dsh-client-ui-cpa-quota 0.4.2 → 0.6.0

package/README.md

@@ -180,6 +180,7 @@ Point the plugin's manual instance input at the mock to see a full five-account
 - **Stale numbers?** Numbers refresh on the configured interval; a failed refresh keeps the last good snapshot and says so on the card.
 - **Where are my keys stored?** In this browser's `localStorage` only. Quota requests go straight from the browser to each instance; the DSH host never sees your keys.
 - **Switching browsers?** Use **Export config / Import config** on the card to move instances and keys between browsers. The exported JSON is plaintext — store it carefully.
+- **Tooltip shows every account?** The tooltip filters accounts by what each one actually serves, using CPA's own per-auth model registry first, then the model name and the DSH provider id as fallbacks. Only when a model matches no registry entry and no family signal can it be pinned down does the tooltip list the remaining usable accounts — and it says so when it does.
 
 ## Community
 

package/README.zh.md

@@ -180,6 +180,7 @@ node tests/mock-cpa.mjs     # 可选：在 http://127.0.0.1:8317 起一个假 CP
 - **数字不新鲜？** 按设定间隔自动刷新；刷新失败会保留上次成功数据并在卡片上说明。
 - **密钥存在哪？** 只存当前浏览器的 `localStorage`。额度请求由浏览器直达各实例，DSH 宿主完全接触不到你的密钥。
 - **换浏览器？** 用卡片里的「导出配置 / 导入配置」在浏览器之间迁移实例与密钥。导出的 JSON 是明文，注意保管。
+- **悬浮卡片显示了全部账号？** 卡片按每个账号「实际服务什么模型」过滤，优先读 CPA 的每账号模型注册表（auth-files/models），模型名和 DSH 提供方 id 只作兜底。仅当某个模型在注册表里无记录、且无法从名称判断归属时，才会列出剩余可用账号，并在卡片里注明。
 
 ## 社区
 

package/lib/client.js

@@ -39,6 +39,9 @@ window.__ModuleLoader__.load({
 		const EV_UPDATED = "dsh-cpa-quota:updated";
 		const EV_REFRESH = "dsh-cpa-quota:refresh-requested";
 		const PROBE_TTL = 60 * 60 * 1000;
+		/** Unreachable/unknown verdicts retry on this shorter clock so one
+		 * transient network failure never hides a ring for an hour. */
+		const PROBE_RETRY_TTL = 2 * 60 * 1000;
 		const W5H = 5 * 60 * 60;
 		const W7D = 7 * 24 * 60 * 60;
 		const W28D = 28 * 24 * 60 * 60;
@@ -80,10 +83,13 @@ window.__ModuleLoader__.load({
 			anthropic: "Claude",
 			kimi: "Kimi",
 			qwen: "Qwen",
+			glm: "GLM",
+			deepseek: "DeepSeek",
 			xai: "xAI / Grok",
 			grok: "xAI / Grok",
 			iflow: "iFlow",
 			vertex: "Vertex",
+			interactions: "Interactions API",
 			aistudio: "AI Studio",
 			"openai-compatibility": "OpenAI-compatible",
 			"openai-compatible": "OpenAI-compatible",
@@ -170,6 +176,7 @@ window.__ModuleLoader__.load({
 			if (provider === "anthropic" || provider === "claude-code") return "claude";
 			if (provider === "grok" || provider === "x-ai" || provider === "x.ai") return "xai";
 			if (provider === "gemini-cli" || provider === "gemini") return provider;
+			if (provider === "zai" || provider === "zhipu" || provider === "chatglm") return "glm";
 			return provider;
 		};
 
@@ -457,13 +464,34 @@ window.__ModuleLoader__.load({
 			}
 		}
 
+		/**
+		 * The ChatGPT account id for a Codex auth file. The management API
+		 * exposes `id_token` as an ALREADY-PARSED claims object (not a JWT
+		 * string), and CPA also accepts `tokens.account_id` in newer builds —
+		 * all shapes are handled here.
+		 */
+		function claimsOf(value) {
+			if (value !== null && typeof value === "object" && !Array.isArray(value)) return value;
+			if (typeof value === "string") return jwtClaims(value);
+			return null;
+		}
+
 		function codexAccountId(entry) {
-			const candidates = [entry.id_token, getPath(entry, ["metadata", "id_token"]), getPath(entry, ["attributes", "id_token"])];
+			const direct = firstText(
+				entry.chatgpt_account_id,
+				entry.account_id,
+				getPath(entry, ["tokens", "account_id"]),
+				getPath(entry, ["tokens", "chatgpt_account_id"]),
+				getPath(entry, ["metadata", "account_id"]),
+				getPath(entry, ["attributes", "account_id"]),
+			);
+			if (direct !== "") return direct;
+			const candidates = [entry.id_token, getPath(entry, ["tokens", "id_token"]), getPath(entry, ["metadata", "id_token"]), getPath(entry, ["attributes", "id_token"])];
 			for (const candidate of candidates) {
-				const claims = jwtClaims(candidate);
+				const claims = claimsOf(candidate);
 				if (claims === null) continue;
-				const direct = text(claims.chatgpt_account_id);
-				if (direct !== "") return direct;
+				const directClaim = text(claims.chatgpt_account_id);
+				if (directClaim !== "") return directClaim;
 				const auth = claims["https://api.openai.com/auth"];
 				if (auth !== null && typeof auth === "object") {
 					const nestedId = text(auth.chatgpt_account_id);
@@ -474,8 +502,8 @@ window.__ModuleLoader__.load({
 		}
 
 		function codexPlanFromEntry(entry) {
-			const candidates = [entry.id_token, getPath(entry, ["metadata", "id_token"]), getPath(entry, ["attributes", "id_token"])]
-				.map(jwtClaims)
+			const candidates = [entry.id_token, getPath(entry, ["tokens", "id_token"]), getPath(entry, ["metadata", "id_token"]), getPath(entry, ["attributes", "id_token"])]
+				.map(claimsOf)
 				.filter((claims) => claims !== null);
 			return extractPlan(...candidates);
 		}
@@ -620,8 +648,12 @@ window.__ModuleLoader__.load({
 		 * @returns {'cpa'|'no'|'unknown'|'unreachable'}
 		 */
 		async function probeCpa(base) {
+			// A hung probe never yields a verdict and the ring stays missing, so
+			// bound the request like every other network call.
+			const controller = typeof AbortController === "function" ? new AbortController() : null;
+			const timer = controller === null ? 0 : window.setTimeout(() => controller.abort(), 10_000);
 			try {
-				const response = await fetch(`${base}/v0/management/usage-statistics-enabled`, { method: "GET" });
+				const response = await fetch(`${base}/v0/management/usage-statistics-enabled`, { method: "GET", ...(controller === null ? {} : { signal: controller.signal }) });
 				const body = await response.text();
 				if (response.status === 401) return /management|unauthor/i.test(body) ? "cpa" : "unknown";
 				if (response.status === 404) return "no";
@@ -631,6 +663,8 @@ window.__ModuleLoader__.load({
 				return "unknown";
 			} catch {
 				return "unreachable";
+			} finally {
+				if (timer !== 0) window.clearTimeout(timer);
 			}
 		}
 
@@ -639,9 +673,16 @@ window.__ModuleLoader__.load({
 			const targets = [];
 			for (const [key, info] of providerBases) {
 				const hit = cache[key];
-				if (!force && hit !== undefined && Date.now() - hit.at < PROBE_TTL) {
-					discoveredByKey.set(key, { ...hit, baseURL: info.baseURL });
-					continue;
+				if (!force && hit !== undefined) {
+					// Confirmed verdicts (cpa / a plain 404) keep the long cache; a
+					// transient network failure or ambiguous answer must retry
+					// quickly — caching it for an hour left rings missing after a
+					// single hiccup.
+					const ttl = hit.cpa === true || hit.verdict === "no" ? PROBE_TTL : PROBE_RETRY_TTL;
+					if (Date.now() - hit.at < ttl) {
+						discoveredByKey.set(key, { ...hit, baseURL: info.baseURL });
+						continue;
+					}
 				}
 				targets.push([key, info]);
 			}
@@ -1337,6 +1378,49 @@ window.__ModuleLoader__.load({
 		 * trying it first spares the other accounts a 5-endpoint walk. */
 		const agEndpointByBase = new Map();
 
+		/**
+		 * Per-account served-model registry: CPA exposes the models each auth
+		 * file routes (`GET /v0/management/auth-files/models?name=…`) — the same
+		 * table its own router uses. Cached per account so refreshes stay cheap;
+		 * a failed lookup stays uncached and retries next refresh.
+		 */
+		const ACCOUNT_MODELS_TTL = 10 * 60 * 1000;
+		const accountModelsByKey = new Map();
+
+		async function loadAccountModelList(instance, entry) {
+			// Key by the auth FILE NAME — it is stable across CPA's index
+			// reshuffles; auth_index moves when accounts are added or removed.
+			const name = firstText(entry.name, entry.id);
+			if (name === "") return null;
+			const key = `${baseKey(instance.baseURL)}\u0000${name}`;
+			const hit = accountModelsByKey.get(key);
+			if (hit !== undefined && Date.now() - hit.at < ACCOUNT_MODELS_TTL) return hit.ids;
+			try {
+				const payload = await fetchJSON(`${instance.base}/v0/management/auth-files/models?name=${encodeURIComponent(name)}`, {
+					headers: { Authorization: `Bearer ${instance.managementKey}` },
+				});
+				const rows = Array.isArray(payload?.models) ? payload.models : [];
+				const ids = rows
+					.map((m) => (typeof m === "string" ? text(m) : firstText(m?.id, m?.name, m?.display_name)))
+					.filter((id) => id !== "");
+				const out = ids.length > 0 ? ids : null;
+				if (out !== null) accountModelsByKey.set(key, { at: Date.now(), ids: out });
+				return out;
+			} catch {
+				return null;
+			}
+		}
+
+		/** Loose match between a declared model id and the selected one: exact,
+		 * same series (effort suffixes stripped), or a pure extension either way. */
+		function modelListMatches(listedId, modelId) {
+			const a = text(listedId).toLowerCase();
+			const b = text(modelId).toLowerCase();
+			if (a === "" || b === "") return false;
+			if (a === b || seriesKey(a) === seriesKey(b)) return true;
+			return b.startsWith(`${a}-`) || a.startsWith(`${b}-`);
+		}
+
 		async function queryAccount(instance, entry) {
 			const provider = normalizeProvider(firstText(entry.provider, entry.type));
 			const authIndex = firstText(entry.auth_index, entry.authIndex);
@@ -1345,6 +1429,7 @@ window.__ModuleLoader__.load({
 				name: firstText(entry.label, entry.email, entry.account_email, entry.name, entry.id, authIndex, "unknown"),
 				provider,
 				authIndex,
+				modelList: null,
 				status: firstText(entry.status),
 				statusMessage: firstText(entry.status_message, entry.statusMessage),
 				disabled: boolOf(entry.disabled),
@@ -1354,6 +1439,10 @@ window.__ModuleLoader__.load({
 				windows: [],
 				error: "",
 			};
+			// Which models CPA routes to this account — the authoritative filter
+			// signal. Fetched with the account's own management key; a failure
+			// just means the account falls back to family-name filtering.
+			account.modelList = await loadAccountModelList(instance, entry);
 			const rememberPlan = () => {
 				if (planKey !== "" && account.plan !== "") planByAccountKey.set(planKey, account.plan);
 			};
@@ -1374,21 +1463,21 @@ window.__ModuleLoader__.load({
 			}
 			try {
 				if (provider === "codex") {
+					// No id found is not fatal: some CPA setups bind the account
+					// server-side, so try without the Chatgpt-Account-Id header
+					// and let an upstream rejection surface as the account error.
 					const accountID = codexAccountId(entry);
-					if (accountID === "") {
-						account.error = ZH ? "缺少 chatgpt_account_id" : "missing chatgpt_account_id";
-						return account;
-					}
+					const usageHeaders = {
+						Authorization: "Bearer $TOKEN$",
+						"Content-Type": "application/json",
+						"User-Agent": "codex_cli_rs/0.76.0 (Debian 13.0.0; x86_64) WindowsTerminal",
+					};
+					if (accountID !== "") usageHeaders["Chatgpt-Account-Id"] = accountID;
 					const body = unwrapApiCall(await apiCall(instance, {
 						auth_index: authIndex,
 						method: "GET",
 						url: UPSTREAM.codexUsage,
-						header: {
-							Authorization: "Bearer $TOKEN$",
-							"Content-Type": "application/json",
-							"User-Agent": "codex_cli_rs/0.76.0 (Debian 13.0.0; x86_64) WindowsTerminal",
-							"Chatgpt-Account-Id": accountID,
-						},
+						header: usageHeaders,
 					}));
 					account.windows = parseCodexWindows(body);
 					account.plan = extractPlan(body) || account.plan;
@@ -1613,12 +1702,35 @@ window.__ModuleLoader__.load({
 			if (lower === "") return "";
 			if (/(?:grok|xai)/.test(lower)) return "xai";
 			if (/(?:kimi|moonshot)/.test(lower)) return "kimi";
+			if (/(?:qwen|qwq)/.test(lower)) return "qwen";
+			if (/(?:iflow)/.test(lower)) return "iflow";
+			if (/(?:glm|chatglm|zhipu)/.test(lower)) return "glm";
+			if (/(?:deepseek)/.test(lower)) return "deepseek";
 			if (/(?:gemini|gemma)/.test(lower)) return "gemini";
 			if (/(?:claude|sonnet|opus|haiku|fable)/.test(lower)) return "claude";
 			if (/(?:gpt|openai|codex)/.test(lower) || /(?:^|[-_:/.])o[1-4](?:$|[-_:/.])/.test(lower)) return "gpt";
 			return "";
 		}
 
+		/**
+		 * Second signal for the account filter: the DSH provider id that serves
+		 * the model. Custom route names ("team-claude", "fast-tier") reveal
+		 * nothing on their own, but the provider usually does.
+		 */
+		function providerFamilyFromId(providerId) {
+			const p = text(providerId).toLowerCase();
+			if (/(?:anthropic|claude)/.test(p)) return "claude";
+			if (/(?:gemini)/.test(p)) return "gemini";
+			if (/(?:codex|openai|gpt)/.test(p)) return "gpt";
+			if (/(?:kimi|moonshot)/.test(p)) return "kimi";
+			if (/(?:grok|xai)/.test(p)) return "xai";
+			if (/(?:qwen)/.test(p)) return "qwen";
+			if (/(?:iflow)/.test(p)) return "iflow";
+			if (/(?:deepseek)/.test(p)) return "deepseek";
+			if (/(?:glm|zai|zhipu)/.test(p)) return "glm";
+			return "";
+		}
+
 		function modelSpecificWindows(account, modelId) {
 			const lower = text(modelId).toLowerCase();
 			if (lower === "") return [];
@@ -1648,25 +1760,58 @@ window.__ModuleLoader__.load({
 				case "openai": return family === "gpt";
 				case "kimi": return family === "kimi";
 				case "xai": return family === "xai";
+				case "qwen": return family === "qwen";
+				case "iflow": return family === "iflow";
+				case "glm": return family === "glm";
+				case "deepseek": return family === "deepseek";
+				case "vertex": return family === "gemini" || family === "claude";
+				case "interactions": return ["gemini", "claude", "gpt"].includes(family);
 				default: return false;
 			}
 		}
 
-		/** Accounts whose provider/model rows match the selected model. */
-		function accountsForModel(accounts, modelId) {
+		/**
+		 * Accounts whose served models match the selected one, in three tiers:
+		 * 1. accounts that DECLARE their model list (CPA's per-auth routing
+		 *    registry) and list this model — authoritative, wins outright, and
+		 *    a declared list without the model excludes that account from every
+		 *    fallback below;
+		 * 2. family heuristics over the remaining accounts — the model name
+		 *    first, then the DSH provider id that serves it;
+		 * 3. when no family can be determined, CPA's routing decision is
+		 *    unknowable from the client — every usable account is listed and
+		 *    the tooltip says why.
+		 */
+		function accountsForModel(accounts, modelId, providerHint = "") {
 			if (!Array.isArray(accounts)) return [];
-			const family = modelFamily(modelId);
-			if (text(modelId) === "" || family === "") return accounts;
-			const specific = accounts.filter((account) => modelSpecificWindows(account, modelId).length > 0);
-			if (specific.length > 0) return specific;
-		return accounts.filter((account) => {
-			if (!providerMatchesFamily(account.provider, family)) return false;
-			const rows = Array.isArray(account.windows) ? account.windows : [];
-			// An account with model/prefix-tagged rows for another family must not
-			// fall through as a generic provider account for this model.
-			const hasTaggedRows = rows.some((row) => row.modelId !== null || Array.isArray(row.modelIds) || Array.isArray(row.prefixes));
-			return !hasTaggedRows;
-		});
+			if (text(modelId) === "") return accounts;
+			let family = modelFamily(modelId);
+			if (family === "") family = providerFamilyFromId(providerHint);
+
+			const listed = accounts.filter((account) => Array.isArray(account.modelList) && account.modelList.length > 0);
+			const exact = listed.filter((account) => account.modelList.some((id) => modelListMatches(id, modelId)));
+			if (exact.length > 0) return exact;
+			const unlisted = accounts.filter((account) => !(Array.isArray(account.modelList) && account.modelList.length > 0));
+			const usable = (list) => list.filter((account) => !account.disabled && !account.unavailable);
+
+			if (family === "") return usable(unlisted);
+			// Cross-channel models (Claude served by both Antigravity and Claude
+			// OAuth, for example) are load-balanced by CPA between the channels,
+			// so specific-window accounts and generic family matches union — the
+			// provider badge tells the user which channel each account is on.
+			const specific = usable(unlisted).filter((account) => modelSpecificWindows(account, modelId).length > 0);
+			const generic = usable(unlisted).filter((account) => {
+				if (!providerMatchesFamily(account.provider, family)) return false;
+				const rows = Array.isArray(account.windows) ? account.windows : [];
+				// An account with model/prefix-tagged rows for another family must not
+				// fall through as a generic provider account for this model.
+				const hasTaggedRows = rows.some((row) => row.modelId !== null || Array.isArray(row.modelIds) || Array.isArray(row.prefixes));
+				return !hasTaggedRows;
+			});
+			if (specific.length > 0 || generic.length > 0) return [...specific, ...generic];
+			// Family known but nothing serves it: the honest answer is "no
+			// matching account", not a list of guesses.
+			return [];
 		}
 
 		function modelRowsForAccount(account, modelId) {
@@ -1728,12 +1873,12 @@ window.__ModuleLoader__.load({
 			});
 		}
 
-		/** Ring level for one instance given the current model. */
-		function levelFor(state, modelId) {
-			if (state === undefined) return { level: "pending", remaining: null };
-			if (state.state === "nokey") return { level: "pending", remaining: null };
-			if (state.state === "error") return { level: "error", remaining: null };
-			const matchingAccounts = accountsForModel(state.accounts, modelId);
+			/** Ring level for one instance given the current model. */
+			function levelFor(state, modelId, providerHint = "") {
+				if (state === undefined) return { level: "pending", remaining: null };
+				if (state.state === "nokey") return { level: "pending", remaining: null };
+				if (state.state === "error") return { level: "error", remaining: null };
+				const matchingAccounts = accountsForModel(state.accounts, modelId, providerHint);
 			const rows = [];
 			for (const account of matchingAccounts) {
 				if (account.disabled || account.unavailable) continue;
@@ -2464,6 +2609,7 @@ body[data-ds-dark-theme] .cpa-q-select{color-scheme:dark}
 			function showTooltip(dot) {
 				const key = dot.getAttribute("data-cpa-base") ?? "";
 				const modelId = dot.getAttribute("data-cpa-model") ?? "";
+				const providerHint = dot.getAttribute("data-cpa-provider") ?? "";
 				const instance = instanceByKey.get(key);
 				const state = quotaByKey.get(key);
 				if (instance === undefined) return;
@@ -2515,12 +2661,17 @@ body[data-ds-dark-theme] .cpa-q-select{color-scheme:dark}
 				} else if (state.accounts.length === 0) {
 					tip.appendChild(el("div", "cpa-q-row", ZH ? "该实例没有账号（auth-files 为空）" : "no auth files on this instance"));
 				} else {
-					const matchingAccounts = accountsForModel(state.accounts, modelId);
-					if (matchingAccounts.length === 0) {
-						tip.appendChild(el("div", "cpa-q-row", ZH ? "该模型没有匹配的厂商额度" : "no matching provider quota for this model"));
-					} else {
-						for (const account of matchingAccounts) tip.appendChild(accountSection(account, modelId));
-					}
+					const matchingAccounts = accountsForModel(state.accounts, modelId, providerHint);
+						if (matchingAccounts.length === 0) {
+							tip.appendChild(el("div", "cpa-q-row", ZH ? "该模型没有匹配的厂商额度" : "no matching provider quota for this model"));
+						} else {
+							if (modelFamily(modelId) === "" && providerFamilyFromId(providerHint) === "") {
+								tip.appendChild(el("div", "cpa-q-hint", ZH
+									? "无法从模型名识别账号归属，以下为该实例全部可用账号"
+									: "model family unknown — listing every usable account on this instance"));
+							}
+							for (const account of matchingAccounts) tip.appendChild(accountSection(account, modelId));
+						}
 					if (state.stale && state.lastError) {
 						const hint = el("div", "cpa-q-hint");
 						hint.textContent = ZH ? "暂时无法刷新，显示上次成功数据" : "refresh temporarily unavailable; showing the last good snapshot";
@@ -2612,7 +2763,7 @@ body[data-ds-dark-theme] .cpa-q-select{color-scheme:dark}
 			function applyDotState(ring) {
 				const key = ring.getAttribute("data-cpa-base") ?? "";
 				const modelId = ring.getAttribute("data-cpa-model") ?? "";
-				const agg = levelFor(quotaByKey.get(key), modelId);
+				const agg = levelFor(quotaByKey.get(key), modelId, ring.getAttribute("data-cpa-provider") ?? "");
 				ring.setAttribute("data-cpa-level", agg.level);
 				const arc = ring.querySelector(".cpa-q-arc");
 				if (arc !== null) {
@@ -2805,9 +2956,11 @@ body[data-ds-dark-theme] .cpa-q-select{color-scheme:dark}
 					if (ring.getAttribute("data-cpa-model") !== modelId) {
 						ring.setAttribute("data-cpa-model", modelId);
 						ring.setAttribute("data-cpa-base", key);
+						ring.setAttribute("data-cpa-provider", model.providerId ?? "");
 						if (tipAnchor === ring) showTooltip(ring);
 					}
 					ring.setAttribute("data-cpa-base", key);
+					ring.setAttribute("data-cpa-provider", model.providerId ?? "");
 					placeRing(ring, button);
 					applyDotState(ring);
 				}
@@ -2890,8 +3043,10 @@ body[data-ds-dark-theme] .cpa-q-select{color-scheme:dark}
 				styleTag.remove();
 
 				quotaByKey.clear();
-				planByAccountKey.clear();
-				discoveredByKey.clear();
+					planByAccountKey.clear();
+					discoveredByKey.clear();
+					accountModelsByKey.clear();
+					agEndpointByBase.clear();
 			}, "ui-cpa-quota: dot, tooltip, card, observer, timers");
 		}
 		//#endregion

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-client-ui-cpa-quota",
   "description": "CliProxyAPI quota indicator: a native-styled ring left of the composer model name; hover shows per-account provider quotas, subscription plans, and status for Codex, Claude, Antigravity, Gemini CLI, Kimi, xAI/Grok, and other CPA auth providers. Targets the current dsh plugin contract (settings-namespace-keyed plugin cards).",
-  "version": "0.4.2",
+  "version": "0.6.0",
   "author": "wkscc310",
   "repository": {
     "type": "git",