feat: multi-key OpenCode Go usage + quota page redesign, bump v0.4.0

- support multiple OpenCode API keys for Go usage and quota queries
- redesigned quota page UI
- update README and tests

plugin/management_test.go

@@ -74,6 +74,9 @@ func TestHandleManagement_QuotaResource(t *testing.T) {
 		if !strings.Contains(bodyStr, "用量配额") {
 			t.Errorf("Body does not contain expected menu text 用量配额")
 		}
+		if !strings.Contains(bodyStr, "v0.4.0") {
+			t.Errorf("Body does not contain version badge v0.4.0")
+		}
 	}
 }
 
@@ -230,19 +233,30 @@ func TestHandleManagement_OpencodeUsageRoute(t *testing.T) {
 			if resp.StatusCode != http.StatusOK {
 				t.Fatalf("StatusCode = %d, want 200, body=%s", resp.StatusCode, string(resp.Body))
 			}
-			var usage OpenCodeFormattedUsageResponse
+			// v0.4.0: the response is the multi-key envelope even for a single key.
+			var usage OpenCodeMultiKeyResponse
 			if err := json.Unmarshal(resp.Body, &usage); err != nil {
 				t.Fatalf("unmarshal body error: %v", err)
 			}
 			if !usage.OK || usage.Provider != "opencode_go" {
 				t.Fatalf("unexpected response: ok=%v provider=%q", usage.OK, usage.Provider)
 			}
-			if usage.Windows.Rolling.Percent != 4 || usage.Windows.Weekly.Percent != 46 || usage.Windows.Monthly.Percent != 23 {
-				t.Errorf("windows percents = %v/%v/%v, want 4/46/23",
-					usage.Windows.Rolling.Percent, usage.Windows.Weekly.Percent, usage.Windows.Monthly.Percent)
+			if len(usage.Keys) != 1 || !usage.Keys[0].OK {
+				t.Fatalf("expected exactly one successful key, got %+v", usage.Keys)
 			}
-			if usage.Windows.Weekly.ResetInSeconds <= 0 {
-				t.Errorf("weekly reset_in_seconds = %d, want > 0", usage.Windows.Weekly.ResetInSeconds)
+			if usage.Keys[0].Windows == nil {
+				t.Fatal("keys[0].windows = nil, want non-nil on success")
+			}
+			if usage.Keys[0].Windows.Rolling.Percent != 4 || usage.Keys[0].Windows.Weekly.Percent != 46 || usage.Keys[0].Windows.Monthly.Percent != 23 {
+				t.Errorf("windows percents = %v/%v/%v, want 4/46/23",
+					usage.Keys[0].Windows.Rolling.Percent, usage.Keys[0].Windows.Weekly.Percent, usage.Keys[0].Windows.Monthly.Percent)
+			}
+			if usage.Keys[0].Windows.Weekly.ResetInSeconds <= 0 {
+				t.Errorf("weekly reset_in_seconds = %d, want > 0", usage.Keys[0].Windows.Weekly.ResetInSeconds)
+			}
+			// The raw key from the POST body must never appear in the response.
+			if strings.Contains(string(resp.Body), "sk-opencode-override") && tc.method == http.MethodPost {
+				t.Errorf("response leaks the raw override key: %s", string(resp.Body))
 			}
 		})
 	}
@@ -252,6 +266,175 @@ func TestHandleManagement_OpencodeUsageRoute(t *testing.T) {
 	}
 }
 
+// /opencode/usage status matrix (v0.4.0): >=1 key success → 200; one success
+// + one 401 → 200 with keys[1].ok=false and no windows; all 401 → 502; no
+// keys configured → 400 with the "no opencode api keys configured" prefix.
+func TestHandleManagement_OpencodeUsage_MultiKeyMatrix(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.Header.Get("Authorization") {
+		case "Bearer sk-good-AAAA", "Bearer sk-good-ZZZZ":
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(mockOpencodeUsageJSON))
+		default:
+			w.WriteHeader(http.StatusUnauthorized)
+			_, _ = w.Write([]byte(`{"error":"invalid api key"}`))
+		}
+	}))
+	defer ts.Close()
+
+	SetHostCaller(nil)
+	SetDefaultHTTPClient(ts.Client())
+	defer func() {
+		SetDefaultHTTPClient(&http.Client{Timeout: 15 * time.Second})
+	}()
+
+	postKeys := func(keys ...string) ManagementRequest {
+		body, _ := json.Marshal(map[string]any{
+			"opencode_api_keys": keys,
+			"opencode_api_base": ts.URL,
+		})
+		return ManagementRequest{
+			Method: http.MethodPost,
+			Path:   "/plugins/commandcode/opencode/usage",
+			Body:   body,
+		}
+	}
+
+	t.Run("both keys succeed → 200", func(t *testing.T) {
+		resp, err := HandleManagement(context.Background(), postKeys("sk-good-AAAA", "sk-good-ZZZZ"), nil)
+		if err != nil {
+			t.Fatalf("HandleManagement error: %v", err)
+		}
+		if resp.StatusCode != http.StatusOK {
+			t.Fatalf("StatusCode = %d, want 200, body=%s", resp.StatusCode, string(resp.Body))
+		}
+		var usage OpenCodeMultiKeyResponse
+		if err := json.Unmarshal(resp.Body, &usage); err != nil {
+			t.Fatalf("unmarshal error: %v", err)
+		}
+		if !usage.OK || len(usage.Keys) != 2 || !usage.Keys[0].OK || !usage.Keys[1].OK {
+			t.Errorf("unexpected response: %+v", usage)
+		}
+		if usage.Error != "" {
+			t.Errorf("top-level error = %q, want empty when keys are configured", usage.Error)
+		}
+	})
+
+	t.Run("one success one 401 → 200 with failed key isolated", func(t *testing.T) {
+		resp, err := HandleManagement(context.Background(), postKeys("sk-good-AAAA", "sk-bad-BBBB"), nil)
+		if err != nil {
+			t.Fatalf("HandleManagement error: %v", err)
+		}
+		if resp.StatusCode != http.StatusOK {
+			t.Fatalf("StatusCode = %d, want 200 (>=1 key succeeded), body=%s", resp.StatusCode, string(resp.Body))
+		}
+		var usage OpenCodeMultiKeyResponse
+		if err := json.Unmarshal(resp.Body, &usage); err != nil {
+			t.Fatalf("unmarshal error: %v", err)
+		}
+		if !usage.OK || len(usage.Keys) != 2 {
+			t.Fatalf("unexpected response: %+v", usage)
+		}
+		if !usage.Keys[0].OK || usage.Keys[0].Windows == nil {
+			t.Errorf("keys[0] = %+v, want ok with windows", usage.Keys[0])
+		}
+		if usage.Keys[1].OK || usage.Keys[1].Windows != nil {
+			t.Errorf("keys[1] = %+v, want not-ok with nil windows", usage.Keys[1])
+		}
+		if usage.Keys[1].StatusCode != http.StatusUnauthorized {
+			t.Errorf("keys[1].status_code = %d, want 401", usage.Keys[1].StatusCode)
+		}
+		// windows must be omitted from the JSON for the failed key, not
+		// serialized as null or a zero-value struct.
+		var raw struct {
+			Keys []struct {
+				Windows json.RawMessage `json:"windows"`
+			} `json:"keys"`
+		}
+		if err := json.Unmarshal(resp.Body, &raw); err != nil {
+			t.Fatalf("unmarshal raw error: %v", err)
+		}
+		if len(raw.Keys[1].Windows) != 0 {
+			t.Errorf("keys[1].windows in JSON = %s, want omitted", string(raw.Keys[1].Windows))
+		}
+		if !strings.Contains(usage.Keys[1].Error, "opencode upstream returned 401") {
+			t.Errorf("keys[1].error = %q, want upstream 401 mention", usage.Keys[1].Error)
+		}
+		if strings.Contains(string(resp.Body), "sk-bad-BBBB") {
+			t.Errorf("response leaks the raw key: %s", string(resp.Body))
+		}
+	})
+
+	t.Run("all keys 401 → 502", func(t *testing.T) {
+		resp, err := HandleManagement(context.Background(), postKeys("sk-bad-CCCC", "sk-bad-DDDD"), nil)
+		if err != nil {
+			t.Fatalf("HandleManagement error: %v", err)
+		}
+		if resp.StatusCode != http.StatusBadGateway {
+			t.Fatalf("StatusCode = %d, want 502 (all keys upstream-failed), body=%s", resp.StatusCode, string(resp.Body))
+		}
+		var usage OpenCodeMultiKeyResponse
+		if err := json.Unmarshal(resp.Body, &usage); err != nil {
+			t.Fatalf("unmarshal error: %v", err)
+		}
+		if usage.OK {
+			t.Errorf("OK = true, want false when all keys fail")
+		}
+		if usage.Error != "" {
+			t.Errorf("top-level error = %q, want empty (per-key errors carry the detail)", usage.Error)
+		}
+	})
+
+	t.Run("no keys configured → 400", func(t *testing.T) {
+		req := ManagementRequest{
+			Method: http.MethodGet,
+			Path:   "/v0/management/plugins/commandcode/opencode/usage",
+		}
+		resp, err := HandleManagement(context.Background(), req, &PluginConfig{})
+		if err != nil {
+			t.Fatalf("HandleManagement error: %v", err)
+		}
+		if resp.StatusCode != http.StatusBadRequest {
+			t.Fatalf("StatusCode = %d, want 400, body=%s", resp.StatusCode, string(resp.Body))
+		}
+		var usage OpenCodeMultiKeyResponse
+		if err := json.Unmarshal(resp.Body, &usage); err != nil {
+			t.Fatalf("unmarshal error: %v", err)
+		}
+		if !strings.HasPrefix(usage.Error, "no opencode api keys configured") {
+			t.Errorf("top-level error = %q, want prefix 'no opencode api keys configured'", usage.Error)
+		}
+	})
+
+	t.Run("POST body opencode_api_keys overrides config and wins over scalar", func(t *testing.T) {
+		body, _ := json.Marshal(map[string]any{
+			"opencode_api_key":  "sk-scalar-must-lose",
+			"opencode_api_keys": []string{"sk-good-AAAA"},
+			"opencode_api_base": ts.URL,
+		})
+		req := ManagementRequest{
+			Method: http.MethodPost,
+			Path:   "/plugins/commandcode/opencode/usage",
+			Body:   body,
+		}
+		cfg := &PluginConfig{OpenCodeAPIKey: "sk-config-must-lose", OpenCodeAPIBase: ts.URL}
+		resp, err := HandleManagement(context.Background(), req, cfg)
+		if err != nil {
+			t.Fatalf("HandleManagement error: %v", err)
+		}
+		if resp.StatusCode != http.StatusOK {
+			t.Fatalf("StatusCode = %d, want 200, body=%s", resp.StatusCode, string(resp.Body))
+		}
+		var usage OpenCodeMultiKeyResponse
+		if err := json.Unmarshal(resp.Body, &usage); err != nil {
+			t.Fatalf("unmarshal error: %v", err)
+		}
+		if len(usage.Keys) != 1 || usage.Keys[0].KeyID != MaskAPIKey("sk-good-AAAA") {
+			t.Errorf("keys = %+v, want only the body-list key (list wins over scalar and config)", usage.Keys)
+		}
+	})
+}
+
 // Regression: /plugins/commandcode/all must not be swallowed by the generic
 // "/usage" suffix match nor miss its dedicated handler.
 func TestHandleManagement_AllRoute_BothProvidersOK(t *testing.T) {
@@ -314,10 +497,14 @@ func TestHandleManagement_AllRoute_BothProvidersOK(t *testing.T) {
 	if err := json.Unmarshal(all.CommandCode, &ccUsage); err != nil || !ccUsage.OK {
 		t.Errorf("commandcode payload invalid: err=%v usage=%+v", err, ccUsage)
 	}
-	var ocUsage OpenCodeFormattedUsageResponse
+	// v0.4.0: the opencode field carries the multi-key envelope.
+	var ocUsage OpenCodeMultiKeyResponse
 	if err := json.Unmarshal(all.OpenCode, &ocUsage); err != nil || !ocUsage.OK {
 		t.Errorf("opencode payload invalid: err=%v usage=%+v", err, ocUsage)
 	}
+	if len(ocUsage.Keys) != 1 || !ocUsage.Keys[0].OK || ocUsage.Keys[0].Windows == nil {
+		t.Errorf("opencode keys = %+v, want one successful key with windows", ocUsage.Keys)
+	}
 }
 
 // Partial failure: one provider fails upstream → ok stays true, the failed
@@ -377,8 +564,10 @@ func TestHandleManagement_AllUsage_PartialFailure(t *testing.T) {
 	if _, present := all.Errors["opencode"]; !present {
 		t.Errorf("expected errors[opencode] to be set, got %v", all.Errors)
 	}
-	if !strings.Contains(all.Errors["opencode"], "opencode upstream returned 500") {
-		t.Errorf("errors[opencode] = %q, want it to mention 'opencode upstream returned 500'", all.Errors["opencode"])
+	// v0.4.0: a configured-but-failed key is an upstream failure; with the
+	// single configured key failing, the aggregate message is "all N keys failed".
+	if !strings.Contains(all.Errors["opencode"], "all 1 opencode keys failed") {
+		t.Errorf("errors[opencode] = %q, want it to mention 'all 1 opencode keys failed'", all.Errors["opencode"])
 	}
 	// opencode field must be omitted (omitempty), not serialized as "null".
 	if strings.Contains(string(resp.Body), `"opencode":null`) {
@@ -450,6 +639,154 @@ func TestHandleManagement_AllUsage_Upstream400NotMisclassified(t *testing.T) {
 	}
 }
 
+// /all matrix (v0.4.0): Command Code upstream down + all opencode keys 401
+// → every failure is upstream → 502, with the aggregate "all N keys failed"
+// message in errors["opencode"].
+func TestHandleManagement_AllUsage_CCUpstreamDown_OpenCodeAll401(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/usage":
+			w.WriteHeader(http.StatusUnauthorized)
+			_, _ = w.Write([]byte(`{"error":"invalid api key"}`))
+		default: // commandcode internal endpoints
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte(`{"error":"cc exploded"}`))
+		}
+	}))
+	defer ts.Close()
+
+	SetHostCaller(nil)
+	SetDefaultHTTPClient(ts.Client())
+	defer func() {
+		SetDefaultHTTPClient(&http.Client{Timeout: 15 * time.Second})
+	}()
+
+	cfg := &PluginConfig{
+		SessionToken:    "configured-token",
+		APIBase:         ts.URL,
+		OpenCodeAPIKeys: []string{"sk-bad-AAAA", "sk-bad-BBBB"},
+		OpenCodeAPIBase: ts.URL,
+	}
+
+	req := ManagementRequest{
+		Method: http.MethodGet,
+		Path:   "/v0/management/plugins/commandcode/all",
+	}
+	resp, err := HandleManagement(context.Background(), req, cfg)
+	if err != nil {
+		t.Fatalf("HandleManagement error: %v", err)
+	}
+	if resp.StatusCode != http.StatusBadGateway {
+		t.Fatalf("StatusCode = %d, want 502 (all failures upstream), body=%s", resp.StatusCode, string(resp.Body))
+	}
+
+	var all AllUsageResponse
+	if err := json.Unmarshal(resp.Body, &all); err != nil {
+		t.Fatalf("unmarshal body error: %v", err)
+	}
+	if all.OK {
+		t.Error("expected ok=false")
+	}
+	if !strings.Contains(all.Errors["opencode"], "all 2 opencode keys failed") {
+		t.Errorf("errors[opencode] = %q, want 'all 2 opencode keys failed'", all.Errors["opencode"])
+	}
+}
+
+// /all matrix: Command Code upstream down + one opencode key succeeds → 200
+// (partial failure); the multi-key opencode payload is inlined.
+func TestHandleManagement_AllUsage_CCUpstreamDown_OpenCodeOneOK(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.URL.Path == "/usage" && r.Header.Get("Authorization") == "Bearer sk-good-AAAA":
+			_, _ = w.Write([]byte(mockOpencodeUsageJSON))
+		case r.URL.Path == "/usage":
+			w.WriteHeader(http.StatusUnauthorized)
+			_, _ = w.Write([]byte(`{"error":"invalid api key"}`))
+		default: // commandcode internal endpoints
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte(`{"error":"cc exploded"}`))
+		}
+	}))
+	defer ts.Close()
+
+	SetHostCaller(nil)
+	SetDefaultHTTPClient(ts.Client())
+	defer func() {
+		SetDefaultHTTPClient(&http.Client{Timeout: 15 * time.Second})
+	}()
+
+	cfg := &PluginConfig{
+		SessionToken:    "configured-token",
+		APIBase:         ts.URL,
+		OpenCodeAPIKeys: []string{"sk-good-AAAA", "sk-bad-BBBB"},
+		OpenCodeAPIBase: ts.URL,
+	}
+
+	req := ManagementRequest{
+		Method: http.MethodGet,
+		Path:   "/v0/management/plugins/commandcode/all",
+	}
+	resp, err := HandleManagement(context.Background(), req, cfg)
+	if err != nil {
+		t.Fatalf("HandleManagement error: %v", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("StatusCode = %d, want 200 (opencode partial success), body=%s", resp.StatusCode, string(resp.Body))
+	}
+
+	var all AllUsageResponse
+	if err := json.Unmarshal(resp.Body, &all); err != nil {
+		t.Fatalf("unmarshal body error: %v", err)
+	}
+	if !all.OK {
+		t.Error("expected ok=true (>=1 provider succeeded)")
+	}
+	if _, present := all.Errors["commandcode"]; !present {
+		t.Errorf("expected errors[commandcode], got %v", all.Errors)
+	}
+	if _, present := all.Errors["opencode"]; present {
+		t.Errorf("errors[opencode] must be absent on partial success, got %q", all.Errors["opencode"])
+	}
+	var oc OpenCodeMultiKeyResponse
+	if err := json.Unmarshal(all.OpenCode, &oc); err != nil || !oc.OK {
+		t.Fatalf("opencode payload invalid: err=%v oc=%+v", err, oc)
+	}
+	if len(oc.Keys) != 2 || !oc.Keys[0].OK || oc.Keys[1].OK {
+		t.Errorf("opencode keys = %+v, want [ok, failed]", oc.Keys)
+	}
+	if strings.Contains(string(resp.Body), "sk-good-AAAA") || strings.Contains(string(resp.Body), "sk-bad-BBBB") {
+		t.Errorf("/all response leaks a raw opencode key: %s", string(resp.Body))
+	}
+}
+
+func TestIsLocalCredentialError(t *testing.T) {
+	local := []string{
+		"session_token is required. Configure ...",
+		"opencode_api_key is required. Configure ...",
+		// v0.4.0 prefix: zero opencode keys configured is a local problem.
+		"no opencode api keys configured. Configure opencode_api_keys (YAML list) ...",
+	}
+	for _, msg := range local {
+		if !isLocalCredentialError(msg) {
+			t.Errorf("isLocalCredentialError(%q) = false, want true", msg)
+		}
+	}
+
+	upstream := []string{
+		"opencode upstream returned 401: check opencode_api_key",
+		"opencode upstream request failed: dial tcp: connection refused",
+		"all 2 opencode keys failed",
+		"upstream returned non-200 status",
+		"failed to parse opencode upstream usage: unexpected end of JSON input",
+		"",
+	}
+	for _, msg := range upstream {
+		if isLocalCredentialError(msg) {
+			t.Errorf("isLocalCredentialError(%q) = true, want false", msg)
+		}
+	}
+}
+
 // Unknown path after the new routes still 404s.
 func TestHandleManagement_UnknownPath(t *testing.T) {
 	req := ManagementRequest{