dsh-usage-state 0.4.7 → 0.4.9

package/CHANGELOG.md

@@ -1,11 +1,30 @@
 # 更新日志（Changelog）
 
-用户可见的变更按版本记录于此。设计取舍见 [设计修订](https://github.com/takboo/dsh-usage-state/blob/main/docs/design-changelog.md)，发布验证流程见 [发布与验收](https://github.com/takboo/dsh-usage-state/blob/main/docs/release.md)。
+用户可见的变更按版本记录于此。当前设计见 [设计共识](https://github.com/takboo/dsh-usage-state/blob/main/docs/design-consensus.md)，发布验证流程见 [发布与验收](https://github.com/takboo/dsh-usage-state/blob/main/docs/release.md)。
 
 格式参照 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)，版本号遵循语义化版本。0.3.0起发布npm，之前仅GitHub分发。已发布日期按 [npm registry](https://registry.npmjs.org/dsh-usage-state) 的UTC记录；历史比较引用说明见文末。
 
 ## [Unreleased]
 
+## [0.4.9] - 2026-10-23
+
+### Added
+
+- DeepSeek 新增账号余额模式：`deepseek-account` 使用 Harness 登录服务读取充值与赠送钱包，`deepseek-official` 保持 API Key 余额；凭据、缓存及登录提示分别处理，账号模式无需 API Key。
+- 退出登录、换号与晚返回响应隔离；非法钱包不当成零，失败只保留同一登录身份的上次成功余额。
+
+### Documentation
+
+- 重写当前文档入口、架构、排查和待办，归档旧审计、研究与设计过程；删除重复研究索引和过时发布操作，集中保留真实验证边界。
+
+## [0.4.8] - 2026-10-17
+
+### Compatibility
+
+- 完成 DSH 0.2.1-rc.2 兼容性复验：隔离 tarball 安装与宿主启动、设置页、模型目录、getState/describeCredentials、已保存凭据优先级和隐藏/API配置往返均通过；输入区状态行可与新增的1017模型标记同时显示。
+- 未发现新的运行兼容性问题，源码及三个预构建入口与0.4.7一致。现有 `^0.2.0-rc.2 || ^0.2.1-rc.1` 已覆盖rc.2，保留支持下界及peer范围，更新中英兼容性声明。
+- CI将0.2.1-rc.1与0.2.1-rc.2纳入独立矩阵，分别运行精确版本的真实Typert host/browser及产物契约测试；333项基线测试及rc.2的18项契约测试通过。浏览器验证使用本地模拟余额与模型流，不访问真实厂商账户。
+
 ## [0.4.7] - 2026-10-17
 
 ### Fixed
@@ -127,7 +146,9 @@
 
 0.4.5起建立版本tag/Release；更早发布没有保存这些引用。0.3.0至0.4.4的比较端点来自各npm版本的gitHead；0.2系列引用对应实现提交，不能替代当时没有保存的正式发布产物。早期日期沿用历史版本记录。今后版本应按发布流程建立稳定引用。
 
-[Unreleased]: https://github.com/takboo/dsh-usage-state/compare/v0.4.7...HEAD
+[Unreleased]: https://github.com/takboo/dsh-usage-state/compare/v0.4.9...HEAD
+[0.4.9]: https://github.com/takboo/dsh-usage-state/compare/v0.4.8...v0.4.9
+[0.4.8]: https://github.com/takboo/dsh-usage-state/compare/v0.4.7...v0.4.8
 [0.4.7]: https://github.com/takboo/dsh-usage-state/compare/v0.4.6...v0.4.7
 [0.4.6]: https://github.com/takboo/dsh-usage-state/compare/v0.4.5...v0.4.6
 [0.4.5]: https://github.com/takboo/dsh-usage-state/compare/3ad9a71e2f7e4b9a05c69bc529e396a364ae6aeb...v0.4.5

package/README.en.md

@@ -4,7 +4,7 @@
 
 [![CI](https://github.com/takboo/dsh-usage-state/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/takboo/dsh-usage-state/actions/workflows/ci.yml) [![npm](https://img.shields.io/npm/v/dsh-usage-state)](https://www.npmjs.com/package/dsh-usage-state)
 
-> **Release status:** Current version **0.4.7** verifies compatibility with DSH **0.2.1-rc.1** and fixes credential-service lookup across startup ordering. See the [GitHub Release](https://github.com/takboo/dsh-usage-state/releases/tag/v0.4.7) for the tarball and checksum and the [Changelog](CHANGELOG.md#047---2026-10-17) for details.
+> **0.4.9** adds DeepSeek Harness account sign-in balances, separate from API Key queries. See the [GitHub Release](https://github.com/takboo/dsh-usage-state/releases/tag/v0.4.9) for the tarball and checksum and the [Changelog](CHANGELOG.md#049---2026-10-23) for details.
 
 Show the current model provider's **account balance** or **coding-plan quota** above the composer input in [DSH (DeepSeek Harness)](https://github.com/deepseek-ai/deepseek-harness). The line matches the input card's width and preserves the native statistics and context meter.
 
@@ -23,7 +23,7 @@ DeepSeek · ¥58.13
 
 ## Install
 
-Requires DSH matching `^0.2.0-rc.2 || ^0.2.1-rc.1` (both candidates revalidated). The prebuilt plugin declares Node ≥20. Install into the `web` profile you actually use.
+Requires DSH matching `^0.2.0-rc.2 || ^0.2.1-rc.1` (verified on 0.2.0-rc.2, 0.2.1-rc.1, and 0.2.1-rc.2). The prebuilt plugin declares Node ≥20. Install into the `web` profile you actually use.
 
 Install from npm:
 
@@ -47,22 +47,25 @@ Use historical version 0.3.2 on DSH 0.1; it does not work on 0.2. Version 0.4.0
 ## Quick start
 
 1. Open **Settings → Usage state** to inspect providers, models and the detected source.
-2. Keep Auto for recognized providers, or choose a supported API, Coding Plan or Hidden option.
+2. Keep Auto for recognized providers, or choose a supported API Key balance, Account balance, Coding Plan or Hidden option.
 3. Set your instance URL for a self-hosted Sub2API source. The current model's reading appears above the input.
 4. Use Refresh now for an explicit query. Check the settings error and the [troubleshooting guide (Chinese)](https://github.com/takboo/dsh-usage-state/blob/main/docs/troubleshooting.md) if it fails.
 
-Advanced controls offer source, endpoint, credential name and key writes. Explicit provider overrides take precedence over legacy source defaults. Descriptions and requests share the candidate order; saves prioritize the explicit ref. Pinned endpoints do not try mirrors, and account configuration/key changes discard previous-identity readings. Configuration and credential write permissions are separate; saves/clears report failure and prevent repeated in-flight operations.
+Advanced controls offer source selection; API Key mode also provides endpoint, credential name and key writes. Explicit provider overrides take precedence over legacy source defaults. Descriptions and requests share the candidate order; saves prioritize the explicit ref. Pinned endpoints do not try mirrors, and account configuration/key changes discard previous-identity readings. Configuration and credential write permissions are separate; saves/clears report failure and prevent repeated in-flight operations.
 
 ## Sources
 
-| Source | API reading | Coding-plan reading | Main credential |
+| Source | Balance reading | Coding-plan reading | Main credential |
 |---|---|---|---|
-| DeepSeek official | CNY/USD balance | — | DEEPSEEK_API_KEY |
+| DeepSeek official API Key | CNY/USD balance | — | DEEPSEEK_API_KEY |
+| DeepSeek account sign-in | CNY/USD recharge and bonus balance | — | Current Harness login |
 | z.ai / Zhipu GLM | — | 5h / 7d used % | ZAI_API_KEY and related refs |
 | Kimi / Moonshot | CNY balance | Kimi Code subscription windows | MOONSHOT_API_KEY / KIMI_CODING_API_KEY |
 | OpenCode Zen Go | — | 5h / 7d / 30d used % | OPENCODE_GO_API_KEY / OPENCODE_API_KEY |
 | Sub2API | Balance or key allowance | Depends on the instance, e.g. 5h / 1d / 7d / 30d | SUB2API_API_KEY and instance URL |
 
+**DeepSeek Desktop account sign-in:** `deepseek-account` automatically uses “Account balance” through the Harness account service, adding recharge and bonus wallets. `deepseek-official` uses “API Key balance”. Queries and caches are separate; account mode never probes or falls back to `DEEPSEEK_API_KEY`. Sign in through Harness account settings. Account mode requires the host account service; older hosts without it need an upgrade. Harness owns the endpoint and login grant; account mode has no API key fields.
+
 Kimi Code routes `kimi-code`, `kimi-coding`, and `kimi-for-coding`, plus custom providers declaring `api.kimi.com` / `api.kimi.ai`, automatically read subscription usage. The plugin displays only returned windows: 5h, 7d, monthly total, and monthly code usage. Moonshot regional APIs retain CNY balance mode. Explicit settings take precedence.
 
 Percentages mean **used**. z.ai keys belong to their China/global region; China is the default endpoint and failures may try the mirror. The current cache merges by source and mode, so separate keys/instances must not be treated as supported independent accounts. Endpoints, field semantics and extension steps are in the [adapter guide (Chinese)](https://github.com/takboo/dsh-usage-state/blob/main/docs/adapters.md).
@@ -83,15 +86,14 @@ Provider settings and advanced controls:
 
 The host schedules refreshes 2 seconds after a turn ends and has a 5-minute fallback timer. The browser reads the RPC mirror every 30 seconds. Ordinary polling initializes a missing or changed account identity, otherwise it does not shorten idle queries to once a minute. Successful requests have a default 60-second minimum; explicit refresh can bypass it, and active retries after failure are not throttled by that successful-request interval. Editing the idle interval reschedules the timer.
 
-The plugin queries balances/quotas and reads the selected model and provider catalog. It writes no session logs and reports no readings to third parties. The host does not return stored key values to the browser; a key the user actively pastes is sent through DSH's credential service to the credential file in the selected home. Credential precedence follows the host: DSH 0.2.1-rc.1 Web/Desktop prefers saved credentials, with environment values as fallback; 0.2.0-rc.2 prefers the environment. The settings page reflects the host’s actual write permissions.
+The plugin queries balances/quotas and reads the selected model and provider catalog. It writes no session logs and reports no readings to third parties. The host does not return stored key values to the browser; a key the user actively pastes is sent through DSH's credential service to the credential file in the selected home. Credential precedence follows the host: DSH 0.2.1-rc.1/rc.2 Web/Desktop prefers saved credentials, with environment values as fallback; 0.2.0-rc.2 prefers the environment. The settings page reflects the host’s actual write permissions.
 
 ## Known limitations
 
 See the [Backlog (Chinese)](https://github.com/takboo/dsh-usage-state/blob/main/docs/backlog.md) for remediation status and verification scope.
 
-- **Older npm 0.4.4 and earlier:** still has credential override, pin/cache identity, legacy hiding, default ordering and failure-display defects. It still divides Moonshot balances ≥100 yuan by 100 and may turn invalid DeepSeek amounts into zero. These are fixed in 0.4.5; upgrade if you use an older version. Cross-check old-version amounts against the [official API](https://platform.kimi.com/docs/api/balance.md).
 - **Account scope:** one target is still selected per source and mode. Identity isolation does not add independent multi-account support.
-- **Live verification:** Kimi Code monthly quotas, Sub2API accounts, high-threshold colors, real credential writes and nonzero OpenCode readings still lack live coverage. Local interaction tests do not replace that acceptance.
+- **Live verification:** this release’s real Desktop account login and visuals, Kimi Code monthly quotas, Sub2API accounts, high-threshold colors, real credential writes and nonzero OpenCode readings still lack live coverage. Local interaction tests do not replace that acceptance.
 - **Scope:** the line can be absent without a selected model or when hidden; clicking it does not open settings; readings are not saved as history.
 
 ## Development and docs
@@ -109,6 +111,6 @@ See the [development guide (Chinese)](https://github.com/takboo/dsh-usage-state/
 
 ## Acknowledgements and license
 
-Thanks to [dsh-cost-meter](https://github.com/Han-1413141/dsh-cost-meter) by Han-1413141 (MIT) for data-source behavior references. This TypeScript implementation was written independently; endpoint, field and compatibility provenance is recorded in the [upstream analysis](https://github.com/takboo/dsh-usage-state/blob/main/docs/research/dsh-cost-meter-analysis.md). DSH provides the settings, credentials, RPC, slots and UI primitives.
+Thanks to [dsh-cost-meter](https://github.com/Han-1413141/dsh-cost-meter) by Han-1413141 (MIT) for data-source behavior references. This TypeScript implementation was written independently; endpoint, field and compatibility provenance is recorded in the [upstream analysis](https://github.com/takboo/dsh-usage-state/blob/main/docs/archive/research/dsh-cost-meter-analysis.md). DSH provides the settings, credentials, RPC, slots and UI primitives.
 
 [MIT](LICENSE). Report problems or attribution suggestions through [Issues](https://github.com/takboo/dsh-usage-state/issues).

package/README.md

@@ -4,7 +4,7 @@
 
 [![CI](https://github.com/takboo/dsh-usage-state/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/takboo/dsh-usage-state/actions/workflows/ci.yml) [![npm](https://img.shields.io/npm/v/dsh-usage-state)](https://www.npmjs.com/package/dsh-usage-state)
 
-> **发布状态**：当前版本 **0.4.7**，已验证 DSH **0.2.1-rc.1** 兼容性，并修复启动顺序导致的凭据服务读取问题。安装包及校验文件见 [GitHub Release](https://github.com/takboo/dsh-usage-state/releases/tag/v0.4.7)，详情见 [更新日志](CHANGELOG.md#047---2026-10-17)。
+> **0.4.9** 新增 DeepSeek Harness 账号登录余额，与 API Key 查询独立。安装包及校验文件见 [GitHub Release](https://github.com/takboo/dsh-usage-state/releases/tag/v0.4.9)，详情见 [更新日志](CHANGELOG.md#049---2026-10-23)。
 
 在 [DSH（DeepSeek Harness）](https://github.com/deepseek-ai/deepseek-harness) 输入框上方显示当前模型供应商的**账户余额**或**套餐额度**。状态行与输入卡片同宽，保留原生统计行和上下文计量器。
 
@@ -23,7 +23,7 @@ DeepSeek · ¥58.13
 
 ## 安装
 
-要求：DSH版本满足 `^0.2.0-rc.2 || ^0.2.1-rc.1`（已复验这两个候选版本），运行预构建插件声明Node≥20，安装到正在使用的 `web` profile。
+要求：DSH版本满足 `^0.2.0-rc.2 || ^0.2.1-rc.1`（已验证0.2.0-rc.2、0.2.1-rc.1和0.2.1-rc.2），运行预构建插件声明Node≥20，安装到正在使用的 `web` profile。
 
 从npm安装：
 
@@ -47,22 +47,25 @@ DSH0.1使用历史版本0.3.2；该版本不适配0.2。0.4.0有RPC挂载缺陷
 ## 快速开始
 
 1. 打开 **设置→用量状态**，查看供应商、模型和检测到的数据源。
-2. 对已识别供应商保留“自动”，或选择其支持的API、Coding Plan、隐藏。
+2. 对已识别供应商保留“自动”，或选择其支持的API Key余额、账号余额、Coding Plan、隐藏。
 3. 自建Sub2API在高级区填写实例地址；已配置模型的当前读数显示在输入框上方。
 4. “立即刷新”用于主动查询；出错先查看设置页原因及 [排查指南](https://github.com/takboo/dsh-usage-state/blob/main/docs/troubleshooting.md)。
 
-高级区提供数据源、端点、凭据名和密钥写入入口。显式provider覆盖优先于旧source默认；凭据描述与读取共用候选顺序，保存优先写显式ref。固定端点不试镜像，配置或凭据身份变化后清除旧身份读数。只读配置与凭据写入权限分别处理，保存/清除过程会显示失败并禁用重复操作。
+高级区提供数据源选择；API Key模式另有端点、凭据名和密钥写入入口。显式provider覆盖优先于旧source默认；凭据描述与读取共用候选顺序，保存优先写显式ref。固定端点不试镜像，配置或凭据身份变化后清除旧身份读数。只读配置与凭据写入权限分别处理，保存/清除过程会显示失败并禁用重复操作。
 
 ## 数据源
 
-| 来源 | API读数 | Coding Plan读数 | 主要凭据 |
+| 来源 | 余额读数 | Coding Plan读数 | 主要凭据 |
 |---|---|---|---|
-| DeepSeek官方 | CNY/USD余额 | — | DEEPSEEK_API_KEY |
+| DeepSeek官方 API Key | CNY/USD余额 | — | DEEPSEEK_API_KEY |
+| DeepSeek账号登录 | CNY/USD充值与赠送余额 | — | Harness当前登录账号 |
 | z.ai / 智谱GLM | — | 5h / 7d已用% | ZAI_API_KEY等 |
 | Kimi / Moonshot | 人民币余额 | Kimi Code订阅窗口 | MOONSHOT_API_KEY / KIMI_CODING_API_KEY |
 | OpenCode Zen Go | — | 5h / 7d / 30d已用% | OPENCODE_GO_API_KEY / OPENCODE_API_KEY |
 | Sub2API | 余额或key配额 | 按实例响应，如5h / 1d / 7d / 30d | SUB2API_API_KEY及实例地址 |
 
+**DeepSeek 桌面端账号登录**：`deepseek-account` 路由自动选择「账号余额」，通过 Harness 登录服务读取充值与赠送余额之和，无需 API Key；`deepseek-official` 路由选择「API Key 余额」。两者独立查询和缓存，账号模式不会探测或回退使用 `DEEPSEEK_API_KEY`。请在 Harness 账号设置中登录；账号模式要求宿主提供账号服务；旧宿主缺少该服务时需升级宿主。账号模式的端点与登录凭据由宿主管理，高级区不提供 API Key 输入。
+
 Kimi Code 的 `kimi-code`、`kimi-coding`、`kimi-for-coding` provider，以及声明 `api.kimi.com` / `api.kimi.ai` 的自定义 provider，会自动读取套餐用量。支持 5h、7d、月总额度及编程月用量，仅展示账户实际返回的窗口。Moonshot 国内/国际 API 继续显示人民币余额；可在设置中显式选择模式。
 
 百分比表示**已用**。z.ai的key分国内/国际区域；默认国内地址，失败可尝试镜像。当前缓存按数据源与模式合并，不能将不同密钥/实例视为已支持独立多账户。厂商端点、字段和扩展步骤见 [适配器指南](https://github.com/takboo/dsh-usage-state/blob/main/docs/adapters.md)。
@@ -83,15 +86,14 @@ OpenCode Zen Go三个窗口，独立状态行位于输入框上方：
 
 宿主默认在回合结束2秒后调度刷新，并有5分钟兜底定时器；浏览器每30秒拉取RPC镜像。普通轮询仅在读数缺失或有效身份变化时初始化查询，不把idle查询改成每分钟一次。成功请求的默认最小间隔为60秒，显式刷新可绕过，失败的主动重试不受该成功间隔限制；修改空闲间隔会重调定时器。
 
-插件查询余额/额度并读取当前模型及供应商目录，不写会话日志，也不向第三方上报这些读数。宿主不把已保存的密钥值返回浏览器；用户主动粘贴的草稿经DSH凭据服务写入所用home的凭据文件。凭据优先级跟随宿主：DSH 0.2.1-rc.1 的 Web/桌面端优先使用已保存凭据，环境变量作为回退；0.2.0-rc.2 则优先使用环境变量。凭据权限以设置页实际返回为准。
+插件查询余额/额度并读取当前模型及供应商目录，不写会话日志，也不向第三方上报这些读数。宿主不把已保存的密钥值返回浏览器；用户主动粘贴的草稿经DSH凭据服务写入所用home的凭据文件。凭据优先级跟随宿主：DSH 0.2.1-rc.1/rc.2 的 Web/桌面端优先使用已保存凭据，环境变量作为回退；0.2.0-rc.2 则优先使用环境变量。凭据权限以设置页实际返回为准。
 
 ## 已知限制
 
 完整整改状态及验证范围见 [待办清单](https://github.com/takboo/dsh-usage-state/blob/main/docs/backlog.md)。
 
-- **旧版npm0.4.4及更早版本**：仍有provider凭据覆盖、pin/缓存身份、legacy隐藏、默认排序和失败展示缺陷；Moonshot≥100元仍会被除以100，DeepSeek非法金额仍可能变0。这些已在0.4.5修复；使用旧版请升级。旧版金额应与 [官方接口](https://platform.kimi.com/docs/api/balance.md) 核对。
 - **账户范围**：仍按source+mode选择一个目标；配置身份隔离不等于新增独立多账户支持。
-- **未验证范围**：Kimi Code月额度真实账户、Sub2API真实账户、高阈值视觉、真实凭据写入和OpenCode非零路径仍缺活体验证；本地交互测试不代替这些验收。
+- **未验证范围**：本次账号模式的真实 Desktop 登录账户与视觉、Kimi Code月额度真实账户、Sub2API真实账户、高阈值视觉、真实凭据写入和OpenCode非零路径仍缺活体验证；本地交互测试不代替这些验收。
 - **范围**：无模型选择或隐藏时可以不显示；点击状态行不打开设置；不保存历史读数。
 
 ## 开发与文档
@@ -109,6 +111,6 @@ npm test
 
 ## 致谢与许可
 
-感谢 [dsh-cost-meter](https://github.com/Han-1413141/dsh-cost-meter)（Han-1413141，MIT）提供的数据源行为参考。本实现独立编写；端点、字段语义与兼容陷阱的溯源见 [上游分析](https://github.com/takboo/dsh-usage-state/blob/main/docs/research/dsh-cost-meter-analysis.md)。宿主平台为DSH，使用其设置、凭据、RPC、插槽和UI原语。
+感谢 [dsh-cost-meter](https://github.com/Han-1413141/dsh-cost-meter)（Han-1413141，MIT）提供的数据源行为参考。本实现独立编写；历史端点与行为溯源见 [归档上游分析](https://github.com/takboo/dsh-usage-state/blob/main/docs/archive/research/dsh-cost-meter-analysis.md)。宿主平台为DSH，使用其设置、凭据、RPC、插槽和UI原语。
 
 [MIT](LICENSE)。问题和署名建议通过 [Issues](https://github.com/takboo/dsh-usage-state/issues) 提交。

package/docs/adapters.md

@@ -1,72 +1,41 @@
-# 适配器指南
+# 数据源适配器
 
-适用于扩展或调整余额/额度来源。当前代码支持DeepSeek、z.ai、Kimi、OpenCode和Sub2API。用户安装排查请读 [排查指南](https://github.com/takboo/dsh-usage-state/blob/main/docs/troubleshooting.md)，候选和整改状态见 [Backlog](https://github.com/takboo/dsh-usage-state/blob/main/docs/backlog.md)。本文件随npm包发布，代码和其他文档链接指向GitHub。下文描述0.4.6实现。
+当前支持DeepSeek、z.ai、Kimi/Moonshot、OpenCode和Sub2API。用户排查见 [指南](https://github.com/takboo/dsh-usage-state/blob/main/docs/troubleshooting.md)，代码入口见 [架构](https://github.com/takboo/dsh-usage-state/blob/main/docs/architecture.md)，未验证项见 [待办](https://github.com/takboo/dsh-usage-state/blob/main/docs/backlog.md)。本文随npm分发。
 
-## Interface
+## HTTP来源契约
 
-完整定义以 [sources/types](https://github.com/takboo/dsh-usage-state/blob/main/src/host/sources/types.ts) 为准。下列是主要字段：
+[UsageSource](https://github.com/takboo/dsh-usage-state/blob/main/src/host/sources/types.ts) 定义id、modes、credentialRefs、defaultBaseUrl、request、可选fallbackRequests及parse。request纯构造url/headers，parse纯解析；网络由 [read.ts](https://github.com/takboo/dsh-usage-state/blob/main/src/host/read.ts) 执行，单请求默认15秒超时。
 
-```ts
-interface UsageSource {
-  id: string
-  displayName: string
-  modes: readonly UsageMode[]
-  credentialRefs(mode: UsageMode): readonly string[]
-  defaultBaseUrl(mode: UsageMode): string | undefined
-  requiresBaseUrl?: boolean
-  requiresApiKey?: boolean
-  request(input: RequestInput): UsageRequest
-  fallbackRequests?(input: RequestInput): readonly UsageRequest[]
-  parse(payload: unknown, mode: UsageMode): UsageReading
-}
-```
+HTTP401/403归auth；JSON语法错归parse，响应体超时/中断归network。仅未固定端点时按Adapter声明尝试镜像。无有效金额/窗口抛SourceError，不以伪造零覆盖成功值。金额必须根据官方字段主单位解析，百分比与计数按明确口径转换。
 
-request纯构造url和headers；parse只处理payload，不访问网络、凭据或当前时钟。RequestInput提供mode/apiKey及可选baseUrl/pinnedBaseUrl；读取Module负责执行、15s单次超时、HTTP错误分类和按序镜像。模板见 [新源骨架](https://github.com/takboo/dsh-usage-state/blob/main/src/host/sources/_template.ts)。
+`requiresApiKey`字段本身不会增加免密钥读取能力。HTTP来源仍需完成凭据解析；DeepSeek账号模式使用下面单独的宿主服务通道。
 
-requiresApiKey在类型中存在，但当前宿主装配仍要求解析到凭据。不能只设置false就宣称已支持无key数据源；若要支持需补完整链路测试。
+## 字段语义
 
-## 增加数据源
-
-1. 用官方文档或固定commit接口定义查清端点、鉴权、单位、百分比口径、重置时刻及错误信封；没有官方资料时明确标社区观察/未验证。fixture去除key和账户信息。
-2. 新建Adapter和源测试，覆盖正常余额/窗口、真实0、非法/缺失字段、数字串、不同时间形态，以及HTTP200错误信封。无有效读数应抛SourceError，不填伪造0。
-3. 在 [注册表](https://github.com/takboo/dsh-usage-state/blob/main/src/host/sources/index.ts) 注册；用目录测试验证元数据可JSON传输。基础设置选项可从该注册表派生。
-4. 若需要自动发现provider，在 [共享hints](https://github.com/takboo/dsh-usage-state/blob/main/src/shared/config.ts) 维护路由名/host规则并加冲突测试。注册Adapter不会自动识别新provider；宿主会将可用端点的origin提示经RPC传到两UI，扩展时校验不含userinfo/query/key。
-5. 若新增窗口id或用户文案，同步 [中英词典](https://github.com/takboo/dsh-usage-state/blob/main/src/client/locales.ts)。窗口顺序由Adapter决定，展示层按返回顺序显示。
-6. 补provider配置到fake fetch和RPC/显示的装配用例，再执行typecheck→build→test→pack。更新两份README、此文字段语义、Backlog验证状态和Unreleased。
-
-开发命令和toolchain见 [开发指南](https://github.com/takboo/dsh-usage-state/blob/main/docs/development.md)。新Adapter不应引入成本计算或历史记录。
-
-## 归一化和错误约定
-
-- 金额保留明确币种/单位，使用来源契约换算，不按数值大小猜“元或分”。数值必须有限；缺失与真实0分别处理。
-- percentage已是0..100时用clampPercent。normalizePercent把0..1视为比例，因此1的解释有歧义；只在来源确需这种兼容时使用并注明。不得拿它解析明确的1%。
-- used/limit只在limit有效且>0时换算；remaining需按来源说明反转。unlimited哨兵不能展示成负余额/负额度。
-- normalizeResetAt支持unix秒、毫秒及ISO。不存在的重置时间保持undefined，不猜一个日期。
-- normalizeBaseUrl去尾斜杠和/vN；provider声明端点目前先取origin。若来源路径有额外前缀，必须测试请求路径，不能假定都从根目录挂载。
-- SourceError区分config/auth/http/network/parse；detail不得主动包含密钥。401/403由读取层归auth，JSON语法错归parse、body中断归network；HTTP200错误信封由Adapter识别。宿主快照边界精确替换本次已解析key的原文回显，不可依赖猜测key形状的正则。
-- source+mode仍只选择一个目标，宿主用有效签名、私有凭据摘要和generation隔离身份/在途；不表示新增多账户，也不在Adapter另建缓存。
-- 共享平台实例按DSH指南声明peer+dev，独立第三方依赖放dependencies；不要将旧宿主link解析经验写成所有平台包都不能import的规则。
-
-归一化实现见 [normalize](https://github.com/takboo/dsh-usage-state/blob/main/src/host/sources/normalize.ts)，网络实现见 [read](https://github.com/takboo/dsh-usage-state/blob/main/src/host/read.ts)。
-
-## 当前端点和字段语义
-
-| 来源 | 请求及鉴权 | 读数语义与证据 |
+| 来源/模式 | 请求与鉴权 | 归一化语义 |
 |---|---|---|
-| DeepSeek API | GET {base}/user/balance，Bearer | balance_infos多币种；优先有余额/CNY并保留granted/topped_up。有限真实0合法，非法total_balance跳过；无有效行抛parse |
-| z.ai Coding Plan | GET {base}/api/monitor/usage/quota/limit，Bearer；默认open.bigmodel.cn，镜像api.z.ai | unit3→5h、6→7d；TOKENS_LIMIT/CREDIT_LIMIT读percentage，不将TIME_LIMIT混为编码额度；兼容plans/flat形态。HTTP200 success:false/code1000归auth；属社区接口观察，已有历史真机证据 |
-| Moonshot API | GET api.moonshot.cn/v1/users/me/balance，Bearer | 官方data.available_balance以人民币元计，voucher/cash也为元，cash可为负；当前余额不按大小换单位，保留已有两位小数舍入及兼容字段，不新增负available_balance支持 |
-| Kimi Code | GET api.kimi.com/coding/v1/usages，Bearer及KimiCLI/1.6 UA | usages.limit_5h/limit_7d/limit_month_total/limit_month_code的used_ratio×100，reset_time归一；兼容usage周计数及limits[].detail/window，枚举分钟归一到小时；国内5h/7d已真实账户验证，月额度仅fixture验证 |
-| OpenCode Zen Go | GET opencode.ai/zen/go/v1/usage，Bearer及浏览器UA | usage或data.usage；rolling/weekly/monthly→5h/7d/30d；percent为0..100；resetsAt归一。历史真机观察UA缺失触发Cloudflare；非零/status非ok未验证 |
-| Sub2API | GET {instance}/v1/usage，Bearer；必须实例地址 | quota.remaining或wallet balance、rate_limits窗口；subscription.daily/weekly/monthly→1d/7d/30d。单位缺失默认USD；parse目前未按mode过滤，可能同时返回余额和窗口；接口字段随实例版本变化 |
+| DeepSeek账号 | `deepseekAccount.getBalance(client)`；不构造HTTP、不读取API Key | `value`为充值钱包，`bonusWallets`为赠送钱包；同币种求和，保留toppedUp/granted，优先有余额/CNY |
+| DeepSeek API Key | GET `{base}/user/balance`，Bearer | 多币种balance_infos；优先有余额/CNY，保留赠送/充值拆分；非法total跳过，无有效行报parse |
+| z.ai Coding Plan | `/api/monitor/usage/quota/limit`，Key | 国内/国际端点与错误信封；保留5h/7d已用百分比，跳过无效窗口 |
+| Kimi Code | GET `https://api.kimi.com/coding/v1/usages`，Bearer；区域镜像 | usages比例池或旧usage/limits计数；支持5h/7d/月总/编程月；仅显示实际返回窗口 |
+| Moonshot | GET `{base}/v1/users/me/balance`，Bearer | available_balance单位为人民币元，不按数值大小推测分/元 |
+| OpenCode Zen Go | GET `{base}/zen/go/usage`，Bearer及浏览器UA | rolling/weekly/monthly归一为5h/7d/30d；percent已是0–100 |
+| Sub2API | GET `{base}/v1/usage`，Bearer；需实例地址 | Key配额/余额与实例实际返回的订阅窗口；不把无限值当可用金额 |
+
+厂商语义优先依 [DeepSeek官方余额接口](https://api-docs.deepseek.com/api/get-user-balance) 与 [Moonshot官方余额定义](https://platform.kimi.com/docs/api/balance.md)。Kimi契约与兼容样本见 [实现](https://github.com/takboo/dsh-usage-state/blob/main/src/host/sources/kimi.ts) 和 [源测试](https://github.com/takboo/dsh-usage-state/blob/main/tests/sources/kimi.test.ts)。社区接口与历史逆向证据在 [归档](https://github.com/takboo/dsh-usage-state/blob/main/docs/archive/README.md)，使用前重新核验。
 
-[Moonshot官方余额定义](https://platform.kimi.com/docs/api/balance.md)优先于早期社区“分/元不明”的研究。[DeepSeek官方余额接口](https://api-docs.deepseek.com/api/get-user-balance)提供字段契约。其余社区/历史证据见 [研究索引](https://github.com/takboo/dsh-usage-state/blob/main/docs/research/README.md) 和 [上游分析](https://github.com/takboo/dsh-usage-state/blob/main/docs/research/dsh-cost-meter-analysis.md)，不能把逆向观察称为厂商保证。
+## DeepSeek Harness 账号与 API Key
 
-## 端点策略和测试缺口
+自动识别 `deepseek-account → deepseek:account`，`deepseek-official → deepseek:api`。账号模式忽略API Key ref与余额端点覆盖，无服务或无登录时不回退。Host通过 `getPlatformSession()` 的issuer/token摘要隔离身份，原始token不进入通用Key字段、RPC、配置或错误详情；读取前后复核身份，签出事件清缓存。
 
-当前共享解析以显式provider覆盖→legacy source默认→provider声明origin/Adapter默认确定有效目标。ref和pin贯通读取/凭据描述；显式pin使fallbackRequests返回空列表。相关回归见 [A01](https://github.com/takboo/dsh-usage-state/blob/main/docs/backlog.md#a01)、[A03](https://github.com/takboo/dsh-usage-state/blob/main/docs/backlog.md#a03)。
+账号服务负责目的地址、登录协议、超时和grant失效。client元数据使用Host包版本、Host locale与时区；无可解析版本时留空。`getBalance()` 返回安全投影：`status: ready`、充值钱包数组value、赠送钱包数组bonusWallets；每行含CNY/USD及主单位balance。金额/数组非法报parse，真实零保留；同币种充值与赠送合计为显示余额。
 
-无pin时首站失败仍按序尝试fallback，不仅在未配置端点时发生。扩展必须同时测Adapter、读取层和入口，覆盖真实HTTP、凭据选择、配置切换及错误边界，不能只证明一个模块接受参数。以上是Unreleased行为，npm0.4.4仍旧实现。
+`status: failed`保守归http，因为Host已折叠底层失败；插件无法再细分网络与协议错误。null表示登录不可用。失败只保留同一登录身份的上次成功值；身份改变后清除。契约核对来源为2026-10-23安装的Desktop包 `dsh-deepseek-account-platform` 和 `dsh-llm-deepseek-account`，以及 [官方账号服务文档](https://github.com/deepseek-ai/deepseek-harness/blob/master/packages/credentials/deepseek-account-platform/README.md)。真实账户验收范围见待办，不由契约核对代替。
 
+## 增加或修改来源
 
-Kimi当前响应和国际端点依据[官方客户端固定源码](https://github.com/MoonshotAI/kimi-code/blob/b510fa9aec85f02849f64121550be2c3fbd4294d/packages/oauth/src/managed-usage.ts)。比例池优先于同名旧计数，缺失周额度不补0；月总额度和编程月用量分别显示，不相加。官方客户端源码是接口观察依据，不视为稳定公开API保证。2026-10-14使用本机既有Kimi Code凭据对api.kimi.com完成只读查询，5h/7d均可解析；未验证国际区域账户和月额度活体响应。
+1. 核对官方接口、鉴权、单位和错误形状；未文档化契约标明来源、日期及不确定性，fixture去除账户信息。
+2. 在 [sources](https://github.com/takboo/dsh-usage-state/blob/main/src/host/sources/index.ts) 注册，使用 [模板](https://github.com/takboo/dsh-usage-state/blob/main/src/host/sources/_template.ts)；模式必须是来源确实支持的读数。
+3. 如需自动发现，更新共享provider/source规则并测命名冲突；新模式同步线上类型、Host codec、两UI及目录。
+4. 覆盖实际装配链、非法字段/真实0、身份切换与失败；保证凭据描述和读取采用同一有效选择。
+5. 按 [开发流程](https://github.com/takboo/dsh-usage-state/blob/main/docs/development.md) 完成typecheck、build、test、pack；更新双语README、当前文档与Changelog，未做的真实验收留在待办。

package/lib/client.js

@@ -67,11 +67,13 @@ window.__ModuleLoader__.load({
 		};
 		const MODES = [
 			"api",
+			"account",
 			"coding-plan",
 			"hidden"
 		];
 		const PROVIDER_MODES = [
 			"api",
+			"account",
 			"coding-plan",
 			"hidden",
 			"auto"
@@ -340,7 +342,7 @@ window.__ModuleLoader__.load({
 				mode: null,
 				reason: "unknown-source"
 			};
-			if (entry?.mode === "api" || entry?.mode === "coding-plan") {
+			if (entry?.mode === "api" || entry?.mode === "account" || entry?.mode === "coding-plan") {
 				if (!source.modes.includes(entry.mode)) return {
 					...base,
 					sourceId,
@@ -360,7 +362,7 @@ window.__ModuleLoader__.load({
 				mode: null,
 				reason: "needs-endpoint"
 			};
-			const mode = sourceId === "kimi" ? kimiMode(input.provider, baseUrl) : source.modes[0];
+			const mode = sourceId === "deepseek" && input.provider === "deepseek-account" ? "account" : sourceId === "kimi" ? kimiMode(input.provider, baseUrl) : source.modes[0];
 			if (mode === void 0 || !source.modes.includes(mode)) return {
 				...base,
 				sourceId,
@@ -546,6 +548,7 @@ window.__ModuleLoader__.load({
 		/** Models are listed for orientation only, so the line stays short. */
 		const MAX_MODELS_SHOWN = 6;
 		function modeLabel(mode, t) {
+			if (mode === "account") return t("modeAccount");
 			if (mode === "api") return t("modeApi");
 			if (mode === "coding-plan") return t("modeCodingPlan");
 			if (mode === "hidden") return t("modeHidden");
@@ -729,6 +732,7 @@ window.__ModuleLoader__.load({
 			const resolvedSource = row.resolution.sourceId === null ? void 0 : props.catalog.find((candidate) => candidate.id === row.resolution.sourceId);
 			const refMode = row.resolution.mode ?? resolvedSource?.modes[0];
 			const refs = refMode === void 0 ? [] : [...resolvedSource?.credentialRefs[refMode] ?? []];
+			const accountMode = row.resolution.mode === "account";
 			const modelNames = row.models.map((model) => model.name);
 			const listed = modelNames.slice(0, MAX_MODELS_SHOWN).join(" · ");
 			const suffix = modelNames.length > MAX_MODELS_SHOWN ? ", …" : "";
@@ -786,7 +790,7 @@ window.__ModuleLoader__.load({
 						style: MUTED,
 						children: [
 							"⚠ ",
-							t(`error.${props.failure.kind}`),
+							t(accountMode && props.failure.kind === "config" ? "accountSignInRequired" : accountMode && props.failure.kind === "auth" ? "accountAuthFailed" : `error.${props.failure.kind}`),
 							props.failure.detail === void 0 ? "" : ` — ${props.failure.detail}`
 						]
 					}),
@@ -794,6 +798,10 @@ window.__ModuleLoader__.load({
 						style: MUTED,
 						children: modelNames.length === 0 ? t("noModels") : t("modelsPrefix", { list: `${listed}${suffix}` })
 					}),
+					accountMode ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						style: MUTED,
+						children: t(props.description?.configured ? "accountConnected" : "accountSignInRequired")
+					}) : null,
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("details", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("summary", {
 						style: {
 							...MUTED,
@@ -807,37 +815,39 @@ window.__ModuleLoader__.load({
 							gap: "8px",
 							paddingTop: "8px"
 						},
-						children: [
-							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-								style: ROW,
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-									style: MUTED,
-									children: t("sourceLabel")
-								}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
-									disabled: props.disabled,
-									value: entry?.sourceId ?? "",
-									onChange: (event) => {
-										const value = event.target.value;
-										if (value === "") props.onClearField([
-											"providers",
-											row.provider,
-											"sourceId"
-										]);
-										else props.onField([
-											"providers",
-											row.provider,
-											"sourceId"
-										], value);
-									},
-									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
-										value: "",
-										children: t("sourceAuto")
-									}), props.catalog.map((candidate) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
-										value: candidate.id,
-										children: candidate.displayName
-									}, candidate.id))]
-								})]
-							}),
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							style: ROW,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								style: MUTED,
+								children: t("sourceLabel")
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
+								disabled: props.disabled,
+								value: entry?.sourceId ?? "",
+								onChange: (event) => {
+									const value = event.target.value;
+									if (value === "") props.onClearField([
+										"providers",
+										row.provider,
+										"sourceId"
+									]);
+									else props.onField([
+										"providers",
+										row.provider,
+										"sourceId"
+									], value);
+								},
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+									value: "",
+									children: t("sourceAuto")
+								}), props.catalog.map((candidate) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+									value: candidate.id,
+									children: candidate.displayName
+								}, candidate.id))]
+							})]
+						}), accountMode ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							style: MUTED,
+							children: t("accountHint")
+						}) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
 							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								style: ROW,
 								children: [
@@ -907,7 +917,7 @@ window.__ModuleLoader__.load({
 								credentials: props.credentials,
 								onChanged: props.onCredentialChanged
 							})
-						]
+						] })]
 					})] })
 				]
 			});
@@ -1551,10 +1561,10 @@ window.__ModuleLoader__.load({
 					display: config.display,
 					now
 				}),
-				t,
+				t: status.kind === "ready" && status.mode === "account" ? (key, params) => t(key === "error.config" ? "accountSignInRequired" : key === "error.auth" ? "accountAuthFailed" : key, params) : t,
 				now,
 				...sourceLabel === "" ? {} : { sourceLabel },
-				...status.kind === "ready" ? { modeLabel: status.mode === "api" ? t("modeApi") : t("modeCodingPlan") } : {}
+				...status.kind === "ready" ? { modeLabel: status.mode === "account" ? t("modeAccount") : status.mode === "api" ? t("modeApi") : t("modeCodingPlan") } : {}
 			});
 			if (fullParts.length === 0) return null;
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
@@ -1577,7 +1587,7 @@ window.__ModuleLoader__.load({
 		const zh = {
 			nav: "用量状态",
 			title: "用量状态",
-			intro: "为每个供应商选择显示账户余额（API 模式）或套餐额度（Coding Plan 模式）。数据由宿主定时刷新，密钥交给 DSH 凭据库保存，本插件不另存明文。",
+			intro: "为每个供应商选择显示账户余额（账号登录或 API Key 模式）或套餐额度（Coding Plan 模式）。数据由宿主定时刷新，密钥交给 DSH 凭据库保存，本插件不另存明文。",
 			refreshNow: "立即刷新",
 			refreshing: "刷新中…",
 			lastChecked: "更新于 {time}",
@@ -1589,7 +1599,12 @@ window.__ModuleLoader__.load({
 			sectionProvidersHint: "余额与额度是账户级的，所以每个供应商只需设置一次：默认「自动」会识别出该用哪个数据源并直接生效。",
 			sectionDisplay: "显示",
 			modeAuto: "自动",
-			modeApi: "API 余额",
+			modeApi: "API Key 余额",
+			modeAccount: "账号余额",
+			accountConnected: "已连接 Harness 登录账号",
+			accountSignInRequired: "请先在 Harness 账号设置中登录",
+			accountAuthFailed: "账号登录已失效，请重新登录",
+			accountHint: "使用 Harness 当前登录账号查询充值与赠送余额，登录由 Harness 管理，无需 API Key。",
 			modeCodingPlan: "Coding Plan",
 			modeHidden: "隐藏",
 			modeUnsupported: "该数据源不支持此模式",
@@ -1655,7 +1670,7 @@ window.__ModuleLoader__.load({
 		const en = {
 			nav: "Usage state",
 			title: "Usage state",
-			intro: "Choose what to show for each provider: account balance (API mode) or coding-plan quota (Coding Plan mode). The host owns refresh timing, and DSH stores credentials — this plugin keeps no separate plaintext copy.",
+			intro: "Choose what to show for each provider: account balance (account sign-in or API Key mode) or coding-plan quota (Coding Plan mode). The host owns refresh timing, and DSH stores credentials — this plugin keeps no separate plaintext copy.",
 			refreshNow: "Refresh now",
 			refreshing: "Refreshing…",
 			lastChecked: "Updated {time}",
@@ -1667,7 +1682,12 @@ window.__ModuleLoader__.load({
 			sectionProvidersHint: "Balance and quota are account-level, so one setting per provider is enough. “Auto” detects which data source to use and works right away.",
 			sectionDisplay: "Display",
 			modeAuto: "Auto",
-			modeApi: "API balance",
+			modeApi: "API Key balance",
+			modeAccount: "Account balance",
+			accountConnected: "Connected to the Harness account",
+			accountSignInRequired: "Sign in through Harness account settings",
+			accountAuthFailed: "Account sign-in expired; sign in again",
+			accountHint: "Reads recharge and bonus wallets for the account signed into Harness. Harness manages sign-in; no API key is needed.",
 			modeCodingPlan: "Coding plan",
 			modeHidden: "Hidden",
 			modeUnsupported: "This data source does not serve that mode",

package/lib/index.js

@@ -1,8 +1,233 @@
+import { createRequire } from "node:module";
+import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { createHash } from "node:crypto";
 import z from "@deepseek-ai/schemastery";
+//#region src/host/sources/normalize.ts
+/** Shared normalization helpers for provider payloads. */
+/** Numbers and numeric strings to a finite number; anything else is absent. */
+function toFiniteNumber(value) {
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value === "string") {
+		const trimmed = value.trim();
+		if (trimmed === "") return void 0;
+		const parsed = Number(trimmed);
+		return Number.isFinite(parsed) ? parsed : void 0;
+	}
+}
+/** Clamp to 0..100 and round to one decimal. */
+function clampPercent(value) {
+	if (!Number.isFinite(value)) return 0;
+	return Math.min(100, Math.max(0, Math.round(value * 10) / 10));
+}
+/**
+* Percentages arrive in two conventions: 0..1 fractions and 0..100 percentages.
+* Values `<= 1` are read as fractions (so a literal "1" means 100%), anything
+* larger is read as a percentage. Invalid or negative input yields `null`.
+*/
+function normalizePercent(value) {
+	const parsed = toFiniteNumber(value);
+	if (parsed === void 0 || parsed < 0) return null;
+	return clampPercent(parsed <= 1 ? parsed * 100 : parsed);
+}
+function fromNumericInstant(value) {
+	if (!Number.isFinite(value) || value <= 0) return void 0;
+	return value > 0xe8d4a51000 ? Math.round(value) : Math.round(value * 1e3);
+}
+/**
+* Reset instants arrive as unix seconds, unix milliseconds, numeric strings or
+* ISO timestamps; all of them become epoch milliseconds. Missing or nonsense
+* values become `undefined` rather than a bogus date.
+*/
+function normalizeResetAt(value) {
+	if (typeof value === "string") {
+		const trimmed = value.trim();
+		if (trimmed === "") return void 0;
+		if (/^\d+(\.\d+)?$/.test(trimmed)) {
+			const numeric = toFiniteNumber(trimmed);
+			return numeric === void 0 ? void 0 : fromNumericInstant(numeric);
+		}
+		const parsed = Date.parse(trimmed);
+		return Number.isFinite(parsed) ? parsed : void 0;
+	}
+	const numeric = toFiniteNumber(value);
+	return numeric === void 0 ? void 0 : fromNumericInstant(numeric);
+}
+/** Trim whitespace, trailing slashes and a trailing `/vN` API version segment. */
+function normalizeBaseUrl(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim().replace(/\/+$/, "");
+	if (trimmed === "") return void 0;
+	const withoutVersion = trimmed.replace(/\/v\d+$/i, "");
+	return withoutVersion === "" ? void 0 : withoutVersion;
+}
+//#endregion
+//#region src/host/sources/types.ts
+var SourceError = class extends Error {
+	kind;
+	constructor(kind, message) {
+		super(message);
+		this.name = "SourceError";
+		this.kind = kind;
+	}
+};
+//#endregion
+//#region src/host/sources/deepseek.ts
+const DEFAULT_BASE_URL$1 = "https://api.deepseek.com";
+const BALANCE_PATH = "/user/balance";
+/**
+* DeepSeek returns one entry per currency and the order is not stable, so a
+* fixed "first entry" read makes the displayed balance flip between the real
+* value and zero. Rule: prefer an entry with a positive balance, prefer CNY
+* among equals (the open platform's primary currency), and fall back to CNY or
+* the first entry so the result never depends on response ordering.
+*/
+function pickBalanceInfo(infos) {
+	if (!Array.isArray(infos)) return void 0;
+	const entries = [];
+	for (const raw of infos) {
+		if (raw === null || typeof raw !== "object") continue;
+		const entry = raw;
+		const amount = toFiniteNumber(entry.total_balance);
+		if (amount === void 0) continue;
+		const granted = toFiniteNumber(entry.granted_balance);
+		const toppedUp = toFiniteNumber(entry.topped_up_balance);
+		entries.push({
+			amount,
+			currency: typeof entry.currency === "string" ? entry.currency : "",
+			...granted === void 0 ? {} : { granted },
+			...toppedUp === void 0 ? {} : { toppedUp }
+		});
+	}
+	if (entries.length === 0) return void 0;
+	const cnyOf = (list) => list.find((entry) => entry.currency.toUpperCase() === "CNY");
+	const funded = entries.filter((entry) => entry.amount > 0);
+	return cnyOf(funded) ?? funded[0] ?? cnyOf(entries) ?? entries[0];
+}
+/** DeepSeek balances: API keys and Harness account grants are separate identities. */
+const deepseek = {
+	id: "deepseek",
+	displayName: "DeepSeek",
+	modes: ["api", "account"],
+	credentialRefs: (mode) => mode === "account" ? [] : ["DEEPSEEK_API_KEY"],
+	defaultBaseUrl: (mode) => mode === "account" ? "https://platform.deepseek.com" : DEFAULT_BASE_URL$1,
+	request(input) {
+		if (input.mode === "account") throw new SourceError("config", "Account balance requires the Harness account service");
+		return {
+			url: `${normalizeBaseUrl(input.baseUrl) ?? DEFAULT_BASE_URL$1}${BALANCE_PATH}`,
+			headers: {
+				authorization: `Bearer ${input.apiKey}`,
+				accept: "application/json"
+			}
+		};
+	},
+	parse(payload, mode) {
+		if (mode === "account") return parseAccountBalance(payload);
+		const root = payload !== null && typeof payload === "object" ? payload : void 0;
+		const picked = root === void 0 ? void 0 : pickBalanceInfo(root.balance_infos);
+		if (picked === void 0) throw new SourceError("parse", "DeepSeek balance response contains no usable balance_infos");
+		return {
+			balances: [{
+				amount: picked.amount,
+				currency: picked.currency,
+				...picked.granted === void 0 ? {} : { granted: picked.granted },
+				...picked.toppedUp === void 0 ? {} : { toppedUp: picked.toppedUp }
+			}],
+			windows: []
+		};
+	}
+};
+/** Parse the account service's sanitized normal and bonus wallets (major units). */
+function parseAccountBalance(payload) {
+	const root = payload !== null && typeof payload === "object" ? payload : void 0;
+	if (root?.status === "failed") throw new SourceError("http", "Harness account balance is temporarily unavailable");
+	if (root?.status !== "ready" || !Array.isArray(root.value) || !Array.isArray(root.bonusWallets)) throw new SourceError("parse", "Invalid Harness account balance response");
+	const wallets = /* @__PURE__ */ new Map();
+	for (const [rows, field] of [[root.value, "toppedUp"], [root.bonusWallets, "granted"]]) for (const raw of rows) {
+		const row = raw !== null && typeof raw === "object" ? raw : void 0;
+		const amount = toFiniteNumber(row?.balance);
+		const currency = row?.currency;
+		if (amount === void 0 || currency !== "CNY" && currency !== "USD") throw new SourceError("parse", "Invalid Harness account wallet");
+		const wallet = wallets.get(currency) ?? {
+			toppedUp: 0,
+			granted: 0
+		};
+		wallet[field] += amount;
+		if (!Number.isFinite(wallet[field])) throw new SourceError("parse", "Invalid Harness account wallet total");
+		wallets.set(currency, wallet);
+	}
+	const picked = pickBalanceInfo([...wallets].map(([currency, wallet]) => ({
+		currency,
+		total_balance: wallet.toppedUp + wallet.granted,
+		granted_balance: wallet.granted,
+		topped_up_balance: wallet.toppedUp
+	})));
+	if (picked === void 0) throw new SourceError("parse", "Harness account has no usable wallets");
+	return {
+		balances: [picked],
+		windows: []
+	};
+}
+//#endregion
+//#region src/host/deepseek-account.ts
+function clientMetadata() {
+	let version = "";
+	try {
+		version = createRequire(import.meta.url)("@deepseek-ai/dsh-llm/package.json").version;
+	} catch {}
+	return {
+		version,
+		locale: Intl.DateTimeFormat().resolvedOptions().locale,
+		timezoneOffsetSeconds: -(/* @__PURE__ */ new Date()).getTimezoneOffset() * 60
+	};
+}
+/** Do not export the grant or its digest across the plugin RPC boundary. */
+async function resolveAccountCredential(account) {
+	if (typeof account?.getPlatformSession !== "function" || typeof account.getBalance !== "function") return void 0;
+	try {
+		const session = await account.getPlatformSession();
+		if (session === null || typeof session.token !== "string" || session.token.trim() === "") return void 0;
+		return {
+			apiKey: "",
+			ref: "deepseek-account",
+			origin: "account",
+			identity: createHash("sha256").update(JSON.stringify([session.origin, session.token])).digest("hex")
+		};
+	} catch {
+		return;
+	}
+}
+async function describeAccount(account) {
+	return {
+		candidates: [],
+		configured: await resolveAccountCredential(account) !== void 0,
+		source: "account",
+		writable: false
+	};
+}
+/** The host service owns authorization, destination validation, timeouts and grant expiry. */
+async function readAccountBalance(account, credential, invalidate) {
+	const matches = async () => (await resolveAccountCredential(account))?.identity === credential.identity;
+	if (account === void 0 || !await matches()) {
+		invalidate();
+		throw new SourceError("config", "DeepSeek account changed; sign in through Harness account settings");
+	}
+	let payload;
+	try {
+		payload = await account.getBalance(clientMetadata());
+	} catch {
+		if (!await matches()) invalidate();
+		throw new SourceError("http", "Harness account balance is temporarily unavailable");
+	}
+	if (!await matches()) {
+		invalidate();
+		throw new SourceError("config", "DeepSeek account changed; sign in through Harness account settings");
+	}
+	if (payload === null) throw new SourceError("auth", "DeepSeek account balance requires a valid Harness login");
+	return parseAccountBalance(payload);
+}
+//#endregion
 //#region src/shared/config.ts
 const DEFAULT_CONFIG = {
 	models: [],
@@ -22,11 +247,13 @@ const DEFAULT_CONFIG = {
 };
 const MODES = [
 	"api",
+	"account",
 	"coding-plan",
 	"hidden"
 ];
 const PROVIDER_MODES = [
 	"api",
+	"account",
 	"coding-plan",
 	"hidden",
 	"auto"
@@ -295,7 +522,7 @@ function resolveProvider(input) {
 		mode: null,
 		reason: "unknown-source"
 	};
-	if (entry?.mode === "api" || entry?.mode === "coding-plan") {
+	if (entry?.mode === "api" || entry?.mode === "account" || entry?.mode === "coding-plan") {
 		if (!source.modes.includes(entry.mode)) return {
 			...base,
 			sourceId,
@@ -315,7 +542,7 @@ function resolveProvider(input) {
 		mode: null,
 		reason: "needs-endpoint"
 	};
-	const mode = sourceId === "kimi" ? kimiMode(input.provider, baseUrl) : source.modes[0];
+	const mode = sourceId === "deepseek" && input.provider === "deepseek-account" ? "account" : sourceId === "kimi" ? kimiMode(input.provider, baseUrl) : source.modes[0];
 	if (mode === void 0 || !source.modes.includes(mode)) return {
 		...base,
 		sourceId,
@@ -330,139 +557,6 @@ function resolveProvider(input) {
 	});
 }
 //#endregion
-//#region src/host/sources/normalize.ts
-/** Shared normalization helpers for provider payloads. */
-/** Numbers and numeric strings to a finite number; anything else is absent. */
-function toFiniteNumber(value) {
-	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
-	if (typeof value === "string") {
-		const trimmed = value.trim();
-		if (trimmed === "") return void 0;
-		const parsed = Number(trimmed);
-		return Number.isFinite(parsed) ? parsed : void 0;
-	}
-}
-/** Clamp to 0..100 and round to one decimal. */
-function clampPercent(value) {
-	if (!Number.isFinite(value)) return 0;
-	return Math.min(100, Math.max(0, Math.round(value * 10) / 10));
-}
-/**
-* Percentages arrive in two conventions: 0..1 fractions and 0..100 percentages.
-* Values `<= 1` are read as fractions (so a literal "1" means 100%), anything
-* larger is read as a percentage. Invalid or negative input yields `null`.
-*/
-function normalizePercent(value) {
-	const parsed = toFiniteNumber(value);
-	if (parsed === void 0 || parsed < 0) return null;
-	return clampPercent(parsed <= 1 ? parsed * 100 : parsed);
-}
-function fromNumericInstant(value) {
-	if (!Number.isFinite(value) || value <= 0) return void 0;
-	return value > 0xe8d4a51000 ? Math.round(value) : Math.round(value * 1e3);
-}
-/**
-* Reset instants arrive as unix seconds, unix milliseconds, numeric strings or
-* ISO timestamps; all of them become epoch milliseconds. Missing or nonsense
-* values become `undefined` rather than a bogus date.
-*/
-function normalizeResetAt(value) {
-	if (typeof value === "string") {
-		const trimmed = value.trim();
-		if (trimmed === "") return void 0;
-		if (/^\d+(\.\d+)?$/.test(trimmed)) {
-			const numeric = toFiniteNumber(trimmed);
-			return numeric === void 0 ? void 0 : fromNumericInstant(numeric);
-		}
-		const parsed = Date.parse(trimmed);
-		return Number.isFinite(parsed) ? parsed : void 0;
-	}
-	const numeric = toFiniteNumber(value);
-	return numeric === void 0 ? void 0 : fromNumericInstant(numeric);
-}
-/** Trim whitespace, trailing slashes and a trailing `/vN` API version segment. */
-function normalizeBaseUrl(value) {
-	if (typeof value !== "string") return void 0;
-	const trimmed = value.trim().replace(/\/+$/, "");
-	if (trimmed === "") return void 0;
-	const withoutVersion = trimmed.replace(/\/v\d+$/i, "");
-	return withoutVersion === "" ? void 0 : withoutVersion;
-}
-//#endregion
-//#region src/host/sources/types.ts
-var SourceError = class extends Error {
-	kind;
-	constructor(kind, message) {
-		super(message);
-		this.name = "SourceError";
-		this.kind = kind;
-	}
-};
-//#endregion
-//#region src/host/sources/deepseek.ts
-const DEFAULT_BASE_URL$1 = "https://api.deepseek.com";
-const BALANCE_PATH = "/user/balance";
-/**
-* DeepSeek returns one entry per currency and the order is not stable, so a
-* fixed "first entry" read makes the displayed balance flip between the real
-* value and zero. Rule: prefer an entry with a positive balance, prefer CNY
-* among equals (the open platform's primary currency), and fall back to CNY or
-* the first entry so the result never depends on response ordering.
-*/
-function pickBalanceInfo(infos) {
-	if (!Array.isArray(infos)) return void 0;
-	const entries = [];
-	for (const raw of infos) {
-		if (raw === null || typeof raw !== "object") continue;
-		const entry = raw;
-		const amount = toFiniteNumber(entry.total_balance);
-		if (amount === void 0) continue;
-		const granted = toFiniteNumber(entry.granted_balance);
-		const toppedUp = toFiniteNumber(entry.topped_up_balance);
-		entries.push({
-			amount,
-			currency: typeof entry.currency === "string" ? entry.currency : "",
-			...granted === void 0 ? {} : { granted },
-			...toppedUp === void 0 ? {} : { toppedUp }
-		});
-	}
-	if (entries.length === 0) return void 0;
-	const cnyOf = (list) => list.find((entry) => entry.currency.toUpperCase() === "CNY");
-	const funded = entries.filter((entry) => entry.amount > 0);
-	return cnyOf(funded) ?? funded[0] ?? cnyOf(entries) ?? entries[0];
-}
-/** DeepSeek official API: balance only — the platform has no coding plan. */
-const deepseek = {
-	id: "deepseek",
-	displayName: "DeepSeek",
-	modes: ["api"],
-	credentialRefs: () => ["DEEPSEEK_API_KEY"],
-	defaultBaseUrl: () => DEFAULT_BASE_URL$1,
-	request(input) {
-		return {
-			url: `${normalizeBaseUrl(input.baseUrl) ?? DEFAULT_BASE_URL$1}${BALANCE_PATH}`,
-			headers: {
-				authorization: `Bearer ${input.apiKey}`,
-				accept: "application/json"
-			}
-		};
-	},
-	parse(payload, _mode) {
-		const root = payload !== null && typeof payload === "object" ? payload : void 0;
-		const picked = root === void 0 ? void 0 : pickBalanceInfo(root.balance_infos);
-		if (picked === void 0) throw new SourceError("parse", "DeepSeek balance response contains no usable balance_infos");
-		return {
-			balances: [{
-				amount: picked.amount,
-				currency: picked.currency,
-				...picked.granted === void 0 ? {} : { granted: picked.granted },
-				...picked.toppedUp === void 0 ? {} : { toppedUp: picked.toppedUp }
-			}],
-			windows: []
-		};
-	}
-};
-//#endregion
 //#region src/host/sources/kimi.ts
 const MOONSHOT_BASE_URL = "https://api.moonshot.cn";
 const KIMI_CODE_BASE_URL = "https://api.kimi.com";
@@ -1252,6 +1346,7 @@ function asRecord(value) {
 * extra configuration in this plugin.
 */
 function providerCredentialRefs(input) {
+	if (input.mode === "account") return [];
 	const suggest = input.suggest ?? suggestSourceId;
 	const refs = [];
 	const push = (value) => {
@@ -1414,6 +1509,10 @@ var UsageStateStore = class {
 	constructor(deps) {
 		this.deps = deps;
 	}
+	/** Clear an account grant immediately when the host signs out. */
+	clear(key) {
+		this.invalidate(key);
+	}
 	invalidate(key) {
 		this.generations.set(key, (this.generations.get(key) ?? 0) + 1);
 		this.identities.delete(key);
@@ -1462,7 +1561,7 @@ var UsageStateStore = class {
 	async refresh(key, options = {}) {
 		if (this.stopped) return {
 			sourceId: key.split(":")[0] ?? "",
-			mode: key.endsWith(":coding-plan") ? "coding-plan" : "api",
+			mode: key.endsWith(":account") ? "account" : key.endsWith(":coding-plan") ? "coding-plan" : "api",
 			balances: [],
 			windows: [],
 			fetchedAt: this.deps.clock.now(),
@@ -1474,7 +1573,7 @@ var UsageStateStore = class {
 		const target = this.currentTargets().find((candidate) => candidate.key === key);
 		if (target === void 0) return {
 			sourceId: key.split(":")[0] ?? "",
-			mode: key.endsWith(":coding-plan") ? "coding-plan" : "api",
+			mode: key.endsWith(":account") ? "account" : key.endsWith(":coding-plan") ? "coding-plan" : "api",
 			balances: [],
 			windows: [],
 			fetchedAt: this.deps.clock.now(),
@@ -1506,7 +1605,8 @@ var UsageStateStore = class {
 			credential?.baseUrl ?? target.baseUrl ?? source.defaultBaseUrl(target.mode),
 			credential?.baseUrlPinned === true || target.baseUrlPinned === true,
 			credential?.ref ?? target.apiKeyRef,
-			credential?.apiKey
+			credential?.apiKey,
+			credential?.identity
 		])).digest("hex");
 		if ((this.generations.get(key) ?? 0) !== generationAtLookup && this.identities.get(key) !== identity) return this.refresh(key, options);
 		if (this.identities.get(key) !== identity) {
@@ -1518,7 +1618,7 @@ var UsageStateStore = class {
 		}
 		if (credential === void 0) return this.fail(target, {
 			kind: "config",
-			detail: "no credential configured"
+			detail: target.mode === "account" ? "Sign in through Harness account settings" : "no credential configured"
 		}, this.readings.get(key));
 		const cached = this.readings.get(key);
 		const lastSuccess = this.succeededAt.get(key);
@@ -1903,7 +2003,7 @@ function createUsageState(ctx, deps = {}) {
 				sourceId: target.sourceId,
 				mode: target.mode,
 				config,
-				deepseekSettings: readNamespace(ctx, "llm-deepseek"),
+				deepseekSettings: readNamespace(ctx, "llm-deepseek") ?? readNamespace(ctx, "llm-deepseek-api-key"),
 				piAiSettings: readNamespace(ctx, "llm-pi-ai")
 			})
 		}));
@@ -1915,6 +2015,8 @@ function createUsageState(ctx, deps = {}) {
 			preferredRefs: target.preferredRefs ?? []
 		};
 	};
+	const account = () => ctx.get("deepseekAccount");
+	const httpReader = createTargetReader({ fetch: fetchImpl });
 	const store = new UsageStateStore({
 		clock: {
 			now,
@@ -1925,6 +2027,7 @@ function createUsageState(ctx, deps = {}) {
 		targets,
 		findSource,
 		credentials: { resolve: async (target) => {
+			if (target.sourceId === "deepseek" && target.mode === "account") return resolveAccountCredential(account());
 			const source = findSource(target.sourceId);
 			if (source === void 0) return void 0;
 			const resolved = await resolveApiKey(source, target.mode, optionsFor(target), lookup);
@@ -1936,9 +2039,10 @@ function createUsageState(ctx, deps = {}) {
 				...target.baseUrlPinned === true ? { baseUrlPinned: true } : {}
 			};
 		} },
-		read: createTargetReader({ fetch: fetchImpl })
+		read: (target, credential, source) => target.sourceId === "deepseek" && target.mode === "account" ? readAccountBalance(account(), credential, () => store.clear(target.key)) : httpReader(target, credential, source)
 	});
 	reconfigure = () => store.reconfigure();
+	ctx.on("deepseek-account/signed-out", () => store.clear("deepseek:account"));
 	const service = new UsageStateService({
 		store,
 		targets,
@@ -1948,6 +2052,7 @@ function createUsageState(ctx, deps = {}) {
 			return origin === void 0 ? [] : [[provider, origin]];
 		})),
 		describe: async (target) => {
+			if (target.sourceId === "deepseek" && target.mode === "account") return describeAccount(account());
 			const source = findSource(target.sourceId);
 			if (source === void 0) return {
 				candidates: [],

package/lib/typert.js

@@ -24,7 +24,11 @@ function strictCodec(name, schema) {
 		create: () => schema
 	};
 }
-const usageModeSchema = z.enum(["api", "coding-plan"]);
+const usageModeSchema = z.enum([
+	"api",
+	"account",
+	"coding-plan"
+]);
 const balanceSchema = z.object({
 	amount: z.number(),
 	currency: z.string(),

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "dsh-usage-state",
-  "version": "0.4.7",
+  "version": "0.4.9",
   "packageManager": "npm@11.19.1",
   "type": "module",
-  "description": "DSH plugin: show account balance (API mode) or coding-plan quota (5h/7d/30d) for the model in use",
+  "description": "DSH plugin: show account sign-in or API key balances and coding-plan quotas for the model in use",
   "license": "MIT",
   "engines": {
     "node": ">=20",