dsh-connect-minimaxcode 0.5.6 → 0.5.7

package/README.en.md

@@ -308,6 +308,14 @@ The OAuth token is valid for about an hour and is refreshed automatically by the
 
 ## Changelog
 
+### 0.5.7 (2026-11-10)
+
+- **The quota readout now uses the open platform's documented endpoint**: the plugin read `/backend/account/token_plan/remains_percent`, and that path now answers every account with an empty `success` — it no longer even carries a `model_remains` field — so the readout showed nothing for anyone and said nothing about why. It now reads `GET /v1/token_plan/remains`, the endpoint the open platform's own M Plan documentation names. That endpoint asks for the **open platform's API key** rather than the OAuth bearer; the key comes from the `token_plan_credit` response and is remembered between reads.
+- **"No subscription" is no longer reported as a failed read**: upstream answers an account without an M Plan subscription with `2062 no active token plan subscription` — credit packages carry no rolling windows of their own. The plugin now reports that as what it is. The balance, the check-in and the model calls are untouched by it.
+- The older path is kept as a **fallback**: an account whose open platform hands out no key still gets whatever the old path can give.
+- Fixed a misfire that came with it: the quota endpoint is asked with the open platform's plan key, so a 401 there means the *key* is wrong, not that the person's credential was revoked. It used to feed the "was this credential revoked" check, which could sign someone out over a bad key. That check now reads only the account-domain endpoints (membership and credit ledger).
+- Added `tests/quota-endpoint.spec.ts` (13 cases) pinning: how the plan key is obtained, the documented endpoint being asked with the key rather than the OAuth bearer, `2062` counted as "no subscription" rather than an error, the fallback to the older path when there is no key, and the key being fetched once. All 209 cases pass.
+
 ### 0.5.6 (2026-11-09)
 
 - **Fixed "every model request fails while credits and check-in still work"**: the two features read two different credential files. The model gateway only knew the plugin's own sign-in and the **legacy JWT** an older desktop app left behind (`local-runtime.auth.json`), while current installs store an OAuth grant instead (`auth/prod/<region>/mcode-public/auth.json`, an `mmoat_` token). Once the legacy JWT expired, the gateway answered every request with `401 auth failed` — and because credits read the OAuth file, the card showed a healthy balance beside a dead model. The gateway now tries, in order: the plugin's own sign-in → **the desktop app's OAuth grant** → the legacy JWT, taking the first that works.

package/README.md

@@ -3,7 +3,7 @@
 把本机已登录的 **MiniMax Code 桌面 App（国内版）** 的模型接入 **DeepSeek Harness（DSH）**，装好即用，无需配置 API Key。
 
 ![license](https://img.shields.io/badge/license-MIT-blue.svg)
-[![version](https://img.shields.io/npm/v/dsh-connect-minimaxcode?color=cb3837)](https://www.npmjs.com/package/dsh-connect-minimaxcode)
+[![version](https://img.shields.io/npm/v/dsh-connect-minimaxcode?color=cb3837)](https://www.npmjs.com/package/dsh-connect-minimaxcode)
 [![CI](https://github.com/JeffTsuiCUG/dsh-connect-minimaxcode/actions/workflows/ci.yml/badge.svg)](https://github.com/JeffTsuiCUG/dsh-connect-minimaxcode/actions/workflows/ci.yml)
 
 [English](README.en.md) | 简体中文
@@ -291,13 +291,17 @@ GET https://agent.minimax.cn/minimax-cloud/api/v1/credit/details?page_number=1&p
 
 ### 限额窗口（套餐的两个滚动窗口）
 
-套餐用量按两个滚动窗口计量（当前套餐为 5 小时与 7 天），插件会显示各窗口的已用百分比与重置倒计时：
+套餐用量按两个滚动窗口计量（当前套餐为 5 小时与 7 天），插件会显示各窗口的已用百分比与重置倒计时。
+
+读取走**开放平台官方文档给出的接口**（M Plan 用量说明页「如何查看 M Plan 用量 → 方式三：使用 API 接口查询」）：
 
 ```
-GET https://www.minimaxi.com/backend/account/token_plan/remains_percent?business=Agent&device_platform=desktop
-Authorization: Bearer <OAuth 令牌>
+GET https://www.minimaxi.com/v1/token_plan/remains
+Authorization: Bearer <API Key>
 ```
 
+该接口要的是**开放平台的 API 密钥**，不是 OAuth 令牌。密钥由账户自己持有，取法与桌面 App 相同 —— 用 OAuth 令牌请求 `GET /backend/account/token_plan_credit?business=Agent&device_platform=desktop`，响应里的 `api_key` 就是它。
+
 ```json
 "model_remains": [{
   "model_name": "general",
@@ -312,7 +316,7 @@ Authorization: Bearer <OAuth 令牌>
 
 - **窗口时长不写死**：从响应自身的起止字段推导（实测恰为 5 小时与 7 天），套餐条款变了显示会跟着变 —— 胶囊与详情行上的窗口名（`5h`、`7d`）也是这么来的，不是写死的字面量
 - **无限量的窗口不报百分比**：上游用 `current_*_status` 标出没有额度的窗口（桌面 App 读作 `isUnlimited: 3 === status`），这类窗口不参与显示，避免出现「0%」这种没人能据此行动的读数
-- **该接口在开放平台域**（`www.minimaxi.com`），只认 OAuth 令牌；JWT 打它返回 `1016 invalid api key`
+- **没有订阅就没有窗口，且这不算错误**：上游对未订阅 M Plan 的账户明确回 `2062 no active token plan subscription`，插件会如实标为「无订阅」而不是「读取失败」—— 积分包本身不带滚动窗口
 - **接口异常时其余显示不受影响**：限额读不到，胶囊与卡片仍显示余额、签到与本机用量
 - 上游还发 `current_*_count` 计数字段（无计数制时为 `-1`），插件只读百分比与起止时刻
 ### 关于续期
@@ -340,6 +344,14 @@ OAuth 令牌有效期约 1 小时，由客户端自动续期。插件**只在自
 
 ## 更新记录
 
+### 0.5.7（2026-11-10）
+
+- **限额窗口改走官方文档接口**：原先读的是 `/backend/account/token_plan/remains_percent`，这条路径现在对任何账户都只回一个空的 `success`（连 `model_remains` 字段都没有），于是限额一栏对所有人都显示不出来，却看不出原因。改用开放平台官方文档（M Plan 用量说明页）给出的 `GET /v1/token_plan/remains`。新接口要求**开放平台 API 密钥**而非 OAuth 令牌，密钥取自 `token_plan_credit` 的响应并缓存复用。
+- **「没有订阅」不再被报成「读取失败」**：上游对未订阅 M Plan 的账户明确回 `2062 no active token plan subscription` —— 积分包本身不带 5 小时 / 周滚动窗口。插件现在把这种情况标为「无订阅」，余额、签到与模型调用不受任何影响。
+- 旧路径保留为**兜底**：账户若拿不到开放平台密钥，仍走旧路径，不会因此彻底没有限额显示。
+- 顺带修正一处误伤可能：限额接口是拿开放平台密钥问的，它回 401 说明的是密钥不对，**不是本人凭据被吊销**；此前它参与「凭据是否被吊销」的判断，可能把人误登出。现在该判断只看账户域接口（会员信息与积分流水）的 401。
+- 新增 `tests/quota-endpoint.spec.ts`（13 个用例）钉住：计划密钥的取法、官方接口用密钥而非 OAuth 令牌请求、`2062` 归为「无订阅」而非错误、无密钥时回落旧路径、密钥只取一次。全量 209 个用例通过。
+
 ### 0.5.6（2026-11-09）
 
 - **修复「模型请求全部失败，但积分/签到正常」**：这是两条凭证路径读的不是同一个文件。模型网关此前只认插件自登录与桌面 App 留下的**旧版 JWT**（`local-runtime.auth.json`），而新版 App 早已改用 OAuth 存储（`auth/prod/<region>/mcode-public/auth.json`，`mmoat_` 令牌）。旧 JWT 过期后网关一律回 `401 auth failed`，而积分走的是 OAuth 文件，于是出现「积分能看、模型不通」。现在网关依次尝试：插件自登录 → **桌面 App 的 OAuth 授权** → 旧版 JWT，三者取第一个可用的。

package/lib/index.d.ts

@@ -208,7 +208,12 @@ declare class MinimaxCatalog {
 declare const MINIMAX_OAUTH_CLIENT_ID = "mcode-public";
 /** Membership endpoint: carries the credit summary. */
 declare const MEMBERSHIP_PATH = "/matrix/api/v1/commerce/get_membership_info";
-/** Rate-limit window endpoint: the 5-hour and weekly usage the plan meters. */
+/**
+ * Rate-limit window endpoint the plugin used first.
+ *
+ * Kept as a fallback for an account whose open platform hands out no plan
+ * key, since the documented path needs one.
+ */
 declare const REMAINS_PERCENT_PATH = "/backend/account/token_plan/remains_percent";
 /** The OAuth credential the account endpoints accept. */
 interface OAuthCredential {
@@ -371,7 +376,7 @@ interface RateLimitWindows {
  */
 declare function parseRateLimitWindows(document: unknown): RateLimitWindows | undefined;
 /**
- * Fetch the plan's two rate-limit windows.
+ * Fetch the plan's two rate-limit windows from the older open-platform path.
  *
  * The endpoint lives on the open-platform host, like the usage summary, and
  * answers the same OAuth credential the membership endpoint takes. The JWT the
@@ -380,6 +385,15 @@ declare function parseRateLimitWindows(document: unknown): RateLimitWindows | un
  * @returns The windows, or `undefined` when the response carries none.
  */
 declare function fetchRateLimitWindows(credential: OAuthCredential, region: MinimaxRegion, fetchImpl?: typeof fetch): Promise<RateLimitWindows | undefined>;
+/** What a quota read found. */
+interface RateLimitRead {
+  /** The windows, when the plan meters any. */
+  windows?: RateLimitWindows;
+  /** Why there are none, when the upstream said so plainly. */
+  absence?: 'no-subscription';
+  /** Why the read failed, when it did. */
+  error?: string;
+}
 /** What the lots say about credits that are about to be lost. */
 interface ExpirySummary {
   /** Credits in lots that expire within {@link EXPIRING_WINDOW_DAYS} days. */
@@ -422,6 +436,8 @@ declare class MinimaxCredits {
   get rateLimit(): RateLimitWindows | undefined;
   /** Why the windows could not be read, when they could not. */
   get rateLimitError(): string | undefined;
+  /** Why the plan has no windows, when the upstream said so plainly. */
+  get rateLimitAbsence(): 'no-subscription' | undefined;
   /** When the windows were last read. */
   get rateLimitAtMs(): number | undefined;
   /**
@@ -451,6 +467,15 @@ declare class MinimaxCredits {
    * window that cannot be read leaves the last one on display.
    */
   refreshRateLimit(credential: OAuthCredential, region: MinimaxRegion, fetchImpl?: typeof fetch, now?: number): Promise<void>;
+  /**
+   * Read the windows from whichever endpoint can answer.
+   *
+   * The documented endpoint needs the open platform's plan key, which the
+   * same platform hands out; the key is remembered because it does not
+   * change from one read to the next. An account with no key at all still
+   * gets the older path's answer.
+   */
+  readWindows(credential: OAuthCredential, region: MinimaxRegion, fetchImpl?: typeof fetch): Promise<RateLimitRead>;
 }
 //#endregion
 //#region src/usage.d.ts
@@ -910,6 +935,8 @@ interface RateLimitStatus {
   };
   /** When the windows were read, in milliseconds since the epoch. */
   updatedAtMs?: number;
+  /** Why the plan has no windows, when the upstream said so plainly. */
+  reason?: 'no-subscription';
   /** Why the windows could not be read. */
   error?: string;
 }

package/lib/index.js

@@ -793,7 +793,24 @@ const MINIMAX_OPEN_HOSTS = {
 const MEMBERSHIP_PATH = "/matrix/api/v1/commerce/get_membership_info";
 /** Credit ledger endpoint: per-grant amounts and expiry. */
 const CREDIT_DETAILS_PATH = "/minimax-cloud/api/v1/credit/details";
-/** Rate-limit window endpoint: the 5-hour and weekly usage the plan meters. */
+/** Open-platform credit endpoint that carries the account's plan key. */
+const TOKEN_PLAN_CREDIT_PATH = "/backend/account/token_plan_credit";
+/**
+* Rate-limit window endpoint, as the open platform documents it.
+*
+* The M Plan FAQ names `GET /v1/token_plan/remains` as the way to read the
+* quota over HTTP. It asks for an API secret key rather than the desktop
+* app's OAuth bearer, and it is the path the upstream still maintains: the
+* older path this plugin started with now answers 200 with an empty body
+* even for accounts that do have windows.
+*/
+const TOKEN_PLAN_REMAINS_PATH = "/v1/token_plan/remains";
+/**
+* Rate-limit window endpoint the plugin used first.
+*
+* Kept as a fallback for an account whose open platform hands out no plan
+* key, since the documented path needs one.
+*/
 const REMAINS_PERCENT_PATH = "/backend/account/token_plan/remains_percent";
 /** OAuth token endpoint. */
 const TOKEN_PATH$1 = "/oauth2/token";
@@ -1160,7 +1177,7 @@ function parsePercent(value) {
 	return Number.isFinite(parsed) ? parsed : void 0;
 }
 /**
-* Fetch the plan's two rate-limit windows.
+* Fetch the plan's two rate-limit windows from the older open-platform path.
 *
 * The endpoint lives on the open-platform host, like the usage summary, and
 * answers the same OAuth credential the membership endpoint takes. The JWT the
@@ -1177,6 +1194,61 @@ async function fetchRateLimitWindows(credential, region, fetchImpl = fetch) {
 	return parseRateLimitWindows(await response.json());
 }
 /**
+* Read the open platform's plan key.
+*
+* The documented quota endpoint wants an API secret key, and the open
+* platform is where the account's key comes from: the desktop app asks the
+* same endpoint with its OAuth bearer and gets the key back in the answer,
+* so the key is a property of the account rather than something the person
+* has to configure.
+*
+* @returns The key, or `undefined` when the account has none.
+*/
+async function fetchTokenPlanApiKey(credential, region, fetchImpl = fetch) {
+	const response = await fetchImpl(`${MINIMAX_OPEN_HOSTS[region]}${TOKEN_PLAN_CREDIT_PATH}?business=Agent&device_platform=desktop`, { headers: {
+		accept: "application/json",
+		authorization: `Bearer ${credential.token}`
+	} });
+	if (!response.ok) throw new Error(`token plan credit request failed: HTTP ${response.status}`);
+	const key = (await response.json()).api_key;
+	return typeof key === "string" && key.length > 0 ? key : void 0;
+}
+/** The upstream's own code for "this account has no plan subscription". */
+const NO_SUBSCRIPTION_CODE = 2062;
+/** The upstream's own code for "the request carried no usable API key". */
+const MISSING_API_KEY_CODE = 1004;
+/** The upstream's status code inside a response body, when it carries one. */
+function readBaseRespCode(document) {
+	const base = document.base_resp;
+	if (typeof base !== "object" || base === null) return void 0;
+	const code = base.status_code;
+	return typeof code === "number" ? code : void 0;
+}
+/**
+* Read the windows from the documented quota endpoint.
+*
+* The upstream says plainly when there is nothing to report: `2062` means
+* the account has no plan subscription, and the quota does not exist for it
+* at all. That is a fact about the plan rather than a failure to read, so
+* it is reported as such and not as an error — the windows of a plan the
+* account does not hold are not missing data.
+*/
+async function fetchTokenPlanWindows(apiKey, region, fetchImpl = fetch) {
+	const response = await fetchImpl(`${MINIMAX_OPEN_HOSTS[region]}${TOKEN_PLAN_REMAINS_PATH}`, { headers: {
+		accept: "application/json",
+		authorization: `Bearer ${apiKey}`,
+		"content-type": "application/json"
+	} });
+	if (!response.ok) throw new Error(`rate-limit window request failed: HTTP ${response.status}`);
+	const document = await response.json();
+	const code = readBaseRespCode(document);
+	if (code === NO_SUBSCRIPTION_CODE) return { absence: "no-subscription" };
+	if (code === MISSING_API_KEY_CODE) return { error: "the open platform did not accept the plan key" };
+	const windows = parseRateLimitWindows(document);
+	if (windows === void 0) return { error: "response carried no rate-limit windows" };
+	return { windows };
+}
+/**
 * Summarize what is about to expire.
 *
 * Only lots that still hold credits count: a lot that was granted and used up
@@ -1215,7 +1287,9 @@ var MinimaxCredits = class {
 	#ledgerError;
 	#rateLimit;
 	#rateLimitError;
+	#rateLimitAbsence;
 	#rateLimitAtMs;
+	#apiKey;
 	/** The balance as last read. */
 	get snapshot() {
 		return this.#snapshot;
@@ -1248,6 +1322,10 @@ var MinimaxCredits = class {
 	get rateLimitError() {
 		return this.#rateLimitError;
 	}
+	/** Why the plan has no windows, when the upstream said so plainly. */
+	get rateLimitAbsence() {
+		return this.#rateLimitAbsence;
+	}
 	/** When the windows were last read. */
 	get rateLimitAtMs() {
 		return this.#rateLimitAtMs;
@@ -1311,14 +1389,36 @@ var MinimaxCredits = class {
 	*/
 	async refreshRateLimit(credential, region, fetchImpl = fetch, now = Date.now()) {
 		try {
-			const windows = await fetchRateLimitWindows(credential, region, fetchImpl);
-			this.#rateLimit = windows;
-			this.#rateLimitError = windows === void 0 ? "response carried no rate-limit windows" : void 0;
+			const read = await this.readWindows(credential, region, fetchImpl);
+			if (read.error === void 0) this.#rateLimit = read.windows;
+			this.#rateLimitAbsence = read.absence;
+			this.#rateLimitError = read.error;
 			this.#rateLimitAtMs = now;
 		} catch (error) {
 			this.#rateLimitError = error instanceof Error ? error.message : String(error);
 		}
 	}
+	/**
+	* Read the windows from whichever endpoint can answer.
+	*
+	* The documented endpoint needs the open platform's plan key, which the
+	* same platform hands out; the key is remembered because it does not
+	* change from one read to the next. An account with no key at all still
+	* gets the older path's answer.
+	*/
+	async readWindows(credential, region, fetchImpl = fetch) {
+		const apiKey = this.#apiKey ?? await fetchTokenPlanApiKey(credential, region, fetchImpl);
+		this.#apiKey = apiKey;
+		if (apiKey !== void 0) try {
+			return await fetchTokenPlanWindows(apiKey, region, fetchImpl);
+		} catch (error) {
+			const legacy = await fetchRateLimitWindows(credential, region, fetchImpl);
+			if (legacy !== void 0) return { windows: legacy };
+			throw error;
+		}
+		const legacy = await fetchRateLimitWindows(credential, region, fetchImpl);
+		return legacy === void 0 ? { error: "response carried no rate-limit windows" } : { windows: legacy };
+	}
 };
 //#endregion
 //#region src/credentials.ts
@@ -2271,11 +2371,7 @@ function apply(ctx) {
 		}
 		await credits.refresh(state.credential, region, fetch, now);
 		creditState = credits.snapshot === void 0 ? "unavailable" : "ok";
-		if ([
-			credits.error,
-			credits.ledgerError,
-			credits.rateLimitError
-		].find((message) => isUnauthorized(message)) !== void 0) {
+		if ([credits.error, credits.ledgerError].find((message) => isUnauthorized(message)) !== void 0) {
 			await revokePluginCredential();
 			return;
 		}
@@ -2382,6 +2478,7 @@ function apply(ctx) {
 		const windows = credits.rateLimit;
 		if (windows === void 0) return {
 			state: "unavailable",
+			...credits.rateLimitAbsence === void 0 ? {} : { reason: credits.rateLimitAbsence },
 			...credits.rateLimitError === void 0 ? {} : { error: credits.rateLimitError }
 		};
 		return {

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-minimaxcode",
   "displayName": "DSH Connect MiniMax Code",
   "description": "把本机已登录的 MiniMax Code 桌面 App 模型接入 DeepSeek Harness：零配置、Anthropic Messages 兼容、动态模型目录，并显示积分余额与到期 — bring MiniMax Code desktop app models into DSH with a dynamic model catalog and a credit balance with expiry details.",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "author": "JeffTsuiCUG",
   "contributors": [
     {