dsh-token-plugin 0.0.0-stage → 2.0.0

package/lib/records.js

@@ -0,0 +1,125 @@
+/**
+ * dsh-usage-plugin — 用量记录归一化与身份判定（纯逻辑层，无副作用）。
+ *
+ * 两条原则：
+ *   1. 归一化不猜测、不补造数据。上游没上报的字段就是 0，绝不用别的字段"兜底"
+ *      填充——那会把口径污染成不可解释的数字（例如用未命中 token 冒充缓存写入，
+ *      会让"四桶合计"凭空多出一笔）。
+ *   2. 去重按"身份"而不是按"毫秒"。同一毫秒完全可能产生两条不同请求的记录，
+ *      只按 time 去重会让它们互相覆盖、静默丢数据。
+ *
+ * @module dsh-usage-plugin/records
+ */
+
+/** 归一化会保留的字符串字段（缺省写空串，保持记录形状稳定）。 */
+const STRING_FIELDS = ['model', 'provider', 'purpose', 'sessionId', 'finishReason', 'fxDate']
+
+/**
+ * 只在确实有值时才写入的标识字段。
+ *
+ * 旧记录没有它们，缺省必须"字段不存在"，而不是留下一个空串——空串会让
+ * `recordKey` 的分支判断和"这条记录是哪来的"这类展示逻辑看起来像有值。
+ */
+const OPTIONAL_STRING_FIELDS = ['origin', 'recordId']
+
+/** 归一化会保留的非负计数字段。 */
+const TOKEN_FIELDS = [
+  'inputTokens', 'outputTokens', 'cacheReadTokens', 'cacheWriteTokens',
+  'reasoningTokens', 'usdCnyRate', 'maxTokens', 'maxUses'
+]
+
+/** 归一化会保留的非负整数字段（宿主 turn/step/seq 语义）。 */
+const INDEX_FIELDS = ['seq', 'turn', 'step', 'slotSeq']
+
+/**
+ * 把一条来自磁盘 / 导入文件 / 实时探针的原始数据归一化为插件内部记录。
+ *
+ * @param raw - 任意来源的候选记录。
+ * @returns 归一化后的记录；缺少可用时间戳时返回 null（该条应被丢弃）。
+ */
+export function normalizeRecord(raw) {
+  if (!raw || typeof raw !== 'object') return null
+  const time = Number(raw.time)
+  if (!Number.isFinite(time) || time <= 0) return null
+
+  const rec = { time }
+  for (const key of STRING_FIELDS) rec[key] = String(raw[key] || '')
+  for (const key of OPTIONAL_STRING_FIELDS) {
+    if (typeof raw[key] === 'string' && raw[key] !== '') rec[key] = raw[key]
+  }
+  for (const key of TOKEN_FIELDS) {
+    const n = Number(raw[key])
+    rec[key] = Number.isFinite(n) && n > 0 ? n : 0
+  }
+  rec.interrupted = !!raw.interrupted
+  // 估算标记：为 true 时该记录的 token / 费用不是上游实测值，UI 与导出必须区分。
+  if (raw.estimated) rec.estimated = true
+  for (const key of INDEX_FIELDS) {
+    if (Number.isSafeInteger(raw[key]) && raw[key] >= 0) rec[key] = raw[key]
+  }
+  // 计费时刻：记录发生时"生效的价格档"所对应的时刻。历史回填 / 导入的记录
+  // 其 time 可能与真实调用时刻不同，用 pricingTime 冻结取价时点。
+  if (Number.isFinite(raw.pricingTime) && raw.pricingTime > 0) rec.pricingTime = raw.pricingTime
+  // 冻结单价快照：记录产生时实际用到的三个单价（元 / 百万 tokens）。
+  // 有它，历史费用就不会因为后来改价格表被重算；没它（旧记录 / 手工导入）
+  // 就退回用当前价格表计算，由 UI 另行提示。
+  const unit = raw.unit
+  if (unit && typeof unit === 'object') {
+    const hit = Number(unit.hit)
+    const miss = Number(unit.miss)
+    const out = Number(unit.out)
+    const any = [hit, miss, out].some((n) => Number.isFinite(n) && n >= 0)
+    if (any) {
+      const snapshot = {
+        hit: Number.isFinite(hit) && hit > 0 ? hit : 0,
+        miss: Number.isFinite(miss) && miss > 0 ? miss : 0,
+        out: Number.isFinite(out) && out > 0 ? out : 0
+      }
+      const fx = Number(unit.fx)
+      if (Number.isFinite(fx) && fx > 0) snapshot.fx = fx
+      rec.unit = snapshot
+    }
+  }
+  return rec
+}
+
+/**
+ * 一条记录的身份键。
+ *
+ * 优先级：
+ *   1. `recordId`——新探针写入的 UUID，天然唯一，直接用它。
+ *   2. 扫描来源的 `(origin, sessionId, seq)`——宿主日志的 seq 即数组下标，稳定。
+ *   3. 复合指纹——老记录没有上面两者，用"会话 + 时刻 + 模型 + 用途 + 四桶用量 +
+ *      结束原因 + 中断标记"共同构成身份。比只按 time 安全：同毫秒的不同请求不会
+ *      再互相覆盖，而真正的重复项仍能被识别出来。
+ *
+ * @param r - 归一化后的记录。
+ * @returns 字符串身份键。
+ */
+export function recordKey(r) {
+  if (r.recordId) return 'id:' + r.recordId
+  if (r.origin === 'scan' && Number.isSafeInteger(r.seq)) return JSON.stringify(['scan', r.sessionId, r.seq])
+  return JSON.stringify([
+    r.sessionId || '', r.time, r.provider, r.model, r.purpose || '',
+    r.origin || '', r.estimated === true,
+    r.inputTokens || 0, r.outputTokens || 0, r.cacheReadTokens || 0, r.cacheWriteTokens || 0,
+    r.reasoningTokens || 0, r.finishReason || '', !!r.interrupted
+  ])
+}
+
+/**
+ * 一条记录在展示层的"可计费 token 合计"。
+ *
+ * 口径（与 DSH 宿主 `TokenUsage` 一致，四桶互斥）：
+ *   `未命中输入 + 缓存命中 + 缓存写入 + 输出`
+ *
+ * 注意 **不含 reasoningTokens**：宿主 `outputTokens` 就是上游的
+ * `completion_tokens`，而 `reasoningTokens` 是它的子集（信息性字段）。
+ * 把它再加一遍会让总数凭空多出一笔。
+ *
+ * @param r - 记录（已归一化或 API 投影形状均可）。
+ * @returns 互斥四桶之和。
+ */
+export function billableTokens(r) {
+  return (r.inputTokens || 0) + (r.cacheReadTokens || 0) + (r.cacheWriteTokens || 0) + (r.outputTokens || 0)
+}

package/lib/storage.js

@@ -0,0 +1,66 @@
+/**
+ * dsh-usage-plugin — 本地持久化的写入 / 读取原语（无业务语义）。
+ *
+ * 用量历史是这个插件的唯一资产，而它此前有一处很危险的行为：
+ * 直接 `writeFile` 覆盖 + 读取时把解析失败静默 catch 成"空数组"。
+ * 一次进程崩溃或一次半截写入，就可能让整份历史被当成空数据再被覆盖回去。
+ * 这里把两件事分开：
+ *   - 写：临时文件 → 刷盘 → 原子 rename，失败时原文件纹丝不动。
+ *   - 读：文件不存在才是空；解析失败必须抛错，由调用方决定如何处置（保留原件并报错）。
+ *
+ * @module dsh-usage-plugin/storage
+ */
+
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+import { randomUUID } from 'node:crypto'
+
+/**
+ * 原子写入文本：同目录临时文件写完并 fsync 后 rename 覆盖目标。
+ *
+ * 任一环节失败都会在 finally 里清掉临时文件，并且**不触碰目标文件**——调用方
+ * 因此可以安全地把"写入失败"当作可重试事件，而不是数据销毁事件。
+ *
+ * @param file - 目标文件绝对路径（父目录会自动创建）。
+ * @param text - 要写入的完整文本。
+ */
+export async function atomicWriteText(file, text) {
+  await fs.mkdir(path.dirname(file), { recursive: true })
+  const temporary = file + '.' + randomUUID() + '.tmp'
+  let handle
+  try {
+    handle = await fs.open(temporary, 'wx')
+    await handle.writeFile(text, 'utf8')
+    await handle.sync()
+    await handle.close()
+    handle = null
+    await fs.rename(temporary, file)
+  } finally {
+    if (handle) await handle.close().catch(() => {})
+    await fs.unlink(temporary).catch(() => {})
+  }
+}
+
+/**
+ * 读取用量记录数组。
+ *
+ * 只有"文件确实不存在"才返回空数组。解析失败、类型不对、读取被拒绝一律抛出——
+ * 静默退化成空数组会让下一次写入把真实历史覆盖掉。
+ *
+ * @param file - 用量数据文件绝对路径。
+ * @returns 记录数组（未归一化，由调用方 `normalizeRecord`）。
+ * @throws 文件存在但不可读 / 不是合法 JSON / 顶层不是数组。
+ */
+export async function readStoredRecords(file) {
+  let text
+  try {
+    text = await fs.readFile(file, 'utf8')
+  } catch (error) {
+    if (error && error.code === 'ENOENT') return []
+    throw error
+  }
+  if (text.trim() === '') return []
+  const records = JSON.parse(text)
+  if (!Array.isArray(records)) throw new Error('用量数据文件的顶层必须是数组')
+  return records
+}

package/package.json

@@ -1,6 +1,101 @@
-{
-  "name": "dsh-token-plugin",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{
+  "name": "dsh-token-plugin",
+  "version": "2.0.0",
+  "description": "DeepSeek Harness usage & cost tracker plugin: per-call token/cache-hit stats, peak/off-peak billing, CSV/JSON/PNG export with custom destination, and persistent local storage. Ships a host half plus a web client half in one npm package; installs into a DSH profile as a dsh.bundle from a local package or a published release.",
+  "keywords": [
+    "deepseek",
+    "harness",
+    "dsh",
+    "plugin",
+    "usage",
+    "cost",
+    "tokens",
+    "cache"
+  ],
+  "license": "MIT",
+  "type": "module",
+  "main": "lib/index.js",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/realhenrylan/dsh-token-plugin.git"
+  },
+  "contributors": [
+    {
+      "name": "ayleen",
+      "url": "https://github.com/ayleen"
+    },
+    {
+      "name": "wuhuqif176",
+      "url": "https://github.com/wuhuqif176"
+    },
+    {
+      "name": "Martin-soaring-dev",
+      "url": "https://github.com/Martin-soaring-dev"
+    },
+    {
+      "name": "liu3734",
+      "url": "https://github.com/liu3734"
+    },
+    {
+      "name": "mumuer1024",
+      "url": "https://github.com/mumuer1024"
+    },
+    {
+      "name": "zhiqiangme",
+      "url": "https://github.com/zhiqiangme"
+    },
+    {
+      "name": "vb2250158",
+      "url": "https://github.com/vb2250158"
+    }
+  ],
+  "homepage": "https://github.com/realhenrylan/dsh-token-plugin#readme",
+  "bugs": {
+    "url": "https://github.com/realhenrylan/dsh-token-plugin/issues"
+  },
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-conversation"
+      ]
+    }
+  },
+  "files": [
+    "lib",
+    "scripts",
+    "cordis.patch.yml",
+    "README.md",
+    "README.zh.md",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "sync": "node sync-to-profile.mjs",
+    "wire": "node scripts/wire.js",
+    "check": "node scripts/check-package.js",
+    "prepublishOnly": "node scripts/check-package.js",
+    "pack": "npm pack"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": ">=4.0.1"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/cordis": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "undici": "^7.0.0"
+  }
+}

package/scripts/check-package.js

@@ -0,0 +1,84 @@
+/**
+ * dsh-usage-plugin — pre-publish sanity gate (dependency-free).
+ *
+ * Run by `npm run check` and `npm run prepublishOnly` before the package is
+ * packed/uploaded. It verifies every piece of the DSH plugin contract that
+ * would otherwise fail LOUDLY at boot or client-load time when missing:
+ *
+ *   1. `dsh.bundle.patch` — the profile bundle patch file exists and carries a
+ *      valid insert entry naming this package (auto-activation via
+ *      `dsh plugin --profile <name> add <pkg>` depends on it).
+ *   2. `dsh.client` — the web client declaration and `exports["./client"]`
+ *      bundle exist (the host serves it at `/plugins/<name>/client.js`).
+ *   3. `files` — the publish whitelist covers every artifact above.
+ *
+ * This is a structural gate, not a full parser; the authoritative YAML +
+ * loader-composition validation is done by DSH itself at profile boot.
+ */
+import { readFileSync, existsSync } from "node:fs";
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const pkgDir = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+const fail = (message) => {
+	console.error(`[check-package] FAIL: ${message}`);
+	process.exitCode = 1;
+};
+
+let ok = true;
+const check = (condition, message) => {
+	if (!condition) {
+		fail(message);
+		ok = false;
+	}
+};
+
+let pkg;
+try {
+	pkg = JSON.parse(readFileSync(resolve(pkgDir, "package.json"), "utf8"));
+} catch (error) {
+	console.error(`[check-package] FAIL: cannot read package.json: ${String(error && error.message || error)}`);
+	process.exit(1);
+}
+
+// ── identity ───────────────────────────────────────────────────────────────
+check(typeof pkg.name === "string" && pkg.name.length > 0, "package.json must declare a name");
+check(typeof pkg.version === "string" && /^\d+\.\d+\.\d+/.test(pkg.version), `invalid version ${JSON.stringify(pkg.version)}`);
+
+// ── dsh.bundle patch (host-side auto-activation) ───────────────────────────
+const bundlePatch = pkg.dsh && pkg.dsh.bundle && pkg.dsh.bundle.patch;
+check(typeof bundlePatch === "string" && bundlePatch.length > 0, 'package.json must declare "dsh": { "bundle": { "patch": "..." } }');
+if (typeof bundlePatch === "string") {
+	const patchPath = resolve(pkgDir, bundlePatch);
+	check(existsSync(patchPath), `dsh.bundle.patch file not found: ${bundlePatch}`);
+	if (existsSync(patchPath)) {
+		const text = readFileSync(patchPath, "utf8");
+		check(text.includes("- insert:"), `bundle patch ${bundlePatch} must contain a top-level "- insert:" entry`);
+		check(text.includes(`name: '${pkg.name}'`) || text.includes(`name: "${pkg.name}"`), `bundle patch ${bundlePatch} must insert an entry with name: '${pkg.name}'`);
+		const required = ["fs", "webServer", "subprocess", "credentials", "sandboxPolicy", "agents"];
+		const missing = required.filter((service) => !text.includes(`- ${service}`));
+		check(missing.length === 0, `bundle patch ${bundlePatch} is missing inject entries: ${missing.join(", ")}`);
+	}
+}
+
+// ── dsh.client + client bundle (browser half) ──────────────────────────────
+const clientDecl = pkg.dsh && pkg.dsh.client;
+check(clientDecl !== null && typeof clientDecl === "object", 'package.json must declare "dsh": { "client": { "platform": "web", ... } }');
+if (clientDecl !== null && typeof clientDecl === "object") {
+	check(clientDecl.platform === "web", `dsh.client.platform must be "web" (got ${JSON.stringify(clientDecl.platform)})`);
+	check(Array.isArray(clientDecl.inject) && clientDecl.inject.length > 0, "dsh.client.inject must be a non-empty string array");
+}
+const clientRel = pkg.exports && (typeof pkg.exports["./client"] === "string" ? pkg.exports["./client"] : (pkg.exports["./client"] && pkg.exports["./client"].default));
+check(typeof clientRel === "string", 'package.json must export "./client" pointing at the client bundle');
+if (typeof clientRel === "string") {
+	check(existsSync(resolve(pkgDir, clientRel)), `client bundle not found: ${clientRel} (run the client build before publishing)`);
+}
+
+// ── files whitelist ────────────────────────────────────────────────────────
+check(Array.isArray(pkg.files), "package.json must declare a files whitelist");
+for (const entry of pkg.files || []) {
+	check(existsSync(resolve(pkgDir, entry)), `files entry not found: ${entry}`);
+}
+
+if (ok) console.log(`[check-package] OK — ${pkg.name}@${pkg.version} satisfies the DSH plugin contract`);

package/scripts/release.mjs

@@ -0,0 +1,97 @@
+import { spawnSync } from 'node:child_process'
+import https from 'node:https'
+import fs from 'node:fs'
+import path from 'node:path'
+
+const REPO = 'realhenrylan/dsh-token-plugin'
+const VERSION = JSON.parse(fs.readFileSync(path.join(process.cwd(), 'package.json'), 'utf8')).version
+const TAG = `v${VERSION}`
+
+function getCredential() {
+  const input = 'protocol=https\nhost=github.com\n\n'
+  const res = spawnSync('git', ['credential', 'fill'], { input, encoding: 'utf8' })
+  const cred = {}
+  for (const l of (res.stdout || '').split('\n')) {
+    const idx = l.indexOf('=')
+    if (idx > 0) cred[l.slice(0, idx).trim()] = l.slice(idx + 1).trim()
+  }
+  return cred
+}
+
+function api(method, apiPath, body, contentType = 'application/json', host = 'api.github.com') {
+  return new Promise((resolve) => {
+    const cred = getCredential()
+    const isBuffer = Buffer.isBuffer(body)
+    const req = https.request({
+      host,
+      path: apiPath,
+      method,
+      headers: {
+        'Authorization': `Bearer ${cred.password || ''}`,
+        'User-Agent': 'dsh-usage-plugin-publish',
+        'Accept': 'application/vnd.github+json',
+        'Content-Type': contentType,
+        ...(body != null ? { 'Content-Length': isBuffer ? body.length : Buffer.byteLength(body) } : {}),
+      },
+      rejectUnauthorized: false,
+    }, (res) => {
+      let data = ''
+      res.on('data', (d) => data += d)
+      res.on('end', () => resolve({ status: res.statusCode, body: data }))
+    })
+    req.on('error', (e) => resolve({ status: 0, body: e.message }))
+    if (body != null) req.write(body)
+    req.end()
+  })
+}
+
+function extractChangelog(tag) {
+  const text = fs.readFileSync(path.join(process.cwd(), 'CHANGELOG.md'), 'utf8')
+  const lines = text.split('\n')
+  const re = new RegExp('^## ' + tag.replace(/\./g, '\\.') + '\\b')
+  const start = lines.findIndex((l) => re.test(l))
+  if (start < 0) return ''
+  let end = lines.length
+  for (let i = start + 1; i < lines.length; i++) {
+    if (/^## v\d/.test(lines[i])) { end = i; break }
+  }
+  return lines.slice(start, end).join('\n').trim()
+}
+
+const body = extractChangelog(TAG)
+if (!body) { console.error('changelog section not found for', TAG); process.exit(1) }
+
+console.log('Creating release', TAG, 'for', REPO)
+const created = await api('POST', `/repos/${REPO}/releases`, JSON.stringify({
+  tag_name: TAG,
+  name: TAG,
+  body,
+  draft: false,
+  prerelease: false,
+}))
+console.log('create status:', created.status)
+if (created.status !== 201) {
+  console.error('create failed:', created.body.slice(0, 600))
+  process.exit(1)
+}
+const release = JSON.parse(created.body)
+console.log('release id:', release.id, 'url:', release.html_url)
+
+// 打包并上传 tarball 作为附件（Windows 下 npm 为 npm.cmd 批处理脚本，经 cmd /c 执行）
+const pack = process.platform === 'win32'
+  ? spawnSync('cmd', ['/c', 'npm', 'pack'], { encoding: 'utf8' })
+  : spawnSync('npm', ['pack'], { encoding: 'utf8' })
+const tgzName = (pack.stdout || '').trim().split('\n').pop()
+if (tgzName && fs.existsSync(tgzName)) {
+  const buf = fs.readFileSync(tgzName)
+  const assetPath = `/repos/${REPO}/releases/${release.id}/assets?name=${encodeURIComponent(tgzName)}`
+  console.log('uploading asset', tgzName, buf.length)
+  const asset = await api('POST', assetPath, buf, 'application/octet-stream', 'uploads.github.com')
+  console.log('asset status:', asset.status)
+  if (asset.status === 201) console.log('asset url:', JSON.parse(asset.body).browser_download_url)
+  else console.error('asset body:', asset.body.slice(0, 400))
+  try { fs.unlinkSync(tgzName) } catch (e) {}
+} else {
+  console.log('no tarball produced; skip asset upload')
+}
+console.log('DONE')

package/scripts/upload-asset.mjs

@@ -0,0 +1,50 @@
+import { spawnSync } from 'node:child_process'
+import https from 'node:https'
+import fs from 'node:fs'
+
+const REPO = 'realhenrylan/dsh-token-plugin'
+const RELEASE_ID = 375098880
+
+function getCredential() {
+  const input = 'protocol=https\nhost=github.com\n\n'
+  const res = spawnSync('git', ['credential', 'fill'], { input, encoding: 'utf8' })
+  const cred = {}
+  for (const l of (res.stdout || '').split('\n')) {
+    const idx = l.indexOf('=')
+    if (idx > 0) cred[l.slice(0, idx).trim()] = l.slice(idx + 1).trim()
+  }
+  return cred
+}
+
+function api(method, apiPath, body, contentType, host = 'api.github.com') {
+  return new Promise((resolve) => {
+    const cred = getCredential()
+    const isBuffer = Buffer.isBuffer(body)
+    const req = https.request({
+      host, path: apiPath, method,
+      headers: {
+        'Authorization': `Bearer ${cred.password || ''}`,
+        'User-Agent': 'dsh-usage-plugin-publish',
+        'Accept': 'application/vnd.github+json',
+        'Content-Type': contentType,
+        ...(body != null ? { 'Content-Length': isBuffer ? body.length : Buffer.byteLength(body) } : {}),
+      },
+      rejectUnauthorized: false,
+    }, (res) => { let d = ''; res.on('data', (c) => d += c); res.on('end', () => resolve({ status: res.statusCode, body: d })) })
+    req.on('error', (e) => resolve({ status: 0, body: e.message }))
+    if (body != null) req.write(body)
+    req.end()
+  })
+}
+
+const tgz = fs.readdirSync('.').find((f) => f.endsWith('.tgz'))
+if (!tgz) { console.error('no tarball found'); process.exit(1) }
+const buf = fs.readFileSync(tgz)
+const assetPath = `/repos/${REPO}/releases/${RELEASE_ID}/assets?name=${encodeURIComponent(tgz)}`
+console.log('uploading', tgz, buf.length)
+const asset = await api('POST', assetPath, buf, 'application/octet-stream', 'uploads.github.com')
+console.log('asset status:', asset.status)
+if (asset.status === 201) console.log('asset url:', JSON.parse(asset.body).browser_download_url)
+else console.error('asset body:', asset.body.slice(0, 400))
+try { fs.unlinkSync(tgz) } catch (e) {}
+console.log('DONE')

package/scripts/wire.js

@@ -0,0 +1,109 @@
+/**
+ * dsh-usage-plugin — wiring script (LEGACY fallback).
+ *
+ * PREFERRED INSTALL: this package declares `dsh.bundle`, so it auto-activates
+ * with a single command and NO manual wiring:
+ *
+ *   dsh plugin --profile web add dsh-token-plugin
+ *
+ * This script exists only for the manual fallback path (installing the package
+ * by hand into a profile's node_modules): it appends the plugin row to the
+ * profile's `cordis.patch.yml` so the plugin loads with the web app:
+ *
+ *   npm run wire
+ *
+ * It is idempotent: running it again never duplicates the row. If it cannot
+ * find a profile patch it prints what to add manually and exits non-zero.
+ */
+import { readFileSync, writeFileSync, existsSync, readdirSync } from "node:fs";
+import { resolve, join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const pkgDir = resolve(here, "..");
+const ROW_ID = "usage-plugin";
+const PACKAGE_NAME = JSON.parse(readFileSync(join(pkgDir, "package.json"), "utf8")).name || "dsh-usage-plugin";
+
+function candidateRoots() {
+  const roots = [];
+  // When installed at <profilesRoot>/node_modules/dsh-usage-plugin, the
+  // profiles root is two levels up; try several depths for other layouts.
+  for (let up = 1; up <= 4; up++) {
+    let p = pkgDir;
+    for (let i = 0; i < up; i++) p = resolve(p, "..");
+    roots.push(p);
+  }
+  if (process.env.DSH_HOME) {
+    roots.push(join(process.env.DSH_HOME, "profiles"));
+    roots.push(process.env.DSH_HOME);
+  }
+  return roots;
+}
+
+function findPatches(roots) {
+  const seen = new Set();
+  const patches = [];
+  for (const root of roots) {
+    let entries;
+    try {
+      entries = readdirSync(root, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory() || entry.name === "node_modules") continue;
+      const patch = join(root, entry.name, "cordis.patch.yml");
+      if (existsSync(patch) && !seen.has(patch)) {
+        seen.add(patch);
+        patches.push(patch);
+      }
+    }
+  }
+  return patches;
+}
+
+function alreadyWired(text) {
+  return text.includes(`id: ${ROW_ID}`);
+}
+
+function wire(patchPath) {
+  const text = readFileSync(patchPath, "utf8");
+  if (alreadyWired(text)) {
+    console.log(`[dsh-usage-plugin] already wired in ${patchPath}`);
+    return true;
+  }
+  const block =
+    "\n# " + PACKAGE_NAME + ": usage & cost tracking (installed via npm).\n" +
+    "- insert:\n" +
+    "    - id: " + ROW_ID + "\n" +
+    "      name: '" + PACKAGE_NAME + "'\n" +
+    "      inject:\n" +
+    "        - fs\n" +
+    "        - webServer\n" +
+    "        - subprocess\n" +
+    "        - credentials\n" +
+    "        - settings\n" +
+    "        - sandboxPolicy\n" +
+    "        - agents\n";
+  writeFileSync(patchPath, text.endsWith("\n") ? text + block : text + "\n" + block, "utf8");
+  console.log(`[dsh-usage-plugin] wired into ${patchPath}`);
+  return true;
+}
+
+const patches = findPatches(candidateRoots());
+if (patches.length === 0) {
+  console.error(
+    "[dsh-usage-plugin] no DSH profile patch found. Preferred: install with `dsh plugin --profile web add " + PACKAGE_NAME + "` (auto-wires via dsh.bundle, no manual editing).\n" +
+    "Manual fallback — add this row to your profile's cordis.patch.yml, then restart the app:\n\n" +
+    "- insert:\n" +
+    "    - id: " + ROW_ID + "\n" +
+    "      name: '" + PACKAGE_NAME + "'\n"
+  );
+  process.exit(1);
+}
+let ok = true;
+for (const patch of patches) ok = wire(patch) && ok;
+if (ok) {
+  console.log("[dsh-usage-plugin] done. Restart the DeepSeek Harness web app for the plugin to load.");
+}
+process.exit(ok ? 0 : 1);