[HouMinXi]

Summary

Volcengine Ark console auto-login and quota fetchers had several integration issues:

1. Console cookies and CSRF tokens were returned unsanitized in REST provider responses.
2. Plan usage quota window keys (session, AFPFiveHour) differed from the canonical names (session (5h), weekly (7d)), causing genericQuotaFetcher to miss them or fall back to single-minute polls.
3. Time window keys could leak into modelWindows, treating rate-limit windows as model names.
4. Auto-binding could clobber existing connections or fail to adopt single connections when names differed from official defaults.
5. detectPlan reported available: true on accounts without purchased quota windows.

This PR fixes response sanitization, window normalization, quota fetcher mapping, unpurchased plan gating, and connection reuse in plan binding.

Changes

• Response sanitization (src/lib/providers/requestDefaults.ts): Strips volcConsoleCookie and volcCsrfToken from provider connection serialization.
• Quota window canonicalization (open-sse/services/usage/volcenginePlan.ts): Normalizes Coding Plan and Agent Plan window keys to session (5h) and weekly (7d). Guards against division by zero (remainingPercentage: 0 when total === 0).
• Quota fetcher isolation (open-sse/services/genericQuotaFetcher.ts): Maps Volcengine window aliases to window5h and window7d. Introduces TIME_WINDOW_KEYS set to isolate rate-limit windows from modelWindows.
• Plan detection guard (src/lib/providers/volcenginePlanBinding.ts): Checks for non-empty active quota windows before marking a plan available.
• Connection reuse and adoption (src/lib/providers/volcenginePlanBinding.ts):
  • Prioritizes targetConnectionId (with provider affinity check).
  • Matches by valid apiKey or volcApiKeyId.
  • Matches by default provider plan name.
  • Safely adopts the single existing connection when exactly one connection exists for the provider.
  • When multiple connections exist without a match, creates a new connection rather than overwriting.
  • Shallow merges existingPsd with new console session data to preserve user-configured flags like autoFetchModels.

Test plan

• tests/unit/volcengine-plan-request-sanitization.test.ts (1 pass)
• tests/unit/volcengine-plan-quota-windows.test.ts (2 pass)
• tests/unit/generic-quota-fetcher-volcengine.test.ts (2 pass)
• tests/unit/volcengine-plan-binding-upsert.test.ts (3 pass)
• tests/unit/services/volcengine-console-auto-login.test.ts (32 pass)
• npm run typecheck:core (0 errors)
• npm run check:cycles (0 cycles)
• npm run check:docs-sync (PASS)

Notes

Base: release/v3.8.51 @ b345c7f6c.

⚠️ base-red inherited: #12732

• changelog.d/fixes/reset-aware-model-family.md missing leading -
• open-sse/executors/glm.ts extra 16th positional (TS2554, fix(glm): drop extra 16th arg to SSE transform helper #12770)
• check:agent-skills-sync dry-run GENERATED: + cli-tunnel
• mutation-coverage names tests/unit/reset-aware-request-scope-12600.test.ts missing from stryker.conf.json

Unique diff does not touch those files. This PR's own fragment starts with - .

[HouMinXi]

Looked at 5a1ff80c2 and the full series 20e73ba33..5a1ff80c2.

Verification notes:

1. src/lib/providers/requestDefaults.ts: volcConsoleCookie and volcCsrfToken are omitted from REST provider connection responses. Verified in tests/unit/volcengine-plan-request-sanitization.test.ts.
2. open-sse/services/usage/volcenginePlan.ts: Window keys aligned to canonical session (5h) and weekly (7d). remainingPercentage: 0 guard prevents division by zero when total tokens is 0. Verified in tests/unit/volcengine-plan-quota-windows.test.ts.
3. open-sse/services/genericQuotaFetcher.ts: Added TIME_WINDOW_KEYS exclusion set so duration windows cannot contaminate modelWindows. Window aliases mapped to window5h and window7d. Verified in tests/unit/generic-quota-fetcher-volcengine.test.ts.
4. src/lib/providers/volcenginePlanBinding.ts:
   • detectPlan checks for non-empty quota windows before returning available: true.
   • findTargetConnection matches targetConnectionId with provider affinity, apiKey, apiKeyId, and default name. Single existing connection is adopted when exactly one exists; when multiple exist without match, a new connection is created to avoid overwriting. existingPsd shallow merged to preserve autoFetchModels.
   • Verified across tests/unit/volcengine-plan-binding-upsert.test.ts (3 tests) and existing 32 tests in tests/unit/services/volcengine-console-auto-login.test.ts.
5. Local code-forge review on 5a1ff80c2: 3/3 passes clean (0 confirmed findings; 2 uncertain notes on provider affinity isolation, which is the intended security fix).