deepseek-harness-wallet 0.2.6 → 0.3.1

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to this project are documented in this file.
 
+## 0.3.1 - 2026-08-23
+
+- 修复 Windows DPAPI 账户密钥在重启后无法解密的问题，并在加密文件损坏或密钥不可用时锁定写入，避免覆盖原数据。 / Fixed Windows DPAPI account keys failing to decrypt after restart and locked writes when encrypted data cannot be recovered, preventing accidental overwrite.
+- 修复 Electron/Tauri 同步通知句柄的点击/关闭回调断链，并让所有充值入口统一经过桌面端外链适配与首次域名确认。 / Fixed callback wiring for synchronous Electron/Tauri notification handles and routed every recharge entry through the desktop external-link adapter and first-use domain confirmation.
+- 修复官方价格页改用“周一至周五”表述后同步被误判为结构变化的问题，并把视觉模型的计费生效时间校正为 2026-08-21 上线日。 / Accepted the official pricing page's current weekday-only wording and corrected vision-model billing to its 2026-08-21 launch date.
+- 将周五 18:00 至周一 09:00 作为连续低谷周期：周五提示“周末全天低谷”，周六/周日分别显示当天全天低谷，周一 09:00 前显示剩余多久进入高峰；跨午夜不重复提醒。 / Treated Friday 18:00 through Monday 09:00 as one continuous off-peak period: Friday previews the all-weekend rule, Saturday/Sunday name the current day, Monday shows time remaining to peak, and midnight boundaries do not repeat alerts.
+- 旧客户端在周末收到空峰值窗口，避免未强刷的 Edge 标签页继续误报高峰；账户文件现在自动保留加密 `.bak`，主文件缺失时可自动恢复。当前 91/91 通过。 / Weekend snapshots give stale clients no peak windows so an old Edge tab cannot keep falsely reporting peak; encrypted account files now keep a `.bak` fallback that restores a missing primary file. 91/91 tests pass.
+
+## 0.3.0 - 2026-08-23
+
+- 新增 `deepseek-v4-flash-vision-exp` 视觉模型计费，沿用 V4 Flash 的峰谷价格；图片 token 由 Harness 上报后与文本 token 一起计入。 / Added billing for `deepseek-v4-flash-vision-exp` using V4 Flash peak/off-peak rates; image tokens reported by Harness are counted with text tokens.
+- 新增官方价格页自动检查：成功解析并完整校验后才应用新规则，网络失败或页面结构变化时保留内置规则并显示状态。 / Added official pricing-page sync: new rules apply only after complete validation; network failures or schema changes keep the built-in policy and expose the status.
+- 新增 Harness 健康检查：显示宿主/插件版本、兼容性、价格同步状态与无敏感信息的诊断复制。 / Added Harness health checks for host/plugin versions, compatibility, pricing-sync status, and safe diagnostic copying.
+- 多账户 API Key 改为加密存储：Windows 使用当前用户 DPAPI，其他系统使用 AES-GCM 本地密钥文件；兼容旧版明文账户文件并在下次保存时迁移。 / Encrypted multi-account API keys at rest with Windows DPAPI or an AES-GCM local key file; legacy plaintext account files migrate on the next save.
+
 ## 0.2.6 - 2026-08-23
 
 - 跟随 DeepSeek 官方规则更新峰谷计费：自 2026-08-23 北京时间 00:00 起，周六、周日全天按低谷价计费；工作日高峰仍为 09:00–12:00、14:00–18:00。 / Updated peak/off-peak billing to match DeepSeek's official rule: from 2026-08-23 00:00 Beijing, Saturday and Sunday are all-day off-peak; weekday peak windows remain 09:00–12:00 and 14:00–18:00.

package/README.md

@@ -3,7 +3,7 @@
 [![npm version](https://img.shields.io/npm/v/deepseek-harness-wallet?label=npm&color=5965d8)](https://www.npmjs.com/package/deepseek-harness-wallet)
 [![GitHub release](https://img.shields.io/github/v/release/feibi-mochi/deepseek-harness-control-center?label=release&color=5965d8)](https://github.com/feibi-mochi/deepseek-harness-control-center/releases)
 [![CI](https://github.com/feibi-mochi/deepseek-harness-control-center/actions/workflows/validate.yml/badge.svg)](https://github.com/feibi-mochi/deepseek-harness-control-center/actions/workflows/validate.yml)
-[![DeepSeek Harness](https://img.shields.io/badge/DeepSeek%20Harness-0.1.0--rc.8-4aa3ff)](https://github.com/deepseek-ai/DeepSeek-Harness)
+[![DeepSeek Harness](https://img.shields.io/badge/DeepSeek%20Harness-0.1.1--rc.2-4aa3ff)](https://github.com/deepseek-ai/DeepSeek-Harness)
 [![License: MIT](https://img.shields.io/badge/license-MIT-3b7a57)](./LICENSE)
 
 **DeepSeek Harness monitoring, alerts, recharge, and session control center.**
@@ -14,6 +14,8 @@
 
 > A local-first companion that keeps account status, per-conversation usage, completion reminders, official recharge, flexible layout, and host-gated session controls beside the DSH composer.
 
+> **Versions:** GitHub `main` is v0.3.1 source; npm and the latest Release remain v0.3.0. Use the GitHub install only for the current source build.
+
 > If DeepSeek Harness Control Center helps you, please consider leaving a ⭐ Star. Thank you!
 
 ## What it does
@@ -23,7 +25,9 @@
 ```
 
 - **Official DeepSeek** — live balance (60s global refresh with fast boot retries), an estimated current-session cost (not an official bill) locked to the price active for each usage event, including the 2026-08-17 peak/off-peak rollout, and token breakdown.
-- **v4 peak/off-peak ring clock** — a resident 24-hour sidebar footer widget for `v4-flash` and `v4-pro`, indicating real-time pricing windows (peak vs. 50% discount off-peak), countdown to the next switch, and optional desktop switch notifications. Weekdays use 09:00–12:00 and 14:00–18:00 Beijing time; Saturday and Sunday are all-day off-peak from 2026-08-23. Other models keep their flat rates.
+- **Vision model accounting** — `deepseek-v4-flash-vision-exp` is priced like V4 Flash; image tokens reported by the Harness are included with text tokens.
+- **v4 peak/off-peak ring clock** — a resident 24-hour sidebar footer widget for `v4-flash`, `v4-pro`, and `v4-flash-vision-exp`. Weekday peak windows are 09:00–12:00 and 14:00–18:00 Beijing time. After Friday 18:00 the card previews “weekend all-day off-peak”; Saturday and Sunday name the current all-day off-peak rule; Monday before 09:00 shows the time remaining to enter peak. Optional notifications treat Friday 18:00 through Monday 09:00 as one continuous off-peak period.
+- **Official pricing sync** — periodically checks the official DeepSeek pricing page and applies only a fully validated table. Network failures retain the last validated rule (or the built-in rule before the first successful sync); an unrecognized page structure is marked for review instead of silently changing billing.
 - **Third-party total** — current-session tokens (input / cache read / output). No balance guessing, no cost math, zero configuration.
 - **Provider classification** — observed wrapper routes appear in the settings page; opted-in routes join the official token/cost bucket and are priced with the official table.
 - **Click the chip** to open the detail panel: correctly formatted per-currency balances, cost and token splits, a freely editable low-balance threshold for the active account and currency (two decimals, persisted per account; alerts never mix currencies), manual refresh, and a jump to the official recharge page (first click shows the domain for confirmation — anti-phishing).
@@ -32,7 +36,7 @@
 - **Completion reminders** — optionally notify when a conversation finishes, with persistent or timed modes, queueing and deduplication for simultaneous completions, cross-tab coordination, and an in-page fallback when system notifications are unavailable.
 - **Optional permanent deletion** — when the DSH host advertises a real deletion capability, an opt-in setting enables a confirmed permanent-delete action in the session menu; unsupported hosts keep the control disabled.
 - **Low-balance alert** — below the threshold the chip turns red with a breathing animation and fires one desktop notification; it resets automatically once the balance recovers.
-- **Theme-native UI** — built entirely on `--dsw-alias-*` theme variables, so light and dark themes both render correctly; the panel closes when you click outside and flips open-direction near screen edges.
+- **Theme-native UI** — uses DSH `--dsw-alias-*` variables with safe fallback colors, so light and dark themes both render correctly; the panel closes when you click outside and flips open-direction near screen edges.
 - **Clear current-session wallet data** — one button clears only the open conversation's token/cost records; it does not delete the conversation, and every other conversation is untouched.
 
 ## Multi-account
@@ -40,7 +44,7 @@
 - Open the wallet panel → **Account Management（账户管理）** to add accounts (name + API key), switch the active one, or remove them.
 - The first account added becomes the active account automatically and is synced into the credentials seam.
 - Switching prompts a confirmation because it changes **LLM billing** for subsequent requests: the switch writes the account key into the credentials seam (`credentials.set('DEEPSEEK_API_KEY', ...)`), and since the llm-deepseek provider route resolves that reference per request, the very next LLM call is billed with the new account — no restart needed.
-- Account keys are stored in plaintext in `$DSH_HOME/storages/accounts.json`; the UI only shows masked keys. Treat the DSH data directory as a local credential store and protect access to it. Balance lookups prefer the active account's key and fall back to the credentials seam when no account is active.
+- Account keys are encrypted at rest in `$DSH_HOME/storages/accounts.json`: Windows uses the current user's DPAPI; other platforms use an owner-only AES-GCM key file. The UI only shows masked keys. Balance lookups prefer the active account's key and fall back to the credentials seam when no account is active.
 - Session usage estimates follow the active account's currency: USD-settled accounts show `本约 $x`, converted from the CNY price table at the vendor's long-standing list ratio (not a live FX rate); CNY accounts show `本场 ¥x`. These are local estimates, not an official invoice.
 - If `DEEPSEEK_API_KEY` is supplied by the launching environment, switching is refused with a clear error (the credentials provider rejects shadowed writes) — unset it in your shell to enable switching.
 
@@ -65,13 +69,13 @@ Details: [compatibility](#browser-desktop-and-os-compatibility) · [data and tru
 
 ## Install
 
-From npm:
+From npm (stable v0.3.0):
 
 ```sh
 dsh plugin --profile web add deepseek-harness-wallet
 ```
 
-or from GitHub directly:
+or from GitHub `main` (current v0.3.1 source):
 
 ```sh
 dsh plugin --profile web add github:feibi-mochi/deepseek-harness-control-center
@@ -81,8 +85,8 @@ Restart `dsh web`, then hard-refresh the page.
 
 ## Quick use
 
-1. Click the wallet or peak/off-peak card to open its control panel.
-2. Choose horizontal or vertical layout, then use the scale control between 100% and 120%.
+1. Click the wallet or peak/off-peak card to open its control panel; open the Harness settings card for health and compatibility checks.
+2. The peak card supports horizontal/vertical layout and 100%–120% scaling. The wallet chip uses a separate scale: 100%–105% in the composer and up to 125% when docked or floating.
 3. Turn the official recharge button off when you need a smaller card; official and third-party rows can also be shown independently.
 4. Drag the card to any open area. If it is hard to find after a layout change, use **Reset/Dock（归位/停靠）** in the panel to return it to the sidebar.
 5. The card follows the host light/dark theme. A hard refresh after upgrading makes sure the new client bundle is loaded.
@@ -139,7 +143,7 @@ For buildable DSH hosts, the npm package and repository include a versioned [Age
 | --- | --- |
 | Token accounting | Listens to the `llm/stream` event and buckets per session and provider: `deepseek-official` plus explicitly opted-in wrapper routes use the official bucket; other providers stay third-party; each usage event also locks its contemporaneous official price, so multiple sessions and pricing windows never mix. |
 | Balance | The wallet plugin itself sends the active key directly only to the official `/user/balance` endpoint. When multi-account switching is enabled, the selected key is also written into the DSH credentials seam; DSH may then use it for subsequent model requests. |
-| Accounts | Keys live in `$DSH_HOME/storages/accounts.json` in plaintext, matching the harness's own credential storage. The UI only shows masked keys, and switching writes the chosen key into the credentials seam for subsequent LLM billing. Protect the DSH data directory as you would any local credential store. |
+| Accounts | Keys live encrypted in `$DSH_HOME/storages/accounts.json`, with an encrypted `accounts.json.bak` fallback that restores a missing primary file. Windows uses current-user DPAPI, so copies normally remain tied to the same Windows user. Other platforms use an owner-only AES-GCM key file; move or back up `accounts.json`, `.bak`, and `.key` together. The UI only shows masked keys, and switching writes the chosen key into the credentials seam for subsequent LLM billing. |
 | Session log | The plugin writes no events; its data lives in `$DSH_HOME/storages/wallet.json`. |
 | Local settings | Layout, scale, visibility, reminder, and panel settings stay in browser-compatible local storage. |
 | Permanent deletion | Opt-in and host-gated. The wallet never advertises the action unless the host implements the matching session deletion path. |
@@ -155,15 +159,16 @@ CNY per 1M tokens, curated from official announcements (cache writes are not bil
 - Since 2026-08-17 00:00 Beijing — peak/off-peak pricing for the v4 models (peak windows Beijing 09:00–12:00 / 14:00–18:00; off-peak is half the peak rate):
   - v4-flash (off-peak / peak): cache read 0.05 / 0.10, input 1.5 / 3, output 4.5 / 9
   - v4-pro (off-peak / peak): cache read 0.15 / 0.30, input 4.5 / 9, output 13.5 / 27
+- Since 2026-08-21 — v4-flash-vision-exp launched with the V4 Flash peak/off-peak table: cache read 0.05 / 0.10, input 1.5 / 3, output 4.5 / 9.
 - Since 2026-08-23 00:00 Beijing — Saturday and Sunday are no longer split into peak/off-peak windows; weekend calls use the off-peak rates all day. Weekday peak windows remain 09:00–12:00 and 14:00–18:00.
 
-deepseek-chat and deepseek-reasoner keep their flat rates. Each usage event is priced when it arrives; upgrading from 0.1.2 migrates legacy counters once using the then-current rate. Costs are estimates; the API-returned balance is authoritative.
+Historical deepseek-chat and deepseek-reasoner records retain their original flat-rate table; this is not a claim that those legacy model names remain currently available. Each usage event is priced when it arrives; upgrading from 0.1.2 migrates legacy counters once using the then-current rate. Costs are estimates; the API-returned balance is authoritative.
 
 ## Roadmap
 
-- [ ] Third-party price tables (cost per token)
-- [ ] Balance history chart
-- [ ] Balance-API adapters for other providers (e.g. Zhipu)
+- [ ] 365-day Token heatmap and rebuildable local usage ledger
+- [ ] Z.ai Coding Plan monitoring, built on a generic provider-adapter contract
+- [ ] Additional provider price/balance adapters only after real-account validation
 
 ## License
 

package/index.js

@@ -16,8 +16,9 @@
  *    seam when no account is active;
  *  - the /api/wallet routes the browser chip polls.
  */
-import { randomUUID } from 'node:crypto'
-import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
+import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from 'node:crypto'
+import { spawnSync } from 'node:child_process'
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, join } from 'node:path'
 
@@ -26,10 +27,18 @@ export const inject = ['webServer']
 
 const OFFICIAL_PROVIDER = 'deepseek-official'
 const RECHARGE_URL = 'https://platform.deepseek.com/top_up'
+const PLUGIN_VERSION = '0.3.1'
+const PRICING_SOURCE_URL = 'https://api-docs.deepseek.com/zh-cn/quick_start/pricing/'
+const PRICING_SYNC_INTERVAL_MS = 6 * 60 * 60_000
+const PRICING_SYNC_TIMEOUT_MS = 8_000
+const MIN_HOST_VERSION = '0.1.0-rc.8'
 const DSH_HOME = process.env.DSH_HOME ?? join(homedir(), '.dsh')
 const STORE_PATH = join(DSH_HOME, 'storages', 'wallet.json')
 const ACCOUNTS_PATH = join(DSH_HOME, 'storages', 'accounts.json')
-const ACCOUNTS_VERSION = 1
+const ACCOUNTS_KEY_PATH = ACCOUNTS_PATH + '.key'
+const ACCOUNTS_BACKUP_PATH = ACCOUNTS_PATH + '.bak'
+const ACCOUNTS_VERSION = 2
+const ACCOUNTS_CRYPTO_VERSION = 1
 const CREDENTIAL_REF = 'DEEPSEEK_API_KEY'
 const DEFAULT_THRESHOLD = 5
 const BALANCE_REFRESH_MS = 60_000
@@ -39,10 +48,12 @@ const STORE_VERSION = 2
 // From 2026-08-23 00:00 Beijing, Saturday and Sunday are off-peak all day.
 // Exposed to clients via snapshot.pricingWindows so the ring clock renders
 // from the active policy instead of hard-coding hours in the bundle.
-const PEAK_WINDOWS = [{ startHour: 9, endHour: 12 }, { startHour: 14, endHour: 18 }]
+const DEFAULT_PEAK_WINDOWS = [{ startHour: 9, endHour: 12 }, { startHour: 14, endHour: 18 }]
 const OFF_PEAK_RATE = 0.5
 const BEIJING_OFFSET_MS = 8 * 3600_000
 const WEEKEND_OFF_PEAK_SINCE = Date.UTC(2026, 7, 22, 16)
+let peakWindows = DEFAULT_PEAK_WINDOWS.map((window) => ({ ...window }))
+let weekendOffPeakSince = WEEKEND_OFF_PEAK_SINCE
 
 function isBeijingWeekend(atMs) {
   if (!Number.isFinite(atMs)) return false
@@ -52,9 +63,25 @@ function isBeijingWeekend(atMs) {
 }
 
 export function isBeijingPeak(atMs) {
-  if (atMs >= WEEKEND_OFF_PEAK_SINCE && isBeijingWeekend(atMs)) return false
+  if (atMs >= weekendOffPeakSince && isBeijingWeekend(atMs)) return false
   const hours = ((atMs + BEIJING_OFFSET_MS) % 86_400_000) / 3_600_000
-  return (hours >= 9 && hours < 12) || (hours >= 14 && hours < 18)
+  return peakWindows.some((window) => hours >= window.startHour && hours < window.endHour)
+}
+
+export function pricingWindowSnapshot(atMs = Date.now()) {
+  const weekendOffPeak = atMs >= weekendOffPeakSince && isBeijingWeekend(atMs)
+  return {
+    timezone: 'Asia/Shanghai',
+    offsetMinutes: 480,
+    // Current clients use weekendOffPeak for a full green ring. Empty windows
+    // also make stale pre-weekend clients fail neutral instead of falsely
+    // claiming Sunday is a peak period until the browser is hard-refreshed.
+    windows: weekendOffPeak ? [] : peakWindows.map((window) => ({ ...window })),
+    offPeakRate: OFF_PEAK_RATE,
+    isPeak: isBeijingPeak(atMs),
+    weekendOffPeak,
+    weekendOffPeakSince,
+  }
 }
 
 // Pricing timeline (CNY per 1M tokens; cacheWrite is not billed by DeepSeek).
@@ -83,11 +110,258 @@ export const PRICE_POLICIES = [
       'deepseek-v4-pro': { cacheHit: [0.15, 0.3], input: [4.5, 9], output: [13.5, 27] },
     },
   },
+  {
+    // Vision Exp was released on 2026-08-21 and uses the V4 Flash table.
+    since: Date.UTC(2026, 7, 20, 16),
+    peakOffPeak: true,
+    models: {
+      'deepseek-v4-flash-vision-exp': { cacheHit: [0.05, 0.1], input: [1.5, 3], output: [4.5, 9] },
+    },
+  },
 ]
 
+let activePricePolicies = PRICE_POLICIES
+let pricingSync = {
+  status: 'built-in',
+  source: PRICING_SOURCE_URL,
+  checkedAt: 0,
+  etag: null,
+  lastModified: null,
+  ruleVersion: 'built-in-2026-08-23',
+  modelCount: 3,
+  message: '尚未检查官方价格页',
+}
+
+function decodeHtmlText(value) {
+  return String(value)
+    .replace(/<br\s*\/?>/gi, ' ')
+    .replace(/<[^>]*>/g, ' ')
+    .replace(/&amp;/gi, '&')
+    .replace(/&nbsp;/gi, ' ')
+    .replace(/&#39;/g, "'")
+    .replace(/&quot;/gi, '"')
+    .replace(/\s+/g, ' ')
+    .trim()
+}
+
+function numericCells(row, count) {
+  const values = row.slice(Math.max(0, row.length - count)).map((cell) => {
+    const match = decodeHtmlText(cell).match(/\d+(?:\.\d+)?/)
+    return match === null ? null : Number(match[0])
+  })
+  return values.length === count && values.every((value) => Number.isFinite(value)) ? values : null
+}
+
+/**
+ * Parse the stable, server-rendered pricing table from DeepSeek's official
+ * documentation. A failed parse is deliberately treated as review-required;
+ * the wallet never silently bills from a partially understood page.
+ */
+export function parseOfficialPricingHtml(html) {
+  if (typeof html !== 'string' || html.length < 500) throw new Error('official pricing page is empty')
+  const rows = [...html.matchAll(/<tr\b[^>]*>([\s\S]*?)<\/tr>/gi)].map((match) =>
+    [...match[1].matchAll(/<td\b[^>]*>([\s\S]*?)<\/td>/gi)].map((cell) => decodeHtmlText(cell[1])),
+  ).filter((row) => row.length > 0)
+  const header = rows.find((row) => row.some((cell) => cell === 'deepseek-v4-flash'))
+  const models = header ? header.filter((cell) => /^deepseek-v4-[a-z0-9-]+$/i.test(cell)) : []
+  const requiredModels = ['deepseek-v4-flash', 'deepseek-v4-pro', 'deepseek-v4-flash-vision-exp']
+  if (models.length < requiredModels.length || requiredModels.some((model) => !models.includes(model))) {
+    throw new Error('official pricing model table changed')
+  }
+
+  function findPair(label) {
+    const index = rows.findIndex((row) => row.some((cell) => cell.includes(label)) && row.some((cell) => cell.includes('空闲时段')))
+    if (index < 0 || !rows[index + 1]?.some((cell) => cell.includes('高峰时段'))) throw new Error('official pricing rate rows changed')
+    const offPeak = numericCells(rows[index], models.length)
+    const peak = numericCells(rows[index + 1], models.length)
+    if (offPeak === null || peak === null) throw new Error('official pricing values changed')
+    return { offPeak, peak }
+  }
+
+  const cacheHit = findPair('缓存命中')
+  const input = findPair('缓存未命中')
+  const output = findPair('百万tokens输出')
+  const modelsWithRates = {}
+  for (const model of requiredModels) {
+    const index = models.indexOf(model)
+    modelsWithRates[model] = {
+      cacheHit: [cacheHit.offPeak[index], cacheHit.peak[index]],
+      input: [input.offPeak[index], input.peak[index]],
+      output: [output.offPeak[index], output.peak[index]],
+    }
+  }
+  const text = decodeHtmlText(html)
+  const windowMatch = text.match(/高峰时段为北京时间(?:周一至周五)?\s*(\d{1,2}):00\s*-\s*(\d{1,2}):00、\s*(\d{1,2}):00\s*-\s*(\d{1,2}):00/)
+  if (windowMatch === null) throw new Error('official peak window changed')
+  const parsedWindows = [
+    { startHour: Number(windowMatch[1]), endHour: Number(windowMatch[2]) },
+    { startHour: Number(windowMatch[3]), endHour: Number(windowMatch[4]) },
+  ]
+  const weekdayOnly = /高峰时段为北京时间周一至周五/.test(text)
+  const weekendMatch = text.match(/北京时间\s*(\d{4})年\s*(\d{1,2})月\s*(\d{1,2})日[^。]*?00:00起[^。]*?周末[^。]*?低谷/)
+  if (!weekdayOnly && weekendMatch === null) throw new Error('official weekend rule changed')
+  const weekendSince = weekdayOnly
+    ? WEEKEND_OFF_PEAK_SINCE
+    : Date.UTC(
+      Number(weekendMatch[1]), Number(weekendMatch[2]) - 1, Number(weekendMatch[3]), 0, 0, 0, 0,
+    ) - BEIJING_OFFSET_MS
+  return {
+    models: modelsWithRates,
+    peakWindows: parsedWindows,
+    weekendOffPeakSince: weekendSince,
+    ruleVersion: 'official-' + createHash('sha256').update(JSON.stringify({ modelsWithRates, parsedWindows, weekendSince })).digest('hex').slice(0, 12),
+  }
+}
+
+function applyOfficialPricing(parsed, response) {
+  activePricePolicies = PRICE_POLICIES.map((policy) => {
+    const models = {}
+    for (const model of Object.keys(policy.models)) {
+      models[model] = parsed.models[model] || policy.models[model]
+    }
+    return { ...policy, models }
+  })
+  peakWindows = parsed.peakWindows.map((window) => ({ ...window }))
+  weekendOffPeakSince = parsed.weekendOffPeakSince
+  pricingSync = {
+    status: 'synced',
+    source: PRICING_SOURCE_URL,
+    checkedAt: Date.now(),
+    etag: response?.headers?.get?.('etag') ?? pricingSync.etag,
+    lastModified: response?.headers?.get?.('last-modified') ?? pricingSync.lastModified,
+    ruleVersion: parsed.ruleVersion,
+    modelCount: Object.keys(parsed.models).length,
+    message: '已同步官方价格页',
+  }
+}
+
+async function syncOfficialPricing(logger) {
+  if (typeof fetch !== 'function') return
+  const controller = new AbortController()
+  const timeout = setTimeout(() => controller.abort(), PRICING_SYNC_TIMEOUT_MS)
+  let stage = 'network'
+  try {
+    const headers = {}
+    if (pricingSync.etag) headers['if-none-match'] = pricingSync.etag
+    if (pricingSync.lastModified) headers['if-modified-since'] = pricingSync.lastModified
+    const response = await fetch(PRICING_SOURCE_URL, { headers, signal: controller.signal })
+    if (response.status === 304) {
+      pricingSync = { ...pricingSync, status: 'synced', checkedAt: Date.now(), message: '官方价格页未变化' }
+      return
+    }
+    if (!response.ok) throw new Error('official pricing page returned ' + response.status)
+    stage = 'parse'
+    const parsed = parseOfficialPricingHtml(await response.text())
+    applyOfficialPricing(parsed, response)
+  } catch (error) {
+    const hasValidatedOfficialRule = typeof pricingSync.ruleVersion === 'string' && pricingSync.ruleVersion.startsWith('official-')
+    pricingSync = {
+      ...pricingSync,
+      status: stage === 'parse' ? 'review-required' : 'offline',
+      checkedAt: Date.now(),
+      message: stage === 'parse'
+        ? '官方价格页结构有变化，需要复核'
+        : hasValidatedOfficialRule ? '官方价格页暂时不可用，沿用上次已验证规则' : '官方价格页暂时不可用，使用内置规则',
+    }
+    if (logger && typeof logger.warn === 'function') logger.warn('dsh-wallet: official pricing sync unavailable')
+  } finally {
+    clearTimeout(timeout)
+  }
+}
+
+export function pricingSnapshot() {
+  return {
+    status: pricingSync.status,
+    source: pricingSync.source,
+    checkedAt: pricingSync.checkedAt,
+    ruleVersion: pricingSync.ruleVersion,
+    message: pricingSync.message,
+    modelCount: pricingSync.modelCount,
+    peakWindows: peakWindows.map((window) => ({ ...window })),
+    weekendOffPeakSince,
+  }
+}
+
+function readPackageManifest(path) {
+  try {
+    const manifest = JSON.parse(readFileSync(path, 'utf8'))
+    return manifest !== null && typeof manifest === 'object' ? manifest : null
+  } catch {
+    return null
+  }
+}
+
+function detectHostManifest() {
+  const starts = [
+    typeof process.cwd === 'function' ? process.cwd() : null,
+    typeof process.argv?.[1] === 'string' ? dirname(process.argv[1]) : null,
+  ].filter(Boolean)
+  const seen = new Set()
+  for (const start of starts) {
+    let current = start
+    for (let depth = 0; depth < 10 && current !== dirname(current); depth += 1) {
+      if (seen.has(current)) break
+      seen.add(current)
+      const manifest = readPackageManifest(join(current, 'package.json'))
+      if (manifest && ['@deepseek-ai/dsh-root', '@deepseek-ai/dsh'].includes(manifest.name)) {
+        return { name: manifest.name, version: typeof manifest.version === 'string' ? manifest.version : null }
+      }
+      current = dirname(current)
+    }
+  }
+  return { name: null, version: null }
+}
+
+function compareVersions(left, right) {
+  const parse = (value) => {
+    const match = typeof value === 'string' && value.match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/)
+    if (match === null) return null
+    return { major: Number(match[1]), minor: Number(match[2]), patch: Number(match[3]), pre: match[4] || '' }
+  }
+  const a = parse(left)
+  const b = parse(right)
+  if (a === null || b === null) return null
+  for (const key of ['major', 'minor', 'patch']) {
+    if (a[key] !== b[key]) return a[key] > b[key] ? 1 : -1
+  }
+  if (a.pre === b.pre) return 0
+  if (a.pre === '') return 1
+  if (b.pre === '') return -1
+  return a.pre.localeCompare(b.pre, 'en', { numeric: true })
+}
+
+const HOST_MANIFEST = detectHostManifest()
+
+export function hostHealthSnapshot() {
+  const hostVersion = HOST_MANIFEST.version
+  const comparison = compareVersions(hostVersion, MIN_HOST_VERSION)
+  const compatibility = comparison === null
+    ? { status: 'unknown', minimumVersion: MIN_HOST_VERSION, message: '无法读取 Harness 版本' }
+    : comparison >= 0
+      ? { status: 'compatible', minimumVersion: MIN_HOST_VERSION, message: '满足插件最低版本要求' }
+      : { status: 'upgrade-recommended', minimumVersion: MIN_HOST_VERSION, message: 'Harness 版本低于插件建议版本' }
+  return {
+    name: HOST_MANIFEST.name,
+    version: hostVersion,
+    detected: hostVersion !== null,
+    compatibility,
+  }
+}
+
+export function healthSnapshot() {
+  return {
+    ok: true,
+    plugin: { name: 'deepseek-harness-wallet', version: PLUGIN_VERSION },
+    host: hostHealthSnapshot(),
+    pricing: pricingSnapshot(),
+    accounts: accountStorageSnapshot(),
+    runtime: { node: process.version, platform: process.platform },
+  }
+}
+
 export function ratesFor(model, atMs) {
   let entry
-  for (const policy of PRICE_POLICIES) {
+  for (const policy of activePricePolicies) {
     // Own-property check: a model named `__proto__`/`toString` would otherwise
     // resolve to an Object.prototype member and produce NaN costs.
     if (atMs >= policy.since && Object.hasOwn(policy.models, model)) entry = policy
@@ -289,10 +563,173 @@ function scheduleSave(logger) {
 
 // ---------------------------------------------------------------------------
 // Multi-account store (accounts.json): list, add, remove, hot-switch.
-// Keys are stored plaintext next to .credentials.yaml, matching the harness's
-// own credential storage; the API surface only ever exposes masked keys.
+// Keys remain available in memory for the active LLM/balance request, but are
+// encrypted at rest. Windows uses the current user's DPAPI; other platforms
+// use an owner-only AES-GCM key file as a best-effort local fallback.
 // ---------------------------------------------------------------------------
 
+const WINDOWS_DPAPI_PROTECT = [
+  '$ErrorActionPreference = "Stop"',
+  'Add-Type -AssemblyName System.Security',
+  '$encoded = [Console]::In.ReadToEnd().Trim()',
+  '$bytes = [Convert]::FromBase64String($encoded)',
+  '$protected = [Security.Cryptography.ProtectedData]::Protect($bytes, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser)',
+  '[Console]::Out.Write([Convert]::ToBase64String($protected))',
+].join(';')
+const WINDOWS_DPAPI_UNPROTECT = [
+  '$ErrorActionPreference = "Stop"',
+  'Add-Type -AssemblyName System.Security',
+  '$encoded = [Console]::In.ReadToEnd().Trim()',
+  '$protected = [Convert]::FromBase64String($encoded)',
+  '$bytes = [Security.Cryptography.ProtectedData]::Unprotect($protected, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser)',
+  '[Console]::Out.Write([Convert]::ToBase64String($bytes))',
+].join(';')
+let fallbackEncryptionKey = null
+let accountStorageScheme = process.platform === 'win32' ? 'windows-dpapi' : 'aes-gcm-file-key'
+let accountStorageError = null
+let accountStorageLocked = false
+let accountStorageRecovered = false
+
+function runWindowsDpapi(operation, value) {
+  if (process.platform !== 'win32') return null
+  // Protect expects base64-encoded UTF-8 plaintext. Unprotect expects the
+  // DPAPI ciphertext's own base64 representation, so encoding it a second
+  // time makes every persisted account undecryptable after restart.
+  const input = operation === 'protect'
+    ? Buffer.from(value, 'utf8').toString('base64')
+    : value
+  const result = spawnSync(
+    'powershell.exe',
+    ['-NoLogo', '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', operation === 'protect' ? WINDOWS_DPAPI_PROTECT : WINDOWS_DPAPI_UNPROTECT],
+    {
+      input,
+      encoding: 'utf8',
+      windowsHide: true,
+      maxBuffer: 1024 * 1024,
+    },
+  )
+  if (result.error || result.status !== 0) return null
+  const output = String(result.stdout || '').trim()
+  return output === '' ? null : output
+}
+
+function getFallbackEncryptionKey(createIfMissing = true) {
+  if (fallbackEncryptionKey !== null) return fallbackEncryptionKey
+  try {
+    mkdirSync(dirname(ACCOUNTS_KEY_PATH), { recursive: true, mode: 0o700 })
+    if (existsSync(ACCOUNTS_KEY_PATH)) {
+      const existing = readFileSync(ACCOUNTS_KEY_PATH)
+      if (existing.length !== 32) throw new Error('account encryption key has an invalid length')
+      fallbackEncryptionKey = existing
+    } else {
+      if (!createIfMissing) {
+        accountStorageError = 'account-encryption-key-missing'
+        accountStorageLocked = true
+        return null
+      }
+      fallbackEncryptionKey = randomBytes(32)
+      writeFileSync(ACCOUNTS_KEY_PATH, fallbackEncryptionKey, { mode: 0o600 })
+      chmodSync(ACCOUNTS_KEY_PATH, 0o600)
+    }
+    return fallbackEncryptionKey
+  } catch {
+    accountStorageError = 'account-encryption-key-unavailable'
+    return null
+  }
+}
+
+function encryptApiKeyAes(apiKey, key, iv = randomBytes(12)) {
+  if (!Buffer.isBuffer(key) || key.length !== 32) throw new Error('AES account key must contain 32 bytes')
+  if (!Buffer.isBuffer(iv) || iv.length !== 12) throw new Error('AES-GCM IV must contain 12 bytes')
+  const cipher = createCipheriv('aes-256-gcm', key, iv)
+  const ciphertext = Buffer.concat([cipher.update(apiKey, 'utf8'), cipher.final()])
+  return {
+    version: ACCOUNTS_CRYPTO_VERSION,
+    scheme: 'aes-gcm-file-key',
+    iv: iv.toString('base64'),
+    tag: cipher.getAuthTag().toString('base64'),
+    payload: ciphertext.toString('base64'),
+  }
+}
+
+function decryptApiKeyAes(value, key) {
+  if (!Buffer.isBuffer(key) || key.length !== 32) throw new Error('AES account key must contain 32 bytes')
+  const decipher = createDecipheriv('aes-256-gcm', key, Buffer.from(value.iv, 'base64'))
+  decipher.setAuthTag(Buffer.from(value.tag, 'base64'))
+  return Buffer.concat([decipher.update(Buffer.from(value.payload, 'base64')), decipher.final()]).toString('utf8')
+}
+
+export const __testing = { encryptApiKeyAes, decryptApiKeyAes, compareVersions }
+
+function protectApiKey(apiKey) {
+  const dpapi = runWindowsDpapi('protect', apiKey)
+  if (dpapi !== null) {
+    accountStorageScheme = 'windows-dpapi'
+    accountStorageError = null
+    return { version: ACCOUNTS_CRYPTO_VERSION, scheme: 'windows-dpapi', payload: dpapi }
+  }
+  const key = getFallbackEncryptionKey()
+  if (key === null) return null
+  try {
+    const encrypted = encryptApiKeyAes(apiKey, key)
+    accountStorageScheme = 'aes-gcm-file-key'
+    return encrypted
+  } catch {
+    accountStorageError = 'account-encryption-failed'
+    return null
+  }
+}
+
+function unprotectApiKey(value) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+    accountStorageError = 'account-encrypted-record-invalid'
+    accountStorageLocked = true
+    return ''
+  }
+  if (value.version !== ACCOUNTS_CRYPTO_VERSION || typeof value.scheme !== 'string' || typeof value.payload !== 'string') {
+    accountStorageError = 'account-encrypted-record-invalid'
+    accountStorageLocked = true
+    return ''
+  }
+  if (value.scheme === 'windows-dpapi') {
+    const decoded = runWindowsDpapi('unprotect', value.payload)
+    if (decoded === null) {
+      accountStorageError = 'account-decryption-failed'
+      accountStorageLocked = true
+    }
+    else {
+      try { return Buffer.from(decoded, 'base64').toString('utf8') } catch { /* fall through */ }
+      accountStorageError = 'account-decryption-failed'
+      accountStorageLocked = true
+    }
+    return ''
+  }
+  if (value.scheme !== 'aes-gcm-file-key' || typeof value.iv !== 'string' || typeof value.tag !== 'string') {
+    accountStorageError = 'account-encrypted-record-invalid'
+    accountStorageLocked = true
+    return ''
+  }
+  const key = getFallbackEncryptionKey(false)
+  if (key === null) return ''
+  try {
+    return decryptApiKeyAes(value, key)
+  } catch {
+    accountStorageError = 'account-decryption-failed'
+    accountStorageLocked = true
+    return ''
+  }
+}
+
+export function accountStorageSnapshot() {
+  return {
+    encryptedAtRest: true,
+    scheme: accountStorageScheme,
+    status: accountStorageLocked ? 'locked' : accountStorageRecovered ? 'recovered' : accountStorageError === null ? 'ready' : 'error',
+    error: accountStorageError,
+    locked: accountStorageLocked,
+  }
+}
+
 function emptyAccounts() {
   return { version: ACCOUNTS_VERSION, accounts: [], activeId: null }
 }
@@ -305,7 +742,9 @@ export function normalizeAccountsData(value) {
     if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) continue
     const id = typeof raw.id === 'string' && raw.id !== '' ? raw.id : null
     const name = typeof raw.name === 'string' ? raw.name.trim() : ''
-    const apiKey = typeof raw.apiKey === 'string' ? raw.apiKey : ''
+    // Accept the v1 plaintext shape once so an existing installation can be
+    // migrated on its next save; new writes use apiKeyEncrypted only.
+    const apiKey = typeof raw.apiKey === 'string' ? raw.apiKey : unprotectApiKey(raw.apiKeyEncrypted)
     if (id === null || name === '' || apiKey === '') continue
     accounts.push({
       id,
@@ -321,16 +760,41 @@ export function normalizeAccountsData(value) {
   return { version: ACCOUNTS_VERSION, accounts, activeId }
 }
 
+function readAccountsFile(path) {
+  const raw = JSON.parse(readFileSync(path, 'utf8'))
+  const normalized = normalizeAccountsData(raw)
+  const legacyPlaintext = Array.isArray(raw?.accounts)
+    && raw.accounts.some((account) => account && typeof account.apiKey === 'string')
+  return { accounts: normalized, migrated: legacyPlaintext || raw?.version !== ACCOUNTS_VERSION }
+}
+
 function loadAccounts() {
+  if (!existsSync(ACCOUNTS_PATH)) {
+    if (!existsSync(ACCOUNTS_BACKUP_PATH)) return { accounts: emptyAccounts(), migrated: false }
+    try {
+      const recovered = readAccountsFile(ACCOUNTS_BACKUP_PATH)
+      accountStorageRecovered = true
+      accountStorageError = 'account-store-restored-from-backup'
+      return { accounts: recovered.accounts, migrated: true }
+    } catch {
+      accountStorageError = 'account-backup-invalid'
+      accountStorageLocked = true
+      return { accounts: emptyAccounts(), migrated: false }
+    }
+  }
   try {
-    return normalizeAccountsData(JSON.parse(readFileSync(ACCOUNTS_PATH, 'utf8')))
+    return readAccountsFile(ACCOUNTS_PATH)
   } catch {
-    return emptyAccounts()
+    accountStorageError = 'account-store-invalid'
+    accountStorageLocked = true
+    return { accounts: emptyAccounts(), migrated: false }
   }
 }
 
 let accountsSaveTimer = null
-let accounts = loadAccounts()
+const loadedAccounts = loadAccounts()
+let accounts = loadedAccounts.accounts
+let accountsNeedsSave = loadedAccounts.migrated
 
 function persistAccounts(logger) {
   if (accountsSaveTimer !== null) {
@@ -338,14 +802,33 @@ function persistAccounts(logger) {
     accountsSaveTimer = null
   }
   try {
+    if (accountStorageLocked) throw new Error('encrypted account store is locked')
     mkdirSync(dirname(ACCOUNTS_PATH), { recursive: true, mode: 0o700 })
     const tmp = ACCOUNTS_PATH + '.tmp'
-    // This file holds plaintext API keys: owner-only, never group/world readable.
-    writeFileSync(tmp, JSON.stringify(accounts), { mode: 0o600 })
+    const encryptedAccounts = accounts.accounts.map((account) => {
+      const apiKeyEncrypted = protectApiKey(account.apiKey)
+      if (apiKeyEncrypted === null) throw new Error('account encryption unavailable')
+      return {
+        id: account.id,
+        name: account.name,
+        apiKeyEncrypted,
+        createdAt: account.createdAt,
+      }
+    })
+    writeFileSync(tmp, JSON.stringify({ version: ACCOUNTS_VERSION, accounts: encryptedAccounts, activeId: accounts.activeId }), { mode: 0o600 })
+    chmodSync(tmp, 0o600)
+    if (existsSync(ACCOUNTS_PATH)) {
+      copyFileSync(ACCOUNTS_PATH, ACCOUNTS_BACKUP_PATH)
+      chmodSync(ACCOUNTS_BACKUP_PATH, 0o600)
+    }
     renameSync(tmp, ACCOUNTS_PATH)
+    accountsNeedsSave = false
+    accountStorageRecovered = false
+    accountStorageError = null
   } catch (error) {
+    accountStorageError = accountStorageError || 'account-encryption-failed'
     if (logger && typeof logger.warn === 'function') {
-      logger.warn('dsh-wallet: failed to persist accounts: ' + String(error))
+      logger.warn('dsh-wallet: failed to persist encrypted accounts')
     }
   }
 }
@@ -424,6 +907,7 @@ export function accountListView() {
       active: account.id === accounts.activeId,
     })),
     activeId: accounts.activeId,
+    storage: accountStorageSnapshot(),
   }
 }
 
@@ -698,15 +1182,7 @@ function snapshotView(sessionId) {
       })(),
     rechargeUrl: RECHARGE_URL,
     // Peak/off-peak policy for the ring clock; billed in Asia/Shanghai.
-    pricingWindows: {
-      timezone: 'Asia/Shanghai',
-      offsetMinutes: 480,
-      windows: PEAK_WINDOWS.map(w => ({ startHour: w.startHour, endHour: w.endHour })),
-      offPeakRate: OFF_PEAK_RATE,
-      isPeak: isBeijingPeak(now),
-      weekendOffPeak: now >= WEEKEND_OFF_PEAK_SINCE && isBeijingWeekend(now),
-      weekendOffPeakSince: WEEKEND_OFF_PEAK_SINCE,
-    },
+    pricingWindows: pricingWindowSnapshot(now),
     accounts: {
       activeId: accounts.activeId,
       activeName: active !== null ? active.name : null,
@@ -768,6 +1244,7 @@ export function apply(ctx, config) {
     storeNeedsSave = false
     scheduleSave(ctx.logger)
   }
+  if (accountsNeedsSave) scheduleAccountsSave(ctx.logger)
   // Thresholds live ONLY in the persisted store; an explicit row config may
   // still override the CNY line for power users, but the bundle patch sets none.
   if (Number.isFinite(config.threshold)) {
@@ -817,6 +1294,19 @@ export function apply(ctx, config) {
   const balanceTimer = setInterval(() => void refreshBalance(ctx), BALANCE_REFRESH_MS)
   if (typeof balanceTimer.unref === 'function') balanceTimer.unref()
 
+  if (config.pricingSync !== false) {
+    ctx.effect(() => {
+      const first = setTimeout(() => void syncOfficialPricing(ctx.logger), 1000)
+      const timer = setInterval(() => void syncOfficialPricing(ctx.logger), PRICING_SYNC_INTERVAL_MS)
+      if (typeof first.unref === 'function') first.unref()
+      if (typeof timer.unref === 'function') timer.unref()
+      return () => {
+        clearTimeout(first)
+        clearInterval(timer)
+      }
+    }, 'dsh-wallet: official pricing sync')
+  }
+
   ctx.effect(() => {
     const disposeSnapshot = ctx.webServer.register({
       kind: 'exact',
@@ -826,6 +1316,23 @@ export function apply(ctx, config) {
         return json(res, 200, snapshotView(sessionParam(req)))
       },
     })
+    const disposeHealth = ctx.webServer.register({
+      kind: 'exact',
+      path: '/api/wallet/health',
+      handler: (req, res) => {
+        if (req.method !== 'GET') return json(res, 405, { ok: false, error: 'method-not-allowed' })
+        return json(res, 200, healthSnapshot())
+      },
+    })
+    const disposePricingRefresh = ctx.webServer.register({
+      kind: 'exact',
+      path: '/api/wallet/pricing/refresh',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return json(res, 405, { ok: false, error: 'method-not-allowed' })
+        await syncOfficialPricing(ctx.logger)
+        return json(res, 200, { ok: true, pricing: pricingSnapshot() })
+      },
+    })
     const disposeThreshold = ctx.webServer.register({
       kind: 'exact',
       path: '/api/wallet/threshold',
@@ -900,6 +1407,7 @@ export function apply(ctx, config) {
       handler: async (req, res) => {
         if (req.method === 'GET') return json(res, 200, { ok: true, ...accountListView() })
         if (req.method !== 'POST') return json(res, 405, { ok: false, error: 'method-not-allowed' })
+        if (accountStorageLocked) return json(res, 423, { ok: false, error: 'account-storage-locked' })
         const body = await readBody(req)
         if (body === null || typeof body.name !== 'string' || typeof body.apiKey !== 'string') {
           return json(res, 400, { ok: false, error: 'name and apiKey are required' })
@@ -939,6 +1447,7 @@ export function apply(ctx, config) {
       path: '/api/wallet/accounts/activate',
       handler: async (req, res) => {
         if (req.method !== 'POST') return json(res, 405, { ok: false, error: 'method-not-allowed' })
+        if (accountStorageLocked) return json(res, 423, { ok: false, error: 'account-storage-locked' })
         const body = await readBody(req)
         if (body === null || typeof body.id !== 'string') return json(res, 400, { ok: false, error: 'id is required' })
         const result = await activateAccount(ctx, body.id)
@@ -955,6 +1464,7 @@ export function apply(ctx, config) {
       path: '/api/wallet/accounts/remove',
       handler: async (req, res) => {
         if (req.method !== 'POST') return json(res, 405, { ok: false, error: 'method-not-allowed' })
+        if (accountStorageLocked) return json(res, 423, { ok: false, error: 'account-storage-locked' })
         const body = await readBody(req)
         if (body === null || typeof body.id !== 'string') return json(res, 400, { ok: false, error: 'id is required' })
         const result = removeAccount(body.id)
@@ -966,6 +1476,8 @@ export function apply(ctx, config) {
     })
     return () => {
       disposeSnapshot()
+      disposeHealth()
+      disposePricingRefresh()
       disposeThreshold()
       disposeRefresh()
       disposeClear()

package/lib/client.js

@@ -23,7 +23,7 @@ window.__ModuleLoader__.load({
 
     var POLL_MS = 15000
     // Keep in lockstep with package.json; a test enforces the sync.
-    var WALLET_VERSION = '0.2.6'
+    var WALLET_VERSION = '0.3.1'
     var CONFIRM_KEY = 'dsh-wallet-recharge-confirmed'
     var CHIP_LAYOUT_KEY = 'dshw-chip-layout-v4'
     var PANEL_POS_KEY = 'dshw-panel-pos-v1'
@@ -206,7 +206,6 @@ window.__ModuleLoader__.load({
               }
             }
             var bridged = extension.notify(payload)
-            if (bridged && typeof bridged.close === 'function') return bridged
             if (bridged !== false) {
               if (bridged && typeof bridged.then === 'function') {
                 function attachDelegate(delegate) {
@@ -219,6 +218,14 @@ window.__ModuleLoader__.load({
                   if (bridgeHandle.closed && delegate && typeof delegate.close === 'function') delegate.close()
                 }
                 Promise.resolve(bridged).then(attachDelegate).catch(function () { attachDelegate(false) })
+              } else if (bridged && typeof bridged === 'object') {
+                // Always return the wrapper whose onclick/onclose fields the
+                // wallet sets. Desktop bridges are asked to call payload
+                // callbacks; returning the raw native handle here disconnected
+                // those callbacks for synchronous Electron/Tauri adapters.
+                bridgeHandle.delegate = bridged
+                try { bridged.onclick = payload.onClick } catch (e) { /* optional callback */ }
+                try { bridged.onclose = payload.onClose } catch (e) { /* optional callback */ }
               }
               return bridgeHandle
             }
@@ -285,6 +292,18 @@ window.__ModuleLoader__.load({
 
     var compatibility = createCompatibilityAdapter(window)
 
+    function openOfficialRecharge() {
+      var url = 'https://platform.deepseek.com/top_up'
+      var confirmed = false
+      try { confirmed = compatibility.storage.getItem(CONFIRM_KEY) === '1' } catch (e) { /* ignore */ }
+      if (!confirmed) {
+        if (typeof window.confirm !== 'function') return false
+        if (!window.confirm('将打开 DeepSeek 官方充值页：\nplatform.deepseek.com\n\n确认继续？')) return false
+        try { compatibility.storage.setItem(CONFIRM_KEY, '1') } catch (e) { /* ignore */ }
+      }
+      return compatibility.openExternal(url)
+    }
+
     var css = [
       '.dshw_anchor{display:inline-flex;align-items:center;min-height:22px;min-width:0;vertical-align:middle}',
       '.dshw_anchorHome{overflow:hidden;min-width:44px}',
@@ -1140,6 +1159,8 @@ window.__ModuleLoader__.load({
       props = props || {}
       var close = typeof props.close === 'function' ? props.close : null
       var [snapshot, setSnapshot] = React.useState(null)
+      var [health, setHealth] = React.useState(null)
+      var [healthNotice, setHealthNotice] = React.useState(null)
       var [thresholdDraft, setThresholdDraft] = React.useState('')
       var [thresholdNotice, setThresholdNotice] = React.useState(null)
       var [accounts, setAccounts] = React.useState(null)
@@ -1213,8 +1234,14 @@ window.__ModuleLoader__.load({
         }
         refresh()
         fetch('/api/wallet/accounts').then(function (resp) { return resp.json() }).then(function (json) {
-          if (!stopped && json && json.ok) setAccounts(json)
+          if (!stopped && json && json.ok) {
+            setAccounts(json)
+            setAccountsError(json.storage && json.storage.locked ? '账户加密文件无法解密，已锁定写入以保护原数据' : null)
+          }
         }).catch(function () { if (!stopped) setAccountsError('\u8d26\u6237\u63a5\u53e3\u4e0d\u53ef\u7528') })
+        fetch('/api/wallet/health').then(function (resp) { return resp.json() }).then(function (json) {
+          if (!stopped && json && json.ok) setHealth(json)
+        }).catch(function () { if (!stopped) setHealthNotice('健康检查不可用') })
         try {
           var savedLayout = compatibility.storage.getItem(CHIP_LAYOUT_KEY)
           var dock = savedLayout === null ? 'home' : normalizeChipLayout(JSON.parse(savedLayout)).dock
@@ -1223,6 +1250,52 @@ window.__ModuleLoader__.load({
         return function () { stopped = true }
       }, [])
 
+      function refreshHealth() {
+        setHealthNotice('正在检测…')
+        fetch('/api/wallet/health').then(function (resp) { return resp.json() }).then(function (json) {
+          if (json && json.ok) { setHealth(json); setHealthNotice('检测完成') }
+          else setHealthNotice('检测失败')
+        }).catch(function () { setHealthNotice('检测失败') })
+      }
+
+      function refreshPricing() {
+        setHealthNotice('正在同步官方价格…')
+        fetch('/api/wallet/pricing/refresh', { method: 'POST' }).then(function (resp) { return resp.json() }).then(function (json) {
+          if (json && json.ok) {
+            setHealth(function (current) { return current ? Object.assign({}, current, { pricing: json.pricing }) : current })
+            setHealthNotice(json.pricing && json.pricing.status === 'synced' ? '官方价格已同步' : '已保留内置价格，等待复核')
+          } else setHealthNotice('价格同步失败')
+        }).catch(function () { setHealthNotice('价格同步失败') })
+      }
+
+      function copyDiagnostics() {
+        if (!health) return
+        var safe = {
+          plugin: health.plugin,
+          host: health.host,
+          pricing: health.pricing && {
+            status: health.pricing.status,
+            ruleVersion: health.pricing.ruleVersion,
+            checkedAt: health.pricing.checkedAt,
+            modelCount: health.pricing.modelCount,
+          },
+          accounts: health.accounts && {
+            encryptedAtRest: health.accounts.encryptedAtRest,
+            scheme: health.accounts.scheme,
+            status: health.accounts.status,
+          },
+          runtime: health.runtime && { node: health.runtime.node, platform: health.runtime.platform },
+        }
+        var text = JSON.stringify(safe, null, 2)
+        try {
+          if (navigator.clipboard && typeof navigator.clipboard.writeText === 'function') {
+            navigator.clipboard.writeText(text).then(function () { setHealthNotice('诊断信息已复制') }).catch(function () { setHealthNotice('复制失败') })
+            return
+          }
+        } catch (e) { /* fall through to the message */ }
+        setHealthNotice('当前环境不支持自动复制')
+      }
+
       function persistVisibility(next) {
         next = normalizeDataVisibility(next)
         setVisibility(next)
@@ -1313,7 +1386,10 @@ window.__ModuleLoader__.load({
 
       function reloadAccounts() {
         fetch('/api/wallet/accounts').then(function (resp) { return resp.json() }).then(function (json) {
-          if (json && json.ok) { setAccounts(json); setAccountsError(null) }
+          if (json && json.ok) {
+            setAccounts(json)
+            setAccountsError(json.storage && json.storage.locked ? '账户加密文件无法解密，已锁定写入以保护原数据' : null)
+          }
         }).catch(function () { /* ignore */ })
         fetch('/api/wallet/snapshot').then(function (resp) { return resp.json() }).then(function (json) {
           if (json && json.ok) {
@@ -1406,6 +1482,51 @@ window.__ModuleLoader__.load({
           React.createElement('span', { className: 'dshw_balDot' }, '·'),
           React.createElement('span', null, currencyCode))))
 
+      // —— 健康检查 ——
+      var hostHealth = health && health.host ? health.host : null
+      var hostCompatibility = hostHealth && hostHealth.compatibility ? hostHealth.compatibility : null
+      var pricing = health && health.pricing ? health.pricing : null
+      var accountStorage = health && health.accounts ? health.accounts : null
+      var compatibilityText = hostCompatibility
+        ? (hostCompatibility.status === 'compatible' ? '兼容' : hostCompatibility.status === 'upgrade-recommended' ? '建议升级' : '待检测')
+        : '检测中'
+      var pricingText = pricing
+        ? (pricing.status === 'synced'
+          ? '已同步'
+          : pricing.status === 'review-required'
+            ? '待复核'
+            : pricing.status === 'offline'
+              ? (String(pricing.ruleVersion || '').indexOf('official-') === 0 ? '离线，沿用已验证规则' : '离线，使用内置规则')
+              : '内置规则')
+        : '检测中'
+      var storageText = accountStorage
+        ? (accountStorage.status === 'locked'
+          ? '无法解密（已锁定写入）'
+          : accountStorage.status === 'recovered'
+            ? '已从加密备份恢复'
+            : accountStorage.status === 'error'
+              ? '加密存储异常'
+              : accountStorage.scheme === 'windows-dpapi' ? 'Windows DPAPI 加密' : 'AES-GCM 加密')
+        : '检测中'
+      rows.push(React.createElement('div', { key: 'health', className: 'dshw_setCard', style: { display: 'block' } },
+        React.createElement('div', { className: 'dshw_settingsGroupHeader' },
+          React.createElement('div', { className: 'dshw_settingsGroupTitle' }, 'Harness 健康检查'),
+          React.createElement('div', { className: 'dshw_settingsGroupHint' }, healthNotice || '不包含 API Key 或本地路径')),
+        React.createElement('div', { className: 'dshw_settingsHeroMeta' },
+          React.createElement('span', null, 'Harness v' + (hostHealth && hostHealth.version ? hostHealth.version : '未识别')),
+          React.createElement('span', { className: 'dshw_balDot' }, '·'),
+          React.createElement('span', null, '插件 v' + WALLET_VERSION),
+          React.createElement('span', { className: 'dshw_balDot' }, '·'),
+          React.createElement('span', null, '兼容：' + compatibilityText)),
+        React.createElement('div', { className: 'dshw_settingsHeroMeta' },
+          React.createElement('span', null, '价格规则：' + pricingText),
+          React.createElement('span', { className: 'dshw_balDot' }, '·'),
+          React.createElement('span', null, '账户存储：' + storageText)),
+        React.createElement('div', { className: 'dshw_settingsFooterActions', style: { marginTop: '8px' } },
+          React.createElement('button', { type: 'button', className: 'dshw_btn', onClick: refreshHealth }, '重新检测'),
+          React.createElement('button', { type: 'button', className: 'dshw_btn', onClick: refreshPricing }, '同步官方价格'),
+          React.createElement('button', { type: 'button', className: 'dshw_btn', disabled: !health, onClick: copyDiagnostics }, '复制诊断信息'))))
+
       // —— 设置卡 ——
       var cells = []
       cells.push(React.createElement('div', { key: 'vis', className: 'dshw_setCell' },
@@ -1705,7 +1826,7 @@ window.__ModuleLoader__.load({
         }, '刷新余额'),
         React.createElement('button', {
           type: 'button', className: 'dshw_btn dshw_btnPrimary',
-          onClick: function () { if (close) close(); window.open('https://platform.deepseek.com/top_up', '_blank', 'noopener') }
+          onClick: function () { if (close) close(); openOfficialRecharge() }
         }, '↗ 去官方充值'))))
       return React.createElement('div', { className: 'dshw_settingsSection', style: { display: 'flex', flexDirection: 'column', gap: '6px', fontSize: '12px', color: 'var(--dsw-alias-label-primary,inherit)' } }, rows)
     }
@@ -1739,38 +1860,27 @@ window.__ModuleLoader__.load({
         var offsetMinutes = policy && Number.isFinite(policy.offsetMinutes) ? policy.offsetMinutes : 480
         var beijingNow = Number.isFinite(nowMs) ? new Date(nowMs + offsetMinutes * 60000) : null
         var day = beijingNow && Number.isFinite(beijingNow.getTime()) ? beijingNow.getUTCDay() : 6
-        var daysUntilMonday = day === 6 ? 2 : 1
-        var nextSwitchMs = beijingNow && Number.isFinite(beijingNow.getTime())
-          ? Date.UTC(
-            beijingNow.getUTCFullYear(), beijingNow.getUTCMonth(), beijingNow.getUTCDate() + daysUntilMonday,
-            9 - (offsetMinutes / 60), 0, 0, 0
-          ) - offsetMinutes * 60000
-          : NaN
-        var weekendMsLeft = Number.isFinite(nextSwitchMs) && Number.isFinite(nowMs)
-          ? Math.max(0, nextSwitchMs - nowMs)
-          : 0
-        var weekendHours = Math.floor(weekendMsLeft / 3600000)
-        var weekendMinutes = Math.floor((weekendMsLeft % 3600000) / 60000)
-        var weekendLeftText = weekendHours > 0
-          ? weekendHours + ' 小时 ' + weekendMinutes + ' 分'
-          : weekendMinutes + ' 分钟'
-        var weekendLeftShort = weekendHours > 0
-          ? weekendHours + 'h' + (weekendMinutes > 0 ? weekendMinutes + 'm' : '')
-          : weekendMinutes + 'm'
-        var weekendDateKey = beijingNow && Number.isFinite(beijingNow.getTime())
-          ? [beijingNow.getUTCFullYear(), String(beijingNow.getUTCMonth() + 1).padStart(2, '0'), String(beijingNow.getUTCDate()).padStart(2, '0')].join('-')
+        // Friday after 18:00, Saturday, Sunday and Monday before 09:00 are
+        // one continuous off-peak period. Anchor it to Friday so unchanged
+        // pricing does not emit duplicate notifications at each midnight.
+        var weekendAnchor = beijingNow && Number.isFinite(beijingNow.getTime())
+          ? new Date(Date.UTC(beijingNow.getUTCFullYear(), beijingNow.getUTCMonth(), beijingNow.getUTCDate() - (day === 6 ? 1 : 2)))
+          : null
+        var weekendDateKey = weekendAnchor
+          ? [weekendAnchor.getUTCFullYear(), String(weekendAnchor.getUTCMonth() + 1).padStart(2, '0'), String(weekendAnchor.getUTCDate()).padStart(2, '0')].join('-')
           : 'weekend'
         var weekendTzName = policy.timezone || 'Asia/Shanghai'
+        var weekendDayLabel = day === 6 ? '周六' : '周日'
         return {
           configured: true, windows: [], weekendOffPeak: true, inPeak: false,
           nextHour: 9,
-          ariaText: '当前为周末低谷时段，全天按半价计费，周一 09:00 恢复标准价',
-          tip: '峰谷时钟 · 当前周末低谷 · 周一 09:00 恢复标准价 · 还有 ' + weekendLeftText + ' · ' + weekendTzName,
+          ariaText: '当前为' + weekendDayLabel + '低谷时段，全天按半价计费，周一 09:00 恢复标准价',
+          tip: '峰谷时钟 · 当前' + weekendDayLabel + '低谷 · ' + weekendDayLabel + '全天半价 · 周一 09:00 恢复工作日规则 · ' + weekendTzName,
           periodName: '周末低谷', rateBadge: '半价',
-          countdownSummary: '周一 09:00 切换 · 剩 ' + weekendLeftShort,
-          windowSummary: '周末全天低谷 · 工作日高峰 09:00–12:00 / 14:00–18:00',
-          periodId: 'weekend-off-' + weekendDateKey,
-          switchBody: '周末低谷结束，已进入工作日高峰时段，按标准价计费',
+          countdownSummary: weekendDayLabel + '全天低谷',
+          windowSummary: weekendDayLabel + '全天低谷 · 工作日高峰 09:00–12:00 / 14:00–18:00',
+          periodId: 'weekend-chain-' + weekendDateKey,
+          switchBody: '已进入周末低谷，全天按半价计费',
         }
       }
       if (windows.length === 0) {
@@ -1815,8 +1925,24 @@ window.__ModuleLoader__.load({
       var period = inPeak ? '高峰' : '低谷' + rateWord
       var periodName = inPeak ? '高峰时段' : '低谷时段'
       var rateBadge = inPeak ? '标准价' : (rate === 0.5 ? '半价' : '×' + rate)
-      var countdownSummary = hh(nextHour) + ' 切换 · 剩 ' + leftShort
-      var windowSummary = '高峰 ' + winText
+      var offsetMinutesForDay = policy && Number.isFinite(policy.offsetMinutes) ? policy.offsetMinutes : 480
+      var localWallDate = Number.isFinite(nowMs) ? new Date(nowMs + offsetMinutesForDay * 60000) : null
+      var localDay = localWallDate ? localWallDate.getUTCDay() : -1
+      var weekendRuleSince = policy && Number.isFinite(policy.weekendOffPeakSince) ? policy.weekendOffPeakSince : -Infinity
+      var nextLocalMidnightMs = localWallDate
+        ? Date.UTC(localWallDate.getUTCFullYear(), localWallDate.getUTCMonth(), localWallDate.getUTCDate() + 1) - offsetMinutesForDay * 60000
+        : Infinity
+      var currentLocalMidnightMs = localWallDate
+        ? Date.UTC(localWallDate.getUTCFullYear(), localWallDate.getUTCMonth(), localWallDate.getUTCDate()) - offsetMinutesForDay * 60000
+        : Infinity
+      var fridayAfterLastPeak = !inPeak && localDay === 5 && nowHour >= windows[windows.length - 1].endHour && nextLocalMidnightMs >= weekendRuleSince
+      var mondayBeforeFirstPeak = !inPeak && localDay === 1 && nowHour < windows[0].startHour && currentLocalMidnightMs >= weekendRuleSince
+      var countdownSummary = fridayAfterLastPeak
+        ? '周末全天低谷'
+        : mondayBeforeFirstPeak ? ('剩 ' + leftShort + ' 进入高峰') : (hh(nextHour) + ' 切换 · 剩 ' + leftShort)
+      var windowSummary = fridayAfterLastPeak
+        ? '周五 18:00 起低谷 · 周六/周日全天低谷'
+        : '高峰 ' + winText
       // Dual timezone: billing is judged in the policy's base zone; a device
       // elsewhere also sees the local-clock span of the CURRENT segment.
       var localNote = ''
@@ -1834,15 +1960,24 @@ window.__ModuleLoader__.load({
       var ariaText = inPeak
         ? '当前为高峰时段，' + tzName + ' ' + winText + '，按标准价计费'
         : '当前为低谷时段，按平价的 ' + rate + ' 倍计费，' + tzName + ' 高峰 ' + winText
-      var tip = '峰谷时钟 · 当前' + period + ' · ' + switchText + ' · 还有 ' + leftText
-        + ' · 高峰 ' + winText + '（' + tzName + '）' + localNote
+      var tip = fridayAfterLastPeak
+        ? '峰谷时钟 · 当前低谷半价 · 下次高峰：周一 09:00 · ' + tzName + localNote
+        : '峰谷时钟 · 当前' + period + ' · ' + switchText + ' · 还有 ' + leftText
+          + ' · 高峰 ' + winText + '（' + tzName + '）' + localNote
+      var periodId = (inPeak ? 'p' : 'o') + Math.round(segStart * 100)
+      if ((fridayAfterLastPeak || mondayBeforeFirstPeak) && localWallDate) {
+        var chainAnchorDays = mondayBeforeFirstPeak ? 3 : 0
+        var chainAnchor = new Date(Date.UTC(localWallDate.getUTCFullYear(), localWallDate.getUTCMonth(), localWallDate.getUTCDate() - chainAnchorDays))
+        var chainKey = [chainAnchor.getUTCFullYear(), String(chainAnchor.getUTCMonth() + 1).padStart(2, '0'), String(chainAnchor.getUTCDate()).padStart(2, '0')].join('-')
+        periodId = 'weekend-chain-' + chainKey
+      }
       return {
         configured: true, windows: windows, weekendOffPeak: false, inPeak: inPeak,
         nextHour: nextHour, ariaText: ariaText, tip: tip,
         periodName: periodName, rateBadge: rateBadge,
         countdownSummary: countdownSummary, windowSummary: windowSummary,
         // Reminder dedup id: entering this period at this boundary fires once.
-        periodId: (inPeak ? 'p' : 'o') + Math.round(segStart * 100),
+        periodId: periodId,
         switchBody: inPeak ? '已进入高峰时段，按标准价计费' : '已进入低谷时段，按平价的 ' + rate + ' 倍计费',
       }
     }
@@ -2269,7 +2404,7 @@ window.__ModuleLoader__.load({
         onPointerDown: isRail ? undefined : handlePointerDown,
         onClick: function (e) {
           if (isRail) {
-            window.open('https://platform.deepseek.com/top_up', '_blank', 'noopener')
+            openOfficialRecharge()
             return
           }
           if (didDragRef.current !== true) {
@@ -2325,7 +2460,7 @@ window.__ModuleLoader__.load({
               'aria-label': '前往官方充值',
               onClick: function (e) {
                 if (e && typeof e.stopPropagation === 'function') e.stopPropagation()
-                window.open('https://platform.deepseek.com/top_up', '_blank', 'noopener')
+                openOfficialRecharge()
               }
             }, '充值') : null
           )
@@ -2367,7 +2502,7 @@ window.__ModuleLoader__.load({
               type: 'button',
               className: 'dshw_btn dshw_btnPrimary',
               style: { height: '22px', fontSize: '11px', padding: '0 8px' },
-              onClick: function () { window.open('https://platform.deepseek.com/top_up', '_blank', 'noopener') }
+              onClick: function () { openOfficialRecharge() }
             }, '↗ 充值'))),
         React.createElement('div', { className: 'dshw_divider' }),
         React.createElement('div', { className: 'dshw_peakRow' },
@@ -3199,7 +3334,9 @@ window.__ModuleLoader__.load({
         }).then(function (json) {
           if (json && json.ok) {
             setAccounts(json)
-            setAccountsError(null)
+            setAccountsError(json.storage && json.storage.locked
+              ? '账户加密文件无法解密，已锁定写入以保护原数据'
+              : null)
           }
         }).catch(function () {
           setAccountsError('\u8d26\u6237\u5217\u8868\u52a0\u8f7d\u5931\u8d25')

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "deepseek-harness-wallet",
-  "description": "Local-first account monitoring, usage accounting, official recharge, completion reminders, flexible layout, host-gated session controls, and multi-account management with hot account switching for DeepSeek Harness.",
-  "version": "0.2.6",
+  "description": "Local-first DeepSeek Harness control center for balance monitoring, usage accounting, official pricing sync, peak/off-peak status, encrypted multi-account switching, health checks, completion reminders, recharge, and host-gated session controls.",
+  "version": "0.3.1",
   "type": "module",
   "main": "index.js",
   "exports": {