feat(client): plans & quota panel, session cost readout, price table remote (ported from #36)

CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Added
+- **A plans & quota card in the sidebar and a dashboard behind it.** The bottom of the sidebar now carries a Command Code card — directly above Settings — showing the serving account's plan and both quota windows (5-hour and weekly) with their spend and limits. Clicking it opens a dashboard in the center column with the plan badge and billing period, the two windows as progress bars with reset times, monthly credit consumption, and the purchased/free credit balances. Both surfaces are driven by the same Host-side usage report the settings page's account card already uses, so no key ever reaches the browser, and the panel refreshes itself in the background on a 2-minute tick while it is on screen. The card is English by construction rather than following the harness language. It needs a harness whose layout can select a center panel — dsh 0.1.5 (rc.1) or newer: on an older engine the card is not registered at all, because a button that opens nothing is worse than no button, and every other screen is unaffected. Ported from [#36](https://github.com/Mars-Sea/dsh-commandcode-provider/pull/36) by [@xer-on](https://github.com/xer-on).
+
+- **The composer now shows a published-rate estimate for the current session.** Under the input, next to the harness's own token counter, a session served by Command Code gains an amount (for example `1.2M tokens · Cache hit 87% · ≈$0.02`), and the token-usage dialog the counter opens gains a price per row (uncached input, completion, cache read). The figures are computed from the session's own token buckets against Command Code's published per-token rates, including the peak/off-peak halves of the hourly-priced DeepSeek models. The readout decorates the harness's counter instead of replacing it, so the existing token/cache-hit/throughput figures and their translations stay exactly as they are. Three rules keep it honest: only Command Code sessions are priced, a model with no published cache-write rate says so rather than guessing a multiplier, and a session with nothing to price (no usage yet, an unknown model) renders no figure at all instead of a misleading `$0.00`. Ported from [#36](https://github.com/Mars-Sea/dsh-commandcode-provider/pull/36) by [@xer-on](https://github.com/xer-on).
+
+### Changed
+- **The model price table is served to the browser over a new `commandcode/prices` Remote.** The official per-token rates (input, output, cache-read, cache-write where published, plus the peak-hour override for the hourly-priced models) are vendored Host-side and reach the composer through the existing `commandcodeUsage` service, so the browser bundle carries no copy that could drift and a price row reaches an open page without a rebuild. A price row whose catalog name differs from the pricing page's slug (a vendor prefix, a dated suffix) is matched automatically, and a model the page does not price renders no cost rather than a guess. The table is pinned against the catalog by `tests/model-prices.test.ts`, which fails when a catalog model has no price — the visible decision point when upstream adds a model. It is refreshed with `node scripts/sync-model-prices.mjs`, which re-reads the page, cross-checks the embedded rates against the page's own rendered table and rewrites only the rows (`--check` reports drift without writing).
+
+### Fixed
+- **Free usage mixed with unpriced usage no longer displays a zero subtotal.** Purely free sessions retain `Free`, while partial sessions need positive priced spend before a figure is shown.
+- **The settings usage card also resolves availability from the Host.** Literal and CLI-auth keys can fetch and refresh usage without a browser credential reference. The slash command omits its balance ratio when either input is unreported or the denominator is zero, and displays a single percent sign for known ratios.
+
+- **Session estimates preserve each request's model and time across reloads and model switches.** An optional Host projection replays durable usage, including failed attempts and retry replacement rules; all eight context-tiered price rows retain their bands. Missing history hides the estimate, and unpriced or other-provider usage is labeled as a subtotal. The result uses the installed published-rate snapshot, not the provider invoice.
+- **Quota refresh resolves credentials on the Host**, including literal config keys and CLI-auth fallback. Omitted purchased/free balances remain unknown instead of appearing as zero.
+- **Transient price-table failures retry automatically** three times with bounded backoff. Host rebinds invalidate stale results; manual refresh remains available after retries are exhausted.
+
+- **A session cost on a model with no published cache-write rate no longer shows `$0.00`.** If every billed token was one the price table has no rate for, the total was zero for lack of a rate rather than for lack of spending, and the readout announced a confident `$0.00`. It now renders nothing, exactly as it already did for an unknown model. Relatedly, a cache-write row whose rate IS published is no longer hidden from the usage dialog: its cost was already part of the total above it, so dropping the row left the visible figures unable to explain the amount.
+
+- **The plans panel no longer reports a failed billing call as a fully consumed quota.** The credits endpoint is fetched in parallel with the plan and can fail on its own; the monthly balance then arrived as an absent number, which the panel read as `0` and turned into "100% used, quota exhausted" — with purchased/free tiles showing balances that were never fetched. Unreported figures now render as a dash, and the quota bar is simply not drawn until both halves of the ratio are known. Only the quota windows the endpoint actually reported get a row, so an unlimited plan no longer shows two fabricated 0%-of-limit meters.
+
+- **The hourly-priced DeepSeek V4 Flash Vision (exp) is priced at its published rate.** The table carried `$0.22 / $0.66 / $0.003`, which is ~47% above the official `$0.15 / $0.60 / $0.003` (peak `$0.30 / $1.20`). Every session cost and per-row price for that model was overstated; the row now matches the page and `scripts/sync-model-prices.mjs` cross-checks the table against the page's rendered rates so the same class of error is caught at sync time.
+
 ## [0.10.6] - 2026-09-12
 
 ### Fixed

README.md

@@ -27,6 +27,8 @@ Unofficial [DeepSeek Harness](https://deepseek-harness.github.io/deepseek-harnes
 - **Plan-aware picker** — models above your subscription tier are hidden by default (toggleable); an optional **Model allowlist** keeps only your favorites in the picker.
 - **Reasoning-effort support** — models with selectable reasoning effort levels expose them in the picker.
 - **Image input** — Vision-capable models accept images.
+- **Plans & quota panel** — a Command Code card at the bottom of the sidebar (directly above Settings) shows the serving account's plan and its 5-hour and weekly windows; clicking it opens a dashboard with the billing period, both windows as progress bars with reset times, monthly credit consumption, and the purchased/free balances. Needs dsh 0.1.5 (rc.1) or newer, and reads in English on every harness language.
+- **Session cost estimate** — published-rate estimates (`≈`) beside the composer token counter and in its usage dialog, using each request's model, request time and context tier from durable session history. Model switches and viewing the session later do not reprice earlier requests. Mixed-provider or unpriced usage shows a labeled subtotal (`≥`); missing history or wholly unpriceable usage stays hidden. These are estimates from the installed price snapshot, not provider invoices. Also English on every harness language.
 - **Web search** — the dsh `web_search` tool is backed by the Command Code Provider API (`/alpha/web-search`) with the same key/endpoint as chat, so no separate search key or base URL is needed. See [Web search](#web-search).
 
 See [Screenshots](#screenshots) below for what the UI looks like.

README.zh-CN.md

@@ -27,6 +27,8 @@
 - **按套餐过滤**：默认隐藏超出订阅套餐的模型，可一键关闭；「模型白名单」可进一步只保留常用模型。
 - **推理强度支持**：支持推理强度的模型可在选择器中选择档位。
 - **图片输入**：Vision 模型支持发送图片。
+- **套餐与配额面板**：侧边栏底部（Settings 正上方）新增 Command Code 卡片，显示当前服务账号的套餐与 5 小时 / 每周两个配额窗口；点击后在中间栏打开面板，包含计费周期、两个窗口的进度条与重置时间、月度额度消耗，以及已购买 / 赠送余额。需要 dsh 0.1.5（rc.1）或更高版本；无论 Harness 语言如何，该面板固定为英文。
+- **会话费用估算**：在输入框下方的 token 计数旁及用量对话框中显示估算金额（`≈`），根据持久化历史中每次请求的模型、请求时间和上下文阶梯分别计价。切换模型或稍后查看不会重新定价之前的请求。混合供应商或缺少费率时显示已定价部分的小计（`≥`）；缺少历史事实或完全无法定价时不显示金额。结果基于插件内的价格快照，不等同于供应商账单。同样固定为英文。
 - **联网搜索**：dsh 的 `web_search` 工具由 Command Code Provider API（`/alpha/web-search`）承载，复用聊天同一个 key 与端点，无需单独配置搜索 key 或地址。详见[联网搜索](#联网搜索)。
 
 ## 安装