feat: add trustworthy model-level token controls

.github/workflows/ci.yml

@@ -0,0 +1,146 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - feat/token-usage-high-value-insights
+
+permissions:
+  contents: write
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  DSH_REF: fb82698709c39f1860b0ab0ed147e1fa30c1d5d0
+  DSH_PNPM_VERSION: 11.7.0
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Check out plugin branch
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref || github.ref_name }}
+          fetch-depth: 0
+
+      - name: Use Node.js 22.19.0
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22.19.0
+
+      - name: Build pinned DeepSeek Harness toolchain
+        shell: bash
+        run: |
+          set -euo pipefail
+          harness="$RUNNER_TEMP/deepseek-harness"
+          git init "$harness"
+          git -C "$harness" remote add origin https://github.com/deepseek-ai/deepseek-harness.git
+          git -C "$harness" fetch --depth 1 origin "$DSH_REF"
+          git -C "$harness" checkout --detach FETCH_HEAD
+          corepack enable
+          corepack prepare "pnpm@$DSH_PNPM_VERSION" --activate
+          pnpm --dir "$harness" install --frozen-lockfile --ignore-scripts
+          pnpm --dir "$harness" run build:lib
+          ln -sfn "$harness" "$GITHUB_WORKSPACE/../deepseek-harness"
+          node --check scripts/link-dsh-workspace.mjs
+          node scripts/link-dsh-workspace.mjs "$harness" "$GITHUB_WORKSPACE/node_modules"
+          echo "$GITHUB_WORKSPACE/node_modules/.bin" >> "$GITHUB_PATH"
+
+      - name: Typecheck host and client
+        run: npm run typecheck
+
+      - name: Run regression tests
+        run: npm test
+
+      - name: Rebuild committed bundles
+        run: npm run build
+
+      - name: Verify package contents
+        shell: bash
+        run: |
+          set -euo pipefail
+          rm -rf dist
+          mkdir -p dist
+          npm pack --dry-run --json --pack-destination dist > dist/pack.json
+          cat dist/pack.json
+          node --input-type=module <<'NODE'
+          import { readFileSync } from 'node:fs'
+
+          const results = JSON.parse(readFileSync('dist/pack.json', 'utf8'))
+          if (!Array.isArray(results) || results.length !== 1) {
+            throw new Error(`Expected one npm pack result, received ${JSON.stringify(results)}`)
+          }
+
+          const files = results[0]?.files?.map((entry) => entry.path).sort()
+          if (!Array.isArray(files)) {
+            throw new Error('npm pack result did not include a files array')
+          }
+
+          const required = [
+            'LICENSE',
+            'README.md',
+            'lib/index.cjs',
+            'lib/index.mjs',
+            'package.json',
+            'src/index.ts',
+            'src/manifests.ts',
+          ]
+          for (const path of required) {
+            if (!files.includes(path)) {
+              throw new Error(`Missing required package file: ${path}`)
+            }
+          }
+
+          const allowedExact = new Set(['LICENSE', 'README.md', 'package.json'])
+          const unexpected = files.filter((path) => (
+            !allowedExact.has(path)
+            && !path.startsWith('lib/')
+            && !path.startsWith('src/')
+          ))
+          if (unexpected.length > 0) {
+            throw new Error(`Unexpected package files: ${unexpected.join(', ')}`)
+          }
+
+          console.log(`Verified npm package contents (${files.length} files)`)
+          NODE
+
+      - name: Persist generated bundles on feature branch
+        if: github.head_ref == 'feat/token-usage-high-value-insights' || github.ref == 'refs/heads/feat/token-usage-high-value-insights'
+        shell: bash
+        run: |
+          set -euo pipefail
+          git add -- lib/index.cjs lib/index.mjs
+          git diff --cached --check
+          mapfile -t staged < <(git diff --cached --name-only)
+          for file in "${staged[@]}"; do
+            case "$file" in
+              lib/index.cjs|lib/index.mjs) ;;
+              *)
+                echo "Unexpected staged file: $file" >&2
+                exit 1
+                ;;
+            esac
+          done
+          if git diff --cached --quiet; then
+            echo "Generated bundles are already current."
+          else
+            target_branch="${GITHUB_HEAD_REF:-$GITHUB_REF_NAME}"
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git commit -m "build: refresh generated plugin bundles"
+            git push origin "HEAD:$target_branch"
+          fi
+
+      - name: Verify generated artifacts
+        shell: bash
+        run: |
+          set -euo pipefail
+          git diff --check
+          git diff --exit-code -- lib

.github/workflows/sync-generated-bundles-v2.yml

@@ -0,0 +1,89 @@
+name: Sync generated bundles v2 (temporary)
+
+on:
+  push:
+    branches:
+      - feat/token-usage-high-value-insights
+    paths:
+      - .github/workflows/sync-generated-bundles-v2.yml
+
+permissions:
+  contents: write
+
+env:
+  DSH_REF: fb82698709c39f1860b0ab0ed147e1fa30c1d5d0
+  DSH_PNPM_VERSION: 11.7.0
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Check out feature branch
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Use Node.js 22.19.0
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22.19.0
+
+      - name: Build pinned DeepSeek Harness toolchain
+        shell: bash
+        run: |
+          set -euo pipefail
+          harness="$RUNNER_TEMP/deepseek-harness"
+          git init "$harness"
+          git -C "$harness" remote add origin https://github.com/deepseek-ai/deepseek-harness.git
+          git -C "$harness" fetch --depth 1 origin "$DSH_REF"
+          git -C "$harness" checkout --detach FETCH_HEAD
+          corepack enable
+          corepack prepare "pnpm@$DSH_PNPM_VERSION" --activate
+          pnpm --dir "$harness" install --frozen-lockfile --ignore-scripts
+          pnpm --dir "$harness" run build:lib
+          ln -sfn "$harness" "$GITHUB_WORKSPACE/../deepseek-harness"
+          node --check scripts/link-dsh-workspace.mjs
+          node scripts/link-dsh-workspace.mjs "$harness" "$GITHUB_WORKSPACE/node_modules"
+          echo "$GITHUB_WORKSPACE/node_modules/.bin" >> "$GITHUB_PATH"
+
+      - name: Typecheck host and client
+        run: npm run typecheck
+
+      - name: Run regression tests
+        run: npm test
+
+      - name: Rebuild generated bundles
+        run: npm run build
+
+      - name: Stage and verify generated bundles only
+        shell: bash
+        run: |
+          set -euo pipefail
+          git status --short
+          git add -- lib/index.cjs lib/index.mjs
+          git diff --cached --check
+          mapfile -t staged < <(git diff --cached --name-only)
+          for file in "${staged[@]}"; do
+            case "$file" in
+              lib/index.cjs|lib/index.mjs) ;;
+              *)
+                echo "Unexpected staged file: $file" >&2
+                exit 1
+                ;;
+            esac
+          done
+
+      - name: Commit refreshed bundles
+        shell: bash
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          if git diff --cached --quiet; then
+            echo "Generated bundles are already current."
+            exit 0
+          fi
+          git commit -m "build: refresh generated plugin bundles"
+          git push origin "HEAD:$GITHUB_REF_NAME"

.github/workflows/sync-generated-bundles.yml

@@ -0,0 +1,89 @@
+name: Sync generated bundles (temporary)
+
+on:
+  push:
+    branches:
+      - feat/token-usage-high-value-insights
+    paths:
+      - .github/workflows/sync-generated-bundles.yml
+
+permissions:
+  contents: write
+
+env:
+  DSH_REF: fb82698709c39f1860b0ab0ed147e1fa30c1d5d0
+  DSH_PNPM_VERSION: 11.7.0
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Check out feature branch
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Use Node.js 22.19.0
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22.19.0
+
+      - name: Build pinned DeepSeek Harness toolchain
+        shell: bash
+        run: |
+          set -euo pipefail
+          harness="$RUNNER_TEMP/deepseek-harness"
+          git init "$harness"
+          git -C "$harness" remote add origin https://github.com/deepseek-ai/deepseek-harness.git
+          git -C "$harness" fetch --depth 1 origin "$DSH_REF"
+          git -C "$harness" checkout --detach FETCH_HEAD
+          corepack enable
+          corepack prepare "pnpm@$DSH_PNPM_VERSION" --activate
+          pnpm --dir "$harness" install --frozen-lockfile --ignore-scripts
+          pnpm --dir "$harness" run build:lib
+          ln -sfn "$harness" "$GITHUB_WORKSPACE/../deepseek-harness"
+          node --check scripts/link-dsh-workspace.mjs
+          node scripts/link-dsh-workspace.mjs "$harness" "$GITHUB_WORKSPACE/node_modules"
+          echo "$GITHUB_WORKSPACE/node_modules/.bin" >> "$GITHUB_PATH"
+
+      - name: Typecheck host and client
+        run: npm run typecheck
+
+      - name: Run regression tests
+        run: npm test
+
+      - name: Rebuild generated bundles
+        run: npm run build
+
+      - name: Stage and verify generated bundles only
+        shell: bash
+        run: |
+          set -euo pipefail
+          git status --short
+          git add -- lib/index.cjs lib/index.mjs
+          git diff --cached --check
+          mapfile -t staged < <(git diff --cached --name-only)
+          for file in "${staged[@]}"; do
+            case "$file" in
+              lib/index.cjs|lib/index.mjs) ;;
+              *)
+                echo "Unexpected staged file: $file" >&2
+                exit 1
+                ;;
+            esac
+          done
+
+      - name: Commit refreshed bundles
+        shell: bash
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          if git diff --cached --quiet; then
+            echo "Generated bundles are already current."
+            exit 0
+          fi
+          git commit -m "build: refresh generated plugin bundles"
+          git push origin "HEAD:$GITHUB_REF_NAME"

.impeccable.md

@@ -0,0 +1,17 @@
+## Design Context
+
+### Users
+DeepSeek Harness developers and operators use this local-first settings page while diagnosing model usage, budget pressure, route concentration, retries, and context-compaction overhead. Their main job is to decide where Token consumption is rising and which exact provider/model route needs attention without exposing conversation content or mistaking estimates for billing facts.
+
+### Brand Personality
+Native, restrained, trustworthy. The interface should feel like a precise DSH operational surface: calm under normal conditions, explicit when evidence is incomplete, and direct when a budget crosses a threshold.
+
+### Aesthetic Direction
+Follow the host DSH Web theme, typography, controls, spacing, and light/dark behavior rather than creating a separate visual brand. Prefer compact data-dense rows, quiet controls, semantic warning states, and progressive disclosure. Avoid decorative dashboards, gradients, glass effects, excessive cards, and color-only status communication.
+
+### Design Principles
+1. Evidence before decoration: every trend, forecast, and alert states its data scope and becomes unavailable when coverage cannot support it.
+2. Native over novel: reuse DSH controls and existing plugin patterns so the page feels built into Settings.
+3. Actionable hierarchy: surface exceeded and forecast-to-exceed budgets first, then warnings, then healthy routes.
+4. Progressive detail: summarize status at a glance while preserving exact values, route identity, and calculation notes nearby.
+5. Accessible in every state: pair color with text, retain keyboard operation, support narrow layouts, and respect the host theme and reduced-motion preference.