@michengai/dsh-codex-ui 1.0.0 → 1.1.0

package/lib/index.mjs

@@ -1,11 +1,37 @@
 import { apply as apply$1 } from "@deepseek-ai/dsh-client-ui-settings-general";
-import { spawn } from "node:child_process";
-import { existsSync } from "node:fs";
 import { lstat, mkdir, open, readFile, realpath, rename, rm, unlink, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep, win32 } from "node:path";
 import { fileURLToPath } from "node:url";
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
 import { randomBytes, randomUUID } from "node:crypto";
+//#region src/usage-frame/contract.ts
+/** 同源费用承载页与宿主之间的最小能力桥；不暴露 Context 或远程服务全集。 */
+const USAGE_FRAME_PATH = "/api/dsh-codex-ui/usage/frame";
+//#endregion
+//#region src/usage-frame-routes.ts
+/** 提供经过宿主认证的同源费用承载资源；只读取固定文件，不代理计费 API。 */
+const USAGE_FRAME_ROUTES = [
+	USAGE_FRAME_PATH,
+	`${USAGE_FRAME_PATH}.js`,
+	`${USAGE_FRAME_PATH}.css`,
+	"/api/dsh-codex-ui/usage/plugin.js"
+];
+async function usageFrameAsset(path, profileDir) {
+	const file = {
+		[USAGE_FRAME_PATH]: ["text/html; charset=utf-8", fileURLToPath(new URL("../assets/usage-frame.html", import.meta.url))],
+		[`${USAGE_FRAME_PATH}.js`]: ["text/javascript; charset=utf-8", fileURLToPath(new URL("./usage-frame.js", import.meta.url))],
+		[`${USAGE_FRAME_PATH}.css`]: ["text/css; charset=utf-8", fileURLToPath(new URL("./usage-frame.css", import.meta.url))],
+		"/api/dsh-codex-ui/usage/plugin.js": ["text/javascript; charset=utf-8", resolve(profileDir, "node_modules", "@kenz1117", "dsh-ui-usage-billing", "lib", "client.js")]
+	}[path];
+	if (!file) throw new Error("未知费用资源");
+	return {
+		contentType: file[0],
+		body: await readFile(file[1], "utf8")
+	};
+}
+//#endregion
 //#region src/business-api.ts
 const CODEX_UI_API_BASE = "/api/dsh-codex-ui";
 const CODEX_UI_API_ENDPOINTS = Object.freeze({
@@ -1677,6 +1703,34 @@ function sessionMoveAuthenticationError(status, error) {
 function apply(ctx) {
 	apply$1(ctx);
 	const host = hostServices(ctx);
+	ctx.effect(() => {
+		const disposers = USAGE_FRAME_ROUTES.map((path) => host.webServer.register({
+			kind: "exact",
+			path,
+			handler: async (request, response) => {
+				if (!authenticateBusinessRequest(ctx, request, response)) return;
+				if (request.method !== "GET" && request.method !== "HEAD") {
+					response.writeHead(405);
+					response.end();
+					return;
+				}
+				try {
+					const asset = await usageFrameAsset(path, resolveDependencyRuntime(ctx).profileDir);
+					response.writeHead(200, {
+						"content-type": asset.contentType,
+						"cache-control": "no-store",
+						"x-content-type-options": "nosniff",
+						"content-security-policy": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'self'"
+					});
+					response.end(request.method === "HEAD" ? void 0 : asset.body);
+				} catch {
+					response.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+					response.end("费用插件或承载资源不可用。");
+				}
+			}
+		}));
+		return () => disposers.forEach((dispose) => dispose());
+	}, "michengai-codex-ui: usage frame");
 	ctx.effect(() => {
 		const foregroundExplorer = new ForegroundExplorer();
 		foregroundExplorer.warmup().catch((error) => ctx.logger.warn("foreground explorer warmup failed: %s", error));