@linxin666/dsh-usage 0.4.7 → 0.4.9

package/src/client/usage.module.css

@@ -594,7 +594,7 @@
 
 .footStripProvider {
   flex: none;
-  max-width: 45%;
+  max-width: 38%;
   overflow: hidden;
   text-overflow: ellipsis;
   font-weight: 500;
@@ -616,3 +616,61 @@
 :global([data-sidebar-collapsed]) .footCard {
   display: none;
 }
+
+/* ---------------------------------------------------------------------------
+   DeepSeek pricing clock: red while the peak window bills double, green while
+   off-peak bills half. The period word rides with the dot, so colour is never
+   the only signal, and the priced sentence lives in the title attribute.
+   --------------------------------------------------------------------------- */
+
+.peakBadge,
+.peakLine {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  font-size: 11px;
+  font-variant-numeric: tabular-nums;
+  white-space: nowrap;
+}
+
+.peakBadge {
+  flex: none;
+}
+
+.peakLine {
+  gap: 6px;
+}
+
+.peakBadge[data-peak='on'],
+.peakLine[data-peak='on'] {
+  color: var(--dsw-alias-state-error-primary, #b42318);
+}
+
+.peakBadge[data-peak='off'],
+.peakLine[data-peak='off'] {
+  color: var(--dsw-alias-state-success-primary, #067647);
+}
+
+.peakDot {
+  flex: none;
+  width: 6px;
+  height: 6px;
+  border-radius: 50%;
+  background: currentColor;
+}
+
+/* Expanded foot card: its own line at full opacity (the meta line below is
+   dimmed) so the red/green reads on every skin. */
+.footPeak {
+  display: flex;
+  align-items: center;
+  gap: 5px;
+  overflow: hidden;
+  font-size: 10px;
+  white-space: nowrap;
+}
+
+.footPeakClock {
+  opacity: 0.7;
+  font-variant-numeric: tabular-nums;
+}

package/src/client/voucher.ts

@@ -1,5 +1,5 @@
 /**
- * The Whale-yuan voucher (鲸元券): the mint family's retained ledger totals
+ * The Whale-yuan voucher (鲸元券): the profile's retained ledger totals
  * stamped onto the banknote artwork as a denomination, ready
  * to save or share. The canvas copy is deliberately locale-neutral (digits,
  * latin captions, ISO dates) so the exported image needs no dictionary;
@@ -16,11 +16,11 @@ import { VOUCHER_ART_DATA_URL } from './voucher-art.generated.ts'
 
 /** The facts stamped onto one voucher. */
 export interface VoucherData {
-  /** Mint family (DeepSeek official + MiMo) total tokens over the retained window. */
+  /** Every provider's total tokens over the retained window. */
   tokens: number
-  /** Provider calls that reported usage. */
+  /** Provider calls that reported usage, summed across every provider. */
   calls: number
-  /** Fold-time spend estimate in CNY; only the priced family contributes. */
+  /** Fold-time spend estimate in CNY; only the priced (official DeepSeek) family contributes. */
   cost: number
   /** Retained window bounds (local date keys, inclusive). */
   from: string
@@ -44,32 +44,23 @@ export function formatDay(ms: number): string {
 }
 
 /**
- * Provider route ids minted beside the DeepSeek official family: the MiMo
- * gateway, which a profile may run as its default route and which the ledger
- * records under its own route id. The bank counts the tokens a profile spends,
- * not only the ones DeepSeek bills. Route ids rather than adapter families
- * because minting is an accounting decision that must never widen the
- * credential or probing paths — the same split `isDeepSeekProviderRoute()`
- * keeps against `adapterFor()` (issue #1772). An empty list mints exactly the
- * official family, which is how a profile that never runs MiMo behaves.
- */
-export const EXTRA_MINT_ROUTE_IDS: readonly string[] = ['mimo']
-
-/** Whether one provider route's ledger rows mint whale yuan. */
-export function mintsWhaleYuan(provider: string): boolean {
-  return isDeepSeekProviderRoute(provider) || EXTRA_MINT_ROUTE_IDS.includes(provider)
-}
-
-/**
- * Sum the mint family's rows out of a usage window: the whole DeepSeek
- * official family (the `deepseek` catalog alias, the live `deepseek-official`
- * route and the signed-in `deepseek-account` route all fold into one voucher)
- * plus {@link EXTRA_MINT_ROUTE_IDS}. Undefined when the window is absent
- * (older host) or the family has no usage — a zero-token note mints nothing.
+ * Sum every provider's rows out of a usage window: the note is a
+ * proof-of-spend for what the profile actually used, so the tokens and calls
+ * of every route in the ledger mint — the DeepSeek official family (the
+ * `deepseek` catalog alias, the live `deepseek-official` route and the
+ * signed-in `deepseek-account` route) beside every subscription and relay
+ * route. Undefined when the window is absent (older host) or nothing was used
+ * — a zero-token note mints nothing.
+ *
+ * Minting is an accounting decision over ledger rows, so it reads no adapter:
+ * widening it must never widen the credential or balance-probe paths, which
+ * keep reading `adapterFor()` (the split `isDeepSeekProviderRoute()` also
+ * keeps, issue #1772).
  *
- * Only the priced family contributes `cost`: MiMo ships no price book, so it
- * mints tokens and calls while the spend line keeps reporting the official
- * family's fold-time estimate (and the observed-balance watch above it).
+ * Only the priced family contributes `cost`: subscription and relay routes
+ * ship no price book, so they mint tokens and calls while the spend line keeps
+ * reporting the official family's fold-time estimate (and the observed-balance
+ * watch above it).
  */
 export function voucherData(window: UsageWindowSummary | undefined): VoucherData | undefined {
   if (window === undefined) return undefined
@@ -77,7 +68,6 @@ export function voucherData(window: UsageWindowSummary | undefined): VoucherData
   let calls = 0
   let cost = 0
   for (const row of window.providers) {
-    if (!mintsWhaleYuan(row.provider)) continue
     tokens += totalTokens(row.totals)
     calls += row.totals.calls
     if (isDeepSeekProviderRoute(row.provider)) cost += row.totals.cost

package/src/core/spend.ts

@@ -0,0 +1,62 @@
+/**
+ * Spend display: the ledger keeps every cost estimate in the priced provider's
+ * billing currency (CNY), and that stored value never moves. This module turns
+ * one CNY figure into the currency the user chose to READ it in, so switching
+ * the display is a rendering decision, not a data migration (issue #1937).
+ * @module @linxin666/dsh-usage/core/spend
+ */
+
+/** A currency the spend display can render. */
+export type SpendCurrency = 'CNY' | 'USD'
+
+/** How to read a stored CNY cost. */
+export interface SpendDisplay {
+  /** The currency to render in. */
+  currency: SpendCurrency
+  /** CNY per USD; consulted only when the display currency is USD. */
+  cnyPerUsd: number
+}
+
+/**
+ * The rate used when the row configures none: a plain default, so an
+ * unconfigured display still has a defined美元 figure instead of a blank card.
+ * The plugin never fetches a live rate (its host routes are loopback-fenced and
+ * its browser half has no network), so there is no fetch that could fail and
+ * leave the card empty.
+ */
+export const DEFAULT_CNY_PER_USD = 7.2
+
+/** The display used when the row carries no setting: the historical CNY rendering. */
+export const DEFAULT_SPEND_DISPLAY: SpendDisplay = { currency: 'CNY', cnyPerUsd: DEFAULT_CNY_PER_USD }
+
+/**
+ * Normalize a configured display.
+ * An unknown currency reads as CNY, and a rate that is not a positive finite
+ * number falls back to the default rate — the display must never be able to
+ * blank the card.
+ * @param input - the configured currency and rate, if any.
+ * @returns a display that can always render.
+ */
+export function resolveSpendDisplay(input?: { currency?: unknown; cnyPerUsd?: unknown }): SpendDisplay {
+  const currency: SpendCurrency = input?.currency === 'USD' ? 'USD' : 'CNY'
+  const rate = typeof input?.cnyPerUsd === 'number' && Number.isFinite(input.cnyPerUsd) && input.cnyPerUsd > 0
+    ? input.cnyPerUsd
+    : DEFAULT_CNY_PER_USD
+  return { currency, cnyPerUsd: rate }
+}
+
+/**
+ * Render one stored CNY cost in the display currency.
+ * A non-finite or negative cost renders as zero rather than as `NaN`/`¥-0.10`.
+ * @param costCny - the stored cost in CNY.
+ * @param display - the display to render in; defaults to CNY.
+ * @returns the formatted amount with its currency symbol.
+ */
+export function formatSpend(costCny: number, display: SpendDisplay = DEFAULT_SPEND_DISPLAY): string {
+  const safe = Number.isFinite(costCny) && costCny > 0 ? costCny : 0
+  if (display.currency === 'USD') {
+    const rate = Number.isFinite(display.cnyPerUsd) && display.cnyPerUsd > 0 ? display.cnyPerUsd : DEFAULT_CNY_PER_USD
+    return '$' + (safe / rate).toFixed(2)
+  }
+  return '¥' + safe.toFixed(2)
+}

package/src/core/types.ts

@@ -6,6 +6,8 @@
  * @module @linxin666/dsh-usage/core/types
  */
 
+import type { SpendDisplay } from './spend.ts'
+
 /** One disjoint token bucket total, aggregated over calls (billed input = input + cacheRead + cacheWrite). */
 export interface UsageTokenTotals {
   /** Uncached input tokens. */
@@ -159,6 +161,12 @@ export interface ProviderSnapshotView {
 /** The overview the browser section renders. */
 export interface UsageOverviewView {
   updatedAt: number
+  /**
+   * How to read every CNY cost in this document. The host stamps the row's
+   * configured display here so both browser halves format spend the same way;
+   * absent on an older host document, which renders as CNY (issue #1937).
+   */
+  display?: SpendDisplay
   providers: ProviderSnapshotView[]
   /** The provider the collapsed sidebar strip and the header highlight; `source` says how it was picked. */
   current: {

package/src/host/loopback.ts

@@ -8,6 +8,19 @@
  * Semantics: RFC 5735 IPv4 127/8, ::1, IPv4-mapped ::ffff:127/8 (matching the
  * remote-web-ui gate), localhost hostnames, plus the browser same-origin
  * markers (sec-fetch-site and Origin) for the request-level fence.
+ *
+ * A reverse proxy in front of the host rewrites the Host header to its own
+ * upstream literal (a Cloudflare tunnel, frp and an nginx reverse proxy all
+ * dial 127.0.0.1:<port>), and the socket the origin sees is the proxy's, which
+ * is loopback by construction. Both halves of the fence then hold for a public
+ * request. Forwarding headers are the signal that a hop stands in between: a
+ * request that carries CF-Connecting-IP or X-Forwarded-For is answered through
+ * a proxy and is never treated as a local one (issue #1906).
+ *
+ * An operator who runs that proxy or tunnel themselves can opt into the
+ * narrower case: isForwardedLoopbackRequest describes a forwarded request that
+ * still landed on this machine's loopback upstream, and a route family admits
+ * it only behind its own default-off switch (issue #1918).
  * @module dsh-web-shared/host/loopback
  */
 
@@ -36,13 +49,29 @@ export function isLoopbackHostname(hostname: string): boolean {
   return isIPv4Loopback(hostname)
 }
 
+/**
+ * Whether a reverse proxy stood between the client and this host: the request
+ * carries CF-Connecting-IP or X-Forwarded-For. Either header is stamped by a
+ * hop that forwards traffic, so the request did not originate on this machine.
+ * @param request - node HTTP request.
+ * @returns true when a forwarding header is present.
+ */
+export function isProxiedRequest(request: IncomingMessage): boolean {
+  return request.headers['cf-connecting-ip'] !== undefined
+    || request.headers['x-forwarded-for'] !== undefined
+}
+
 /**
  * Request-level trust fence: a loopback socket address AND a loopback Host
  * header, plus browser same-origin markers. The socket address is
- * authoritative; X-Forwarded-For is never trusted.
+ * authoritative for a direct connection; a request that carries a forwarding
+ * header is refused outright, because a proxy in front of the host makes both
+ * the socket address and the Host header describe the proxy rather than the
+ * client. X-Forwarded-For is therefore never evidence *for* loopback.
  */
 export function isLoopbackRequest(request: IncomingMessage): boolean {
   if (!isLoopbackAddress(request.socket.remoteAddress)) return false
+  if (isProxiedRequest(request)) return false
   const host = request.headers.host
   if (typeof host !== 'string') return false
   let hostUrl: URL
@@ -61,3 +90,30 @@ export function isLoopbackRequest(request: IncomingMessage): boolean {
     return false
   }
 }
+
+/**
+ * Whether a forwarded request landed on this machine's loopback upstream: a
+ * forwarding header (the proxy's own stamp), a loopback socket address (the
+ * proxy dials 127.0.0.1:<port>), and a loopback Host header (the proxy rewrote
+ * the authority to its upstream literal).
+ *
+ * This is a fact about the route, not a trust decision. A public request to a
+ * tunnel satisfies all three by construction, because the proxy is the client
+ * of this process: only a caller that operates the proxy can decide it stands
+ * for the browser, which is why every consumer keeps this behind an explicit
+ * default-off switch and its own browser markers. isLoopbackRequest is
+ * unchanged and still refuses a forwarded request (issue #1906).
+ * @param request - node HTTP request.
+ * @returns true when a forwarding header, a loopback socket, and a loopback Host all hold.
+ */
+export function isForwardedLoopbackRequest(request: IncomingMessage): boolean {
+  if (!isProxiedRequest(request)) return false
+  if (!isLoopbackAddress(request.socket.remoteAddress)) return false
+  const host = request.headers.host
+  if (typeof host !== 'string') return false
+  try {
+    return isLoopbackHostname(new URL('http://' + host).hostname)
+  } catch {
+    return false
+  }
+}

package/src/host/pair-access.ts

@@ -37,9 +37,32 @@ interface LookupCtx {
  */
 export function isPairedOrLoopbackAllowed(ctx: LookupCtx, request: IncomingMessage): boolean {
   if (isLoopbackRequest(request)) return true
-  const fromGet = typeof ctx.get === 'function' ? ctx.get('remoteWebUiPairing', false) : undefined
-  const pairing = (isPairingAccess(fromGet) ? fromGet : ctx.remoteWebUiPairing)
-  return pairing?.isPairedDevice(request) === true
+  return lookupPairing(ctx)?.isPairedDevice(request) === true
+}
+
+/**
+ * The pairing service, or undefined when this composition does not expose it.
+ *
+ * Two lookups exist because the fence is shared with test harnesses that hand
+ * over a bare object: a real cordis context resolves services through `get`, a
+ * harness may carry the property directly. `get(name, false)` is the
+ * non-strict form, so an unloaded service answers undefined rather than
+ * throwing. Reading an un-injected service as a PROPERTY throws instead
+ * (`cannot get property "remoteWebUiPairing" without inject`); a trust fence
+ * must answer "not paired" in that case, never leak the error into the route
+ * handler, where the host web server turns it into an empty-body 400 (#1942).
+ */
+function lookupPairing(ctx: LookupCtx): PairingAccess | undefined {
+  if (typeof ctx.get === 'function') {
+    const viaGet = ctx.get('remoteWebUiPairing', false)
+    return isPairingAccess(viaGet) ? viaGet : undefined
+  }
+  try {
+    const viaProperty = ctx.remoteWebUiPairing
+    return isPairingAccess(viaProperty) ? viaProperty : undefined
+  } catch {
+    return undefined
+  }
 }
 
 function isPairingAccess(value: unknown): value is PairingAccess {

package/src/host/usage-service.ts

@@ -22,6 +22,7 @@ import { deepseekModelSpend } from '../core/pricing.ts'
 import { createLedgerDocument, deserializeLedger, foldUsage, ledgerDayKeys, localDateKey, pruneLedger, summarizeDays, totalTokens } from '../core/ledger.ts'
 import type { BalanceView, CredentialKind, ObservedSpendView, PlanView, ProviderSnapshotState, ProviderSnapshotView, UsageDayView, UsageLedgerDocument, UsageOverviewView, UsageTokenTotals } from '../core/types.ts'
 import { addTotals, emptyTotals } from '../core/types.ts'
+import { resolveSpendDisplay, type SpendDisplay } from '../core/spend.ts'
 
 /**
  * Persisted accrual state for the official DeepSeek family's real spend:
@@ -60,6 +61,12 @@ interface ProviderRoute {
 export interface UsageServiceOptions {
   pollIntervalSec: number
   retainDays: number
+  /**
+   * How the browser halves should read the stored CNY costs. Optional so a
+   * caller that predates the display setting keeps the CNY rendering (issue
+   * #1937); the overview stamps the resolved value on every document.
+   */
+  display?: SpendDisplay
 }
 
 /** Probe timeout per HTTP call. */
@@ -336,6 +343,8 @@ export class UsageService {
     const all = summarizeDays(allKeys.map((key) => this.ledger.days[key] ?? {}))
     return {
       updatedAt: Date.now(),
+      // Display only: costs stay stored in CNY (issue #1937).
+      display: resolveSpendDisplay(this.options.display),
       providers,
       current: this.currentView(),
       usage: {

package/src/index.ts

@@ -4,6 +4,7 @@ import type { SettingsNamespace } from '@deepseek-ai/dsh-settings'
 import z from '@deepseek-ai/schemastery'
 import { mountOnce } from './mount-once.ts'
 import { UsageService, type UsageServiceOptions } from './host/usage-service.ts'
+import { DEFAULT_CNY_PER_USD, resolveSpendDisplay, type SpendDisplay } from './core/spend.ts'
 import { makeUsageDayRoute, makeUsageOverviewRoute, makeUsageRefreshRoute } from './host/routes.ts'
 
 declare module '@deepseek-ai/cordis' {
@@ -46,6 +47,10 @@ export interface UsageConfigFields {
   pollIntervalSec?: ConfigField<number>
   /** Ledger retention in local days. */
   retainDays?: ConfigField<number>
+  /** Currency the spend figures are DISPLAYED in; the ledger itself stays CNY. */
+  spendCurrency?: ConfigField<'CNY' | 'USD'>
+  /** CNY per USD, consulted only while the display currency is USD. */
+  cnyPerUsd?: ConfigField<number>
 }
 
 /**
@@ -66,10 +71,18 @@ export const Config = z.object({
   enabled: z.boolean().default(true).volatile(),
   pollIntervalSec: z.number().min(30).max(3600).default(60).volatile(),
   retainDays: z.number().min(7).max(730).default(180).volatile(),
+  // Display only: the ledger keeps every cost estimate in CNY, and switching
+  // this field never rewrites history (issue #1937). The plugin fetches no live
+  // rate, so an unset or unusable rate renders with the documented default
+  // instead of failing the card.
+  spendCurrency: z.union(['CNY', 'USD'] as const).default('CNY').volatile(),
+  cnyPerUsd: z.number().min(0.01).max(1000).default(DEFAULT_CNY_PER_USD).volatile(),
 })
 
 export interface ResolvedConfig extends UsageServiceOptions {
   enabled: boolean
+  /** The resolved spend display; always present, unlike the optional service option. */
+  display: SpendDisplay
 }
 
 /** Read one config field, following the live reference the schema produces. */
@@ -99,6 +112,10 @@ export function resolveConfig(config?: UsageConfigFields): ResolvedConfig {
     enabled: readConfigField(config?.enabled) ?? true,
     pollIntervalSec: readNumber(config?.pollIntervalSec, 60),
     retainDays: readNumber(config?.retainDays, 180),
+    display: resolveSpendDisplay({
+      currency: readConfigField(config?.spendCurrency),
+      cnyPerUsd: readNumber(config?.cnyPerUsd, DEFAULT_CNY_PER_USD),
+    }),
   }
 }