dsh-dock 0.10.3 → 0.11.1

package/features/tokenlog/host.js

@@ -2,27 +2,28 @@
 //
 // 记录 DSH 会话日志中的每次 LLM 调用（assistant/message 的 usage），
 // 支持历史全量扫描 + 实时 session/event 增量；RPC 经 webServer HTTP 路由
-//   POST /dsh-dock/tokenlog/query|export|scan|hello
-// 向浏览器半部提供查询/统计/导出。
+//   POST /dsh-dock/tokenlog/query|export|scan|hello|pricing|setpricing
+// 向浏览器半部提供查询/统计/导出，以及单价的读取与保存。
 //
 // 数据模型（标量，无 Host 对象引用）：
 // {
 //   id, time, sessionId, provider, model, apiKey(掩码),
 //   inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens, reasoningTokens,
-//   billedInput, totalTokens, cacheHitPercent, cost, effort, status, llmMs, turn, step
+//   billedInput, totalTokens, cacheHitPercent, cost, pricingSource, effort, status, llmMs, turn, step
 // }
 //
-// 定价可经 settings.yaml 的 dsh-dock-tokenlog 命名空间覆盖（未注册 schema，读原始用户层）：
-//   dsh-dock-tokenlog:
-//     usdCnyRate: 7.2
-//     pricingUrl: 'https://api-docs.deepseek.com/zh-cn/quick_start/pricing'
-//     pricingFetchIntervalHours: 24
-//     pricing:
-//       deepseek-v4-flash: { input: 1.5, output: 4.5, cacheRead: 0.05, cacheWrite: 0 }
-import { sendJson, readBody } from '../../src/host-core.js'
-
-/** 本功能的 settings 覆盖命名空间（未注册 schema：读取原始用户层，字段全部可选）。 */
-const NS = 'dsh-dock-tokenlog'
+// 单价配置保存在 settings 的 dsh-dock 命名空间 tokenlog 段（schema 见 src/host-core.js）：
+//   dsh-dock:
+//     tokenlog:
+//       usdCnyRate: 7.2
+//       fetchOfficial: true
+//       pricing:
+//         - { match: deepseek-v4-flash, input: 1.5, output: 4.5, cacheRead: 0.05, cacheWrite: 0,
+//             peaks: [{ start: 9, end: 14, input: 3, output: 9, cacheRead: 0.1, cacheWrite: 0 }] }
+// 定价优先级：用户自定义单价 > 官网抓取刊例价 > 内置默认表 > 兜底单价。
+// 分时段价支持多段（start>end 跨零点、start=end 全天、小数小时表示半点）；旧单段 peak 自动归一。
+// 费用在查询/导出时按当前单价即时重算，因此改价无需重扫历史。
+import { DOCK_NS, sendJson, readBody } from '../../src/host-core.js'
 
 export const feature = {
   id: 'tokenlog',
@@ -53,25 +54,28 @@ export const feature = {
     // ===== 定价与金额估算 =====
     // 定价表以「人民币元 / 百万 tokens」为基准(DeepSeek/智谱官方刊例即人民币), 金额先算 CNY,
     // 对外记录的 cost 保持 USD，供旧版客户端兼容；当前客户端和 CSV 统一展示人民币。
-    // usdCnyRate 与 pricing 均可被 settings.yaml 覆盖:
-    //   dsh-dock-tokenlog:
-    //     usdCnyRate: 7.2                    # USD↔CNY 汇率
-    //     pricing:                            # 可选: 覆盖/新增定价条目(modelPattern -> {...})
-    //       deepseek-v4-flash:
-    //         input: 1.5  output: 4.5  cacheRead: 0.05  cacheWrite: 0
-    //         peak: { start: 9, end: 14, input: 3.0, output: 9.0, cacheRead: 0.10, cacheWrite: 0 }
-    // 官方价格随时会变动: 改价只改 settings.yaml 即可, 无需升级插件; 重启/重扫后历史记录按新价重算。
+    // 单价来源与优先级(resolvePricing):
+    //   1) 用户在面板「单价设置」保存的自定义单价(settings dsh-dock.tokenlog.pricing)——最高优先;
+    //   2) 官网抓取刊例价(fetchOfficial 关闭时不参与);
+    //   3) 内置默认表 DEFAULT_PRICING;
+    //   4) 兜底单价(settings dsh-dock.tokenlog.fallback)。
+    // 费用在查询/导出时即时重算(见 withCost), 所以改价立即生效、无需重扫历史。
+    const DEFAULT_PRICING_URL = 'https://api-docs.deepseek.com/zh-cn/quick_start/pricing'
+    const DEFAULT_FETCH_INTERVAL_HOURS = 24
+    const DEFAULT_FALLBACK = { input: 2.16, output: 6.48, cacheRead: 0.43, cacheWrite: 4.32 }
+    /** 计价来源标签(随记录下发, 供界面标注)。 */
+    const PRICING_SOURCE_LABELS = { custom: '自定义', official: '官网', builtin: '内置', fallback: '兜底' }
     let usdCnyRate = 7.2
-    let fallbackPricing = { match: '*', input: 2.16, output: 6.48, cacheRead: 0.43, cacheWrite: 4.32 }
+    let fallbackPricing = { match: '*', ...DEFAULT_FALLBACK }
     // 内置定价表(人民币元 / 百万 tokens), 按 model 子串匹配; 未匹配走 fallback。
-    // 支持峰谷定价: 条目带 peak={start,end,input,output,cacheRead,cacheWrite},
-    // 高峰时段(插件运行机器本地时间 [start,end))用峰价, 其余用基础价。
-    // 官方来源: DeepSeek-V4 系列 2026-08-17 生效的峰谷刊例(高峰每日 9:00-14:00, 空闲为高峰一半)。
+    // 支持分时段定价: 条目可带 peaks=[{start,end,input,output,cacheRead,cacheWrite}, ...],
+    // 命中某段(插件运行机器本地时间)用该段价, 其余时段用基准价; 支持多段与跨零点(start>end)。
+    // 官方来源: DeepSeek-V4 系列 2026-08-17 生效的分时段刊例(高峰每日 9:00-14:00, 空闲为高峰一半)。
     const DEFAULT_PRICING = [
       { match: 'deepseek-v4-flash', input: 1.5, output: 4.5, cacheRead: 0.05, cacheWrite: 0,
-        peak: { start: 9, end: 14, input: 3.0, output: 9.0, cacheRead: 0.10, cacheWrite: 0 } },
+        peaks: [{ start: 9, end: 14, input: 3.0, output: 9.0, cacheRead: 0.10, cacheWrite: 0 }] },
       { match: 'deepseek-v4-pro', input: 4.5, output: 13.5, cacheRead: 0.15, cacheWrite: 0,
-        peak: { start: 9, end: 14, input: 9.0, output: 27.0, cacheRead: 0.30, cacheWrite: 0 } },
+        peaks: [{ start: 9, end: 14, input: 9.0, output: 27.0, cacheRead: 0.30, cacheWrite: 0 }] },
       { match: 'deepseek-v3', input: 3.6, output: 7.2, cacheRead: 0.72, cacheWrite: 7.2 },
       { match: 'deepseek-chat', input: 1.94, output: 7.92, cacheRead: 0.5, cacheWrite: 7.92 },
       { match: 'deepseek-reasoner', input: 3.96, output: 15.77, cacheRead: 1.01, cacheWrite: 7.92 },
@@ -79,84 +83,125 @@ export const feature = {
       { match: 'glm', input: 2.88, output: 8.64, cacheRead: 0.58, cacheWrite: 7.2 },
     ]
     let pricingTable = DEFAULT_PRICING
+    // 用户自定义单价(最高优先)与官网抓取开关/地址——均由 loadPricingConfig() 从 settings 刷新。
+    let userPricing = []
+    let fetchOfficialEnabled = true
+    let pricingUrl = DEFAULT_PRICING_URL
+    let fetchIntervalMs = DEFAULT_FETCH_INTERVAL_HOURS * 3600000
 
     function normalizePricing(match, e) {
       const n = (x) => (typeof x === 'number' && Number.isFinite(x) ? x : 0)
       const row = { match, input: n(e.input), output: n(e.output), cacheRead: n(e.cacheRead), cacheWrite: n(e.cacheWrite) }
-      if (e.peak && typeof e.peak === 'object') {
-        row.peak = {
-          start: n(e.peak.start), end: n(e.peak.end),
-          input: n(e.peak.input), output: n(e.peak.output),
-          cacheRead: n(e.peak.cacheRead), cacheWrite: n(e.peak.cacheWrite),
-        }
+      // 分时段价支持多段: peaks=[{start,end,input,output,cacheRead,cacheWrite}, ...]。
+      // 兼容旧的单段写法 peak={...}(以及旧版本存盘数据), 统一归一到 peaks。
+      const src = Array.isArray(e.peaks) && e.peaks.length ? e.peaks : (e.peak && typeof e.peak === 'object' ? [e.peak] : [])
+      const peaks = []
+      for (const s of src) {
+        if (!s || typeof s !== 'object') continue
+        peaks.push({
+          start: n(s.start), end: n(s.end),
+          input: n(s.input), output: n(s.output),
+          cacheRead: n(s.cacheRead), cacheWrite: n(s.cacheWrite),
+        })
       }
+      if (peaks.length) row.peaks = peaks
       return row
     }
 
-    // 读取 settings.yaml 的 dsh-dock-tokenlog { usdCnyRate?, pricing? } 覆盖默认值。
-    // pricing: map modelPattern -> {input,output,cacheRead,cacheWrite,peak?};
-    // 设置条目排前面优先命中(同 match 覆盖内置); 键 '*' 覆盖 fallback。幂等, 可重复调用。
+    /** 浅拷贝分时段数组（RPC 下发与落盘都用它，避免调用方改到内存态）。 */
+    function clonePeaks(peaks) {
+      return Array.isArray(peaks) ? peaks.map((s) => Object.assign({}, s)) : []
+    }
+
+    // 读 settings 的 dsh-dock.tokenlog 段并刷新模块级定价状态。幂等, 可重复调用。
+    // 取值做防御性归一(schema 已给默认, 但 settings 未挂载/异常时仍需兜底)。
     function loadPricingConfig() {
       try {
         const settings = ctx.get('settings')
-        if (!settings || typeof settings.get !== 'function') return
-        const v = settings.get(NS)
-        if (!v || typeof v !== 'object') return
-        if (typeof v.usdCnyRate === 'number' && v.usdCnyRate > 0) usdCnyRate = v.usdCnyRate
-        if (v.pricing && typeof v.pricing === 'object') {
-          const overrides = []
-          for (const [match, entry] of Object.entries(v.pricing)) {
-            if (!entry || typeof entry !== 'object') continue
-            const row = normalizePricing(String(match).toLowerCase(), entry)
-            if (row.match === '*') fallbackPricing = row
-            else overrides.push(row)
-          }
-          pricingTable = overrides.concat(DEFAULT_PRICING)
+        const root = settings && typeof settings.get === 'function' ? settings.get(DOCK_NS) : null
+        const t = root && typeof root === 'object' && root.tokenlog && typeof root.tokenlog === 'object' ? root.tokenlog : null
+        if (!t) return
+        if (typeof t.usdCnyRate === 'number' && t.usdCnyRate > 0) usdCnyRate = t.usdCnyRate
+        if (typeof t.fetchOfficial === 'boolean') fetchOfficialEnabled = t.fetchOfficial
+        if (typeof t.pricingUrl === 'string' && t.pricingUrl) pricingUrl = t.pricingUrl
+        if (typeof t.pricingFetchIntervalHours === 'number' && t.pricingFetchIntervalHours > 0) {
+          fetchIntervalMs = t.pricingFetchIntervalHours * 3600000
         }
+        userPricing = Array.isArray(t.pricing)
+          ? t.pricing
+            .filter((e) => e && typeof e === 'object' && typeof e.match === 'string' && e.match)
+            .map((e) => normalizePricing(String(e.match).toLowerCase(), e))
+          : []
+        if (t.fallback && typeof t.fallback === 'object') fallbackPricing = normalizePricing('*', t.fallback)
       } catch (e) {
         console.error('[dsh-dock] tokenlog read pricing config failed', e && e.message)
       }
     }
 
-    // 命中定价行: 优先官网自动获取 → settings.yaml 覆盖+内置 → fallback; 再按调用时刻取峰/谷价。
-    // 官网获取的数据若为 USD 则自动折成 CNY(内置表已是 CNY)。返回人民币单价(元/百万 tokens)。
+    // 分时段命中: start<end 为普通区间 [start,end); start>end 表示跨零点(如 23~7 点);
+    // start===end 视为全天。多段命中时取第一段(按配置顺序)。
+    function pickPeakSegment(peaks, hour) {
+      if (!Array.isArray(peaks) || hour < 0) return null
+      for (const s of peaks) {
+        const a = Number(s.start), b = Number(s.end)
+        if (!Number.isFinite(a) || !Number.isFinite(b)) continue
+        const hit = a === b ? true : (a < b ? (hour >= a && hour < b) : (hour >= a || hour < b))
+        if (hit) return s
+      }
+      return null
+    }
+
+    // 命中定价行: 用户自定义 → 官网抓取(可关闭) → 内置表 → 兜底; 再按调用时刻取分时价。
+    // 官网获取的数据若为 USD 则自动折成 CNY(内置表已是 CNY)。返回单价(元/百万 tokens)与来源标签。
     function resolvePricing(model, timeMs) {
       const m = String(model || '').toLowerCase()
       let row = null
-      let fromFetch = false
-      // 1. 优先: 官网自动获取的定价(48h 内有效, 超时回退内置)
-      const fetched = fetchedPricing
-      if (fetched && fetched.length > 0 && (Date.now() - lastFetchTime < FETCH_INTERVAL_MS * 2)) {
-        for (const r of fetched) {
-          if (m.includes(r.match)) { row = r; fromFetch = true; break }
+      let source = 'fallback'
+      // 1) 用户自定义单价: 最高优先(官网抓取价常与实际计费不符, 用户填了就以其为准)
+      for (const r of userPricing) {
+        if (m.includes(r.match)) { row = r; source = 'custom'; break }
+      }
+      // 2) 官网自动获取的定价(48h 内有效, 超时回退内置; 可在设置里关闭抓取)
+      if (!row && fetchOfficialEnabled) {
+        const fetched = fetchedPricing
+        if (fetched && fetched.length > 0 && (Date.now() - lastFetchTime < fetchIntervalMs * 2)) {
+          for (const r of fetched) {
+            if (m.includes(r.match)) { row = r; source = 'official'; break }
+          }
         }
       }
-      // 2. 回退: settings.yaml 覆盖 + 内置表
+      const fromFetch = source === 'official'
+      // 3) 内置表
       if (!row) {
         for (const r of pricingTable) {
-          if (m.includes(r.match)) { row = r; break }
+          if (m.includes(r.match)) { row = r; source = 'builtin'; break }
         }
       }
-      if (!row) row = fallbackPricing
-      // 3. 峰谷判断(本地时间 [start,end) 用峰价)
-      const h = (typeof timeMs === 'number' && Number.isFinite(timeMs)) ? new Date(timeMs).getHours() : -1
-      let prices
-      if (row.peak && h >= row.peak.start && h < row.peak.end) {
-        prices = { input: row.peak.input, output: row.peak.output, cacheRead: row.peak.cacheRead, cacheWrite: row.peak.cacheWrite }
-      } else {
-        prices = { input: row.input, output: row.output, cacheRead: row.cacheRead, cacheWrite: row.cacheWrite }
+      // 4) 兜底
+      if (!row) { row = fallbackPricing; source = 'fallback' }
+      // 分时段判断(本地时间, 支持多段与跨零点; 用小数小时以便 08:30 这类半点边界); 未命中用基准价
+      let h = -1
+      if (typeof timeMs === 'number' && Number.isFinite(timeMs)) {
+        const d = new Date(timeMs)
+        h = d.getHours() + d.getMinutes() / 60
       }
-      // 4. 币种转换: 获取的数据若是 USD 则折成 CNY(内置表已是 CNY, 无需转换)
+      const seg = pickPeakSegment(row.peaks, h)
+      const prices = seg
+        ? { input: seg.input, output: seg.output, cacheRead: seg.cacheRead, cacheWrite: seg.cacheWrite }
+        : { input: row.input, output: row.output, cacheRead: row.cacheRead, cacheWrite: row.cacheWrite }
+      // 币种转换: 官网抓取的数据若是 USD 则折成 CNY(内置表已是 CNY, 无需转换)
       if (fromFetch && row.currency === 'usd') {
         prices.input *= usdCnyRate
         prices.output *= usdCnyRate
         prices.cacheRead *= usdCnyRate
         prices.cacheWrite *= usdCnyRate
       }
-      return prices
+      return { ...prices, source }
     }
+
     // 金额估算: 表为人民币价 → 先算 CNY, 再折成 USD(= CNY / usdCnyRate) 供客户端/CSV 使用。
-    function estimateCost(usage, model, timeMs) {
+    // 返回 { cost(USD), source(计价来源) }。
+    function costOf(usage, model, timeMs) {
       const p = resolvePricing(model, timeMs)
       const cny = (
         num(usage.inputTokens) * p.input +
@@ -164,29 +209,156 @@ export const feature = {
         num(usage.cacheWriteTokens) * p.cacheWrite +
         num(usage.outputTokens) * p.output
       ) / 1e6
-      return cny / usdCnyRate
+      return { cost: cny / usdCnyRate, source: p.source }
+    }
+
+    // 按当前单价重算一条记录的费用(浅拷贝)：面板改价后无需重扫历史即可即时生效。
+    function withCost(r) {
+      const c = costOf(r, r.model, r.time)
+      return Object.assign({}, r, { cost: c.cost, pricingSource: c.source })
+    }
+
+    // 面板「单价设置」读取：返回当前生效的单价表 + 兜底/汇率/抓取开关 + 已出现过的模型
+    // (含已配置 Provider 的模型, 供用户按模型逐条配置单价; 未配置的模型可手输匹配串)。
+    function readPricingConfig() {
+      const cfg = readConfiguredProviders()
+      const seen = new Set()
+      for (const r of records.values()) if (r.model) seen.add(r.model)
+      for (const ids of Object.values(cfg)) for (const id of ids) if (id) seen.add(id)
+      // 每个模型的当前计价来源(供面板提示哪些模型走了兜底价, 提示用户去配单价)
+      const sourcesByModel = {}
+      for (const m of seen) sourcesByModel[m] = PRICING_SOURCE_LABELS[resolvePricing(m, Date.now()).source] || ''
+      return {
+        usdCnyRate,
+        fetchOfficial: fetchOfficialEnabled,
+        pricingUrl,
+        pricingFetchIntervalHours: Math.round(fetchIntervalMs / 3600000),
+        pricing: userPricing.map((r) => Object.assign({}, r, { peaks: clonePeaks(r.peaks) })),
+        fallback: Object.assign({}, fallbackPricing),
+        builtin: pricingTable.map((r) => ({ match: r.match, input: r.input, output: r.output, cacheRead: r.cacheRead, cacheWrite: r.cacheWrite, peaks: clonePeaks(r.peaks) })),
+        models: [...seen].sort(),
+        sourcesByModel,
+      }
+    }
+
+    // 保存面板提交的单价配置: 校验 → 合并进 dsh-dock.tokenlog(保留 pricingUrl 等未在面板暴露
+    // 的字段) → 落盘。保存后由调用方 loadPricingConfig() 刷新内存, 使改价立即影响费用估算。
+    async function savePricingConfig(input) {
+      const settings = ctx.get('settings')
+      if (!settings || typeof settings.get !== 'function' || typeof settings.mutate !== 'function') {
+        throw new Error('settings 服务不可用，单价无法持久化')
+      }
+      const bad = (msg) => { const err = new Error(msg); err.statusCode = 400; return err }
+      const nonNeg = (v, label) => {
+        const n = Number(v)
+        if (!Number.isFinite(n) || n < 0) throw bad(`「${label}」需为不小于 0 的数字`)
+        return n
+      }
+      const root = settings.get(DOCK_NS)
+      const current = root && typeof root === 'object' && root.tokenlog && typeof root.tokenlog === 'object' ? root.tokenlog : {}
+      const next = Object.assign({}, current)
+      if (input.usdCnyRate !== undefined) {
+        const r = Number(input.usdCnyRate)
+        if (!Number.isFinite(r) || r <= 0 || r > 1000) throw bad('「USD→CNY 汇率」需为 0~1000 的正数')
+        next.usdCnyRate = r
+      }
+      if (input.fetchOfficial !== undefined) next.fetchOfficial = !!input.fetchOfficial
+      if (input.pricing !== undefined) {
+        if (!Array.isArray(input.pricing)) throw bad('「模型单价」需为数组')
+        const rows = []
+        for (const raw of input.pricing) {
+          if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw bad('模型单价条目格式不符')
+          const match = String(raw.match || '').trim().toLowerCase()
+          if (!match) throw bad('模型单价条目的「模型匹配」不能为空')
+          if (match === '*') throw bad('模型匹配不能是 *；未匹配模型请填「兜底单价」')
+          const row = {
+            match,
+            input: nonNeg(raw.input, `${match} 输入单价`),
+            output: nonNeg(raw.output, `${match} 输出单价`),
+            cacheRead: nonNeg(raw.cacheRead, `${match} 缓存命中单价`),
+            cacheWrite: nonNeg(raw.cacheWrite, `${match} 缓存写入单价`),
+          }
+          // 分时段价(可多段): 每段 start/end 为 0~24 的本地小时(支持 8.5 表示 08:30);
+          // start>end 表示跨零点, start===end 表示全天。
+          const rawPeaks = Array.isArray(raw.peaks) ? raw.peaks : []
+          const peaks = []
+          for (const seg of rawPeaks) {
+            if (!seg || typeof seg !== 'object' || Array.isArray(seg)) throw bad(`「${match}」分时段条目格式不符`)
+            const start = Number(seg.start), end = Number(seg.end)
+            if (!Number.isFinite(start) || !Number.isFinite(end) || start < 0 || start > 24 || end < 0 || end > 24) {
+              throw bad(`「${match}」分时段时刻需为 0~24 的小时数`)
+            }
+            peaks.push({
+              start, end,
+              input: nonNeg(seg.input, `${match} 分时段输入单价`),
+              output: nonNeg(seg.output, `${match} 分时段输出单价`),
+              cacheRead: nonNeg(seg.cacheRead, `${match} 分时段缓存命中单价`),
+              cacheWrite: nonNeg(seg.cacheWrite, `${match} 分时段缓存写入单价`),
+            })
+          }
+          if (peaks.length) row.peaks = peaks
+          rows.push(row)
+        }
+        next.pricing = rows
+      }
+      if (input.fallback !== undefined) {
+        const f = input.fallback
+        if (!f || typeof f !== 'object' || Array.isArray(f)) throw bad('「兜底单价」格式不符')
+        next.fallback = {
+          input: nonNeg(f.input, '兜底输入单价'),
+          output: nonNeg(f.output, '兜底输出单价'),
+          cacheRead: nonNeg(f.cacheRead, '兜底缓存命中单价'),
+          cacheWrite: nonNeg(f.cacheWrite, '兜底缓存写入单价'),
+        }
+      }
+      try {
+        await settings.mutate(DOCK_NS, [{ op: 'set', path: ['tokenlog'], value: next }])
+      } catch (e) {
+        const err = new Error('保存单价被拒绝：' + ((e && e.message) || String(e)))
+        err.statusCode = 400
+        throw err
+      }
+      console.log('[dsh-dock] tokenlog pricing saved: rows=' + (Array.isArray(next.pricing) ? next.pricing.length : 0) +
+        ', fetchOfficial=' + next.fetchOfficial)
+      return next
     }
 
     // ===== 官网定价自动获取 =====
-    // 每 24 小时从 DeepSeek 官网抓取最新定价并解析 HTML 表格; 抓取/解析失败时使用内置默认值。
-    const FETCH_INTERVAL_MS = 24 * 60 * 60 * 1000
+    // 每 N 小时(默认 24)从官网抓取最新定价并解析 HTML 表格; 抓取/解析失败时使用内置默认值。
+    // 用户在面板配置的单价优先于抓取价, 因此抓取仅作兜底; 也可在面板关闭抓取。
     let fetchedPricing = null  // Array<{ match, input, output, cacheRead, cacheWrite, currency }>
     let lastFetchTime = 0
 
     function getPricingFetchConfig() {
-      let url = 'https://api-docs.deepseek.com/zh-cn/quick_start/pricing'
-      let intervalMs = FETCH_INTERVAL_MS
-      try {
-        const settings = ctx.get('settings')
-        if (settings && typeof settings.get === 'function') {
-          const v = settings.get(NS)
-          if (v && typeof v === 'object') {
-            if (typeof v.pricingUrl === 'string' && v.pricingUrl) url = v.pricingUrl
-            if (typeof v.pricingFetchIntervalHours === 'number' && v.pricingFetchIntervalHours > 0) intervalMs = v.pricingFetchIntervalHours * 3600000
-          }
-        }
-      } catch (e) { /* 用默认 */ }
-      return { url, intervalMs }
+      return { url: pricingUrl, intervalMs: fetchIntervalMs }
+    }
+
+    // 服务端出站请求前的 URL 校验(SSRF 防护): 仅 http/https, 且拒绝本机/环回/私有/保留地址。
+    function isPrivateOrReservedHost(host) {
+      const h = String(host || '').toLowerCase().replace(/^\[|\]$/g, '')
+      if (!h) return true
+      if (h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local') || h.endsWith('.internal')) return true
+      if (h.includes(':')) { // IPv6 字面量
+        return h === '::' || h === '::1' || h.startsWith('fe80') || h.startsWith('fc') || h.startsWith('fd')
+      }
+      const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/)
+      if (m) {
+        const a = Number(m[1]), b = Number(m[2])
+        return a === 0 || a === 10 || a === 127
+          || (a === 169 && b === 254)          // link-local
+          || (a === 172 && b >= 16 && b <= 31) // 私网
+          || (a === 192 && b === 168)          // 私网
+          || a >= 224                          // 组播/保留
+      }
+      return false
+    }
+
+    function assertAllowedFetchUrl(raw) {
+      let u
+      try { u = new URL(String(raw)) } catch { throw new Error('价格页地址不是合法 URL：' + raw) }
+      if (u.protocol !== 'http:' && u.protocol !== 'https:') throw new Error('价格页地址仅支持 http/https')
+      if (isPrivateOrReservedHost(u.hostname)) throw new Error('价格页地址不允许指向本机/内网/保留地址')
+      return u.toString()
     }
 
     // 从 HTML 中提取所有 <table> 的行列数据
@@ -282,8 +454,9 @@ export const feature = {
     async function fetchOfficialPricing() {
       try {
         const { url } = getPricingFetchConfig()
-        console.log('[dsh-dock] tokenlog fetching official pricing from:', url)
-        const res = await fetch(url, {
+        const safeUrl = assertAllowedFetchUrl(url)
+        console.log('[dsh-dock] tokenlog fetching official pricing from:', safeUrl)
+        const res = await fetch(safeUrl, {
           headers: { 'User-Agent': 'dsh-dock-tokenlog/0.4', 'Accept': 'text/html,*/*' }
         })
         if (!res.ok) throw new Error('HTTP ' + res.status)
@@ -409,7 +582,7 @@ export const feature = {
       const cacheRead = num(usage.cacheReadTokens)
       const cacheWrite = num(usage.cacheWriteTokens)
       const reasoning = num(usage.reasoningTokens)
-      const cost = estimateCost(usage, head.model, event.time)
+      const priced = costOf(usage, head.model, event.time)
       stepStart.delete(startK)
       return {
         id: sessionId + ':' + event.seq,
@@ -426,7 +599,8 @@ export const feature = {
         billedInput: input + cacheRead + cacheWrite,
         totalTokens: input + output + cacheRead + cacheWrite,
         cacheHitPercent: (input + cacheRead) > 0 ? Math.round((cacheRead / (input + cacheRead)) * 100) : 0,
-        cost,
+        cost: priced.cost,
+        pricingSource: priced.source,
         effort: head.effort || '',
         status,
         statusCode: ei ? ei.statusCode : 0,
@@ -567,11 +741,11 @@ export const feature = {
     let sessionQuery = null
     disposers.push(ctx.inject(['sessionQuery'], (sqCtx) => {
       sessionQuery = sqCtx.sessionQuery
-      // 服务就绪后加载 settings 定价配置(汇率 + pricing 覆盖), 供采集/重扫/导出使用
+      // 服务就绪后加载 settings 单价配置(汇率 + 自定义单价 + 抓取开关), 供采集/重扫/导出使用
       loadPricingConfig()
-      // 从官网获取最新定价(启动时 + 每 24h 自动刷新)
-      fetchOfficialPricing()
-      const fetchTimer = setInterval(fetchOfficialPricing, getPricingFetchConfig().intervalMs)
+      // 从官网获取最新定价(启动时 + 每 N 小时自动刷新; 面板关闭抓取时不发起请求)
+      if (fetchOfficialEnabled) fetchOfficialPricing()
+      const fetchTimer = setInterval(() => { if (fetchOfficialEnabled) fetchOfficialPricing() }, getPricingFetchConfig().intervalMs)
       sqCtx.effect(() => () => clearInterval(fetchTimer))
       // 实时监听: session/event (root scope 可收到所有 session 事件, 与官方 persistence 同款订阅)
       disposers.push(sqCtx.on('session/event', (session, event) => {
@@ -616,7 +790,8 @@ export const feature = {
             const payload = await readBody(req)
             if (method === 'query') {
               loadPricingConfig()
-              const list = buildQuery(payload || {})
+              // 费用按当前单价即时重算(withCost): 面板改价后立即反映到统计与明细, 无需重扫历史。
+              const list = buildQuery(payload || {}).map(withCost)
               const rows = [...list].sort((a, b) => b.time - a.time)
               const all = [...records.values()]
               const cfg = readConfiguredProviders()
@@ -653,15 +828,31 @@ export const feature = {
                   efforts: [...new Set(all.map((r) => r.effort).filter(Boolean))],
                   sessionIds: [...new Set(all.map((r) => r.sessionId).filter(Boolean))].sort(),
                   rateUsdCny: usdCnyRate,
+                  pricingInfo: {
+                    hasCustom: userPricing.length > 0,
+                    customCount: userPricing.length,
+                    fetchOfficial: fetchOfficialEnabled,
+                    sources: [...new Set(list.map((r) => r.pricingSource).filter(Boolean))].map((s) => PRICING_SOURCE_LABELS[s] || s),
+                  },
                   totals: totals(list),
                   summary: payload && payload.dim ? summarize(list, payload.dim) : [],
                 }
               })
             }
+            if (method === 'pricing') {
+              loadPricingConfig()
+              return sendJson(res, 200, { ok: true, data: readPricingConfig() })
+            }
+            if (method === 'setpricing') {
+              await savePricingConfig(payload || {})
+              loadPricingConfig()
+              return sendJson(res, 200, { ok: true, data: readPricingConfig() })
+            }
             if (method === 'export') {
               loadPricingConfig()
-              const list = buildQuery(payload || {})
-              const header = ['time', 'provider', 'model', 'apiKey', 'inputTokens', 'outputTokens', 'cacheReadTokens', 'cacheWriteTokens', 'reasoningTokens', 'billedInput', 'cacheHitPercent', 'totalTokens', 'costCny', 'effort', 'status', 'statusCode', 'errorCode', 'errorMsg', 'llmMs', 'sessionId', 'turn', 'step']
+              const list = buildQuery(payload || {}).map(withCost)
+              // 列序对齐界面习惯（缓存命中在前）：… 命中 → 未命中 → 输出 → 写入
+              const header = ['time', 'provider', 'model', 'apiKey', 'cacheReadTokens', 'inputTokens', 'outputTokens', 'cacheWriteTokens', 'reasoningTokens', 'billedInput', 'cacheHitPercent', 'totalTokens', 'costCny', 'effort', 'status', 'statusCode', 'errorCode', 'errorMsg', 'llmMs', 'sessionId', 'turn', 'step']
               const esc = (v) => {
                 const s = String(v === undefined || v === null ? '' : v)
                 return /[,"\n]/.test(s) ? '"' + s.replace(/"/g, '""') + '"' : s
@@ -679,7 +870,9 @@ export const feature = {
             }
             return sendJson(res, 404, { ok: false, error: { code: 'method-not-found', message: 'unknown method: ' + method, details: {} } })
           } catch (e) {
-            return sendJson(res, 500, { ok: false, error: { code: 'internal', message: (e && e.message) || String(e), details: {} } })
+            // 参数校验类错误按 4xx 返回(如单价非法), 其余为 500
+            const status = e && e.statusCode ? e.statusCode : 500
+            return sendJson(res, status, { ok: false, error: { code: status === 500 ? 'internal' : 'bad-request', message: (e && e.message) || String(e), details: {} } })
           }
         }
       }), 'dsh-dock tokenlog: /dsh-dock/tokenlog HTTP route')