dsh-budget 0.4.3 → 0.4.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/CHANGELOG.md +18 -0
  2. package/README.es.md +9 -5
  3. package/README.hi.md +9 -5
  4. package/README.md +8 -4
  5. package/README.pt.md +9 -5
  6. package/README.zh.md +9 -5
  7. package/package.json +29 -29
package/CHANGELOG.md CHANGED
@@ -5,6 +5,24 @@ All notable changes to this project are documented in this file.
5
5
  The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
6
6
  and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
7
 
8
+ ## [0.4.5] - 2026-09-07
9
+
10
+ ### Fixed
11
+
12
+ - Align the `@deepseek-ai/dsh-*` peer ranges to `>=0.1.2-rc.1 <0.2.0`: the older `>=0.1.0-rc.8 <0.2.0` band resolved to only the `0.1.0-rc.8` prerelease under registry-driven resolution and broke fresh tarball installs; no behavior change.
13
+
14
+ ### Docs
15
+
16
+ - Refresh the five-language README support-version wording: the verified GitHub tag `dsh-v0.1.3-alpha.1` now leads the compatibility claim, while npm `0.1.2-rc.1` stays the published dependency-pin line (peers `>=0.1.2-rc.1 <0.2.0`); no behavior change.
17
+
18
+
19
+ ## [0.4.4] - 2026-09-04
20
+
21
+ ### Changed
22
+
23
+ - Align the devDependency pins to the published dsh `0.1.2-rc.1` line (14 `@deepseek-ai/dsh-*` packages) and the `dshWorkshop` compatibility list; the compat CI probes and the `typecheck:ci` step label move from `0.1.1-rc.2` to `0.1.2-rc.1`. Peer ranges stay unchanged; the audit-event suppression keeps applying on `0.1.2-rc.1` (`Session.append` still cannot stamp the `ignorable` marker). No behavior change.
24
+ - The assembly test fixture carries the v2 `assistant/message` `stream` field so the checkout-ruler `typecheck` (paths against dsh 0.1.3-alpha.1, where the field is mandatory) and the published-ruler `typecheck:ci` both pass; test-only, no behavior change.
25
+
8
26
  ## [0.4.3] - 2026-09-02
9
27
 
10
28
  ### Docs
package/README.es.md CHANGED
@@ -25,9 +25,9 @@
25
25
 
26
26
  | Superficie | Estado |
27
27
  |---|---|
28
- | Harness | DeepSeek Harness `0.1.2-alpha.5` (adaptado el 2026-09-02): el sobre de sesión conserva su campo ignorable solo para compatibilidad de lectura de logs almacenados - Session.append aún no puede estamparlo, por lo que el comportamiento de la puerta no cambia. |
28
+ | Harness | DeepSeek Harness `dsh-v0.1.3-alpha.1` (GitHub tag, verificado el 2026-09-06; pin de npm `0.1.2-rc.1` adaptado el 2026-09-02; rango de peer `>=0.1.2-rc.1 <0.2.0`): el sobre de sesión conserva su campo ignorable solo para compatibilidad de lectura de logs almacenados - Session.append aún no puede estamparlo, por lo que el comportamiento de la puerta no cambia. Verificado el 2026-09-06 contra el master checkout dsh-v0.1.3-alpha.1 (cadena completa de puertas + smoke de instalación de perfil). |
29
29
 
30
- | Eventos de auditoría | Se escriben en harness anteriores a `0.1.2-alpha.5`; se suprimen con una razón de degradación registrada en `0.1.2-alpha.5` y posteriores (vocabulario de eventos de sesión fail-closed, sin superficie de registro externa) || Node | `^22.19.0 \|\| >=24.0.0` |
30
+ | Eventos de auditoría | Se escriben en harness anteriores a `0.1.2-rc.1`; se suprimen con una razón de degradación registrada en `0.1.2-rc.1` y posteriores (vocabulario de eventos de sesión fail-closed, sin superficie de registro externa) || Node | `^22.19.0 \|\| >=24.0.0` |
31
31
  | Superficies | Host + cliente Web (pestaña Budget en Settings); comando `/budget` |
32
32
 
33
33
  ## Qué obtienes
@@ -102,7 +102,7 @@ Todos los ajustes son campos `Config` de Schemastery (modificables desde cordis.
102
102
 
103
103
  - **Permisos**: `network:outbound` (solo el webhook de alerta opcional), `session:append` (eventos de auditoría), `native-code:none`.
104
104
  - **Datos**: todo lo mostrado proviene del flujo de eventos de sesión; la única llamada de red es el webhook configurado, validado al cargar y sin credenciales en los registros. Ningún prompt o payload sale del host.
105
- - **Registro de sesión**: `budget/alert` y `budget/block` son eventos de auditoría solo-registro con nombres de ámbito e importes USD (diferidos por microtarea ante el guard de reentrada de append). En harness `0.1.2-alpha.5` y posteriores no se escriben — el vocabulario de eventos fail-closed rechaza logs con tipos de evento no registrados y no ofrece superficie de registro externa — así que el rastro de auditoría se degrada al logger de presupuesto y al webhook únicamente.
105
+ - **Registro de sesión**: `budget/alert` y `budget/block` son eventos de auditoría solo-registro con nombres de ámbito e importes USD (diferidos por microtarea ante el guard de reentrada de append). En harness `0.1.2-rc.1` y posteriores no se escriben — el vocabulario de eventos fail-closed rechaza logs con tipos de evento no registrados y no ofrece superficie de registro externa — así que el rastro de auditoría se degrada al logger de presupuesto y al webhook únicamente.
106
106
 
107
107
  ## Límites de seguridad
108
108
 
@@ -122,7 +122,7 @@ Todos los ajustes son campos `Config` de Schemastery (modificables desde cordis.
122
122
  ```sh
123
123
  pnpm install # node ^22.19 || >=24
124
124
  pnpm run typecheck # tsc: src + tests contra el checkout local del harness
125
- pnpm run typecheck:ci # tsc contra los tipos publicados 0.1.2-alpha.5 (sin paths)
125
+ pnpm run typecheck:ci # tsc contra los tipos publicados 0.1.2-rc.1 (sin paths)
126
126
  pnpm test # vitest
127
127
  pnpm run build # declaraciones tsc + bundles tsdown (lib/)
128
128
  pnpm run verify:self-contained # las especificaciones de dependencias resuelven desde el registry
@@ -179,4 +179,8 @@ Este proyecto es uno de los [33 complementos de DeepSeek Harness](https://github
179
179
 
180
180
  ## License
181
181
 
182
- [Apache License 2.0](LICENSE) © 2026 dsh-budget contributors
182
+ [Apache License 2.0](LICENSE) © 2026 dsh-budget contributors
183
+
184
+ ### Instalar desde el mercado de DSH Desktop
185
+
186
+ Todos los plugins de PerryLink pueden explorarse en el mercado integrado de DSH Desktop: **Market → Sources → add source → pegar** `https://perrylink-dsh-catalog.perrylink.workers.dev/catalog-source.json` **→ seleccionarlo**. La instalación sigue pasando por la verificación de identidad npm del mercado y tu confirmación.
package/README.hi.md CHANGED
@@ -25,9 +25,9 @@
25
25
 
26
26
  | सतह | स्थिति |
27
27
  |---|---|
28
- | Harness | DeepSeek Harness `0.1.2-alpha.5` (2026-09-02 को अनुकूलित): सत्र लिफ़ाफ़ा अपना ignorable फ़ील्ड केवल संग्रहीत-लॉग पठन संगतता के लिए रखता है - Session.append अभी भी इसे स्टैम्प नहीं कर सकता, इसलिए गेट व्यवहार अपरिवर्तित है। |
28
+ | Harness | DeepSeek Harness `dsh-v0.1.3-alpha.1` (GitHub tag, 2026-09-06 को सत्यापित; npm pin `0.1.2-rc.1` 2026-09-02 को अनुकूलित; peer रेंज `>=0.1.2-rc.1 <0.2.0`): सत्र लिफ़ाफ़ा अपना ignorable फ़ील्ड केवल संग्रहीत-लॉग पठन संगतता के लिए रखता है - Session.append अभी भी इसे स्टैम्प नहीं कर सकता, इसलिए गेट व्यवहार अपरिवर्तित है। 2026-09-06 को dsh-v0.1.3-alpha.1 master checkout के विरुद्ध सत्यापित (पूर्ण गेट श्रृंखला + प्रोफ़ाइल इंस्टॉल स्मोक)। |
29
29
 
30
- | ऑडिट इवेंट | `0.1.2-alpha.5` से पहले के harness पर लिखे जाते हैं; `0.1.2-alpha.5` और बाद में दबाए जाते हैं और डिग्रेडेशन कारण लॉग होता है (fail-closed सत्र इवेंट शब्दावली, कोई बाहरी पंजीकरण सतह नहीं) || Node | `^22.19.0 \|\| >=24.0.0` |
30
+ | ऑडिट इवेंट | `0.1.2-rc.1` से पहले के harness पर लिखे जाते हैं; `0.1.2-rc.1` और बाद में दबाए जाते हैं और डिग्रेडेशन कारण लॉग होता है (fail-closed सत्र इवेंट शब्दावली, कोई बाहरी पंजीकरण सतह नहीं) || Node | `^22.19.0 \|\| >=24.0.0` |
31
31
  | सतहें | Host + वेब क्लाइंट (Settings में Budget टैब); `/budget` कमांड |
32
32
 
33
33
  ## आपको क्या मिलता है
@@ -102,7 +102,7 @@ dsh --profile web --dump-config | grep -A2 'id: budget'
102
102
 
103
103
  - **अनुमतियाँ**: `network:outbound` (केवल वैकल्पिक अलर्ट वेबहुक), `session:append` (ऑडिट इवेंट), `native-code:none`।
104
104
  - **डेटा**: दिखाई गई हर चीज़ सत्र इवेंट स्ट्रीम से आती है; होस्ट की एकमात्र नेटवर्क कॉल कॉन्फ़िगर किया वेबहुक है, जिसका URL लोड पर सत्यापित होता है और लॉग से पहले क्रेडेंशियल-रहित किया जाता है। कोई prompt या payload होस्ट से बाहर नहीं जाता।
105
- - **सत्र लॉग**: `budget/alert` और `budget/block` केवल-लॉग ऑडिट इवेंट हैं जिनमें स्कोप नाम और USD राशियाँ होती हैं (session-append पुनर्प्रवेश गार्ड से बचने हेतु माइक्रोटास्क-विलंबित)। `0.1.2-alpha.5` और बाद के harness पर ये नहीं लिखे जाते — fail-closed इवेंट शब्दावली अपंजीकृत इवेंट प्रकार वाले लॉग को अस्वीकार करती है और कोई बाहरी पंजीकरण सतह नहीं देती — इसलिए ऑडिट ट्रेल केवल बजट लॉगर और webhook तक सीमित रहता है।
105
+ - **सत्र लॉग**: `budget/alert` और `budget/block` केवल-लॉग ऑडिट इवेंट हैं जिनमें स्कोप नाम और USD राशियाँ होती हैं (session-append पुनर्प्रवेश गार्ड से बचने हेतु माइक्रोटास्क-विलंबित)। `0.1.2-rc.1` और बाद के harness पर ये नहीं लिखे जाते — fail-closed इवेंट शब्दावली अपंजीकृत इवेंट प्रकार वाले लॉग को अस्वीकार करती है और कोई बाहरी पंजीकरण सतह नहीं देती — इसलिए ऑडिट ट्रेल केवल बजट लॉगर और webhook तक सीमित रहता है।
106
106
 
107
107
  ## सुरक्षा सीमाएँ
108
108
 
@@ -122,7 +122,7 @@ dsh --profile web --dump-config | grep -A2 'id: budget'
122
122
  ```sh
123
123
  pnpm install # node ^22.19 || >=24
124
124
  pnpm run typecheck # tsc: src + tests स्थानीय हार्नेस चेकआउट के विरुद्ध
125
- pnpm run typecheck:ci # tsc प्रकाशित 0.1.2-alpha.5 प्रकारों के विरुद्ध (बिना paths)
125
+ pnpm run typecheck:ci # tsc प्रकाशित 0.1.2-rc.1 प्रकारों के विरुद्ध (बिना paths)
126
126
  pnpm test # vitest
127
127
  pnpm run build # tsc घोषणाएँ + tsdown बंडल (lib/)
128
128
  pnpm run verify:self-contained # निर्भरता स्पेक registry से हल होती हैं
@@ -179,4 +179,8 @@ pnpm pack # प्रकाशित tarball
179
179
 
180
180
  ## License
181
181
 
182
- [Apache License 2.0](LICENSE) © 2026 dsh-budget contributors
182
+ [Apache License 2.0](LICENSE) © 2026 dsh-budget contributors
183
+
184
+ ### DSH Desktop मार्केट से इंस्टॉल करें
185
+
186
+ सभी PerryLink प्लगइन DSH Desktop के बिल्ट-इन मार्केट में देखे जा सकते हैं: **Market → Sources → add source → पेस्ट करें** `https://perrylink-dsh-catalog.perrylink.workers.dev/catalog-source.json` **→ चुनें**। इंस्टॉलेशन मार्केट के npm-identity सत्यापन और आपकी पुष्टि से ही होता है।
package/README.md CHANGED
@@ -28,9 +28,9 @@
28
28
 
29
29
  | Surface | Status |
30
30
  |---|---|
31
- | Harness | DeepSeek Harness `0.1.2-alpha.5` (adapted 2026-09-02): the session envelope keeps its ignorable field for stored-log read compatibility only - Session.append still cannot stamp it, so audit-gate behavior is unchanged. |
31
+ | Harness | DeepSeek Harness `dsh-v0.1.3-alpha.1` (GitHub tag, verified 2026-09-06; npm pin `0.1.2-rc.1` adapted 2026-09-02; peer range `>=0.1.2-rc.1 <0.2.0`): the session envelope keeps its ignorable field for stored-log read compatibility only - Session.append still cannot stamp it, so audit-gate behavior is unchanged. Verified 2026-09-06 against the dsh-v0.1.3-alpha.1 master checkout (full gate chain + profile install smoke). |
32
32
 
33
- | Audit events | Written on harnesses before `0.1.2-alpha.5`; suppressed with a logged degradation reason on `0.1.2-alpha.5` and later (fail-closed session event vocabulary, no external registration surface) || Node | `^22.19.0 \|\| >=24.0.0` |
33
+ | Audit events | Written on harnesses before `0.1.2-rc.1`; suppressed with a logged degradation reason on `0.1.2-rc.1` and later (fail-closed session event vocabulary, no external registration surface) || Node | `^22.19.0 \|\| >=24.0.0` |
34
34
  | Surfaces | Host + Web client (Settings budget tab); `/budget` command |
35
35
 
36
36
  ## What you get
@@ -105,7 +105,7 @@ All tunables are Schemastery `Config` fields (changeable from cordis.yml). `cord
105
105
 
106
106
  - **Permissions**: `network:outbound` (the optional alert webhook only), `session:append` (audit events), `native-code:none`.
107
107
  - **Data**: everything displayed comes from the session event stream; the only host-side network call is the configured webhook, whose URL is validated at load and credential-stripped before any log. No prompts or payloads ever leave the host.
108
- - **Session log**: `budget/alert` and `budget/block` are log-only audit events carrying scope names and USD amounts (microtask-deferred past the session-append reentrancy guard). On harnesses `0.1.2-alpha.5` and later they are not written — the fail-closed event vocabulary rejects logs with unregistered event types and offers no external registration surface — so the audit trail degrades to the budget logger and webhook only.
108
+ - **Session log**: `budget/alert` and `budget/block` are log-only audit events carrying scope names and USD amounts (microtask-deferred past the session-append reentrancy guard). On harnesses `0.1.2-rc.1` and later they are not written — the fail-closed event vocabulary rejects logs with unregistered event types and offers no external registration surface — so the audit trail degrades to the budget logger and webhook only.
109
109
 
110
110
  ## Security boundaries
111
111
 
@@ -125,7 +125,7 @@ All tunables are Schemastery `Config` fields (changeable from cordis.yml). `cord
125
125
  ```sh
126
126
  pnpm install # node ^22.19 || >=24
127
127
  pnpm run typecheck # tsc: src + tests against the local harness checkout
128
- pnpm run typecheck:ci # tsc against the published 0.1.2-alpha.5 types (no paths)
128
+ pnpm run typecheck:ci # tsc against the published 0.1.2-rc.1 types (no paths)
129
129
  pnpm test # vitest
130
130
  pnpm run build # tsc declarations + tsdown bundles (lib/)
131
131
  pnpm run verify:self-contained # dependency specs resolve from the registry
@@ -180,6 +180,10 @@ This project is one of the [33 DeepSeek Harness plugins](https://github.com/Perr
180
180
  | **[dsh-dsh-test-drive](https://github.com/PerryLink/dsh-dsh-test-drive)** | Isolated install-and-smoke test drives for DeepSeek Harness plugins. | |
181
181
  | **[dsh-dsh-translate](https://github.com/PerryLink/dsh-dsh-translate)** | Vendor parameter translation and deterministic JSON repair for DeepSeek Harness. | |
182
182
 
183
+ ### Install from the DSH Desktop Market
184
+
185
+ All PerryLink plugins are browsable in the built-in DSH Desktop Market: **Market → Sources → add source → paste** `https://perrylink-dsh-catalog.perrylink.workers.dev/catalog-source.json` **→ select it**. Installation still goes through the Market's npm-identity verification and your confirmation.
186
+
183
187
  ## License
184
188
 
185
189
  [Apache License 2.0](LICENSE) © 2026 dsh-budget contributors
package/README.pt.md CHANGED
@@ -25,9 +25,9 @@
25
25
 
26
26
  | Superfície | Status |
27
27
  |---|---|
28
- | Harness | DeepSeek Harness `0.1.2-alpha.5` (adaptado em 2026-09-02): o envelope de sessão mantém seu campo ignorable apenas para compatibilidade de leitura de logs armazenados - o Session.append ainda não consegue estampá-lo, então o comportamento da porta não muda. |
28
+ | Harness | DeepSeek Harness `dsh-v0.1.3-alpha.1` (GitHub tag, verificado em 2026-09-06; pin npm `0.1.2-rc.1` adaptado em 2026-09-02; faixa de peer `>=0.1.2-rc.1 <0.2.0`): o envelope de sessão mantém seu campo ignorable apenas para compatibilidade de leitura de logs armazenados - o Session.append ainda não consegue estampá-lo, então o comportamento da porta não muda. Verificado em 2026-09-06 contra o checkout master dsh-v0.1.3-alpha.1 (cadeia completa de portas + smoke de instalação de perfil). |
29
29
 
30
- | Eventos de auditoria | Gravados em harness anteriores a `0.1.2-alpha.5`; suprimidos com uma razão de degradação registrada em `0.1.2-alpha.5` e posteriores (vocabulário de eventos de sessão fail-closed, sem superfície de registro externa) || Node | `^22.19.0 \|\| >=24.0.0` |
30
+ | Eventos de auditoria | Gravados em harness anteriores a `0.1.2-rc.1`; suprimidos com uma razão de degradação registrada em `0.1.2-rc.1` e posteriores (vocabulário de eventos de sessão fail-closed, sem superfície de registro externa) || Node | `^22.19.0 \|\| >=24.0.0` |
31
31
  | Superfícies | Host + cliente Web (aba Budget em Settings); comando `/budget` |
32
32
 
33
33
  ## O que você ganha
@@ -102,7 +102,7 @@ Todos os ajustes são campos `Config` do Schemastery (alteráveis pelo cordis.ym
102
102
 
103
103
  - **Permissões**: `network:outbound` (apenas o webhook de alerta opcional), `session:append` (eventos de auditoria), `native-code:none`.
104
104
  - **Dados**: tudo exibido vem do fluxo de eventos da sessão; a única chamada de rede é o webhook configurado, validado ao carregar e sem credenciais nos registros. Nenhum prompt ou payload sai do host.
105
- - **Registro de sessão**: `budget/alert` e `budget/block` são eventos de auditoria somente-registro com nomes de escopo e valores USD (adiados por microtarefa ante o guard de reentrância do append). Em harness `0.1.2-alpha.5` e posteriores eles não são gravados — o vocabulário de eventos fail-closed rejeita logs com tipos de evento não registrados e não oferece superfície de registro externa — então o rastro de auditoria degrada apenas para o logger de orçamento e o webhook.
105
+ - **Registro de sessão**: `budget/alert` e `budget/block` são eventos de auditoria somente-registro com nomes de escopo e valores USD (adiados por microtarefa ante o guard de reentrância do append). Em harness `0.1.2-rc.1` e posteriores eles não são gravados — o vocabulário de eventos fail-closed rejeita logs com tipos de evento não registrados e não oferece superfície de registro externa — então o rastro de auditoria degrada apenas para o logger de orçamento e o webhook.
106
106
 
107
107
  ## Limites de segurança
108
108
 
@@ -122,7 +122,7 @@ Todos os ajustes são campos `Config` do Schemastery (alteráveis pelo cordis.ym
122
122
  ```sh
123
123
  pnpm install # node ^22.19 || >=24
124
124
  pnpm run typecheck # tsc: src + tests contra o checkout local do harness
125
- pnpm run typecheck:ci # tsc contra os tipos publicados 0.1.2-alpha.5 (sem paths)
125
+ pnpm run typecheck:ci # tsc contra os tipos publicados 0.1.2-rc.1 (sem paths)
126
126
  pnpm test # vitest
127
127
  pnpm run build # declarações tsc + bundles tsdown (lib/)
128
128
  pnpm run verify:self-contained # especificações de dependências resolvem pelo registry
@@ -179,4 +179,8 @@ Este projeto é um dos [33 plugins de DeepSeek Harness](https://github.com/Perry
179
179
 
180
180
  ## License
181
181
 
182
- [Apache License 2.0](LICENSE) © 2026 dsh-budget contributors
182
+ [Apache License 2.0](LICENSE) © 2026 dsh-budget contributors
183
+
184
+ ### Instalar a partir do mercado do DSH Desktop
185
+
186
+ Todos os plugins PerryLink podem ser explorados no mercado integrado do DSH Desktop: **Market → Sources → add source → colar** `https://perrylink-dsh-catalog.perrylink.workers.dev/catalog-source.json` **→ selecionar**. A instalação continua passando pela verificação de identidade npm do mercado e pela sua confirmação.
package/README.zh.md CHANGED
@@ -27,9 +27,9 @@
27
27
 
28
28
  | 方面 | 状态 |
29
29
  |---|---|
30
- | Harness | DeepSeek Harness `0.1.2-alpha.5`（2026-09-02 已适配）：会话信封保留 ignorable 字段但仅用于存量日志读取兼容——Session.append 仍无法盖章，门控行为不变。 |
30
+ | Harness | DeepSeek Harness `dsh-v0.1.3-alpha.1`（GitHub tag，2026-09-06 核验；npm 钉号 `0.1.2-rc.1`，2026-09-02 已适配；peer 范围 `>=0.1.2-rc.1 <0.2.0`）：会话信封保留 ignorable 字段但仅用于存量日志读取兼容——Session.append 仍无法盖章，门控行为不变。已于 2026-09-06 对照 dsh-v0.1.3-alpha.1 master 检出核验（完整门禁链 + profile 安装冒烟）。 |
31
31
 
32
- | 审计事件 | `0.1.2-alpha.5` 之前的宿主上写入；在 `0.1.2-alpha.5` 及以后抑制并记录降级原因（fail-closed 会话事件词表，无外部注册面） || Node | `^22.19.0 \|\| >=24.0.0` |
32
+ | 审计事件 | `0.1.2-rc.1` 之前的宿主上写入；在 `0.1.2-rc.1` 及以后抑制并记录降级原因（fail-closed 会话事件词表，无外部注册面） || Node | `^22.19.0 \|\| >=24.0.0` |
33
33
  | 界面 | Host + Web 客户端（设置页预算页签）；`/budget` 命令 |
34
34
 
35
35
  ## 你能得到什么
@@ -104,7 +104,7 @@ dsh --profile web --dump-config | grep -A2 'id: budget'
104
104
 
105
105
  - **权限**：`network:outbound`（仅可选告警 webhook）、`session:append`（审计事件）、`native-code:none`。
106
106
  - **数据**：展示内容全部来自会话事件流；主机侧唯一网络调用是配置的 webhook，URL 在加载时校验、入日志前剥离凭据。任何 prompt/载荷都不会离开主机。
107
- - **会话日志**：`budget/alert` 与 `budget/block` 是仅日志审计事件，只携带作用域名与 USD 金额（微任务延后以绕过会话 append 重入保护）。在 `0.1.2-alpha.5` 及以后的宿主上不再写入——fail-closed 事件词表会拒绝含未注册事件类型的日志，且没有外部注册面——审计轨迹因此仅降级到预算日志与 webhook。
107
+ - **会话日志**：`budget/alert` 与 `budget/block` 是仅日志审计事件，只携带作用域名与 USD 金额（微任务延后以绕过会话 append 重入保护）。在 `0.1.2-rc.1` 及以后的宿主上不再写入——fail-closed 事件词表会拒绝含未注册事件类型的日志，且没有外部注册面——审计轨迹因此仅降级到预算日志与 webhook。
108
108
 
109
109
  ## 安全边界
110
110
 
@@ -124,7 +124,7 @@ dsh --profile web --dump-config | grep -A2 'id: budget'
124
124
  ```sh
125
125
  pnpm install # node ^22.19 || >=24
126
126
  pnpm run typecheck # tsc：src + tests，对照本地 harness checkout
127
- pnpm run typecheck:ci # tsc：对照已发布的 0.1.2-alpha.5 类型（无 paths）
127
+ pnpm run typecheck:ci # tsc：对照已发布的 0.1.2-rc.1 类型（无 paths）
128
128
  pnpm test # vitest
129
129
  pnpm run build # tsc 声明 + tsdown bundles（lib/）
130
130
  pnpm run verify:self-contained # 依赖声明全部来自 registry
@@ -181,4 +181,8 @@ pnpm pack # 发布用 tarball
181
181
 
182
182
  ## License
183
183
 
184
- [Apache License 2.0](LICENSE) © 2026 dsh-budget contributors
184
+ [Apache License 2.0](LICENSE) © 2026 dsh-budget contributors
185
+
186
+ ### 从 DSH Desktop 市场安装
187
+
188
+ 所有 PerryLink 插件均可在 DSH Desktop 内置市场中浏览：**市场 → 来源 → 添加来源 → 粘贴** `https://perrylink-dsh-catalog.perrylink.workers.dev/catalog-source.json` **→ 选中**。安装仍需通过市场的 npm 身份校验与你的确认。
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "dsh-budget",
3
- "version": "0.4.3",
3
+ "version": "0.4.5",
4
4
  "description": "Cost governance for DeepSeek Harness: aggregated token/cost metering per model, session and day, session/daily/monthly budget caps with threshold alerts (desktop notification + webhook) and alert/block/degrade over-limit policies, built-in carbon footprint estimation and per-model latency benchmarks, a Settings budget tab, and the /budget command",
5
5
  "repository": {
6
6
  "type": "git",
@@ -80,7 +80,7 @@
80
80
  ],
81
81
  "compatibility": {
82
82
  "dshVersions": [
83
- "0.1.2-alpha.5"
83
+ "0.1.2-rc.1"
84
84
  ]
85
85
  },
86
86
  "capability": {
@@ -114,18 +114,18 @@
114
114
  "packageManager": "pnpm@11.7.0",
115
115
  "peerDependencies": {
116
116
  "@deepseek-ai/cordis": "^4.0.2",
117
- "@deepseek-ai/dsh-agent": ">=0.1.0-rc.8 <0.2.0",
118
- "@deepseek-ai/dsh-commands": ">=0.1.0-rc.8 <0.2.0",
119
- "@deepseek-ai/dsh-llm": ">=0.1.0-rc.8 <0.2.0",
120
- "@deepseek-ai/dsh-session": ">=0.1.0-rc.8 <0.2.0",
121
- "@deepseek-ai/dsh-storage-domain": ">=0.1.0-rc.8 <0.2.0",
122
- "@deepseek-ai/dsh-token-meter": ">=0.1.0-rc.8 <0.2.0",
123
- "@deepseek-ai/dsh-tools": ">=0.1.0-rc.8 <0.2.0",
124
- "@deepseek-ai/dsh-typert-protocol": ">=0.1.0-rc.8 <0.2.0",
117
+ "@deepseek-ai/dsh-agent": ">=0.1.2-rc.1 <0.2.0",
118
+ "@deepseek-ai/dsh-commands": ">=0.1.2-rc.1 <0.2.0",
119
+ "@deepseek-ai/dsh-llm": ">=0.1.2-rc.1 <0.2.0",
120
+ "@deepseek-ai/dsh-session": ">=0.1.2-rc.1 <0.2.0",
121
+ "@deepseek-ai/dsh-storage-domain": ">=0.1.2-rc.1 <0.2.0",
122
+ "@deepseek-ai/dsh-token-meter": ">=0.1.2-rc.1 <0.2.0",
123
+ "@deepseek-ai/dsh-tools": ">=0.1.2-rc.1 <0.2.0",
124
+ "@deepseek-ai/dsh-typert-protocol": ">=0.1.2-rc.1 <0.2.0",
125
125
  "@deepseek-ai/schemastery": "^3.18.2",
126
- "@deepseek-ai/dsh-client-connection": ">=0.1.1-rc.2 <0.2.0",
127
- "@deepseek-ai/dsh-client-locale": ">=0.1.1-rc.2 <0.2.0",
128
- "@deepseek-ai/dsh-client-ui-settings": ">=0.1.1-rc.2 <0.2.0"
126
+ "@deepseek-ai/dsh-client-connection": ">=0.1.2-rc.1 <0.2.0",
127
+ "@deepseek-ai/dsh-client-locale": ">=0.1.2-rc.1 <0.2.0",
128
+ "@deepseek-ai/dsh-client-ui-settings": ">=0.1.2-rc.1 <0.2.0"
129
129
  },
130
130
  "peerDependenciesMeta": {
131
131
  "@deepseek-ai/dsh-client-connection": {
@@ -144,23 +144,23 @@
144
144
  "zod": "^4.4.3"
145
145
  },
146
146
  "devDependencies": {
147
- "@deepseek-ai/dsh-api-remotes": "0.1.2-alpha.5",
148
- "@deepseek-ai/dsh-attachment": "0.1.2-alpha.5",
147
+ "@deepseek-ai/dsh-api-remotes": "0.1.2-rc.1",
148
+ "@deepseek-ai/dsh-attachment": "0.1.2-rc.1",
149
149
  "@deepseek-ai/cordis": "^4.0.2",
150
- "@deepseek-ai/cordis-plugin-include": "1.0.6",
151
- "@deepseek-ai/cordis-plugin-loader": "1.0.2",
152
- "@deepseek-ai/dsh-agent": "0.1.2-alpha.5",
153
- "@deepseek-ai/dsh-client-connection": "0.1.2-alpha.5",
154
- "@deepseek-ai/dsh-client-locale": "0.1.2-alpha.5",
155
- "@deepseek-ai/dsh-client-ui-settings": "0.1.2-alpha.5",
156
- "@deepseek-ai/dsh-client-ui-slots": "0.1.2-alpha.5",
157
- "@deepseek-ai/dsh-commands": "0.1.2-alpha.5",
158
- "@deepseek-ai/dsh-llm": "0.1.2-alpha.5",
159
- "@deepseek-ai/dsh-session": "0.1.2-alpha.5",
160
- "@deepseek-ai/dsh-storage-domain": "0.1.2-alpha.5",
161
- "@deepseek-ai/dsh-token-meter": "0.1.2-alpha.5",
162
- "@deepseek-ai/dsh-tools": "0.1.2-alpha.5",
163
- "@deepseek-ai/dsh-typert-protocol": "0.1.2-alpha.5",
150
+ "@deepseek-ai/cordis-plugin-include": "^1.0.7",
151
+ "@deepseek-ai/cordis-plugin-loader": "^1.0.3",
152
+ "@deepseek-ai/dsh-agent": "0.1.2-rc.1",
153
+ "@deepseek-ai/dsh-client-connection": "0.1.2-rc.1",
154
+ "@deepseek-ai/dsh-client-locale": "0.1.2-rc.1",
155
+ "@deepseek-ai/dsh-client-ui-settings": "0.1.2-rc.1",
156
+ "@deepseek-ai/dsh-client-ui-slots": "0.1.2-rc.1",
157
+ "@deepseek-ai/dsh-commands": "0.1.2-rc.1",
158
+ "@deepseek-ai/dsh-llm": "0.1.2-rc.1",
159
+ "@deepseek-ai/dsh-session": "0.1.2-rc.1",
160
+ "@deepseek-ai/dsh-storage-domain": "0.1.2-rc.1",
161
+ "@deepseek-ai/dsh-token-meter": "0.1.2-rc.1",
162
+ "@deepseek-ai/dsh-tools": "0.1.2-rc.1",
163
+ "@deepseek-ai/dsh-typert-protocol": "0.1.2-rc.1",
164
164
  "@deepseek-ai/schemastery": "^3.18.2",
165
165
  "@types/node": "^22.19.0",
166
166
  "@types/react": "18.3.31",