@senguoyun/dsh-arkme 0.1.15 → 0.1.22

package/README.md

@@ -1,10 +1,19 @@
 # Arkme DSH Plugin
 
+[![npm 版本](https://img.shields.io/npm/v/%40senguoyun/dsh-arkme?label=npm%20%E7%89%88%E6%9C%AC)](https://www.npmjs.com/package/@senguoyun/dsh-arkme)
+[![发布记录](https://img.shields.io/badge/%E5%8F%91%E5%B8%83%E8%AE%B0%E5%BD%95-GitHub-blue)](https://github.com/arkme-senx/arkme-dsh-plugin/releases)
+
 Arkme 的 DeepSeek Harness 集成插件，为 DSH 提供账号、记录、聊天、Bot、社区、通话和市集能力。
 
 - npm：[`@senguoyun/dsh-arkme`](https://www.npmjs.com/package/@senguoyun/dsh-arkme)
 - 源码：[`arkme-senx/arkme-dsh-plugin`](https://github.com/arkme-senx/arkme-dsh-plugin)
 
+## 版本与发布
+
+- 项目首页顶部的 **npm 版本** 徽章显示当前可通过 npm 安装的正式版本。
+- 功能分支只提交功能代码；版本号、更新说明和 GitHub Release 由合并后的发版流程统一处理。
+- 发版负责人通过 GitHub Actions 的“准备插件发版”创建发版 PR；合并后自动发布 npm、创建同版本 Git Tag 和 GitHub Release。详见[插件自动发版](docs/plugin-release.md)。
+
 ## 功能
 
 - 内置搜索页支持快记搜索、搜索历史、纯图片库和已生成 AI 视频快速入口；图片库采用桌面端多列视图并排除普通视频。

package/assets/desktop_call/arkme-video-linear.svg

@@ -0,0 +1,5 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path d="M12.53 20.4201H6.21C3.05 20.4201 2 18.3201 2 16.2101V7.79008C2 4.63008 3.05 3.58008 6.21 3.58008H12.53C15.69 3.58008 16.74 4.63008 16.74 7.79008V16.2101C16.74 19.3701 15.68 20.4201 12.53 20.4201Z" stroke="#292D32" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M19.52 17.0999L16.74 15.1499V8.83989L19.52 6.88989C20.88 5.93989 22 6.51989 22 8.18989V15.8099C22 17.4799 20.88 18.0599 19.52 17.0999Z" stroke="#292D32" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M11.5 11C12.3284 11 13 10.3284 13 9.5C13 8.67157 12.3284 8 11.5 8C10.6716 8 10 8.67157 10 9.5C10 10.3284 10.6716 11 11.5 11Z" stroke="#292D32" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

package/assets/desktop_call/bundle.js

@@ -45764,6 +45764,14 @@ function summarizeDiagPayload(payload = {}) {
 function diagLog(label, payload = {}) {
   try {
     console.log(`[DesktopCallDiag] ${label} ${safeJsonStringify(payload)}`);
+    try {
+      postToWebHostBridge({
+        type: "diag",
+        label,
+        detail: payload
+      });
+    } catch (_) {
+    }
   } catch (error) {
     console.log(
       `[DesktopCallDiag] ${label} ${safeJsonStringify({
@@ -46334,6 +46342,30 @@ function safeJsonStringify(value) {
     return "{}";
   }
 }
+function resolveWebHostCallRequestId() {
+  try {
+    const parsed = JSON.parse(String(window.name || "{}"));
+    return safeString(parsed?.callRequestId);
+  } catch (_) {
+    return "";
+  }
+}
+function postToWebHostBridge(message) {
+  if (!window.parent || window.parent === window) {
+    return false;
+  }
+  const callRequestId = resolveWebHostCallRequestId();
+  if (!callRequestId) {
+    return false;
+  }
+  const payload = typeof message === "string" ? message : safeJsonStringify(message);
+  window.parent.postMessage({
+    channel: "jotmo-desktop-call",
+    callRequestId,
+    message: payload
+  }, window.location.origin);
+  return true;
+}
 function escapeHtml(value) {
   return safeString(value).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
 }
@@ -46443,9 +46475,11 @@ function postToFlutter(type, extra = {}) {
     message: safeString(extra.message)
   });
   const bridge = resolveFlutterBridge();
+  const postedToWebHost = postToWebHostBridge(payload);
   diagLog("post_to_flutter", {
     type,
     hasBridge: Boolean(bridge),
+    postedToWebHost,
     roomId: statePayload.roomId,
     callId: statePayload.callId,
     mediaType: statePayload.mediaType,
@@ -46455,12 +46489,52 @@ function postToFlutter(type, extra = {}) {
     connectionRole: state.connectionRole
   });
   if (!bridge) {
+    if (postedToWebHost) {
+      return true;
+    }
     console.warn("[DesktopCall] flutter bridge unavailable", payload);
     return false;
   }
   bridge.postMessage(payload);
   return true;
 }
+function postLocalTerminalToWebHost(type, message) {
+  const peer = getFlutterPeer();
+  const payload = safeJsonStringify({
+    type,
+    roomId: state.activeRoomId,
+    callId: state.activeCallId,
+    mediaType: state.activeMediaType,
+    statusText: safeString(message),
+    phase: CALL_PHASE.ending,
+    hasActiveCall: false,
+    audioEnabled: state.audioEnabled,
+    videoEnabled: state.videoEnabled,
+    speakerEnabled: state.speakerEnabled,
+    elapsedLabel: state.elapsedLabel,
+    caller: {
+      name: state.caller.name,
+      avatar: state.caller.avatar
+    },
+    peer: {
+      name: peer.name,
+      avatar: peer.avatar
+    },
+    userData: state.lastUserData,
+    reason: "local_hangup_hint",
+    message: safeString(message)
+  });
+  const posted = postToWebHostBridge(payload);
+  diagLog("local_terminal_web_host_hint", {
+    type,
+    posted,
+    roomId: state.activeRoomId,
+    callId: state.activeCallId,
+    mediaType: state.activeMediaType,
+    phase: state.phase
+  });
+  return posted;
+}
 function setStatusText(text) {
   state.lastStatusText = safeString(text);
 }
@@ -49191,8 +49265,22 @@ function markTerminalEmitted(payload = {}) {
   state.terminalBridgeKey = resolveCallSessionKey(payload);
 }
 async function finalizeTerminalState(type, payload = {}, statusText) {
+  diagLog("finalize_terminal_state_start", {
+    type,
+    payload: summarizeDiagPayload(payload),
+    statusText,
+    pendingLocalTerminalAction: state.pendingLocalTerminalAction,
+    terminalBridgeKey: state.terminalBridgeKey,
+    sessionKey: resolveCallSessionKey(payload)
+  });
   updateCallIdentity(payload);
   if (isTerminalAlreadyEmitted(payload)) {
+    diagLog("finalize_terminal_state_duplicate_skip", {
+      type,
+      payload: summarizeDiagPayload(payload),
+      terminalBridgeKey: state.terminalBridgeKey,
+      sessionKey: resolveCallSessionKey(payload)
+    });
     return;
   }
   markTerminalEmitted(payload);
@@ -49220,6 +49308,12 @@ async function finalizeTerminalState(type, payload = {}, statusText) {
   await cleanupActiveMedia();
   resetRuntimeState({ preserveBootstrap: true });
   render();
+  diagLog("finalize_terminal_state_done", {
+    type,
+    resolvedStatusText,
+    phase: state.phase,
+    terminalBridgeKey: state.terminalBridgeKey
+  });
 }
 async function attachRemoteView(userId) {
   const normalizedUserId = safeString(userId);
@@ -49696,13 +49790,18 @@ async function hangupCall() {
   if (!state.engine) {
     return;
   }
+  const engine = state.engine;
   state.pendingLocalTerminalAction = "hangup";
-  try {
-    await state.engine.hangup();
-  } catch (error) {
+  diagLog("hangup_call_start", captureRuntimeSnapshot({
+    pendingLocalTerminalAction: state.pendingLocalTerminalAction
+  }));
+  postLocalTerminalToWebHost("end", "\u901A\u8BDD\u5DF2\u7ED3\u675F");
+  void engine.hangup().catch(() => {
     state.pendingLocalTerminalAction = "";
-    throw error;
-  }
+    diagLog("hangup_call_engine_failed", captureRuntimeSnapshot());
+  });
+  await finalizeTerminalState("end", {}, "\u901A\u8BDD\u5DF2\u7ED3\u675F");
+  diagLog("hangup_call_done", captureRuntimeSnapshot());
 }
 async function requestToggleFullscreen() {
   state.activeDevicePopover = "";

package/assets/desktop_call/call-add-linear.svg

@@ -0,0 +1,13 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g id="Property 1=linear">
+<g id="vuesax/linear/call-add">
+<g id="call-add">
+<g id="call-add_2">
+<path id="Vector" d="M21.97 18.33C21.97 18.69 21.89 19.06 21.72 19.42C21.55 19.78 21.33 20.12 21.04 20.44C20.55 20.98 20.01 21.37 19.4 21.62C18.8 21.87 18.15 22 17.45 22C16.43 22 15.34 21.76 14.19 21.27C13.04 20.78 11.89 20.12 10.75 19.29C9.6 18.45 8.51 17.52 7.47 16.49C6.44 15.45 5.51 14.36 4.68 13.22C3.86 12.08 3.2 10.94 2.72 9.81C2.24 8.67 2 7.58 2 6.54C2 5.86 2.12 5.21 2.36 4.61C2.6 4 2.98 3.44 3.51 2.94C4.15 2.31 4.85 2 5.59 2C5.87 2 6.15 2.06 6.4 2.18C6.66 2.3 6.89 2.48 7.07 2.74L9.39 6.01C9.57 6.26 9.7 6.49 9.79 6.71C9.88 6.92 9.93 7.13 9.93 7.32C9.93 7.56 9.86 7.8 9.72 8.03C9.59 8.26 9.4 8.5 9.16 8.74L8.4 9.53C8.29 9.64 8.24 9.77 8.24 9.93C8.24 10.01 8.25 10.08 8.27 10.16C8.3 10.24 8.33 10.3 8.35 10.36C8.53 10.69 8.84 11.12 9.28 11.64C9.73 12.16 10.21 12.69 10.73 13.22C11.27 13.75 11.79 14.24 12.32 14.69C12.84 15.13 13.27 15.43 13.61 15.61C13.66 15.63 13.72 15.66 13.79 15.69C13.87 15.72 13.95 15.73 14.04 15.73C14.21 15.73 14.34 15.67 14.45 15.56L15.21 14.81C15.46 14.56 15.7 14.37 15.93 14.25C16.16 14.11 16.39 14.04 16.64 14.04C16.83 14.04 17.03 14.08 17.25 14.17C17.47 14.26 17.7 14.39 17.95 14.56L21.26 16.91C21.52 17.09 21.7 17.3 21.81 17.55C21.91 17.8 21.97 18.05 21.97 18.33Z" stroke="#292D32" stroke-width="1.5" stroke-miterlimit="10"/>
+<path id="Vector_2" d="M15.5 6H20.5" stroke="#292D32" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+<path id="Vector_3" d="M18 8.5V3.5" stroke="#292D32" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+</g>
+</g>
+</g>
+</g>
+</svg>

package/assets/desktop_call/icon-scan-add-contact.svg

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<svg width="800px" height="800px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path fill-rule="evenodd" clip-rule="evenodd" d="M5 8a1 1 0 0 1-2 0V5.923c0-.76.082-1.185.319-1.627.223-.419.558-.754.977-.977C4.738 3.082 5.162 3 5.923 3H8a1 1 0 0 1 0 2H5.923c-.459 0-.57.022-.684.082a.364.364 0 0 0-.157.157c-.06.113-.082.225-.082.684V8zm3 11a1 1 0 1 1 0 2H5.923c-.76 0-1.185-.082-1.627-.319a2.363 2.363 0 0 1-.977-.977C3.082 19.262 3 18.838 3 18.077V16a1 1 0 1 1 2 0v2.077c0 .459.022.57.082.684.038.07.087.12.157.157.113.06.225.082.684.082H8zm7-15a1 1 0 0 0 1 1h2.077c.459 0 .57.022.684.082.07.038.12.087.157.157.06.113.082.225.082.684V8a1 1 0 1 0 2 0V5.923c0-.76-.082-1.185-.319-1.627a2.363 2.363 0 0 0-.977-.977C19.262 3.082 18.838 3 18.077 3H16a1 1 0 0 0-1 1zm4 12a1 1 0 1 1 2 0v2.077c0 .76-.082 1.185-.319 1.627a2.364 2.364 0 0 1-.977.977c-.442.237-.866.319-1.627.319H16a1 1 0 1 1 0-2h2.077c.459 0 .57-.022.684-.082a.363.363 0 0 0 .157-.157c.06-.113.082-.225.082-.684V16zM3 11a1 1 0 1 0 0 2h18a1 1 0 1 0 0-2H3z" fill="#000000"/>
+</svg>

package/assets/desktop_call/index.html

@@ -24,10 +24,11 @@
         const listeners = [];
         window.JotmoDesktopCallBridge = {
           postMessage(message) {
+            const payload = typeof message === "string" ? message : JSON.stringify(message);
             parent.postMessage({
               channel: "jotmo-desktop-call",
               callRequestId: context.callRequestId,
-              message,
+              message: payload,
             }, location.origin);
           },
         };
@@ -65,7 +66,8 @@
           }
         };
         ["process", "global", "module", "require"].forEach(blockGlobal);
-        import("./bundle.js").catch((error) => {
+        const bundleUrl = `./bundle.js?callRequestId=${encodeURIComponent(context.callRequestId || "idle")}`;
+        import(bundleUrl).catch((error) => {
           window.__JOTMO_DESKTOP_CALL_HOST__.postFlutterMessage(JSON.stringify({
             type: "fatal_error",
             message: error instanceof Error ? error.message : "呼叫界面加载失败",

package/assets/desktop_call/manifest.json

@@ -4,7 +4,7 @@
   "callEnginePackage": "@trtc/call-engine-lite-js",
   "callEngineRange": "^3.5.9",
   "upstreamBundleSha256": "6ff59d3eb9ce4d7556ba4054bac0df22ae279a7bccc56ccbf5712b6f475c95ce",
-  "bundleSha256": "dadd84a0f617a80bd969ed144db356edc6a82a58b4490483d45006813ee03278",
+  "bundleSha256": "839e0376d8916472d99fe4b0cbcc39b165c3dc96ac00b31b15fb3910bcdf6917",
   "iconSha256": "583d7dbd34069c5b50ca294a071637bbd3beed913cecdb91a202c001004eed45",
   "outgoingOnly": true
 }

package/assets/desktop_call/profile-circle-linear.svg

@@ -0,0 +1,11 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g id="Property 1=linear">
+<g id="vuesax/linear/profile-circle">
+<g id="profile-circle">
+<path id="Vector" d="M12.12 12.78C12.05 12.77 11.96 12.77 11.88 12.78C10.12 12.72 8.71997 11.28 8.71997 9.50998C8.71997 7.69998 10.18 6.22998 12 6.22998C13.81 6.22998 15.28 7.69998 15.28 9.50998C15.27 11.28 13.88 12.72 12.12 12.78Z" stroke="#292D32" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+<path id="Vector_2" d="M18.74 19.38C16.96 21.01 14.6 22 12 22C9.40001 22 7.04001 21.01 5.26001 19.38C5.36001 18.44 5.96001 17.52 7.03001 16.8C9.77001 14.98 14.25 14.98 16.97 16.8C18.04 17.52 18.64 18.44 18.74 19.38Z" stroke="#292D32" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+<path id="Vector_3" d="M12 22C17.5228 22 22 17.5228 22 12C22 6.47715 17.5228 2 12 2C6.47715 2 2 6.47715 2 12C2 17.5228 6.47715 22 12 22Z" stroke="#292D32" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+</g>
+</g>
+</g>
+</svg>

package/assets/desktop_call/user-add-linear.svg

@@ -0,0 +1,15 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g id="Property 1=linear">
+<g id="vuesax/linear/user-add">
+<g id="user-add">
+<path id="Vector" d="M12 12C14.7614 12 17 9.76142 17 7C17 4.23858 14.7614 2 12 2C9.23858 2 7 4.23858 7 7C7 9.76142 9.23858 12 12 12Z" stroke="#292D32" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+<path id="Vector_2" d="M3.41003 22C3.41003 18.13 7.26003 15 12 15C12.96 15 13.89 15.13 14.76 15.37" stroke="#292D32" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+<path id="Vector_3" d="M22 18C22 18.32 21.96 18.63 21.88 18.93C21.79 19.33 21.63 19.72 21.42 20.06C20.73 21.22 19.46 22 18 22C16.97 22 16.04 21.61 15.34 20.97C15.04 20.71 14.78 20.4 14.58 20.06C14.21 19.46 14 18.75 14 18C14 16.92 14.43 15.93 15.13 15.21C15.86 14.46 16.88 14 18 14C19.18 14 20.25 14.51 20.97 15.33C21.61 16.04 22 16.98 22 18Z" stroke="#292D32" stroke-width="1.5" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<g id="Group">
+<path id="Vector_4" d="M19.49 17.98H16.51" stroke="#292D32" stroke-width="1.5" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+<path id="Vector_5" d="M18 16.52V19.51" stroke="#292D32" stroke-width="1.5" stroke-miterlimit="10" stroke-linecap="round" stroke-linejoin="round"/>
+</g>
+</g>
+</g>
+</g>
+</svg>

package/assets/windows/manifest.json

@@ -0,0 +1,9 @@
+{
+  "schemaVersion": 1,
+  "platform": "win32",
+  "arch": "x64",
+  "file": "arkme-credential-helper.exe",
+  "sha256": "8b598f3f4facb0c785c3fbc29ccddb75a08e90528ba02a55fc6c996442ec4a16",
+  "sourceSha256": "7e2267aa232d4fbe785d2ab88bd707ab6edacd88bd454fda7f8017ddfc0335b6",
+  "goVersion": "go version go1.25.5 darwin/arm64"
+}

package/cordis.patch.yml

@@ -6,6 +6,7 @@
         authBaseUrl: https://api.jotmo.cc
         subjectBaseUrl: https://subject.jotmo.cc
         recordBaseUrl: https://record.jotmo.cc
+        dataBaseUrl: https://data.jotmo.cc
         chatBaseUrl: https://chat.jotmo.cc
         botBaseUrl: https://bot.jotmo.cc
         imBaseUrl: https://im.jotmo.cc
@@ -25,6 +26,7 @@
         relatedRecordingsEnabled: true
         geetestCaptchaId: ec81315ab8b0f18a7bfa13602d01e307
         interwovenMomentsEnabled: true
+        chatMemberJoinEventsEnabled: true
         allowNonLoopback: false
         allowProduction: true
         updateCheckEnabled: true

package/docs/consumer-plugin-contract.md

@@ -2,7 +2,7 @@
 
 `@senguoyun/dsh-arkme` owns authentication, OS credential-store access, SQLite caching, account isolation, remote synchronization, and retry semantics. A generated Consumer plugin owns only presentation and user interaction.
 
-The bundled UI uses only official DSH slots: `sidebar.footer.action` owns the launcher, inline Arkme directory, and a non-modal translucent React portal that floats the Arkme message surface over the center column; `settings.general.item` owns account controls. The plugin never registers or replaces `conversation`, so the native DSH Conversation remains mounted and remains perceptible through and around the frosted card. Consumers must not depend on private `sidebar.workspaces.virtual` or `main.surface` extensions.
+The bundled UI uses only official DSH slots. `sidebar`, `conversation`, and `details` compose the resident Arkme product shell; `settings.section` owns the single `arkme-account` section inside native DSH Settings; `shell.overlay` owns lifecycle dialogs. DSH owns Settings chrome, ordering, and scrolling, while `ArkmeSettingsSurface` owns only Arkme account content and actions. Consumers must not depend on private `sidebar.workspaces.virtual` or `main.surface` extensions.
 
 ## Browser SDK
 
@@ -91,6 +91,8 @@ Plugin update discovery and acknowledgement are lifecycle concerns owned by the
 
 `capabilities().features.outgoingCall` reports whether the Provider's bundled private-chat outgoing-call flow is installed. Contract v1 does not expose a Browser SDK method for starting or preparing calls: short-lived UserSig, room bootstrap data, raw user IDs, and WebRTC account values stay inside the built-in Host/runtime path. Consumers must not invoke raw `calls.outgoing.*` operations or recreate a credential-bearing call API.
 
+`capabilities().features.callHistory === true` advertises Browser-safe call-history access. `callHistory()` returns recent call records with opaque account-scoped `callRef` values, display metadata, result labels, summary status and summary previews. `callDetail(callRef)` accepts only an unchanged `callRef` from the Provider and returns safe metadata, participants, summary and transcript text. `retryCallSummary(callRef)` is a write-like operation and must only run from a current explicit human request to retry or regenerate that call summary. Consumers must never expect or reconstruct raw room IDs, WebRTC credentials, recording URLs, video URLs, signed media URLs or upstream tokens from this contract.
+
 `profile()` exposes only UI-safe fields: display name, nickname, avatar reference, Arkme ID, optional one-time Arkme ID change availability, account type, creation time, binding flags, and masked phone/email. Raw phone, raw email, real name, and credentials are intentionally excluded from contract v1. The model-facing `arkme_id_set` tool owns the one-time write workflow; the Browser SDK does not expose a profile mutation method.
 
 `readImage(avatarRef)` resolves an opaque image reference returned by `profile()` or `listSources()`. Private chats expose one optional `avatarRef`. Groups expose the preferred additive `groupAvatar` presentation plus legacy `avatarRefs`: `groupAvatar.slots` preserves the server-selected order for up to five members, including safe phone-default or generic fallbacks when a real image is absent, while legacy `avatarRefs` contains only resolvable real images. `memberCount`, `strategy`, and `computedAtMillis` describe the snapshot without exposing member or session identities. The Provider refreshes an authorized public profile image before downloading it and returns bounded PNG/JPEG/WebP/GIF base64 bytes; signed URLs, STS credentials and bearer tokens never enter the browser contract. Consumers must use `imageDataUrl()` (or decode the payload themselves) instead of concatenating OSS URLs or fetching an avatar reference directly.

package/docs/plugin-release.md

@@ -0,0 +1,23 @@
+# 插件自动发版
+
+日常功能分支不修改 `package.json.version` 或 `arkme.updateNotice`。功能合并到 `master` 后，由发版负责人在 GitHub 的 **Actions → 准备插件发版 → Run workflow** 中选择发版级别并填写一句更新说明。
+
+该工作流会自动创建 `release/v<版本号>` 发版 PR，并在其中更新版本号、插件内更新说明和 GitHub Release 链接，随后执行完整测试、类型检查和构建。
+
+合并该发版 PR 后，发布工作流会再次验证代码，发布 npm 包、创建 `v<版本号>` Git Tag，并生成 GitHub Release。
+
+## 一次性配置
+
+在 npm 包 `@senguoyun/dsh-arkme` 的发布设置中创建 GitHub Trusted Publisher，绑定：
+
+- GitHub Organization：`arkme-senx`
+- Repository：`arkme-dsh-plugin`
+- Workflow：`publish-plugin-release.yml`
+
+Trusted Publisher 配置完成后，GitHub Actions 通过短期身份凭据发布 npm，不需要把 npm Token 保存到 GitHub Secrets。
+
+## 版本选择
+
+- `patch`：修复和小优化，如 `0.1.19 → 0.1.20`。
+- `minor`：新增一组用户可见能力，如 `0.1.19 → 0.2.0`。
+- `major`：存在不兼容变更时使用。