dsh-llm-local-token 1.4.1 → 1.5.0

package/README.md

@@ -13,10 +13,14 @@ usable model routes inside DSH.
 Both routes appear in the model picker as soon as the plugin loads. A route whose credential is
 missing is skipped instead of failing the boot.
 
+The usage badge additionally reports a **GLM Coding Plan** subscription, which DSH already serves
+through pi-ai's own `zai-coding-cn` route — the plugin adds the quota, not a second route, so the
+model picker gains no duplicate. See [Subscription usage badge](#subscription-usage-badge).
+
 <table>
 <tr>
 <td align="center" width="50%"><sub>Both subscriptions as routes in the model picker</sub><br><img src="https://raw.githubusercontent.com/tianxia--/dsh-llm-local-token/main/docs/model-routes.png" alt="The DSH model picker listing OpenAI Codex (local token) and Claude (local token) groups" width="330"></td>
-<td align="center" width="50%"><sub>Subscription usage, read from provider rate-limit headers</sub><br><img src="https://raw.githubusercontent.com/tianxia--/dsh-llm-local-token/main/docs/subscription-usage.png" alt="Subscription usage popover showing Claude and OpenAI Codex quota windows" width="400"></td>
+<td align="center" width="50%"><sub>Subscription usage for every subscription the plugin can see</sub><br><img src="https://raw.githubusercontent.com/tianxia--/dsh-llm-local-token/main/docs/subscription-usage.png" alt="Subscription usage popover showing GLM Coding Plan, OpenAI Codex and Claude quota windows" width="400"></td>
 </tr>
 </table>
 
@@ -84,19 +88,42 @@ All keys are optional; the defaults match a stock CLI install.
 | `usageProbeStartupDelayMs` | `20000` | Delay before the probe that runs at boot. A clock schedule only fires while dsh happens to be running, so boot is its own trigger. |
 | `usageProbeCodexModel` | `gpt-5.6-terra` | Model the Codex probe names; only a vehicle for the headers. |
 | `usageProbeAnthropicModel` | `claude-haiku-4-5-20251001` | Model the Anthropic probe names; only a vehicle for the headers. |
+| `glmQuota` | `true` | Report GLM Coding Plan quota. No route is registered either way — DSH already serves GLM. |
+| `glmApiKey` | — | GLM token, overriding every discovered source. |
+| `glmApiKeyEnv` | `ZAI_CODING_CN_API_KEY` | Environment variable and `$DSH_HOME/.credentials.yaml` ref consulted for the GLM token. |
+| `glmBaseDomain` | `https://open.bigmodel.cn` | Monitor host. `https://api.z.ai` is the international front; both answer the same body for the same account. |
 
 ## Subscription usage badge
 
-Both providers state their quota in response headers, so reading it off a real request costs
+Codex and Claude state their quota in response headers, so reading it off a real request costs
 nothing. A route you never call has nothing to report, though — so the plugin also refreshes on a
 schedule, with one deliberately tiny request per provider (16 input tokens for Codex, 9 for
 Anthropic) that carries no prompt, skills, tools or history and is never stored. A badge appears in
 the composer bar next to the context ring; click it for the breakdown.
 
-| Provider | Headers read | Shown |
+| Provider | Source | Shown |
 | --- | --- | --- |
 | `openai-codex` | `x-codex-primary-*`, `x-codex-secondary-*`, `x-codex-plan-type`, `x-codex-credits-balance` | plan, used % per window, reset countdown, credit balance |
 | `anthropic` | `anthropic-ratelimit-unified-{5h,7d}-{utilization,reset,status}` | used % for the 5-hour and 7-day windows, reset countdown |
+| `zai-coding-cn` | `GET /api/monitor/usage/quota/limit` | plan level, used % for the 5-hour and weekly token windows, and the MCP tool-call quota |
+
+GLM is the odd one out and deliberately so. DSH already serves it through pi-ai's built-in
+`zai-coding-cn` route, so this plugin contributes the quota half only — registering a route would
+put a duplicate GLM in the model picker. Its numbers come from the subscription's own monitor
+endpoint rather than response headers, so there is no probe request to pay for. modlens re-exposes
+every pi-ai route under a `modlens-` prefix as a separate picker entry, and the badge treats
+`modlens-zai-coding-cn` as the same subscription.
+
+GLM's credential is resolved in the order that keeps the number honest — the badge has to report
+the subscription the calls are actually billed to:
+
+1. `glmApiKey` in this plugin's config
+2. the `ZAI_CODING_CN_API_KEY` environment variable
+3. the same-named ref in `$DSH_HOME/.credentials.yaml` — what DSH itself calls with
+4. `~/.zcode/v2/credentials.json` → `oauth:bigmodel:access_token`, for a local `zcode` sign-in
+
+With none of those present the GLM row is skipped, exactly like a missing Codex or Claude
+credential. Set `glmQuota: false` to switch it off outright.
 
 The badge is green under 60%, amber under 85%, red above. Any reading older than a minute carries
 its age, because a 5-hour window resets about five times a day and a stale number that looks live

package/README.zh.md

@@ -11,10 +11,14 @@ Codex CLI 或 Claude Code，这些订阅就会变成 DSH 里可选的模型路
 
 插件加载后模型直接出现在模型选择器里。缺少凭据的路由会被跳过，不会导致启动失败。
 
+用量徽标另外还会报告 **GLM Coding Plan** 的订阅额度。GLM 的调用 DSH 已经通过 pi-ai 自带的
+`zai-coding-cn` 路由提供了，所以本插件只补上额度那一半，不会再注册一条路由——模型选择器里
+不会多出一个重复的 GLM。详见[订阅用量徽标](#订阅用量徽标)。
+
 <table>
 <tr>
 <td align="center" width="50%"><sub>两份订阅都成了模型选择器里的路由</sub><br><img src="https://raw.githubusercontent.com/tianxia--/dsh-llm-local-token/main/docs/model-routes.png" alt="DSH 模型选择器中的 OpenAI Codex (local token) 与 Claude (local token) 分组" width="330"></td>
-<td align="center" width="50%"><sub>订阅用量，来自 provider 的 rate-limit 响应头</sub><br><img src="https://raw.githubusercontent.com/tianxia--/dsh-llm-local-token/main/docs/subscription-usage.png" alt="订阅用量弹层，显示 Claude 与 OpenAI Codex 的配额窗口" width="400"></td>
+<td align="center" width="50%"><sub>订阅用量：插件能看到的每一份订阅</sub><br><img src="https://raw.githubusercontent.com/tianxia--/dsh-llm-local-token/main/docs/subscription-usage.png" alt="订阅用量弹层，显示 GLM Coding Plan、OpenAI Codex 与 Claude 的配额窗口" width="400"></td>
 </tr>
 </table>
 
@@ -79,17 +83,36 @@ agent-default-model:
 | `usageProbeStartupDelayMs` | `20000` | 启动探测的延迟。固定时间点只在 dsh 恰好运行时才触发，所以启动本身也是一个触发点。 |
 | `usageProbeCodexModel` | `gpt-5.6-terra` | Codex 探测使用的模型，仅作为拿响应头的载体。 |
 | `usageProbeAnthropicModel` | `claude-haiku-4-5-20251001` | Anthropic 探测使用的模型，仅作为拿响应头的载体。 |
+| `glmQuota` | `true` | 是否报告 GLM Coding Plan 额度。无论开关，都不会注册路由 —— DSH 已经自带 GLM 路由。 |
+| `glmApiKey` | — | 直接指定 GLM token，优先级高于所有自动发现的来源。 |
+| `glmApiKeyEnv` | `ZAI_CODING_CN_API_KEY` | 查找 GLM token 时使用的环境变量名，同时也是 `$DSH_HOME/.credentials.yaml` 里的 ref 名。 |
+| `glmBaseDomain` | `https://open.bigmodel.cn` | 额度接口所在域名。国际站是 `https://api.z.ai`；同一账号下两个域名返回的内容完全一致。 |
 
 ## 订阅用量徽标
 
-两家 provider 都在响应头里返回额度状态，所以真实请求顺带就能读到。但你从没调用过的那条路由无从上报 ——
+Codex 与 Claude 都在响应头里返回额度状态，所以真实请求顺带就能读到。但你从没调用过的那条路由无从上报 ——
 因此插件还会**定时刷新**：每个 provider 发一个刻意做到最小的请求（Codex 16 个输入 token、Anthropic 9 个），
 不带 prompt、skill、工具与历史，也不落存储。输入框工具条上（上下文圆环旁边）会出现一个徽标，点开看明细。
 
-| Provider | 读取的响应头 | 展示内容 |
+| Provider | 数据来源 | 展示内容 |
 | --- | --- | --- |
 | `openai-codex` | `x-codex-primary-*`、`x-codex-secondary-*`、`x-codex-plan-type`、`x-codex-credits-balance` | 套餐、各窗口已用百分比、重置倒计时、点数余额 |
 | `anthropic` | `anthropic-ratelimit-unified-{5h,7d}-{utilization,reset,status}` | 5 小时与 7 天窗口的已用百分比、重置倒计时 |
+| `zai-coding-cn` | `GET /api/monitor/usage/quota/limit` | 套餐等级、5 小时与每周 token 窗口的已用百分比、MCP 工具调用配额 |
+
+GLM 是个例外，而且是刻意为之。DSH 已经通过 pi-ai 内置的 `zai-coding-cn` 路由提供 GLM 调用，
+所以本插件只补额度那一半 —— 再注册一条路由只会让模型选择器里多出一个重复的 GLM。它的数字来自订阅
+自己的额度接口而不是响应头，因此不需要付出任何探测请求的代价。另外 modlens 会把每条 pi-ai 路由都加上
+`modlens-` 前缀再暴露成一个独立条目，徽标会把 `modlens-zai-coding-cn` 视作同一份订阅。
+
+GLM 的凭据按下面的顺序解析，这个顺序保证数字是诚实的 —— 徽标必须报告**真正在扣费的那份订阅**：
+
+1. 本插件配置里的 `glmApiKey`
+2. 环境变量 `ZAI_CODING_CN_API_KEY`
+3. `$DSH_HOME/.credentials.yaml` 里的同名 ref —— DSH 自己调用时用的就是它
+4. `~/.zcode/v2/credentials.json` 的 `oauth:bigmodel:access_token`，对应本地 `zcode` 登录
+
+一个都找不到就跳过 GLM 那一行，和缺少 Codex / Claude 凭据时的处理一致。设 `glmQuota: false` 可彻底关闭。
 
 低于 60% 显示绿色，低于 85% 琥珀色，更高显示红色。超过一分钟的数值会标注**读取时间** —— 5 小时窗口每天
 重置约五次，一个看起来实时的过期数字比没有数字更糟。浏览器端每 15 秒轮询 `GET /llm-local-token/usage`，

package/lib/client.js

@@ -48,6 +48,7 @@ window.__ModuleLoader__.load({
 			label: "Quota", title: "Subscription usage",
 			"window.primary": "Primary", "window.secondary": "Secondary",
 			"window.5h": "5 hours", "window.7d": "7 days",
+			"window.tokens": "Tokens", "window.mcp": "MCP calls",
 			empty: "No data yet — send one message to read your quota.",
 			resets: "resets {when}", credits: "credits: {balance}",
 			current: "current",
@@ -58,6 +59,7 @@ window.__ModuleLoader__.load({
 			label: "额度", title: "订阅用量",
 			"window.primary": "主窗口", "window.secondary": "次窗口",
 			"window.5h": "5 小时", "window.7d": "7 天",
+			"window.tokens": "Token 额度", "window.mcp": "MCP 调用",
 			empty: "暂无数据 —— 发一条消息即可读取额度。",
 			resets: "{when}重置", credits: "点数余额：{balance}",
 			current: "当前",
@@ -186,10 +188,16 @@ window.__ModuleLoader__.load({
 			}, [state.open]);
 
 			const withData = state.providers.filter((entry) => entry.usage !== null);
-			/** The route serving the selected model, when this plugin owns it. */
+			/**
+			 * The entry covering the selected model. Matching allows aliases because
+			 * one subscription can surface under several picker ids — modlens
+			 * re-exposes every route under a `modlens-` prefix, and that wrapper bills
+			 * the same account as the route it wraps.
+			 */
+			const covers = (entry, provider) => entry.provider === provider || (entry.aliases ?? []).includes(provider);
 			const active = activeProvider === null
 				? undefined
-				: state.providers.find((entry) => entry.provider === activeProvider);
+				: state.providers.find((entry) => covers(entry, activeProvider));
 			/**
 			 * The selected model belongs to some other adapter (a plain API key, a
 			 * different plugin): this badge owns no quota fact about it, so it says
@@ -234,13 +242,13 @@ window.__ModuleLoader__.load({
 						children: [
 							jsx("p", { className: "ltk_title", children: t("title") }),
 							...ordered.map((entry) => jsxs("div", {
-								className: activeProvider !== null && entry.provider !== activeProvider ? "ltk_prov ltk_provDim" : "ltk_prov",
+								className: activeProvider !== null && !covers(entry, activeProvider) ? "ltk_prov ltk_provDim" : "ltk_prov",
 								children: [
 									jsxs("div", {
 										className: "ltk_provHead",
 										children: [
 											jsx("span", { className: "ltk_provName", children: entry.displayName }),
-											entry.provider !== activeProvider ? null : jsx("span", { className: "ltk_cur", children: t("current") }),
+											activeProvider === null || !covers(entry, activeProvider) ? null : jsx("span", { className: "ltk_cur", children: t("current") }),
 											entry.usage?.plan === undefined ? null : jsx("span", { className: "ltk_plan", children: entry.usage.plan }),
 										],
 									}),
@@ -248,7 +256,10 @@ window.__ModuleLoader__.load({
 										? jsx("p", { className: "ltk_hint", children: t("empty") })
 										: jsxs("div", {
 											children: [
-												...entry.usage.windows.map((w) => jsx(UsageRow, { t, entry: w }, w.label)),
+												// Keyed by position: a provider may report two windows of the
+												// same kind (GLM sends two token windows), so the label is not
+												// unique and the order is stable.
+												...entry.usage.windows.map((w, index) => jsx(UsageRow, { t, entry: w }, index)),
 												entry.usage.credits === undefined || entry.usage.creditsUnlimited === true
 													? null
 													: jsx("p", { className: "ltk_hint", children: t("credits", { balance: String(entry.usage.credits) }) }),

package/lib/glm.js

@@ -0,0 +1,165 @@
+// GLM Coding Plan quota.
+//
+// This one is quota-only, and deliberately so: dsh already serves GLM through
+// pi-ai's built-in `zai-coding-cn` route, so registering another would put a
+// duplicate GLM in the model picker. What is missing without this file is the
+// other half — the badge can only speak about a provider it holds a snapshot
+// for, so selecting GLM used to blank it out.
+//
+// The numbers come from the subscription's own monitor endpoint, the same one
+// @z_ai/coding-helper's usage-query skill calls. Verified against both fronts
+// (api.z.ai and open.bigmodel.cn) with the same account: identical bodies down
+// to the reset epochs, so one parser serves either.
+
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+/** The pi-ai route id dsh calls GLM through. */
+export const GLM_PROVIDER = "zai-coding-cn";
+/**
+ * Other ids the same subscription answers for. modlens re-exposes every pi-ai
+ * route under a `modlens-` prefix as a separate picker entry, so the session can
+ * report either id for what is one account and one quota.
+ */
+export const GLM_ALIASES = ["modlens-zai-coding-cn"];
+
+/** Mainland front; `api.z.ai` serves the same account and the same body. */
+const DEFAULT_BASE = "https://open.bigmodel.cn";
+const QUOTA_PATH = "/api/monitor/usage/quota/limit";
+
+/**
+ * Minutes per `unit` code, for the codes that are actually pinned down.
+ *
+ * `3` is the hour: `unit: 3, number: 5` was observed resetting in 4.96h, and
+ * @z_ai/coding-helper labels that same row "5 Hour".
+ *
+ * `6` is the week. Both dated windows reset at the same wall-clock second, and
+ * taking the monthly row's reset minus one month gives an anchor that lands
+ * exactly 3.0000 weeks before the `unit: 6` reset — one subscription anchor
+ * explains both only if this is a weekly cycle.
+ *
+ * `5` (the vendor's "1 Month") is left out on purpose rather than for lack of
+ * evidence. It meters MCP tool calls, and a window carrying `windowMinutes`
+ * renders as its duration — so mapping it would replace the informative
+ * "MCP calls" with a bare "30 days" and lose what the row is about.
+ */
+const UNIT_MINUTES = { 3: 60, 6: 10080 };
+
+function readJson(path) {
+  return readFile(path, "utf8").then(JSON.parse);
+}
+
+/**
+ * The token for the quota query, in the order that keeps the number honest.
+ *
+ * The badge must report the subscription the calls are actually billed to, so
+ * the key dsh itself calls with wins; the local zcode CLI's OAuth is the
+ * fallback for someone who signed in there instead of pasting a key.
+ * @returns the token, or undefined when this machine has no GLM credential.
+ */
+export async function resolveGlmToken(config = {}) {
+  if (typeof config.glmApiKey === "string" && config.glmApiKey.length > 0) return config.glmApiKey;
+
+  const fromEnv = process.env[config.glmApiKeyEnv ?? "ZAI_CODING_CN_API_KEY"];
+  if (typeof fromEnv === "string" && fromEnv.length > 0) return fromEnv;
+
+  // dsh's own credential store, where `apiKeyEnv: ZAI_CODING_CN_API_KEY`
+  // resolves from. Read the one named ref rather than parsing the document: the
+  // file also holds unrelated secrets and has no business being loaded whole.
+  try {
+    const store = await readFile(config.dshCredentialsPath ?? join(homedir(), ".dsh", ".credentials.yaml"), "utf8");
+    const ref = new RegExp(`^\\s*${config.glmApiKeyEnv ?? "ZAI_CODING_CN_API_KEY"}:\\s*(.+)$`, "m").exec(store);
+    const value = ref?.[1]?.trim().replace(/^["']|["']$/g, "");
+    if (value !== undefined && value.length > 0) return value;
+  } catch {
+    // Absent or unreadable; the CLI fallbacks below may still answer.
+  }
+
+  try {
+    const zcode = await readJson(config.zcodeCredentialsPath ?? join(homedir(), ".zcode", "v2", "credentials.json"));
+    const oauth = zcode?.["oauth:bigmodel:access_token"];
+    if (typeof oauth === "string" && oauth.length > 0) return oauth;
+  } catch {
+    // zcode not installed or never signed in.
+  }
+
+  return undefined;
+}
+
+/** Base domain for the monitor endpoint; the account decides which front. */
+export function glmBaseDomain(config = {}) {
+  const base = config.glmBaseDomain ?? DEFAULT_BASE;
+  return String(base).replace(/\/+$/, "");
+}
+
+/**
+ * Fetch the quota document.
+ * @returns the parsed body, for `glmUsage` to read.
+ */
+export async function probeGlmQuota({ token, baseDomain = DEFAULT_BASE }) {
+  const response = await fetch(`${baseDomain}${QUOTA_PATH}`, {
+    // The token goes in bare — this endpoint does not take a `Bearer` prefix.
+    headers: { authorization: token, "content-type": "application/json" },
+  });
+  if (!response.ok) throw new Error(`GLM quota HTTP ${response.status}`);
+  return response.json();
+}
+
+/**
+ * Name a row by what it meters, since only some window lengths are knowable.
+ *
+ * Repeats are fine and expected — two token windows of different lengths both
+ * answer "tokens". The one whose length is known renders from `windowMinutes`
+ * instead, and the panel keys rows by position rather than by this string.
+ */
+function kindOf(limit) {
+  return limit?.type === "TIME_LIMIT" ? "mcp" : "tokens";
+}
+
+/**
+ * Read the quota document into the shape the panel renders.
+ * @param body - the parsed `/api/monitor/usage/quota/limit` response.
+ * @returns the snapshot, or undefined when the body carried no usable limit.
+ */
+export function glmUsage(body) {
+  const limits = body?.data?.limits;
+  if (!Array.isArray(limits)) return undefined;
+
+  const windows = [];
+  for (const limit of limits) {
+    // `percentage` is 0..100 and counts what is USED, not what is left: the
+    // metered row reports currentValue 33 of usage 1000 alongside percentage 3.
+    const percent = Number(limit?.percentage);
+    if (!Number.isFinite(percent)) continue;
+
+    const unitMinutes = UNIT_MINUTES[limit?.unit];
+    const count = Number(limit?.number);
+    const minutes = unitMinutes === undefined || !Number.isFinite(count) ? undefined : unitMinutes * count;
+
+    // `nextResetTime` is epoch MILLISECONDS here, unlike the seconds the Codex
+    // and Anthropic headers carry — so it is not scaled on the way in.
+    const reset = Number(limit?.nextResetTime);
+
+    windows.push({
+      label: kindOf(limit),
+      used: Math.max(0, Math.min(percent / 100, 1)),
+      ...(minutes === undefined ? {} : { windowMinutes: minutes }),
+      ...(Number.isFinite(reset) && reset > 0 ? { resetAt: new Date(reset).toISOString() } : {}),
+    });
+  }
+  if (windows.length === 0) return undefined;
+
+  // Token windows first. The badge headlines the first two, and the endpoint
+  // happens to lead with the MCP row — which would put a tool-call count in
+  // front of the number that actually moves when you send a message.
+  windows.sort((a, b) => Number(a.label === "mcp") - Number(b.label === "mcp"));
+
+  const level = body?.data?.level;
+  return {
+    provider: GLM_PROVIDER,
+    ...(typeof level === "string" && level.length > 0 ? { plan: level } : {}),
+    windows,
+    at: new Date().toISOString(),
+  };
+}

package/lib/index.js

@@ -17,6 +17,7 @@ import { defaultCodexAuthPath, readCodexAuth, resolveCodexAccessToken } from "./
 import { defaultClaudeAuthPath, resolveClaudeAccessToken } from "./claude-keychain.js";
 import { anthropicUsage, codexUsage, withUsageProbe } from "./usage.js";
 import { probeAnthropicQuota, probeCodexQuota } from "./probe.js";
+import { GLM_ALIASES, GLM_PROVIDER, glmBaseDomain, glmUsage, probeGlmQuota, resolveGlmToken } from "./glm.js";
 
 /** Plugin identity used by the cordis loader entry. */
 export const name = "llm-local-token";
@@ -104,6 +105,14 @@ function profileOf(provider, displayName, piProvider, transport) {
  */
 export async function apply(ctx, config = {}) {
   const routes = [];
+  /**
+   * Providers this plugin reports quota for but does not serve.
+   *
+   * Kept apart from `routes` on purpose: `registerAdapter` claims every id it is
+   * given, so listing a provider dsh already serves would have this plugin fight
+   * pi-ai for it. These entries only ever contribute a snapshot.
+   */
+  const quotaOnly = [];
   /** Latest quota snapshot per provider id, replaced on every observed response. */
   const usage = new Map();
   /**
@@ -178,6 +187,29 @@ export async function apply(ctx, config = {}) {
     ctx.logger.info(`llm-local-token: Claude local token not usable (${String(error?.message ?? error).slice(0, 160)}); skipping Claude provider`);
   }
 
+  // ── GLM quota: dsh already serves this route, so only the numbers are ours ─
+  //
+  // The credential is resolved once here to decide whether to report at all;
+  // each probe resolves again so a rotated key or a fresh zcode sign-in lands
+  // without a restart.
+  if (config.glmQuota !== false) {
+    const glmToken = await resolveGlmToken(config);
+    if (glmToken === undefined) {
+      ctx.logger.info("llm-local-token: no GLM credential found (set glmApiKey, ZAI_CODING_CN_API_KEY, or sign in with zcode); skipping GLM quota");
+    } else {
+      quotaOnly.push({
+        provider: GLM_PROVIDER,
+        aliases: GLM_ALIASES,
+        displayName: "GLM Coding Plan",
+        readQuota: glmUsage,
+        probe: async () => probeGlmQuota({
+          token: (await resolveGlmToken(config)) ?? glmToken,
+          baseDomain: glmBaseDomain(config),
+        }),
+      });
+    }
+  }
+
   const profiles = () => new Map(routes.map((route) => [
     route.provider,
     profileOf(route.provider, route.displayName, route.piProvider, route.transport),
@@ -201,6 +233,9 @@ export async function apply(ctx, config = {}) {
 
   ctx.llm.registerAdapter(routes.map((route) => route.provider), adapter);
 
+  /** Everything the panel speaks about: routes we serve, plus quota-only entries. */
+  const reported = [...routes, ...quotaOnly];
+
   // Quota snapshots observed on real responses, newest per provider.
   ctx.inject(["webServer"], (wctx) => {
     wctx.effect(() => wctx.webServer.register({
@@ -212,8 +247,9 @@ export async function apply(ctx, config = {}) {
           return sendJson(res, 404, { error: `unknown route "${path}"` });
         }
         return sendJson(res, 200, {
-          providers: routes.map((route) => ({
+          providers: reported.map((route) => ({
             provider: route.provider,
+            ...(route.aliases === undefined ? {} : { aliases: route.aliases }),
             displayName: route.displayName,
             usage: usage.get(route.provider) ?? null,
           })),
@@ -234,12 +270,12 @@ export async function apply(ctx, config = {}) {
   // A probe is a convenience and never a dependency: each failure is logged and
   // swallowed, leaving the panel with whatever snapshot it already had.
   const probeOnce = async (reason) => {
-    for (const route of routes) {
+    for (const route of reported) {
       if (typeof route.probe !== "function") continue;
       try {
         const snapshot = route.readQuota(await route.probe());
         if (snapshot === undefined) {
-          ctx.logger.info(`llm-local-token: ${route.provider} probe carried no quota headers`);
+          ctx.logger.info(`llm-local-token: ${route.provider} probe carried no quota data`);
           continue;
         }
         record(snapshot);
@@ -292,5 +328,6 @@ export async function apply(ctx, config = {}) {
     }
   }
 
-  ctx.logger.info(`llm-local-token: registered ${routes.map((route) => route.provider).join(", ")} (codex auth: ${codexAuthPath}, codex transport: ${codexTransport})`);
+  const quotaNote = quotaOnly.length === 0 ? "" : `; quota-only: ${quotaOnly.map((entry) => entry.provider).join(", ")}`;
+  ctx.logger.info(`llm-local-token: registered ${routes.map((route) => route.provider).join(", ")}${quotaNote} (codex auth: ${codexAuthPath}, codex transport: ${codexTransport})`);
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-llm-local-token",
-  "version": "1.4.1",
-  "description": "DeepSeek Harness plugin: serve LLM calls with the OAuth tokens your local Codex CLI and Claude Code already hold, instead of a separately configured API key.",
+  "version": "1.5.0",
+  "description": "DeepSeek Harness plugin: serve LLM calls with the OAuth tokens your local Codex CLI and Claude Code already hold, instead of a separately configured API key — plus a composer badge showing subscription usage for those routes and for GLM Coding Plan.",
   "keywords": [
     "deepseek-harness",
     "dsh",
@@ -10,7 +10,10 @@
     "llm",
     "codex",
     "claude",
-    "oauth"
+    "oauth",
+    "glm",
+    "zai",
+    "quota"
   ],
   "license": "MIT",
   "type": "module",