v1.0.1

1.0.1

• 打包改名修复：cordis.patch.yml 的插件名和 client/client.js 的模块 id 现在都由 package.json 自动派生，制品内三者必须一致，否则构建失败。
• scripts/build-dist.mjs 同时解包复验 tgz 和 zip；失败不产出坏包。
• 扫描接口 POST /dsh-market-notes/scan、GET /dsh-market-notes/status 增加同源校验，跨站请求返回 403。
• 新增 force=ai：只重新生成带 🤖 的备注，手写备注在任何模式下都不会被覆盖（设置页新增「重新生成 AI 备注」）。
• 批量按 10 个一批调用，单批失败不影响其他批；市场请求 10 秒超时；备注按码点截断（正文 198 + 🤖 = 200）。
• 单一源码目录，旧的 link 开发目录已退役。

English

• Fixed packaging drift: the patch row name and the client module id are now derived from package.json; a mismatching artifact fails the build.
• scripts/build-dist.mjs extracts and re-verifies both the tgz and the zip; failed builds leave no artifact.
• Same-origin guard on /dsh-market-notes/scan and /status (cross-site requests get 403).
• New force=ai mode regenerates only 🤖-marked notes; user-written notes are never touched.
• Model calls are chunked (10 per batch), market requests time out after 10 s, notes are truncated by code points.