deepseek-harness-wallet 0.2.6 → 0.3.0

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project are documented in this file.
 
+## 0.3.0 - 2026-08-23
+
+- 新增 `deepseek-v4-flash-vision-exp` 视觉模型计费，沿用 V4 Flash 的峰谷价格；图片 token 由 Harness 上报后与文本 token 一起计入。 / Added billing for `deepseek-v4-flash-vision-exp` using V4 Flash peak/off-peak rates; image tokens reported by Harness are counted with text tokens.
+- 新增官方价格页自动检查：成功解析并完整校验后才应用新规则，网络失败或页面结构变化时保留内置规则并显示状态。 / Added official pricing-page sync: new rules apply only after complete validation; network failures or schema changes keep the built-in policy and expose the status.
+- 新增 Harness 健康检查：显示宿主/插件版本、兼容性、价格同步状态与无敏感信息的诊断复制。 / Added Harness health checks for host/plugin versions, compatibility, pricing-sync status, and safe diagnostic copying.
+- 多账户 API Key 改为加密存储：Windows 使用当前用户 DPAPI，其他系统使用 AES-GCM 本地密钥文件；兼容旧版明文账户文件并在下次保存时迁移。 / Encrypted multi-account API keys at rest with Windows DPAPI or an AES-GCM local key file; legacy plaintext account files migrate on the next save.
+
 ## 0.2.6 - 2026-08-23
 
 - 跟随 DeepSeek 官方规则更新峰谷计费：自 2026-08-23 北京时间 00:00 起，周六、周日全天按低谷价计费；工作日高峰仍为 09:00–12:00、14:00–18:00。 / Updated peak/off-peak billing to match DeepSeek's official rule: from 2026-08-23 00:00 Beijing, Saturday and Sunday are all-day off-peak; weekday peak windows remain 09:00–12:00 and 14:00–18:00.

package/README.md

@@ -23,7 +23,9 @@
 ```
 
 - **Official DeepSeek** — live balance (60s global refresh with fast boot retries), an estimated current-session cost (not an official bill) locked to the price active for each usage event, including the 2026-08-17 peak/off-peak rollout, and token breakdown.
+- **Vision model accounting** — `deepseek-v4-flash-vision-exp` is priced like V4 Flash; image tokens reported by the Harness are included with text tokens.
 - **v4 peak/off-peak ring clock** — a resident 24-hour sidebar footer widget for `v4-flash` and `v4-pro`, indicating real-time pricing windows (peak vs. 50% discount off-peak), countdown to the next switch, and optional desktop switch notifications. Weekdays use 09:00–12:00 and 14:00–18:00 Beijing time; Saturday and Sunday are all-day off-peak from 2026-08-23. Other models keep their flat rates.
+- **Official pricing sync** — periodically checks the official DeepSeek pricing page, applies only a fully validated table, and visibly keeps the built-in rules when the page is unavailable or changes format.
 - **Third-party total** — current-session tokens (input / cache read / output). No balance guessing, no cost math, zero configuration.
 - **Provider classification** — observed wrapper routes appear in the settings page; opted-in routes join the official token/cost bucket and are priced with the official table.
 - **Click the chip** to open the detail panel: correctly formatted per-currency balances, cost and token splits, a freely editable low-balance threshold for the active account and currency (two decimals, persisted per account; alerts never mix currencies), manual refresh, and a jump to the official recharge page (first click shows the domain for confirmation — anti-phishing).
@@ -40,7 +42,7 @@
 - Open the wallet panel → **Account Management（账户管理）** to add accounts (name + API key), switch the active one, or remove them.
 - The first account added becomes the active account automatically and is synced into the credentials seam.
 - Switching prompts a confirmation because it changes **LLM billing** for subsequent requests: the switch writes the account key into the credentials seam (`credentials.set('DEEPSEEK_API_KEY', ...)`), and since the llm-deepseek provider route resolves that reference per request, the very next LLM call is billed with the new account — no restart needed.
-- Account keys are stored in plaintext in `$DSH_HOME/storages/accounts.json`; the UI only shows masked keys. Treat the DSH data directory as a local credential store and protect access to it. Balance lookups prefer the active account's key and fall back to the credentials seam when no account is active.
+- Account keys are encrypted at rest in `$DSH_HOME/storages/accounts.json`: Windows uses the current user's DPAPI; other platforms use an owner-only AES-GCM key file. The UI only shows masked keys. Balance lookups prefer the active account's key and fall back to the credentials seam when no account is active.
 - Session usage estimates follow the active account's currency: USD-settled accounts show `本约 $x`, converted from the CNY price table at the vendor's long-standing list ratio (not a live FX rate); CNY accounts show `本场 ¥x`. These are local estimates, not an official invoice.
 - If `DEEPSEEK_API_KEY` is supplied by the launching environment, switching is refused with a clear error (the credentials provider rejects shadowed writes) — unset it in your shell to enable switching.
 
@@ -81,7 +83,7 @@ Restart `dsh web`, then hard-refresh the page.
 
 ## Quick use
 
-1. Click the wallet or peak/off-peak card to open its control panel.
+1. Click the wallet or peak/off-peak card to open its control panel; open the Harness settings card for health and compatibility checks.
 2. Choose horizontal or vertical layout, then use the scale control between 100% and 120%.
 3. Turn the official recharge button off when you need a smaller card; official and third-party rows can also be shown independently.
 4. Drag the card to any open area. If it is hard to find after a layout change, use **Reset/Dock（归位/停靠）** in the panel to return it to the sidebar.
@@ -139,7 +141,7 @@ For buildable DSH hosts, the npm package and repository include a versioned [Age
 | --- | --- |
 | Token accounting | Listens to the `llm/stream` event and buckets per session and provider: `deepseek-official` plus explicitly opted-in wrapper routes use the official bucket; other providers stay third-party; each usage event also locks its contemporaneous official price, so multiple sessions and pricing windows never mix. |
 | Balance | The wallet plugin itself sends the active key directly only to the official `/user/balance` endpoint. When multi-account switching is enabled, the selected key is also written into the DSH credentials seam; DSH may then use it for subsequent model requests. |
-| Accounts | Keys live in `$DSH_HOME/storages/accounts.json` in plaintext, matching the harness's own credential storage. The UI only shows masked keys, and switching writes the chosen key into the credentials seam for subsequent LLM billing. Protect the DSH data directory as you would any local credential store. |
+| Accounts | Keys live encrypted in `$DSH_HOME/storages/accounts.json`: Windows uses current-user DPAPI, while other platforms use an owner-only AES-GCM key file. The UI only shows masked keys, and switching writes the chosen key into the credentials seam for subsequent LLM billing. Protect the DSH data directory as you would any local credential store. |
 | Session log | The plugin writes no events; its data lives in `$DSH_HOME/storages/wallet.json`. |
 | Local settings | Layout, scale, visibility, reminder, and panel settings stay in browser-compatible local storage. |
 | Permanent deletion | Opt-in and host-gated. The wallet never advertises the action unless the host implements the matching session deletion path. |
@@ -151,10 +153,11 @@ For buildable DSH hosts, the npm package and repository include a versioned [Age
 CNY per 1M tokens, curated from official announcements (cache writes are not billed):
 
 - Since 2025-02-09 — deepseek-chat 2/8 (cache read 0.5), deepseek-reasoner 4/16 (cache read 1)
-- Since 2026-04-24 — v4-flash 1/2 (cache read 0.02), v4-pro 3/6 (cache read 0.025)
+- Since 2026-04-24 — v4-flash 1/2 (cache read 0.02), v4-pro 3/6 (cache read 0.025), v4-flash-vision-exp 1/2 (cache read 0.02)
 - Since 2026-08-17 00:00 Beijing — peak/off-peak pricing for the v4 models (peak windows Beijing 09:00–12:00 / 14:00–18:00; off-peak is half the peak rate):
   - v4-flash (off-peak / peak): cache read 0.05 / 0.10, input 1.5 / 3, output 4.5 / 9
   - v4-pro (off-peak / peak): cache read 0.15 / 0.30, input 4.5 / 9, output 13.5 / 27
+  - v4-flash-vision-exp (off-peak / peak): cache read 0.05 / 0.10, input 1.5 / 3, output 4.5 / 9
 - Since 2026-08-23 00:00 Beijing — Saturday and Sunday are no longer split into peak/off-peak windows; weekend calls use the off-peak rates all day. Weekday peak windows remain 09:00–12:00 and 14:00–18:00.
 
 deepseek-chat and deepseek-reasoner keep their flat rates. Each usage event is priced when it arrives; upgrading from 0.1.2 migrates legacy counters once using the then-current rate. Costs are estimates; the API-returned balance is authoritative.

package/index.js

@@ -16,8 +16,9 @@
  *    seam when no account is active;
  *  - the /api/wallet routes the browser chip polls.
  */
-import { randomUUID } from 'node:crypto'
-import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
+import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from 'node:crypto'
+import { spawnSync } from 'node:child_process'
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, join } from 'node:path'
 
@@ -26,10 +27,17 @@ export const inject = ['webServer']
 
 const OFFICIAL_PROVIDER = 'deepseek-official'
 const RECHARGE_URL = 'https://platform.deepseek.com/top_up'
+const PLUGIN_VERSION = '0.3.0'
+const PRICING_SOURCE_URL = 'https://api-docs.deepseek.com/zh-cn/quick_start/pricing/'
+const PRICING_SYNC_INTERVAL_MS = 6 * 60 * 60_000
+const PRICING_SYNC_TIMEOUT_MS = 8_000
+const MIN_HOST_VERSION = '0.1.0-rc.8'
 const DSH_HOME = process.env.DSH_HOME ?? join(homedir(), '.dsh')
 const STORE_PATH = join(DSH_HOME, 'storages', 'wallet.json')
 const ACCOUNTS_PATH = join(DSH_HOME, 'storages', 'accounts.json')
-const ACCOUNTS_VERSION = 1
+const ACCOUNTS_KEY_PATH = ACCOUNTS_PATH + '.key'
+const ACCOUNTS_VERSION = 2
+const ACCOUNTS_CRYPTO_VERSION = 1
 const CREDENTIAL_REF = 'DEEPSEEK_API_KEY'
 const DEFAULT_THRESHOLD = 5
 const BALANCE_REFRESH_MS = 60_000
@@ -39,10 +47,12 @@ const STORE_VERSION = 2
 // From 2026-08-23 00:00 Beijing, Saturday and Sunday are off-peak all day.
 // Exposed to clients via snapshot.pricingWindows so the ring clock renders
 // from the active policy instead of hard-coding hours in the bundle.
-const PEAK_WINDOWS = [{ startHour: 9, endHour: 12 }, { startHour: 14, endHour: 18 }]
+const DEFAULT_PEAK_WINDOWS = [{ startHour: 9, endHour: 12 }, { startHour: 14, endHour: 18 }]
 const OFF_PEAK_RATE = 0.5
 const BEIJING_OFFSET_MS = 8 * 3600_000
 const WEEKEND_OFF_PEAK_SINCE = Date.UTC(2026, 7, 22, 16)
+let peakWindows = DEFAULT_PEAK_WINDOWS.map((window) => ({ ...window }))
+let weekendOffPeakSince = WEEKEND_OFF_PEAK_SINCE
 
 function isBeijingWeekend(atMs) {
   if (!Number.isFinite(atMs)) return false
@@ -52,9 +62,9 @@ function isBeijingWeekend(atMs) {
 }
 
 export function isBeijingPeak(atMs) {
-  if (atMs >= WEEKEND_OFF_PEAK_SINCE && isBeijingWeekend(atMs)) return false
+  if (atMs >= weekendOffPeakSince && isBeijingWeekend(atMs)) return false
   const hours = ((atMs + BEIJING_OFFSET_MS) % 86_400_000) / 3_600_000
-  return (hours >= 9 && hours < 12) || (hours >= 14 && hours < 18)
+  return peakWindows.some((window) => hours >= window.startHour && hours < window.endHour)
 }
 
 // Pricing timeline (CNY per 1M tokens; cacheWrite is not billed by DeepSeek).
@@ -72,6 +82,7 @@ export const PRICE_POLICIES = [
     models: {
       'deepseek-v4-flash': { cacheHit: 0.02, input: 1, output: 2 },
       'deepseek-v4-pro': { cacheHit: 0.025, input: 3, output: 6 },
+      'deepseek-v4-flash-vision-exp': { cacheHit: 0.02, input: 1, output: 2 },
     },
   },
   {
@@ -81,13 +92,241 @@ export const PRICE_POLICIES = [
     models: {
       'deepseek-v4-flash': { cacheHit: [0.05, 0.1], input: [1.5, 3], output: [4.5, 9] },
       'deepseek-v4-pro': { cacheHit: [0.15, 0.3], input: [4.5, 9], output: [13.5, 27] },
+      'deepseek-v4-flash-vision-exp': { cacheHit: [0.05, 0.1], input: [1.5, 3], output: [4.5, 9] },
     },
   },
 ]
 
+let activePricePolicies = PRICE_POLICIES
+let pricingSync = {
+  status: 'built-in',
+  source: PRICING_SOURCE_URL,
+  checkedAt: 0,
+  etag: null,
+  lastModified: null,
+  ruleVersion: 'built-in-2026-08-23',
+  message: '尚未检查官方价格页',
+}
+
+function decodeHtmlText(value) {
+  return String(value)
+    .replace(/<br\s*\/?>/gi, ' ')
+    .replace(/<[^>]*>/g, ' ')
+    .replace(/&amp;/gi, '&')
+    .replace(/&nbsp;/gi, ' ')
+    .replace(/&#39;/g, "'")
+    .replace(/&quot;/gi, '"')
+    .replace(/\s+/g, ' ')
+    .trim()
+}
+
+function numericCells(row, count) {
+  const values = row.slice(Math.max(0, row.length - count)).map((cell) => {
+    const match = decodeHtmlText(cell).match(/\d+(?:\.\d+)?/)
+    return match === null ? null : Number(match[0])
+  })
+  return values.length === count && values.every((value) => Number.isFinite(value)) ? values : null
+}
+
+/**
+ * Parse the stable, server-rendered pricing table from DeepSeek's official
+ * documentation. A failed parse is deliberately treated as review-required;
+ * the wallet never silently bills from a partially understood page.
+ */
+export function parseOfficialPricingHtml(html) {
+  if (typeof html !== 'string' || html.length < 500) throw new Error('official pricing page is empty')
+  const rows = [...html.matchAll(/<tr\b[^>]*>([\s\S]*?)<\/tr>/gi)].map((match) =>
+    [...match[1].matchAll(/<td\b[^>]*>([\s\S]*?)<\/td>/gi)].map((cell) => decodeHtmlText(cell[1])),
+  ).filter((row) => row.length > 0)
+  const header = rows.find((row) => row.some((cell) => cell === 'deepseek-v4-flash'))
+  const models = header ? header.filter((cell) => /^deepseek-v4-[a-z0-9-]+$/i.test(cell)) : []
+  const requiredModels = ['deepseek-v4-flash', 'deepseek-v4-pro', 'deepseek-v4-flash-vision-exp']
+  if (models.length < requiredModels.length || requiredModels.some((model) => !models.includes(model))) {
+    throw new Error('official pricing model table changed')
+  }
+
+  function findPair(label) {
+    const index = rows.findIndex((row) => row.some((cell) => cell.includes(label)) && row.some((cell) => cell.includes('空闲时段')))
+    if (index < 0 || !rows[index + 1]?.some((cell) => cell.includes('高峰时段'))) throw new Error('official pricing rate rows changed')
+    const offPeak = numericCells(rows[index], models.length)
+    const peak = numericCells(rows[index + 1], models.length)
+    if (offPeak === null || peak === null) throw new Error('official pricing values changed')
+    return { offPeak, peak }
+  }
+
+  const cacheHit = findPair('缓存命中')
+  const input = findPair('缓存未命中')
+  const output = findPair('百万tokens输出')
+  const modelsWithRates = {}
+  for (const model of requiredModels) {
+    const index = models.indexOf(model)
+    modelsWithRates[model] = {
+      cacheHit: [cacheHit.offPeak[index], cacheHit.peak[index]],
+      input: [input.offPeak[index], input.peak[index]],
+      output: [output.offPeak[index], output.peak[index]],
+    }
+  }
+  const text = decodeHtmlText(html)
+  const windowMatch = text.match(/高峰时段为北京时间\s*(\d{1,2}):00\s*-\s*(\d{1,2}):00、\s*(\d{1,2}):00\s*-\s*(\d{1,2}):00/)
+  if (windowMatch === null) throw new Error('official peak window changed')
+  const parsedWindows = [
+    { startHour: Number(windowMatch[1]), endHour: Number(windowMatch[2]) },
+    { startHour: Number(windowMatch[3]), endHour: Number(windowMatch[4]) },
+  ]
+  const weekendMatch = text.match(/北京时间\s*(\d{4})年\s*(\d{1,2})月\s*(\d{1,2})日[^。]*?00:00起[^。]*?周末[^。]*?低谷/)
+  if (weekendMatch === null) throw new Error('official weekend rule changed')
+  const weekendSince = Date.UTC(
+    Number(weekendMatch[1]), Number(weekendMatch[2]) - 1, Number(weekendMatch[3]), 0, 0, 0, 0,
+  ) - BEIJING_OFFSET_MS
+  return {
+    models: modelsWithRates,
+    peakWindows: parsedWindows,
+    weekendOffPeakSince: weekendSince,
+    ruleVersion: 'official-' + createHash('sha256').update(JSON.stringify({ modelsWithRates, parsedWindows, weekendSince })).digest('hex').slice(0, 12),
+  }
+}
+
+function applyOfficialPricing(parsed, response) {
+  const base = PRICE_POLICIES[PRICE_POLICIES.length - 1]
+  activePricePolicies = [
+    ...PRICE_POLICIES.slice(0, -1),
+    { ...base, models: parsed.models },
+  ]
+  peakWindows = parsed.peakWindows.map((window) => ({ ...window }))
+  weekendOffPeakSince = parsed.weekendOffPeakSince
+  pricingSync = {
+    status: 'synced',
+    source: PRICING_SOURCE_URL,
+    checkedAt: Date.now(),
+    etag: response?.headers?.get?.('etag') ?? pricingSync.etag,
+    lastModified: response?.headers?.get?.('last-modified') ?? pricingSync.lastModified,
+    ruleVersion: parsed.ruleVersion,
+    message: '已同步官方价格页',
+  }
+}
+
+async function syncOfficialPricing(logger) {
+  if (typeof fetch !== 'function') return
+  const controller = new AbortController()
+  const timeout = setTimeout(() => controller.abort(), PRICING_SYNC_TIMEOUT_MS)
+  try {
+    const headers = {}
+    if (pricingSync.etag) headers['if-none-match'] = pricingSync.etag
+    if (pricingSync.lastModified) headers['if-modified-since'] = pricingSync.lastModified
+    const response = await fetch(PRICING_SOURCE_URL, { headers, signal: controller.signal })
+    if (response.status === 304) {
+      pricingSync = { ...pricingSync, status: 'synced', checkedAt: Date.now(), message: '官方价格页未变化' }
+      return
+    }
+    if (!response.ok) throw new Error('official pricing page returned ' + response.status)
+    const parsed = parseOfficialPricingHtml(await response.text())
+    applyOfficialPricing(parsed, response)
+  } catch (error) {
+    pricingSync = {
+      ...pricingSync,
+      status: pricingSync.checkedAt > 0 ? 'review-required' : 'offline',
+      checkedAt: Date.now(),
+      message: pricingSync.checkedAt > 0 ? '官方价格页结构有变化，需要复核' : '官方价格页暂时不可用，使用内置规则',
+    }
+    if (logger && typeof logger.warn === 'function') logger.warn('dsh-wallet: official pricing sync unavailable')
+  } finally {
+    clearTimeout(timeout)
+  }
+}
+
+export function pricingSnapshot() {
+  return {
+    status: pricingSync.status,
+    source: pricingSync.source,
+    checkedAt: pricingSync.checkedAt,
+    ruleVersion: pricingSync.ruleVersion,
+    message: pricingSync.message,
+    modelCount: Object.keys(activePricePolicies[activePricePolicies.length - 1].models).length,
+    peakWindows: peakWindows.map((window) => ({ ...window })),
+    weekendOffPeakSince,
+  }
+}
+
+function readPackageManifest(path) {
+  try {
+    const manifest = JSON.parse(readFileSync(path, 'utf8'))
+    return manifest !== null && typeof manifest === 'object' ? manifest : null
+  } catch {
+    return null
+  }
+}
+
+function detectHostManifest() {
+  const starts = [
+    typeof process.cwd === 'function' ? process.cwd() : null,
+    typeof process.argv?.[1] === 'string' ? dirname(process.argv[1]) : null,
+  ].filter(Boolean)
+  const seen = new Set()
+  for (const start of starts) {
+    let current = start
+    for (let depth = 0; depth < 10 && current !== dirname(current); depth += 1) {
+      if (seen.has(current)) break
+      seen.add(current)
+      const manifest = readPackageManifest(join(current, 'package.json'))
+      if (manifest && ['@deepseek-ai/dsh-root', '@deepseek-ai/dsh'].includes(manifest.name)) {
+        return { name: manifest.name, version: typeof manifest.version === 'string' ? manifest.version : null }
+      }
+      current = dirname(current)
+    }
+  }
+  return { name: null, version: null }
+}
+
+function compareVersions(left, right) {
+  const parse = (value) => {
+    const match = typeof value === 'string' && value.match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/)
+    if (match === null) return null
+    return { major: Number(match[1]), minor: Number(match[2]), patch: Number(match[3]), pre: match[4] || '' }
+  }
+  const a = parse(left)
+  const b = parse(right)
+  if (a === null || b === null) return null
+  for (const key of ['major', 'minor', 'patch']) {
+    if (a[key] !== b[key]) return a[key] > b[key] ? 1 : -1
+  }
+  if (a.pre === b.pre) return 0
+  if (a.pre === '') return 1
+  if (b.pre === '') return -1
+  return a.pre.localeCompare(b.pre, 'en', { numeric: true })
+}
+
+const HOST_MANIFEST = detectHostManifest()
+
+export function hostHealthSnapshot() {
+  const hostVersion = HOST_MANIFEST.version
+  const comparison = compareVersions(hostVersion, MIN_HOST_VERSION)
+  const compatibility = comparison === null
+    ? { status: 'unknown', minimumVersion: MIN_HOST_VERSION, message: '无法读取 Harness 版本' }
+    : comparison >= 0
+      ? { status: 'compatible', minimumVersion: MIN_HOST_VERSION, message: '满足插件最低版本要求' }
+      : { status: 'upgrade-recommended', minimumVersion: MIN_HOST_VERSION, message: 'Harness 版本低于插件建议版本' }
+  return {
+    name: HOST_MANIFEST.name,
+    version: hostVersion,
+    detected: hostVersion !== null,
+    compatibility,
+  }
+}
+
+export function healthSnapshot() {
+  return {
+    ok: true,
+    plugin: { name: 'deepseek-harness-wallet', version: PLUGIN_VERSION },
+    host: hostHealthSnapshot(),
+    pricing: pricingSnapshot(),
+    accounts: accountStorageSnapshot(),
+    runtime: { node: process.version, platform: process.platform },
+  }
+}
+
 export function ratesFor(model, atMs) {
   let entry
-  for (const policy of PRICE_POLICIES) {
+  for (const policy of activePricePolicies) {
     // Own-property check: a model named `__proto__`/`toString` would otherwise
     // resolve to an Object.prototype member and produce NaN costs.
     if (atMs >= policy.since && Object.hasOwn(policy.models, model)) entry = policy
@@ -289,10 +528,128 @@ function scheduleSave(logger) {
 
 // ---------------------------------------------------------------------------
 // Multi-account store (accounts.json): list, add, remove, hot-switch.
-// Keys are stored plaintext next to .credentials.yaml, matching the harness's
-// own credential storage; the API surface only ever exposes masked keys.
+// Keys remain available in memory for the active LLM/balance request, but are
+// encrypted at rest. Windows uses the current user's DPAPI; other platforms
+// use an owner-only AES-GCM key file as a best-effort local fallback.
 // ---------------------------------------------------------------------------
 
+const WINDOWS_DPAPI_PROTECT = [
+  '$ErrorActionPreference = "Stop"',
+  'Add-Type -AssemblyName System.Security',
+  '$encoded = [Console]::In.ReadToEnd().Trim()',
+  '$bytes = [Convert]::FromBase64String($encoded)',
+  '$protected = [Security.Cryptography.ProtectedData]::Protect($bytes, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser)',
+  '[Console]::Out.Write([Convert]::ToBase64String($protected))',
+].join(';')
+const WINDOWS_DPAPI_UNPROTECT = [
+  '$ErrorActionPreference = "Stop"',
+  'Add-Type -AssemblyName System.Security',
+  '$encoded = [Console]::In.ReadToEnd().Trim()',
+  '$protected = [Convert]::FromBase64String($encoded)',
+  '$bytes = [Security.Cryptography.ProtectedData]::Unprotect($protected, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser)',
+  '[Console]::Out.Write([Convert]::ToBase64String($bytes))',
+].join(';')
+let fallbackEncryptionKey = null
+let accountStorageScheme = process.platform === 'win32' ? 'windows-dpapi' : 'aes-gcm-file-key'
+let accountStorageError = null
+
+function runWindowsDpapi(operation, value) {
+  if (process.platform !== 'win32') return null
+  const result = spawnSync(
+    'powershell.exe',
+    ['-NoLogo', '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', operation === 'protect' ? WINDOWS_DPAPI_PROTECT : WINDOWS_DPAPI_UNPROTECT],
+    {
+      input: Buffer.from(value, 'utf8').toString('base64'),
+      encoding: 'utf8',
+      windowsHide: true,
+      maxBuffer: 1024 * 1024,
+    },
+  )
+  if (result.error || result.status !== 0) return null
+  const output = String(result.stdout || '').trim()
+  return output === '' ? null : output
+}
+
+function getFallbackEncryptionKey() {
+  if (fallbackEncryptionKey !== null) return fallbackEncryptionKey
+  try {
+    mkdirSync(dirname(ACCOUNTS_KEY_PATH), { recursive: true, mode: 0o700 })
+    if (existsSync(ACCOUNTS_KEY_PATH)) {
+      const existing = readFileSync(ACCOUNTS_KEY_PATH)
+      if (existing.length !== 32) throw new Error('account encryption key has an invalid length')
+      fallbackEncryptionKey = existing
+    } else {
+      fallbackEncryptionKey = randomBytes(32)
+      writeFileSync(ACCOUNTS_KEY_PATH, fallbackEncryptionKey, { mode: 0o600 })
+      chmodSync(ACCOUNTS_KEY_PATH, 0o600)
+    }
+    return fallbackEncryptionKey
+  } catch {
+    accountStorageError = 'account-encryption-key-unavailable'
+    return null
+  }
+}
+
+function protectApiKey(apiKey) {
+  const dpapi = runWindowsDpapi('protect', apiKey)
+  if (dpapi !== null) {
+    accountStorageScheme = 'windows-dpapi'
+    accountStorageError = null
+    return { version: ACCOUNTS_CRYPTO_VERSION, scheme: 'windows-dpapi', payload: dpapi }
+  }
+  const key = getFallbackEncryptionKey()
+  if (key === null) return null
+  try {
+    const iv = randomBytes(12)
+    const cipher = createCipheriv('aes-256-gcm', key, iv)
+    const ciphertext = Buffer.concat([cipher.update(apiKey, 'utf8'), cipher.final()])
+    accountStorageScheme = 'aes-gcm-file-key'
+    return {
+      version: ACCOUNTS_CRYPTO_VERSION,
+      scheme: 'aes-gcm-file-key',
+      iv: iv.toString('base64'),
+      tag: cipher.getAuthTag().toString('base64'),
+      payload: ciphertext.toString('base64'),
+    }
+  } catch {
+    accountStorageError = 'account-encryption-failed'
+    return null
+  }
+}
+
+function unprotectApiKey(value) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return ''
+  if (value.version !== ACCOUNTS_CRYPTO_VERSION || typeof value.scheme !== 'string' || typeof value.payload !== 'string') return ''
+  if (value.scheme === 'windows-dpapi') {
+    const decoded = runWindowsDpapi('unprotect', value.payload)
+    if (decoded === null) accountStorageError = 'account-decryption-failed'
+    else {
+      try { return Buffer.from(decoded, 'base64').toString('utf8') } catch { /* fall through */ }
+    }
+    return ''
+  }
+  if (value.scheme !== 'aes-gcm-file-key' || typeof value.iv !== 'string' || typeof value.tag !== 'string') return ''
+  const key = getFallbackEncryptionKey()
+  if (key === null) return ''
+  try {
+    const decipher = createDecipheriv('aes-256-gcm', key, Buffer.from(value.iv, 'base64'))
+    decipher.setAuthTag(Buffer.from(value.tag, 'base64'))
+    return Buffer.concat([decipher.update(Buffer.from(value.payload, 'base64')), decipher.final()]).toString('utf8')
+  } catch {
+    accountStorageError = 'account-decryption-failed'
+    return ''
+  }
+}
+
+export function accountStorageSnapshot() {
+  return {
+    encryptedAtRest: true,
+    scheme: accountStorageScheme,
+    status: accountStorageError === null ? 'ready' : 'error',
+    error: accountStorageError,
+  }
+}
+
 function emptyAccounts() {
   return { version: ACCOUNTS_VERSION, accounts: [], activeId: null }
 }
@@ -305,7 +662,9 @@ export function normalizeAccountsData(value) {
     if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) continue
     const id = typeof raw.id === 'string' && raw.id !== '' ? raw.id : null
     const name = typeof raw.name === 'string' ? raw.name.trim() : ''
-    const apiKey = typeof raw.apiKey === 'string' ? raw.apiKey : ''
+    // Accept the v1 plaintext shape once so an existing installation can be
+    // migrated on its next save; new writes use apiKeyEncrypted only.
+    const apiKey = typeof raw.apiKey === 'string' ? raw.apiKey : unprotectApiKey(raw.apiKeyEncrypted)
     if (id === null || name === '' || apiKey === '') continue
     accounts.push({
       id,
@@ -323,14 +682,20 @@ export function normalizeAccountsData(value) {
 
 function loadAccounts() {
   try {
-    return normalizeAccountsData(JSON.parse(readFileSync(ACCOUNTS_PATH, 'utf8')))
+    const raw = JSON.parse(readFileSync(ACCOUNTS_PATH, 'utf8'))
+    const normalized = normalizeAccountsData(raw)
+    const legacyPlaintext = Array.isArray(raw?.accounts)
+      && raw.accounts.some((account) => account && typeof account.apiKey === 'string')
+    return { accounts: normalized, migrated: legacyPlaintext || raw?.version !== ACCOUNTS_VERSION }
   } catch {
-    return emptyAccounts()
+    return { accounts: emptyAccounts(), migrated: false }
   }
 }
 
 let accountsSaveTimer = null
-let accounts = loadAccounts()
+const loadedAccounts = loadAccounts()
+let accounts = loadedAccounts.accounts
+let accountsNeedsSave = loadedAccounts.migrated
 
 function persistAccounts(logger) {
   if (accountsSaveTimer !== null) {
@@ -340,12 +705,24 @@ function persistAccounts(logger) {
   try {
     mkdirSync(dirname(ACCOUNTS_PATH), { recursive: true, mode: 0o700 })
     const tmp = ACCOUNTS_PATH + '.tmp'
-    // This file holds plaintext API keys: owner-only, never group/world readable.
-    writeFileSync(tmp, JSON.stringify(accounts), { mode: 0o600 })
+    const encryptedAccounts = accounts.accounts.map((account) => {
+      const apiKeyEncrypted = protectApiKey(account.apiKey)
+      if (apiKeyEncrypted === null) throw new Error('account encryption unavailable')
+      return {
+        id: account.id,
+        name: account.name,
+        apiKeyEncrypted,
+        createdAt: account.createdAt,
+      }
+    })
+    writeFileSync(tmp, JSON.stringify({ version: ACCOUNTS_VERSION, accounts: encryptedAccounts, activeId: accounts.activeId }), { mode: 0o600 })
+    chmodSync(tmp, 0o600)
     renameSync(tmp, ACCOUNTS_PATH)
+    accountsNeedsSave = false
   } catch (error) {
+    accountStorageError = accountStorageError || 'account-encryption-failed'
     if (logger && typeof logger.warn === 'function') {
-      logger.warn('dsh-wallet: failed to persist accounts: ' + String(error))
+      logger.warn('dsh-wallet: failed to persist encrypted accounts')
     }
   }
 }
@@ -701,11 +1078,11 @@ function snapshotView(sessionId) {
     pricingWindows: {
       timezone: 'Asia/Shanghai',
       offsetMinutes: 480,
-      windows: PEAK_WINDOWS.map(w => ({ startHour: w.startHour, endHour: w.endHour })),
+      windows: peakWindows.map(w => ({ startHour: w.startHour, endHour: w.endHour })),
       offPeakRate: OFF_PEAK_RATE,
       isPeak: isBeijingPeak(now),
-      weekendOffPeak: now >= WEEKEND_OFF_PEAK_SINCE && isBeijingWeekend(now),
-      weekendOffPeakSince: WEEKEND_OFF_PEAK_SINCE,
+      weekendOffPeak: now >= weekendOffPeakSince && isBeijingWeekend(now),
+      weekendOffPeakSince,
     },
     accounts: {
       activeId: accounts.activeId,
@@ -768,6 +1145,7 @@ export function apply(ctx, config) {
     storeNeedsSave = false
     scheduleSave(ctx.logger)
   }
+  if (accountsNeedsSave) scheduleAccountsSave(ctx.logger)
   // Thresholds live ONLY in the persisted store; an explicit row config may
   // still override the CNY line for power users, but the bundle patch sets none.
   if (Number.isFinite(config.threshold)) {
@@ -817,6 +1195,17 @@ export function apply(ctx, config) {
   const balanceTimer = setInterval(() => void refreshBalance(ctx), BALANCE_REFRESH_MS)
   if (typeof balanceTimer.unref === 'function') balanceTimer.unref()
 
+  ctx.effect(() => {
+    const first = setTimeout(() => void syncOfficialPricing(ctx.logger), 1000)
+    const timer = setInterval(() => void syncOfficialPricing(ctx.logger), PRICING_SYNC_INTERVAL_MS)
+    if (typeof first.unref === 'function') first.unref()
+    if (typeof timer.unref === 'function') timer.unref()
+    return () => {
+      clearTimeout(first)
+      clearInterval(timer)
+    }
+  }, 'dsh-wallet: official pricing sync')
+
   ctx.effect(() => {
     const disposeSnapshot = ctx.webServer.register({
       kind: 'exact',
@@ -826,6 +1215,23 @@ export function apply(ctx, config) {
         return json(res, 200, snapshotView(sessionParam(req)))
       },
     })
+    const disposeHealth = ctx.webServer.register({
+      kind: 'exact',
+      path: '/api/wallet/health',
+      handler: (req, res) => {
+        if (req.method !== 'GET') return json(res, 405, { ok: false, error: 'method-not-allowed' })
+        return json(res, 200, healthSnapshot())
+      },
+    })
+    const disposePricingRefresh = ctx.webServer.register({
+      kind: 'exact',
+      path: '/api/wallet/pricing/refresh',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return json(res, 405, { ok: false, error: 'method-not-allowed' })
+        await syncOfficialPricing(ctx.logger)
+        return json(res, 200, { ok: true, pricing: pricingSnapshot() })
+      },
+    })
     const disposeThreshold = ctx.webServer.register({
       kind: 'exact',
       path: '/api/wallet/threshold',
@@ -966,6 +1372,8 @@ export function apply(ctx, config) {
     })
     return () => {
       disposeSnapshot()
+      disposeHealth()
+      disposePricingRefresh()
       disposeThreshold()
       disposeRefresh()
       disposeClear()

package/lib/client.js

@@ -23,7 +23,7 @@ window.__ModuleLoader__.load({
 
     var POLL_MS = 15000
     // Keep in lockstep with package.json; a test enforces the sync.
-    var WALLET_VERSION = '0.2.6'
+    var WALLET_VERSION = '0.3.0'
     var CONFIRM_KEY = 'dsh-wallet-recharge-confirmed'
     var CHIP_LAYOUT_KEY = 'dshw-chip-layout-v4'
     var PANEL_POS_KEY = 'dshw-panel-pos-v1'
@@ -1140,6 +1140,8 @@ window.__ModuleLoader__.load({
       props = props || {}
       var close = typeof props.close === 'function' ? props.close : null
       var [snapshot, setSnapshot] = React.useState(null)
+      var [health, setHealth] = React.useState(null)
+      var [healthNotice, setHealthNotice] = React.useState(null)
       var [thresholdDraft, setThresholdDraft] = React.useState('')
       var [thresholdNotice, setThresholdNotice] = React.useState(null)
       var [accounts, setAccounts] = React.useState(null)
@@ -1215,6 +1217,9 @@ window.__ModuleLoader__.load({
         fetch('/api/wallet/accounts').then(function (resp) { return resp.json() }).then(function (json) {
           if (!stopped && json && json.ok) setAccounts(json)
         }).catch(function () { if (!stopped) setAccountsError('\u8d26\u6237\u63a5\u53e3\u4e0d\u53ef\u7528') })
+        fetch('/api/wallet/health').then(function (resp) { return resp.json() }).then(function (json) {
+          if (!stopped && json && json.ok) setHealth(json)
+        }).catch(function () { if (!stopped) setHealthNotice('健康检查不可用') })
         try {
           var savedLayout = compatibility.storage.getItem(CHIP_LAYOUT_KEY)
           var dock = savedLayout === null ? 'home' : normalizeChipLayout(JSON.parse(savedLayout)).dock
@@ -1223,6 +1228,52 @@ window.__ModuleLoader__.load({
         return function () { stopped = true }
       }, [])
 
+      function refreshHealth() {
+        setHealthNotice('正在检测…')
+        fetch('/api/wallet/health').then(function (resp) { return resp.json() }).then(function (json) {
+          if (json && json.ok) { setHealth(json); setHealthNotice('检测完成') }
+          else setHealthNotice('检测失败')
+        }).catch(function () { setHealthNotice('检测失败') })
+      }
+
+      function refreshPricing() {
+        setHealthNotice('正在同步官方价格…')
+        fetch('/api/wallet/pricing/refresh', { method: 'POST' }).then(function (resp) { return resp.json() }).then(function (json) {
+          if (json && json.ok) {
+            setHealth(function (current) { return current ? Object.assign({}, current, { pricing: json.pricing }) : current })
+            setHealthNotice(json.pricing && json.pricing.status === 'synced' ? '官方价格已同步' : '已保留内置价格，等待复核')
+          } else setHealthNotice('价格同步失败')
+        }).catch(function () { setHealthNotice('价格同步失败') })
+      }
+
+      function copyDiagnostics() {
+        if (!health) return
+        var safe = {
+          plugin: health.plugin,
+          host: health.host,
+          pricing: health.pricing && {
+            status: health.pricing.status,
+            ruleVersion: health.pricing.ruleVersion,
+            checkedAt: health.pricing.checkedAt,
+            modelCount: health.pricing.modelCount,
+          },
+          accounts: health.accounts && {
+            encryptedAtRest: health.accounts.encryptedAtRest,
+            scheme: health.accounts.scheme,
+            status: health.accounts.status,
+          },
+          runtime: health.runtime && { node: health.runtime.node, platform: health.runtime.platform },
+        }
+        var text = JSON.stringify(safe, null, 2)
+        try {
+          if (navigator.clipboard && typeof navigator.clipboard.writeText === 'function') {
+            navigator.clipboard.writeText(text).then(function () { setHealthNotice('诊断信息已复制') }).catch(function () { setHealthNotice('复制失败') })
+            return
+          }
+        } catch (e) { /* fall through to the message */ }
+        setHealthNotice('当前环境不支持自动复制')
+      }
+
       function persistVisibility(next) {
         next = normalizeDataVisibility(next)
         setVisibility(next)
@@ -1406,6 +1457,39 @@ window.__ModuleLoader__.load({
           React.createElement('span', { className: 'dshw_balDot' }, '·'),
           React.createElement('span', null, currencyCode))))
 
+      // —— 健康检查 ——
+      var hostHealth = health && health.host ? health.host : null
+      var hostCompatibility = hostHealth && hostHealth.compatibility ? hostHealth.compatibility : null
+      var pricing = health && health.pricing ? health.pricing : null
+      var accountStorage = health && health.accounts ? health.accounts : null
+      var compatibilityText = hostCompatibility
+        ? (hostCompatibility.status === 'compatible' ? '兼容' : hostCompatibility.status === 'upgrade-recommended' ? '建议升级' : '待检测')
+        : '检测中'
+      var pricingText = pricing
+        ? (pricing.status === 'synced' ? '已同步' : pricing.status === 'review-required' ? '待复核' : pricing.status === 'offline' ? '离线，使用内置规则' : '内置规则')
+        : '检测中'
+      var storageText = accountStorage
+        ? (accountStorage.scheme === 'windows-dpapi' ? 'Windows DPAPI 加密' : 'AES-GCM 加密')
+        : '检测中'
+      rows.push(React.createElement('div', { key: 'health', className: 'dshw_setCard', style: { display: 'block' } },
+        React.createElement('div', { className: 'dshw_settingsGroupHeader' },
+          React.createElement('div', { className: 'dshw_settingsGroupTitle' }, 'Harness 健康检查'),
+          React.createElement('div', { className: 'dshw_settingsGroupHint' }, healthNotice || '不包含 API Key 或本地路径')),
+        React.createElement('div', { className: 'dshw_settingsHeroMeta' },
+          React.createElement('span', null, 'Harness v' + (hostHealth && hostHealth.version ? hostHealth.version : '未识别')),
+          React.createElement('span', { className: 'dshw_balDot' }, '·'),
+          React.createElement('span', null, '插件 v' + WALLET_VERSION),
+          React.createElement('span', { className: 'dshw_balDot' }, '·'),
+          React.createElement('span', null, '兼容：' + compatibilityText)),
+        React.createElement('div', { className: 'dshw_settingsHeroMeta' },
+          React.createElement('span', null, '价格规则：' + pricingText),
+          React.createElement('span', { className: 'dshw_balDot' }, '·'),
+          React.createElement('span', null, '账户存储：' + storageText)),
+        React.createElement('div', { className: 'dshw_settingsFooterActions', style: { marginTop: '8px' } },
+          React.createElement('button', { type: 'button', className: 'dshw_btn', onClick: refreshHealth }, '重新检测'),
+          React.createElement('button', { type: 'button', className: 'dshw_btn', onClick: refreshPricing }, '同步官方价格'),
+          React.createElement('button', { type: 'button', className: 'dshw_btn', disabled: !health, onClick: copyDiagnostics }, '复制诊断信息'))))
+
       // —— 设置卡 ——
       var cells = []
       cells.push(React.createElement('div', { key: 'vis', className: 'dshw_setCell' },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "deepseek-harness-wallet",
-  "description": "Local-first account monitoring, usage accounting, official recharge, completion reminders, flexible layout, host-gated session controls, and multi-account management with hot account switching for DeepSeek Harness.",
-  "version": "0.2.6",
+  "description": "Local-first account monitoring, usage accounting, official pricing sync, health checks, encrypted multi-account management, recharge, completion reminders, flexible layout, and host-gated session controls for DeepSeek Harness.",
+  "version": "0.3.0",
   "type": "module",
   "main": "index.js",
   "exports": {