dsh-tokenlens 1.3.9 → 1.4.0

package/CHANGELOG.md

@@ -4,20 +4,23 @@
 
 **版本记录约定**：同一发布日只保留一个章节，标题取当日**最后一个**已发布版本号；当日多次发布的改动合并到该章节，并在标题下注明当日实际发布过的版本号（npm 上仍可安装这些独立版本）。若当日已有发布，后续小改动不再单独增加版本号，而是并入下一篇日志。这样日志按天规整、不出现同日多个小版本。
 
-## 1.3.9 — 2026-11-02
+## 1.4.0 — 2026-11-02
 
-（当日已发布版本：v1.3.5 / v1.3.6 / v1.3.7 / v1.3.8 / v1.3.9）
+（当日已发布版本：v1.3.5 / v1.3.6 / v1.3.7 / v1.3.8 / v1.3.9 / v1.4.0）
 
 - feat(ui): 供应商管理页可为 **Open Design** 填写「工作区 ID」并持久化到插件配置——此前 workspaceId 只能在 profile patch 或 `OPENDESIGN_WORKSPACE_ID` 里设置，用推理 Key 配好供应商后额度卡片仍报错却无处可改
-- feat(ui): **Control Key 也能在弹窗里直接填**（v1.3.9）——Open Design 卡片新增密码型输入框，粘贴保存即写入插件自己的 store；输入框是只写的（Host 只回 `hasKey` / `keySource`，secret 永不下发浏览器），保存成功后自动清空并改用「已保存；要替换请重新粘贴」占位提示。小白用户不再需要手改 `.credentials.yaml`
+- feat(ui): **Control Key 也能在弹窗里直接填**——Open Design 卡片新增密码型输入框，粘贴保存即写入插件自己的 store；输入框是只写的（Host 只回 `hasKey` / `keySource`，secret 永不下发浏览器），保存成功后自动清空并改用「已保存；要替换请重新粘贴」占位提示。小白用户不再需要手改 `.credentials.yaml`
 - feat(ui): 「工作区 ID」输入框支持**直接粘贴整条控制台地址**——`https://open-design.ai/cloud/dashboard?workspaceId=ws_x&tab=billing` 会自动提取出 `ws_x`，避免用户复制整条 URL 后被校验拒绝
+- **fix(open-design): 修掉「配好了仍报错」**——额度窗口原来只查 `billing/coding-plan-usage`，而那条路由由控制台的浏览器 Cookie 会话鉴权，**任何 Control Key 都会被 401**（控制台前端自己也走 cookie）。现在改用**同样接受 Control Key** 的 `billing/funding-check`，Design Plan 的 5 小时 / 7 天窗口正常读出
+- fix(open-design): 改为钱包、窗口、套餐三层**互相独立降级**——先读 `wallet/balance`（余额）与 `billing/summary`（套餐档位，如 GO / PLUS），窗口再由 funding-check 补齐；任一路由不可用只少一块数据，不再整条报错。旧版会把 quota 的 401 当成整体失败，导致钱包也读不到
+- feat(wire): `billing/summary` 的 `membershipTier` 映射为 `plan`（`GO` / `PLUS` / `PRO` / `MAX`），弹窗标题行显示「套餐：GO」
 - feat(ui): Open Design 额度失败时的引导——详情弹窗的错误条说明「额度查询需要工作区 ID 与 Control Key（不是推理 Key）」，并提供「去配置」按钮直接跳到供应商管理页
 - feat(host): Host 侧错误文案更具体（区分缺 workspaceId / 缺 Control Key，并指向管理页）；`providerUpdate` 接受 `workspaceId`，校验为 1–120 位标识符字符（字母、数字、`. _ : @ -`），路径穿越/空格/超长一律拒绝
 - feat(wire): `providers[]` 仅对声明了 workspace 的适配器（Open Design）下发 `workspaceId` 字段；其余供应商不下发，客户端据此决定是否渲染输入框（旧 Host 无此字段 ⇒ 不渲染，自然降级）
 - feat(ui): Open Design 缺配置时 chip 不再按 `missing-key` 静默隐藏，而是显示「待配置」并可点进详情看引导——否则用户既看不到提示也没有入口
 - fix(tool): Agent 工具 `tokenlens_usage` 的 `updateCheck` 动作此前虽在枚举里却会落到用量读取分支，返回当前供应商的用量或错误；现在正确执行更新检查并返回 `UpdateInfo`
 - docs: 中英 README 补充 **workspace ID 与 Control Key 到底在哪里取**——控制台的「套餐与余额」页没有独立的 ID 字段，workspace ID 取自地址栏的 `?workspaceId=`（成员邀请预览页也会显示「工作空间 ID」），而 `~/.amr/config.json` 只存 `controlKey` / `runtimeKey` / `apiUrl` / `linkUrl`、不含 workspace ID；Control Key 是桌面端 / `vela login` 写入该文件的 `profiles.prod.controlKey`，用推理 Key 冒充会得到 401
-- 测试：280 → 289（workspace ID 校验/持久化/清空与 URL 提取、管理页字段渲染、Control Key 只写保存与不回声、缺 workspaceId 的 Host 报错与引导按钮、待配置 chip、工具 updateCheck 分发）
+- 测试：280 → 292（workspace ID 校验/持久化/清空与 URL 提取、Control Key 只写保存与不回声、funding-check 嵌套文档解析、窗口不可用时的钱包降级、summary 缺失时不臆造档位、待配置 chip、工具 updateCheck 分发）
 
 ## 1.3.4 — 2026-11-01
 

package/PROTOCOL.md

@@ -124,6 +124,20 @@ returns it, only `hasKey`/`keySource`). The environment/credential sources
 (`OPENDESIGN_CONTROL_KEY`, `VELA_CONTROL_KEY`, `OPENDESIGN_WORKSPACE_ID`) still
 work and the page override wins.
 
+Reads, in independent layers (v1.4.0) — each may fail without voiding the others:
+
+| read | path | provides |
+|---|---|---|
+| wallet | `GET /api/v1/workspaces/{id}/wallet/balance` | `balance` (USD, authoritative) |
+| plan windows | `GET /api/v1/workspaces/{id}/billing/funding-check` | `windows` from its nested `codingPlan` (`eligible`, `tier`, 5h/7d credit windows) |
+| plan tier | `GET /api/v1/billing/summary` | `plan` from `membershipTier` (`go` → `GO`) |
+
+`billing/coding-plan-usage` carries the same plan document at the top level but is
+served by the console's **cookie-authenticated** route: a Control Key always gets
+HTTP 401 there (the console UI itself authenticates with a session cookie), so it
+is only a fallback. The wallet is therefore always read first; the plan endpoint
+must not turn a readable balance into a hard error.
+
 Rules:
 
 - `percent` is clamped to `0..100`; an unknown percentage is `null` (render "—"), never a fake 0.

package/README.md

@@ -321,11 +321,11 @@ Control Key 是 **Open Design 桌面端/CLI 登录时写入本机的会话凭据
 | `minimax` | `GET https://api.minimax.io/v1/api/openplatform/coding_plan/remains`（订阅 Key；国内站 `api.minimaxi.com`） | 5 小时 / 每周 已用百分比（best-effort） |
 | `zhipu-cn` | `GET https://open.bigmodel.cn/api/monitor/usage/quota/limit`（`ZHIPU_API_KEY`） | GLM Coding Plan：5 小时 / 本周 / 每月 百分比 + 方案 |
 | `volcengine` | Coding Plan / AgentPlan：`POST https://open.volcengineapi.com/?Action=GetCodingPlanUsage&Version=2024-01-01`（Signature V4，`VOLCENGINE_ACCESS_KEY_ID` + `VOLCENGINE_SECRET_ACCESS_KEY`） | 5 小时 / 本周 / 每月 百分比 + 档位 |
-| `open-design` | 只读计费接口：`GET https://amr-api.open-design.ai/api/v1/workspaces/{workspaceId}/billing/coding-plan-usage` + `…/wallet/balance`（workspace ID + Control Key：`OPENDESIGN_CONTROL_KEY` / `VELA_CONTROL_KEY`，非推理 Key） | Design Plan 的 5 小时 / 7 天 已用百分比 + 重置时间；钱包余额（USD） |
+| `open-design` | 只读计费接口：`GET …/api/v1/workspaces/{workspaceId}/wallet/balance`（钱包）+ `…/billing/funding-check`（Design Plan 窗口，位于 `codingPlan` 内）+ `/api/v1/billing/summary`（套餐档位），workspace ID + Control Key：`OPENDESIGN_CONTROL_KEY` / `VELA_CONTROL_KEY`，非推理 Key | Design Plan 的 5 小时 / 7 天 已用百分比 + 重置时间；套餐档位；钱包余额（USD） |
 
 - OpenCode 的额度定义见[官方文档](https://opencode.ai/docs/go/#usage-limits)（5h = 月度额度的 20%、周 = 50%、月 = 100%）；接口只返回百分比，插件也只画百分比。
 - Command Code 的 `/alpha/*` 是官方 CLI 自用的私有计费路由；免费 / 无方案账户返回空窗口（显示 `—`），插件不会用方案目录猜额度。
-- Open Design 的窗口按账户实际返回的时长渲染：Go 同时有 5 小时和 7 天窗口，Plus / Pro / Max 只有 7 天窗口；钱包余额是独立于窗口的 USD 额度，用尽后继续扣钱包。查询要求工作区权限，鉴权失败会明确显示错误而不是 0；工作区 ID 与 Control Key 缺任一项时，弹窗会指出缺哪一项并给出「去配置」入口（v1.3.5）。
+- Open Design 的窗口按账户实际返回的时长渲染：Go 同时有 5 小时和 7 天窗口，Plus / Pro / Max 只有 7 天窗口；钱包余额是独立于窗口的 USD 额度，用尽后继续扣钱包。查询要求工作区权限，鉴权失败会明确显示错误而不是 0；工作区 ID 与 Control Key 缺任一项时，弹窗会指出缺哪一项并给出「去配置」入口（v1.3.5）。窗口、余额、套餐档位是**三层独立读取**（v1.4.0）：任一接口不可用时只少那一块数据，不会整套报错。
 - 未配置凭据的供应商 chip 静默隐藏；`zai`、`minimax`、`deepinfra` 属 best-effort 适配（未公开接口，失败时按可重试错误优雅降级）。
 - 各供应商的元数据（`kind` / `label` / `shortLabel` / `baseURL` / `apiKeyRef` / `consoleUrl`）集中在 `lib/providers.mjs` 的 `PROVIDER_DEFAULTS` 与 `ADAPTERS` 中，新增适配器只需在该文件登记并补测试。
 
@@ -437,7 +437,7 @@ Host 半注册 `tokenlens_usage`，参数 `action`（默认 `snapshot`）与可
 
 ## 验证
 
-- `node --test`：**286 个自动化用例**，覆盖 Host 数据层、供应商适配器、统计折叠、各 harness 读取、插件集成与浏览器端渲染 / 交互。
+- `node --test`：**292 个自动化用例**，覆盖 Host 数据层、供应商适配器、统计折叠、各 harness 读取、插件集成与浏览器端渲染 / 交互。
 - 在真实环境中验证过 **5 个 harness** 的数据源；本机统计与独立的 SQLite 查询、独立的日志解析逐项对账（差额为 0），跨 harness 合并与供应商映射算术自洽。
 - 供应商接口按各官方文档与参考客户端行为验证；未配置凭据时 chip 静默隐藏，接口异常时按可重试错误降级。
 

package/index.js

@@ -76,7 +76,7 @@ export const inject = []
 export const PLUGIN_NAME = 'dsh-tokenlens'
 
 /** Plugin version; mirrors package.json (kept here so diagnostics need no fs read). */
-export const PLUGIN_VERSION = '1.3.9'
+export const PLUGIN_VERSION = '1.4.0'
 
 /** Documented defaults; every field of the raw row config is optional. */
 const DEFAULTS = {

package/lib/providers.mjs

@@ -243,6 +243,14 @@ export const PROVIDER_DEFAULTS = {
     // The read-only billing API is scoped to one workspace and authenticated
     // with a Control Key (not the inference API key used for model calls).
     workspaceId: '',
+    // The Design Plan windows live behind a cookie-authenticated console route
+    // (`billing/coding-plan-usage` answers 401 to a Control Key). The same plan
+    // document is served by `billing/funding-check`, which DOES accept the
+    // Control Key, so that is the quota source here.
+    usagePath: '/api/v1/workspaces/{workspaceId}/billing/funding-check',
+    // The account-scoped read that carries the plan tier when the quota route is
+    // unavailable.
+    summaryPath: '/api/v1/billing/summary',
     controlKeyRef: 'OPENDESIGN_CONTROL_KEY',
     apiKeyRef: 'OPENDESIGN_CONTROL_KEY',
     consoleUrl: 'https://open-design.ai/cloud/dashboard',
@@ -786,13 +794,21 @@ function openDesignCredits(value) {
  * and repeated durations keep only the first canonical window.
  */
 export function parseOpenDesignUsage(payload, workspaceId, now = Date.now()) {
-  const document = payload !== null && typeof payload === 'object' && !Array.isArray(payload) ? payload : null
-  if (document === null) throw new UsageError('parse', 'the OpenDesign quota response is not an object')
+  const outer = payload !== null && typeof payload === 'object' && !Array.isArray(payload) ? payload : null
+  if (outer === null) throw new UsageError('parse', 'the OpenDesign quota response is not an object')
+  // Two documents carry the same plan shape: the console route answers it at the
+  // top level, while `billing/funding-check` nests it under `codingPlan`.
+  const nested = outer.codingPlan !== null && typeof outer.codingPlan === 'object' && !Array.isArray(outer.codingPlan)
+  const document = nested ? outer.codingPlan : outer
+  // funding-check omits `eligible` when there is no plan (its `funding` field
+  // then reports `wallet`). Read a missing flag on the nested document as "not
+  // eligible" instead of a parse failure, without mutating the input.
+  const eligible = document.eligible === undefined && nested ? false : document.eligible
   const expected = String(workspaceId ?? '').trim()
   if (typeof document.workspaceId !== 'string' || document.workspaceId !== expected) {
     throw new UsageError('parse', 'the OpenDesign quota response belongs to a different workspace')
   }
-  if (typeof document.eligible !== 'boolean') {
+  if (typeof eligible !== 'boolean') {
     throw new UsageError('parse', 'the OpenDesign quota response has no eligibility flag')
   }
   if (!Array.isArray(document.windows) || document.windows.length > 32) {
@@ -831,7 +847,7 @@ export function parseOpenDesignUsage(payload, workspaceId, now = Date.now()) {
   }
   const windows = windowSet(inputs, now)
   const usable = WINDOW_IDS.some((id) => windows[id] !== null)
-  if (document.eligible === false) {
+  if (eligible === false) {
     if (usable) throw new UsageError('parse', 'the OpenDesign quota response reports an ineligible plan with windows')
     return { windows: windowSet({}, now), plan: null }
   }
@@ -870,6 +886,23 @@ export function parseOpenDesignWallet(payload, workspaceId) {
   }
 }
 
+/**
+ * Parse the OpenDesign account-scoped `billing/summary` document (v1.4.0).
+ *
+ * Only the plan tier is surfaced: credit buckets use a Command-Code-specific
+ * wire shape (remaining/granted/purchased) that OpenDesign's
+ * subscription/recharge split does not map onto, and the wallet already carries
+ * the spendable amount. Everything is optional — a missing tier is null, never
+ * invented.
+ */
+export function parseOpenDesignSummary(payload) {
+  const document = payload !== null && typeof payload === 'object' && !Array.isArray(payload) ? payload : null
+  if (document === null) return { plan: null }
+  const tier = typeof document.membershipTier === 'string' ? document.membershipTier.trim() : ''
+  const plan = tier === '' ? null : { id: tier, label: tier.toUpperCase() }
+  return { plan }
+}
+
 /**
  * The provider adapter table. `read()` performs the required network reads and
  * returns the normalized result; optional reads (subscription/whoami) are
@@ -932,21 +965,53 @@ export const ADAPTERS = {
         authorization: `Bearer ${controlKey}`,
         'x-vela-workspace-id': workspaceId,
       }
-      const usage = await httpJson(`${workspaceBase}/billing/coding-plan-usage`, { method: 'GET', headers })
-      const parsed = parseOpenDesignUsage(usage, workspaceId, now)
+      // v1.4.0: the funding-check document carries the Design Plan windows
+      // (inside `codingPlan`) and the wallet balance in one authenticated read.
+      // `billing/coding-plan-usage` is a cookie-authenticated console route that
+      // answers 401 to a Control Key, so it is tried only as a fallback.
+      const funding = await httpJson(
+        joinUrl(config.baseURL, config.usagePath.replace('{workspaceId}', encodeURIComponent(workspaceId))),
+        { method: 'GET', headers },
+      ).catch(() => undefined)
+      // Keep the wallet read as the independent balance source: funding-check
+      // reports the same amount, but the wallet route is the authoritative one
+      // (and works even when the plan document is missing).
       const wallet = await httpJson(`${workspaceBase}/wallet/balance`, { method: 'GET', headers })
-      const usageMember =
-        usage !== null && typeof usage === 'object' && typeof usage.workspaceMemberId === 'string'
-          ? usage.workspaceMemberId
-          : undefined
       const walletParsed = parseOpenDesignWallet(wallet, workspaceId)
-      if (usageMember !== undefined && usageMember !== walletParsed.workspaceMemberId) {
-        throw new UsageError('parse', 'the OpenDesign wallet and quota responses name different workspace members')
+      let parsed = { windows: null, plan: null }
+      const usage =
+        funding !== undefined
+          ? funding
+          : await httpJson(`${workspaceBase}/billing/coding-plan-usage`, { method: 'GET', headers }).catch(
+              (error) => {
+                // A rejected quota route is not a failed read: the wallet half is
+                // real data. Anything else (network, timeout, 5xx) still propagates.
+                if (error instanceof UsageError && (error.code === 'unauthorized' || error.code === 'forbidden')) {
+                  return undefined
+                }
+                throw error
+              },
+            )
+      if (usage !== undefined) {
+        parsed = parseOpenDesignUsage(usage, workspaceId, now)
+        const usageMember =
+          usage !== null && typeof usage === 'object' && typeof usage.workspaceMemberId === 'string'
+            ? usage.workspaceMemberId
+            : undefined
+        if (usageMember !== undefined && usageMember !== walletParsed.workspaceMemberId) {
+          throw new UsageError('parse', 'the OpenDesign wallet and quota responses name different workspace members')
+        }
       }
+      // `billing/summary` is the account-scoped read that carries the plan tier.
+      // It is display-only: a failure must not void the wallet we already have.
+      const summary = await httpJson(joinUrl(config.baseURL, config.summaryPath), { method: 'GET', headers }).catch(
+        () => undefined,
+      )
+      const parsedSummary = parseOpenDesignSummary(summary)
       return {
         kind: 'windows',
         windows: parsed.windows,
-        plan: parsed.plan,
+        plan: parsed.plan ?? parsedSummary.plan,
         balance: walletParsed.balance,
       }
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-tokenlens",
-  "version": "1.3.9",
+  "version": "1.4.0",
   "type": "module",
   "description": "dsh-TokenLens (词元透镜) — provider-aware plan capacity plus local token statistics (today/7d/30d/all-time, by harness/provider/model/workspace) for DSH.",
   "license": "MIT",