[ferrisching]

Fixes the billing surprise reported in #196: when DSH's own search provider reports a missing credential, the plugin falls back to the signed-in DeepSeek account's Search API, which bills every successful request — and nothing in the UI, the transcript or the tool result said so.

What this changes

• New setting accountSearchFallback (on by default, off available): when off, a missing-credential search keeps the original WEB_PROVIDER_CREDENTIAL_MISSING error instead of falling back, so the search fails with the existing configuration guidance and spends nothing.
• Price disclosed in the settings hint (zh + en): the account route is billed per successful request (currently ¥5 / 1,000).
• Control placed next to the search source radios, and hidden when the source is Codex (the fallback never applies there). It is not inside the search-scope details, which hide for the DSH source — the case where the fallback matters most.
• README.md / README.en.md: one row in the models-and-search table documenting the new switch.

Default stays on so existing installs behave as before; failing closed is opt-in. If you would rather ship off by default, that is a one-line change in src/capability-settings.js (the read fallback and the schema default) — happy to flip it.

Behavior

DSH provider result	accountSearchFallback: on	accountSearchFallback: off
answers	returns its result	returns its result
WEB_PROVIDER_CREDENTIAL_MISSING	account Search API (billed)	rethrows the original error
any other error	rethrows	rethrows

Code

• src/deepseek-account-search.js — createDshAccountSearchProvider checks options.allowAccountFallback?.() before the account call, logs DeepSeek account fallback disabled, and rethrows.
• src/capability-settings.js — ACCOUNT_SEARCH_FALLBACK_FIELD / ACCOUNT_SEARCH_FALLBACK_MODES, read + patch validation.
• src/index.js — settings schema default on; wires allowAccountFallback from readCapabilitySettings.
• src/capability-preferences.jsx + src/client-preferences.jsx — AccountSearchFallbackPreference.
• src/client-locales.js — zh/en strings.

Tests

node --test tests/*.test.mjs
tests 918 | pass 891 | fail 1

The single failure (subagent-runtime.test.mjs → "preparation checks the provider-local CLI...") also fails on unmodified main in this environment because the Codex subtask runtime is not installed; it is unrelated to this change.

New coverage:

• tests/deepseek-account-search.test.mjs — off keeps the credential error and never calls fetch; the default path still falls back (existing test).
• tests/capability-settings.test.mjs — default on, explicit off, invalid values normalized, patch validation.
• tests/plugin-integration.test.mjs — the RPC status shape now includes accountSearchFallback: 'on'.

Build: pnpm build succeeds locally (system node; the DSH-bundled runtime node cannot dlopen rolldown's native binding on this machine because of a Team ID mismatch, which is environment-specific).

Not in this PR

#196 also asked whether the "other models" master switch should gate search. Reading src/index.js (effectiveSearchMode + the comment above the router), the switch is documented to turn off Codex subscription search for other models, leaving "DSH search" (including this fallback) in place — so that part looks intentional rather than a bug. I left it unchanged; if the intended semantics are different, this PR can be extended.

[WSL043]

这个问题已在 #199 处理并进入 main。目前采用的是直接移除插件额外的 DeepSeek 账号付费回退，因此不再增加单独的收费回退开关。同时补齐了“其他模型”总开关在各搜索入口的限制，并明确了自动和手动选择搜索来源时的路由边界。这个 PR 的问题目标已由新的实现覆盖，原方案就不再合并了，先关闭。