@linxin666/dsh-usage 0.4.1 → 0.4.3

package/lib/types/mount-once.d.ts

@@ -4,19 +4,50 @@
  * the loader accepts a standalone install of the same package side by side;
  * without this guard the second instance would still re-register the same
  * webserver routes, tools, settings namespaces, and system-prompt sections
- * and fail the boot. mountOnce makes the second host apply a no-op for the
- * lifetime of the first instance (the browser half is already deduped by
- * package name in the client module host).
+ * and fail the boot. mountOnce makes a mount of an already-mounted package a
+ * no-op for as long as the first instance lives (the browser half is already
+ * deduped by package name in the client module host).
+ *
+ * A no-op is only safe while the holder is ALIVE. The holder can be disposed
+ * long after the refused mount ran its course: the Host reloads a profile by
+ * creating the new loader entries before the old ones are torn down (a
+ * plugin-manager enable/disable/install write, a settings-driven row reload,
+ * HMR), so the new aggregate shell entry mounts its family plugin while the
+ * previous entry still owns the name. Dropping that refused mount lost the
+ * plugin for good - the previous entry then disposed its own mount, releasing
+ * the name with nobody left to take it, and the family row stayed listed as
+ * active while its host routes 404ed (the task-board panel showed
+ * "board.hostError.notMounted", no degraded record appeared, and only a Host
+ * restart recovered it).
+ *
+ * The refused mount is therefore QUEUED, not dropped, and replayed the moment
+ * the holder releases the name - if the waiting fiber is still alive then. The
+ * single-instance guarantee is unchanged: exactly one mount is live per
+ * package name, and the replay re-enters the guard so a later mount still
+ * dedupes against it.
  *
  * The registry rides a global symbol so two module instances of the same
- * package (npm copy vs repository link) still share one verdict. cordis
- * `ctx.effect` runs its callback immediately and treats the callback's
+ * package (npm copy vs repository link) still share one verdict. That symbol
+ * is a CROSS-REPOSITORY contract, not this file's private state: the four
+ * satellite packages (dsh-skins / dsh-pet / dsh-presets /
+ * dsh-community-plugins) are separate repositories carrying their own copy of
+ * this guard, rebuilt on their own schedule, so the value under `MOUNTED`
+ * must keep the shape every published copy reads (a `Set` of package names
+ * with `has`/`add`/`delete`). The wait queues this guard added therefore live
+ * under their own additive key, and the registry reads back a `Set` even when
+ * some other build left a different value there. Changing `MOUNTED`'s shape
+ * in place broke that contract once: a satellite's legacy copy created a
+ * `Set`, the family's new copy read it as a `Map`, and every family row
+ * mounted after it failed with "claims.get is not a function".
+ *
+ * cordis `ctx.effect` runs its callback immediately and treats the callback's
  * return value as the fiber disposer, so the unmarker is returned, not run.
  */
 /**
  * Wrap a cordis plugin apply so the package runs at most once per process.
- * The first mount registers normally and unmarks when its fiber disposes;
- * any later mount of the same package name is a no-op.
+ * The first mount registers normally and releases the name when its fiber
+ * disposes; a mount refused while that name is held waits for the release and
+ * then runs, unless its own fiber disposes first.
  * @param packageName - npm package identity shared by every install source.
  * @param fn - the original plugin apply.
  * @returns an apply of the same shape.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-usage",
   "description": "Usage statistics plugin for the dsh web GUI: per-provider balance and coding-plan quota detection plus a live token usage ledger, with a compact price glance card above the sidebar's Settings row",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "icon": "icon.svg",
   "type": "module",
   "engines": {
@@ -33,7 +33,7 @@
   "license": "Apache-2.0",
   "dsh": {
     "engines": {
-      "dsh": ">=0.1.7-rc.1"
+      "dsh": ">=0.1.7-rc.2"
     },
     "bundle": {
       "patch": "./cordis.patch.yml"
@@ -50,25 +50,25 @@
     }
   },
   "dependencies": {
-    "schemastery": "^3.18.0"
+    "@deepseek-ai/schemastery": "^3.18.4"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh": ">=0.1.7-rc.2",
     "react": "^18.2.0"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.4",
-    "@deepseek-ai/dsh-credentials": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-client-connection": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-client-locale": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-client-store": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-llm": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-session": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-settings": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-credentials": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-connection": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-locale": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-store": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-llm": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-session": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-settings": "^0.1.7-rc.2",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^22.20.0",

package/src/client/UsageSectionCard.tsx

@@ -128,6 +128,10 @@ function balanceLine(provider: ProviderSnapshotView): ReactNode {
   }
   if (provider.credential === 'oauth') return <span className={styles.muted}>{t('usage.oauth')}</span>
   if (provider.credential === 'none') return <span className={styles.muted}>{t('usage.balance.noCredential')}</span>
+  // balanceSupported === false is the origin gate: the adapter has a balance
+  // endpoint but it belongs to another provider's account (issue #1688), so
+  // the row says so instead of silently vanishing from the card.
+  if (provider.balanceSupported === false) return <span className={styles.muted}>{t('usage.balance.unsupported')}</span>
   if (!provider.supported) return <span className={styles.muted}>{t('usage.balance.unsupported')}</span>
   return null
 }
@@ -298,7 +302,10 @@ export function UsageSectionCard(props: UsageSectionProps): ReactNode {
             <span className={styles.cardTitle}>{t('usage.balance')}</span>
             {(() => {
               const configured = snapshot.providers.filter(isConfigured)
-              const rows = configured.filter((provider) => provider.balanceSupported === true || (provider.balanceSupported === undefined && provider.supported))
+              // Include rows whose balance is deliberately not applicable
+              // (another origin's endpoint): the row itself explains why, which
+              // a single generic line cannot (#1688).
+              const rows = configured.filter((provider) => provider.balanceSupported === true || provider.balanceSupported === false || (provider.balanceSupported === undefined && provider.supported))
               if (rows.length === 0) {
                 return <span className={styles.muted}>{configured.length === 0 ? t('usage.balance.noneConfigured') : t('usage.balance.unsupported')}</span>
               }

package/src/client/body-mutations.ts

@@ -4,10 +4,10 @@
  * plugin bundle.
  *
  * Family plugins that inject at the DOM level must notice when the shell
- * re-renders around their injected node: the sidebar entry rows
- * (sidebar-entry-core), the center-column panel containers
- * (panel-mount-core), and the aggregate shell's column shims. Each consumer
- * used to install its OWN `MutationObserver` on `document.body` with
+ * re-renders around their injected node: the aggregate shell's column shims
+ * and any plugin surface still extending the shell from outside the official
+ * slot seats. Each consumer used to install its OWN `MutationObserver` on
+ * `document.body` with
  * `{ childList: true, subtree: true }`, so a page carrying N family plugins
  * paid N native observers and N callback invocations for EVERY mutation batch
  * the app produced — chat token streaming alone produces many per second, and

package/src/client/index.ts

@@ -21,6 +21,7 @@ import { createUsageStore, type UsageStoreInstance } from './usage-store.ts'
 import { UsageSectionCard, type UsageSectionFace, type UsageSettings } from './UsageSectionCard.tsx'
 import { mountUsageFootCard, openUsageSettings } from './foot-card-mount.tsx'
 import { NS, en, zh, t } from './locales.ts'
+import { createServedEntryForm } from './settings-entry-form.ts'
 import type { UsageOverviewView } from '../core/types.ts'
 
 /** The host usage API as the browser sees it (same-origin JSON endpoints). */
@@ -42,13 +43,25 @@ async function usageFetch<T>(path: string, method: 'GET' | 'POST'): Promise<T> {
 }
 
 const usageApi: UsageHttpApi = {
-  overview: () => usageFetch('/api/dsh-usage/overview', 'GET'),
-  refresh: () => usageFetch('/api/dsh-usage/refresh', 'POST'),
+  // DOCUMENT-RELATIVE routes (issue #1707): the GUI is served with
+  // `<base href="./">`, so a sub-path deployment resolves these against its
+  // entry directory instead of escaping to the origin root.
+  overview: () => usageFetch('api/dsh-usage/overview', 'GET'),
+  refresh: () => usageFetch('api/dsh-usage/refresh', 'POST'),
 }
 
-/** Settings namespace the section edits (dsh-web-settings maps it onto this row's profile entry id). */
+/**
+ * Settings namespace the section edits: the family identity of this plugin's
+ * own settings form, and the row id a standalone bundle install carries.
+ */
 const USAGE_SETTINGS_NS = 'dsh-usage'
 
+/** Profile entry id the family aggregate's generated row carries. */
+const AGGREGATE_ENTRY_ID = 'web-ui-usage'
+
+/** Profile entry ids this package's patch rows carry, most likely first. */
+const USAGE_ENTRY_IDS: readonly string[] = [AGGREGATE_ENTRY_ID, 'usage', USAGE_SETTINGS_NS]
+
 /** First-level nav position: directly below the Workshop section (order 150). */
 const SECTION_ORDER = 151
 
@@ -98,15 +111,15 @@ export function apply(ctx: ClientContext): void {
   }, 'dsh-usage: dictionaries')
 
   // The family binder is what maps this namespace onto the row's profile entry
-  // id and hands back the native form. Without the group plugin the client can
-  // only address an entry id it already knows: the namespace itself is one when
-  // the profile keeps the family spelling. Any other entry id leaves the form
-  // unavailable, which renders the row's controls disabled — the Host's own
-  // generated page for the row still edits the same Config.
+  // id and hands back the native form. Without the group plugin the shared forms
+  // service is addressed on the entry id the describe mirror justifies, rebound
+  // as soon as the mirror answers: the namespace itself is only an entry id on a
+  // standalone install, so binding it on the aggregate left the form unavailable
+  // and the row's controls disabled.
   const binder = ctx.get('webUiSettings')
   const settingsForm = binder !== undefined
     ? binder.bind<UsageSettings>({ namespace: USAGE_SETTINGS_NS })
-    : ctx.configForms.get<UsageSettings>(USAGE_SETTINGS_NS)
+    : createServedEntryForm<UsageSettings>({ forms: ctx.configForms, entryIds: USAGE_ENTRY_IDS })
 
   // One store instance per apply body; the section mounts and unmounts with
   // the settings page, and the store survives between visits so the last

package/src/client/settings-entry-form.ts

@@ -0,0 +1,142 @@
+// Generated by scripts/sync-shared.mjs from shared/client/settings/settings-entry-form.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+// Generated by scripts/sync-shared.mjs from shared/client/settings/settings-entry-form.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Family settings form bound to the profile entry id a Host actually serves.
+ *
+ * Under the 0.1.7 settings model a form is addressed by PROFILE ENTRY ID, while
+ * a family card knows only its own settings namespace. The family binder
+ * (`ctx.get('webUiSettings')`, published by dsh-web-settings) resolves one onto
+ * the other and is the preferred transport; this module is the fallback for a
+ * page that serves no binder — the group plugin is not installed, or its client
+ * half has not applied yet (the aggregate mounts its children in order, and a
+ * child still waiting on its own injects publishes nothing).
+ *
+ * The shared describe mirror is the only local evidence of which row id this
+ * profile serves, but it answers asynchronously: at plugin activation it usually
+ * holds nothing yet. A one-shot guess therefore cannot be right for every
+ * deployment, and the form is bound once per session:
+ *
+ * - binding the bare namespace made every save answer `No configurable plugin
+ *   entry "<namespace>"` on an aggregate install (the namespace is not an entry
+ *   id there), which the card reported as "the deployment did not accept these
+ *   values";
+ * - binding the aggregate row id would break a standalone install, whose row id
+ *   is the namespace or the package's own `ui-*` row.
+ *
+ * So the fallback starts on the most likely row and REBINDS the moment the
+ * mirror names one of this package's rows. Until the mirror answers, the form
+ * reports the binding it holds (usually `loading`), which the card renders as an
+ * unavailable form rather than a doomed one.
+ */
+import type { ConfigForm, ConfigFormSnapshot, ConfigForms } from '@deepseek-ai/dsh-client-ui-settings/client'
+
+/** Options of {@link createServedEntryForm}. */
+export interface ServedEntryFormOptions<T> {
+  /** The shared configuration forms service (`ctx.configForms`). */
+  forms: ConfigForms
+  /**
+   * Profile entry ids this package's rows carry, most likely first: the
+   * aggregate's generated row, the package's own standalone row, then the bare
+   * namespace. The first is the fallback while the mirror has no answer; the
+   * last is the answer when the mirror serves none of them.
+   */
+  entryIds: readonly string[]
+}
+
+/** The snapshot a form reports before the Host has answered with this entry. */
+function pendingSnapshot<T>(): ConfigFormSnapshot<T> {
+  return {
+    status: 'loading',
+    value: undefined,
+    base: undefined,
+    user: undefined,
+    revision: undefined,
+    writable: false,
+    mode: 'host',
+  }
+}
+
+/**
+ * Create a settings form bound to the profile entry id this Host serves, and
+ * rebound whenever the shared describe mirror names a different one of this
+ * package's rows.
+ * @param options - the shared forms service and this package's candidate row ids.
+ * @returns a form delegating to the currently resolved entry's own form.
+ */
+export function createServedEntryForm<T>(options: ServedEntryFormOptions<T>): ConfigForm<T> {
+  const { forms, entryIds } = options
+  const fallbackId = entryIds[0]
+  const namespaceId = entryIds[entryIds.length - 1]
+  const listeners = new Set<() => void>()
+  let boundId: string | undefined
+  let bound: ConfigForm<T> | undefined
+  let offBound: (() => void) | undefined
+  let snapshot: ConfigFormSnapshot<T> = pendingSnapshot<T>()
+
+  /** Republish: the delegated snapshot when one is bound, the pending one otherwise. */
+  const publish = (): void => {
+    if (bound !== undefined) snapshot = bound.getSnapshot()
+    for (const listener of [...listeners]) listener()
+  }
+
+  /**
+   * The entry id the mirror currently justifies. An unanswered or empty mirror
+   * is not evidence of absence, so it keeps the first candidate; a mirror that
+   * answers without any of this package's rows leaves the namespace itself.
+   * @returns the entry id to bind.
+   */
+  const resolve = (): string => {
+    let served: readonly string[] | undefined
+    try {
+      served = forms.describe().getSnapshot().view?.namespaces.map(row => row.ns)
+    } catch {
+      // A mirror that refuses the read is unanswered too, not absent.
+      served = undefined
+    }
+    if (served === undefined || served.length === 0) return fallbackId
+    return entryIds.find(id => served.includes(id)) ?? namespaceId
+  }
+
+  /** Bind (or rebind) the resolved entry's form; a no-op while it is unchanged. */
+  const bind = (): void => {
+    const target = resolve()
+    if (target === boundId) return
+    offBound?.()
+    offBound = undefined
+    let form: ConfigForm<T>
+    try {
+      form = forms.get<T>(target)
+    } catch {
+      // A service that refuses the id stays unbound; the next mirror answer
+      // retries rather than pinning a wrong entry for the session.
+      boundId = undefined
+      return
+    }
+    boundId = target
+    bound = form
+    offBound = form.subscribe(() => { publish() })
+    publish()
+  }
+
+  // The mirror subscription lives for the page: the card owns its form for the
+  // session, and the ConfigForm contract carries no disposer to hang it on. The
+  // callback is cheap (a resolve plus a no-op while the id is unchanged). A
+  // mirror without a subscription seat keeps the initial binding.
+  try {
+    forms.describe().subscribe(() => { bind() })
+  } catch {
+    // A describe face that refuses the subscription: the initial binding stands.
+  }
+  bind()
+
+  return {
+    getSnapshot: () => snapshot,
+    subscribe: (listener) => {
+      listeners.add(listener)
+      return () => { listeners.delete(listener) }
+    },
+    set: (field, value) => bound?.set(field, value) ?? Promise.resolve(false),
+    unset: (field) => bound?.unset(field) ?? Promise.resolve(false),
+    mutate: (ops, expectedRevision) => bound?.mutate(ops, expectedRevision) ?? Promise.resolve(false),
+  }
+}

package/src/core/adapters.ts

@@ -22,6 +22,14 @@ export interface AdapterProbeContext {
   apiKey: string
   /** Provider account id riding a dedicated header, when the credential carries one (Codex). */
   accountId?: string
+  /**
+   * The route's configured base URL (the pi-ai profile's baseURL), when it
+   * declares one. An adapter whose endpoint belongs to one provider origin
+   * uses it to refuse an account that merely shares the route key, so a
+   * differently-hosted model of the same family is never reported with the
+   * other account's number.
+   */
+  baseURL?: string
 }
 
 /** A parsed balance fact. */
@@ -43,6 +51,14 @@ export interface ProviderAdapter {
   /** Fallback display name when the LLM runtime has none. */
   displayName: string
   balance?: {
+    /**
+     * Origin (scheme + host) whose account this balance endpoint reports.
+     * Omitted when the endpoint is per-route by construction (a profile
+     * supplies the host) or when the provider has only one origin. When set,
+     * a route whose configured baseURL resolves elsewhere is not this
+     * origin's account and must not be probed with this adapter.
+     */
+    origin?: string
     build(context: AdapterProbeContext): ProbeSpec
     parse(status: number, body: unknown): BalanceParse | undefined
   }
@@ -113,10 +129,14 @@ function bearer(apiKey: string): Record<string, string> {
  * adapter registers (sessions and agent-default-model carry it), so both ids
  * must resolve here or the current provider would never be probed.
  */
+/** The official DeepSeek API origin: the only account its balance endpoint reports. */
+export const DEEPSEEK_API_ORIGIN = 'https://api.deepseek.com'
+
 const DEEPSEEK: ProviderAdapter = {
   ids: ['deepseek', 'deepseek-official'],
   displayName: 'DeepSeek',
   balance: {
+    origin: DEEPSEEK_API_ORIGIN,
     build: ({ apiKey }) => ({ url: 'https://api.deepseek.com/user/balance', headers: bearer(apiKey) }),
     parse: (status, body) => {
       if (status !== 200 || typeof body !== 'object' || body === null) return undefined
@@ -459,6 +479,42 @@ export function adapterFor(provider: string): ProviderAdapter | undefined {
   return PROVIDER_ADAPTERS.find((adapter) => adapter.ids.includes(provider))
 }
 
+/** Origin of a configured base URL, or undefined when it cannot be parsed. */
+export function originOf(baseURL: string | undefined): string | undefined {
+  if (baseURL === undefined || baseURL.trim() === '') return undefined
+  try {
+    return new URL(baseURL).origin
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Whether an adapter's balance endpoint reports THIS route's account.
+ *
+ * Some adapter families share one route key across providers that merely
+ * speak the same API: `deepseek` is both the official DeepSeek catalog entry
+ * and a common id for an OpenAI-compatible reseller (Alibaba Bailian, ...)
+ * pointed at another host by the profile's `baseURL`. The balance endpoint is
+ * per ORIGIN, not per route key, so probing the official endpoint for a
+ * reseller profile reports the official account's money under the reseller's
+ * name (issue #1688). An adapter published with a fixed `origin` therefore
+ * only applies to a route whose configured base URL is that origin, or to a
+ * route that pins no base URL at all (the catalog alias of the official
+ * route, which resolves the family's own credential).
+ *
+ * @param adapter - the matched adapter.
+ * @param baseURL - the route's configured base URL (pi-ai profile), if any.
+ * @returns true when the adapter may probe its balance endpoint for the route.
+ */
+export function balanceAppliesToRoute(adapter: ProviderAdapter, baseURL: string | undefined): boolean {
+  const expected = adapter.balance?.origin
+  if (expected === undefined) return true
+  const configured = originOf(baseURL)
+  if (configured === undefined) return true
+  return configured === expected
+}
+
 /**
  * Whether a provider route belongs to the official DeepSeek family: the only
  * family with a spend price book and a settings-section-owned env credential

package/src/host/usage-service.ts

@@ -15,7 +15,7 @@ import type { Session, SessionEvent } from '@deepseek-ai/dsh-session'
 import type { TokenUsage } from '@deepseek-ai/dsh-llm'
 import { dshHome } from '../dsh-home.ts'
 import { withIdentityEncoding } from './http.ts'
-import { adapterFor, isDeepSeekProviderRoute, providerErrorMessage } from '../core/adapters.ts'
+import { adapterFor, balanceAppliesToRoute, isDeepSeekProviderRoute, providerErrorMessage } from '../core/adapters.ts'
 import type { BalanceParse, PlanParse } from '../core/adapters.ts'
 import { foldAliasRoutes } from '../core/provider-routes.ts'
 import { deepseekModelSpend } from '../core/pricing.ts'
@@ -202,7 +202,16 @@ export class UsageService {
         displayName: route.displayName || adapter?.displayName || route.id,
         credential: snapshot?.credential ?? 'none',
         supported: adapter !== undefined && (adapter.balance !== undefined || adapter.plan !== undefined),
-        ...(adapter?.balance !== undefined ? { balanceSupported: true } : {}),
+        // A balance endpoint that belongs to another origin does not report
+        // THIS route's account: it is supported by the adapter but not
+        // applicable here, and the UI renders it as unsupported rather than
+        // showing the other account's number (issue #1688).
+        ...(adapter?.balance !== undefined && balanceAppliesToRoute(adapter, this.piAiProfile(route.id)?.baseURL)
+          ? { balanceSupported: true }
+          : {}),
+        ...(adapter?.balance !== undefined && !balanceAppliesToRoute(adapter, this.piAiProfile(route.id)?.baseURL)
+          ? { balanceSupported: false }
+          : {}),
         ...(adapter?.plan !== undefined ? { planSupported: true } : {}),
         ...(snapshot?.balance !== undefined ? { balance: snapshot.balance } : {}),
         ...(snapshot?.plan !== undefined ? { plan: snapshot.plan } : {}),
@@ -573,6 +582,12 @@ export class UsageService {
   private async probeRoute(route: ProviderRoute, adapter: NonNullable<ReturnType<typeof adapterFor>>): Promise<void> {
     const credential = await this.resolveCredential(route.id)
     const previous = this.snapshots.get(route.id)
+    // The balance endpoint is per ORIGIN, not per route key: a profile that
+    // points a shared route id (`deepseek`) at another host is a different
+    // account, and probing the official endpoint would print this account's
+    // money under that route's name (issue #1688). Such a route reports the
+    // balance as unsupported instead.
+    const balanceApplies = balanceAppliesToRoute(adapter, this.piAiProfile(route.id)?.baseURL)
     if (credential.key === undefined) {
       // Nothing to probe with (oauth grant, no credential): retained facts
       // would never refresh again, so the row resets to its credential
@@ -591,11 +606,13 @@ export class UsageService {
       displayName: route.displayName || adapter.displayName,
       credential: credential.kind,
       supported: true,
+      ...(adapter.balance !== undefined && !balanceApplies ? { balanceSupported: false } : {}),
       updatedAt: Date.now(),
     }
     const runProbe = async (kind: 'balance' | 'plan'): Promise<BalanceView | PlanView | undefined> => {
       const half = adapter[kind]
       if (half === undefined) return undefined
+      if (kind === 'balance' && !balanceApplies) return undefined
       try {
         const spec = half.build({ apiKey: credential.key as string, ...(credential.accountId !== undefined ? { accountId: credential.accountId } : {}) })
         const response = await fetch(spec.url, withIdentityEncoding({