@@ -830,6 +880,47 @@ function planTone(percent) {
 	if (percent >= 70) return "warn";
 	return "ok";
 }
+/**
+* Build the raw pet announce payload for one provider snapshot, or
+* undefined when nothing worth announcing exists. Pure: every payload this
+* returns satisfies the pet's `parseAnnouncement` contract — plan
+* announcements require a numeric percent, so percent-less windows never
+* announce (the pet validator would silently drop them). A priced family
+* (DeepSeek) with spend today announces a cost bubble first; balance-only
+* families announce the balance; plan families announce their tightest
+* percent window.
+*/
+function buildAnnouncement(snapshot, context) {
+	const todayCost = context?.todayCost ?? 0;
+	if (todayCost > 0) {
+		const peak = context?.peak ?? false;
+		const noteParts = [peak ? "高峰时段 计价×2" : "空闲时段 计价减半", ...snapshot.balance !== void 0 ? [`余额 ${formatMoney(snapshot.balance.currency, snapshot.balance.totalBalance)}`] : []];
+		return {
+			kind: "cost",
+			title: snapshot.displayName,
+			amount: `今日 ${formatMoney("CNY", todayCost.toFixed(2))}`,
+			...noteParts.length > 0 ? { note: noteParts.join(" · ") } : {},
+			tone: peak ? "warn" : "ok"
+		};
+	}
+	if (snapshot.balance !== void 0) return {
+		kind: "balance",
+		title: snapshot.displayName,
+		amount: formatMoney(snapshot.balance.currency, snapshot.balance.totalBalance),
+		tone: "ok"
+	};
+	if (snapshot.plan === void 0) return void 0;
+	const window = snapshot.plan.windows.filter((entry) => typeof entry.percent === "number").sort((a, b) => (b.percent ?? 0) - (a.percent ?? 0))[0];
+	if (window === void 0 || window.percent === void 0) return void 0;
+	return {
+		kind: "plan",
+		title: snapshot.displayName,
+		percent: window.percent,
+		...window.resetsAt !== void 0 ? { resetAt: window.resetsAt } : {},
+		...snapshot.plan.planName !== void 0 ? { note: snapshot.plan.planName } : {},
+		tone: planTone(window.percent)
+	};
+}
 /** Best-effort typed service read: absent services resolve to undefined at runtime. */
 function service(ctx, name) {
 	try {
@@ -838,11 +929,27 @@ function service(ctx, name) {
 		return;
 	}
 }
-/** Atomic JSON write through a temp file + rename. */
+/**
+* Atomic JSON write through a unique temp file + fsync + rename. The temp
+* name is per-call so two overlapping flushes can never interleave into one
+* temp file, and the fsync closes the rename-lands-but-bytes-are-not-durable
+* window.
+*/
 async function writeJsonAtomic(path, value) {
-	const temp = path + ".tmp";
-	await writeFile(temp, JSON.stringify(value, null, 1), "utf8");
-	await rename(temp, path);
+	const temp = `${path}.${process.pid}.${Date.now()}.tmp`;
+	try {
+		const handle = await open(temp, "w");
+		try {
+			await handle.writeFile(JSON.stringify(value, null, 1), "utf8");
+			await handle.sync();
+		} finally {
+			await handle.close();
+		}
+		await rename(temp, path);
+	} catch (error) {
+		await unlink(temp).catch(() => {});
+		throw error;
+	}
 }
 /**
 * Read a foreign settings namespace's resolved value (the llm adapter
@@ -853,7 +960,7 @@ function readNamespace(ctx, ns) {
 	try {
 		const settings = service(ctx, "settings");
 		if (settings === void 0) return void 0;
-		return settings.get(settingsNamespace(ns));
+		return settings.get(ns);
 	} catch {
 		return;
 	}
@@ -874,8 +981,16 @@ var UsageService = class {
 	pollTimer;
 	flushTimer;
 	pollInFlight = false;
+	/** The running poll cycle; manual refresh joins it instead of no-oping. */
+	pollPromise;
+	/** Serialized ledger flushes: overlapping debounce/stop flushes queue, never interleave. */
+	flushChain = Promise.resolve();
+	/** True once loadPersisted finished; nothing may overwrite the files before that. */
+	loaded = false;
 	disposed = false;
 	lastSignature;
+	/** Last prune guard: once per local day, and whenever retention shrinks. */
+	lastPrune;
 	constructor(ctx, options) {
 		this.ctx = ctx;
 		this.options = options;
@@ -889,19 +1004,24 @@ var UsageService = class {
 		this.loadPersisted();
 		this.rearmPoll(2e3);
 	}
-	/** Stop timers and flush pending ledger writes. */
+	/**
+	* Stop timers and flush pending ledger writes. The returned promise
+	* resolves after the final flush lands, so a successor instance (quick
+	* disable → enable) can serialize its first load behind it.
+	*/
 	stop() {
 		this.disposed = true;
 		if (this.pollTimer !== void 0) clearTimeout(this.pollTimer);
 		if (this.flushTimer !== void 0) clearTimeout(this.flushTimer);
 		this.sessionListenerDisposer?.();
-		this.flushLedger();
+		return this.flushLedger();
 	}
-	/** Re-apply options live (settings change); the poll cycle picks them up. */
+	/** Re-apply options live (settings change); retention shrink prunes now. */
 	applyOptions(options) {
 		this.options = options;
+		this.pruneIfNeeded();
 	}
-	/** Force one poll now (manual refresh route). */
+	/** Force one poll now (manual refresh route); joins an in-flight cycle. */
 	async refresh() {
 		await this.pollNow();
 	}
@@ -913,19 +1033,23 @@ var UsageService = class {
 		for (const route of routes) {
 			const adapter = adapterFor(route.id);
 			const snapshot = this.snapshots.get(route.id);
+			const error = snapshot?.balanceError ?? snapshot?.planError;
 			providers.push({
 				provider: route.id,
 				displayName: route.displayName || adapter?.displayName || route.id,
 				credential: snapshot?.credential ?? "none",
 				supported: adapter !== void 0 && (adapter.balance !== void 0 || adapter.plan !== void 0),
+				...adapter?.balance !== void 0 ? { balanceSupported: true } : {},
+				...adapter?.plan !== void 0 ? { planSupported: true } : {},
 				...snapshot?.balance !== void 0 ? { balance: snapshot.balance } : {},
 				...snapshot?.plan !== void 0 ? { plan: snapshot.plan } : {},
-				...snapshot?.error !== void 0 ? { error: snapshot.error } : {},
+				...error !== void 0 ? { error } : {},
 				...snapshot?.updatedAt !== void 0 ? { updatedAt: snapshot.updatedAt } : {}
 			});
 		}
 		providers.sort((a, b) => Number(b.supported) - Number(a.supported) || a.displayName.localeCompare(b.displayName));
 		const days = ledgerDayKeys(this.ledger).slice(-30);
+		const range = summarizeDays(days.map((key) => this.ledger.days[key] ?? {}));
 		return {
 			updatedAt: Date.now(),
 			providers,
@@ -937,50 +1061,33 @@ var UsageService = class {
 						date,
 						totals: this.daySummary(date).totals
 					};
-				})
+				}),
+				range: {
+					from: days[0] ?? todayKey,
+					to: days[days.length - 1] ?? todayKey,
+					totals: range.totals,
+					providers: range.providers
+				}
 			}
 		};
 	}
 	/** One local day aggregated per provider. */
 	daySummary(dateKey) {
-		const day = this.ledger.days[dateKey] ?? {};
-		const providers = Object.entries(day).map(([provider, models]) => {
-			const totals = emptyTotals();
-			const modelRows = Object.entries(models).map(([model, modelTotals]) => ({
-				model,
-				totals: modelTotals
-			}));
-			for (const row of modelRows) {
-				totals.inputTokens += row.totals.inputTokens;
-				totals.outputTokens += row.totals.outputTokens;
-				totals.cacheReadTokens += row.totals.cacheReadTokens;
-				totals.cacheWriteTokens += row.totals.cacheWriteTokens;
-				totals.reasoningTokens += row.totals.reasoningTokens;
-				totals.calls += row.totals.calls;
-			}
-			modelRows.sort((a, b) => totalTokens(b.totals) - totalTokens(a.totals));
-			return {
-				provider,
-				totals,
-				models: modelRows.slice(0, 12)
-			};
-		});
-		providers.sort((a, b) => totalTokens(b.totals) - totalTokens(a.totals));
-		const totals = emptyTotals();
-		for (const row of providers) {
-			totals.inputTokens += row.totals.inputTokens;
-			totals.outputTokens += row.totals.outputTokens;
-			totals.cacheReadTokens += row.totals.cacheReadTokens;
-			totals.cacheWriteTokens += row.totals.cacheWriteTokens;
-			totals.reasoningTokens += row.totals.reasoningTokens;
-			totals.calls += row.totals.calls;
-		}
+		const { totals, providers } = summarizeDays([this.ledger.days[dateKey] ?? {}]);
 		return {
 			date: dateKey,
 			totals,
 			providers
 		};
 	}
+	/** Today's ledger spend for one provider's adapter family (0 when unpriced). */
+	familyCostToday(provider) {
+		const family = adapterFor(provider);
+		if (family === void 0) return 0;
+		let cost = 0;
+		for (const row of this.daySummary(localDateKey(Date.now())).providers) if (adapterFor(row.provider) === family) cost += row.totals.cost;
+		return cost;
+	}
 	onSessionEvent(session, event) {
 		try {
 			if (event.type === "request/header") {
@@ -1014,13 +1121,17 @@ var UsageService = class {
 				if (usage === void 0) return;
 				const route = this.sessionRoutes.get(session);
 				if (route === void 0 || route.provider === "") return;
-				foldUsage(this.ledger, Date.now(), route.provider, route.model || "unknown", this.totalsFrom(usage));
+				foldUsage(this.ledger, Date.now(), route.provider, route.model || "unknown", this.totalsFrom(usage, route.provider, route.model || "unknown", Date.now()));
 				this.scheduleFlush();
 			}
 		} catch {}
 	}
-	/** Normalize a provider TokenUsage into the ledger bucket (one call). */
-	totalsFrom(usage) {
+	/**
+	* Normalize a provider TokenUsage into the ledger bucket (one call). The
+	* DeepSeek official family is priced at the fold instant (its billing
+	* period is time-of-day); other families stay unpriced (cost 0).
+	*/
+	totalsFrom(usage, provider, model, atMs) {
 		const totals = emptyTotals();
 		totals.inputTokens = usage.inputTokens;
 		totals.outputTokens = usage.outputTokens;
@@ -1028,14 +1139,23 @@ var UsageService = class {
 		totals.cacheWriteTokens = usage.cacheWriteTokens ?? 0;
 		totals.reasoningTokens = usage.reasoningTokens ?? 0;
 		totals.calls = 1;
+		if (isDeepSeekProviderRoute(provider)) totals.cost = deepseekModelSpend(model, totals, atMs);
 		return totals;
 	}
 	async loadPersisted() {
 		try {
 			const [rawLedger, rawSnapshots] = await Promise.all([readFile(this.ledgerPath, "utf8").catch(() => void 0), readFile(this.snapshotsPath, "utf8").catch(() => void 0)]);
 			if (rawLedger !== void 0) {
-				this.ledger = deserializeLedger(JSON.parse(rawLedger));
+				const loaded = deserializeLedger(JSON.parse(rawLedger));
+				for (const [dayKey, providers] of Object.entries(loaded.days)) {
+					const atMs = (/* @__PURE__ */ new Date(dayKey + "T12:00:00")).getTime();
+					for (const [provider, models] of Object.entries(providers)) for (const [model, totals] of Object.entries(models)) foldUsage(this.ledger, atMs, provider, model, totals);
+				}
 				pruneLedger(this.ledger, localDateKey(Date.now()), this.options.retainDays);
+				this.lastPrune = {
+					dayKey: localDateKey(Date.now()),
+					retainDays: this.options.retainDays
+				};
 			}
 			if (rawSnapshots !== void 0) {
 				const parsed = JSON.parse(rawSnapshots);
@@ -1043,7 +1163,9 @@ var UsageService = class {
 					for (const [provider, snapshot] of Object.entries(parsed.providers)) if (typeof snapshot === "object" && snapshot !== null && typeof snapshot.provider === "string") this.snapshots.set(provider, snapshot);
 				}
 			}
-		} catch {}
+		} catch {} finally {
+			this.loaded = true;
+		}
 	}
 	scheduleFlush() {
 		if (this.flushTimer !== void 0 || this.disposed) return;
@@ -1052,13 +1174,40 @@ var UsageService = class {
 			this.flushLedger();
 		}, FLUSH_DEBOUNCE_MS);
 	}
-	async flushLedger() {
+	/**
+	* Queue one ledger flush behind the previous one. Debounce and stop-time
+	* flushes serialize here, so two `writeJsonAtomic` calls can never run
+	* concurrently on the same path.
+	*/
+	flushLedger() {
+		const next = this.flushChain.then(() => this.writeLedgerOnce());
+		this.flushChain = next.catch(() => {});
+		return next;
+	}
+	async writeLedgerOnce() {
+		if (!this.loaded) return;
 		try {
 			await mkdir(dirname(this.ledgerPath), { recursive: true });
 			await writeJsonAtomic(this.ledgerPath, this.ledger);
 		} catch {}
 	}
+	/**
+	* Prune days past retention. Runs at most once per local day and whenever
+	* `retainDays` shrinks — not only at startup, so long-lived processes and
+	* live settings changes both honor retention.
+	*/
+	pruneIfNeeded() {
+		const todayKey = localDateKey(Date.now());
+		if (this.lastPrune?.dayKey === todayKey && this.lastPrune.retainDays === this.options.retainDays) return;
+		const pruned = pruneLedger(this.ledger, todayKey, this.options.retainDays);
+		this.lastPrune = {
+			dayKey: todayKey,
+			retainDays: this.options.retainDays
+		};
+		if (pruned > 0) this.scheduleFlush();
+	}
 	async persistSnapshots() {
+		if (!this.loaded) return;
 		try {
 			await mkdir(dirname(this.snapshotsPath), { recursive: true });
 			await writeJsonAtomic(this.snapshotsPath, {
@@ -1075,25 +1224,38 @@ var UsageService = class {
 			this.pollNow().finally(() => this.rearmPoll(Math.max(30, this.options.pollIntervalSec) * 1e3));
 		}, delayMs);
 	}
-	/** One poll cycle: enumerate routes, resolve credentials, probe, announce. */
-	async pollNow() {
-		if (this.pollInFlight || this.disposed) return;
+	/**
+	* One poll cycle: enumerate routes, resolve credentials, probe, announce.
+	* A call while a cycle is already running joins that cycle instead of
+	* returning immediately, so a manual refresh always waits for real probes.
+	*/
+	pollNow() {
+		if (this.pollInFlight) return this.pollPromise ?? Promise.resolve();
+		if (this.disposed) return Promise.resolve();
 		this.pollInFlight = true;
-		try {
-			const routes = this.listProviderRoutes();
-			const seen = /* @__PURE__ */ new Set();
-			for (const route of routes) {
-				seen.add(route.id);
-				const adapter = adapterFor(route.id);
-				if (adapter === void 0 || adapter.balance === void 0 && adapter.plan === void 0) continue;
-				await this.probeRoute(route, adapter);
+		const cycle = (async () => {
+			try {
+				this.pruneIfNeeded();
+				const routes = this.listProviderRoutes();
+				const seen = /* @__PURE__ */ new Set();
+				for (const route of routes) {
+					if (this.disposed) return;
+					seen.add(route.id);
+					const adapter = adapterFor(route.id);
+					if (adapter === void 0 || adapter.balance === void 0 && adapter.plan === void 0) continue;
+					await this.probeRoute(route, adapter);
+				}
+				for (const id of [...this.snapshots.keys()]) if (!seen.has(id)) this.snapshots.delete(id);
+				if (this.disposed) return;
+				await this.persistSnapshots();
+				this.announceCurrent();
+			} finally {
+				this.pollInFlight = false;
+				this.pollPromise = void 0;
 			}
-			for (const id of [...this.snapshots.keys()]) if (!seen.has(id)) this.snapshots.delete(id);
-			await this.persistSnapshots();
-			this.announceCurrent();
-		} finally {
-			this.pollInFlight = false;
-		}
+		})();
+		this.pollPromise = cycle;
+		return cycle;
 	}
 	listProviderRoutes() {
 		const routes = /* @__PURE__ */ new Map();
@@ -1110,26 +1272,31 @@ var UsageService = class {
 	async probeRoute(route, adapter) {
 		const credential = await this.resolveCredential(route.id);
 		const previous = this.snapshots.get(route.id);
+		if (credential.key === void 0) {
+			this.snapshots.set(route.id, {
+				provider: route.id,
+				displayName: route.displayName || adapter.displayName,
+				credential: credential.kind,
+				supported: true,
+				updatedAt: Date.now()
+			});
+			return;
+		}
 		const snapshot = {
 			provider: route.id,
 			displayName: route.displayName || adapter.displayName,
 			credential: credential.kind,
 			supported: true,
-			...previous?.balance !== void 0 ? { balance: previous.balance } : {},
-			...previous?.plan !== void 0 ? { plan: previous.plan } : {},
 			updatedAt: Date.now()
 		};
-		if (credential.key === void 0) {
-			snapshot.error = void 0;
-			this.snapshots.set(route.id, snapshot);
-			return;
-		}
-		let probed = false;
 		const runProbe = async (kind) => {
 			const half = adapter[kind];
 			if (half === void 0) return void 0;
 			try {
-				const spec = half.build({ apiKey: credential.key });
+				const spec = half.build({
+					apiKey: credential.key,
+					...credential.accountId !== void 0 ? { accountId: credential.accountId } : {}
+				});
 				const response = await fetch(spec.url, {
 					headers: spec.headers,
 					signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
@@ -1138,7 +1305,6 @@ var UsageService = class {
 				if (!response.ok) throw new Error(providerErrorMessage(response.status, body));
 				const parsed = half.parse(response.status, body);
 				if (parsed === void 0) throw new Error("unrecognized response shape");
-				probed = true;
 				const updatedAt = Date.now();
 				if (kind === "balance") {
 					const fact = parsed;
@@ -1155,23 +1321,27 @@ var UsageService = class {
 					updatedAt
 				};
 			} catch (error) {
-				snapshot.error = error instanceof Error ? error.message.slice(0, 200) : String(error);
+				const message = error instanceof Error ? error.message.slice(0, 200) : String(error);
+				if (kind === "balance") snapshot.balanceError = message;
+				else snapshot.planError = message;
 				return;
 			}
 		};
 		const balance = await runProbe("balance");
 		if (balance !== void 0) snapshot.balance = balance;
+		else if (previous?.balance !== void 0) snapshot.balance = previous.balance;
 		const plan = await runProbe("plan");
 		if (plan !== void 0) snapshot.plan = plan;
-		if (probed) snapshot.error = void 0;
-		if (snapshot.balance === void 0 && snapshot.plan === void 0 && snapshot.error === void 0) snapshot.error = "no credential configured";
+		else if (previous?.plan !== void 0) snapshot.plan = previous.plan;
 		this.snapshots.set(route.id, snapshot);
 	}
 	/**
 	* Resolve the credential backing one route: pi-ai credential records
 	* first, then the profile's apiKeyEnv reference, then the DeepSeek
-	* official adapter's env reference. OAuth grants resolve to a kind with
-	* no key (this plugin does not spend third-party OAuth budgets).
+	* official adapter's env reference. OAuth grants hand their stored access
+	* token to the oauth-aware adapters (Codex plan quota); a stale token
+	* fails its probe with a 401 and refreshes the next time the harness
+	* itself runs that provider.
 	*/
 	async resolveCredential(provider) {
 		const credentials = service(this.ctx, "credentials");
@@ -1182,10 +1352,20 @@ var UsageService = class {
 				kind: "api-key",
 				key: record.key
 			};
-			if (record?.kind === "grant") return { kind: "oauth" };
+			if (record?.kind === "grant" && typeof record.payload === "object" && record.payload !== null) {
+				const payload = record.payload;
+				const access = typeof payload.access === "string" && payload.access !== "" ? payload.access : void 0;
+				const accountId = typeof payload.chatgpt_account_id === "string" && payload.chatgpt_account_id !== "" ? payload.chatgpt_account_id : void 0;
+				if (access !== void 0) return {
+					kind: "oauth",
+					key: access,
+					...accountId !== void 0 ? { accountId } : {}
+				};
+				return { kind: "oauth" };
+			}
 		} catch {}
 		try {
-			const envName = this.piAiProfile(provider)?.apiKeyEnv ?? (provider === "deepseek" ? this.deepseekApiKeyEnv() : void 0);
+			const envName = this.piAiProfile(provider)?.apiKeyEnv ?? (isDeepSeekProviderRoute(provider) ? this.deepseekApiKeyEnv() : void 0);
 			if (typeof envName === "string" && envName !== "") {
 				const resolved = await credentials.resolve(credentialRef(envName));
 				if (resolved?.value !== void 0 && resolved.value !== "") return {
@@ -1205,51 +1385,54 @@ var UsageService = class {
 		return readNamespace(this.ctx, "llm-deepseek")?.apiKeyEnv ?? "DEEPSEEK_API_KEY";
 	}
 	/**
-	* Announce the current provider's balance or plan usage to the pet. In
-	* `change` mode only meaningful value changes re-announce; `off` skips.
+	* Announce the current provider's spend, balance, or plan usage to the pet.
+	* In `change` mode only meaningful value changes re-announce; `off` skips.
+	* The TTL rides the poll interval (bubble_mode `always` re-announces every
+	* cycle, so a TTL of two cycles + margin keeps the bubble continuous
+	* across polls; the pet contract caps the ceiling). A route id the
+	* catalogs spell differently than the snapshot keys falls back to its
+	* adapter family's snapshot. Fully guarded: a malformed snapshot or a
+	* failing pet service must never break the poll loop, and a disposed
+	* service never announces.
 	*/
 	announceCurrent() {
-		if (this.options.bubbleMode === "off") return;
-		let provider = this.current.provider;
-		if (provider === void 0) {
-			const fallback = readNamespace(this.ctx, "agent-default-model");
-			if (fallback?.provider !== void 0) {
-				provider = fallback.provider;
-				this.current = {
-					provider: fallback.provider,
-					model: fallback.model,
-					source: "default"
-				};
-			} else return;
-		}
-		const snapshot = this.snapshots.get(provider);
-		if (snapshot === void 0) return;
-		let announcement;
-		if (snapshot.balance !== void 0) announcement = {
-			kind: "balance",
-			title: snapshot.displayName,
-			amount: formatMoney(snapshot.balance.currency, snapshot.balance.totalBalance),
-			tone: "ok"
-		};
-		else if (snapshot.plan !== void 0 && snapshot.plan.windows.length > 0) {
-			const window = [...snapshot.plan.windows].sort((a, b) => (b.percent ?? 0) - (a.percent ?? 0))[0];
-			announcement = {
-				kind: "plan",
-				title: snapshot.displayName,
-				...window.percent !== void 0 ? { percent: window.percent } : {},
-				...window.resetsAt !== void 0 ? { resetAt: window.resetsAt } : {},
-				...snapshot.plan.planName !== void 0 ? { note: snapshot.plan.planName } : {},
-				tone: window.percent !== void 0 ? planTone(window.percent) : "ok"
-			};
-		} else return;
-		const signature = JSON.stringify(announcement);
-		if (this.options.bubbleMode === "change" && signature === this.lastSignature) return;
-		this.lastSignature = signature;
-		const pet = service(this.ctx, "pet");
+		if (this.disposed || this.options.bubbleMode === "off") return;
 		try {
-			pet?.announce({
+			let provider = this.current.provider;
+			if (provider === void 0) {
+				const fallback = readNamespace(this.ctx, "agent-default-model");
+				if (fallback?.provider !== void 0) {
+					provider = fallback.provider;
+					this.current = {
+						provider: fallback.provider,
+						model: fallback.model,
+						source: "default"
+					};
+				} else return;
+			}
+			let snapshot = this.snapshots.get(provider);
+			if (snapshot === void 0) {
+				const family = adapterFor(provider);
+				if (family !== void 0) {
+					for (const [id, candidate] of this.snapshots) if (adapterFor(id) === family) {
+						snapshot = candidate;
+						break;
+					}
+				}
+			}
+			if (snapshot === void 0) return;
+			const announcement = buildAnnouncement(snapshot, {
+				todayCost: this.familyCostToday(provider),
+				peak: deepseekPeriodAt(Date.now()).peak
+			});
+			if (announcement === void 0) return;
+			const signature = JSON.stringify(announcement);
+			if (this.options.bubbleMode === "change" && signature === this.lastSignature) return;
+			this.lastSignature = signature;
+			const ttlMs = Math.min(72e5, this.options.pollIntervalSec * 2e3 + 3e4);
+			service(this.ctx, "pet")?.announce({
 				source: USAGE_ANNOUNCE_SOURCE,
-				ttlMs: void 0,
+				ttlMs,
 				...announcement
 			});
 		} catch {}
@@ -1383,7 +1566,7 @@ function makeUsageRefreshRoute(service) {
 //#region src/index.ts
 const name = "dsh-usage";
 const inject = ["webServer"];
-const USAGE_SETTINGS_NAMESPACE = settingsNamespace("dsh-usage");
+const USAGE_SETTINGS_NAMESPACE = "dsh-usage";
 const Config = z.object({
 	enabled: z.boolean().default(true),
 	pollIntervalSec: z.number().min(30).max(3600).default(60),
@@ -1402,33 +1585,42 @@ function resolveConfig(config) {
 const apply = mountOnce("@linxin666/dsh-usage", (ctx, config) => {
 	let source = () => config ?? {};
 	let service;
+	let pendingStop;
 	let disposeRoutes;
 	const rearm = () => {
 		const value = resolveConfig(source());
 		if (!value.enabled) {
-			service?.stop();
+			pendingStop = service?.stop();
 			service = void 0;
 			disposeRoutes?.();
 			disposeRoutes = void 0;
 			return;
 		}
 		if (service === void 0) {
-			service = new UsageService(ctx, value);
-			service.start();
-			const disposers = [makeUsageOverviewRoute(service), makeUsageRefreshRoute(service)].map((route) => ctx.webServer.register(route));
-			disposeRoutes = () => {
-				for (const dispose of disposers) try {
-					dispose();
-				} catch {}
+			const next = new UsageService(ctx, value);
+			service = next;
+			const begin = () => {
+				if (service !== next) return;
+				next.start();
+				const disposers = [makeUsageOverviewRoute(next), makeUsageRefreshRoute(next)].map((route) => ctx.webServer.register(route));
+				disposeRoutes = () => {
+					for (const dispose of disposers) try {
+						dispose();
+					} catch {}
+				};
 			};
+			if (pendingStop !== void 0) pendingStop.then(begin, begin);
+			else begin();
 		} else service.applyOptions(value);
 	};
-	installSettingsSection(ctx, USAGE_SETTINGS_NAMESPACE, Config, config ?? {}, {
-		setSource: (next) => {
-			source = next;
-			rearm();
-		},
-		onChange: rearm
+	ctx.inject(["settings"], (settingsCtx) => {
+		settingsCtx.settings.installSection(ctx, USAGE_SETTINGS_NAMESPACE, Config, config ?? {}, {
+			setSource: (next) => {
+				source = next;
+				rearm();
+			},
+			onChange: rearm
+		});
 	});
 	ctx.effect(() => {
 		rearm();