dsh-llm-local-token 1.3.2 → 1.4.1

package/README.md

@@ -78,20 +78,29 @@ All keys are optional; the defaults match a stock CLI install.
 | `claudeKeychainService` | `Claude Code-credentials` | macOS Keychain service holding the Claude OAuth payload |
 | `requireClaude` | `false` | Fail activation when no Claude credential is found, instead of skipping the route |
 | `codexTransport` | `"sse"` | Streaming transport for the Codex route: `sse` / `websocket` / `websocket-cached` / `auto`. **The quota badge depends on `sse`**: pi-ai's default `auto` streams over WebSocket, and the `x-codex-*` quota headers exist only on the SSE response, so the badge stays empty under WS. Set `auto` to prefer WebSocket and accept no Codex quota data. |
+| `usageProbe` | `true` | Refresh quota on a schedule with one bare minimal request per provider. Set `false` to keep the panel purely passive. |
+| `usageProbeIntervalHours` | `4` | Hours between probes. Tracks the 5-hour window, which resets about five times a day; `24` is once per day. |
+| `usageProbeAtHour` | — | Local hour `0`–`23` for a once-daily probe at a fixed clock time. Overrides `usageProbeIntervalHours`. |
+| `usageProbeStartupDelayMs` | `20000` | Delay before the probe that runs at boot. A clock schedule only fires while dsh happens to be running, so boot is its own trigger. |
+| `usageProbeCodexModel` | `gpt-5.6-terra` | Model the Codex probe names; only a vehicle for the headers. |
+| `usageProbeAnthropicModel` | `claude-haiku-4-5-20251001` | Model the Anthropic probe names; only a vehicle for the headers. |
 
 ## Subscription usage badge
 
-Both providers return their quota state in response headers, so the plugin reads it for free —
-no polling, no extra endpoint hits. A badge appears in the composer bar next to the context
-ring; click it for the breakdown.
+Both providers state their quota in response headers, so reading it off a real request costs
+nothing. A route you never call has nothing to report, though — so the plugin also refreshes on a
+schedule, with one deliberately tiny request per provider (16 input tokens for Codex, 9 for
+Anthropic) that carries no prompt, skills, tools or history and is never stored. A badge appears in
+the composer bar next to the context ring; click it for the breakdown.
 
 | Provider | Headers read | Shown |
 | --- | --- | --- |
 | `openai-codex` | `x-codex-primary-*`, `x-codex-secondary-*`, `x-codex-plan-type`, `x-codex-credits-balance` | plan, used % per window, reset countdown, credit balance |
 | `anthropic` | `anthropic-ratelimit-unified-{5h,7d}-{utilization,reset,status}` | used % for the 5-hour and 7-day windows, reset countdown |
 
-The badge is green under 60%, amber under 85%, red above. Usage is whatever the **last real
-request** reported, so a freshly started host shows "no data yet" until you send one message.
+The badge is green under 60%, amber under 85%, red above. Any reading older than a minute carries
+its age, because a 5-hour window resets about five times a day and a stale number that looks live
+is worse than none.
 The browser half polls `GET /llm-local-token/usage` every 15s; that route only reads the
 in-memory snapshot.
 

package/README.zh.md

@@ -73,19 +73,27 @@ agent-default-model:
 | `claudeKeychainService` | `Claude Code-credentials` | 存放 Claude OAuth 数据的 Keychain 服务名 |
 | `requireClaude` | `false` | 为 `true` 时找不到 Claude 凭据就启动失败（而不是跳过） |
 | `codexTransport` | `"sse"` | Codex 路由的流式通道：`sse` / `websocket` / `websocket-cached` / `auto`。**额度徽标依赖 `sse`**：pi-ai 默认的 `auto` 会走 WebSocket，而 `x-codex-*` 额度响应头只存在于 SSE 响应上，走 WS 时徽标永远是「暂无数据」。想要 WebSocket 就设成 `auto`，代价是没有 Codex 额度数据。 |
+| `usageProbe` | `true` | 是否定时刷新额度（每个 provider 一个最小裸请求）。设 `false` 则完全被动，只读真实请求。 |
+| `usageProbeIntervalHours` | `4` | 探测间隔小时数。对齐 5 小时窗口（每天重置约五次）；设 `24` 就是每天一次。 |
+| `usageProbeAtHour` | — | 本地时钟小时 `0`–`23`，在固定时间每天探测一次。设置后覆盖 `usageProbeIntervalHours`。 |
+| `usageProbeStartupDelayMs` | `20000` | 启动探测的延迟。固定时间点只在 dsh 恰好运行时才触发，所以启动本身也是一个触发点。 |
+| `usageProbeCodexModel` | `gpt-5.6-terra` | Codex 探测使用的模型，仅作为拿响应头的载体。 |
+| `usageProbeAnthropicModel` | `claude-haiku-4-5-20251001` | Anthropic 探测使用的模型，仅作为拿响应头的载体。 |
 
 ## 订阅用量徽标
 
-两家 provider 都在响应头里返回额度状态，插件顺带读取即可 —— 不轮询、不额外调接口。输入框工具条上
-（上下文圆环旁边）会出现一个徽标，点开看明细。
+两家 provider 都在响应头里返回额度状态，所以真实请求顺带就能读到。但你从没调用过的那条路由无从上报 ——
+因此插件还会**定时刷新**：每个 provider 发一个刻意做到最小的请求（Codex 16 个输入 token、Anthropic 9 个），
+不带 prompt、skill、工具与历史，也不落存储。输入框工具条上（上下文圆环旁边）会出现一个徽标，点开看明细。
 
 | Provider | 读取的响应头 | 展示内容 |
 | --- | --- | --- |
 | `openai-codex` | `x-codex-primary-*`、`x-codex-secondary-*`、`x-codex-plan-type`、`x-codex-credits-balance` | 套餐、各窗口已用百分比、重置倒计时、点数余额 |
 | `anthropic` | `anthropic-ratelimit-unified-{5h,7d}-{utilization,reset,status}` | 5 小时与 7 天窗口的已用百分比、重置倒计时 |
 
-低于 60% 显示绿色，低于 85% 琥珀色，更高显示红色。数值来自**最近一次真实请求**，所以刚启动时会显示
-「暂无数据」，发一条消息即可。浏览器端每 15 秒轮询 `GET /llm-local-token/usage`，该路由只读内存快照。
+低于 60% 显示绿色，低于 85% 琥珀色，更高显示红色。超过一分钟的数值会标注**读取时间** —— 5 小时窗口每天
+重置约五次，一个看起来实时的过期数字比没有数字更糟。浏览器端每 15 秒轮询 `GET /llm-local-token/usage`，
+该路由只读内存快照。
 
 徽标**只显示当前选中模型所属 provider** 的用量：选 Codex 就是 Codex 的窗口，切到 Claude 就换成
 Claude 的，不会把两家的数字混在一起。选中的模型由别的 adapter 提供（普通 API key、其他插件）时徽标

package/lib/client.js

@@ -6,7 +6,7 @@ window.__ModuleLoader__.load({
 		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 		const jsxRuntime = require("react/jsx-runtime");
 		const react = require("react");
-		const runtime = require("@deepseek-ai/dsh-client-runtime/client");
+		const clientStore = require("@deepseek-ai/dsh-client-store");
 		const jsx = jsxRuntime.jsx;
 		const jsxs = jsxRuntime.jsxs;
 
@@ -52,6 +52,7 @@ window.__ModuleLoader__.load({
 			resets: "resets {when}", credits: "credits: {balance}",
 			current: "current",
 			"unit.d": "{n} days", "unit.h": "{n} hours", "unit.m": "{n} min",
+			readAt: "read {when} ago",
 		};
 		const zh = {
 			label: "额度", title: "订阅用量",
@@ -61,6 +62,7 @@ window.__ModuleLoader__.load({
 			resets: "{when}重置", credits: "点数余额：{balance}",
 			current: "当前",
 			"unit.d": "{n} 天", "unit.h": "{n} 小时", "unit.m": "{n} 分钟",
+			readAt: "{when}前读取",
 		};
 
 		/** Green under 60%, amber under 85%, red above. */
@@ -98,6 +100,24 @@ window.__ModuleLoader__.load({
 			return String(Math.round(seconds / 86400)) + "d";
 		}
 
+		/**
+		 * Compact "how long ago" for a snapshot instant; blank under a minute.
+		 *
+		 * A scheduled probe means a number can be hours old while still looking
+		 * live, and a 5-hour window resets about five times a day — so the age is
+		 * load-bearing, not decoration. Returning "" for a fresh read keeps the
+		 * panel quiet until staleness is the thing worth saying.
+		 */
+		function agoOf(iso) {
+			const at = Date.parse(iso ?? "");
+			if (!Number.isFinite(at)) return "";
+			const seconds = Math.max(0, Math.round((Date.now() - at) / 1000));
+			if (seconds < 60) return "";
+			if (seconds < 3600) return String(Math.round(seconds / 60)) + "m";
+			if (seconds < 86400) return String(Math.round(seconds / 3600)) + "h";
+			return String(Math.round(seconds / 86400)) + "d";
+		}
+
 		function UsageRow({ t, entry }) {
 			const percent = Math.round(entry.used * 100);
 			return jsxs("div", {
@@ -123,12 +143,10 @@ window.__ModuleLoader__.load({
 		function UsageBadge(props) {
 			const { t } = props;
 			const state = props.useLocalTokenUsage((snapshot) => snapshot);
-			// The provider of the model this session will actually use. The hook only
-			// exists when the host composed model selection (Web); its presence is
-			// fixed at registration time, so this call order never changes at runtime.
-			const activeProvider = typeof props.useModelSelection === "function"
-				? props.useModelSelection((snapshot) => snapshot.current?.provider ?? null)
-				: null;
+			// The provider of the model this session will actually use. The controller
+			// always supplies this hook — backed by a standing empty selection when the
+			// host composed no model selection — so the call is unconditional.
+			const activeProvider = props.useModelSelection((snapshot) => snapshot.current?.provider ?? null);
 			const wrapRef = react.useRef(null);
 			const [pos, setPos] = react.useState(null);
 			react.useEffect(() => {
@@ -234,6 +252,9 @@ window.__ModuleLoader__.load({
 												entry.usage.credits === undefined || entry.usage.creditsUnlimited === true
 													? null
 													: jsx("p", { className: "ltk_hint", children: t("credits", { balance: String(entry.usage.credits) }) }),
+												agoOf(entry.usage.at).length === 0
+													? null
+													: jsx("p", { className: "ltk_hint", children: t("readAt", { when: agoOf(entry.usage.at) }) }),
 											],
 										}),
 								],
@@ -246,15 +267,55 @@ window.__ModuleLoader__.load({
 
 		/** Polls the host route; the snapshot only changes when a request happened. */
 		class UsageController {
-			/** @param directories - `ctx.modelDirectories`, or undefined off Web. */
-			constructor(directories) {
-				this.directories = directories;
+			/** @param ctx - the client root context; `modelDirectories` is read from
+			 * it per session rather than captured once, because whether the call
+			 * succeeds depends on when it happens (see `directoryFor`). */
+			constructor(ctx) {
+				this.ctx = ctx;
 				this.state = { open: false, providers: [], diag: undefined };
-				this.store = runtime.createSnapshotStore({ ...this.state });
+				this.store = clientStore.createSnapshotStore({ ...this.state });
+				/**
+				 * One standing selection store per session, mirroring the host
+				 * directory's `current` once we manage to reach it. The hook has to
+				 * name a store at registration time, but the directory is not reachable
+				 * that early — so the badge subscribes to this instead, and `bind`
+				 * fills it in later. Sessions whose directory never resolves keep the
+				 * `current: null` seed and fall back to the every-route view.
+				 */
+				this.selections = new Map();
+				this.unbind = new Map();
 				this.timer = undefined;
 				this.started = false;
 			}
 
+			/** The standing mirror for one session, created on first request. */
+			selectionFor(sessionId) {
+				const key = String(sessionId);
+				const existing = this.selections.get(key);
+				if (existing !== undefined) return existing;
+				const mirror = clientStore.createSnapshotStore({ current: null });
+				this.selections.set(key, mirror);
+				return mirror;
+			}
+
+			/**
+			 * Mirror the host's selection into this session's store, once.
+			 *
+			 * Idempotent and safe to retry: until the directory exists this is a no-op,
+			 * so the caller can simply keep asking.
+			 */
+			bind(sessionId) {
+				const key = String(sessionId);
+				if (this.unbind.has(key)) return;
+				const directory = this.directoryFor(sessionId);
+				if (directory === undefined) return;
+				const mirror = this.selectionFor(sessionId);
+				const copy = () => mirror.set({ current: directory.store.getSnapshot().current ?? null });
+				copy();
+				this.unbind.set(key, directory.store.subscribe(copy));
+				if (directory.store.getSnapshot().current === null) directory.load().catch(() => {});
+			}
+
 			publish(patch) {
 				this.state = { ...this.state, ...patch };
 				this.store.set({ ...this.state });
@@ -272,45 +333,58 @@ window.__ModuleLoader__.load({
 			}
 
 			/**
-			 * The session's shared model-selection store, or undefined when the host
-			 * composed no model selection or does not know this session. Both cases
-			 * degrade to the every-route view rather than failing the registration.
+			 * The session's shared model-selection directory, or undefined when it is
+			 * not reachable from here.
+			 *
+			 * Two ways it is not: the host composed no model selection at all, and —
+			 * the case that actually bites — nobody has built this session's directory
+			 * yet. Building one reads `remote.session` and `sessions` through the
+			 * *caller's* context, and this plugin deliberately injects neither, so
+			 * cordis refuses with "cannot get property \"remote.session\" without
+			 * inject". Once the composer's own model seat has built it, the resolver
+			 * answers from its cache and the same call succeeds. So this is not an
+			 * error to report, it is a "not yet" — hence `bind`'s retry.
 			 */
 			directoryFor(sessionId) {
-				if (this.directories === undefined || sessionId === undefined) return undefined;
+				if (sessionId === undefined) return undefined;
+				const directories = this.ctx.get("modelDirectories");
+				if (directories === undefined) return undefined;
 				try {
-					return this.directories.directoryFor(sessionId);
-				} catch (_unknownSession) {
+					return directories.directoryFor(sessionId);
+				} catch (_notReachableYet) {
 					return undefined;
 				}
 			}
 
 			inject(sessionId) {
-				const directory = this.directoryFor(sessionId);
 				return {
-					hooks: directory === undefined
-						? { localTokenUsage: this.store }
-						: { localTokenUsage: this.store, modelSelection: directory.store },
-					/**
-					 * `current` is null until something loads the directory. The composer
-					 * model seat normally does, but ask once so a fresh session shows the
-					 * right route instead of the union view.
-					 */
-					ensureSelection: () => {
-						if (directory === undefined) return;
-						if (directory.store.getSnapshot().current !== null) return;
-						directory.load().catch(() => {});
+					hooks: {
+						localTokenUsage: this.store,
+						modelSelection: this.selectionFor(sessionId),
 					},
+					/** Mount-time attempt; `start`'s tick covers a mount that lands first. */
+					ensureSelection: () => this.bind(sessionId),
 					start: () => {
+						this.bind(sessionId);
 						if (this.started) return;
 						this.started = true;
 						this.poll();
-						this.timer = setInterval(() => this.poll(), POLL_MS);
+						this.timer = setInterval(() => {
+							this.poll();
+							this.bind(sessionId);
+						}, POLL_MS);
 					},
 					stop: () => {
 						if (this.timer !== undefined) clearInterval(this.timer);
 						this.timer = undefined;
 						this.started = false;
+						// Drop the mirror subscription with the badge; `bind` re-establishes
+						// it on the next mount, and the mirror keeps its last value meanwhile.
+						const stopMirror = this.unbind.get(String(sessionId));
+						if (stopMirror !== undefined) {
+							stopMirror();
+							this.unbind.delete(String(sessionId));
+						}
 					},
 					toggle: () => {
 						const open = !this.state.open;
@@ -328,7 +402,7 @@ window.__ModuleLoader__.load({
 			// Optional on purpose: read the service rather than declaring it in
 			// `inject`, so a composition without model selection still loads this
 			// plugin (the badge then reports every route, as it always did).
-			const controller = new UsageController(ctx.get("modelDirectories"));
+			const controller = new UsageController(ctx);
 			// The quota badge is a clickable control, so it belongs in the input
 			// tool row (a list slot), beside the send button.
 			ctx.slots.inject("conversation.input.right", () => ctx.slots.register({

package/lib/index.js

@@ -13,14 +13,19 @@ import { LlmError } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { anthropicProvider } from "@earendil-works/pi-ai/providers/anthropic";
 import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
-import { defaultCodexAuthPath, resolveCodexAccessToken } from "./token-store.js";
+import { defaultCodexAuthPath, readCodexAuth, resolveCodexAccessToken } from "./token-store.js";
 import { defaultClaudeAuthPath, resolveClaudeAccessToken } from "./claude-keychain.js";
-import { withUsageProbe } from "./usage.js";
+import { anthropicUsage, codexUsage, withUsageProbe } from "./usage.js";
+import { probeAnthropicQuota, probeCodexQuota } from "./probe.js";
 
 /** Plugin identity used by the cordis loader entry. */
 export const name = "llm-local-token";
-/** Register only after the llm service exists. */
-export const inject = ["llm"];
+/**
+ * Register only after the llm service exists. `timer` joins it because cordis
+ * throws on reading ctx.setTimeout/setInterval unless the service is declared
+ * here; the base profile mounts cordis-plugin-timer.
+ */
+export const inject = ["llm", "timer"];
 /** Route prefix serving the quota snapshots to the browser. */
 const USAGE_PREFIX = "/llm-local-token";
 
@@ -61,6 +66,20 @@ function withApiKeyAuth(provider, name) {
 /** Transport values pi-ai's profile vocabulary accepts. */
 const TRANSPORTS = ["sse", "websocket", "websocket-cached", "auto"];
 
+/**
+ * The route-owned image request policy. pi-ai fills these from its own defaults
+ * only for config-declared providers; a `profiles` callback like ours is read
+ * verbatim, so an omitted field arrives as undefined and
+ * `dsh-attachment-local` rejects the request with "Image request maxPixels must
+ * be a positive integer" the moment any history entry carries an image. The
+ * values below are pi-ai's own defaults.
+ */
+const IMAGE_POLICY = {
+  maxRequestImageBytes: 20_971_520,
+  requestImagePixelBudget: 4_194_304,
+  requestImageMaxBytes: 1_048_576,
+};
+
 /**
  * Build one adapter profile in the shape PiAiAdapter expects.
  * @param transport - optional streaming transport preference; undefined leaves
@@ -74,6 +93,7 @@ function profileOf(provider, displayName, piProvider, transport) {
     retryPolicy: undefined,
     streamIdleTimeoutMs: 300_000,
     configuredMaxTokens: new Map(),
+    ...IMAGE_POLICY,
     ...(transport === undefined ? {} : { transport }),
   };
 }
@@ -112,12 +132,27 @@ export async function apply(ctx, config = {}) {
   if (codexTransport !== requestedTransport) {
     ctx.logger.info(`llm-local-token: ignoring unknown codexTransport "${requestedTransport}"; using "sse"`);
   }
+  /** The Codex endpoint wants the account id beside the token; absent is fine. */
+  const codexAccountId = async () => {
+    try {
+      const auth = await readCodexAuth(codexAuthPath);
+      return auth?.tokens?.account_id ?? auth?.account_id;
+    } catch {
+      return undefined;
+    }
+  };
   routes.push({
     provider: "openai-codex",
     displayName: "OpenAI Codex (local token)",
     piProvider: withUsageProbe(withApiKeyAuth(openaiCodexProvider(), "Codex local token"), record),
     resolveApiKey: async () => resolveCodexAccessToken(codexAuthPath),
     transport: codexTransport,
+    readQuota: codexUsage,
+    probe: async () => probeCodexQuota({
+      accessToken: await resolveCodexAccessToken(codexAuthPath),
+      accountId: await codexAccountId(),
+      model: config.usageProbeCodexModel,
+    }),
   });
 
   // ── Claude route: local Claude Code credentials (legacy file or Keychain) ─
@@ -132,6 +167,11 @@ export async function apply(ctx, config = {}) {
       displayName: "Claude (local token)",
       piProvider: withUsageProbe(anthropicProvider(), record),
       resolveApiKey: async () => resolveClaudeAccessToken({ filePath: claudeAuthPath, service: claudeKeychainService, account: config.claudeKeychainAccount }),
+      readQuota: anthropicUsage,
+      probe: async () => probeAnthropicQuota({
+        accessToken: await resolveClaudeAccessToken({ filePath: claudeAuthPath, service: claudeKeychainService, account: config.claudeKeychainAccount }),
+        model: config.usageProbeAnthropicModel,
+      }),
     });
   } catch (error) {
     if (config.requireClaude === true) throw error;
@@ -184,5 +224,73 @@ export async function apply(ctx, config = {}) {
     }), "llm-local-token: usage route");
     wctx.logger.info(`llm-local-token: usage route mounted at ${USAGE_PREFIX}/usage`);
   });
+  // ── Scheduled quota refresh ───────────────────────────────────────────────
+  //
+  // usage.js only reports what a real request happened to return, so the route
+  // you are not using reads "no data yet" indefinitely. These probes close that
+  // gap without polling the model: one bare minimal request per provider (see
+  // probe.js), on a schedule, carrying no prompt, skills, tools or history.
+  //
+  // A probe is a convenience and never a dependency: each failure is logged and
+  // swallowed, leaving the panel with whatever snapshot it already had.
+  const probeOnce = async (reason) => {
+    for (const route of routes) {
+      if (typeof route.probe !== "function") continue;
+      try {
+        const snapshot = route.readQuota(await route.probe());
+        if (snapshot === undefined) {
+          ctx.logger.info(`llm-local-token: ${route.provider} probe carried no quota headers`);
+          continue;
+        }
+        record(snapshot);
+        ctx.logger.info(`llm-local-token: refreshed ${route.provider} quota (${reason})`);
+      } catch (error) {
+        ctx.logger.info(`llm-local-token: ${route.provider} quota probe failed (${String(error?.message ?? error).slice(0, 160)})`);
+      }
+    }
+  };
+
+  // cordis's timer service disposes these with the plugin; the globals are only
+  // a fallback for a profile that did not load it.
+  const stops = [];
+  const after = (ms, fn) => {
+    if (typeof ctx.setTimeout === "function") return void ctx.setTimeout(fn, ms);
+    const handle = globalThis.setTimeout(fn, ms);
+    stops.push(() => globalThis.clearTimeout(handle));
+  };
+  const every = (ms, fn) => {
+    if (typeof ctx.setInterval === "function") return void ctx.setInterval(fn, ms);
+    const handle = globalThis.setInterval(fn, ms);
+    stops.push(() => globalThis.clearInterval(handle));
+  };
+  ctx.on("dispose", () => {
+    for (const stop of stops) stop();
+  });
+
+  if (config.usageProbe !== false) {
+    const atHour = Number(config.usageProbeAtHour);
+    const daily = Number.isInteger(atHour) && atHour >= 0 && atHour <= 23;
+
+    // A wall-clock schedule only fires while dsh happens to be running, and a
+    // desktop session is usually closed at 03:00 — so boot is its own trigger.
+    after(Number(config.usageProbeStartupDelayMs ?? 20000), () => void probeOnce("startup"));
+
+    if (daily) {
+      const next = new Date();
+      next.setHours(atHour, 0, 0, 0);
+      if (next.getTime() <= Date.now()) next.setDate(next.getDate() + 1);
+      after(next.getTime() - Date.now(), () => {
+        void probeOnce("daily");
+        every(86400000, () => void probeOnce("daily"));
+      });
+      ctx.logger.info(`llm-local-token: quota probe scheduled daily at ${String(atHour).padStart(2, "0")}:00 local`);
+    } else {
+      const requested = Number(config.usageProbeIntervalHours ?? 4);
+      const hours = Number.isFinite(requested) && requested > 0 ? requested : 4;
+      every(hours * 3600000, () => void probeOnce("interval"));
+      ctx.logger.info(`llm-local-token: quota probe scheduled every ${hours}h`);
+    }
+  }
+
   ctx.logger.info(`llm-local-token: registered ${routes.map((route) => route.provider).join(", ")} (codex auth: ${codexAuthPath}, codex transport: ${codexTransport})`);
 }

package/lib/probe.js

@@ -0,0 +1,84 @@
+// Bare quota probes.
+//
+// A snapshot only changes when a real request reports it (see usage.js), so a
+// route you never call shows nothing at all. These probes close that gap with
+// the smallest request each provider accepts: no system prompt, no skills, no
+// MCP tools, no conversation history, and nothing stored server-side. The reply
+// is discarded — the rate-limit headers are the only thing read back.
+//
+// Measured cost per probe: Codex 16 input tokens, Anthropic 8 input + 1 output.
+
+import { normalizeHeaders } from "./usage.js";
+
+const CODEX_ENDPOINT = "https://chatgpt.com/backend-api/codex/responses";
+const ANTHROPIC_ENDPOINT = "https://api.anthropic.com/v1/messages";
+
+/** Models are only a vehicle for the headers; both are overridable in config. */
+const CODEX_MODEL = "gpt-5.6-terra";
+const ANTHROPIC_MODEL = "claude-haiku-4-5-20251001";
+
+/**
+ * Take the headers and drop the body: the answer is never used, and cancelling
+ * early stops the stream instead of paying for tokens nobody reads.
+ */
+async function headersOnly(response) {
+  try {
+    await response.body?.cancel();
+  } catch {
+    // Already settled or uncancellable; the headers are in hand either way.
+  }
+  return normalizeHeaders(response.headers);
+}
+
+/**
+ * Ask ChatGPT's Codex endpoint for one period, purely to read `x-codex-*` back.
+ *
+ * Three constraints are load-bearing and were each found by being rejected:
+ * the endpoint answers only over SSE (the quota headers do not exist on the
+ * WebSocket transport), it rejects `max_output_tokens` outright with HTTP 400,
+ * and `store: false` is what keeps the probe out of the account's history.
+ * @returns normalized response headers.
+ */
+export async function probeCodexQuota({ accessToken, accountId, model = CODEX_MODEL }) {
+  const response = await fetch(CODEX_ENDPOINT, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${accessToken}`,
+      "content-type": "application/json",
+      accept: "text/event-stream",
+      "openai-beta": "responses=experimental",
+      originator: "codex_cli_rs",
+      ...(accountId === undefined || accountId === null ? {} : { "chatgpt-account-id": String(accountId) }),
+    },
+    body: JSON.stringify({
+      model,
+      instructions: "Reply with a single period.",
+      input: [{ type: "message", role: "user", content: [{ type: "input_text", text: "." }] }],
+      stream: true,
+      store: false,
+    }),
+  });
+  return headersOnly(response);
+}
+
+/**
+ * Ask Anthropic for one token, purely to read `anthropic-ratelimit-unified-*`.
+ *
+ * The free `/v1/messages/count_tokens` endpoint cannot serve this: it answers
+ * HTTP 200 and carries no rate-limit headers at all, so a real (if minimal)
+ * message is the only way to learn the numbers.
+ * @returns normalized response headers.
+ */
+export async function probeAnthropicQuota({ accessToken, model = ANTHROPIC_MODEL }) {
+  const response = await fetch(ANTHROPIC_ENDPOINT, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${accessToken}`,
+      "content-type": "application/json",
+      "anthropic-version": "2023-06-01",
+      "anthropic-beta": "oauth-2025-04-20",
+    },
+    body: JSON.stringify({ model, max_tokens: 1, messages: [{ role: "user", content: "." }] }),
+  });
+  return headersOnly(response);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-llm-local-token",
-  "version": "1.3.2",
+  "version": "1.4.1",
   "description": "DeepSeek Harness plugin: serve LLM calls with the OAuth tokens your local Codex CLI and Claude Code already hold, instead of a separately configured API key.",
   "keywords": [
     "deepseek-harness",
@@ -23,6 +23,7 @@
   },
   "files": [
     "lib/",
+    "!lib/*.bak*",
     "cordis.patch.yml",
     "README.md",
     "README.zh.md",