dsh-wisp 1.36.0 → 1.42.0

package/lib/index.js

@@ -10,9 +10,15 @@
 //      for a sandboxed half to reach a real capability, so the update check goes
 //      through it — nothing is bypassed.
 //
-//   2. Nothing else. `web` is declared as an OPTIONAL inject on purpose: a
-//      required inject that nothing provides would leave this fiber `waiting`
-//      forever, and the companion would simply disappear from the UI.
+//   2. Answer `host.call('checkBalance')` — the account balance, through the
+//      `deepseekAccount` service. NOT through our own HTTP call with an API key:
+//      that service is documented as "only Host consumers can obtain a request
+//      credential", which is exactly the right shape — the platform owns the
+//      login, the plugin never sees a token, and there is nothing to leak into
+//      the page (the browser half could not read a key even if we had one).
+//      `web` and `deepseekAccount` are both declared as OPTIONAL injects on
+//      purpose: a required inject that nothing provides would leave this fiber
+//      `waiting` forever, and the companion would simply disappear from the UI.
 //
 // WHY TWO SOURCES. npm's registry is the authoritative one, but a publish can sit
 // in npm's staging queue for a long time (observed: `PUT 202`, still 404 after 18
@@ -25,11 +31,15 @@
 /** Cordis plugin name used by loader diagnostics. */
 export const name = 'wisp'
 
+/** Stamped into every balance request. Must match package.json — the preflight guards it. */
+export const VERSION = '1.42.0'
+
 /**
- * `web` is optional on purpose. A required inject that nothing provides keeps
- * the fiber in `waiting` forever, and the user's companion would vanish.
+ * `web` and `deepseekAccount` are optional on purpose. A required inject that
+ * nothing provides keeps the fiber in `waiting` forever, and the user's
+ * companion would vanish.
  */
-export const inject = { required: [], optional: ['web'] }
+export const inject = { required: [], optional: ['web', 'deepseekAccount'] }
 
 /** The two places a published version can be read from. Overridable per install. */
 export const DEFAULT_SOURCES = {
@@ -37,9 +47,35 @@ export const DEFAULT_SOURCES = {
   github: 'https://raw.githubusercontent.com/969246694/dsh-wisp/main/package.json',
 }
 
-/** How long the whole check may take before it is reported as a timeout. */
+/** How long ONE source may take before it is reported as a timeout. */
 const CHECK_TIMEOUT_MS = 8000
 
+/**
+ * Resolve the `web` service LATE, on every call.
+ *
+ * `inject.optional: ['web']` hands us `ctx.web`, but only when the service was
+ * already provided at the moment this fiber materialized — and this half is
+ * inserted by a bundle patch, so it can start BEFORE the web service registers.
+ * An optional dependency that was absent at start does not retroactively appear,
+ * which would disable the update check forever. `ctx.get('web')` looks the
+ * service up at call time instead, so a startup race cannot wedge it.
+ *
+ * @returns the service, or undefined when this shell really has none.
+ */
+export function resolveWebService(ctx) {
+  try {
+    if (ctx && typeof ctx.get === 'function') {
+      const late = ctx.get('web')
+      if (late && typeof late.fetch === 'function') return late
+    }
+  } catch (error) { /* restricted context: fall through to the declared property */ }
+  try {
+    const declared = ctx && ctx.web
+    if (declared && typeof declared.fetch === 'function') return declared
+  } catch (error) { /* no such property */ }
+  return undefined
+}
+
 /**
  * Fetch one manifest and pull `version` out of it.
  * @param web - the `web` service, or undefined when it is not loaded.
@@ -71,8 +107,7 @@ export async function readVersion(web, url, signal) {
   }
 }
 
-/** Compare two dotted versions. Returns -1 / 0 / 1; non-numeric parts count as 0. */
-export function compareVersions(a, b) {
+/** Compare two dotted versions. Returns -1 / 0 / 1; non-numeric parts count as 0. */export function compareVersions(a, b) {
   const parse = (v) => String(v).split('-')[0].split('.').map((n) => {
     const x = Number.parseInt(n, 10)
     return Number.isFinite(x) ? x : 0
@@ -91,12 +126,25 @@ export function compareVersions(a, b) {
  * Read every source and report the highest version found.
  * @param web - the `web` service.
  * @param urls - `{ npm, github }` (or any other set of named sources).
- * @param signal - optional cancellation signal.
+ * @param signal - optional cancellation signal shared by every source.
+ * @param timeoutMs - when given, EACH source gets its own deadline instead.
  * @returns a plain, JSON-serializable verdict (it crosses the sandbox boundary).
  */
-export async function readPublishedVersion(web, urls, signal) {
+export async function readPublishedVersion(web, urls, signal, timeoutMs) {
   const names = Object.keys(urls ?? {})
-  const results = await Promise.all(names.map((key) => readVersion(web, urls[key], signal)))
+  const perSource = typeof timeoutMs === 'number' && timeoutMs > 0
+    && typeof AbortController === 'function' && typeof setTimeout === 'function'
+  const results = await Promise.all(names.map((key) => {
+    /* 每个源一个**自己的**截止时间。共用一个信号时，一个卡住的镜像会在到点时把
+       另一个已经拿到结果的源一起作废 —— 那次检查就整个失败，而其实 npm 是通的。
+       （实测：raw.githubusercontent.com 在这台机器上根本连不上。） */
+    if (!perSource) return readVersion(web, urls[key], signal)
+    const controller = new AbortController()
+    const timer = setTimeout(() => controller.abort(), timeoutMs)
+    return readVersion(web, urls[key], controller.signal)
+      .then((result) => { clearTimeout(timer); return result })
+      .catch((error) => { clearTimeout(timer); throw error })
+  }))
   const sources = {}
   let best = null
   let from = null
@@ -119,7 +167,132 @@ export async function readPublishedVersion(web, urls, signal) {
   return { ok: true, latest: best, from, sources }
 }
 
-/** Register the handler the browser half reaches through `host.call`. */
+/* ---------------------------------------------------------------------------
+   ACCOUNT BALANCE.
+
+   The shape of the platform service, read from the live Host Service registry
+   rather than guessed:
+
+     ctx.deepseekAccount.getBalance(client: AccountClientMetadata)
+       -> { status: 'ready', value: AccountWallet[], bonusWallets: AccountWallet[] }
+        | { status: 'failed' }
+        | null                      // signed out, or the grant changed mid-query
+     ctx.deepseekAccount.getState()
+       -> { status: 'signed-out' | 'credential-stored', links, attempt }
+
+     AccountClientMetadata = { version, locale, timezoneOffsetSeconds }
+     AccountWallet         = { currency: 'CNY' | 'USD', balance: string }
+
+   `null` deliberately means TWO different things, and telling the user the wrong
+   one is worse than saying nothing — so when it happens we ask getState() once
+   more to find out which. Signed out => "log in first"; still credential-stored
+   => the grant moved under us => "didn't read it, try again".
+   --------------------------------------------------------------------------- */
+
+/** How long a balance query may take before it is reported as a timeout. */
+export const BALANCE_TIMEOUT_MS = 8000
+
+/** Keep only well-formed wallets, and never let an unbounded list cross the sandbox. */
+export function normalizeWallets(list) {
+  if (!Array.isArray(list)) return []
+  const out = []
+  for (const wallet of list) {
+    if (!wallet || typeof wallet !== 'object') continue
+    if (typeof wallet.balance !== 'string') continue
+    out.push({ currency: typeof wallet.currency === 'string' ? wallet.currency : '', balance: wallet.balance })
+    if (out.length >= 8) break
+  }
+  return out
+}
+
+/**
+ * Settle with the platform call, or reject with `timeout` — whichever is first.
+ * The service takes no AbortSignal, so a race is the only way to bound it: an
+ * unbounded await here would mean she simply never says anything.
+ */
+function withTimeout(promise, ms) {
+  if (!(ms > 0) || typeof setTimeout !== 'function') return Promise.resolve(promise)
+  return new Promise((resolve, reject) => {
+    let settled = false
+    const timer = setTimeout(() => {
+      if (settled) return
+      settled = true
+      reject(new Error('timeout'))
+    }, ms)
+    const finish = (fn, value) => {
+      if (settled) return
+      settled = true
+      if (typeof clearTimeout === 'function') clearTimeout(timer)
+      fn(value)
+    }
+    Promise.resolve(promise).then(
+      (value) => finish(resolve, value),
+      (error) => finish(reject, error),
+    )
+  })
+}
+
+/**
+ * Ask the platform for the account balance.
+ * @param account - the `deepseekAccount` service, or undefined when it is not loaded.
+ * @param client - `AccountClientMetadata` for the requesting UI.
+ * @param timeoutMs - override for tests; defaults to BALANCE_TIMEOUT_MS.
+ * @returns a plain, JSON-serializable verdict (it crosses the sandbox boundary) — never throws.
+ */
+export async function readBalance(account, client, timeoutMs) {
+  const limit = typeof timeoutMs === 'number' ? timeoutMs : BALANCE_TIMEOUT_MS
+  if (!account || typeof account.getBalance !== 'function') {
+    return { ok: false, reason: 'no-account-service' }
+  }
+  let result = null
+  try {
+    result = await withTimeout(account.getBalance(client), limit)
+  } catch (error) {
+    const detail = error && error.message ? String(error.message) : String(error)
+    return { ok: false, reason: detail === 'timeout' ? 'timeout' : 'call-failed', detail }
+  }
+  if (result === null || result === undefined) {
+    /* null 同时意味着"没登录"和"授权在查询途中换了"。分不清时**不许猜**：
+       只有 getState() 明确说 signed-out 才说"去登录"，否则一律说"刚才没读到" ——
+       叫人去登录一个已经登录的账户，比说"没读到"糟得多。 */
+    let state = null
+    try {
+      if (typeof account.getState === 'function') {
+        state = await withTimeout(account.getState(), limit)
+      }
+    } catch (error) { state = null }
+    const signedIn = state && typeof state.status === 'string' ? state.status === 'credential-stored' : null
+    return {
+      ok: true,
+      status: signedIn === false ? 'signed-out' : 'unavailable',
+      signedIn,
+      wallets: [],
+      bonusWallets: [],
+    }
+  }
+  if (typeof result !== 'object' || result.status !== 'ready') {
+    /* The platform answered, and the answer was "failed" — a result, not a throw. */
+    return { ok: true, status: 'failed', wallets: [], bonusWallets: [] }
+  }
+  return {
+    ok: true,
+    status: 'ready',
+    wallets: normalizeWallets(result.value),
+    bonusWallets: normalizeWallets(result.bonusWallets),
+  }
+}
+
+/** Build the metadata every balance query carries. */
+export function accountClientMetadata(locale) {
+  return {
+    version: VERSION,
+    locale: typeof locale === 'string' && locale !== '' ? locale : 'zh-CN',
+    /* The service wants seconds EAST of UTC; getTimezoneOffset() is minutes WEST. */
+    timezoneOffsetSeconds: -new Date().getTimezoneOffset() * 60,
+  }
+}
+
+/** Register the handlers the browser half reaches through `host.call`. */
 export function registerHandlers(ctx, options = {}) {
   const urls = options.urls && typeof options.urls === 'object' ? options.urls : DEFAULT_SOURCES
   /* `harness` is a sandbox global: the host half is evaluated inside a vm whose
@@ -131,30 +304,39 @@ export function registerHandlers(ctx, options = {}) {
   }
   const dispose = seat.handle('checkUpdate', async (args) => {
     const current = args && typeof args.current === 'string' ? args.current : null
-    const canAbort = typeof AbortController === 'function'
-    const controller = canAbort ? new AbortController() : null
-    let timer = null
-    if (controller && typeof setTimeout === 'function') {
-      timer = setTimeout(() => controller.abort(), CHECK_TIMEOUT_MS)
-    }
-    try {
-      const verdict = await readPublishedVersion(ctx && ctx.web, urls, controller ? controller.signal : undefined)
-      return { ...verdict, current, checkedAt: new Date().toISOString() }
-    } finally {
-      if (timer !== null && typeof clearTimeout === 'function') clearTimeout(timer)
-    }
+    /* 服务**在调用时**解析，不用闭包里那个可能早就定格的 ctx.web（见 resolveWebService）。 */
+    const web = resolveWebService(ctx)
+    const verdict = await readPublishedVersion(web, urls, undefined, CHECK_TIMEOUT_MS)
+    return { ...verdict, current, checkedAt: new Date().toISOString() }
   })
-  return { registered: true, dispose, urls }
+  /* The balance handler. `ctx.deepseekAccount` is undefined unless the platform
+     provides it — readBalance() turns that into `no-account-service` rather than
+     a throw, so the browser half can say "not in this shell" honestly. */
+  const disposeBalance = seat.handle('checkBalance', async (args) => {
+    const verdict = await readBalance(
+      ctx && ctx.deepseekAccount,
+      accountClientMetadata(args && args.locale),
+    )
+    return { ...verdict, checkedAt: new Date().toISOString() }
+  })
+  return {
+    registered: true,
+    dispose: () => {
+      if (typeof dispose === 'function') dispose()
+      if (typeof disposeBalance === 'function') disposeBalance()
+    },
+    urls,
+  }
 }
 
 export function apply(ctx, config) {
-  /* The body stays tiny: register the handler, and keep its disposer on the
-     fiber so unloading the package takes the handler with it. */
+  /* The body stays tiny: register the handlers, and keep their disposer on the
+     fiber so unloading the package takes both of them with it. */
   const result = registerHandlers(ctx, config || {})
   if (result.registered && typeof ctx.effect === 'function') {
     ctx.effect(() => () => {
       if (typeof result.dispose === 'function') result.dispose()
-    }, 'dsh-wisp: checkUpdate handler')
+    }, 'dsh-wisp: host handlers')
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-wisp",
-  "version": "1.36.0",
+  "version": "1.42.0",
   "description": "DeepSeek娘 — an unofficial floating desktop companion for the DeepSeek Harness UI. Zero dependencies; sprites inlined as data URIs; schedules on the Client timer service instead of the trapped browser timer globals.",
   "type": "module",
   "main": "lib/index.js",
@@ -31,6 +31,7 @@
     "build.mjs",
     "verify-wisp.mjs",
     "tools/smoke.mjs",
+    "tools/engine-probe.mjs",
     "tools/keyout.mjs",
     "tools/assets.mjs",
     "tools/tiers.mjs",