dsh-tokenlens 1.3.8 → 1.4.0

package/CHANGELOG.md

@@ -4,18 +4,23 @@
 
 **版本记录约定**：同一发布日只保留一个章节，标题取当日**最后一个**已发布版本号；当日多次发布的改动合并到该章节，并在标题下注明当日实际发布过的版本号（npm 上仍可安装这些独立版本）。若当日已有发布，后续小改动不再单独增加版本号，而是并入下一篇日志。这样日志按天规整、不出现同日多个小版本。
 
-## 1.3.8 — 2026-11-02
+## 1.4.0 — 2026-11-02
 
-（当日已发布版本：v1.3.5 / v1.3.6 / v1.3.7 / v1.3.8）
+（当日已发布版本：v1.3.5 / v1.3.6 / v1.3.7 / v1.3.8 / v1.3.9 / v1.4.0）
 
 - feat(ui): 供应商管理页可为 **Open Design** 填写「工作区 ID」并持久化到插件配置——此前 workspaceId 只能在 profile patch 或 `OPENDESIGN_WORKSPACE_ID` 里设置，用推理 Key 配好供应商后额度卡片仍报错却无处可改
+- feat(ui): **Control Key 也能在弹窗里直接填**——Open Design 卡片新增密码型输入框，粘贴保存即写入插件自己的 store；输入框是只写的（Host 只回 `hasKey` / `keySource`，secret 永不下发浏览器），保存成功后自动清空并改用「已保存；要替换请重新粘贴」占位提示。小白用户不再需要手改 `.credentials.yaml`
+- feat(ui): 「工作区 ID」输入框支持**直接粘贴整条控制台地址**——`https://open-design.ai/cloud/dashboard?workspaceId=ws_x&tab=billing` 会自动提取出 `ws_x`，避免用户复制整条 URL 后被校验拒绝
+- **fix(open-design): 修掉「配好了仍报错」**——额度窗口原来只查 `billing/coding-plan-usage`，而那条路由由控制台的浏览器 Cookie 会话鉴权，**任何 Control Key 都会被 401**（控制台前端自己也走 cookie）。现在改用**同样接受 Control Key** 的 `billing/funding-check`，Design Plan 的 5 小时 / 7 天窗口正常读出
+- fix(open-design): 改为钱包、窗口、套餐三层**互相独立降级**——先读 `wallet/balance`（余额）与 `billing/summary`（套餐档位，如 GO / PLUS），窗口再由 funding-check 补齐；任一路由不可用只少一块数据，不再整条报错。旧版会把 quota 的 401 当成整体失败，导致钱包也读不到
+- feat(wire): `billing/summary` 的 `membershipTier` 映射为 `plan`（`GO` / `PLUS` / `PRO` / `MAX`），弹窗标题行显示「套餐：GO」
 - feat(ui): Open Design 额度失败时的引导——详情弹窗的错误条说明「额度查询需要工作区 ID 与 Control Key（不是推理 Key）」，并提供「去配置」按钮直接跳到供应商管理页
 - feat(host): Host 侧错误文案更具体（区分缺 workspaceId / 缺 Control Key，并指向管理页）；`providerUpdate` 接受 `workspaceId`，校验为 1–120 位标识符字符（字母、数字、`. _ : @ -`），路径穿越/空格/超长一律拒绝
 - feat(wire): `providers[]` 仅对声明了 workspace 的适配器（Open Design）下发 `workspaceId` 字段；其余供应商不下发，客户端据此决定是否渲染输入框（旧 Host 无此字段 ⇒ 不渲染，自然降级）
 - feat(ui): Open Design 缺配置时 chip 不再按 `missing-key` 静默隐藏，而是显示「待配置」并可点进详情看引导——否则用户既看不到提示也没有入口
 - fix(tool): Agent 工具 `tokenlens_usage` 的 `updateCheck` 动作此前虽在枚举里却会落到用量读取分支，返回当前供应商的用量或错误；现在正确执行更新检查并返回 `UpdateInfo`
 - docs: 中英 README 补充 **workspace ID 与 Control Key 到底在哪里取**——控制台的「套餐与余额」页没有独立的 ID 字段，workspace ID 取自地址栏的 `?workspaceId=`（成员邀请预览页也会显示「工作空间 ID」），而 `~/.amr/config.json` 只存 `controlKey` / `runtimeKey` / `apiUrl` / `linkUrl`、不含 workspace ID；Control Key 是桌面端 / `vela login` 写入该文件的 `profiles.prod.controlKey`，用推理 Key 冒充会得到 401
-- 测试：280 → 286（workspace ID 校验/持久化/清空、管理页字段渲染与保存、缺 workspaceId 的 Host 报错与引导按钮、待配置 chip、工具 updateCheck 分发）
+- 测试：280 → 292（workspace ID 校验/持久化/清空与 URL 提取、Control Key 只写保存与不回声、funding-check 嵌套文档解析、窗口不可用时的钱包降级、summary 缺失时不臆造档位、待配置 chip、工具 updateCheck 分发）
 
 ## 1.3.4 — 2026-11-01
 

package/PROTOCOL.md

@@ -116,10 +116,27 @@ row at the end of the capacity card and appends the amount to the chip tooltip.
 **workspace id** (the console URL's `?workspaceId=` value) and a **Control Key**
 (the `profiles.prod.controlKey` the desktop app / `vela login` writes to
 `~/.amr/config.json`). The inference key from the Cloud API Keys page answers
-HTTP 401 on the billing endpoints. Missing either value is a `missing-key` error;
-the workspace id may be set from the management page (persisted in
-`providers.json`, v1.3.5) and the Control Key comes from `OPENDESIGN_CONTROL_KEY`,
-`VELA_CONTROL_KEY`, the credential store, or that page's key field.
+HTTP 401 on the billing endpoints. Missing either value is a `missing-key` error.
+Since v1.3.9 both may be entered on the management page: `workspaceId` is
+persisted in `providers.json`, and the Control Key is written through the same
+`apiKey` override field the store already supported (write-only — the Host never
+returns it, only `hasKey`/`keySource`). The environment/credential sources
+(`OPENDESIGN_CONTROL_KEY`, `VELA_CONTROL_KEY`, `OPENDESIGN_WORKSPACE_ID`) still
+work and the page override wins.
+
+Reads, in independent layers (v1.4.0) — each may fail without voiding the others:
+
+| read | path | provides |
+|---|---|---|
+| wallet | `GET /api/v1/workspaces/{id}/wallet/balance` | `balance` (USD, authoritative) |
+| plan windows | `GET /api/v1/workspaces/{id}/billing/funding-check` | `windows` from its nested `codingPlan` (`eligible`, `tier`, 5h/7d credit windows) |
+| plan tier | `GET /api/v1/billing/summary` | `plan` from `membershipTier` (`go` → `GO`) |
+
+`billing/coding-plan-usage` carries the same plan document at the top level but is
+served by the console's **cookie-authenticated** route: a Control Key always gets
+HTTP 401 there (the console UI itself authenticates with a session cookie), so it
+is only a fallback. The wallet is therefore always read first; the plan endpoint
+must not turn a readable balance into a hard error.
 
 Rules:
 

package/README.en.md

@@ -114,6 +114,8 @@ Open Design (OpenDesign) is the exception: its read-only billing API needs a **w
 - *Workspace ID* — the console has **no dedicated field for it**; it appears in the address bar: open 套餐与余额 or 成员 and read `open-design.ai/cloud/dashboard?workspaceId=<the id>`. A member-invite preview page also lists it as 「工作空间 ID」. `~/.amr/config.json` stores only the keys/URLs, not the workspace id.
 - *Control Key* — a session credential that the Open Design desktop app / `vela` CLI writes to `~/.amr/config.json` when you sign in (`profiles.prod.controlKey`). Sign in once with the desktop app, or run `vela login` and approve the browser prompt, then copy that value (or point the plugin at it). Pasting the inference key instead makes the quota call answer HTTP 401.
 
+Both values can be entered right in the plugin (simplest for non-technical users): usage dialog → 管理 → 供应商配置 → expand **Open Design**. The workspace-ID field also accepts a whole pasted console URL (`...?workspaceId=xxx` is extracted), and the Control Key field is a write-only password input — saving it stores the secret in the plugin's own store, and the Host never echoes it back (only `hasKey`). Press 测试连接 afterwards. Alternatively put `OPENDESIGN_CONTROL_KEY` in `$DSH_HOME/.credentials.yaml` `refs:` (or the environment) and the workspace id in `OPENDESIGN_WORKSPACE_ID`.
+
 See the [Chinese README](README.md) for the full configuration reference, preview and provider tables.
 
 ## Supported providers and harnesses

package/README.md

@@ -231,8 +231,11 @@ Control Key 是 **Open Design 桌面端/CLI 登录时写入本机的会话凭据
 
 拿到后两种放法：
 
-- 写进 `$DSH_HOME/.credentials.yaml` 的 `refs:` 下：`OPENDESIGN_CONTROL_KEY: <control key>`（或环境变量 `OPENDESIGN_CONTROL_KEY` / `VELA_CONTROL_KEY`）；
-- workspace ID 在插件的[供应商管理页](#供应商管理) Open Design 卡片里填写，或用 `OPENDESIGN_WORKSPACE_ID` 环境变量。
+- **最简单（推荐给不折腾的用户）**：全部在插件里填——用量弹窗 →「管理」→「供应商配置」→ 展开 **Open Design**：
+  - 「工作区 ID」：直接粘贴控制台地址整条也行（`...?workspaceId=xxx` 会自动提取出 ID）；
+  - 「Control Key」：粘贴后保存，输入框是密码型、保存后不再显示（Host 只回 `hasKey`，secret 永不下发浏览器）。
+  保存后点「测试连接」，出现 5 小时 / 7 天百分比与钱包余额即成功。
+- **或写配置文件**：Control Key 写进 `$DSH_HOME/.credentials.yaml` 的 `refs:` 下 `OPENDESIGN_CONTROL_KEY: <control key>`（或环境变量 `OPENDESIGN_CONTROL_KEY` / `VELA_CONTROL_KEY`）；workspace ID 用 `OPENDESIGN_WORKSPACE_ID` 环境变量或 profile 配置。
 
 > 这也解释了最容易踩的坑：**用推理 Key 填 Control Key** 会让额度查询返回 401。插件已经区分这两种凭据，缺哪一项都会指名道姓地提示。
 
@@ -318,11 +321,11 @@ Control Key 是 **Open Design 桌面端/CLI 登录时写入本机的会话凭据
 | `minimax` | `GET https://api.minimax.io/v1/api/openplatform/coding_plan/remains`（订阅 Key；国内站 `api.minimaxi.com`） | 5 小时 / 每周 已用百分比（best-effort） |
 | `zhipu-cn` | `GET https://open.bigmodel.cn/api/monitor/usage/quota/limit`（`ZHIPU_API_KEY`） | GLM Coding Plan：5 小时 / 本周 / 每月 百分比 + 方案 |
 | `volcengine` | Coding Plan / AgentPlan：`POST https://open.volcengineapi.com/?Action=GetCodingPlanUsage&Version=2024-01-01`（Signature V4，`VOLCENGINE_ACCESS_KEY_ID` + `VOLCENGINE_SECRET_ACCESS_KEY`） | 5 小时 / 本周 / 每月 百分比 + 档位 |
-| `open-design` | 只读计费接口：`GET https://amr-api.open-design.ai/api/v1/workspaces/{workspaceId}/billing/coding-plan-usage` + `…/wallet/balance`（workspace ID + Control Key：`OPENDESIGN_CONTROL_KEY` / `VELA_CONTROL_KEY`，非推理 Key） | Design Plan 的 5 小时 / 7 天 已用百分比 + 重置时间；钱包余额（USD） |
+| `open-design` | 只读计费接口：`GET …/api/v1/workspaces/{workspaceId}/wallet/balance`（钱包）+ `…/billing/funding-check`（Design Plan 窗口，位于 `codingPlan` 内）+ `/api/v1/billing/summary`（套餐档位），workspace ID + Control Key：`OPENDESIGN_CONTROL_KEY` / `VELA_CONTROL_KEY`，非推理 Key | Design Plan 的 5 小时 / 7 天 已用百分比 + 重置时间；套餐档位；钱包余额（USD） |
 
 - OpenCode 的额度定义见[官方文档](https://opencode.ai/docs/go/#usage-limits)（5h = 月度额度的 20%、周 = 50%、月 = 100%）；接口只返回百分比，插件也只画百分比。
 - Command Code 的 `/alpha/*` 是官方 CLI 自用的私有计费路由；免费 / 无方案账户返回空窗口（显示 `—`），插件不会用方案目录猜额度。
-- Open Design 的窗口按账户实际返回的时长渲染：Go 同时有 5 小时和 7 天窗口，Plus / Pro / Max 只有 7 天窗口；钱包余额是独立于窗口的 USD 额度，用尽后继续扣钱包。查询要求工作区权限，鉴权失败会明确显示错误而不是 0；工作区 ID 与 Control Key 缺任一项时，弹窗会指出缺哪一项并给出「去配置」入口（v1.3.5）。
+- Open Design 的窗口按账户实际返回的时长渲染：Go 同时有 5 小时和 7 天窗口，Plus / Pro / Max 只有 7 天窗口；钱包余额是独立于窗口的 USD 额度，用尽后继续扣钱包。查询要求工作区权限，鉴权失败会明确显示错误而不是 0；工作区 ID 与 Control Key 缺任一项时，弹窗会指出缺哪一项并给出「去配置」入口（v1.3.5）。窗口、余额、套餐档位是**三层独立读取**（v1.4.0）：任一接口不可用时只少那一块数据，不会整套报错。
 - 未配置凭据的供应商 chip 静默隐藏；`zai`、`minimax`、`deepinfra` 属 best-effort 适配（未公开接口，失败时按可重试错误优雅降级）。
 - 各供应商的元数据（`kind` / `label` / `shortLabel` / `baseURL` / `apiKeyRef` / `consoleUrl`）集中在 `lib/providers.mjs` 的 `PROVIDER_DEFAULTS` 与 `ADAPTERS` 中，新增适配器只需在该文件登记并补测试。
 
@@ -434,7 +437,7 @@ Host 半注册 `tokenlens_usage`，参数 `action`（默认 `snapshot`）与可
 
 ## 验证
 
-- `node --test`：**286 个自动化用例**，覆盖 Host 数据层、供应商适配器、统计折叠、各 harness 读取、插件集成与浏览器端渲染 / 交互。
+- `node --test`：**292 个自动化用例**，覆盖 Host 数据层、供应商适配器、统计折叠、各 harness 读取、插件集成与浏览器端渲染 / 交互。
 - 在真实环境中验证过 **5 个 harness** 的数据源；本机统计与独立的 SQLite 查询、独立的日志解析逐项对账（差额为 0），跨 harness 合并与供应商映射算术自洽。
 - 供应商接口按各官方文档与参考客户端行为验证；未配置凭据时 chip 静默隐藏，接口异常时按可重试错误降级。
 

package/client.js

@@ -331,8 +331,12 @@ window.__ModuleLoader__.load({
       providerConsoleURLPlaceholder: '留空则使用内置默认地址',
       providerWorkspaceId: '工作区 ID（Workspace ID）',
       providerWorkspaceIdHint: 'Open Design Cloud 工作区标识；额度查询需要',
-      providerWorkspaceIdPlaceholder: '留空则使用环境变量 OPENDESIGN_WORKSPACE_ID',
+      providerWorkspaceIdPlaceholder: '粘贴工作区 ID，或直接粘贴控制台地址（自动提取）',
       providerWorkspaceIdTooLong: '工作区 ID 最多 120 个字符',
+      providerControlKey: 'Control Key',
+      providerControlKeyHint: '本机 Open Design 登录后写在 ~/.amr/config.json 的 profiles.prod.controlKey；不是 Cloud API Keys 页的推理 Key',
+      providerControlKeyPlaceholder: '粘贴 Control Key（保存后不再显示）',
+      providerControlKeySaved: '已保存；要替换请重新粘贴',
       configureProvider: '去配置',
       errorOpenDesignConfig: 'Open Design 额度查询需要工作区 ID 与 Control Key（不是推理 Key）',
       providerSave: '保存',
@@ -582,8 +586,12 @@ window.__ModuleLoader__.load({
       providerConsoleURL: 'Console URL',
       providerWorkspaceId: 'Workspace ID',
       providerWorkspaceIdHint: 'The Open Design Cloud workspace identifier the quota query is scoped to',
-      providerWorkspaceIdPlaceholder: 'Empty uses the OPENDESIGN_WORKSPACE_ID environment variable',
+      providerWorkspaceIdPlaceholder: 'Paste the workspace ID, or the console URL (it is extracted)',
       providerWorkspaceIdTooLong: 'The workspace ID may be at most 120 characters',
+      providerControlKey: 'Control Key',
+      providerControlKeyHint: 'Written to ~/.amr/config.json as profiles.prod.controlKey after signing in to Open Design; not the inference key from the Cloud API Keys page',
+      providerControlKeyPlaceholder: 'Paste the Control Key (never shown again after saving)',
+      providerControlKeySaved: 'Saved; paste again to replace it',
       configureProvider: 'Configure',
       errorOpenDesignConfig: 'Open Design quota needs a workspace ID and a Control Key (not an inference key)',
       providerConsoleURLPlaceholder: 'Leave empty for the built-in default',
@@ -2329,6 +2337,10 @@ window.__ModuleLoader__.load({
             const clearedDraft = hasField('consoleUrl')
             const resetNames = !clearedDraft && (hasField('shortLabel') || hasField('label'))
             const resetWorkspace = hasField('workspaceId')
+            // v1.3.9: a saved secret is never echoed back, so the typed value is
+            // dropped after the Host confirms it (the placeholder then reports
+            // "already saved" through the answered hasKey flag).
+            const resetSecret = hasField('apiKey')
             const rowTest = { ...current.rowTest }
             delete rowTest[providerId]
             // Adopt the answered list; a Host that omits it must not blank the page.
@@ -2336,7 +2348,7 @@ window.__ModuleLoader__.load({
             let nextDrafts = current.drafts
             if (clearedDraft) {
               nextDrafts = mapWithout(current.drafts, providerId)
-            } else if (resetNames || resetWorkspace) {
+            } else if (resetNames || resetWorkspace || resetSecret) {
               const draft = current.drafts[providerId]
               const answered = adoptsList
                 ? parsed.providers.find((entry) => entry.providerId === providerId)
@@ -2355,6 +2367,7 @@ window.__ModuleLoader__.load({
                       ? answered.workspaceId
                       : draft.workspaceId
                 }
+                if (resetSecret) next.apiKey = ''
                 nextDrafts = mapWith(current.drafts, providerId, next)
               }
             }
@@ -2843,6 +2856,9 @@ window.__ModuleLoader__.load({
         shortLabel: provider.shortLabel,
         label: provider.label,
         workspaceId: typeof provider.workspaceId === 'string' ? provider.workspaceId : '',
+        // A secret is never seeded from the wire: it starts empty and only
+        // carries what the user just typed (v1.3.9).
+        apiKey: '',
       }
     }
 
@@ -2869,6 +2885,10 @@ window.__ModuleLoader__.load({
         const wireWorkspaceId = typeof provider.workspaceId === 'string' ? provider.workspaceId : ''
         const workspaceId = typeof source.workspaceId === 'string' ? source.workspaceId.trim() : wireWorkspaceId
         if (workspaceId !== wireWorkspaceId) update.workspaceId = workspaceId
+        // v1.3.9: the Control Key is write-only. A typed value is sent once; an
+        // empty draft means "leave the stored secret alone", never "clear it".
+        const apiKey = typeof source.apiKey === 'string' ? source.apiKey.trim() : ''
+        if (apiKey !== '') update.apiKey = apiKey
       }
       return update
     }
@@ -2893,21 +2913,43 @@ window.__ModuleLoader__.load({
               shortLabel: provider.shortLabel,
               label: provider.label,
               workspaceId: typeof provider.workspaceId === 'string' ? provider.workspaceId : '',
+              apiKey: '',
             }),
       })
     }
 
-    /** Record one typed editor value (names, the display-only console URL, the workspace id). */
+    /**
+     * Accept a pasted console URL and pull the workspace id out of it (v1.3.9):
+     * beginners copy the whole address bar, so `…?workspaceId=abc&x=1` must
+     * reduce to `abc` instead of being rejected for containing slashes.
+     */
+    function extractWorkspaceId(raw) {
+      const text = typeof raw === 'string' ? raw.trim() : ''
+      if (text === '') return ''
+      const match = /[?&]workspaceId=([^&#\s]+)/i.exec(text)
+      if (match === null) return text
+      try {
+        return decodeURIComponent(match[1])
+      } catch {
+        return match[1]
+      }
+    }
+
+    /** Record one typed editor value (names, the display-only console URL, the workspace id, a typed secret). */
     function updateProviderDraft(provider, field, value) {
-      if (field !== 'consoleUrl' && field !== 'shortLabel' && field !== 'label' && field !== 'workspaceId') return
-      if (field === 'workspaceId' && provider.supportsWorkspaceId !== true) return
+      if (field !== 'consoleUrl' && field !== 'shortLabel' && field !== 'label' && field !== 'workspaceId' && field !== 'apiKey') {
+        return
+      }
+      if ((field === 'workspaceId' || field === 'apiKey') && provider.supportsWorkspaceId !== true) return
       if (provider === null || provider === undefined) return
       const current = store.get().management
       const draft = providerDraftOf(provider, current)
       patchManagement({
         drafts: mapWith(current.drafts, provider.providerId, {
           ...draft,
-          [field]: typeof value === 'string' ? value : '',
+          // v1.3.9: a pasted console URL is reduced to its workspace id as the
+          // user types, so the save never posts a URL or gets rejected.
+          [field]: field === 'workspaceId' ? extractWorkspaceId(value) : typeof value === 'string' ? value : '',
         }),
       })
     }
@@ -5943,6 +5985,43 @@ window.__ModuleLoader__.load({
       return (typeof value === 'string' ? value.trim() : '').length
     }
 
+    /**
+     * One write-only credential field (v1.3.9).
+     *
+     * The Host never sends a stored secret back, so the input always starts empty
+     * and its placeholder reports whether a value is already saved. Typing a new
+     * value stages `{apiKey}` on the draft; the save button then sends it once,
+     * and a successful save clears it again (the Host keeps the secret).
+     */
+    function buildProviderSecretField(provider, management, t, options) {
+      const providerId = provider.providerId
+      const draft = providerDraftOf(provider, management)
+      const disabled = management.busy[providerId] !== undefined
+      const value = typeof draft[options.field] === 'string' ? draft[options.field] : ''
+      return h(
+        'div',
+        { key: options.key, className: 'dsh-tokenlens-field' },
+        h(
+          'div',
+          { className: 'dsh-tokenlens-field-head' },
+          h('span', { className: 'dsh-tokenlens-field-label' }, options.label),
+          h('span', { className: 'dsh-tokenlens-field-hint' }, options.hint),
+        ),
+        h('input', {
+          type: 'password',
+          className: `dsh-tokenlens-input ${options.className}`,
+          [options.dataAttr]: providerId,
+          value,
+          placeholder: options.placeholder,
+          disabled,
+          autoComplete: 'off',
+          spellCheck: false,
+          'aria-label': options.label,
+          onChange: (event) => updateProviderDraft(provider, options.field, event?.target?.value),
+        }),
+      )
+    }
+
     /**
      * One editable name field (v0.12.0): a text input capped at the Host limit,
      * with a permanent limit hint and an inline error while the draft is longer
@@ -6072,6 +6151,20 @@ window.__ModuleLoader__.load({
             : buildDshUnmanagedRow(provider, t)
       const fields = [
         sourceRow,
+        // v1.3.9: Open Design's Control Key cannot come from the DSH model
+        // settings (that route holds the inference key, which the billing API
+        // rejects), so this one provider gets a write-only credential input.
+        provider.supportsWorkspaceId === true
+          ? buildProviderSecretField(provider, management, t, {
+              key: 'apiKey',
+              className: 'dsh-tokenlens-controlkey-input',
+              dataAttr: 'data-provider-controlkey',
+              field: 'apiKey',
+              placeholder: provider.hasKey === true ? t('providerControlKeySaved') : t('providerControlKeyPlaceholder'),
+              label: t('providerControlKey'),
+              hint: t('providerControlKeyHint'),
+            })
+          : null,
         buildProviderNameField(provider, management, t, {
           key: 'shortLabel',
           className: 'dsh-tokenlens-shortlabel-input',

package/index.js

@@ -76,7 +76,7 @@ export const inject = []
 export const PLUGIN_NAME = 'dsh-tokenlens'
 
 /** Plugin version; mirrors package.json (kept here so diagnostics need no fs read). */
-export const PLUGIN_VERSION = '1.3.8'
+export const PLUGIN_VERSION = '1.4.0'
 
 /** Documented defaults; every field of the raw row config is optional. */
 const DEFAULTS = {

package/lib/providers.mjs

@@ -243,6 +243,14 @@ export const PROVIDER_DEFAULTS = {
     // The read-only billing API is scoped to one workspace and authenticated
     // with a Control Key (not the inference API key used for model calls).
     workspaceId: '',
+    // The Design Plan windows live behind a cookie-authenticated console route
+    // (`billing/coding-plan-usage` answers 401 to a Control Key). The same plan
+    // document is served by `billing/funding-check`, which DOES accept the
+    // Control Key, so that is the quota source here.
+    usagePath: '/api/v1/workspaces/{workspaceId}/billing/funding-check',
+    // The account-scoped read that carries the plan tier when the quota route is
+    // unavailable.
+    summaryPath: '/api/v1/billing/summary',
     controlKeyRef: 'OPENDESIGN_CONTROL_KEY',
     apiKeyRef: 'OPENDESIGN_CONTROL_KEY',
     consoleUrl: 'https://open-design.ai/cloud/dashboard',
@@ -786,13 +794,21 @@ function openDesignCredits(value) {
  * and repeated durations keep only the first canonical window.
  */
 export function parseOpenDesignUsage(payload, workspaceId, now = Date.now()) {
-  const document = payload !== null && typeof payload === 'object' && !Array.isArray(payload) ? payload : null
-  if (document === null) throw new UsageError('parse', 'the OpenDesign quota response is not an object')
+  const outer = payload !== null && typeof payload === 'object' && !Array.isArray(payload) ? payload : null
+  if (outer === null) throw new UsageError('parse', 'the OpenDesign quota response is not an object')
+  // Two documents carry the same plan shape: the console route answers it at the
+  // top level, while `billing/funding-check` nests it under `codingPlan`.
+  const nested = outer.codingPlan !== null && typeof outer.codingPlan === 'object' && !Array.isArray(outer.codingPlan)
+  const document = nested ? outer.codingPlan : outer
+  // funding-check omits `eligible` when there is no plan (its `funding` field
+  // then reports `wallet`). Read a missing flag on the nested document as "not
+  // eligible" instead of a parse failure, without mutating the input.
+  const eligible = document.eligible === undefined && nested ? false : document.eligible
   const expected = String(workspaceId ?? '').trim()
   if (typeof document.workspaceId !== 'string' || document.workspaceId !== expected) {
     throw new UsageError('parse', 'the OpenDesign quota response belongs to a different workspace')
   }
-  if (typeof document.eligible !== 'boolean') {
+  if (typeof eligible !== 'boolean') {
     throw new UsageError('parse', 'the OpenDesign quota response has no eligibility flag')
   }
   if (!Array.isArray(document.windows) || document.windows.length > 32) {
@@ -831,7 +847,7 @@ export function parseOpenDesignUsage(payload, workspaceId, now = Date.now()) {
   }
   const windows = windowSet(inputs, now)
   const usable = WINDOW_IDS.some((id) => windows[id] !== null)
-  if (document.eligible === false) {
+  if (eligible === false) {
     if (usable) throw new UsageError('parse', 'the OpenDesign quota response reports an ineligible plan with windows')
     return { windows: windowSet({}, now), plan: null }
   }
@@ -870,6 +886,23 @@ export function parseOpenDesignWallet(payload, workspaceId) {
   }
 }
 
+/**
+ * Parse the OpenDesign account-scoped `billing/summary` document (v1.4.0).
+ *
+ * Only the plan tier is surfaced: credit buckets use a Command-Code-specific
+ * wire shape (remaining/granted/purchased) that OpenDesign's
+ * subscription/recharge split does not map onto, and the wallet already carries
+ * the spendable amount. Everything is optional — a missing tier is null, never
+ * invented.
+ */
+export function parseOpenDesignSummary(payload) {
+  const document = payload !== null && typeof payload === 'object' && !Array.isArray(payload) ? payload : null
+  if (document === null) return { plan: null }
+  const tier = typeof document.membershipTier === 'string' ? document.membershipTier.trim() : ''
+  const plan = tier === '' ? null : { id: tier, label: tier.toUpperCase() }
+  return { plan }
+}
+
 /**
  * The provider adapter table. `read()` performs the required network reads and
  * returns the normalized result; optional reads (subscription/whoami) are
@@ -932,21 +965,53 @@ export const ADAPTERS = {
         authorization: `Bearer ${controlKey}`,
         'x-vela-workspace-id': workspaceId,
       }
-      const usage = await httpJson(`${workspaceBase}/billing/coding-plan-usage`, { method: 'GET', headers })
-      const parsed = parseOpenDesignUsage(usage, workspaceId, now)
+      // v1.4.0: the funding-check document carries the Design Plan windows
+      // (inside `codingPlan`) and the wallet balance in one authenticated read.
+      // `billing/coding-plan-usage` is a cookie-authenticated console route that
+      // answers 401 to a Control Key, so it is tried only as a fallback.
+      const funding = await httpJson(
+        joinUrl(config.baseURL, config.usagePath.replace('{workspaceId}', encodeURIComponent(workspaceId))),
+        { method: 'GET', headers },
+      ).catch(() => undefined)
+      // Keep the wallet read as the independent balance source: funding-check
+      // reports the same amount, but the wallet route is the authoritative one
+      // (and works even when the plan document is missing).
       const wallet = await httpJson(`${workspaceBase}/wallet/balance`, { method: 'GET', headers })
-      const usageMember =
-        usage !== null && typeof usage === 'object' && typeof usage.workspaceMemberId === 'string'
-          ? usage.workspaceMemberId
-          : undefined
       const walletParsed = parseOpenDesignWallet(wallet, workspaceId)
-      if (usageMember !== undefined && usageMember !== walletParsed.workspaceMemberId) {
-        throw new UsageError('parse', 'the OpenDesign wallet and quota responses name different workspace members')
+      let parsed = { windows: null, plan: null }
+      const usage =
+        funding !== undefined
+          ? funding
+          : await httpJson(`${workspaceBase}/billing/coding-plan-usage`, { method: 'GET', headers }).catch(
+              (error) => {
+                // A rejected quota route is not a failed read: the wallet half is
+                // real data. Anything else (network, timeout, 5xx) still propagates.
+                if (error instanceof UsageError && (error.code === 'unauthorized' || error.code === 'forbidden')) {
+                  return undefined
+                }
+                throw error
+              },
+            )
+      if (usage !== undefined) {
+        parsed = parseOpenDesignUsage(usage, workspaceId, now)
+        const usageMember =
+          usage !== null && typeof usage === 'object' && typeof usage.workspaceMemberId === 'string'
+            ? usage.workspaceMemberId
+            : undefined
+        if (usageMember !== undefined && usageMember !== walletParsed.workspaceMemberId) {
+          throw new UsageError('parse', 'the OpenDesign wallet and quota responses name different workspace members')
+        }
       }
+      // `billing/summary` is the account-scoped read that carries the plan tier.
+      // It is display-only: a failure must not void the wallet we already have.
+      const summary = await httpJson(joinUrl(config.baseURL, config.summaryPath), { method: 'GET', headers }).catch(
+        () => undefined,
+      )
+      const parsedSummary = parseOpenDesignSummary(summary)
       return {
         kind: 'windows',
         windows: parsed.windows,
-        plan: parsed.plan,
+        plan: parsed.plan ?? parsedSummary.plan,
         balance: walletParsed.balance,
       }
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-tokenlens",
-  "version": "1.3.8",
+  "version": "1.4.0",
   "type": "module",
   "description": "dsh-TokenLens (词元透镜) — provider-aware plan capacity plus local token statistics (today/7d/30d/all-time, by harness/provider/model/workspace) for DSH.",
   "license": "MIT",