dsh-cost-meter 1.7.21 → 1.7.23

package/lib/native-search-billing.js

@@ -9,16 +9,9 @@ import { randomUUID } from 'node:crypto'
 import { readFileSync, writeFileSync, renameSync, mkdirSync, statSync } from 'node:fs'
 import { dirname } from 'node:path'
 import { gunzipSync, inflateSync, brotliDecompressSync } from 'node:zlib'
+import { recordNativeSearchUsage } from './native-search-history.js'
+export { NATIVE_SEARCH_USAGE_EVENT, isNativeSearchUsageEvent } from './native-search-events.js'
 
-export const NATIVE_SEARCH_USAGE_EVENT = 'cost-meter/native-search-usage'
-export function isNativeSearchUsageEvent(event) {
-  const data = event?.data
-  return event?.type === NATIVE_SEARCH_USAGE_EVENT && data?.provider === 'deepseek-official'
-    && typeof data.model === 'string' && /^deepseek-[a-z\d._:-]{1,120}$/i.test(data.model)
-    && typeof data.requestId === 'string' && /^[a-f\d]{8}(?:-[a-f\d]{4}){3}-[a-f\d]{12}$/i.test(data.requestId)
-    && Number.isFinite(data.startedAtMs) && data.startedAtMs > 0
-    && ['inputTokens', 'outputTokens', 'cacheReadTokens', 'cacheWriteTokens', 'reasoningTokens'].every(key => Number.isSafeInteger(data.usage?.[key]) && data.usage[key] >= 0)
-}
 const MAX_BODY_BYTES = 4 * 1024 * 1024
 const monitors = new WeakMap()
 
@@ -253,7 +246,9 @@ export function installNativeSearchBilling(ctx, ledger) {
       const usage = event.usage
       ledger.account({ input: usage.inputTokens, output: usage.outputTokens, cacheRead: usage.cacheReadTokens, cacheWrite: usage.cacheWriteTokens, reasoning: usage.reasoningTokens }, event.model, session?.id, event.startedAtMs, event.provider)
     },
-    record(session, event) { session.append(NATIVE_SEARCH_USAGE_EVENT, event) },
+    // Never infer an append contract from function source. Host logs remain read-only;
+    // the plugin journal retains exact usage for imports and currency repricing.
+    record(session, event) { recordNativeSearchUsage(ledger.path, session.id, event) },
     uncovered: (event) => coverage.add(event),
   })
   monitors.set(ledger, { coverage })

package/lib/native-search-events.js

@@ -0,0 +1,11 @@
+/** Shared, host-independent validation for the plugin's own metering records. */
+export const NATIVE_SEARCH_USAGE_EVENT = 'cost-meter/native-search-usage'
+
+export function isNativeSearchUsageEvent(event) {
+  const data = event?.data
+  return event?.type === NATIVE_SEARCH_USAGE_EVENT && data?.provider === 'deepseek-official'
+    && typeof data.model === 'string' && /^deepseek-[a-z\d._:-]{1,120}$/i.test(data.model)
+    && typeof data.requestId === 'string' && /^[a-f\d]{8}(?:-[a-f\d]{4}){3}-[a-f\d]{12}$/i.test(data.requestId)
+    && Number.isFinite(data.startedAtMs) && data.startedAtMs > 0
+    && ['inputTokens', 'outputTokens', 'cacheReadTokens', 'cacheWriteTokens', 'reasoningTokens'].every(key => Number.isSafeInteger(data.usage?.[key]) && data.usage[key] >= 0)
+}

package/lib/native-search-history.js

@@ -0,0 +1,79 @@
+/** Native-search usage belongs to the plugin, never to the host's event vocabulary. */
+import { createHash } from 'node:crypto'
+import { mkdirSync, openSync, writeSync, fsyncSync, closeSync, lstatSync, readdirSync, createReadStream } from 'node:fs'
+import { join } from 'node:path'
+import { StringDecoder } from 'node:string_decoder'
+import { NATIVE_SEARCH_USAGE_EVENT, isNativeSearchUsageEvent } from './native-search-events.js'
+
+const validId = id => typeof id === 'string' && id.length > 0 && id.length <= 512
+export const nativeSearchHistoryRoot = ledgerPath => ledgerPath ? `${ledgerPath}.native-search` : ''
+const filename = id => `${createHash('sha256').update(id).digest('hex')}.jsonl`
+
+export function recordNativeSearchUsage(ledgerPath, sessionId, data) {
+  if (!ledgerPath || !validId(sessionId) || !isNativeSearchUsageEvent({ type: NATIVE_SEARCH_USAGE_EVENT, data })) throw new Error('Invalid native-search history record')
+  const root = nativeSearchHistoryRoot(ledgerPath)
+  mkdirSync(root, { recursive: true, mode: 0o700 })
+  if (!lstatSync(root).isDirectory() || lstatSync(root).isSymbolicLink()) throw new Error('Unsafe native-search history directory')
+  const path = join(root, filename(sessionId))
+  try { if (!lstatSync(path).isFile() || lstatSync(path).isSymbolicLink()) throw new Error('Unsafe native-search history file') } catch (error) { if (error.code !== 'ENOENT') throw error }
+  // Whitelist fields: no prompt, response body, credential, or Session object is persisted.
+  const event = { type: NATIVE_SEARCH_USAGE_EVENT, sessionId, time: data.startedAtMs, data: {
+    model: data.model, provider: data.provider, startedAtMs: data.startedAtMs, requestId: data.requestId,
+    usage: Object.fromEntries(['inputTokens', 'outputTokens', 'cacheReadTokens', 'cacheWriteTokens', 'reasoningTokens'].map(key => [key, data.usage[key]])),
+  } }
+  const fd = openSync(path, 'a', 0o600)
+  try {
+    // A leading newline isolates any torn final row from the next successful append.
+    const bytes = Buffer.from(`\n${JSON.stringify(event)}\n`)
+    let offset = 0
+    while (offset < bytes.length) offset += writeSync(fd, bytes, offset, bytes.length - offset)
+    fsyncSync(fd)
+  } finally { closeSync(fd) }
+}
+
+export function listNativeSearchHistory(ledgerPath, excludeIds = new Set(), onlyIds = null) {
+  const root = nativeSearchHistoryRoot(ledgerPath)
+  if (!root) return []
+  try {
+    if (lstatSync(root).isSymbolicLink()) return []
+    const excluded = new Set([...excludeIds].map(filename))
+    const included = onlyIds === null ? null : new Set([...onlyIds].map(filename))
+    return readdirSync(root, { withFileTypes: true }).filter(e => e.isFile() && /^[a-f\d]{64}\.jsonl$/.test(e.name) && !excluded.has(e.name) && (included === null || included.has(e.name))).map(e => join(root, e.name))
+  } catch { return [] }
+}
+
+/** Small, bounded lines; invalid/torn rows are ignored without joining adjacent calls. */
+export async function readNativeSearchHistory(path, expectedId) {
+  const records = [], ids = new Set()
+  const info = lstatSync(path)
+  if (!info.isFile() || info.isSymbolicLink() || info.size > 256 * 1024 * 1024) throw new Error('Invalid native-search history file')
+  const decoder = new StringDecoder('utf8')
+  let pending = '', dropping = false, sessionId = expectedId
+  const consume = text => {
+    const lines = text.split('\n')
+    lines[0] = pending + lines[0]
+    pending = lines.pop()
+    for (const line of lines) {
+      if (dropping) { dropping = false; continue }
+      if (line.length > 4096) continue
+      let row
+      try { row = JSON.parse(line) } catch { continue }
+      if (!validId(row?.sessionId) || !isNativeSearchUsageEvent(row) || !Number.isFinite(row.time) || row.time <= 0 || !path.endsWith(filename(row.sessionId))) continue
+      if (sessionId === undefined) sessionId = row.sessionId
+      if (row.sessionId !== sessionId || ids.has(row.data.requestId)) continue
+      ids.add(row.data.requestId)
+      records.push(row)
+    }
+    if (pending.length > 4096) { pending = ''; dropping = true }
+  }
+  for await (const bytes of createReadStream(path, { highWaterMark: 64 * 1024 })) consume(decoder.write(bytes))
+  consume(decoder.end())
+  // No newline means the append may have been interrupted: never infer its completion.
+  return { sessionId, records }
+}
+
+export async function nativeSearchRecordsFor(ledgerPath, sessionId) {
+  if (!ledgerPath || !validId(sessionId)) return []
+  try { return (await readNativeSearchHistory(join(nativeSearchHistoryRoot(ledgerPath), filename(sessionId)), sessionId)).records }
+  catch (error) { if (error.code === 'ENOENT') return []; throw error }
+}

package/lib/repair-sessions-cli.js

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+import { parseArgs } from 'node:util'
+import { createRequire } from 'node:module'
+import { pathToFileURL } from 'node:url'
+import { join, resolve } from 'node:path'
+import { lstat } from 'node:fs/promises'
+import { resolveDshHome } from '@deepseek-ai/dsh-home-paths'
+import { listSessionLogFiles } from './session-log-files.js'
+import { repairSessionLog } from './session-log-repair.js'
+
+async function main() {
+  const { values } = parseArgs({ options: {
+    write: { type: 'boolean', default: false },
+    'sessions-root': { type: 'string' }, 'host-modules': { type: 'string' },
+    help: { type: 'boolean', short: 'h' },
+  } })
+  if (values.help) {
+    console.log('dsh-cost-meter-repair-sessions [--sessions-root <目录>] [--write] [--host-modules <node_modules>]\n默认只检查。退出所有 DSH 后加 --write 修复；每份受影响日志先保留原样备份。\n写入需要同次 npx 安装 @deepseek-ai/dsh，或用 --host-modules 指向现有宿主的 node_modules。')
+    return
+  }
+  const root = resolve(values['sessions-root'] ?? join(resolveDshHome(), 'sessions'))
+  if (!(await lstat(root)).isDirectory()) throw new Error('会话根目录不存在或不是目录')
+  let acquireLease
+  if (values.write) {
+    const require = createRequire(values['host-modules'] ? join(resolve(values['host-modules']), '__cost_meter_repair__.cjs') : import.meta.url)
+    let Host
+    try { Host = (await import(pathToFileURL(require.resolve('@deepseek-ai/dsh-session-persistence-jsonl')).href)).default }
+    catch { throw new Error('未找到可用宿主：请在 npx 命令中同时指定 --package=@deepseek-ai/dsh@0.1.5-rc.2，或传 --host-modules') }
+    if (typeof Host?.prototype?.acquireLease !== 'function') throw new Error('该宿主没有兼容的会话锁接口，未写入任何日志')
+    acquireLease = (directory, id) => Host.prototype.acquireLease.call(null, id, undefined, directory)
+  }
+  const totals = { scanned: 0, affected: 0, events: 0, repaired: 0, failed: 0 }
+  console.log(`${values.write ? '修复' : '只读检查'}：${root}`)
+  for (const path of listSessionLogFiles(root, null, true)) {
+    totals.scanned++
+    try {
+      const result = await repairSessionLog(path, { write: values.write, acquireLease })
+      if (!result.changedEvents) continue
+      totals.affected++; totals.events += result.changedEvents
+      if (result.written) totals.repaired++
+      console.log(JSON.stringify({ path, events: result.changedEvents, written: result.written, backup: result.backup }))
+    } catch (error) {
+      totals.failed++
+      console.error(JSON.stringify({ path, error: error.message }))
+    }
+  }
+  console.log(JSON.stringify(totals))
+  if (totals.failed) process.exitCode = 1
+}
+
+main().catch(error => { console.error(error.message); process.exitCode = 1 })

package/lib/session-log-files.js

@@ -0,0 +1,30 @@
+import { readdirSync } from 'node:fs'
+import { join } from 'node:path'
+
+/** Canonical committed artifacts only: exclude backups, temporary files and aliases. */
+export function sessionLogGeneration(name) {
+  const match = /^session(?:\.v([1-9]\d*))?\.jsonl(\.zstd)?$/.exec(name)
+  if (!match) return null
+  const version = Number(match[1] ?? 0)
+  return Number.isSafeInteger(version) ? { version, compressed: Boolean(match[2]) } : null
+}
+
+export function listSessionLogFiles(root, onlySessionIds = null, allGenerations = false) {
+  const entries = path => { try { return readdirSync(path, { withFileTypes: true }) } catch { return [] } }
+  const paths = []
+  for (const project of entries(root)) {
+    if (!project.isDirectory()) continue
+    for (const session of entries(join(root, project.name))) {
+      if (!session.isDirectory() || (onlySessionIds !== null && !onlySessionIds.has(session.name))) continue
+      const directory = join(root, project.name, session.name)
+      const candidates = entries(directory).filter(entry => entry.isFile()).flatMap(entry => {
+        const generation = sessionLogGeneration(entry.name)
+        return generation ? [{ name: entry.name, ...generation }] : []
+      }).sort((a, b) => b.version - a.version || Number(b.compressed) - Number(a.compressed))
+      // DSH keeps older generations after migration; they share the same event prefix.
+      // Billing uses exactly one generation per session, with numeric v10 > v3 ordering.
+      for (const entry of allGenerations ? candidates : candidates.slice(0, 1)) paths.push(join(directory, entry.name))
+    }
+  }
+  return paths
+}

package/lib/session-log-repair.js

@@ -0,0 +1,175 @@
+/** Offline repair for v1.7.21's unknown native-search events. Never called at startup. */
+import { open, lstat, realpath, copyFile, rename, unlink } from 'node:fs/promises'
+import { createReadStream, constants } from 'node:fs'
+import { createHash, randomUUID } from 'node:crypto'
+import { dirname, basename, resolve } from 'node:path'
+import * as zlib from 'node:zlib'
+import { scanZstdFrames } from './backfill.js'
+import { NATIVE_SEARCH_USAGE_EVENT, isNativeSearchUsageEvent } from './native-search-events.js'
+import { sessionLogGeneration } from './session-log-files.js'
+
+const MAX_FRAME = 64 * 1024 * 1024
+const MAX_TOTAL = 4 * 1024 * 1024 * 1024
+const identity = info => [info.dev, info.ino, info.size, info.mtimeNs, info.ctimeNs].join(':')
+
+async function canonicalLogPath(path) {
+  // realpath also expands Windows 8.3 names (e.g. RUNNER~1), which are ordinary
+  // aliases, not symbolic links. Check links explicitly, then use one physical
+  // identity for validation. The host lock can still depend on the supplied spelling.
+  for (let current = path; ; current = dirname(current)) {
+    if ((await lstat(current)).isSymbolicLink()) throw new Error('不修复符号链接或目录链接中的日志')
+    if (dirname(current) === current) break
+  }
+  return realpath(path)
+}
+
+async function hashFile(path) {
+  const hash = createHash('sha256')
+  for await (const bytes of createReadStream(path)) hash.update(bytes)
+  return hash.digest('hex')
+}
+
+/** Copy untouched compressed frames byte for byte; join only frames that split a row. */
+async function* logGroups(path, compressed) {
+  let tail = Buffer.alloc(0), rawParts = [], plainParts = [], groupSize = 0, rawSize = 0, total = 0
+  const group = (raw, plain) => {
+    total += plain.length
+    groupSize += plain.length
+    rawSize += raw.length
+    if (groupSize > MAX_FRAME || rawSize > MAX_FRAME || total > MAX_TOTAL) throw new Error('会话日志超过修复内存预算，原文件未改动')
+    rawParts.push(raw); plainParts.push(plain)
+    if (plain.length === 0 || plain.at(-1) !== 10) return null
+    const out = { raw: Buffer.concat(rawParts, rawSize), plain: Buffer.concat(plainParts, groupSize) }
+    rawParts = []; plainParts = []; groupSize = 0; rawSize = 0
+    return out
+  }
+  for await (const bytes of createReadStream(path, { highWaterMark: 1024 * 1024 })) {
+    const data = tail.length ? Buffer.concat([tail, bytes]) : bytes
+    if (!compressed) {
+      const end = data.lastIndexOf(10) + 1
+      if (end > MAX_FRAME) throw new Error('会话日志行过大，原文件未改动')
+      if (end) yield { raw: data.subarray(0, end), plain: data.subarray(0, end) }
+      tail = Buffer.from(data.subarray(end))
+      total += end
+      if (total > MAX_TOTAL || tail.length > MAX_FRAME) throw new Error('会话日志超过修复内存预算，原文件未改动')
+      continue
+    }
+    const frames = scanZstdFrames(data)
+    for (const frame of frames) {
+      const raw = data.subarray(frame.start, frame.end)
+      const plain = zlib.zstdDecompressSync(raw, { maxOutputLength: MAX_FRAME })
+      const out = group(raw, plain)
+      if (out) yield out
+    }
+    tail = Buffer.from(data.subarray(frames.at(-1)?.end ?? 0))
+    if (tail.length > MAX_FRAME) throw new Error('Zstandard 帧损坏或过大，原文件未改动')
+  }
+  if (compressed && tail.length) throw new Error('Zstandard 尾帧不完整或损坏，原文件未改动')
+  if (plainParts.length || tail.length) throw new Error('会话日志末行未完整落盘，原文件未改动')
+}
+
+function repairGroup(bytes, state) {
+  const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes)
+  const lines = text.split('\n')
+  let changes = 0
+  for (let i = 0; i < lines.length - 1; i++) {
+    const line = lines[i]
+    if (state.rows++ === 0) {
+      const header = JSON.parse(line)
+      if (header?.type !== 'session' || typeof header.id !== 'string' || !Number.isSafeInteger(header.createdAt)) throw new Error('会话日志缺少合法头记录，原文件未改动')
+      state.sessionId = header.id
+      continue
+    }
+    if (!line.includes(NATIVE_SEARCH_USAGE_EVENT)) continue
+    const row = JSON.parse(line)
+    if (row?.type !== NATIVE_SEARCH_USAGE_EVENT || row.ignorable === true) continue
+    if (!isNativeSearchUsageEvent(row) || !Number.isSafeInteger(row.seq) || row.seq < 0 || !Number.isSafeInteger(row.time) || row.time <= 0) throw new Error('原生搜索记录形态异常，未自动修改')
+    if (Object.hasOwn(row, 'ignorable')) lines[i] = JSON.stringify({ ...row, ignorable: true })
+    else {
+      // Preserve every existing byte in the affected row when adding the missing marker.
+      const end = line.lastIndexOf('}')
+      lines[i] = `${line.slice(0, end)},"ignorable":true${line.slice(end)}`
+    }
+    changes++
+  }
+  state.changedEvents += changes
+  return changes ? Buffer.from(lines.join('\n')) : null
+}
+
+async function writeAll(handle, bytes) {
+  let offset = 0
+  while (offset < bytes.length) offset += (await handle.write(bytes, offset, bytes.length - offset)).bytesWritten
+}
+
+/**
+ * Default is read-only. Writes require the actual host's kernel Session lease.
+ * Each replacement keeps an exclusive byte-identical backup and verifies source identity.
+ */
+export async function repairSessionLog(path, { write = false, acquireLease } = {}) {
+  path = resolve(path)
+  const generation = sessionLogGeneration(basename(path))
+  if (!generation) throw new Error('只接受规范的 session[.vN].jsonl[.zstd] 文件')
+  if (generation.compressed && (typeof zlib.zstdDecompressSync !== 'function' || typeof zlib.zstdCompressSync !== 'function')) throw new Error('修复 Zstandard 日志需要 Node 22.15+ 或 Node 24')
+  const supplied = await lstat(path, { bigint: true })
+  if (!supplied.isFile() || supplied.isSymbolicLink()) throw new Error('不修复符号链接或非普通日志文件')
+  const physicalPath = await canonicalLogPath(path)
+  const initial = await lstat(physicalPath, { bigint: true })
+  if (identity(initial) !== identity(supplied)) throw new Error('日志在路径解析期间已变化，未自动修改')
+  const state = { path, rows: 0, sessionId: '', changedEvents: 0, written: false, backup: null }
+  const leases = []
+  let output, temporary
+  try {
+    if (write) {
+      if (typeof acquireLease !== 'function') throw new Error('写入修复需要宿主会话锁，请使用带 @deepseek-ai/dsh 的修复命令')
+      // Windows host semaphores hash resolve(path), without expanding 8.3 aliases.
+      // Hold both supplied and physical names so either host spelling is protected.
+      const directories = [dirname(path)]
+      if (process.platform === 'win32' && dirname(path).toLowerCase() !== dirname(physicalPath).toLowerCase()) directories.push(dirname(physicalPath))
+      for (const directory of directories) {
+        const lease = await acquireLease(directory, basename(dirname(path)))
+        leases.push(lease)
+        if (typeof lease?.release !== 'function') throw new Error('宿主未提供可释放的会话锁，停止修复')
+      }
+      temporary = `${path}.cost-meter-repair-${randomUUID()}.tmp`
+      output = await open(temporary, 'wx', Number(initial.mode & 0o777n))
+    }
+    const before = await lstat(path, { bigint: true })
+    if (identity(before) !== identity(initial)) throw new Error('日志在取得锁之前已变化，请退出宿主后重试')
+    const sourceHash = createHash('sha256')
+    for await (const group of logGroups(path, generation.compressed)) {
+      sourceHash.update(group.raw)
+      const updated = repairGroup(group.plain, state)
+      if (output) {
+        const bytes = !updated ? group.raw : generation.compressed ? zlib.zstdCompressSync(updated, {
+          params: { [zlib.constants.ZSTD_c_checksumFlag]: 1 },
+        }) : updated
+        await writeAll(output, bytes)
+      }
+    }
+    if (state.rows === 0) throw new Error('空日志，未自动修改')
+    const expectedHash = sourceHash.digest('hex')
+    if (identity(await lstat(path, { bigint: true })) !== identity(before)) throw new Error('日志在扫描期间已变化，请退出宿主后重试')
+    if (output && state.changedEvents) {
+      await output.sync()
+      await output.close(); output = null
+      const backup = `${path}.cost-meter-backup-${Date.now()}-${randomUUID()}`
+      await copyFile(path, backup, constants.COPYFILE_EXCL)
+      state.backup = backup
+      const backupHandle = await open(backup, 'r+')
+      try { await backupHandle.sync() } finally { await backupHandle.close() }
+      if (await hashFile(backup) !== expectedHash || await hashFile(path) !== expectedHash || identity(await lstat(path, { bigint: true })) !== identity(before)) throw new Error('日志或备份在写入前发生变化，原文件未替换')
+      await rename(temporary, path)
+      temporary = null
+      state.written = true
+      if (process.platform !== 'win32') {
+        const directory = await open(dirname(path), 'r')
+        try { await directory.sync() } finally { await directory.close() }
+      }
+    }
+    return state
+  } finally {
+    if (output) await output.close()
+    if (temporary) await unlink(temporary).catch(() => {})
+    for (const lease of leases.reverse()) await lease?.release?.()
+  }
+}

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "dsh-cost-meter",
-  "version": "1.7.21",
+  "version": "1.7.23",
   "description": "DeepSeek Harness 会话费用统计插件:本会话成本、当日费用、历史记录与官方价格同步,支持多厂商多模型价格计费(内置 90+ 模型价格目录与自动匹配)、主流 Coding Plan 订阅额度查询与显示(9 家,含 SCNet Token Plan 本地 Credits 计量与火山方舟 Volcano Ark Coding Plan AK/SK 签名查询)、自定义 Provider 余额查询(可配任意 HTTP 端点)与余额进度条、峰谷计价时段显示与切换前弹窗/系统通知提醒(位置/提前量/类型可配),界面中英双语。Session cost tracking plugin for DeepSeek Harness: per-conversation cost, daily totals, history and official price sync, with multi-vendor model pricing (built-in 90+ model catalog with auto-matching), Coding Plan quota queries & display for 9 vendors (incl. local credits metering for the SCNet Token Plan and Volcano Ark Coding Plan via AK/SK signature), plan/API dual-track billing with per-1% & full-window Token Plan usage estimates, custom provider balance lookup (configurable HTTP endpoint) and balance progress bar, plus peak/off-peak pricing display with pre-switch popup & system-notification alerts (position / lead time / type configurable), in a bilingual (Chinese/English) UI.",
   "type": "module",
   "main": "lib/index.js",
+  "bin": { "dsh-cost-meter-repair-sessions": "./lib/repair-sessions-cli.js" },
   "exports": {
     ".": {
       "default": "./lib/index.js"