dsh-plugin-weapp-gateway 0.8.13 → 0.8.23

package/lib/vendor/cost-meter/net.mjs

@@ -0,0 +1,183 @@
+/**
+ * 对外 HTTP 请求的统一重试封装(issue #28)。
+ * opencode.ai 等端点部署在 Cloudflare 之后会间歇性重置连接(ECONNRESET),
+ * Node fetch 统一抛为 `fetch failed`;对这类瞬时网络错误做少量重试即可消除
+ * 面板偶发报错,而 401/403 等业务错误重试无意义,仍由调用方原样处理。
+ */
+
+import { gunzipSync } from 'node:zlib'
+
+/** 视为瞬时的网络错误码(Node DNS/socket 层 + undici 内部码)。 */
+const TRANSIENT_CODES = new Set([
+  'ECONNRESET', 'ECONNREFUSED', 'ETIMEDOUT', 'ENOTFOUND', 'EHOSTUNREACH',
+  'ENETUNREACH', 'EPIPE', 'EAI_AGAIN',
+  'UND_ERR_SOCKET', 'UND_ERR_CONNECT_TIMEOUT', 'UND_ERR_HEADERS_TIMEOUT',
+  'UND_ERR_BODY_TIMEOUT', 'UND_ERR_READ_ERROR', 'UND_ERR_ABORTED',
+])
+
+/**
+ * 判定 fetch 抛出的错误是否为瞬时网络错误(值得重试)。
+ * @param {unknown} error - fetch reject 的错误。
+ */
+export function isTransientFetchError(error) {
+  if (typeof error !== 'object' || error === null) return false
+  // 超时信号两种历史形态均可安全重试:AbortSignal.timeout 抛 DOMException
+  // TimeoutError;老版本 undici 把超时包成 AbortError + cause.code
+  // === 'UND_ERR_ABORTED'。其余裸 AbortError 是调用方手动取消,重试既无意义
+  // 也违背取消意图,不再重试(本插件内部调用方目前只传超时信号,保持如此)。
+  if (error.name === 'TimeoutError') return true
+  if (error.name === 'AbortError') return error.cause?.code === 'UND_ERR_ABORTED'
+  const code = error.cause?.code ?? error.code
+  // 有具体 code 时以白名单为准:证书过期(EPERM/CERT_*)等持久性错误不重试。
+  if (typeof code === 'string') return TRANSIENT_CODES.has(code)
+  // 无具体 code 的纯 'fetch failed'(TypeError)按瞬时处理。
+  return error instanceof TypeError && String(error.message ?? '').includes('fetch failed')
+}
+
+/** 退避也响应调用方取消，及时清理计时器与监听器。 */
+const sleep = (ms, signal) => new Promise((resolve, reject) => {
+  const abort = () => { clearTimeout(timer); reject(signal.reason) }
+  const timer = setTimeout(() => { signal?.removeEventListener('abort', abort); resolve() }, ms)
+  if (signal?.aborted) abort()
+  else signal?.addEventListener('abort', abort, { once: true })
+})
+
+/**
+ * 带重试的 fetch:仅对瞬时网络错误自动重试(默认共 4 次尝试,退避 300/600/1200ms,
+ * 上限 1500ms),其余错误与 HTTP 状态码原样交回调用方(业务语义各自判断)。
+ * 每次尝试用 timeoutMs 新建超时信号——重试若复用已中止的 AbortSignal.timeout
+ * 会立即再抛 AbortError,重试形同虚设。
+ * @param {string} url - 请求地址。
+ * @param {RequestInit} [init] - fetch init(headers/method/body 等);未显式指定
+ *   accept-encoding 时默认注入 identity(见函数首注释)。
+ * @param {{ attempts?: number, backoffMs?: number, timeoutMs?: number }} [options]
+ *   - attempts:总尝试次数(含首次),默认 4。
+ *   - backoffMs:退避基数,默认 300(实际等待 backoffMs * 2^(尝试序-2))。
+ *   - timeoutMs:单次尝试超时;>0 时覆盖 init.signal,默认 0(沿用调用方信号)。
+ */
+export async function fetchWithRetry(url, init = {}, { attempts = 4, backoffMs = 300, timeoutMs = 0, fetchImpl = fetch } = {}) {
+  // 部分 CDN(实测 api.commandcode.ai:DSH 0.1.7 宿主的全局 undici 8 dispatcher
+  // 默认在请求头里协商 br)会返回压缩响应体却丢失 Content-Encoding 响应头——
+  // 违反 HTTP 语义,fetch 因此不做自动解压,response.json() 对着压缩字节直接报
+  // 「额度响应无法读取为有效 JSON」。brotli 流没有可靠魔数,事后嗅探无法稳健
+  // 补救(与 #172/#173 的裸 gzip 场景同族但更难防);这些接口的响应都很小,压缩
+  // 本无收益,故调用方未显式指定时统一默认 accept-encoding: identity 关闭
+  // 内容协商,从请求侧根除,显式指定的值不被覆盖。仅对纯对象形态的 headers
+  // 注入(本仓库所有调用方均如此)且不改其形状,Headers 实例等其余形态原样透传。
+  const headers = init.headers
+  if (headers === undefined || headers === null) {
+    init = { ...init, headers: { 'accept-encoding': 'identity' } }
+  } else if (typeof headers === 'object' && typeof headers.entries !== 'function'
+    && !Object.keys(headers).some(name => name.toLowerCase() === 'accept-encoding')) {
+    init = { ...init, headers: { ...headers, 'accept-encoding': 'identity' } }
+  }
+  const request = typeof fetchImpl === 'function' ? fetchImpl : fetch
+  for (let attempt = 1; ; attempt++) {
+    init.signal?.throwIfAborted()
+    if (attempt > 1) await sleep(Math.min(1500, backoffMs * 2 ** (attempt - 2)), init.signal)
+    let perAttempt = init
+    if (timeoutMs > 0) {
+      // 超时信号不得吞掉调用方的取消信号:两者并存时用 AbortSignal.any 组合
+      // (任一触发即中止);运行时不支持 any 时退回旧行为(仅超时信号)。
+      const timeoutSignal = AbortSignal.timeout(timeoutMs)
+      const signal = init.signal !== undefined && init.signal !== null && typeof AbortSignal.any === 'function'
+        ? AbortSignal.any([init.signal, timeoutSignal])
+        : timeoutSignal
+      perAttempt = { ...init, signal }
+    }
+    try {
+      return await request(url, perAttempt)
+    } catch (error) {
+      if (init.signal?.aborted) throw init.signal.reason
+      if (!isTransientFetchError(error) || attempt >= attempts) throw error
+    }
+  }
+}
+
+/**
+ * 裸 gzip 正文的解压兜底(issue #172):个别 CDN 边缘(实测 MiFE/3.4.34)会返回
+ * gzip 压缩字节却不带 Content-Encoding/Content-Type;undici 只按 Content-Encoding
+ * 解码,这类正文会以乱码进入 JSON.parse,报 "response body is not valid JSON"。
+ * JSON 文本不可能以 gzip 魔数(1f 8b)开头,按魔数识别无误判风险;解压输出同样受
+ * maxBytes 约束(maxOutputLength),压缩体膨胀超限按 tooLarge 处理,防止小压缩体
+ * 绕过读取上限;解压失败(伪魔数/损坏流)保留原字节,交给 JSON.parse 统一报
+ * 不回显正文的解析错误。
+ */
+const decodeBoundedBody = (buffer, maxBytes, tooLarge) => {
+  if (buffer.length < 2 || buffer[0] !== 0x1f || buffer[1] !== 0x8b) return buffer
+  try { return gunzipSync(buffer, { maxOutputLength: maxBytes }) }
+  catch (error) {
+    if (error?.code === 'ERR_BUFFER_TOO_LARGE') throw tooLarge()
+    return buffer
+  }
+}
+
+/** 流式限制实际响应体，不依赖可能缺失或不准确的 Content-Length。 */
+export async function readJsonBounded(response, maxBytes = 262144) {
+  const tooLarge = () => Object.assign(new Error('response body is too large'), { code: 'RESPONSE_TOO_LARGE' })
+  const parse = text => {
+    try { return JSON.parse(text) } catch { throw new Error('response body is not valid JSON') }
+  }
+  if (Number(response.headers?.get?.('content-length')) > maxBytes) {
+    try { await response.body?.cancel?.() } catch { /* 清理失败不掩盖长度错误。 */ }
+    throw tooLarge()
+  }
+  if (response.body?.[Symbol.asyncIterator]) {
+    const chunks = []
+    let bytes = 0
+    for await (const chunk of response.body) {
+      const buffer = Buffer.from(chunk)
+      bytes += buffer.length
+      if (bytes > maxBytes) throw tooLarge()
+      chunks.push(buffer)
+    }
+    return parse(decodeBoundedBody(Buffer.concat(chunks), maxBytes, tooLarge).toString('utf8'))
+  }
+  // 兼容没有流接口的 adapter/测试替身；标准 Node Response 均走上面的有界流读取。
+  const text = typeof response.text === 'function' ? await response.text() : JSON.stringify(await response.json())
+  if (typeof text !== 'string' || Buffer.byteLength(text, 'utf8') > maxBytes) throw tooLarge()
+  return parse(text)
+}
+
+// ── 请求头密钥判定(v1.7.9 自 store.js 迁入) ─────────────────────────────
+//
+// 本模块是插件的零本地依赖底层(store / custom-balance / coding-plans / gateway
+// 都只依赖 net),这里存放共享判定可避免「coding-plans → custom-balance →
+// store → plan-billing → coding-plans」的 ESM 环(v1.7.6 引入环边 custom-balance
+// → store;v1.7.8 在 DSH Desktop 的加载顺序下爆发 TDZ:
+// Cannot access 'CODING_PLAN_PROVIDER_IDS' before initialization)。
+// 共享判定避免各条持久化、回传和请求路径的安全规则分叉。
+
+/** {{VAR}} 占位符形态(与 custom-balance.js resolveTemplateString 同一文法)。 */
+const HEADER_PLACEHOLDER_RE = /\{\{\s*[A-Za-z_][A-Za-z0-9_]*\s*\}\}/
+
+/** 敏感头名:这类头下的非占位符值一律按密钥处理(自定义余额场景里它们就是凭据)。 */
+const SENSITIVE_HEADER_NAME_RE = /authorization|api[-_]?key|apikey|token|secret|cookie|session|credential|private[-_]?key/i
+
+/** 典型密钥值形状:sk- 系 / Google AIza / GitHub ghp_ / Slack xoxb- / JWT eyJ 头。 */
+const KNOWN_KEY_VALUE_RE = /^(sk-[A-Za-z0-9_-]|rk-[A-Za-z0-9_-]|gsk_[A-Za-z0-9]|AIza[0-9A-Za-z_-]{10,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[bap]-|eyJ[A-Za-z0-9_-]{10,})/
+
+/**
+ * 判定一个请求头的值是否疑似明文密钥(issue #86)。
+ * 两级判定:敏感头名(authorization / api-key / token 等)的非占位符值一律视为密钥;
+ * 其余头名只在值具备典型密钥形状(Bearer 前缀 / 已知 key 前缀 / ≥32 位混合字母数字的
+ * 不透明长串)时判密钥——Content-Type、Accept 等普通值不会误判(误判会让该头无法落盘)。
+ * @param {unknown} name - 头名。
+ * @param {unknown} value - 头值。
+ * @returns {boolean}
+ */
+export function looksLikeSecretHeaderValue(name, value) {
+  if (typeof value !== 'string' || value.length === 0) return false
+  // 只能豁免纯引用及常见认证前缀；追加一个占位符不能使已有明文密钥绕过脱敏。
+  if (HEADER_PLACEHOLDER_RE.test(value)) {
+    const literal = value.replace(new RegExp(HEADER_PLACEHOLDER_RE.source, 'g'), '').trim()
+    if (/^(?:(?:bearer|basic|token)\s*)?[:\s]*$/i.test(literal)) return false
+    value = literal
+  }
+  if (SENSITIVE_HEADER_NAME_RE.test(String(name ?? ''))) return true
+  const trimmed = value.trim()
+  if (/^(bearer|basic|token)\s+\S/i.test(trimmed)) return true
+  if (KNOWN_KEY_VALUE_RE.test(trimmed)) return true
+  if (trimmed.length >= 32 && /^[A-Za-z0-9_-]+$/.test(trimmed) && /[A-Za-z]/.test(trimmed) && /[0-9]/.test(trimmed)) return true
+  return false
+}

package/lib/vendor/cost-meter/opendesign.mjs

@@ -0,0 +1,204 @@
+/** OpenDesign public list prices and workspace-scoped, read-only billing queries. */
+import { fetchWithRetry, readJsonBounded } from './net.mjs'
+
+export const OPENDESIGN_API = 'https://amr-api.open-design.ai/api/v1'
+export const OPENDESIGN_PRICES_URL = OPENDESIGN_API + '/public/model-prices'
+export const OPENDESIGN_PROVIDER_IDS = ['opendesign', 'open-design', 'open-design-api', 'amr-link.open-design.ai']
+/** Machine-readable query failure codes so callers/logs can distinguish causes without parsing text. */
+export const OPEN_DESIGN_QUOTA_FAILURES = Object.freeze({
+  invalidRequest: 'invalid_request',
+  unauthorized: 'unauthorized',
+  http: 'http_error',
+  noSubscription: 'no_subscription',
+  invalidResponse: 'invalid_response',
+  network: 'network_error',
+  identityMismatch: 'identity_mismatch',
+})
+const object = value => value !== null && typeof value === 'object' && !Array.isArray(value)
+const rate = value => typeof value === 'number' && Number.isFinite(value) && value >= 0 && value <= 1e6
+const id = value => typeof value === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$/.test(value)
+const queryError = (message, soft = false, code) => Object.assign(new Error(message), { opendesignPublic: true, ...(code === undefined ? {} : { code }), ...(soft ? { soft: true } : {}) })
+/** Issue #274: `billing/preflight` wraps the same member identity under `codingPlan` when present. */
+const quotaMemberOf = value => object(value)
+  ? value.workspaceMemberId ?? (object(value.codingPlan) ? value.codingPlan.workspaceMemberId : undefined)
+  : undefined
+/** Preflight also reports balanceUsd; it is only a fallback when the wallet endpoint fails. */
+const balanceWindowOf = value => {
+  const raw = object(value) ? value.balanceUsd : undefined
+  const text = typeof raw === 'string' ? raw : typeof raw === 'number' && Number.isFinite(raw) ? String(raw) : ''
+  return /^-?\d{1,12}(?:\.\d{1,12})?$/.test(text) ? { text: '$' + text, resetsAt: '' } : null
+}
+export function normalizeOpenDesignWorkspace(value) {
+  if (value === undefined || value === '') return ''
+  return typeof value === 'string' && id(value.trim()) ? value.trim() : null
+}
+
+/** The public API explicitly uses USD per million tokens; never apply a 1M conversion twice. */
+export function parseOpenDesignPrices(value, checkedAt = new Date().toISOString().slice(0, 10)) {
+  if (!object(value) || !Array.isArray(value.data) || value.data.length > 10000) throw Error('OpenDesign: invalid public price catalog')
+  const models = Object.create(null)
+  const tier = raw => {
+    if (!object(raw) || !rate(raw.input) || !rate(raw.output)) return null
+    if (['cacheRead', 'cacheWrite'].some(key => raw[key] !== undefined && !rate(raw[key]))) return null
+    return { cacheMiss: raw.input, output: raw.output,
+      ...(raw.cacheRead !== undefined ? { cacheHit: raw.cacheRead } : {}), ...(raw.cacheWrite !== undefined ? { cacheWrite: raw.cacheWrite } : {}) }
+  }
+  for (const row of value.data) {
+    if (!object(row) || typeof row.model !== 'string' || !/^[\w./:@+-]{1,200}$/.test(row.model) || ['__proto__', 'constructor', 'prototype'].includes(row.model)) throw Error('OpenDesign: invalid model id')
+    if (Object.hasOwn(models, row.model)) throw Error('OpenDesign: duplicate model price')
+    if (row.pricing?.unit !== '1m_tokens' || row.pricing?.currency !== 'USD') throw Error('OpenDesign: unsupported pricing unit or currency')
+    const price = tier(row.pricing)
+    if (!price) throw Error('OpenDesign: invalid token price')
+    if (row.pricing.longContext !== undefined) {
+      const raw = row.pricing.longContext, long = tier(raw)
+      if (!long || !Number.isSafeInteger(raw.inputTokensAbove) || raw.inputTokensAbove <= 0) throw Error('OpenDesign: invalid long-context price')
+      price.longContext = { aboveInputTokens: raw.inputTokensAbove, ...long }
+    }
+    models[row.model] = { ...price, billingMode: 'flat', sourceUrl: OPENDESIGN_PRICES_URL, checkedAt }
+  }
+  if (!Object.keys(models).length) throw Error('OpenDesign: empty public price catalog')
+  return { models }
+}
+
+/** Each quota window is an independent simultaneous limit, not an additive balance. */
+export function parseOpenDesignUsage(value, workspaceId) {
+  // Issue #274: the `billing/preflight` form wraps the identical window payload in `codingPlan`.
+  if (object(value) && object(value.codingPlan)) {
+    if ([value.workspaceId, value.codingPlan.workspaceId].some(id => id !== undefined && id !== workspaceId)
+      || value.workspaceMemberId !== undefined && value.codingPlan.workspaceMemberId !== undefined && value.workspaceMemberId !== value.codingPlan.workspaceMemberId) return null
+    value = { ...value, ...value.codingPlan, workspaceMemberId: value.workspaceMemberId ?? value.codingPlan.workspaceMemberId }
+  }
+  if (!object(value) || value.workspaceId !== workspaceId || value.workspaceMemberId !== undefined && !id(value.workspaceMemberId) || typeof value.eligible !== 'boolean'
+    || !Array.isArray(value.windows) || value.windows.length > 32) return null
+  const windows = {}, seen = new Set()
+  for (const row of value.windows) {
+    if (!object(row) || typeof row.policyId !== 'string' || !row.policyId || seen.has(row.policyId)
+      || !Number.isSafeInteger(row.durationSeconds) || row.durationSeconds <= 0
+      || !['usedCredits', 'remainingCredits', 'limitCredits'].every(key => typeof row[key] === 'string' && /^\d{1,80}$/.test(row[key]))) return null
+    seen.add(row.policyId)
+    const used = BigInt(row.usedCredits), remaining = BigInt(row.remainingCredits), limit = BigInt(row.limitCredits)
+    if (limit <= 0n || remaining > limit || remaining !== (used >= limit ? 0n : limit - used)) return null
+    const resetsAt = row.resetsAt == null ? '' : typeof row.resetsAt === 'string' && Number.isFinite(Date.parse(row.resetsAt)) ? new Date(row.resetsAt).toISOString() : null
+    if (resetsAt === null) return null
+    // Identify the window by its duration, keeping usage and reset time on that same row.
+    const duration = row.durationSeconds, base = duration === 5 * 60 * 60 ? 'fiveHour' : duration === 7 * 24 * 60 * 60 ? 'weekly' : 'window_' + duration + 's'
+    const key = Object.hasOwn(windows, base) ? base + '_' + seen.size : base
+    windows[key] = { percent: Number((used > limit ? limit : used) * 100000n / limit) / 1000, resetsAt }
+  }
+  if (value.eligible && !Object.keys(windows).length) return null
+  if (!value.eligible && value.windows.length) return null
+  return windows
+}
+
+export function parseOpenDesignWallet(value, workspaceId) {
+  if (!object(value) || value.billingScopeVersion !== 2 || value.workspaceId !== workspaceId || !id(value.workspaceMemberId)
+    || typeof value.balanceUsd !== 'string' || !/^-?\d{1,12}(?:\.\d{1,12})?$/.test(value.balanceUsd)) return null
+  return { text: '$' + value.balanceUsd, resetsAt: '' }
+}
+
+export async function queryOpenDesignQuota(key, locale, t, { workspaceId, signal, fetchImpl } = {}) {
+  const zh = locale === 'zh', workspace = normalizeOpenDesignWorkspace(workspaceId)
+  if (!workspace) throw queryError(zh ? 'OpenDesign：请先填写工作区 ID。' : 'OpenDesign: configure a workspace ID first.', true, OPEN_DESIGN_QUOTA_FAILURES.invalidRequest)
+  if (typeof key !== 'string' || !key.trim()) throw queryError(zh
+    ? 'OpenDesign：额度查询需要 Control Key（OPENDESIGN_CONTROL_KEY / VELA_CONTROL_KEY），不能使用推理 API Key。'
+    : 'OpenDesign: quota queries require a Control Key (OPENDESIGN_CONTROL_KEY / VELA_CONTROL_KEY), not an inference API key.', true, OPEN_DESIGN_QUOTA_FAILURES.invalidRequest)
+  const controller = new AbortController(), combined = signal ? AbortSignal.any([signal, controller.signal]) : controller.signal
+  const timer = setTimeout(() => controller.abort(), 15000); timer.unref?.()
+  const prefix = OPENDESIGN_API + '/workspaces/' + encodeURIComponent(workspace)
+  // The preflight and wallet routes accept a Control Key without a browser cookie.
+  // Read both sides independently and only fail
+  // when both fail; a single 401 must never discard the other side's valid answer.
+  const read = async (path, side) => {
+    const url = prefix + path
+    let response
+    try {
+      response = await fetchWithRetry(url, { method: 'GET', redirect: 'error', signal: combined,
+        headers: { accept: 'application/json', authorization: 'Bearer ' + key.trim(), 'x-vela-workspace-id': workspace } }, { attempts: 2, fetchImpl })
+    } catch (error) {
+      if (combined.aborted) throw error // caller cancellation / 15 s deadline must not degrade to a partial card
+      return { ok: false, side, kind: OPEN_DESIGN_QUOTA_FAILURES.network, url }
+    }
+    if (!response.ok) {
+      try { await response.body?.cancel?.() } catch {}
+      const unauthorized = response.status === 401 || response.status === 403
+      return { ok: false, side, kind: unauthorized ? OPEN_DESIGN_QUOTA_FAILURES.unauthorized : OPEN_DESIGN_QUOTA_FAILURES.http, status: response.status, url }
+    }
+    try { return { ok: true, side, value: await readJsonBounded(response, 256 * 1024), url } }
+    catch (error) {
+      if (combined.aborted) throw error
+      return { ok: false, side, kind: OPEN_DESIGN_QUOTA_FAILURES.invalidResponse, source: 'body', url }
+    }
+  }
+  const describe = failure => {
+    if (failure.kind === OPEN_DESIGN_QUOTA_FAILURES.unauthorized) return queryError(t(locale, 'codingPlanUnauthorized', { provider: 'OpenDesign', code: String(failure.status) }), true, failure.kind)
+    if (failure.kind === OPEN_DESIGN_QUOTA_FAILURES.http) return queryError(t(locale, 'codingPlanHttp', { provider: 'OpenDesign', code: String(failure.status), url: failure.url }), false, failure.kind)
+    if (failure.kind === OPEN_DESIGN_QUOTA_FAILURES.invalidResponse && failure.source === 'body') return queryError(t(locale, 'codingPlanInvalidJson', { provider: 'OpenDesign', url: failure.url }), false, failure.kind)
+    if (failure.kind === OPEN_DESIGN_QUOTA_FAILURES.invalidResponse) return queryError(failure.side === 'wallet'
+      ? (zh ? 'OpenDesign：钱包响应的工作区、成员或数据无效。' : 'OpenDesign: invalid wallet response or workspace/member identity.')
+      : (zh ? 'OpenDesign：额度响应的工作区、成员或数据无效。' : 'OpenDesign: invalid quota response or workspace/member identity.'), false, failure.kind)
+    if (failure.kind === OPEN_DESIGN_QUOTA_FAILURES.noSubscription) {
+      const code = 'codingPlanNoSubscription', text = t(locale, code, { provider: 'OpenDesign' })
+      // Fallback keeps "no subscription" distinguishable from "bad credential" until the catalog ships the key.
+      return queryError(text === code
+        ? (zh ? 'OpenDesign：当前账户没有生效的套餐订阅（未订阅或已到期）。' : 'OpenDesign: no active plan subscription was detected for this workspace (not subscribed or expired).')
+        : text, true, failure.kind)
+    }
+    return queryError(zh ? 'OpenDesign：查询失败，请检查控制端凭据、工作区权限和网络。' : 'OpenDesign: query failed; check the control credential, workspace access and connection.', false, failure.kind)
+  }
+  const partialResult = (windows, endpoint, failures, fallback = false) => ({
+    windows, endpoint,
+    partial: Object.fromEntries(failures.map(([side, failure]) => [side, failure.kind])),
+    message: [
+      ...(fallback ? [zh ? '钱包余额来自 billing/preflight。' : 'Wallet balance is from billing/preflight.'] : []),
+      ...failures.map(([side, failure]) => (side === 'usage' ? (zh ? '套餐额度：' : 'Plan quota: ') : (zh ? '钱包端点：' : 'Wallet endpoint: ')) + describe(failure).message),
+    ].join('\n'),
+  })
+  try {
+    // #274 / #313: do not spend a request on the browser-session-only usage route.
+    const [usageRead, walletRead] = await Promise.all([read('/billing/preflight', 'preflight'), read('/wallet/balance', 'wallet')])
+    combined.throwIfAborted()
+    // The preflight answer is already scoped by URL and x-vela-workspace-id; tolerate a body that
+    // omits the redundant workspaceId, but never accept one that names a different workspace.
+    const preflight = usageRead.ok && usageRead.side === 'preflight'
+    const identifiesOtherWorkspace = value => object(value) && value.workspaceId !== undefined && value.workspaceId !== workspace
+    const usageWorkspaceConflict = preflight && object(usageRead.value)
+      && (identifiesOtherWorkspace(usageRead.value) || identifiesOtherWorkspace(usageRead.value.codingPlan))
+    const usagePayload = preflight && object(usageRead.value) && usageRead.value.workspaceId === undefined
+      ? { ...usageRead.value, workspaceId: workspace } : usageRead.value
+    const usageWindows = usageRead.ok && !usageWorkspaceConflict ? parseOpenDesignUsage(usagePayload, workspace) : null
+    const usageFailure = !usageRead.ok ? usageRead
+      : usageWindows === null ? { ok: false, side: usageRead.side, kind: OPEN_DESIGN_QUOTA_FAILURES.invalidResponse, source: 'shape', url: usageRead.url }
+        // The parser returns {} only for eligible:false with no windows: a definitive no-subscription answer.
+        : Object.keys(usageWindows).length === 0 ? { ok: false, side: usageRead.side, kind: OPEN_DESIGN_QUOTA_FAILURES.noSubscription } : null
+    const balance = walletRead.ok ? parseOpenDesignWallet(walletRead.value, workspace) : null
+    const walletFailure = !walletRead.ok ? walletRead
+      : balance === null ? { ok: false, side: 'wallet', kind: OPEN_DESIGN_QUOTA_FAILURES.invalidResponse, source: 'shape', url: walletRead.url } : null
+    // A preflight answer carries balanceUsd too; it only fills in when the wallet endpoint failed.
+    const fallbackBalance = usageWindows !== null && preflight ? balanceWindowOf(usageRead.value) : null
+    if (usageWindows !== null && balance !== null) {
+      // Only an identity the quota response actually provides must agree with the wallet member.
+      const usageMember = quotaMemberOf(usageRead.value)
+      if (usageMember !== undefined && walletRead.value.workspaceMemberId !== usageMember) {
+        throw queryError(zh ? 'OpenDesign：钱包与额度的工作区成员不一致。' : 'OpenDesign: wallet and quota member identities do not match.', false, OPEN_DESIGN_QUOTA_FAILURES.identityMismatch)
+      }
+    }
+    if (usageFailure === null && walletFailure === null) return { windows: { ...usageWindows, balance }, endpoint: usageRead.url }
+    // Partial degradation (issue #274): keep whichever side answered. `partial` names the failing
+    // side and its machine-readable cause; it never replaces the existing windows contract.
+    if (usageFailure === null) return partialResult(fallbackBalance === null ? usageWindows : { ...usageWindows, balance: fallbackBalance }, usageRead.url, [['wallet', walletFailure]], fallbackBalance !== null)
+    if (walletFailure === null) return partialResult({ balance }, walletRead.url, [['usage', usageFailure]])
+    // No subscription is a valid preflight answer too: its readable wallet balance
+    // must survive an unavailable wallet route, without inventing any quota windows.
+    if (fallbackBalance !== null) return partialResult({ balance: fallbackBalance }, usageRead.url, [['usage', usageFailure], ['wallet', walletFailure]], true)
+    // Both failed: report the most actionable cause, preferring a definitive account state
+    // (no subscription / rejected credential) over a secondary transport or shape failure.
+    const priority = [OPEN_DESIGN_QUOTA_FAILURES.noSubscription, OPEN_DESIGN_QUOTA_FAILURES.unauthorized,
+      OPEN_DESIGN_QUOTA_FAILURES.invalidResponse, OPEN_DESIGN_QUOTA_FAILURES.http, OPEN_DESIGN_QUOTA_FAILURES.network]
+    throw describe(priority.indexOf(walletFailure.kind) < priority.indexOf(usageFailure.kind) ? walletFailure : usageFailure)
+  } catch (error) {
+    combined.throwIfAborted()
+    // Never put an upstream body, arbitrary network exception or credential in the UI.
+    if (error?.opendesignPublic === true) throw error
+    throw Error(zh ? 'OpenDesign：查询失败，请检查控制端凭据、工作区权限和网络。' : 'OpenDesign: query failed; check the control credential, workspace access and connection.')
+  } finally { clearTimeout(timer) }
+}

package/lib/vendor/cost-meter/tokenrhythm-balance.mjs

@@ -0,0 +1,95 @@
+/** Token Rhythm 账户可用余额（#290）；复用余额缓存及 DSH 只写凭据库。 */
+import { credentialRef } from './credentials-shim.mjs'
+import { fetchWithRetry, readJsonBounded } from './net.mjs'
+
+// 与官方网站账户页相同的 wallet summary / availableBalanceCny，见 docs/tokenrhythm-balance.md。
+export const TOKENRHYTHM_BALANCE_URL = 'https://tokenrhythm.studio/api/wallet/summary'
+export const TOKENRHYTHM_BALANCE_CREDENTIAL_VARS = ['TOKENRHYTHM_COOKIE']
+const messages = {
+  zh: {
+    missing: '请填写 Token Rhythm 网站登录 Cookie（tr_session，不是模型 API Key）',
+    cookie: 'Token Rhythm Cookie 格式无效，请填写 tr_session 或包含它的 Cookie',
+    network: 'Token Rhythm 余额网络请求失败，请稍后重试',
+    redirect: 'Token Rhythm 余额接口发生重定向，已拒绝转发 Cookie',
+    permission: 'Token Rhythm 登录已失效或无权查询，请登录官网后更新 Cookie',
+    http: 'Token Rhythm 余额接口返回 HTTP {status}',
+    payload: 'Token Rhythm 余额响应无效或过大，请稍后重试',
+    amount: 'Token Rhythm 未返回有效的可用余额，未将其视为零余额',
+    currency: 'Token Rhythm 余额币种不是 CNY，请检查平台接口',
+  },
+  en: {
+    missing: 'Enter the Token Rhythm website session cookie (tr_session, not a model API key)',
+    cookie: 'Invalid Token Rhythm cookie; enter tr_session or a Cookie header containing it',
+    network: 'Token Rhythm balance network request failed; please retry later',
+    redirect: 'Token Rhythm balance redirect refused to protect the cookie',
+    permission: 'Token Rhythm session expired or access denied; sign in on the website and update the cookie',
+    http: 'Token Rhythm balance returned HTTP {status}',
+    payload: 'Token Rhythm balance response is invalid or too large; please retry later',
+    amount: 'Token Rhythm returned no valid available balance; it was not treated as zero',
+    currency: 'Token Rhythm balance currency is not CNY; check the platform API',
+  },
+}
+const failure = (locale, key, status = '') => new Error(messages[locale === 'en' ? 'en' : 'zh'][key].replace('{status}', String(status)))
+
+export function parseTokenRhythmCookie(value, locale = 'zh') {
+  const text = String(value ?? '').trim()
+  if (!text || text.length > 16384 || /[\r\n]/.test(text)) throw failure(locale, 'cookie')
+  if (/^[A-Za-z0-9._-]+$/.test(text)) return text
+  const parts = text.replace(/^Cookie:\s*/i, '').split(';').map(part => part.trim())
+  const sessions = parts.filter(part => /^tr_session\s*=/.test(part))
+  const match = sessions.length === 1 && /^tr_session\s*=\s*([A-Za-z0-9._-]+)$/.exec(sessions[0])
+  if (!match) throw failure(locale, 'cookie')
+  return match[1]
+}
+
+export function parseTokenRhythmBalance(payload, locale = 'zh') {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) throw failure(locale, 'payload')
+  // 官网成功码为 0 / 200（兼容字符串）；拒绝夹带余额的业务错误，不回显原始响应。
+  if ((payload.code !== undefined && ![0, '0', 200, '200'].includes(payload.code)) || payload.success === false) throw failure(locale, 'permission')
+  const data = Object.hasOwn(payload, 'data') ? payload.data : payload
+  if (!data || typeof data !== 'object' || Array.isArray(data)) throw failure(locale, 'payload')
+  if (data.currency !== undefined && data.currency !== 'CNY') throw failure(locale, 'currency')
+  const raw = Object.hasOwn(data, 'availableBalanceCny') ? data.availableBalanceCny : data.available_balance_cny
+  const text = typeof raw === 'string' ? raw.trim() : ''
+  const remaining = typeof raw === 'number' ? raw : /^[+-]?\d+(\.\d+)?$/.test(text) ? Number(text) : NaN
+  if (!Number.isFinite(remaining)) throw failure(locale, 'amount')
+  // 可用余额与累计消费/赠额/冻结金额分开；接口没有预算上限时不伪造百分比。
+  return { remaining, unit: 'CNY', maxBudget: null, spend: null }
+}
+
+export async function queryTokenRhythmBalance(ctx, config, { fetchImpl = fetch, signal } = {}) {
+  signal?.throwIfAborted()
+  const locale = config?.locale
+  let value
+  try { value = (await ctx?.get?.('credentials')?.resolve(credentialRef('TOKENRHYTHM_COOKIE')))?.value } catch { /* 回落环境变量。 */ }
+  if (typeof value !== 'string' || !value.trim()) value = process.env.TOKENRHYTHM_COOKIE
+  if (!value?.trim()) throw Object.assign(failure(locale, 'missing'), { soft: true })
+  const session = parseTokenRhythmCookie(value, locale)
+  let response
+  try {
+    response = await fetchWithRetry(TOKENRHYTHM_BALANCE_URL, {
+      method: 'GET', redirect: 'manual', signal,
+      headers: {
+        Accept: 'application/json', Cookie: 'tr_session=' + session,
+        Referer: 'https://tokenrhythm.studio/account', Origin: 'https://tokenrhythm.studio',
+        'User-Agent': 'Mozilla/5.0 (compatible; dsh-cost-meter)',
+      },
+    }, { attempts: 2, timeoutMs: 15000, fetchImpl })
+  } catch {
+    signal?.throwIfAborted()
+    throw failure(locale, 'network')
+  }
+  if (!response.ok) {
+    await response.body?.cancel().catch(() => {})
+    if (response.status >= 300 && response.status < 400) throw failure(locale, 'redirect')
+    if (response.status === 401 || response.status === 403) throw failure(locale, 'permission')
+    throw failure(locale, 'http', response.status)
+  }
+  let payload
+  try { payload = await readJsonBounded(response) } catch {
+    signal?.throwIfAborted()
+    throw failure(locale, 'payload')
+  }
+  signal?.throwIfAborted()
+  return { label: config?.customBalance?.label || 'Token Rhythm', ...parseTokenRhythmBalance(payload, locale) }
+}

package/lib/vendor/cost-meter/workbuddy-accounts.mjs

@@ -0,0 +1,44 @@
+import { fetchWorkBuddyLocal, workBuddyOrigin } from './workbuddy-transport.mjs'
+import { fetchWithRetry, readJsonBounded } from './net.mjs'
+
+export const validWorkBuddyAccountId = id => typeof id === 'string' && /^(cn|global):[^\s\u0000-\u001f\u007f]{1,256}$/.test(id)
+const amount = value => typeof value === 'number' && Number.isFinite(value) && value >= 0
+
+/** Read the connector's published per-account endpoint; never switch its active account. */
+export async function fetchWorkBuddyAccounts(hostOrigin, config = {}, { signal, fetchImpl = fetchWorkBuddyLocal } = {}) {
+  if (!hostOrigin) return null
+  const origin = workBuddyOrigin(hostOrigin)
+  const results = await Promise.all(['cn', 'global'].map(async region => {
+    try {
+      const response = await fetchWithRetry(new URL('/plugins/dsh-connect-workbuddy/account-credits?region=' + region, origin),
+        { method: 'GET', redirect: 'error', signal }, { attempts: 1, timeoutMs: 35000, fetchImpl })
+      if (response.status === 404 || response.headers.get('content-type')?.includes('text/html')) { await response.body?.cancel?.(); return { missing: true } }
+      if (!response.ok) { await response.body?.cancel?.(); return { failed: true } }
+      const body = await readJsonBounded(response)
+      if (!Array.isArray(body?.accounts) || body.accounts.length > 200) return { failed: true }
+      const seen = new Set(), accounts = []
+      for (const row of body.accounts) {
+        const id = region + ':' + row?.id
+        if (!validWorkBuddyAccountId(id) || typeof row?.id !== 'string' || seen.has(id)) return { failed: true }
+        seen.add(id)
+        accounts.push({ id, region, name: typeof row.accountName === 'string' ? row.accountName.slice(0, 160) : '',
+          current: row.selected === true, remaining: amount(row.credits) ? row.credits : null })
+      }
+      return { accounts }
+    } catch { signal?.throwIfAborted(); return { failed: true } }
+  }))
+  // An older connector has no account list; its selected-account route remains usable.
+  if (!results.some(result => result.accounts)) return null
+  const accounts = results.flatMap(result => result.accounts ?? [])
+  const scope = ['all', 'selected'].includes(config.accountScope) ? config.accountScope : 'current'
+  const ids = new Set(Array.isArray(config.accountIds) ? config.accountIds : [])
+  if (scope === 'selected') for (const id of ids) if (validWorkBuddyAccountId(id) && !accounts.some(row => row.id === id)) {
+    accounts.push({ id, region: id.split(':')[0], name: '', current: false, remaining: null })
+  }
+  const selected = accounts.filter(row => scope === 'all' || (scope === 'current' ? row.current : ids.has(row.id)))
+  const known = selected.filter(row => row.remaining !== null)
+  return { scope, accounts, selectedIds: selected.map(row => row.id),
+    knownRemaining: known.reduce((sum, row) => sum + row.remaining, 0),
+    unknownCount: selected.length - known.length,
+    incomplete: results.some(result => result.failed), fetchedAt: Date.now() }
+}

package/lib/vendor/cost-meter/workbuddy-transport.mjs

@@ -0,0 +1,38 @@
+import { request } from 'node:http'
+
+export function workBuddyOrigin(value) {
+  let url
+  try { url = new URL(value) } catch {}
+  if (!url || url.protocol !== 'http:' || !['127.0.0.1', '[::1]', 'localhost'].includes(url.hostname)
+    || url.username || url.password || url.pathname !== '/' || url.search || url.hash) {
+    throw Object.assign(new Error('workbuddyConnectUnavailable'), { code: 'workbuddyConnectUnavailable' })
+  }
+  return url
+}
+
+// Host-local reads must not use DSH's global fetch proxy/dispatcher. No credentials,
+// redirects, or configurable remote paths; the byte limit includes the whole body.
+export function fetchWorkBuddyLocal(url, { signal } = {}) {
+  workBuddyOrigin(new URL(url).origin)
+  return new Promise((resolve, reject) => {
+    const req = request(url, { method: 'GET', agent: false, signal, headers: { accept: 'application/json', 'accept-encoding': 'identity' } }, res => {
+      const chunks = []; let bytes = 0
+      res.on('error', reject)
+      res.on('data', chunk => {
+        bytes += chunk.length
+        if (bytes > 1024 * 1024) { res.destroy(new Error('WorkBuddy response too large')); return }
+        chunks.push(chunk)
+      })
+      res.on('end', () => {
+        const status = res.statusCode ?? 502
+        if (status >= 300 && status < 400) { reject(new TypeError('fetch failed: redirect refused')); return }
+        resolve(new Response([204, 205, 304].includes(status) ? null : Buffer.concat(chunks), {
+          status, headers: { 'content-type': res.headers['content-type'] ?? '' },
+        }))
+      })
+    })
+    req.on('error', reject)
+    req.setTimeout(35000, () => req.destroy(new Error('WorkBuddy query timed out')))
+    req.end()
+  })
+}