dsh-memory-nebula 1.1.2 → 1.1.3

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 本文件记录「记忆星图」每个版本改了什么。日期为落盘日期。
 
+## 1.1.3 — 2026-11-11
+
+主题「门面」：让别人能找得到、看得懂、敢报问题。
+
+- `package.json` 补齐 `repository` / `homepage` / `bugs`，描述改为中英双句，
+  关键词补 `dsh`、`memory-graph`、`knowledge-graph`、`offline-snapshot`。
+- GitHub Actions CI：Node 22.13 与 24 双矩阵，跑 `npm test` 与 `npm run check`。
+- 新增 `SECURITY.md`（只读边界、loopback/Origin/CSP、`/share` 数据出口、
+  private advisory）与 `CONTRIBUTING.md`（无依赖、测试命令、文案/测试/版本约定）。
+- README 与 README.en 顶部加 CI、npm、license badge。
+- 市场索引与 unpkg 地址推到 1.1.3，安装名/TGZ 名同步。
+
 ## 1.1.2 — 2026-11-10
 
 主题「换个门牌」：市场索引从 jsDelivr 换到 unpkg。

package/CONTRIBUTING.md

@@ -0,0 +1,48 @@
+# Contributing
+
+Thanks for looking. This is a small, dependency-free plugin, and the fastest
+way to keep it healthy is to run the same checks CI runs.
+
+## Setup
+
+- Node.js 22.13 or newer (CI covers 22.13 and 24).
+- No install step: the package has no runtime or dev dependencies.
+- The repo is the plugin source. To try it inside DSH, point a profile at this
+  directory or install the packed tarball; see `docs/distribution.md`.
+
+## Before opening a pull request
+
+```bash
+npm test          # node --test "test/*.test.mjs"
+npm run check     # static release checks (version, UTF-8, links, assets)
+```
+
+For HTTP or UI changes, also start the standalone engine and run the smoke
+tests:
+
+```bash
+node lib/standalone.mjs --port 7891 --root <a-memory-root>
+node scripts/smoke.mjs http://127.0.0.1:7891/api/memory-nebula
+```
+
+If you change the market index or locale files, keep the package version and
+`market/index.json` version in sync; `test/market.test.mjs` enforces it.
+
+## Rules of the house
+
+- Read-only toward memory stores. Never write into `~/.dsh-meow`, OpenViking
+  directories, or user notes.
+- No new runtime dependencies without a strong reason; the single-file
+  snapshot and offline story depend on shipping everything ourselves.
+- Keep UI strings in `lib/web/i18n.js`; Chinese is the source text. If you add
+  a visible string, add the English entry and run `dev/check-i18n.mjs`.
+- Add a test for behavior changes. A bug fix without a regression test will
+  usually be asked for one.
+- Keep commits focused. Update `CHANGELOG.md` for user-visible changes and bump
+  the version only when preparing a release.
+
+## Reporting bugs
+
+Open an issue with the version, platform, and the diagnostics report from
+`?` → “复制诊断” (it contains no memory text or local paths). For security
+issues use `SECURITY.md`, not a public issue.

package/README.en.md

@@ -1,5 +1,9 @@
 # Memory Nebula · memory-nebula
 
+[![CI](https://github.com/hanhan9999999999999999999/dsh-memory-nebula/actions/workflows/ci.yml/badge.svg)](https://github.com/hanhan9999999999999999999/dsh-memory-nebula/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/dsh-memory-nebula.svg)](https://www.npmjs.com/package/dsh-memory-nebula)
+[![license](https://img.shields.io/npm/l/dsh-memory-nebula.svg)](LICENSE)
+
 A DSH plugin that pulls memories out of every workspace **and every memory plugin**, turns them into a **nebula of evidence-backed connections**, and lets both you and the AI follow those connections the way neurons do.
 
 ![Memory Nebula: three views, filters, evidence chains](./docs/assets/preview.png)
@@ -49,7 +53,7 @@ Export the whole graph (text included) as one self-contained HTML for offline re
 ## Quick start
 
 From the plugin market (recommended): add the index
-`https://unpkg.com/dsh-memory-nebula@1.1.2/market/index.json` under
+`https://unpkg.com/dsh-memory-nebula@1.1.3/market/index.json` under
 Plugins → Discover, search for “Memory Nebula”, and install. Run the doctor in step 2.5 afterwards.
 
 Or install from this checkout:
@@ -57,7 +61,7 @@ Or install from this checkout:
 ```powershell
 # 1) link the plugin (either way)
 New-Item -ItemType Junction -Path "<profile>\node_modules\dsh-memory-nebula" -Target "<plugin>"
-npm install <path>\dsh-memory-nebula-1.1.2.tgz --prefix <profile>
+npm install <path>\dsh-memory-nebula-1.1.3.tgz --prefix <profile>
 
 # 2) profile package.json: add the dependency AND the bundle
 #    dependencies:        "dsh-memory-nebula": "file:../../plugins/dsh-memory-nebula"
@@ -83,7 +87,7 @@ The page probes `/ping` on both legs and picks the newer `build`; a banner expla
 Self-checks:
 
 ```bash
-npm test                 # 84 unit assertions
+npm test                 # 87 unit assertions
 npm run check            # static release check
 node scripts/smoke.mjs   # 63 contract assertions against a live instance
 ```
@@ -113,8 +117,10 @@ Adapter contract and every `sources.json` field: [docs/adapters.md](docs/adapter
 | [docs/operations.md](docs/operations.md) | Read-only boundary, install, hot reload, known limits |
 | [docs/release.md](docs/release.md) | Release checklist, versioning, packaging, rollback |
 | [docs/compatibility.md](docs/compatibility.md) | Verified OS/Node/browser matrix, explicit non-support |
-| [docs/distribution.md](docs/distribution.md) | Install/upgrade/rollback/uninstall, support flow, marketplace copy |
-| [docs/testing.md](docs/testing.md) | 84 unit tests, 63 smoke checks, 21 security probes, browser probes |
+| [docs/distribution.md](docs/distribution.md) | Install/upgrade/rollback/uninstall, support flow, marketplace copy |
+| [SECURITY.md](SECURITY.md) | Read-only boundary, HTTP protections and vulnerability reporting |
+| [CONTRIBUTING.md](CONTRIBUTING.md) | Local development, test commands and contribution rules |
+| [docs/testing.md](docs/testing.md) | 87 unit tests, 63 smoke checks, 21 security probes, browser probes |
 | [docs/roadmap.md](docs/roadmap.md) | From 0.5 to 1.0: scoped sharing, first-run guidance, 10k-node performance, i18n and release support |
 | [CHANGELOG.md](CHANGELOG.md) | Version history |
 
@@ -136,7 +142,7 @@ lib/
 scripts/smoke.mjs     63 read-only contract checks
 scripts/release-check.mjs  static release check
 scripts/bench.mjs     10k benchmark (build / recall / hygiene / snapshot / memory)
-test/                 node:test unit suite (84 assertions)
+test/                 node:test unit suite (87 assertions)
 ```
 
 ## Privacy and security
@@ -148,4 +154,4 @@ test/                 node:test unit suite (84 assertions)
 
 ## Version
 
-`1.1.2`, MIT. Front-end changes apply on refresh; everything under `lib/host/` is hot-reloaded, while `http.js` / `index.js` / `live.js` need a DSH restart (or the standalone engine).
+`1.1.3`, MIT. Front-end changes apply on refresh; everything under `lib/host/` is hot-reloaded, while `http.js` / `index.js` / `live.js` need a DSH restart (or the standalone engine).

package/README.md

@@ -1,5 +1,9 @@
 # 记忆星图 · memory-nebula
 
+[![CI](https://github.com/hanhan9999999999999999999/dsh-memory-nebula/actions/workflows/ci.yml/badge.svg)](https://github.com/hanhan9999999999999999999/dsh-memory-nebula/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/dsh-memory-nebula.svg)](https://www.npmjs.com/package/dsh-memory-nebula)
+[![license](https://img.shields.io/npm/l/dsh-memory-nebula.svg)](LICENSE)
+
 [English](README.en.md) · 在 DSH 里把散落在各个工作区、各个记忆插件里的记忆抽出来，算成一张**带证据的关联星云**，再从这张图上做「神经元式」的连带检索——以及，让别的插件注入了什么，星图就顺着连接补上它没注的那一半。
 
 ![记忆星图：三种视图、左栏筛选、证据链与详情](./docs/assets/preview.png)
@@ -73,7 +77,7 @@
 已经装好的机器上（`profiles/desktop`），只要打开「记忆星图」页面就有一张图；页面每 12 秒比一次 `sig`，别的会话写了新记忆会自动长出新星点。库里还没有记忆时，页面会给三条接入路径，也可以先点「看示例」；`…/memory-nebula/?demo=1` 可直达示例星系，逛完退出不会动真实库。
 
 从插件市场装（推荐）：在 DSH 的「插件 → 发现」里添加索引
-`https://unpkg.com/dsh-memory-nebula@1.1.2/market/index.json`，搜索「记忆星图」安装。
+`https://unpkg.com/dsh-memory-nebula@1.1.3/market/index.json`，搜索「记忆星图」安装。
 装完按下面的 2.5 跑一次 doctor。
 
 也可以从仓库装到 DSH：
@@ -81,7 +85,7 @@
 ```powershell
 # 1) 装进 profile（二选一）
 New-Item -ItemType Junction -Path "<profile>\node_modules\dsh-memory-nebula" -Target "<plugin>"
-npm install <path>\dsh-memory-nebula-1.1.2.tgz --prefix <profile>
+npm install <path>\dsh-memory-nebula-1.1.3.tgz --prefix <profile>
 
 # 2) profile 的 package.json 里加依赖与 bundles（只加 dependencies 不会重组）
 #    dependencies:         "dsh-memory-nebula": "file:../../plugins/dsh-memory-nebula"
@@ -107,7 +111,7 @@ node lib/standalone.mjs --port 7890                          # 其它系统，
 自检三条命令：
 
 ```bash
-npm test        # 84 项单元测试
+npm test        # 87 项单元测试
 npm run verify  # 单测 + 发布静态检查（npm pack 的 prepack 会自动再跑）
 node scripts/smoke.mjs   # 63 项接口契约（对运行中的实例）
 ```
@@ -139,10 +143,12 @@ node scripts/smoke.mjs   # 63 项接口契约（对运行中的实例）
 | [docs/operations.md](docs/operations.md) | 只读边界、装卸、已知限制、sidecar、发布信息 |
 | [docs/release.md](docs/release.md) | 发布前检查清单、版本策略、打包/安装/回滚 |
 | [docs/compatibility.md](docs/compatibility.md) | 已验证的平台/Node/浏览器矩阵，以及明确不支持的组合 |
-| [docs/distribution.md](docs/distribution.md) | 安装/升级/回滚/卸载、支持流程、市场文案与发布检查 |
+| [docs/distribution.md](docs/distribution.md) | 安装/升级/回滚/卸载、支持流程、市场文案与发布检查 |
+| [SECURITY.md](SECURITY.md) | 只读边界、HTTP 防护与漏洞报告 |
+| [CONTRIBUTING.md](CONTRIBUTING.md) | 本地开发、测试命令与提交约定 |
 | [docs/verified.md](docs/verified.md) | 每一条结论背后的实测证据 |
 | [docs/architecture.md](docs/architecture.md) | 模块分工、请求路径、不能破的不变量 |
-| [docs/testing.md](docs/testing.md) | 84 项单测、63 项冒烟、21 项安全探针、浏览器探针清单与手工验收 |
+| [docs/testing.md](docs/testing.md) | 87 项单测、63 项冒烟、21 项安全探针、浏览器探针清单与手工验收 |
 | [docs/roadmap.md](docs/roadmap.md) | 从 0.5 到 1.0：切片分享、首访引导、万条性能、国际化与发行支持 |
 | [CHANGELOG.md](CHANGELOG.md) | 版本变更 |
 
@@ -168,7 +174,7 @@ lib/
 scripts/smoke.mjs     只读契约自查（63 项）
 scripts/release-check.mjs  发布静态检查
 scripts/bench.mjs     10k 性能基准（建图 / 检索 / 体检 / 快照 / 内存）
-test/                 node:test 单元测试（84 项）
+test/                 node:test 单元测试（87 项）
 sidecar.ps1           Windows 独立引擎开关
 ```
 
@@ -181,6 +187,6 @@ sidecar.ps1           Windows 独立引擎开关
 
 ## 版本与许可
 
-- 当前版本 `1.1.2`，MIT。
+- 当前版本 `1.1.3`，MIT。
 - 打包内容：`lib/`、`scripts/`、`docs/`、`cordis.patch.yml`、`README.md` / `README.en.md`、`CHANGELOG.md`、`LICENSE`、`sidecar.ps1`（`test/` 与 `dev/` 不进包）。
 - 前端改动刷新页面即生效；`lib/host/` 下所有引擎文件（含 `adapters/`、`bridge.js`、`ledger.js`）由 LiveEngine 热载，`http.js` / `index.js` / `live.js` 改动要重启 DSH 或走独立引擎。

package/SECURITY.md

@@ -0,0 +1,43 @@
+# Security
+
+## What this project touches
+
+`dsh-memory-nebula` reads memory stores on the local machine (meow-memory,
+OpenViking, plain notes, SQLite) and serves a read-only viewer. It never writes
+to those stores. The only writable state is under
+`$DSH_HOME/memory-nebula/` (mutes, manual links, caches, logs, injected-ledger
+files).
+
+The HTTP surface is intended for one local user:
+
+- it binds to loopback only;
+- write routes require a loopback `Origin` and reject cross-site requests;
+- static pages ship a restrictive CSP and `nosniff` / `no-store`;
+- `/share` is the one route that deliberately exports memory **content** as a
+  self-contained HTML file. Treat exported files as plaintext backups.
+
+Do not expose the server to a public network. There is no account system, no
+telemetry, and no upload path.
+
+## Supported versions
+
+Security fixes land on the latest published minor. Older minors are not
+maintained separately.
+
+## Reporting a vulnerability
+
+Please use GitHub's private vulnerability reporting:
+
+<https://github.com/hanhan9999999999999999999/dsh-memory-nebula/security/advisories/new>
+
+Do not open a public issue for a vulnerability. Include the version, the
+affected route or file, and a minimal reproduction when possible. Reports that
+only need a configuration change will be answered with the setting rather than
+a release.
+
+## Out of scope
+
+- running the server on a public interface;
+- a malicious local user who can already read the memory database;
+- exported snapshot files shared by the user;
+- third-party memory adapters that execute their own code.

package/docs/compatibility.md

@@ -1,6 +1,6 @@
 # 兼容矩阵
 
-最后更新：2026-11-10（1.1.2 市场索引改由 unpkg 托管；运行前提未变）
+最后更新：2026-11-11（1.1.3 补仓库元数据、CI 与安全文档；运行前提未变）
 
 这张表只写**真的跑过**的东西。「预期可用」是依据运行前提做的判断，不是实测；
 没有出现的组合就是没有验证，不应当作支持承诺。
@@ -22,7 +22,7 @@
 | 适配器 | meow / notes / sqlite / ingest | 单测 + `sources`/`ingest` 冒烟 |
 | 独立引擎 | `lib/standalone.mjs`，127.0.0.1:7890/7891 | 0.5–0.9 的 `smoke` 与 `--diagnose` |
 | 安装体检 | 真实 desktop profile + 运行中实例 | 1.1.0：9 项全过（含 endpoint ping） |
-| 市场索引 | `@deepseek-ai/dsh-plugin-market-index` format 1 校验 | 1.1.2：unpkg 索引 200，`parseMarketIndex` 通过，图标/详情/图片可解析 |
+| 市场索引 | `@deepseek-ai/dsh-plugin-market-index` format 1 校验 | 1.1.3：unpkg 索引 200，`parseMarketIndex` 通过，图标/详情/图片可解析 |
 
 ## 预期可用，但未实测
 

package/docs/distribution.md

@@ -6,7 +6,7 @@
 ## 包是什么
 
 - npm 包名：`dsh-memory-nebula`
-- 当前版本：`1.1.1`
+- 当前版本：`1.1.3`
 - 形态：DSH 插件（`cordis.patch.yml` + `lib/client.js`）与独立引擎（`lib/standalone.mjs`）共用一套代码
 - 许可：MIT；没有授权锁、没有遥测、不会把记忆上传到任何服务器
 - 包内容：`lib/`、`scripts/`、`docs/`、`cordis.patch.yml`、`README.md` / `README.en.md`、
@@ -19,26 +19,26 @@
 在「插件 → 发现」里添加索引：
 
 ```text
-https://unpkg.com/dsh-memory-nebula@1.1.2/market/index.json
+https://unpkg.com/dsh-memory-nebula@1.1.3/market/index.json
 ```
 
-搜索「记忆星图」安装。索引与详情页都在 npm 包里，由 jsDelivr 提供；不需要第二个站点。
+搜索「记忆星图」安装。索引与详情页都在 npm 包里，由 unpkg 提供；不需要第二个站点。
 条目声明 `engines.dsh >= 0.2.2-rc.1`，更老的 DSH 会显示不兼容而不是装完才崩。
 
 ### 从 tgz（离线/客户机器）
 
 ```powershell
 # Windows PowerShell
-Get-FileHash .\dsh-memory-nebula-1.1.2.tgz -Algorithm SHA256
+Get-FileHash .\dsh-memory-nebula-1.1.3.tgz -Algorithm SHA256
 # 对照同目录的 .sha256 文件；不一致就停，不要装
 
-npm install .\dsh-memory-nebula-1.1.2.tgz --prefix <profile>
+npm install .\dsh-memory-nebula-1.1.3.tgz --prefix <profile>
 ```
 
 ```bash
 # macOS / Linux
-sha256sum -c dsh-memory-nebula-1.1.2.tgz.sha256
-npm install ./dsh-memory-nebula-1.1.2.tgz --prefix <profile>
+sha256sum -c dsh-memory-nebula-1.1.3.tgz.sha256
+npm install ./dsh-memory-nebula-1.1.3.tgz --prefix <profile>
 ```
 
 然后确认 `<profile>/package.json` 里两处都在：
@@ -129,7 +129,7 @@ Remove-Item -Recurse -Force "$env:USERPROFILE\.dsh\memory-nebula"
 npm run verify          # 单测 + release-check；prepack 也会跑
 node scripts/smoke.mjs http://127.0.0.1:7891/api/memory-nebula
 npm pack                # 生成 tgz
-sha256sum dsh-memory-nebula-1.1.2.tgz > dsh-memory-nebula-1.1.2.tgz.sha256
+sha256sum dsh-memory-nebula-1.1.3.tgz > dsh-memory-nebula-1.1.3.tgz.sha256
 npm publish             # 需要维护者账号；本仓库不自动发布
 ```
 

package/docs/http-api.md

@@ -17,7 +17,7 @@
 ```json
 {
   "ok": true,
-  "version": "1.1.2",
+  "version": "1.1.3",
   "build": 1794143336695,
   "startedAt": 1794143336695,
   "mode": "host",
@@ -47,7 +47,7 @@
 ```text
 memory-nebula diagnostics
 # 不含记忆正文；可以整段贴给支持
-version: 1.1.2
+version: 1.1.3
 build: 1794276294467
 started: 2026-11-10T02:20:37.399Z
 mode: standalone

package/docs/market.en.md

@@ -78,13 +78,13 @@ Above 3,000 memories it stays in the 2D nebula and asks you to filter before swi
 Add this index in the DSH plugin market:
 
 ```text
-https://unpkg.com/dsh-memory-nebula@1.1.2/market/index.json
+https://unpkg.com/dsh-memory-nebula@1.1.3/market/index.json
 ```
 
 Then search for “Memory Nebula” and install. Or install the npm package directly:
 
 ```bash
-npm install dsh-memory-nebula@1.1.2
+npm install dsh-memory-nebula@1.1.3
 ```
 
 Run the read-only doctor after installing:

package/docs/market.zh.md

@@ -78,13 +78,13 @@ Shift 点第二个节点，会找两点之间的**证据链**：每一跳是哪
 在 DSH 的插件市场里添加索引：
 
 ```text
-https://unpkg.com/dsh-memory-nebula@1.1.2/market/index.json
+https://unpkg.com/dsh-memory-nebula@1.1.3/market/index.json
 ```
 
 然后搜索「记忆星图」安装。也可以直接装 npm 包：
 
 ```bash
-npm install dsh-memory-nebula@1.1.2
+npm install dsh-memory-nebula@1.1.3
 ```
 
 装完先体检：

package/docs/operations.md

@@ -68,7 +68,7 @@ memory-nebula --help          # 装成 bin 之后
 
 ## 发布信息
 
-- 版本 `1.1.2`，`license: MIT`，无运行时依赖。
+- 版本 `1.1.3`，`license: MIT`，无运行时依赖。
 - `files`：`lib/`、`cordis.patch.yml`、`README.md`、`README.en.md`、`docs/`、`CHANGELOG.md`、
   `LICENSE`、`scripts/`、`sidecar.ps1`。
 - 装完先体检：`node scripts/doctor.mjs --profile <profile> [--root DIR] [--base URL] [--json]`；

package/docs/release.md

@@ -21,7 +21,7 @@ cd <plugin>
 # 1. 语法与静态检查（版本一致、UTF-8、import、死文件、CORS、document.write…）
 npm run check
 
-# 2. 单元测试（84 项，纯函数 + 契约）
+# 2. 单元测试（87 项，纯函数 + 契约）
 npm test
 
 # 3. 起一个干净实例，跑接口契约（63 项）
@@ -62,6 +62,7 @@ npm pack                       # 生成 dsh-memory-nebula-<version>.tgz
 1.1.2 实测：**72 个文件**，包 2.3 MB、解开 2.9 MB（`docs/assets/` 的预览图与基准脚本占大头）。
 干净目录安装后 `--version` = 1.1.2，导出 `apply,inject,name,version`；
 安装包起 7896 实测 `/share?scope=ws:DSHLive2D&hide=level:lesson` → 200、601,177 字节。
+1.1.3 起包内多了 `SECURITY.md` 与 `CONTRIBUTING.md`，`.github/` 不进包；文件数与体积以 `npm pack` 的输出为准（不要手写进文档，否则每次改文档都要重打包）。
 清单里应含 `sidecar.ps1`、`scripts/`、`test/` 不含（单测只在仓库里跑）、`dev/` 与截图不含。
 
 装进 DSH profile（与 `docs/operations.md` 的 junction 方式二选一）：

package/docs/verified.md

@@ -2,6 +2,14 @@
 
 > 下面的数字都是**当时实测**的值，记录的是「这个结论被什么证据支撑过」，不是当前规模——记忆每天在长，规模类数字请以 `node scripts/smoke.mjs` 和界面顶栏为准。
 
+## 1.1.3（2026-11-11）门面
+
+- **包元数据**：`package.json` 有 `repository` / `homepage` / `bugs`，描述中英双句，13 个关键词；`npm pack` 后从 tarball 解出的 manifest 同样带这些字段。
+- **CI**：`.github/workflows/ci.yml` 矩阵 Node 22.13.0 / 24，跑 `npm test` 与 `npm run check`；本机等价命令通过（87/87、release-check 全绿），GitHub 首次运行在推送后确认。
+- **政策文件**：`SECURITY.md`（只读边界、loopback/Origin/CSP、`/share` 是正文出口、private advisory）与 `CONTRIBUTING.md`（无依赖、测试命令、文案/测试/版本约定）已进包。
+- **回归**：87/87 单测；release-check v1.1.3 全绿（143 文本 / 69 脚本 / 23 Markdown 链接，含 1.1.3 构件断言）。
+- **README**：中英顶部都有 CI / npm / license badge，文档表补 SECURITY/CONTRIBUTING 两行。
+
 ## 1.1.2（2026-11-10）换个门牌
 
 - **CDN 选择**：本机 `curl` 与 Node fetch 访问 jsDelivr 均为 `ECONNRESET`；unpkg 的 Node fetch 200。

package/lib/web/app.js

@@ -1,7 +1,7 @@
 /* 记忆星图 —— 界面逻辑
    数据：/api/memory-nebula/*（同源）。渲染交给 render.js。 */
 ;(function () {
-  const APP_VERSION = '1.1.2'  // 和 package.json 同步（release-check 会核对）
+  const APP_VERSION = '1.1.3'  // 和 package.json 同步（release-check 会核对）
   'use strict'
   /** 中文即源文：英文模式查 i18n.js 的表，查不到就原样返回中文。 */
   const T = (zh, vars) => (window.NebulaI18n ? window.NebulaI18n.t(zh, vars) : zh)

package/market/index.json

@@ -86,8 +86,8 @@
       },
       "versions": [
         {
-          "version": "1.1.2",
-          "publishTimestamp": 1794324000,
+          "version": "1.1.3",
+          "publishTimestamp": 1794332116,
           "source": {
             "type": "npm"
           },

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "dsh-memory-nebula",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "private": false,
-  "description": "记忆星图 Memory Nebula —— 把 DSH 里所有记忆插件的记忆只读抽取出来，连成一张可交互的神经元星云；并提供跨项目记忆的扩散检索（spreading activation）。",
+  "description": "Local-first memory nebula for DeepSeek Harness — read-only graph, spreading recall, evidence chains, offline snapshots. 记忆星图：把 DSH 各工作区的记忆只读连成一张可交互星云。",
   "type": "module",
   "main": "lib/index.js",
   "bin": {
@@ -26,7 +26,9 @@
     "scripts",
     "sidecar.ps1",
     "locale",
-    "market"
+    "market",
+    "SECURITY.md",
+    "CONTRIBUTING.md"
   ],
   "scripts": {
     "test": "node --test \"test/*.test.mjs\"",
@@ -64,7 +66,19 @@
     "relational-memory",
     "spreading-activation",
     "memory-adapter",
-    "visualization"
+    "visualization",
+    "dsh",
+    "memory-graph",
+    "knowledge-graph",
+    "offline-snapshot"
   ],
-  "author": "主人 & 小代码酱"
+  "author": "主人 & 小代码酱",
+  "homepage": "https://github.com/hanhan9999999999999999999/dsh-memory-nebula#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hanhan9999999999999999999/dsh-memory-nebula.git"
+  },
+  "bugs": {
+    "url": "https://github.com/hanhan9999999999999999999/dsh-memory-nebula/issues"
+  }
 }

package/scripts/release-check.mjs

@@ -243,7 +243,20 @@ if (!read('docs/market.zh.md').includes(`dsh-memory-nebula@${pkg.version}`)) fai
 if (!read('docs/market.zh.md').includes('https://unpkg.com/')) fail('中文详情没走 unpkg 索引')
 if (!read('docs/market.en.md').includes('https://unpkg.com/')) fail('英文详情没走 unpkg 索引')
 if (!pkg.files?.includes('market') || !pkg.files?.includes('locale')) fail('package.json files 没带 market/locale')
-ok('1.1.2 构件：市场索引 / unpkg / 双语详情 / 图标')
+ok('1.1.2 构件：市场索引 / unpkg / 双语详情 / 图标')
+
+const ciSrc = read('.github/workflows/ci.yml')
+if (!ciSrc.includes("'22.13.0'") || !ciSrc.includes("'24'")) fail('CI 矩阵缺 Node 22.13/24')
+if (!ciSrc.includes('npm run check')) fail('CI 没跑 release-check')
+if (!pkg.repository?.url?.includes('github.com/hanhan9999999999999999999/dsh-memory-nebula')) fail('package.json 缺 repository')
+if (!pkg.homepage?.includes('github.com/hanhan9999999999999999999/dsh-memory-nebula')) fail('package.json 缺 homepage')
+if (!pkg.bugs?.url?.endsWith('/issues')) fail('package.json 缺 bugs.url')
+if (!read('SECURITY.md').includes('private vulnerability reporting')) fail('SECURITY.md 缺报告入口')
+if (!read('CONTRIBUTING.md').includes('npm run check')) fail('CONTRIBUTING.md 缺检查命令')
+if (!read('README.md').includes('actions/workflows/ci.yml/badge.svg')) fail('README.md 缺 CI badge')
+if (!pkg.files?.includes('SECURITY.md') || !pkg.files?.includes('CONTRIBUTING.md')) fail('package.json files 没带政策文档')
+ok('1.1.3 构件：仓库元数据 / CI / 安全与贡献文档')
+
 
 
 console.log(`\n发布检查：${pkg.name} v${pkg.version}\n`)