@ilaomianyang/dsh-memory-graph 0.10.0 → 0.10.2

package/CHANGELOG.md

@@ -1,8 +1,31 @@
 # Changelog
 
+## 0.10.2 — 2026-11-03
+
+补一个从第一天就存在的渲染缺陷，并让发布流水线第一次真正跑完。
+
+**Fixed**
+
+- 图里每个节点的光晕（halo）一直是 `r="NaN"`。`haloScale` 在模型里算好了（实体 2.5、卡片 2.7），序列化给页面的 payload 时漏了这个字段，浏览器做 `node.r * undefined` 得到 NaN，柔光画不出来，控制台上每个节点报一条 `<circle> attribute r: Expected length, "NaN"`。截图上完全看不出来——缺的是柔光，不是骨架——只有打开控制台才发现。现在 payload 带上 `haloScale`。
+- `test/page.mjs` 加一条检查兜住这一类问题：解析页面里的 `DATA`，断言每个节点的 `r` 与 `haloScale` 都是有限数，并且整页不出现字面量 `NaN`。
+
+**Changed**
+
+- 检查数 231 → 232（README 两版、`test.yml` 的注释同步）。
+
+**已发布到 npm：`@ilaomianyang/dsh-memory-graph@0.10.2`，由 GitHub Actions 用 trusted publishing（OIDC，仓库里不存任何 token）发布，带 SLSA provenance。**
+
+## 0.10.1 — 2026-11-03
+
+**Added**
+
+- `.github/workflows/publish.yml`：推 `v*` tag 就发布，不再靠本机 `npm publish`。核对 tag 与 `package.json`、跳过已发布的版本（重推 tag 是空操作）、`npm publish --provenance`，npm 页面上因此有「Built and signed on GitHub Actions」。
+- `npm run release`：跑测试 → bump → 提交 → 打 tag → 推 tag 的一条命令。
+- 首版流水线踩了两个坑，都只影响 CI，与插件本身无关：`npm view` 在「版本尚未发布」时退出码为 1，而 runner 打开了 `PSNativeCommandUseErrorActionPreference`，这个预期内的非零退出直接把守门步骤干掉了；改成直接读 registry 文档判断。另外 trusted publishing 需要 npm ≥ 11.5.1，Node 22 自带 10.x，所以先 `npm install -g npm@latest`。
+
 ## 0.10.0 — 2026-11-03
 
-**发布到 npm**。`dsh-memory-graph` 这个名字在 npm 上已经被别人占了（maintainer `lilai123`，2026-11-01 发的 0.1.2，是个同名但不同的插件），所以换名发布。
+**已发布到 npm：`npm i @ilaomianyang/dsh-memory-graph`（0.10.0，2026-11-03）。** npmmirror 已同步，国内直接装。`dsh-memory-graph` 这个名字在 npm 上已经被别人占了（maintainer `lilai123`，2026-11-01 发的 0.1.2，是个同名但不同的插件），所以换名发布。
 
 **Changed**
 
@@ -18,6 +41,11 @@
 
 - README 两版新增「从 npm 装」：`plugin_manager action=install_bundle target="@ilaomianyang/dsh-memory-graph"`，并给出国内走 `registry="https://registry.npmmirror.com/"` 的写法（镜像自动同步 npm，滞后几分钟到几小时）。
 
+**Added（发布流水线）**
+
+- `.github/workflows/publish.yml`：推 `v*` tag 就发布，不再靠本机 `npm publish`。它会核对 tag 与 `package.json`、跳过已发布的版本（重推 tag 是空操作）、`npm publish --provenance`，并在 npm 页面上留一条「Built and signed on GitHub Actions」。凭据是仓库 secret `NPM_TOKEN`（必须是 Automation token，账号开着 2FA 时普通 Publish token 会被 403 挡掉）。
+- `npm run release`：先跑测试、再 bump、提交、打 tag、推 tag 的一条命令；README 两版都加了「发布」一节。
+
 **Removed**
 
 - `package-lock.json`：里面还写着 `@local/dsh-memory-graph`（第一次本地装时的残留），且只有一个依赖，留着只会误导。

package/README.en.md

@@ -2,7 +2,7 @@
 
 English · [中文](README.md)
 
-[![test](https://github.com/ilaomianyang/dsh-memory-graph/actions/workflows/test.yml/badge.svg)](https://github.com/ilaomianyang/dsh-memory-graph/actions/workflows/test.yml)
+[![npm](https://img.shields.io/npm/v/@ilaomianyang/dsh-memory-graph?label=npm)](https://www.npmjs.com/package/@ilaomianyang/dsh-memory-graph) [![test](https://github.com/ilaomianyang/dsh-memory-graph/actions/workflows/test.yml/badge.svg)](https://github.com/ilaomianyang/dsh-memory-graph/actions/workflows/test.yml)
 
 Long-term **associative memory** for [DeepSeek Harness](https://getartcraft.com) (DSH).
 
@@ -383,7 +383,7 @@ Side benefit: an injected message no longer cuts a turn in half, so an episode's
 No network, no real vault:
 
 ```bash
-npm test        # 43 + 13 + 35 + 12 + 22 + 54 + 15 + 7 + 11 + 19 = 231 checks, plus the 25-question retrieval eval
+npm test        # 43 + 13 + 35 + 12 + 22 + 54 + 15 + 8 + 11 + 19 = 232 checks, plus the 25-question retrieval eval
 npm run eval    # retrieval eval only (offline, deterministic)
 ```
 
@@ -409,6 +409,37 @@ node test/live.mjs --tokens 900                 # a small output cap, watch a tr
 
 They read the key from `~/.dsh/.credentials.yaml` or the environment (see above); nothing is hard-coded or persisted. Both run in a plain `node` process with no harness `llm` service to borrow, so they set `transport: 'http'` explicitly — the plugin's own default is `harness`.
 
+## Releasing
+
+There is one source of truth for the version: `version` in `package.json`. Releasing a version *is* pushing a tag:
+
+```bash
+npm run release        # = npm version patch (runs the suite first) → commit → tag → git push --follow-tags
+npm version minor -m "chore(release): v%s" && git push --follow-tags   # for minor / major
+```
+
+The tag triggers `.github/workflows/publish.yml`, which does four things:
+
+1. checks that the tag and `package.json` agree — a mismatch fails instead of publishing a package whose version lies;
+2. checks whether that version is already on the registry — if so it skips, so re-running a tag is a no-op rather than an error;
+3. `npm publish --provenance --access public` (`prepublishOnly` runs the 232 checks again; a red build cannot reach the registry);
+4. adds "Built and signed on GitHub Actions" to the npm page, proving the tarball came from this commit of this repository.
+
+Two ways to authenticate; the workflow accepts both (it uses `NPM_TOKEN` when the secret exists and falls back to OIDC when it does not):
+
+**1. Trusted publishing — recommended, no secret stored anywhere.** npm treats this as the intended path and is retiring 2FA-bypassing tokens for it (per npm's notice: account changes restricted from Aug 2026, direct publishing from Jan 2027). On the package page: **Package → Settings → Trusted publishing → Add a publisher → GitHub Actions**, repository `ilaomianyang/dsh-memory-graph`, workflow `publish.yml`, environment empty. CI then publishes as this run's OIDC identity and `--provenance` comes along for free.
+
+**2. `NPM_TOKEN` — works today, a stopgap.** npmjs.com → Access Tokens → Generate New Token, choose **Granular Access Token**: tick **Bypass two-factor authentication (2FA)**, set Permissions to **Read and write (publish and stage)** (if it offers a package picker, pick only this package), and do not leave the Expiration at the default 30 days. Then add it to the repository: Settings → Secrets and variables → Actions → New repository secret, named `NPM_TOKEN`. With 2FA on the account an ordinary Publish token is rejected with `403 ... two-factor authentication ... required to publish`; only the bypass one gets through. That token is for CI only — keep it out of `~/.npmrc`.
+
+To publish locally instead (no CI, or GitHub is unreachable that minute):
+
+```bash
+npm publish            # publishConfig pins the registry to npmjs; prepublishOnly runs the tests
+git push --follow-tags # push the tag too, or CI has no record of this release
+```
+
+After a manual publish, the CI path hits the skip branch in step 2 and will not publish twice.
+
 ## Distillation, measured (real runs, not estimates)
 
 With `deepseek-chat` via `npm run live`:

package/README.md

@@ -2,7 +2,7 @@
 
 [English](README.en.md) · 中文
 
-[![test](https://github.com/ilaomianyang/dsh-memory-graph/actions/workflows/test.yml/badge.svg)](https://github.com/ilaomianyang/dsh-memory-graph/actions/workflows/test.yml)
+[![npm](https://img.shields.io/npm/v/@ilaomianyang/dsh-memory-graph?label=npm)](https://www.npmjs.com/package/@ilaomianyang/dsh-memory-graph) [![test](https://github.com/ilaomianyang/dsh-memory-graph/actions/workflows/test.yml/badge.svg)](https://github.com/ilaomianyang/dsh-memory-graph/actions/workflows/test.yml)
 
 给 DeepSeek Harness 的**长期联想记忆**插件。上下文压缩会把东西真的抹掉；这个插件在上下文之外留一层持久的、可读的、属于你自己的记忆。
 
@@ -376,7 +376,7 @@ Harness 会把运行时快照、技能目录、时间戳、审批通知、压缩
 零依赖，不联网，不碰真实记忆库：
 
 ```bash
-npm test        # 43 + 13 + 35 + 12 + 22 + 54 + 15 + 7 + 11 + 19 = 231 项检查，另加 25 题检索评测
+npm test        # 43 + 13 + 35 + 12 + 22 + 54 + 15 + 8 + 11 + 19 = 232 项检查，另加 25 题检索评测
 npm run eval    # 只跑检索评测（离线，确定性的）
 ```
 
@@ -402,6 +402,37 @@ npm run live:supersede   # 真模型：先记一条，再让它被"更正"推翻
 
 它们从 `~/.dsh/.credentials.yaml` 或环境变量取 key（见下文），不写死、不落盘。这两个脚本跑在普通 `node` 进程里，没有 Harness 的 `llm` 服务可借，所以它们显式用 `transport: 'http'`；插件自己在界面里默认走 harness。
 
+## 发布
+
+版本号只有一个来源：`package.json` 的 `version`。发一个版本就等于打一个 tag：
+
+```bash
+npm run release        # = npm version patch（先跑测试）→ 提交 → tag → git push --follow-tags
+npm version minor -m "chore(release): v%s" && git push --follow-tags   # minor / major 换这个写法
+```
+
+推上去的 tag 会触发 `.github/workflows/publish.yml`，它只做四件事：
+
+1. 核对 tag 和 `package.json` 的版本号——不一致就失败，不会发出一个版本号对不上的包；
+2. 查这个版本是不是已经在注册表上——在就跳过，重推同一个 tag 是空操作而不是报错；
+3. `npm publish --provenance --access public`（`prepublishOnly` 会再跑一遍那 232 项，红的进不去）；
+4. npm 页面上多一条「Built and signed on GitHub Actions」，证明这个 tarball 是从这个仓库的这个提交构建的。
+
+凭据有两条路，工作流两条都认（有 `NPM_TOKEN` 就用它，没有就走 OIDC）：
+
+**一、Trusted publishing——推荐，仓库里不存任何密钥。** npm 把这条当正路，同时正在把「绕过 2FA 的 token」收掉（npm 的公告：账号类操作 2026 年 8 月起限制，直接发布 2027 年 1 月起禁用）。在包页面上：**Package → Settings → Trusted publishing → Add a publisher → GitHub Actions**，repository 填 `ilaomianyang/dsh-memory-graph`，workflow 填 `publish.yml`，environment 留空。之后 CI 用这次运行的 OIDC 身份发布，`--provenance` 自动带上。
+
+**二、`NPM_TOKEN`——今天就能用，过渡方案。** npmjs.com → Access Tokens → Generate New Token，选 **Granular Access Token**：勾上 **Bypass two-factor authentication (2FA)**，Permissions 选 **Read and write (publish and stage)**（如果出现选包的地方，只勾这一个包），Expiration 别留默认的 30 天。然后加到仓库：Settings → Secrets and variables → Actions → New repository secret，名字 `NPM_TOKEN`。账号开着 2FA 时，普通的 Publish token 会被 `403 ... two-factor authentication ... required to publish` 挡回来，只有勾了 bypass 的发得出去。这个 token 只给 CI 用，别写进 `~/.npmrc`。
+
+不想等 CI、或者 GitHub 那一刻连不上，就在本地发：
+
+```bash
+npm publish            # publishConfig 已经把 registry 钉在 npmjs，prepublishOnly 会跑测试
+git push --follow-tags # 别忘推 tag，否则 CI 里没有这次发布的记录
+```
+
+手动发过之后，CI 那条会命中第 2 步的跳过分支，不会再发一次。
+
 ## 蒸馏实测（真模型跑过，不是估计）
 
 用 `deepseek-chat`，`npm run live`：

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ilaomianyang/dsh-memory-graph",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "type": "module",
   "author": "ISKING <admin@isking.cc>",
   "repository": {
@@ -52,7 +52,9 @@
     "live": "node test/live.mjs",
     "live:supersede": "node test/live-supersede.mjs",
     "check": "node --check index.js",
-    "prepublishOnly": "npm test"
+    "preversion": "npm test",
+    "prepublishOnly": "npm test",
+    "release": "npm version patch -m \"chore(release): v%s\" && git push --follow-tags"
   },
   "dsh": {
     "bundle": {