@iasiv5/dsh-quota-watch 0.1.30 → 0.1.32

package/README.md

@@ -1,6 +1,5 @@
 # DSH Quota Watch
 
-[![Release](https://img.shields.io/github/v/release/iasiv5/dsh-quota-watch?label=Release&sort=semver)](https://github.com/iasiv5/dsh-quota-watch/releases)
 [![CI](https://img.shields.io/github/actions/workflow/status/iasiv5/dsh-quota-watch/ci.yml?branch=main&label=CI)](https://github.com/iasiv5/dsh-quota-watch/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/@iasiv5/dsh-quota-watch?label=npm)](https://www.npmjs.com/package/@iasiv5/dsh-quota-watch)
 [![License](https://img.shields.io/github/license/iasiv5/dsh-quota-watch?label=License)](./LICENSE)
@@ -24,7 +23,7 @@
 
 | 项目 | 要求或声明 |
 |---|---|
-| DSH | `>=0.1.7-rc.2`（包元数据声明的最低版本） |
+| DSH | `>=0.2.0-rc.1`（包元数据声明的最低版本）；`0.2.1-rc.2` 已完成静态源码适配审计（`docs/reports/2026-10-17-dsh-0.2.1-rc.2-compat-audit.md`，含 2026-10-19 复核附记），并已在 DSH Web `0.2.1-rc.2` 实例上运行时实测 |
 | Node.js | `>=20` |
 | Cordis | peer dependency `^4.0.2` |
 | 客户端平台 | 包元数据声明 `web` |
@@ -87,7 +86,7 @@ Web 与 Desktop profile 均已实测适配。按 DSH 插件管理器提示完成
 
 ## English summary
 
-DSH Quota Watch displays provider-reported quota snapshots for GLM Coding Plan and GitHub Copilot in a floating capsule, detail panel, and optional sidebar card that is hidden by default and toggled from the panel. It does not read DSH session tokens or derive Copilot remaining credits from credits used. The declared requirements are DSH `>=0.1.7-rc.2`, Node.js `>=20`, and Cordis peer `^4.0.2`; the package declares a Web client target. The plugin has been manually verified with both DSH Web and Desktop profiles; CI does not run host-profile integration tests.
+DSH Quota Watch displays provider-reported quota snapshots for GLM Coding Plan and GitHub Copilot in a floating capsule, detail panel, and optional sidebar card that is hidden by default and toggled from the panel. It does not read DSH session tokens or derive Copilot remaining credits from credits used. The declared requirements are DSH `>=0.2.0-rc.1`, Node.js `>=20`, and Cordis peer `^4.0.2`; the package declares a Web client target. Compatibility with DSH `0.2.1-rc.2` has been reviewed by a static source audit (`docs/reports/2026-10-17-dsh-0.2.1-rc.2-compat-audit.md`); runtime verification follows host upgrades. The plugin has been manually verified with both DSH Web and Desktop profiles; CI does not run host-profile integration tests.
 
 Install for a DSH Web or Desktop profile from the DSH plugin marketplace. Both profiles have been manually verified; the CLI install commands are shown above.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iasiv5/dsh-quota-watch",
-  "version": "0.1.30",
+  "version": "0.1.32",
   "description": "DSH Web sidebar monitor for GLM Coding Plan quotas and GitHub Copilot credits",
   "type": "module",
   "main": "./src/host.mjs",
@@ -42,7 +42,7 @@
   },
   "dsh": {
     "engines": {
-      "dsh": ">=0.1.7-rc.2"
+      "dsh": ">=0.2.0-rc.1"
     },
     "bundle": {
       "patch": "./cordis.patch.yml"

package/src/access.mjs

@@ -46,13 +46,17 @@ export function isLoopbackRequest(request) {
 
 function pairingService(ctx) {
   try {
+    // Sanctioned non-throwing lookup: works whenever a future host provides
+    // the pairing service again. On cordis Local a bare `ctx.remoteWebUiPairing`
+    // property read throws for a non-injected service, so it must not be used
+    // as a fallback (the service itself is absent from 0.2.x hosts — pairing
+    // authorization currently degrades to loopback-only).
     const fromGet = typeof ctx.get === 'function' ? ctx.get('remoteWebUiPairing', false) : undefined
     if (fromGet && typeof fromGet.isPairedDevice === 'function') return fromGet
   } catch {
     // Missing optional pairing service stays loopback-only.
   }
-  const direct = ctx.remoteWebUiPairing
-  return direct && typeof direct.isPairedDevice === 'function' ? direct : undefined
+  return undefined
 }
 
 /** Allow the local desktop or a browser session explicitly paired by the host. */