dsh-memory-nebula 1.1.2 → 1.1.4

package/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 本文件记录「记忆星图」每个版本改了什么。日期为落盘日期。
 
+## 1.1.4 — 2026-11-11
+
+主题「对齐」：装上了新代码，跑的还是旧宿主——这件事要自己说出来。
+
+- `doctor` 新增版本漂移检查：`--base` 探测到的宿主版本与本地包版本不一致时给
+  `[warn] version: installed 1.1.4, running host 1.1.0`，并提示「重启 DSH」，
+  不再让一份全绿的体检报告掩盖「升级没生效」。
+- `checkEndpoint` 保留响应里的版本号；`checkVersionDrift` 可独立测试，空值/相同版本不报。
+- CI 增加 `Package install` job：从 `npm pack` 的 tgz 安装，比对 `--version`，
+  跑 `doctor --help`，并检查包内包含 `SECURITY.md` / `CONTRIBUTING.md`、不夹带 `dev/`。
+- 单测 87 → 88；真机验证 1.1.4 前端在 1.1.0 宿主上可读、可搜、可开详情，
+  doctor 明确给出 `9 通过 / 1 提醒 / 0 失败`。
+
+## 1.1.3 — 2026-11-11
+
+主题「门面」：让别人能找得到、看得懂、敢报问题。
+
+- `package.json` 补齐 `repository` / `homepage` / `bugs`，描述改为中英双句，
+  关键词补 `dsh`、`memory-graph`、`knowledge-graph`、`offline-snapshot`。
+- GitHub Actions CI：Node 22.13 与 24 双矩阵，跑 `npm test` 与 `npm run check`。
+- 新增 `SECURITY.md`（只读边界、loopback/Origin/CSP、`/share` 数据出口、
+  private advisory）与 `CONTRIBUTING.md`（无依赖、测试命令、文案/测试/版本约定）。
+- README 与 README.en 顶部加 CI、npm、license badge。
+- 市场索引与 unpkg 地址推到 1.1.3，安装名/TGZ 名同步。
+
 ## 1.1.2 — 2026-11-10
 
 主题「换个门牌」：市场索引从 jsDelivr 换到 unpkg。

package/CONTRIBUTING.md

@@ -0,0 +1,48 @@
+# Contributing
+
+Thanks for looking. This is a small, dependency-free plugin, and the fastest
+way to keep it healthy is to run the same checks CI runs.
+
+## Setup
+
+- Node.js 22.13 or newer (CI covers 22.13 and 24).
+- No install step: the package has no runtime or dev dependencies.
+- The repo is the plugin source. To try it inside DSH, point a profile at this
+  directory or install the packed tarball; see `docs/distribution.md`.
+
+## Before opening a pull request
+
+```bash
+npm test          # node --test "test/*.test.mjs"
+npm run check     # static release checks (version, UTF-8, links, assets)
+```
+
+For HTTP or UI changes, also start the standalone engine and run the smoke
+tests:
+
+```bash
+node lib/standalone.mjs --port 7891 --root <a-memory-root>
+node scripts/smoke.mjs http://127.0.0.1:7891/api/memory-nebula
+```
+
+If you change the market index or locale files, keep the package version and
+`market/index.json` version in sync; `test/market.test.mjs` enforces it.
+
+## Rules of the house
+
+- Read-only toward memory stores. Never write into `~/.dsh-meow`, OpenViking
+  directories, or user notes.
+- No new runtime dependencies without a strong reason; the single-file
+  snapshot and offline story depend on shipping everything ourselves.
+- Keep UI strings in `lib/web/i18n.js`; Chinese is the source text. If you add
+  a visible string, add the English entry and run `dev/check-i18n.mjs`.
+- Add a test for behavior changes. A bug fix without a regression test will
+  usually be asked for one.
+- Keep commits focused. Update `CHANGELOG.md` for user-visible changes and bump
+  the version only when preparing a release.
+
+## Reporting bugs
+
+Open an issue with the version, platform, and the diagnostics report from
+`?` → “复制诊断” (it contains no memory text or local paths). For security
+issues use `SECURITY.md`, not a public issue.

package/README.en.md

@@ -1,5 +1,9 @@
 # Memory Nebula · memory-nebula
 
+[![CI](https://github.com/hanhan9999999999999999999/dsh-memory-nebula/actions/workflows/ci.yml/badge.svg)](https://github.com/hanhan9999999999999999999/dsh-memory-nebula/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/dsh-memory-nebula.svg)](https://www.npmjs.com/package/dsh-memory-nebula)
+[![license](https://img.shields.io/npm/l/dsh-memory-nebula.svg)](LICENSE)
+
 A DSH plugin that pulls memories out of every workspace **and every memory plugin**, turns them into a **nebula of evidence-backed connections**, and lets both you and the AI follow those connections the way neurons do.
 
 ![Memory Nebula: three views, filters, evidence chains](./docs/assets/preview.png)
@@ -49,7 +53,7 @@ Export the whole graph (text included) as one self-contained HTML for offline re
 ## Quick start
 
 From the plugin market (recommended): add the index
-`https://unpkg.com/dsh-memory-nebula@1.1.2/market/index.json` under
+`https://unpkg.com/dsh-memory-nebula@1.1.4/market/index.json` under
 Plugins → Discover, search for “Memory Nebula”, and install. Run the doctor in step 2.5 afterwards.
 
 Or install from this checkout:
@@ -57,7 +61,7 @@ Or install from this checkout:
 ```powershell
 # 1) link the plugin (either way)
 New-Item -ItemType Junction -Path "<profile>\node_modules\dsh-memory-nebula" -Target "<plugin>"
-npm install <path>\dsh-memory-nebula-1.1.2.tgz --prefix <profile>
+npm install <path>\dsh-memory-nebula-1.1.4.tgz --prefix <profile>
 
 # 2) profile package.json: add the dependency AND the bundle
 #    dependencies:        "dsh-memory-nebula": "file:../../plugins/dsh-memory-nebula"
@@ -83,7 +87,7 @@ The page probes `/ping` on both legs and picks the newer `build`; a banner expla
 Self-checks:
 
 ```bash
-npm test                 # 84 unit assertions
+npm test                 # 88 unit assertions
 npm run check            # static release check
 node scripts/smoke.mjs   # 63 contract assertions against a live instance
 ```
@@ -114,7 +118,9 @@ Adapter contract and every `sources.json` field: [docs/adapters.md](docs/adapter
 | [docs/release.md](docs/release.md) | Release checklist, versioning, packaging, rollback |
 | [docs/compatibility.md](docs/compatibility.md) | Verified OS/Node/browser matrix, explicit non-support |
 | [docs/distribution.md](docs/distribution.md) | Install/upgrade/rollback/uninstall, support flow, marketplace copy |
-| [docs/testing.md](docs/testing.md) | 84 unit tests, 63 smoke checks, 21 security probes, browser probes |
+| [SECURITY.md](SECURITY.md) | Read-only boundary, HTTP protections and vulnerability reporting |
+| [CONTRIBUTING.md](CONTRIBUTING.md) | Local development, test commands and contribution rules |
+| [docs/testing.md](docs/testing.md) | 88 unit tests, 63 smoke checks, 21 security probes, browser probes |
 | [docs/roadmap.md](docs/roadmap.md) | From 0.5 to 1.0: scoped sharing, first-run guidance, 10k-node performance, i18n and release support |
 | [CHANGELOG.md](CHANGELOG.md) | Version history |
 
@@ -136,7 +142,7 @@ lib/
 scripts/smoke.mjs     63 read-only contract checks
 scripts/release-check.mjs  static release check
 scripts/bench.mjs     10k benchmark (build / recall / hygiene / snapshot / memory)
-test/                 node:test unit suite (84 assertions)
+test/                 node:test unit suite (88 assertions)
 ```
 
 ## Privacy and security
@@ -148,4 +154,4 @@ test/                 node:test unit suite (84 assertions)
 
 ## Version
 
-`1.1.2`, MIT. Front-end changes apply on refresh; everything under `lib/host/` is hot-reloaded, while `http.js` / `index.js` / `live.js` need a DSH restart (or the standalone engine).
+`1.1.4`, MIT. Front-end changes apply on refresh; everything under `lib/host/` is hot-reloaded, while `http.js` / `index.js` / `live.js` need a DSH restart (or the standalone engine).

package/README.md

@@ -1,5 +1,9 @@
 # 记忆星图 · memory-nebula
 
+[![CI](https://github.com/hanhan9999999999999999999/dsh-memory-nebula/actions/workflows/ci.yml/badge.svg)](https://github.com/hanhan9999999999999999999/dsh-memory-nebula/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/dsh-memory-nebula.svg)](https://www.npmjs.com/package/dsh-memory-nebula)
+[![license](https://img.shields.io/npm/l/dsh-memory-nebula.svg)](LICENSE)
+
 [English](README.en.md) · 在 DSH 里把散落在各个工作区、各个记忆插件里的记忆抽出来，算成一张**带证据的关联星云**，再从这张图上做「神经元式」的连带检索——以及，让别的插件注入了什么，星图就顺着连接补上它没注的那一半。
 
 ![记忆星图：三种视图、左栏筛选、证据链与详情](./docs/assets/preview.png)
@@ -73,7 +77,7 @@
 已经装好的机器上（`profiles/desktop`），只要打开「记忆星图」页面就有一张图；页面每 12 秒比一次 `sig`，别的会话写了新记忆会自动长出新星点。库里还没有记忆时，页面会给三条接入路径，也可以先点「看示例」；`…/memory-nebula/?demo=1` 可直达示例星系，逛完退出不会动真实库。
 
 从插件市场装（推荐）：在 DSH 的「插件 → 发现」里添加索引
-`https://unpkg.com/dsh-memory-nebula@1.1.2/market/index.json`，搜索「记忆星图」安装。
+`https://unpkg.com/dsh-memory-nebula@1.1.4/market/index.json`，搜索「记忆星图」安装。
 装完按下面的 2.5 跑一次 doctor。
 
 也可以从仓库装到 DSH：
@@ -81,7 +85,7 @@
 ```powershell
 # 1) 装进 profile（二选一）
 New-Item -ItemType Junction -Path "<profile>\node_modules\dsh-memory-nebula" -Target "<plugin>"
-npm install <path>\dsh-memory-nebula-1.1.2.tgz --prefix <profile>
+npm install <path>\dsh-memory-nebula-1.1.4.tgz --prefix <profile>
 
 # 2) profile 的 package.json 里加依赖与 bundles（只加 dependencies 不会重组）
 #    dependencies:         "dsh-memory-nebula": "file:../../plugins/dsh-memory-nebula"
@@ -107,7 +111,7 @@ node lib/standalone.mjs --port 7890                          # 其它系统，
 自检三条命令：
 
 ```bash
-npm test        # 84 项单元测试
+npm test        # 88 项单元测试
 npm run verify  # 单测 + 发布静态检查（npm pack 的 prepack 会自动再跑）
 node scripts/smoke.mjs   # 63 项接口契约（对运行中的实例）
 ```
@@ -140,9 +144,11 @@ node scripts/smoke.mjs   # 63 项接口契约（对运行中的实例）
 | [docs/release.md](docs/release.md) | 发布前检查清单、版本策略、打包/安装/回滚 |
 | [docs/compatibility.md](docs/compatibility.md) | 已验证的平台/Node/浏览器矩阵，以及明确不支持的组合 |
 | [docs/distribution.md](docs/distribution.md) | 安装/升级/回滚/卸载、支持流程、市场文案与发布检查 |
+| [SECURITY.md](SECURITY.md) | 只读边界、HTTP 防护与漏洞报告 |
+| [CONTRIBUTING.md](CONTRIBUTING.md) | 本地开发、测试命令与提交约定 |
 | [docs/verified.md](docs/verified.md) | 每一条结论背后的实测证据 |
 | [docs/architecture.md](docs/architecture.md) | 模块分工、请求路径、不能破的不变量 |
-| [docs/testing.md](docs/testing.md) | 84 项单测、63 项冒烟、21 项安全探针、浏览器探针清单与手工验收 |
+| [docs/testing.md](docs/testing.md) | 88 项单测、63 项冒烟、21 项安全探针、浏览器探针清单与手工验收 |
 | [docs/roadmap.md](docs/roadmap.md) | 从 0.5 到 1.0：切片分享、首访引导、万条性能、国际化与发行支持 |
 | [CHANGELOG.md](CHANGELOG.md) | 版本变更 |
 
@@ -168,7 +174,7 @@ lib/
 scripts/smoke.mjs     只读契约自查（63 项）
 scripts/release-check.mjs  发布静态检查
 scripts/bench.mjs     10k 性能基准（建图 / 检索 / 体检 / 快照 / 内存）
-test/                 node:test 单元测试（84 项）
+test/                 node:test 单元测试（88 项）
 sidecar.ps1           Windows 独立引擎开关
 ```
 
@@ -181,6 +187,6 @@ sidecar.ps1           Windows 独立引擎开关
 
 ## 版本与许可
 
-- 当前版本 `1.1.2`，MIT。
+- 当前版本 `1.1.4`，MIT。
 - 打包内容：`lib/`、`scripts/`、`docs/`、`cordis.patch.yml`、`README.md` / `README.en.md`、`CHANGELOG.md`、`LICENSE`、`sidecar.ps1`（`test/` 与 `dev/` 不进包）。
 - 前端改动刷新页面即生效；`lib/host/` 下所有引擎文件（含 `adapters/`、`bridge.js`、`ledger.js`）由 LiveEngine 热载，`http.js` / `index.js` / `live.js` 改动要重启 DSH 或走独立引擎。

package/SECURITY.md

@@ -0,0 +1,43 @@
+# Security
+
+## What this project touches
+
+`dsh-memory-nebula` reads memory stores on the local machine (meow-memory,
+OpenViking, plain notes, SQLite) and serves a read-only viewer. It never writes
+to those stores. The only writable state is under
+`$DSH_HOME/memory-nebula/` (mutes, manual links, caches, logs, injected-ledger
+files).
+
+The HTTP surface is intended for one local user:
+
+- it binds to loopback only;
+- write routes require a loopback `Origin` and reject cross-site requests;
+- static pages ship a restrictive CSP and `nosniff` / `no-store`;
+- `/share` is the one route that deliberately exports memory **content** as a
+  self-contained HTML file. Treat exported files as plaintext backups.
+
+Do not expose the server to a public network. There is no account system, no
+telemetry, and no upload path.
+
+## Supported versions
+
+Security fixes land on the latest published minor. Older minors are not
+maintained separately.
+
+## Reporting a vulnerability
+
+Please use GitHub's private vulnerability reporting:
+
+<https://github.com/hanhan9999999999999999999/dsh-memory-nebula/security/advisories/new>
+
+Do not open a public issue for a vulnerability. Include the version, the
+affected route or file, and a minimal reproduction when possible. Reports that
+only need a configuration change will be answered with the setting rather than
+a release.
+
+## Out of scope
+
+- running the server on a public interface;
+- a malicious local user who can already read the memory database;
+- exported snapshot files shared by the user;
+- third-party memory adapters that execute their own code.

package/docs/compatibility.md

@@ -1,6 +1,6 @@
 # 兼容矩阵
 
-最后更新：2026-11-10（1.1.2 市场索引改由 unpkg 托管；运行前提未变）
+最后更新：2026-11-11（1.1.3 补仓库元数据、CI 与安全文档；1.1.4 加医生版本漂移提醒；运行前提未变）
 
 这张表只写**真的跑过**的东西。「预期可用」是依据运行前提做的判断，不是实测；
 没有出现的组合就是没有验证，不应当作支持承诺。
@@ -22,7 +22,7 @@
 | 适配器 | meow / notes / sqlite / ingest | 单测 + `sources`/`ingest` 冒烟 |
 | 独立引擎 | `lib/standalone.mjs`，127.0.0.1:7890/7891 | 0.5–0.9 的 `smoke` 与 `--diagnose` |
 | 安装体检 | 真实 desktop profile + 运行中实例 | 1.1.0：9 项全过（含 endpoint ping） |
-| 市场索引 | `@deepseek-ai/dsh-plugin-market-index` format 1 校验 | 1.1.2：unpkg 索引 200，`parseMarketIndex` 通过，图标/详情/图片可解析 |
+| 市场索引 | `@deepseek-ai/dsh-plugin-market-index` format 1 校验 | 1.1.4：unpkg 索引 200，`parseMarketIndex` 通过，图标/详情/图片可解析 |
 
 ## 预期可用，但未实测
 

package/docs/distribution.md

@@ -6,7 +6,7 @@
 ## 包是什么
 
 - npm 包名：`dsh-memory-nebula`
-- 当前版本：`1.1.1`
+- 当前版本：`1.1.4`
 - 形态：DSH 插件（`cordis.patch.yml` + `lib/client.js`）与独立引擎（`lib/standalone.mjs`）共用一套代码
 - 许可：MIT；没有授权锁、没有遥测、不会把记忆上传到任何服务器
 - 包内容：`lib/`、`scripts/`、`docs/`、`cordis.patch.yml`、`README.md` / `README.en.md`、
@@ -19,26 +19,26 @@
 在「插件 → 发现」里添加索引：
 
 ```text
-https://unpkg.com/dsh-memory-nebula@1.1.2/market/index.json
+https://unpkg.com/dsh-memory-nebula@1.1.4/market/index.json
 ```
 
-搜索「记忆星图」安装。索引与详情页都在 npm 包里，由 jsDelivr 提供；不需要第二个站点。
+搜索「记忆星图」安装。索引与详情页都在 npm 包里，由 unpkg 提供；不需要第二个站点。
 条目声明 `engines.dsh >= 0.2.2-rc.1`，更老的 DSH 会显示不兼容而不是装完才崩。
 
 ### 从 tgz（离线/客户机器）
 
 ```powershell
 # Windows PowerShell
-Get-FileHash .\dsh-memory-nebula-1.1.2.tgz -Algorithm SHA256
+Get-FileHash .\dsh-memory-nebula-1.1.4.tgz -Algorithm SHA256
 # 对照同目录的 .sha256 文件；不一致就停，不要装
 
-npm install .\dsh-memory-nebula-1.1.2.tgz --prefix <profile>
+npm install .\dsh-memory-nebula-1.1.4.tgz --prefix <profile>
 ```
 
 ```bash
 # macOS / Linux
-sha256sum -c dsh-memory-nebula-1.1.2.tgz.sha256
-npm install ./dsh-memory-nebula-1.1.2.tgz --prefix <profile>
+sha256sum -c dsh-memory-nebula-1.1.4.tgz.sha256
+npm install ./dsh-memory-nebula-1.1.4.tgz --prefix <profile>
 ```
 
 然后确认 `<profile>/package.json` 里两处都在：
@@ -129,7 +129,7 @@ Remove-Item -Recurse -Force "$env:USERPROFILE\.dsh\memory-nebula"
 npm run verify          # 单测 + release-check；prepack 也会跑
 node scripts/smoke.mjs http://127.0.0.1:7891/api/memory-nebula
 npm pack                # 生成 tgz
-sha256sum dsh-memory-nebula-1.1.2.tgz > dsh-memory-nebula-1.1.2.tgz.sha256
+sha256sum dsh-memory-nebula-1.1.4.tgz > dsh-memory-nebula-1.1.4.tgz.sha256
 npm publish             # 需要维护者账号；本仓库不自动发布
 ```
 

package/docs/http-api.md

@@ -17,7 +17,7 @@
 ```json
 {
   "ok": true,
-  "version": "1.1.2",
+  "version": "1.1.4",
   "build": 1794143336695,
   "startedAt": 1794143336695,
   "mode": "host",
@@ -47,7 +47,7 @@
 ```text
 memory-nebula diagnostics
 # 不含记忆正文；可以整段贴给支持
-version: 1.1.2
+version: 1.1.4
 build: 1794276294467
 started: 2026-11-10T02:20:37.399Z
 mode: standalone

package/docs/market.en.md

@@ -78,13 +78,13 @@ Above 3,000 memories it stays in the 2D nebula and asks you to filter before swi
 Add this index in the DSH plugin market:
 
 ```text
-https://unpkg.com/dsh-memory-nebula@1.1.2/market/index.json
+https://unpkg.com/dsh-memory-nebula@1.1.4/market/index.json
 ```
 
 Then search for “Memory Nebula” and install. Or install the npm package directly:
 
 ```bash
-npm install dsh-memory-nebula@1.1.2
+npm install dsh-memory-nebula@1.1.4
 ```
 
 Run the read-only doctor after installing:

package/docs/market.zh.md

@@ -78,13 +78,13 @@ Shift 点第二个节点，会找两点之间的**证据链**：每一跳是哪
 在 DSH 的插件市场里添加索引：
 
 ```text
-https://unpkg.com/dsh-memory-nebula@1.1.2/market/index.json
+https://unpkg.com/dsh-memory-nebula@1.1.4/market/index.json
 ```
 
 然后搜索「记忆星图」安装。也可以直接装 npm 包：
 
 ```bash
-npm install dsh-memory-nebula@1.1.2
+npm install dsh-memory-nebula@1.1.4
 ```
 
 装完先体检：

package/docs/operations.md

@@ -68,7 +68,7 @@ memory-nebula --help          # 装成 bin 之后
 
 ## 发布信息
 
-- 版本 `1.1.2`，`license: MIT`，无运行时依赖。
+- 版本 `1.1.4`，`license: MIT`，无运行时依赖。
 - `files`：`lib/`、`cordis.patch.yml`、`README.md`、`README.en.md`、`docs/`、`CHANGELOG.md`、
   `LICENSE`、`scripts/`、`sidecar.ps1`。
 - 装完先体检：`node scripts/doctor.mjs --profile <profile> [--root DIR] [--base URL] [--json]`；

package/docs/release.md

@@ -21,7 +21,7 @@ cd <plugin>
 # 1. 语法与静态检查（版本一致、UTF-8、import、死文件、CORS、document.write…）
 npm run check
 
-# 2. 单元测试（84 项，纯函数 + 契约）
+# 2. 单元测试（88 项，纯函数 + 契约）
 npm test
 
 # 3. 起一个干净实例，跑接口契约（63 项）
@@ -62,6 +62,9 @@ npm pack                       # 生成 dsh-memory-nebula-<version>.tgz
 1.1.2 实测：**72 个文件**，包 2.3 MB、解开 2.9 MB（`docs/assets/` 的预览图与基准脚本占大头）。
 干净目录安装后 `--version` = 1.1.2，导出 `apply,inject,name,version`；
 安装包起 7896 实测 `/share?scope=ws:DSHLive2D&hide=level:lesson` → 200、601,177 字节。
+1.1.3 起包内多了 `SECURITY.md` 与 `CONTRIBUTING.md`，`.github/` 不进包；文件数与体积以 `npm pack` 的输出为准（不要手写进文档，否则每次改文档都要重打包）。
+
+1.1.4 实测：**75 个文件**，包约 2.3MB、解开约 2.9MB（精确字节以 `npm pack` 输出为准）。
 清单里应含 `sidecar.ps1`、`scripts/`、`test/` 不含（单测只在仓库里跑）、`dev/` 与截图不含。
 
 装进 DSH profile（与 `docs/operations.md` 的 junction 方式二选一）：

package/docs/testing.md

@@ -4,7 +4,7 @@
 
 三层自动检查 + 一层人工验收。前三层都能在干净仓库里跑，不依赖 DSH 正在运行。
 
-## 一、单元测试：`test/`（87 项）
+## 一、单元测试：`test/`（88 项）
 
 ```bash
 npm test
@@ -24,7 +24,7 @@ node --test "test/*.test.mjs"
 | `share.test.mjs` | 14 | 单文件自包含、正文与 `</script>` 防护、尖括号转义、`$&` 保留、`<noscript>`/只读元信息、ws/project/focus 切片、hide 白名单与脱敏 |
 | `i18n.test.mjs` | 7 | 字典非空、回退中文、语言优先级、applyDom、T/静态 key 全覆盖 |
 | `diagnostics.test.mjs` | 2 | 报告结构、无 path/dbPath、文本不含盘符与库名、空图格式化 |
-| `doctor.test.mjs` | 8 | 版本下界、包文件、profile 依赖/bundles/已安装、warn 不阻断、文本/JSON 报告 |
+| `doctor.test.mjs` | 9 | 版本下界、包文件、profile 依赖/bundles/已安装、版本漂移提醒、warn 不阻断、文本/JSON 报告 |
 | `market.test.mjs` | 3 | 市场索引版本/分类/标签、双语详情与图标存在、详情图片路径可解析 |
 | `package.test.mjs` | 7 | 包身份与导出、`files` 不夹带测试、清单文件存在、死文件不再进包、CHANGELOG 与版本一致、Cordis patch、相对 import 可解析 |
 

package/docs/verified.md

@@ -2,6 +2,35 @@
 
 > 下面的数字都是**当时实测**的值，记录的是「这个结论被什么证据支撑过」，不是当前规模——记忆每天在长，规模类数字请以 `node scripts/smoke.mjs` 和界面顶栏为准。
 
+## 1.1.4（2026-11-11）对齐
+
+- **医生能说出「装的是新的、跑的是旧的」**：在真实 desktop profile 上，
+  `node scripts/doctor.mjs --profile … --base http://127.0.0.1:60156/api/memory-nebula`
+  得到 `[warn] version: installed 1.1.3, running host 1.1.0`，提示「重启 DSH 让宿主加载新代码」；
+  汇总 `9 通过 / 1 提醒 / 0 失败`。此前同一场景会给出全绿，掩盖升级未生效。
+- **真机页面**：headless Edge 打开 `http://127.0.0.1:60156/api/memory-nebula/`，
+  页面标题「记忆星图 · Memory Nebula」，顶栏 `1980 记忆 / 9531 连接 / 9 工作区 / 73 会话`，
+  `NebulaAPI.meta.version=1.1.0`（宿主未重启）、`mode=host`、无版本横幅、无 JS 异常；
+  搜索「记忆」12 命中，点第一条详情正文 1995 字。截图 `dev/shot/live-host.png`（工作区探针，不进包）。
+- **CI 安装门**：GitHub Actions run 42879133994 的 `Node 22.13.0` / `Node 24` /
+  `Package install` 三个 job 全部 success；`Package install` 会从 `npm pack` 的 tgz 安装、
+  比对 `--version`、跑 `doctor --help`，并检查包内带 `SECURITY.md` / `CONTRIBUTING.md`、不带 `dev/`。
+- **回归**：88/88 单测；release-check v1.1.4 全绿（含 1.1.4 构件断言：`checkVersionDrift`、
+  CI 安装门、doctor 版本漂移用例）。
+- **打包**：`npm pack` 75 文件 / 约 2.3MB（解开约 2.9MB）；
+  最终 sha256 见同目录 `.tgz.sha256`（不写进包内，避免重打包后自相矛盾）。
+
+## 1.1.3（2026-11-11）门面
+
+- **包元数据**：`package.json` 有 `repository` / `homepage` / `bugs`，描述中英双句，13 个关键词；`npm pack` 后从 tarball 解出的 manifest 同样带这些字段。
+- **CI**：`.github/workflows/ci.yml` 矩阵 Node 22.13.0 / 24，跑 `npm test` 与 `npm run check`；首次运行 `aed5605` 在 GitHub 上 **completed / success**，本机等价命令 87/87。
+- **政策文件**：`SECURITY.md`（只读边界、loopback/Origin/CSP、`/share` 是正文出口、private advisory）与 `CONTRIBUTING.md`（无依赖、测试命令、文案/测试/版本约定）已进包。
+- **回归**：87/87 单测；release-check v1.1.3 全绿（143 文本 / 69 脚本 / 23 Markdown 链接，含 1.1.3 构件断言）。
+- **发布**：`npm pack` 75 文件 / 2,289,894B，sha256 `e5aea7789b600ab49c3171dff72ecdd892f435fa61b8bb97ca2f0d1b823a7ce7`；`npm latest` = 1.1.3（registry shasum `23d31ddea801518bbc2ef20ff440b864534a8402`），registry 安装后 `--version` = 1.1.3、doctor 8 通过。
+- **远程索引**：`https://unpkg.com/dsh-memory-nebula@1.1.3/market/index.json` 200，`parseMarketIndex` 通过（format 1 / 1.1.3），`marketInstallTarget` 返回 `dsh-memory-nebula@1.1.3`；icon/locale/详情/图片均 200。
+- **GitHub Release**：`v1.1.3` 附 tgz 与 `.sha256` 两个资产。
+- **README**：中英顶部都有 CI / npm / license badge，文档表补 SECURITY/CONTRIBUTING 两行。
+
 ## 1.1.2（2026-11-10）换个门牌
 
 - **CDN 选择**：本机 `curl` 与 Node fetch 访问 jsDelivr 均为 `ECONNRESET`；unpkg 的 Node fetch 200。

package/lib/host/doctor.js

@@ -147,11 +147,13 @@ export async function checkEndpoint(base, timeoutMs = 3000) {
     const res = await fetch(url, { signal: ctl.signal, headers: { accept: 'application/json' } })
     const body = await res.json().catch(() => ({}))
     if (!res.ok) return item('endpoint', 'warn', `${url} → HTTP ${res.status}`, '看 DSH 日志或 standalone 控制台')
-    return item(
+    const out = item(
       'endpoint',
       'ok',
       `${url} → ${body.version || '?'} / ${body.mode || '?'} / ${body.stats?.nodes ?? '?'} memories`,
     )
+    out.version = String(body.version || '')
+    return out
   } catch (err) {
     const reason = err?.name === 'AbortError' ? `超时 ${timeoutMs}ms` : String(err.message || err)
     return item('endpoint', 'warn', `${url} → ${reason}`, '插件没在跑、端口不对，或被别的进程占用')
@@ -160,6 +162,22 @@ export async function checkEndpoint(base, timeoutMs = 3000) {
   }
 }
 
+/**
+ * 装的是新代码、跑的还是旧代码：这是宿主最常见的「升级后没生效」。
+ * 只提醒，不阻断；页面通常仍兼容，但新路由/新能力不会出现。
+ */
+export function checkVersionDrift(installed, running) {
+  const have = String(installed || '')
+  const live = String(running || '')
+  if (!have || !live || have === live) return null
+  return item(
+    'version',
+    'warn',
+    `installed ${have}, running host ${live}`,
+    '重启 DSH 让宿主加载新代码；只刷新页面不会换掉后端',
+  )
+}
+
 /**
  * @param {{profile?:string, roots?:string[], base?:string}} opts
  */
@@ -168,7 +186,12 @@ export async function runDoctor(opts = {}) {
   const checks = [checkRuntime(), ...pkg.items]
   if (opts.profile) checks.push(...checkProfile(opts.profile).items)
   checks.push(checkSources({ roots: opts.roots || [] }))
-  if (opts.base) checks.push(await checkEndpoint(opts.base))
+  if (opts.base) {
+    const endpoint = await checkEndpoint(opts.base)
+    checks.push(endpoint)
+    const drift = checkVersionDrift(pkg.version, endpoint.version)
+    if (drift) checks.push(drift)
+  }
   const counts = { ok: 0, warn: 0, fail: 0, skip: 0 }
   for (const c of checks) counts[c.status] = (counts[c.status] || 0) + 1
   return { ok: counts.fail === 0, counts, checks }

package/lib/web/app.js

@@ -1,7 +1,7 @@
 /* 记忆星图 —— 界面逻辑
    数据：/api/memory-nebula/*（同源）。渲染交给 render.js。 */
 ;(function () {
-  const APP_VERSION = '1.1.2'  // 和 package.json 同步（release-check 会核对）
+  const APP_VERSION = '1.1.4'  // 和 package.json 同步（release-check 会核对）
   'use strict'
   /** 中文即源文：英文模式查 i18n.js 的表，查不到就原样返回中文。 */
   const T = (zh, vars) => (window.NebulaI18n ? window.NebulaI18n.t(zh, vars) : zh)

package/market/index.json

@@ -86,8 +86,8 @@
       },
       "versions": [
         {
-          "version": "1.1.2",
-          "publishTimestamp": 1794324000,
+          "version": "1.1.4",
+          "publishTimestamp": 1794332116,
           "source": {
             "type": "npm"
           },

package/package.json

@@ -1,70 +1,84 @@
-{
-  "name": "dsh-memory-nebula",
-  "version": "1.1.2",
-  "private": false,
-  "description": "记忆星图 Memory Nebula —— 把 DSH 里所有记忆插件的记忆只读抽取出来，连成一张可交互的神经元星云；并提供跨项目记忆的扩散检索（spreading activation）。",
-  "type": "module",
-  "main": "lib/index.js",
-  "bin": {
-    "memory-nebula": "lib/standalone.mjs",
-    "memory-nebula-doctor": "scripts/doctor.mjs"
-  },
-  "exports": {
-    ".": "./lib/index.js",
-    "./client": "./lib/client.js",
-    "./cordis.patch.yml": "./cordis.patch.yml",
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "lib",
-    "cordis.patch.yml",
-    "README.md",
-    "README.en.md",
-    "docs",
-    "CHANGELOG.md",
-    "LICENSE",
-    "scripts",
-    "sidecar.ps1",
-    "locale",
-    "market"
-  ],
-  "scripts": {
-    "test": "node --test \"test/*.test.mjs\"",
-    "smoke": "node scripts/smoke.mjs",
-    "bench": "node --expose-gc scripts/bench.mjs",
-    "check": "node scripts/release-check.mjs",
-    "standalone": "node lib/standalone.mjs",
-    "start": "node lib/standalone.mjs",
-    "verify": "npm test && npm run check",
-    "prepack": "npm run verify",
-    "doctor": "node scripts/doctor.mjs"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "license": "MIT",
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    },
-    "client": {
-      "platform": "web",
-      "inject": []
-    }
-  },
-  "engines": {
-    "node": ">=22.13.0"
-  },
-  "keywords": [
-    "deepseek-harness",
-    "dsh-plugin",
-    "memory",
-    "nebula",
-    "graph",
-    "relational-memory",
-    "spreading-activation",
-    "memory-adapter",
-    "visualization"
-  ],
-  "author": "主人 & 小代码酱"
-}
+{
+  "name": "dsh-memory-nebula",
+  "version": "1.1.4",
+  "private": false,
+  "description": "Local-first memory nebula for DeepSeek Harness — read-only graph, spreading recall, evidence chains, offline snapshots. 记忆星图：把 DSH 各工作区的记忆只读连成一张可交互星云。",
+  "type": "module",
+  "main": "lib/index.js",
+  "bin": {
+    "memory-nebula": "lib/standalone.mjs",
+    "memory-nebula-doctor": "scripts/doctor.mjs"
+  },
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "README.en.md",
+    "docs",
+    "CHANGELOG.md",
+    "LICENSE",
+    "scripts",
+    "sidecar.ps1",
+    "locale",
+    "market",
+    "SECURITY.md",
+    "CONTRIBUTING.md"
+  ],
+  "scripts": {
+    "test": "node --test \"test/*.test.mjs\"",
+    "smoke": "node scripts/smoke.mjs",
+    "bench": "node --expose-gc scripts/bench.mjs",
+    "check": "node scripts/release-check.mjs",
+    "standalone": "node lib/standalone.mjs",
+    "start": "node lib/standalone.mjs",
+    "verify": "npm test && npm run check",
+    "prepack": "npm run verify",
+    "doctor": "node scripts/doctor.mjs"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "MIT",
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": []
+    }
+  },
+  "engines": {
+    "node": ">=22.13.0"
+  },
+  "keywords": [
+    "deepseek-harness",
+    "dsh-plugin",
+    "memory",
+    "nebula",
+    "graph",
+    "relational-memory",
+    "spreading-activation",
+    "memory-adapter",
+    "visualization",
+    "dsh",
+    "memory-graph",
+    "knowledge-graph",
+    "offline-snapshot"
+  ],
+  "author": "主人 & 小代码酱",
+  "homepage": "https://github.com/hanhan9999999999999999999/dsh-memory-nebula#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hanhan9999999999999999999/dsh-memory-nebula.git"
+  },
+  "bugs": {
+    "url": "https://github.com/hanhan9999999999999999999/dsh-memory-nebula/issues"
+  }
+}

package/scripts/release-check.mjs

@@ -245,6 +245,24 @@ if (!read('docs/market.en.md').includes('https://unpkg.com/')) fail('英文详
 if (!pkg.files?.includes('market') || !pkg.files?.includes('locale')) fail('package.json files 没带 market/locale')
 ok('1.1.2 构件：市场索引 / unpkg / 双语详情 / 图标')
 
+const ciSrc = read('.github/workflows/ci.yml')
+if (!ciSrc.includes("'22.13.0'") || !ciSrc.includes("'24'")) fail('CI 矩阵缺 Node 22.13/24')
+if (!ciSrc.includes('npm run check')) fail('CI 没跑 release-check')
+if (!pkg.repository?.url?.includes('github.com/hanhan9999999999999999999/dsh-memory-nebula')) fail('package.json 缺 repository')
+if (!pkg.homepage?.includes('github.com/hanhan9999999999999999999/dsh-memory-nebula')) fail('package.json 缺 homepage')
+if (!pkg.bugs?.url?.endsWith('/issues')) fail('package.json 缺 bugs.url')
+if (!read('SECURITY.md').includes('private vulnerability reporting')) fail('SECURITY.md 缺报告入口')
+if (!read('CONTRIBUTING.md').includes('npm run check')) fail('CONTRIBUTING.md 缺检查命令')
+if (!read('README.md').includes('actions/workflows/ci.yml/badge.svg')) fail('README.md 缺 CI badge')
+if (!pkg.files?.includes('SECURITY.md') || !pkg.files?.includes('CONTRIBUTING.md')) fail('package.json files 没带政策文档')
+ok('1.1.3 构件：仓库元数据 / CI / 安全与贡献文档')
+
+if (!read('lib/host/doctor.js').includes('checkVersionDrift')) fail('doctor 缺版本漂移检查')
+if (!ciSrc.includes('Package install')) fail('CI 缺打包安装 job')
+if (!read('test/doctor.test.mjs').includes('running host')) fail('doctor 测试缺版本漂移用例')
+ok('1.1.4 构件：医生版本漂移 / CI 安装门')
+
+
 
 console.log(`\n发布检查：${pkg.name} v${pkg.version}\n`)
 for (const n of notes) console.log(`  ✔ ${n}`)