deepseek-harness-quota 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,10 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+## 0.1.0
+
+- Display the real DeepSeek account balance in the DSH Web sidebar.
+- Show topped-up and granted balance details, low-balance warnings, and per-turn cost deltas.
+- Support privacy mode, smart polling, request timeouts, keyboard access, and touch long-press.
+- Link to the official DeepSeek Top-up and Usage pages.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dsh-quota contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,232 @@
+# dsh-quota 💰
+
+<p align="center">
+  <strong>DeepSeek Harness（DSH）Web 侧边栏余额插件</strong><br>
+  在不打断工作流的前提下查看 DeepSeek 账户余额、额度明细与单轮消耗。
+</p>
+
+<p align="center">
+  <img src="https://img.shields.io/badge/version-0.1.0-blue.svg" alt="Version 0.1.0" />
+  <img src="https://img.shields.io/badge/Node-%3E%3D20-green.svg" alt="Node.js 20 or later" />
+  <img src="https://img.shields.io/badge/platform-DSH%20Web-purple.svg" alt="DSH Web" />
+  <img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="MIT License" />
+</p>
+
+<p align="center">
+  <img src="docs/assets/dsh-quota-overview.png" alt="dsh-quota 在 DSH 侧边栏展示账户余额与余额明细" width="100%" />
+</p>
+
+<p align="center"><sub>余额常驻侧边栏底部；右键可查看明细、切换隐私模式或手动刷新。</sub></p>
+
+## 功能
+
+- **融入原生侧边栏**：宽栏时余额位于「设置」右侧；收起侧边栏后自动切换为紧凑胶囊。
+- **余额明细**：右键打开卡片，查看总余额、充值余额、赠送余额和更新时间，并可前往 DeepSeek 官方充值页。
+- **官方用量入口**：从明细卡片直接打开 DeepSeek Usage 页面，查看官方统计的 Token 与费用明细。
+- **单轮消耗提示**：检测到余额下降时，显示类似 `-¥0.03` 的上浮提示，2.6 秒后自动消失。
+- **余额状态预警**：人民币余额低于 `¥5`（美元低于 `$1`）时显示橙色；余额为零、欠费或不可用时显示红色。
+- **隐私模式**：双击余额或点击卡片中的「隐藏」，将金额替换为 `¥ ****`；偏好保存在浏览器本地。
+- **智能刷新**：会话结束后自动刷新；前台每 60 秒、后台每 5 分钟轮询；回到前台时按需补刷。
+- **窄栏智能格式化**：根据金额范围保留适当精度，并对千位金额使用 `k` 缩写，避免文本溢出。
+- **版本可见**：明细卡片显示当前插件版本，方便排查与更新。
+
+## 快速开始
+
+### 环境要求
+
+- DSH Web；
+- Node.js 20 或更高版本；
+- 已在 DSH 中配置 DeepSeek API Key，或已设置 `DEEPSEEK_API_KEY` 环境变量。
+
+### 安装
+
+在本仓库目录执行：
+
+```bash
+dsh plugin --profile web add "$PWD"
+```
+
+也可以传入插件目录的绝对路径：
+
+```bash
+dsh plugin --profile web add /path/to/dsh-quota
+```
+
+首次添加 bundle 后，停止并重新启动 `dsh web`。后续修改 `lib/client.js` 时，`dsh-client-hmr` 会自动更新浏览器端代码，通常无需再次重启。
+
+### 验证安装
+
+将 `3000` 替换为当前 DSH Web 端口：
+
+```bash
+DSH_QUOTA_PORT=3000
+curl -i "http://127.0.0.1:${DSH_QUOTA_PORT}/plugins/dsh-quota/client.js"
+curl -s "http://127.0.0.1:${DSH_QUOTA_PORT}/dsh-quota/balance"
+```
+
+客户端地址应返回以 `window.__ModuleLoader__.load` 开头的 JavaScript；余额地址应返回 JSON。
+
+## 使用方式
+
+| 操作 | 结果 |
+|:---|:---|
+| 左键单击余额 | 立即刷新；刷新图标至少显示 350ms，避免闪烁 |
+| 左键双击余额 | 显示或隐藏金额，且不会选中余额文本 |
+| 右键单击余额 | 展开或收起账户余额明细卡片 |
+| 触屏长按余额 | 打开账户余额明细卡片 |
+| 聚焦后按 `Shift+F10` / `↑` | 通过键盘展开或收起明细卡片 |
+| 点击卡片外部 / 按 `Esc` | 关闭明细卡片 |
+| 点击「充值」 | 在新标签页打开 DeepSeek 官方充值页 |
+| 点击「用量」 | 在新标签页打开 [DeepSeek 官方 Usage 页面](https://platform.deepseek.com/usage) |
+| 对话结束 | 延迟 800ms 自动刷新；余额下降时显示本轮消耗 |
+
+隐私模式通过浏览器 `localStorage` 中的 `dsh-quota:privacy` 保存，仅影响界面展示，不改变服务端返回的数据。
+
+## 用量查看
+
+明细卡片中的「用量」会直接打开 [DeepSeek 官方 Usage 页面](https://platform.deepseek.com/usage)。插件不在本地自行累计 Token 或推算历史费用，原因是余额差值可能同时包含其他设备或 API Key 的调用、充值、赠金变化和延迟结算，无法替代官方账单。
+
+余额接口仅用于当前余额、充值余额和赠送余额展示；需要按 API Key 或月份核对详细用量时，请以官方 Usage 页面及其导出数据为准。
+
+## 刷新策略
+
+| 触发场景 | 行为 |
+|:---|:---|
+| 首次挂载 | 立即请求一次余额 |
+| 任一会话从运行中变为结束 | 800ms 后请求余额，等待上游计费落库 |
+| 页面位于前台 | 每 60 秒请求一次 |
+| 页面位于后台或最小化 | 每 5 分钟请求一次 |
+| 页面回到前台 | 若距离上次定时请求已超过 60 秒，则立即补刷 |
+| 用户手动点击 | 立即请求；连续刷新期间忽略余额胶囊上的重复点击 |
+
+只有新余额低于上一次成功读取的余额时才会显示消耗提示。免费额度、缓存命中或上游尚未结算时，不会出现该动画。
+
+## 配置
+
+默认配置可直接使用：
+
+| 字段 | 默认值 | 说明 |
+|:---|:---|:---|
+| `baseURL` | `https://api.deepseek.com` | DeepSeek API 基础地址；末尾的 `/` 会自动移除 |
+| `apiKeyEnv` | `DEEPSEEK_API_KEY` | 交给 DSH `credentials.resolve()` 解析的凭据引用 |
+| `timeoutMs` | `10000` | 上游余额请求超时，单位为毫秒，最大 60 秒 |
+
+如需代理 DeepSeek API 或改用其他凭据引用，可在 Web profile 的 Cordis patch 中覆盖配置：
+
+```yaml
+- patch:
+    - id: dsh-quota
+      config:
+        baseURL: https://api.deepseek.com
+        apiKeyEnv: DEEPSEEK_API_KEY
+        timeoutMs: 10000
+```
+
+`apiKeyEnv` 必须是合法的环境变量名称，例如 `DEEPSEEK_API_KEY` 或 `MY_DEEPSEEK_KEY`。
+
+## 安全与数据流
+
+- API Key 只在 DSH Host 端通过 `credentials.resolve()` 解析，不会注入浏览器 bundle。
+- Client 仅请求同源地址 `/dsh-quota/balance`。
+- Host 使用 Bearer Token 请求 `${baseURL}/user/balance`，再将上游 JSON 包装后返回。
+- 本地路由响应带有 `Cache-Control: no-store`，避免余额被浏览器或中间缓存保存。
+- Host 和 Client 均设置 10 秒请求超时；并发刷新会合并为同一个在途请求。
+- 插件不引入额外的第三方 npm 运行时依赖；Host 使用 Node.js 内置 `fetch`。
+
+```text
+DSH Client
+  └─ GET /dsh-quota/balance（同源，不含 API Key）
+       └─ DSH Host + credentials.resolve()
+            └─ GET https://api.deepseek.com/user/balance
+```
+
+余额字段遵循 [DeepSeek 官方查询余额 API](https://api-docs.deepseek.com/zh-cn/api/get-user-balance) 的 `is_available` 与 `balance_infos` 结构。
+
+## 响应与错误
+
+Host 路由始终返回 JSON。上游请求成功时，格式为：
+
+```json
+{
+  "ok": true,
+  "status": 200,
+  "data": {}
+}
+```
+
+无法解析凭据或请求失败时，`ok` 为 `false`，并返回可读的 `error.code` 与 `error.message`。为便于 Client 统一处理，这类应用层错误当前仍使用 HTTP `200` 返回。
+
+## 版本与更新
+
+插件版本会显示在余额明细卡片右上角，并由测试确保与 `package.json` 保持一致。npm 包名为 `deepseek-harness-quota`；内部插件 ID 仍为 `dsh-quota`。
+
+发布到 npm 后可通过 DSH plugin 命令安装、更新或移除：
+
+```bash
+dsh plugin --profile web add deepseek-harness-quota
+dsh plugin --profile web update deepseek-harness-quota
+dsh plugin --profile web remove deepseek-harness-quota
+```
+
+更新或移除 Host bundle 后请重启 `dsh web`。插件不会在运行时自行下载或安装更新。
+
+## 常见问题
+
+### 为什么显示 `¥ ?`？
+
+将鼠标悬停在余额上查看错误详情，并直接请求 `/dsh-quota/balance` 排查。常见原因是未配置 API Key、凭据引用名称错误、上游网络不可达或 DeepSeek API 返回异常。
+
+### 为什么添加插件后界面没有变化？
+
+确认使用的是 `web` profile，并在首次添加插件后重启 `dsh web`。随后检查客户端 bundle 地址是否能正常返回 JavaScript。
+
+### 为什么没有显示本轮消耗？
+
+消耗提示只在连续两次成功读取之间检测到余额下降时出现。如果该轮尚未结算、没有实际扣费或余额接口返回失败，则不会触发提示。
+
+### API Key 会发送到浏览器吗？
+
+不会。浏览器只访问同源余额路由，Bearer Token 仅由 Host 端添加到发往 DeepSeek 的请求中。
+
+## 开发与验证
+
+修改代码后先进行语法检查：
+
+```bash
+npm test
+npm run check
+```
+
+运行 DSH Web 后，建议依次检查：
+
+1. 宽栏余额是否与「设置」同行并靠右对齐；
+2. 左键刷新、双击隐私模式、右键明细卡片是否正常；
+3. 卡片是否能通过外部点击和 `Esc` 关闭；
+4. 收起侧边栏后金额是否以紧凑格式完整显示；
+5. 前后台切换和会话结束后是否触发预期刷新；
+6. API Key 未配置时，Tooltip 是否显示可诊断的错误信息。
+
+## 项目结构
+
+```text
+dsh-quota/
+├── .github/workflows/ci.yml        # Node.js 20/22 持续集成检查
+├── docs/
+│   └── assets/
+│       └── dsh-quota-overview.png  # README 功能展示图
+├── lib/
+│   ├── index.js                    # Host：凭据解析、余额代理路由
+│   └── client.js                   # Client：侧边栏组件、交互与刷新逻辑
+├── cordis.patch.yml                # Cordis Host 插件挂载声明
+├── package.json                    # 导出、DSH bundle 与 Web Client 声明
+├── test/                           # Client 解析、Host 路由与包校验测试
+├── AGENTS.md                       # 项目架构与维护约束
+├── CLAUDE.md                       # 与 AGENTS.md 同步的项目约束
+├── CHANGELOG.md                    # 版本变更记录
+├── LICENSE                         # MIT License
+└── README.md
+```
+
+## License
+
+本项目基于 [MIT License](LICENSE) 开源。

package/cordis.patch.yml

@@ -0,0 +1,12 @@
+# dsh-quota bundle patch
+#
+# Mounted when the plugin is installed through the DSH CLI:
+#
+#   dsh plugin --profile web add /path/to/dsh-quota
+#
+# The command appends `dsh-quota` to `dsh.profile.bundles` (see the package's
+# `dsh.bundle.patch` declaration), and profile boot merges THIS patch — one
+# insert of the host half — into the Loader entry tree.
+- insert:
+    - id: dsh-quota
+      name: 'dsh-quota'

package/lib/client.js

@@ -0,0 +1,931 @@
+// dsh-quota client half — a web client bundle registered through
+// window.__ModuleLoader__.load({id, factory}). The factory materializes
+// lazily and returns { apply, inject }; cordis mounts it as a client plugin.
+// apply() registers a small balance readout into the sidebar foot action list
+// (kind 'list') and refreshes it from the host route /dsh-quota/balance.
+window.__ModuleLoader__.load({
+	id: "dsh-quota",
+	factory: (require) => {
+		var module = { exports: {} };
+		var exports = module.exports;
+		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+
+		let React = require("react");
+
+		const ENDPOINT = "/dsh-quota/balance";
+		const ACTIVE_REFRESH_MS = 60000;   // 正常活跃时 60 秒刷新
+		const IDLE_REFRESH_MS = 300000;    // 窗口后台/闲置时 5 分钟刷新
+		const REQUEST_TIMEOUT_MS = 10000;
+		const VERSION = "0.1.0";
+		const TOP_UP_URL = "https://platform.deepseek.com/top_up";
+		const USAGE_URL = "https://platform.deepseek.com/usage";
+
+		const inject = ["slots"];
+
+		/** Currency symbol for a DeepSeek balance currency code. */
+		function currencySymbol(currency) {
+			switch (currency) {
+				case "CNY":
+					return "¥";
+				case "USD":
+					return "$";
+				default:
+					return "";
+			}
+		}
+
+		/** Pick the primary readable balance from the DeepSeek balance payload. */
+		function readBalance(json) {
+			if (!json || json.ok !== true) {
+				const upstreamMessage = json && json.data && (json.data.message || json.data.error);
+				const error = json && json.error;
+				throw new Error(
+					(error && error.message) ||
+					(typeof upstreamMessage === "string" ? upstreamMessage : "DeepSeek 余额请求失败")
+				);
+			}
+
+			const data = json.data;
+			const infos = data && Array.isArray(data.balance_infos) ? data.balance_infos : [];
+			const info = infos.find((item) => item && item.currency === "CNY")
+				|| infos.find((item) => item && item.currency === "USD")
+				|| infos.find((item) => item && typeof item.currency === "string");
+
+			if (!info) {
+				throw new Error("DeepSeek 余额响应中缺少 balance_infos");
+			}
+
+			const amount = (value, field) => {
+				const text = String(value ?? "");
+				if (text === "" || !Number.isFinite(Number(text))) {
+					throw new Error(`DeepSeek 余额响应中的 ${field} 无效`);
+				}
+				return text;
+			};
+
+			return {
+				currency: info.currency,
+				total: amount(info.total_balance, "total_balance"),
+				granted: amount(info.granted_balance, "granted_balance"),
+				toppedUp: amount(info.topped_up_balance, "topped_up_balance"),
+				available: data.is_available === true,
+				updatedAt: Date.now()
+			};
+		}
+
+		function formatTime(timestamp) {
+			if (!timestamp) return "—";
+			const d = new Date(timestamp);
+			const h = String(d.getHours()).padStart(2, "0");
+			const m = String(d.getMinutes()).padStart(2, "0");
+			const s = String(d.getSeconds()).padStart(2, "0");
+			return `${h}:${m}:${s}`;
+		}
+
+		/** 窄栏精简格式化（智能去小数/大数缩写，彻底避免 ... 截断） */
+		function formatRailBalance(value, privacy) {
+			if (value == null) return "…";
+			if (privacy) return "****";
+			const symbol = currencySymbol(value.currency) || "¥";
+			const num = parseFloat(value.total);
+			if (isNaN(num)) return `${symbol} ?`;
+
+			if (num >= 10000) {
+				return `${symbol}${(num / 1000).toFixed(0)}k`;
+			}
+			if (num >= 1000) {
+				return `${symbol}${(num / 1000).toFixed(1)}k`;
+			}
+			// >= 100 时去除小数（例如 195.91 -> ¥196），完全不溢出
+			if (num >= 100) {
+				return `${symbol}${Math.round(num)}`;
+			}
+			// 10 <= num < 100：若小数为 .00 则精简，否则保留1位小数
+			if (num >= 10) {
+				const fixed = num.toFixed(1);
+				return `${symbol}${fixed.endsWith(".0") ? Math.round(num) : fixed}`;
+			}
+			// < 10：保留2位小数（例如 ¥5.93, ¥0.50）
+			return `${symbol}${num.toFixed(2)}`;
+		}
+
+		const STYLE_ID = "@dsh-quota/sidebar-balance";
+		if (typeof document !== "undefined" && document.querySelector(`style[data-plugin="${STYLE_ID}"]`) === null) {
+			const tag = document.createElement("style");
+			tag.dataset.plugin = STYLE_ID;
+			tag.textContent = `
+@keyframes dsh-quota-spin {
+	from { transform: rotate(0deg); }
+	to { transform: rotate(360deg); }
+}
+@keyframes dsh-quota-float-up {
+	0% { opacity: 0; transform: translateY(4px) scale(0.9); }
+	15% { opacity: 1; transform: translateY(0) scale(1); }
+	75% { opacity: 1; transform: translateY(0) scale(1); }
+	100% { opacity: 0; transform: translateY(-8px) scale(0.92); }
+}
+@keyframes dsh-quota-popover-in {
+	from { opacity: 0; transform: translateY(6px) scale(0.96); }
+	to { opacity: 1; transform: translateY(0) scale(1); }
+}
+
+.dsh-quota-spinning {
+	animation: dsh-quota-spin 0.75s linear infinite;
+	transform-origin: center center;
+	display: inline-block;
+}
+[class*="_footArea"] {
+	position: relative !important;
+}
+
+.dsh-quota-balance-wide,
+.dsh-quota-balance-wide *,
+.dsh-quota-balance-rail,
+.dsh-quota-balance-rail * {
+	-webkit-user-select: none !important;
+	-moz-user-select: none !important;
+	-ms-user-select: none !important;
+	user-select: none !important;
+	-webkit-touch-callout: none !important;
+}
+
+.dsh-quota-balance-wide {
+	position: absolute;
+	right: 4px;
+	top: 50%;
+	transform: translateY(-50%);
+	height: 28px;
+	display: inline-flex;
+	align-items: center;
+	gap: 5px;
+	padding: 0 8px;
+	border-radius: 6px;
+	font-size: 12px;
+	font-weight: 500;
+	font-variant-numeric: tabular-nums;
+	color: var(--dsw-alias-label-secondary);
+	cursor: pointer;
+	border: 0;
+	background: transparent;
+	font-family: inherit;
+	white-space: nowrap;
+	z-index: 2;
+	transition: background-color 0.15s ease, color 0.15s ease, opacity 0.15s ease;
+}
+.dsh-quota-balance-wide:hover {
+	background-color: var(--dsw-alias-interactive-bg-hover);
+	color: var(--dsw-alias-label-primary);
+}
+.dsh-quota-balance-wide.dsh-quota-refreshing {
+	opacity: 0.85;
+	color: var(--dsw-alias-label-primary);
+}
+
+.dsh-quota-warn {
+	color: #faad14 !important;
+}
+.dsh-quota-danger {
+	color: #ff4d4f !important;
+}
+
+.dsh-quota-delta-badge {
+	position: absolute;
+	right: 2px;
+	top: -12px;
+	background: rgba(255, 77, 79, 0.18);
+	color: #ff4d4f;
+	font-size: 11px;
+	font-weight: 600;
+	font-variant-numeric: tabular-nums;
+	padding: 1px 5px;
+	border-radius: 5px;
+	pointer-events: none;
+	animation: dsh-quota-float-up 2.6s ease-in-out forwards;
+	white-space: nowrap;
+	border: 1px solid rgba(255, 77, 79, 0.3);
+	z-index: 3;
+}
+
+.dsh-quota-balance-rail {
+	display: inline-flex;
+	justify-content: center;
+	align-items: center;
+	height: 26px;
+	min-width: 32px;
+	max-width: 50px;
+	padding: 0 4px;
+	box-sizing: border-box;
+	border-radius: 6px;
+	font-size: 11px;
+	font-weight: 600;
+	font-variant-numeric: tabular-nums;
+	letter-spacing: -0.2px;
+	color: var(--dsw-alias-label-secondary);
+	cursor: pointer;
+	border: 0;
+	background: transparent;
+	font-family: inherit;
+	white-space: nowrap;
+	overflow: hidden;
+	transition: background-color 0.15s ease, color 0.15s ease;
+}
+.dsh-quota-balance-rail:hover {
+	background-color: var(--dsw-alias-interactive-bg-hover);
+	color: var(--dsw-alias-label-primary);
+}
+.dsh-quota-balance-rail.dsh-quota-refreshing {
+	opacity: 0.85;
+	color: var(--dsw-alias-label-primary);
+}
+
+.dsh-quota-popover {
+	position: absolute;
+	bottom: 48px;
+	left: 0;
+	right: 0;
+	width: auto;
+	box-sizing: border-box;
+	background: var(--dsw-alias-bg-layer-2, #1e1e20);
+	border: 1px solid var(--dsw-alias-border-l1, rgba(255, 255, 255, 0.12));
+	box-shadow: var(--dsw-shadow-lv3, 0 10px 25px rgba(0, 0, 0, 0.45));
+	border-radius: 12px;
+	padding: 12px 14px;
+	z-index: 1000;
+	animation: dsh-quota-popover-in 0.18s cubic-bezier(0.16, 1, 0.3, 1);
+	font-size: 12px;
+	color: var(--dsw-alias-label-primary, #fff);
+	cursor: default;
+	user-select: text;
+}
+
+.dsh-quota-popover-rail {
+	position: fixed;
+	left: 56px;
+	bottom: 12px;
+	right: auto;
+	width: 240px;
+}
+
+.dsh-quota-popover-header {
+	display: flex;
+	justify-content: space-between;
+	align-items: center;
+	font-weight: 600;
+	font-size: 13px;
+	margin-bottom: 10px;
+	padding-bottom: 8px;
+	border-bottom: 1px solid var(--dsw-alias-border-l2, rgba(255, 255, 255, 0.08));
+}
+.dsh-quota-popover-meta {
+	display: inline-flex;
+	align-items: center;
+	gap: 6px;
+}
+.dsh-quota-version {
+	font-size: 10px;
+	font-weight: 500;
+	color: var(--dsw-alias-label-tertiary, #888);
+}
+.dsh-quota-popover-row {
+	display: flex;
+	justify-content: space-between;
+	align-items: center;
+	margin: 6px 0;
+	color: var(--dsw-alias-label-secondary, #aaa);
+}
+.dsh-quota-popover-val {
+	font-weight: 500;
+	font-variant-numeric: tabular-nums;
+	color: var(--dsw-alias-label-primary, #fff);
+}
+.dsh-quota-popover-actions {
+	display: flex;
+	flex-wrap: wrap;
+	gap: 6px;
+	margin-top: 12px;
+	padding-top: 10px;
+	border-top: 1px solid var(--dsw-alias-border-l2, rgba(255, 255, 255, 0.08));
+}
+.dsh-quota-btn {
+	flex: 1 1 calc(50% - 3px);
+	min-width: 0;
+	display: inline-flex;
+	align-items: center;
+	justify-content: center;
+	gap: 5px;
+	padding: 6px 6px;
+	border-radius: 6px;
+	font-size: 11px;
+	font-weight: 500;
+	text-decoration: none;
+	cursor: pointer;
+	white-space: nowrap;
+	border: 1px solid var(--dsw-alias-border-l1, rgba(255, 255, 255, 0.15));
+	background: var(--dsw-alias-interactive-bg, rgba(255, 255, 255, 0.06));
+	color: var(--dsw-alias-label-primary, #fff);
+	transition: background 0.15s ease, border-color 0.15s ease;
+}
+.dsh-quota-btn:hover {
+	background: var(--dsw-alias-interactive-bg-hover, rgba(255, 255, 255, 0.12));
+}
+.dsh-quota-btn-primary {
+	background: #1677ff;
+	border-color: #1677ff;
+	color: #fff;
+}
+.dsh-quota-btn-primary:hover {
+	background: #4096ff;
+	border-color: #4096ff;
+}
+.dsh-quota-status-tag {
+	font-size: 10px;
+	padding: 1px 6px;
+	border-radius: 4px;
+	font-weight: 500;
+	white-space: nowrap;
+}
+.dsh-quota-status-tag.normal {
+	background: rgba(82, 196, 26, 0.15);
+	color: #52c41a;
+}
+.dsh-quota-status-tag.warn {
+	background: rgba(250, 173, 20, 0.15);
+	color: #faad14;
+}
+.dsh-quota-status-tag.danger {
+	background: rgba(255, 77, 79, 0.15);
+	color: #ff4d4f;
+}
+`;
+			document.head.appendChild(tag);
+		}
+
+		function SpinnerIcon(props) {
+			const size = props.size || 11;
+			return React.createElement(
+				"svg",
+				{
+					width: size,
+					height: size,
+					viewBox: "0 0 16 16",
+					fill: "none",
+					className: "dsh-quota-spinning",
+					style: { flexShrink: 0 }
+				},
+				React.createElement("circle", {
+					cx: 8,
+					cy: 8,
+					r: 6,
+					stroke: "currentColor",
+					strokeWidth: 2,
+					strokeLinecap: "round",
+					strokeDasharray: "28",
+					strokeDashoffset: "10",
+					opacity: 0.85
+				})
+			);
+		}
+
+		function IconExternalLink(props) {
+			const size = props.size || 12;
+			return React.createElement(
+				"svg",
+				{
+					width: size,
+					height: size,
+					viewBox: "0 0 24 24",
+					fill: "none",
+					stroke: "currentColor",
+					strokeWidth: "2",
+					strokeLinecap: "round",
+					strokeLinejoin: "round",
+					style: { flexShrink: 0 }
+				},
+				React.createElement("path", { d: "M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6" }),
+				React.createElement("polyline", { points: "15 3 21 3 21 9" }),
+				React.createElement("line", { x1: "10", y1: "14", x2: "21", y2: "3" })
+			);
+		}
+
+		function IconEye(props) {
+			const size = props.size || 12;
+			return React.createElement(
+				"svg",
+				{
+					width: size,
+					height: size,
+					viewBox: "0 0 24 24",
+					fill: "none",
+					stroke: "currentColor",
+					strokeWidth: "2",
+					strokeLinecap: "round",
+					strokeLinejoin: "round",
+					style: { flexShrink: 0 }
+				},
+				React.createElement("path", { d: "M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z" }),
+				React.createElement("circle", { cx: "12", cy: "12", r: "3" })
+			);
+		}
+
+		function IconEyeOff(props) {
+			const size = props.size || 12;
+			return React.createElement(
+				"svg",
+				{
+					width: size,
+					height: size,
+					viewBox: "0 0 24 24",
+					fill: "none",
+					stroke: "currentColor",
+					strokeWidth: "2",
+					strokeLinecap: "round",
+					strokeLinejoin: "round",
+					style: { flexShrink: 0 }
+				},
+				React.createElement("path", { d: "M17.94 17.94A10.07 10.07 0 0 1 12 20c-7 0-11-8-11-8a18.45 18.45 0 0 1 5.06-5.94M9.9 4.24A9.12 9.12 0 0 1 12 4c7 0 11 8 11 8a18.5 18.5 0 0 1-2.16 3.19m-6.72-1.07a3 3 0 1 1-4.24-4.24" }),
+				React.createElement("line", { x1: "1", y1: "1", x2: "23", y2: "23" })
+			);
+		}
+
+		function IconRefresh(props) {
+			const size = props.size || 12;
+			return React.createElement(
+				"svg",
+				{
+					width: size,
+					height: size,
+					viewBox: "0 0 24 24",
+					fill: "none",
+					stroke: "currentColor",
+					strokeWidth: "2",
+					strokeLinecap: "round",
+					strokeLinejoin: "round",
+					style: { flexShrink: 0 }
+				},
+				React.createElement("path", { d: "M21.5 2v6h-6" }),
+				React.createElement("path", { d: "M2.5 22v-6h6" }),
+				React.createElement("path", { d: "M2 11.5a10 10 0 0 1 18.8-4.3" }),
+				React.createElement("path", { d: "M22 12.5a10 10 0 0 1-18.8 4.2" })
+			);
+		}
+
+		function QuotaBalance(props) {
+			const [state, setState] = React.useState({ status: "loading", refreshing: false, value: null, error: null });
+			const [costDelta, setCostDelta] = React.useState(null);
+			const [showPopover, setShowPopover] = React.useState(false);
+			const [privacy, setPrivacy] = React.useState(() => {
+				try {
+					return localStorage.getItem("dsh-quota:privacy") === "1";
+				} catch {
+					return false;
+				}
+			});
+
+			const prevBalanceRef = React.useRef(null);
+			const deltaTimerRef = React.useRef(null);
+			const popoverRef = React.useRef(null);
+			const activeRequestRef = React.useRef(null);
+			const lastFetchedRef = React.useRef(0);
+			const clickTimerRef = React.useRef(null);
+			const longPressTimerRef = React.useRef(null);
+			const longPressTriggeredRef = React.useRef(false);
+			const mountedRef = React.useRef(true);
+			const wide = props.wide !== false;
+			const useSessions = props.useSessions;
+
+			const runningCount = typeof useSessions === "function"
+				? useSessions((sessionState) => {
+					if (!sessionState || !sessionState.byId) return 0;
+					let count = 0;
+					for (const id in sessionState.byId) {
+						if (sessionState.byId[id] && sessionState.byId[id].running) count++;
+					}
+					return count;
+				})
+				: 0;
+
+			const prevRunningCountRef = React.useRef(runningCount);
+
+			const togglePrivacy = React.useCallback(() => {
+				setPrivacy((prev) => {
+					const next = !prev;
+					try {
+						localStorage.setItem("dsh-quota:privacy", next ? "1" : "0");
+					} catch {}
+					return next;
+				});
+			}, []);
+
+			const load = React.useCallback(async () => {
+				if (activeRequestRef.current) return activeRequestRef.current.promise;
+
+				setState((prev) => ({ ...prev, refreshing: true }));
+				const startTime = Date.now();
+				lastFetchedRef.current = startTime;
+				const controller = new AbortController();
+				const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+				const waitForSpin = () => new Promise((resolve) => {
+					setTimeout(resolve, Math.max(0, 350 - (Date.now() - startTime)));
+				});
+
+				const promise = (async () => {
+					try {
+						const res = await fetch(ENDPOINT, {
+							headers: { accept: "application/json" },
+							signal: controller.signal
+						});
+						const json = await res.json();
+						const nextVal = readBalance(json);
+						await waitForSpin();
+						if (!mountedRef.current) return;
+
+						if (prevBalanceRef.current) {
+							const prevTotal = parseFloat(prevBalanceRef.current.total);
+							const newTotal = parseFloat(nextVal.total);
+							if (!isNaN(prevTotal) && !isNaN(newTotal) && prevTotal > newTotal) {
+								const diff = (prevTotal - newTotal).toFixed(4).replace(/0+$/, "").replace(/\.$/, "");
+								setCostDelta(`-${currencySymbol(nextVal.currency)}${diff}`);
+								clearTimeout(deltaTimerRef.current);
+								deltaTimerRef.current = setTimeout(() => setCostDelta(null), 2600);
+							}
+						}
+						prevBalanceRef.current = nextVal;
+						setState({ status: "done", refreshing: false, value: nextVal, error: null });
+					} catch (err) {
+						await waitForSpin();
+						if (!mountedRef.current) return;
+						const timedOut = err && err.name === "AbortError";
+						setState({
+							status: "error",
+							refreshing: false,
+							value: null,
+							error: {
+								code: timedOut ? "request-timeout" : "client-error",
+								message: timedOut
+									? `余额请求超过 ${REQUEST_TIMEOUT_MS / 1000} 秒未完成`
+									: String(err && err.message ? err.message : err)
+							}
+						});
+					} finally {
+						clearTimeout(timeout);
+						if (activeRequestRef.current && activeRequestRef.current.controller === controller) {
+							activeRequestRef.current = null;
+						}
+					}
+				})();
+
+				activeRequestRef.current = { controller, promise };
+				return promise;
+			}, []);
+
+			React.useEffect(() => {
+				mountedRef.current = true;
+				return () => {
+					mountedRef.current = false;
+					if (activeRequestRef.current) activeRequestRef.current.controller.abort();
+					clearTimeout(deltaTimerRef.current);
+					clearTimeout(clickTimerRef.current);
+					clearTimeout(longPressTimerRef.current);
+				};
+			}, []);
+
+			// 5. 智能刷新节流：后台闲置 5 分钟轮询，前台 60 秒轮询
+			React.useEffect(() => {
+				let timer = null;
+				const schedule = (ms) => {
+					if (timer) clearInterval(timer);
+					timer = setInterval(() => {
+						load();
+					}, ms);
+				};
+
+				load();
+				schedule(ACTIVE_REFRESH_MS);
+
+				const handleVisibilityChange = () => {
+					if (document.hidden) {
+						schedule(IDLE_REFRESH_MS);
+					} else {
+						schedule(ACTIVE_REFRESH_MS);
+						if (Date.now() - lastFetchedRef.current > ACTIVE_REFRESH_MS) {
+							load();
+						}
+					}
+				};
+
+				document.addEventListener("visibilitychange", handleVisibilityChange);
+				return () => {
+					if (timer) clearInterval(timer);
+					document.removeEventListener("visibilitychange", handleVisibilityChange);
+				};
+			}, [load]);
+
+			// 对话结束即时刷新
+			React.useEffect(() => {
+				if (prevRunningCountRef.current > runningCount) {
+					const timer = setTimeout(load, 800);
+					prevRunningCountRef.current = runningCount;
+					return () => clearTimeout(timer);
+				}
+				prevRunningCountRef.current = runningCount;
+			}, [runningCount, load]);
+
+			// 点击弹窗外部时关闭 Popover
+			React.useEffect(() => {
+				if (!showPopover) return;
+				const onPointerDown = (e) => {
+					if (popoverRef.current && !popoverRef.current.contains(e.target)) {
+						setShowPopover(false);
+					}
+				};
+				const onKeyDown = (e) => {
+					if (e.key === "Escape") setShowPopover(false);
+				};
+				document.addEventListener("pointerdown", onPointerDown);
+				document.addEventListener("keydown", onKeyDown);
+				return () => {
+					document.removeEventListener("pointerdown", onPointerDown);
+					document.removeEventListener("keydown", onKeyDown);
+				};
+			}, [showPopover]);
+
+			const value = state.value;
+			const numTotal = value ? parseFloat(value.total) : NaN;
+
+			// 2. 预警状态判定：欠费 (danger) / 余额偏低 (warn) / 正常 (normal)
+			let alertLevel = "normal";
+			let alertTitle = "正常";
+			if (value) {
+				if (!value.available || (!isNaN(numTotal) && numTotal <= 0)) {
+					alertLevel = "danger";
+					alertTitle = "账户已欠费";
+				} else if (!isNaN(numTotal) && (value.currency === "CNY" ? numTotal < 5.0 : numTotal < 1.0)) {
+					alertLevel = "warn";
+					alertTitle = "余额偏低";
+				}
+			}
+
+			let label;
+			if (value == null) {
+				label = state.status === "loading" ? "…" : "¥ ?";
+			} else if (privacy) {
+				label = `${currencySymbol(value.currency)} ****`;
+			} else {
+				label = `${currencySymbol(value.currency)}${value.total}`;
+			}
+
+			const railLabel = formatRailBalance(value, privacy);
+
+			const tooltip =
+				state.refreshing
+					? "DeepSeek 余额刷新中…"
+					: state.error != null
+						? `DeepSeek 余额: ${state.error.message}`
+						: value == null
+							? "DeepSeek 余额加载中…"
+							: `DeepSeek 余额: ${currencySymbol(value.currency)}${value.total}${alertLevel !== "normal" ? ` (${alertTitle})` : ""}\n左键点击刷新 · 右键查看明细 · 双击切换隐私`;
+
+			const handleClick = (e) => {
+				if (e && typeof e.stopPropagation === "function") {
+					e.stopPropagation();
+				}
+				if (longPressTriggeredRef.current) {
+					longPressTriggeredRef.current = false;
+					return;
+				}
+				clearTimeout(clickTimerRef.current);
+				clickTimerRef.current = setTimeout(load, 220);
+			};
+
+			const handleContextMenu = (e) => {
+				if (e && typeof e.preventDefault === "function") {
+					e.preventDefault();
+					e.stopPropagation();
+				}
+				setShowPopover((prev) => !prev);
+			};
+
+			const handleDoubleClick = (e) => {
+				if (e && typeof e.stopPropagation === "function") {
+					e.stopPropagation();
+				}
+				clearTimeout(clickTimerRef.current);
+				togglePrivacy();
+			};
+
+			const handleKeyDown = (e) => {
+				if (e.key === "ContextMenu" || (e.shiftKey && e.key === "F10") || e.key === "ArrowUp") {
+					e.preventDefault();
+					e.stopPropagation();
+					setShowPopover((prev) => !prev);
+				}
+			};
+
+			const handlePointerDown = (e) => {
+				if (!e || e.pointerType !== "touch") return;
+				longPressTriggeredRef.current = false;
+				clearTimeout(longPressTimerRef.current);
+				longPressTimerRef.current = setTimeout(() => {
+					longPressTriggeredRef.current = true;
+					setShowPopover(true);
+				}, 500);
+			};
+
+			const handlePointerEnd = () => {
+				clearTimeout(longPressTimerRef.current);
+			};
+
+			const handleMouseDown = (e) => {
+				// 防止双击时触发浏览器默认选中文本行为
+				if (e && typeof e.preventDefault === "function") {
+					if (e.detail > 1) {
+						e.preventDefault();
+					}
+				}
+			};
+
+			// Popover 详情卡片
+			const popoverElement = showPopover && React.createElement(
+				"div",
+				{
+					ref: popoverRef,
+					className: `dsh-quota-popover${!wide ? " dsh-quota-popover-rail" : ""}`,
+					role: "dialog",
+					"aria-label": `DeepSeek 账户余额，dsh-quota v${VERSION}`,
+					onClick: (e) => e.stopPropagation()
+				},
+				React.createElement(
+					"div",
+					{ className: "dsh-quota-popover-header" },
+					React.createElement("span", null, "DeepSeek 账户余额"),
+					React.createElement(
+						"span",
+						{ className: "dsh-quota-popover-meta" },
+						React.createElement("span", { className: "dsh-quota-version" }, `v${VERSION}`),
+						React.createElement(
+							"span",
+							{ className: `dsh-quota-status-tag ${alertLevel}` },
+							alertTitle
+						)
+					)
+				),
+				React.createElement(
+					"div",
+					{ className: "dsh-quota-popover-row" },
+					React.createElement("span", null, "总余额"),
+					React.createElement("span", { className: "dsh-quota-popover-val" }, value ? `${currencySymbol(value.currency)}${privacy ? "****" : value.total}` : "—")
+				),
+				React.createElement(
+					"div",
+					{ className: "dsh-quota-popover-row" },
+					React.createElement("span", null, "充值余额"),
+					React.createElement("span", { className: "dsh-quota-popover-val" }, value ? `${currencySymbol(value.currency)}${privacy ? "****" : value.toppedUp}` : "—")
+				),
+				React.createElement(
+					"div",
+					{ className: "dsh-quota-popover-row" },
+					React.createElement("span", null, "赠送赠金"),
+					React.createElement("span", { className: "dsh-quota-popover-val" }, value ? `${currencySymbol(value.currency)}${privacy ? "****" : value.granted}` : "—")
+				),
+				React.createElement(
+					"div",
+					{ className: "dsh-quota-popover-row", style: { fontSize: "11px", opacity: 0.75, marginTop: "8px" } },
+					React.createElement("span", null, "更新时间"),
+					React.createElement("span", null, value ? formatTime(value.updatedAt) : "—")
+				),
+				React.createElement(
+					"div",
+					{ className: "dsh-quota-popover-actions" },
+					React.createElement(
+						"a",
+						{
+							href: TOP_UP_URL,
+							target: "_blank",
+							rel: "noreferrer",
+							className: "dsh-quota-btn dsh-quota-btn-primary"
+						},
+						React.createElement(IconExternalLink, { size: 12 }),
+						React.createElement("span", null, "充值")
+					),
+					React.createElement(
+						"a",
+						{
+							href: USAGE_URL,
+							target: "_blank",
+							rel: "noreferrer",
+							className: "dsh-quota-btn",
+							title: "打开 DeepSeek 官方用量页面"
+						},
+						React.createElement(IconExternalLink, { size: 12 }),
+						React.createElement("span", null, "用量")
+					),
+					React.createElement(
+						"button",
+						{
+							type: "button",
+							className: "dsh-quota-btn",
+							onClick: togglePrivacy
+						},
+						privacy ? React.createElement(IconEye, { size: 12 }) : React.createElement(IconEyeOff, { size: 12 }),
+						React.createElement("span", null, privacy ? "显示" : "隐藏")
+					),
+					React.createElement(
+						"button",
+						{
+							type: "button",
+							className: "dsh-quota-btn",
+							onClick: load
+						},
+						state.refreshing
+							? React.createElement(SpinnerIcon, { size: 12 })
+							: React.createElement(IconRefresh, { size: 12 }),
+						React.createElement("span", null, "刷新")
+					)
+				)
+			);
+
+			if (!wide) {
+				return React.createElement(
+					React.Fragment,
+					null,
+					React.createElement(
+						"button",
+						{
+							type: "button",
+							className: `dsh-quota-balance-rail ${alertLevel !== "normal" ? `dsh-quota-${alertLevel}` : ""}${state.refreshing ? " dsh-quota-refreshing" : ""}`,
+							title: tooltip,
+							"aria-label": tooltip,
+							"aria-haspopup": "dialog",
+							"aria-expanded": showPopover,
+							onClick: handleClick,
+							onDoubleClick: handleDoubleClick,
+							onContextMenu: handleContextMenu,
+							onMouseDown: handleMouseDown,
+							onKeyDown: handleKeyDown,
+							onPointerDown: handlePointerDown,
+							onPointerUp: handlePointerEnd,
+							onPointerCancel: handlePointerEnd
+						},
+						state.refreshing
+							? React.createElement(SpinnerIcon, { size: 12 })
+							: React.createElement("span", null, railLabel)
+					),
+					popoverElement
+				);
+			}
+
+			return React.createElement(
+				React.Fragment,
+				null,
+				React.createElement(
+					"button",
+					{
+						type: "button",
+						className: `dsh-quota-balance-wide ${alertLevel !== "normal" ? `dsh-quota-${alertLevel}` : ""}${state.refreshing ? " dsh-quota-refreshing" : ""}`,
+						title: tooltip,
+						"aria-label": tooltip,
+						"aria-haspopup": "dialog",
+						"aria-expanded": showPopover,
+						onClick: handleClick,
+						onDoubleClick: handleDoubleClick,
+						onContextMenu: handleContextMenu,
+						onMouseDown: handleMouseDown,
+						onKeyDown: handleKeyDown,
+						onPointerDown: handlePointerDown,
+						onPointerUp: handlePointerEnd,
+						onPointerCancel: handlePointerEnd
+					},
+					costDelta && React.createElement("span", { className: "dsh-quota-delta-badge" }, costDelta),
+					state.refreshing && React.createElement(SpinnerIcon, { size: 12 }),
+					React.createElement("span", null, label)
+				),
+				popoverElement
+			);
+		}
+
+		function apply(ctx) {
+			const slots = ctx.get("slots");
+			if (slots === undefined) return;
+			slots.inject("sidebar.footer.action", () =>
+				slots.register(
+					{
+						name: "sidebar.footer.action",
+						id: "dsh-quota",
+						order: 0
+					},
+					QuotaBalance
+				)
+			);
+		}
+
+		exports.apply = apply;
+		exports.inject = inject;
+		exports.__test = Object.freeze({
+			VERSION,
+			currencySymbol,
+			readBalance,
+			formatRailBalance
+		});
+		return module.exports;
+	}
+});

package/lib/index.js

@@ -0,0 +1,106 @@
+// dsh-quota host half — a cordis object plugin mounted by cordis.patch.yml.
+// Provides one HTTP route on the shared webserver that resolves the configured
+// DeepSeek API key (the same credential seam the deepseek provider uses) and
+// calls GET https://api.deepseek.com/user/balance. The client half fetches
+// this route from the same origin; no RPC framework is involved.
+//
+// This file must not import npm packages. `dsh plugin add /local/path` installs
+// the plugin as a `link:` symlink; Node ESM then realpath-resolves from THIS
+// directory, not from ~/.dsh/profiles/web/node_modules, so undeclared deps
+// (schemastery, @deepseek-ai/dsh-credentials, …) crash the entire plugin tree.
+const name = "dsh-quota";
+
+// webServer is a hard dependency so cordis activates this plugin only AFTER the
+// webserver is up (otherwise the route would be registered before the server
+// exists, or not at all). credentials is read softly via ctx.get below, because
+// a missing key is a handled runtime case, not a composition error.
+const inject = ["webServer"];
+
+const DEFAULT_API_KEY_ENV = "DEEPSEEK_API_KEY";
+const PUBLIC_BASE_URL = "https://api.deepseek.com";
+const DEFAULT_TIMEOUT_MS = 10000;
+
+// Mirrors @deepseek-ai/dsh-credentials `credentialRef` (POSIX env-name brand).
+const REF_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function credentialRef(value) {
+	if (!REF_PATTERN.test(value)) {
+		throw new TypeError(`credential ref "${value}" must match ${String(REF_PATTERN)}`);
+	}
+	return value;
+}
+
+function apply(ctx, config) {
+	const raw = config && typeof config === "object" ? config : {};
+	const baseURL = String(raw.baseURL ?? PUBLIC_BASE_URL).replace(/\/+$/, "");
+	const apiKeyEnv = String(raw.apiKeyEnv ?? DEFAULT_API_KEY_ENV);
+	const configuredTimeout = Number(raw.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+	const timeoutMs = Number.isFinite(configuredTimeout) && configuredTimeout > 0
+		? Math.min(Math.round(configuredTimeout), 60000)
+		: DEFAULT_TIMEOUT_MS;
+	const ref = credentialRef(apiKeyEnv);
+
+	const webServer = ctx.get("webServer");
+	if (webServer === undefined) return;
+
+	const send = (res, status, payload) => {
+		const body = JSON.stringify(payload);
+		res.writeHead(status, {
+			"content-type": "application/json; charset=utf-8",
+			"cache-control": "no-store"
+		});
+		res.end(body);
+	};
+
+	ctx.effect(() =>
+		webServer.register({
+			kind: "exact",
+			path: "/dsh-quota/balance",
+			handler: async (_req, res) => {
+				try {
+					const credentials = ctx.get("credentials");
+					const hit = credentials === undefined ? undefined : await credentials.resolve(ref);
+					if (hit === undefined) {
+						return send(res, 200, {
+							ok: false,
+							error: {
+								code: "no-api-key",
+								message:
+									`No API key resolved from '${apiKeyEnv}'. ` +
+									"Set it in DSH (settings → models, or DEEPSEEK_API_KEY).",
+								configurable: true
+							}
+						});
+					}
+					const upstream = await fetch(`${baseURL}/user/balance`, {
+						method: "GET",
+						signal: AbortSignal.timeout(timeoutMs),
+						headers: {
+							authorization: `Bearer ${hit.value}`,
+							accept: "application/json"
+						}
+					});
+					const data = await upstream.json();
+					return send(res, 200, {
+						ok: upstream.ok,
+						status: upstream.status,
+						data
+					});
+				} catch (error) {
+					const timedOut = error && (error.name === "TimeoutError" || error.name === "AbortError");
+					return send(res, 200, {
+						ok: false,
+						error: {
+							code: timedOut ? "upstream-timeout" : "fetch-failed",
+							message: timedOut
+								? `DeepSeek balance request timed out after ${timeoutMs}ms.`
+								: String(error && error.message ? error.message : error),
+							configurable: false
+						}
+					});
+				}
+			}
+		})
+	);
+}
+
+export { name, apply, inject };

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "deepseek-harness-quota",
+  "version": "0.1.0",
+  "description": "DeepSeek Harness Web plugin for viewing DeepSeek balance, quota details, and per-turn cost in the sidebar.",
+  "type": "module",
+  "main": "lib/index.js",
+  "scripts": {
+    "test": "node --test",
+    "pack:check": "npm pack --dry-run",
+    "check": "node -c lib/index.js && node -c lib/client.js && npm test && npm run pack:check",
+    "prepublishOnly": "npm run check"
+  },
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/client.js",
+    "docs/assets/dsh-quota-overview.png",
+    "cordis.patch.yml",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-runtime"
+      ]
+    }
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "deepseek",
+    "deepseek-harness",
+    "dsh",
+    "plugin",
+    "balance",
+    "quota"
+  ],
+  "author": "qx0657",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/qx0657/deepseek-harness-quota.git"
+  },
+  "homepage": "https://github.com/qx0657/deepseek-harness-quota#readme",
+  "bugs": {
+    "url": "https://github.com/qx0657/deepseek-harness-quota/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "MIT"
+}