feat: display official subscription quota on Claude provider cards

Read Claude OAuth credentials from macOS Keychain (with file fallback)
and query the Anthropic usage API to show quota utilization inline on
official provider cards. Includes compact countdown timer for reset
windows and hides the rarely-used seven_day_sonnet tier in inline mode.

src-tauri/src/commands/mod.rs

@@ -21,6 +21,7 @@ mod session_manager;
 mod settings;
 pub mod skill;
 mod stream_check;
+mod subscription;
 mod sync_support;
 
 mod lightweight;
@@ -49,6 +50,7 @@ pub use session_manager::*;
 pub use settings::*;
 pub use skill::*;
 pub use stream_check::*;
+pub use subscription::*;
 
 pub use lightweight::*;
 pub use usage::*;

src-tauri/src/commands/subscription.rs

@@ -0,0 +1,10 @@
+use crate::services::subscription::SubscriptionQuota;
+
+/// 查询官方订阅额度
+///
+/// 读取 CLI 工具已有的 OAuth 凭据并调用官方 API 获取使用额度。
+/// 不需要 AppState（不访问数据库），直接读文件 + 发 HTTP。
+#[tauri::command]
+pub async fn get_subscription_quota(tool: String) -> Result<SubscriptionQuota, String> {
+    crate::services::subscription::get_subscription_quota(&tool).await
+}

src-tauri/src/lib.rs

@@ -888,6 +888,8 @@ pub fn run() {
             // usage query
             commands::queryProviderUsage,
             commands::testUsageScript,
+            // subscription quota
+            commands::get_subscription_quota,
             // New MCP via config.json (SSOT)
             commands::get_mcp_config,
             commands::upsert_mcp_server_in_config,

src-tauri/src/services/mod.rs

@@ -10,6 +10,7 @@ pub mod proxy;
 pub mod skill;
 pub mod speedtest;
 pub mod stream_check;
+pub mod subscription;
 pub mod usage_stats;
 pub mod webdav;
 pub mod webdav_auto_sync;

src-tauri/src/services/subscription.rs

@@ -0,0 +1,460 @@
+//! 官方订阅额度查询服务
+//!
+//! 读取 CLI 工具的已有 OAuth 凭据，查询官方订阅额度。
+//! 第一层：仅读取凭据，不实现登录/刷新。
+
+use serde::{Deserialize, Serialize};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use crate::config;
+
+// ── 数据类型 ──────────────────────────────────────────────
+
+/// 凭据状态
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum CredentialStatus {
+    Valid,
+    Expired,
+    NotFound,
+    ParseError,
+}
+
+/// 单个限速窗口（如 5小时会话、7天周期）
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct QuotaTier {
+    /// 窗口标识：five_hour, seven_day, seven_day_opus, seven_day_sonnet 等
+    pub name: String,
+    /// 使用百分比 0–100
+    pub utilization: f64,
+    /// ISO 8601 重置时间
+    pub resets_at: Option<String>,
+}
+
+/// 超额使用信息
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ExtraUsage {
+    pub is_enabled: bool,
+    pub monthly_limit: Option<f64>,
+    pub used_credits: Option<f64>,
+    pub utilization: Option<f64>,
+    pub currency: Option<String>,
+}
+
+/// 订阅额度查询结果
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SubscriptionQuota {
+    pub tool: String,
+    pub credential_status: CredentialStatus,
+    pub credential_message: Option<String>,
+    pub success: bool,
+    pub tiers: Vec<QuotaTier>,
+    pub extra_usage: Option<ExtraUsage>,
+    pub error: Option<String>,
+    pub queried_at: Option<i64>,
+}
+
+impl SubscriptionQuota {
+    fn not_found(tool: &str) -> Self {
+        Self {
+            tool: tool.to_string(),
+            credential_status: CredentialStatus::NotFound,
+            credential_message: None,
+            success: false,
+            tiers: vec![],
+            extra_usage: None,
+            error: None,
+            queried_at: None,
+        }
+    }
+
+    fn error(tool: &str, status: CredentialStatus, message: String) -> Self {
+        Self {
+            tool: tool.to_string(),
+            credential_status: status,
+            credential_message: Some(message.clone()),
+            success: false,
+            tiers: vec![],
+            extra_usage: None,
+            error: Some(message),
+            queried_at: Some(now_millis()),
+        }
+    }
+}
+
+// ── Claude 凭据读取 ──────────────────────────────────────
+
+/// Claude OAuth 凭据文件中的嵌套结构
+#[derive(Deserialize)]
+struct ClaudeOAuthEntry {
+    #[serde(rename = "accessToken")]
+    access_token: Option<String>,
+    #[serde(rename = "expiresAt")]
+    expires_at: Option<serde_json::Value>,
+}
+
+/// 读取 Claude OAuth 凭据
+///
+/// 按优先级尝试以下来源：
+/// 1. macOS Keychain (service: "Claude Code-credentials")
+/// 2. 凭据文件 ~/.claude/.credentials.json
+///
+/// JSON 格式（两种 key 都兼容）：
+/// {"claudeAiOauth": {"accessToken": "...", "expiresAt": ...}}
+/// {"claude.ai_oauth": {"accessToken": "...", "expiresAt": ...}}
+fn read_claude_credentials() -> (Option<String>, CredentialStatus, Option<String>) {
+    // 来源 1: macOS Keychain
+    #[cfg(target_os = "macos")]
+    {
+        if let Some(result) = read_claude_credentials_from_keychain() {
+            return result;
+        }
+    }
+
+    // 来源 2: 凭据文件
+    read_claude_credentials_from_file()
+}
+
+/// 从 macOS Keychain 读取 Claude 凭据
+#[cfg(target_os = "macos")]
+fn read_claude_credentials_from_keychain(
+) -> Option<(Option<String>, CredentialStatus, Option<String>)> {
+    let output = std::process::Command::new("security")
+        .args([
+            "find-generic-password",
+            "-s",
+            "Claude Code-credentials",
+            "-w",
+        ])
+        .output()
+        .ok()?;
+
+    if !output.status.success() {
+        return None; // Keychain 中无此条目，回退到文件
+    }
+
+    let json_str = String::from_utf8(output.stdout).ok()?;
+    let json_str = json_str.trim();
+    if json_str.is_empty() {
+        return None;
+    }
+
+    Some(parse_claude_credentials_json(json_str))
+}
+
+/// 从文件读取 Claude 凭据
+fn read_claude_credentials_from_file() -> (Option<String>, CredentialStatus, Option<String>) {
+    let cred_path = config::get_claude_config_dir().join(".credentials.json");
+
+    if !cred_path.exists() {
+        return (None, CredentialStatus::NotFound, None);
+    }
+
+    let content = match std::fs::read_to_string(&cred_path) {
+        Ok(c) => c,
+        Err(e) => {
+            return (
+                None,
+                CredentialStatus::ParseError,
+                Some(format!("Failed to read credentials file: {e}")),
+            );
+        }
+    };
+
+    parse_claude_credentials_json(&content)
+}
+
+/// 解析 Claude 凭据 JSON（Keychain 和文件共用）
+fn parse_claude_credentials_json(
+    content: &str,
+) -> (Option<String>, CredentialStatus, Option<String>) {
+    let parsed: serde_json::Value = match serde_json::from_str(content) {
+        Ok(v) => v,
+        Err(e) => {
+            return (
+                None,
+                CredentialStatus::ParseError,
+                Some(format!("Failed to parse credentials JSON: {e}")),
+            );
+        }
+    };
+
+    // 兼容两种 key 名
+    let entry_value = parsed
+        .get("claudeAiOauth")
+        .or_else(|| parsed.get("claude.ai_oauth"));
+
+    let entry_value = match entry_value {
+        Some(v) => v,
+        None => {
+            return (
+                None,
+                CredentialStatus::ParseError,
+                Some("No OAuth entry found in credentials".to_string()),
+            );
+        }
+    };
+
+    let entry: ClaudeOAuthEntry = match serde_json::from_value(entry_value.clone()) {
+        Ok(e) => e,
+        Err(e) => {
+            return (
+                None,
+                CredentialStatus::ParseError,
+                Some(format!("Failed to parse OAuth entry: {e}")),
+            );
+        }
+    };
+
+    let access_token = match entry.access_token {
+        Some(t) if !t.is_empty() => t,
+        _ => {
+            return (
+                None,
+                CredentialStatus::ParseError,
+                Some("accessToken is empty or missing".to_string()),
+            );
+        }
+    };
+
+    // 检查 token 是否过期
+    if let Some(expires_at) = entry.expires_at {
+        if is_token_expired(&expires_at) {
+            return (
+                Some(access_token),
+                CredentialStatus::Expired,
+                Some("OAuth token has expired".to_string()),
+            );
+        }
+    }
+
+    (Some(access_token), CredentialStatus::Valid, None)
+}
+
+/// 判断 token 是否过期，兼容 Unix 时间戳（秒/毫秒）和 ISO 字符串
+fn is_token_expired(expires_at: &serde_json::Value) -> bool {
+    let now_secs = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs();
+
+    match expires_at {
+        serde_json::Value::Number(n) => {
+            if let Some(ts) = n.as_u64() {
+                // 区分秒和毫秒（毫秒级时间戳大于 1e12）
+                let ts_secs = if ts > 1_000_000_000_000 {
+                    ts / 1000
+                } else {
+                    ts
+                };
+                ts_secs < now_secs
+            } else {
+                false
+            }
+        }
+        serde_json::Value::String(s) => {
+            // 尝试解析 ISO 8601 格式
+            if let Ok(dt) = chrono::DateTime::parse_from_rfc3339(s) {
+                (dt.timestamp() as u64) < now_secs
+            } else if let Ok(dt) = chrono::NaiveDateTime::parse_from_str(s, "%Y-%m-%dT%H:%M:%S%.f")
+            {
+                (dt.and_utc().timestamp() as u64) < now_secs
+            } else {
+                false // 无法解析时不视为过期
+            }
+        }
+        _ => false,
+    }
+}
+
+// ── Claude API 查询 ──────────────────────────────────────
+
+/// Claude OAuth 用量 API 响应中的单个窗口
+#[derive(Deserialize)]
+struct ApiUsageWindow {
+    utilization: Option<f64>,
+    resets_at: Option<String>,
+}
+
+/// Claude OAuth 用量 API 响应中的超额用量
+#[derive(Deserialize)]
+struct ApiExtraUsage {
+    is_enabled: Option<bool>,
+    monthly_limit: Option<f64>,
+    used_credits: Option<f64>,
+    utilization: Option<f64>,
+    currency: Option<String>,
+}
+
+/// 已知的 Claude 用量窗口名称
+const KNOWN_TIERS: &[&str] = &[
+    "five_hour",
+    "seven_day",
+    "seven_day_opus",
+    "seven_day_sonnet",
+];
+
+/// 查询 Claude 官方订阅额度
+async fn query_claude_quota(access_token: &str) -> SubscriptionQuota {
+    let client = crate::proxy::http_client::get();
+
+    let resp = client
+        .get("https://api.anthropic.com/api/oauth/usage")
+        .header("Authorization", format!("Bearer {access_token}"))
+        .header("anthropic-beta", "oauth-2025-04-20")
+        .header("Accept", "application/json")
+        .timeout(std::time::Duration::from_secs(10))
+        .send()
+        .await;
+
+    let resp = match resp {
+        Ok(r) => r,
+        Err(e) => {
+            return SubscriptionQuota::error(
+                "claude",
+                CredentialStatus::Valid,
+                format!("Network error: {e}"),
+            );
+        }
+    };
+
+    let status = resp.status();
+
+    if status == reqwest::StatusCode::UNAUTHORIZED || status == reqwest::StatusCode::FORBIDDEN {
+        return SubscriptionQuota::error(
+            "claude",
+            CredentialStatus::Expired,
+            format!("Authentication failed (HTTP {status}). Please re-login with Claude CLI."),
+        );
+    }
+
+    if !status.is_success() {
+        let body = resp.text().await.unwrap_or_default();
+        return SubscriptionQuota::error(
+            "claude",
+            CredentialStatus::Valid,
+            format!("API error (HTTP {status}): {body}"),
+        );
+    }
+
+    let body: serde_json::Value = match resp.json().await {
+        Ok(v) => v,
+        Err(e) => {
+            return SubscriptionQuota::error(
+                "claude",
+                CredentialStatus::Valid,
+                format!("Failed to parse API response: {e}"),
+            );
+        }
+    };
+
+    // 解析已知的 tier 窗口
+    let mut tiers = Vec::new();
+    for &tier_name in KNOWN_TIERS {
+        if let Some(window) = body.get(tier_name) {
+            if let Ok(w) = serde_json::from_value::<ApiUsageWindow>(window.clone()) {
+                if let Some(util) = w.utilization {
+                    tiers.push(QuotaTier {
+                        name: tier_name.to_string(),
+                        utilization: util,
+                        resets_at: w.resets_at,
+                    });
+                }
+            }
+        }
+    }
+
+    // 也解析未知窗口（API 可能返回新的窗口类型）
+    if let Some(obj) = body.as_object() {
+        for (key, value) in obj {
+            if key == "extra_usage" || KNOWN_TIERS.contains(&key.as_str()) {
+                continue;
+            }
+            if let Ok(w) = serde_json::from_value::<ApiUsageWindow>(value.clone()) {
+                if let Some(util) = w.utilization {
+                    tiers.push(QuotaTier {
+                        name: key.clone(),
+                        utilization: util,
+                        resets_at: w.resets_at,
+                    });
+                }
+            }
+        }
+    }
+
+    // 解析超额使用
+    let extra_usage = body.get("extra_usage").and_then(|v| {
+        serde_json::from_value::<ApiExtraUsage>(v.clone())
+            .ok()
+            .map(|e| ExtraUsage {
+                is_enabled: e.is_enabled.unwrap_or(false),
+                monthly_limit: e.monthly_limit,
+                used_credits: e.used_credits,
+                utilization: e.utilization,
+                currency: e.currency,
+            })
+    });
+
+    SubscriptionQuota {
+        tool: "claude".to_string(),
+        credential_status: CredentialStatus::Valid,
+        credential_message: None,
+        success: true,
+        tiers,
+        extra_usage,
+        error: None,
+        queried_at: Some(now_millis()),
+    }
+}
+
+// ── 入口函数 ──────────────────────────────────────────────
+
+/// 查询指定 CLI 工具的官方订阅额度
+pub async fn get_subscription_quota(tool: &str) -> Result<SubscriptionQuota, String> {
+    match tool {
+        "claude" => {
+            let (token, status, message) = read_claude_credentials();
+
+            match status {
+                CredentialStatus::NotFound => Ok(SubscriptionQuota::not_found("claude")),
+                CredentialStatus::ParseError => Ok(SubscriptionQuota::error(
+                    "claude",
+                    CredentialStatus::ParseError,
+                    message.unwrap_or_else(|| "Failed to parse credentials".to_string()),
+                )),
+                CredentialStatus::Expired => {
+                    // 即使过期也尝试调用 API（token 可能实际上仍有效）
+                    if let Some(token) = token {
+                        let result = query_claude_quota(&token).await;
+                        if result.success {
+                            return Ok(result);
+                        }
+                    }
+                    Ok(SubscriptionQuota::error(
+                        "claude",
+                        CredentialStatus::Expired,
+                        message.unwrap_or_else(|| "OAuth token has expired".to_string()),
+                    ))
+                }
+                CredentialStatus::Valid => {
+                    let token = token.expect("token must be Some when status is Valid");
+                    Ok(query_claude_quota(&token).await)
+                }
+            }
+        }
+        // Codex / Gemini: 暂不支持
+        _ => Ok(SubscriptionQuota::not_found(tool)),
+    }
+}
+
+// ── 辅助函数 ──────────────────────────────────────────────
+
+fn now_millis() -> i64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_millis() as i64
+}