deepseek-harness-wallet 0.3.1 → 0.3.2

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project are documented in this file.
 
+## 0.3.2 - 2026-08-23
+
+- 新增 365 天本地 Token 用量账本与折叠式热力图：按日期、会话、模型和官方/第三方 provider 展示调用次数、Token、缓存命中率与可定价费用。 / Added a 365-day local Token ledger and collapsible heatmap grouped by date, session, model, and official/third-party provider.
+- 稳定的 `(turn, step)` 或请求标识会去重，后到的最终样本替换先前样本；费用在用量发生时锁定，未知价格只保留 Token。 / Stable `(turn, step)` or request identities are deduplicated, later final samples replace earlier ones, and cost is locked at usage time while unknown prices retain tokens only.
+- 历史账本与当前会话清除分开，历史数据只写入本机钱包存储，不保存提示词、工具参数或回答正文；支持独立清除全部历史账本。 / History clearing is separate from current-session clearing; the local store keeps no prompts, tool arguments, or response bodies and exposes an independent clear-history action.
+- 新增 `/api/wallet/history` 与 `/api/wallet/clear-history`，并补充跨平台、价格锁定、去重和 UI 回归测试。 / Added the history endpoints and regression coverage for cross-platform persistence, price locking, deduplication, and the heatmap UI.
+- 提高浅色与深色主题下辅助文字的对比度，覆盖历史说明、统计标签、星期、账户数量、密钥掩码和版本号。 / Raised auxiliary-text contrast in light and dark themes across history labels, weekday markers, account metadata, masked keys, and version text.
+- 重排钱包设置页：账户管理与常态展开的 365 天热力图紧跟余额概览，健康检查和显示/提醒偏好后移；紧凑钱包面板仍可折叠历史区。 / Reordered wallet settings so account management and the always-visible 365-day heatmap follow the balance overview, while compact wallet panels keep the history section collapsible.
+- 全面加固账本准确性：去重键加入 provider/模型，修复清除会话后晚到样本少算、未定价状态无法恢复，并阻止在线价格同步覆盖历史固定价策略。 / Hardened ledger accuracy by isolating dedup keys per provider/model, fixing late replacements after session clearing, recovering unpriced state, and preventing live pricing sync from mutating historical flat-rate policies.
+- 为 `wallet.json` 与 `accounts.json` 补齐主备恢复和失败锁写；Windows DPAPI 与 macOS/Linux AES-GCM 均覆盖损坏密文、权限、无明文和重启读取测试。 / Added primary/backup recovery and fail-closed writes for both stores, with Windows DPAPI and macOS/Linux AES-GCM coverage for corrupt ciphertext, permissions, plaintext exclusion, and reloads.
+- 修复 320–390px 设置页被宿主导航挤压、热力图 resize 后偏离最新日期、365 个空白键盘焦点、异步旧响应覆盖和浅深色强度/对比度问题。当前 110/110 测试通过。 / Fixed narrow settings layout, recent-date tracking across resize, excessive empty keyboard stops, stale async responses, and light/dark heatmap contrast. 110/110 tests pass.
+
 ## 0.3.1 - 2026-08-23
 
 - 修复 Windows DPAPI 账户密钥在重启后无法解密的问题，并在加密文件损坏或密钥不可用时锁定写入，避免覆盖原数据。 / Fixed Windows DPAPI account keys failing to decrypt after restart and locked writes when encrypted data cannot be recovered, preventing accidental overwrite.

package/README.md

@@ -14,7 +14,7 @@
 
 > A local-first companion that keeps account status, per-conversation usage, completion reminders, official recharge, flexible layout, and host-gated session controls beside the DSH composer.
 
-> **Versions:** GitHub `main` is v0.3.1 source; npm and the latest Release remain v0.3.0. Use the GitHub install only for the current source build.
+> **Version:** GitHub `main`, npm, and the latest Release are all v0.3.2.
 
 > If DeepSeek Harness Control Center helps you, please consider leaving a ⭐ Star. Thank you!
 
@@ -28,8 +28,9 @@
 - **Vision model accounting** — `deepseek-v4-flash-vision-exp` is priced like V4 Flash; image tokens reported by the Harness are included with text tokens.
 - **v4 peak/off-peak ring clock** — a resident 24-hour sidebar footer widget for `v4-flash`, `v4-pro`, and `v4-flash-vision-exp`. Weekday peak windows are 09:00–12:00 and 14:00–18:00 Beijing time. After Friday 18:00 the card previews “weekend all-day off-peak”; Saturday and Sunday name the current all-day off-peak rule; Monday before 09:00 shows the time remaining to enter peak. Optional notifications treat Friday 18:00 through Monday 09:00 as one continuous off-peak period.
 - **Official pricing sync** — periodically checks the official DeepSeek pricing page and applies only a fully validated table. Network failures retain the last validated rule (or the built-in rule before the first successful sync); an unrecognized page structure is marked for review instead of silently changing billing.
+- **365-day local usage ledger** — Wallet settings keeps the heatmap visible, while compact wallet panels keep it collapsible. Stable request identities are deduplicated, official cost is locked at usage time, official and third-party data stay separate, and prompts or responses are never stored. Collection begins after upgrading to v0.3.2; older aggregate counters have no trustworthy dates and are not backfilled.
 - **Third-party total** — current-session tokens (input / cache read / output). No balance guessing, no cost math, zero configuration.
-- **Provider classification** — observed wrapper routes appear in the settings page; opted-in routes join the official token/cost bucket and are priced with the official table.
+- **Provider classification** — observed wrapper routes appear in the settings page; opted-in routes join the official token/cost bucket for subsequent calls and are priced with the official table. Existing history is not retroactively reclassified.
 - **Click the chip** to open the detail panel: correctly formatted per-currency balances, cost and token splits, a freely editable low-balance threshold for the active account and currency (two decimals, persisted per account; alerts never mix currencies), manual refresh, and a jump to the official recharge page (first click shows the domain for confirmation — anti-phishing).
 - **Move, dock, and scale** — drag the chip freely, preview nearby snap targets, use compact horizontal or vertical layouts, adjust its scale from the control panel, and show official or third-party data independently. The choices are remembered locally.
 - **Floating window mode** — detach the detail panel into a draggable window with a remembered position, or minimize it directly to a freely movable dot; the dot turns red below the threshold.
@@ -37,14 +38,14 @@
 - **Optional permanent deletion** — when the DSH host advertises a real deletion capability, an opt-in setting enables a confirmed permanent-delete action in the session menu; unsupported hosts keep the control disabled.
 - **Low-balance alert** — below the threshold the chip turns red with a breathing animation and fires one desktop notification; it resets automatically once the balance recovers.
 - **Theme-native UI** — uses DSH `--dsw-alias-*` variables with safe fallback colors, so light and dark themes both render correctly; the panel closes when you click outside and flips open-direction near screen edges.
-- **Clear current-session wallet data** — one button clears only the open conversation's token/cost records; it does not delete the conversation, and every other conversation is untouched.
+- **Clear current-session wallet data** — one button clears only the open conversation's token/cost records; it does not delete the conversation, and every other conversation is untouched. Historical ledger clearing is a separate action.
 
 ## Multi-account
 
 - Open the wallet panel → **Account Management（账户管理）** to add accounts (name + API key), switch the active one, or remove them.
 - The first account added becomes the active account automatically and is synced into the credentials seam.
 - Switching prompts a confirmation because it changes **LLM billing** for subsequent requests: the switch writes the account key into the credentials seam (`credentials.set('DEEPSEEK_API_KEY', ...)`), and since the llm-deepseek provider route resolves that reference per request, the very next LLM call is billed with the new account — no restart needed.
-- Account keys are encrypted at rest in `$DSH_HOME/storages/accounts.json`: Windows uses the current user's DPAPI; other platforms use an owner-only AES-GCM key file. The UI only shows masked keys. Balance lookups prefer the active account's key and fall back to the credentials seam when no account is active.
+- Account keys are encrypted at rest in `$DSH_HOME/storages/accounts.json`: Windows uses the current user's DPAPI; other platforms use an owner-only AES-GCM key file. An encrypted `.bak` recovers a missing, corrupt, or undecryptable primary file; if neither copy can be read, writes are locked instead of overwriting account data. The UI only shows masked keys.
 - Session usage estimates follow the active account's currency: USD-settled accounts show `本约 $x`, converted from the CNY price table at the vendor's long-standing list ratio (not a live FX rate); CNY accounts show `本场 ¥x`. These are local estimates, not an official invoice.
 - If `DEEPSEEK_API_KEY` is supplied by the launching environment, switching is refused with a clear error (the credentials provider rejects shadowed writes) — unset it in your shell to enable switching.
 
@@ -69,13 +70,13 @@ Details: [compatibility](#browser-desktop-and-os-compatibility) · [data and tru
 
 ## Install
 
-From npm (stable v0.3.0):
+From npm (stable v0.3.2):
 
 ```sh
 dsh plugin --profile web add deepseek-harness-wallet
 ```
 
-or from GitHub `main` (current v0.3.1 source):
+or from GitHub `main` (current v0.3.2 source):
 
 ```sh
 dsh plugin --profile web add github:feibi-mochi/deepseek-harness-control-center
@@ -143,8 +144,8 @@ For buildable DSH hosts, the npm package and repository include a versioned [Age
 | --- | --- |
 | Token accounting | Listens to the `llm/stream` event and buckets per session and provider: `deepseek-official` plus explicitly opted-in wrapper routes use the official bucket; other providers stay third-party; each usage event also locks its contemporaneous official price, so multiple sessions and pricing windows never mix. |
 | Balance | The wallet plugin itself sends the active key directly only to the official `/user/balance` endpoint. When multi-account switching is enabled, the selected key is also written into the DSH credentials seam; DSH may then use it for subsequent model requests. |
-| Accounts | Keys live encrypted in `$DSH_HOME/storages/accounts.json`, with an encrypted `accounts.json.bak` fallback that restores a missing primary file. Windows uses current-user DPAPI, so copies normally remain tied to the same Windows user. Other platforms use an owner-only AES-GCM key file; move or back up `accounts.json`, `.bak`, and `.key` together. The UI only shows masked keys, and switching writes the chosen key into the credentials seam for subsequent LLM billing. |
-| Session log | The plugin writes no events; its data lives in `$DSH_HOME/storages/wallet.json`. |
+| Accounts | Keys live encrypted in `$DSH_HOME/storages/accounts.json`, with an encrypted `accounts.json.bak` fallback for a missing, corrupt, or undecryptable primary. Windows uses current-user DPAPI; other platforms use an owner-only AES-GCM key file, so move `accounts.json`, `.bak`, and `.key` together. If neither copy can be read, account writes fail closed. |
+| Usage ledger | Local events live in `$DSH_HOME/storages/wallet.json` with a `wallet.json.bak` recovery copy. Missing/corrupt primaries recover automatically; if neither copy is readable, wallet writes fail closed. Up to 365 days of session/provider/model/token metadata and locked cost are kept—never prompts, tool arguments, or response bodies. |
 | Local settings | Layout, scale, visibility, reminder, and panel settings stay in browser-compatible local storage. |
 | Permanent deletion | Opt-in and host-gated. The wallet never advertises the action unless the host implements the matching session deletion path. |
 | Model surface | No tools registered, no prompt injection, zero token cost. |
@@ -166,7 +167,7 @@ Historical deepseek-chat and deepseek-reasoner records retain their original fla
 
 ## Roadmap
 
-- [ ] 365-day Token heatmap and rebuildable local usage ledger
+- [x] 365-day Token heatmap and rebuildable local usage ledger
 - [ ] Z.ai Coding Plan monitoring, built on a generic provider-adapter contract
 - [ ] Additional provider price/balance adapters only after real-account validation