fix(standalone-api): /status 返回真实包版本（去掉硬编码常量）

dsh-mneme/CHANGELOG.md

@@ -10,6 +10,7 @@
 ## 🧹 工程
 
 - **发布准备脚本在 CRLF 检出上不再假成功（`scripts/release-prep.mjs`）**：该脚本用 `/^(# Changelog\n\n)/` 匹配 CHANGELOG 文件头，而 Windows 检出是 CRLF——正则命中不了，`replace` 退化成空操作，**脚本却照样打印 `✓ … 占位节`**，`git status` 里看不出任何异常（CI 跑在 ubuntu 是 LF，所以只有本机发版会中招，v0.8.13 那次即如此、最后靠人工补的占位节）。规则抽成 `dsh-mneme/scripts/changelog-prep.mjs` 的纯函数：行尾两种都吃、插入内容跟随原文件行尾、带 BOM 也认；匹配不上则如实回报 `header-not-found`，入口**报错退出（exit 1）**而不是假打印成功。配 6 条回归测试（LF / CRLF / BOM / 幂等 / 回报契约 / detectEol）。
+- **standalone API 的 `/status` 版本号不再硬编码**：该端点此前返回模块内的字面量常量，发布时不会随 `package.json` 一起 bump——手上的 0.8.13 实例对外报的是 `0.7.12`，第三方集成据它判版本会读到假数据。现改为复用 `version-check.js` 的 `PACKAGE_VERSION`（运行时读 `package.json`，宿主侧 `/api/dsh-mneme/status` 走的就是这条），测试断言同步改成锁 `PACKAGE_VERSION` 而非字面量——旧断言把常量钉死，正是「发布漏 bump 而 CI 全绿」放行的原因。
 
 ## [0.8.13] - 2026-10-03
 

dsh-mneme/lib/api-standalone.js

@@ -1,4 +1,4 @@
-// Standalone HTTP API (v0.7.12): a plain node:http server for ecosystem
+// Standalone HTTP API: a plain node:http server for ecosystem
 // integrations that live outside the DSH host and cannot reach the plugin's
 // internal webServer routes (/api/dsh-mneme/*). Mirrors the JSON semantics of
 // those routes but with mandatory Bearer-token auth on everything except
@@ -17,12 +17,10 @@ import { createServer } from "node:http";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { TYPES } from "./store.js";
 import { bootstrapFromDirectory } from "./bootstrap.js";
+import { PACKAGE_VERSION } from "./version-check.js";
 
 const DEFAULT_PORT = 8790;
 const DEFAULT_HOST = "127.0.0.1";
-// Hardcoded release version (package.json is bumped at publish time and may
-// lag the code that ships in between).
-const VERSION = "0.7.12";
 const MAX_PORT_ATTEMPTS = 20;
 
 /**
@@ -260,7 +258,7 @@ export function createStandaloneApi({ service, store, config = {}, logger, setti
           entities = store.db.prepare("SELECT count(*) AS c FROM entities").get().c;
         } catch { /* entities storage unavailable → 0 */ }
         sendJson(res, 200, {
-          version: VERSION,
+          version: PACKAGE_VERSION,
           memories: { total: service.count(), byType },
           entities,
           uptime_s: Math.floor(process.uptime())

dsh-mneme/src/api-standalone.js

@@ -1,4 +1,4 @@
-// Standalone HTTP API (v0.7.12): a plain node:http server for ecosystem
+// Standalone HTTP API: a plain node:http server for ecosystem
 // integrations that live outside the DSH host and cannot reach the plugin's
 // internal webServer routes (/api/dsh-mneme/*). Mirrors the JSON semantics of
 // those routes but with mandatory Bearer-token auth on everything except
@@ -17,12 +17,10 @@ import { createServer } from "node:http";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { TYPES } from "./store.js";
 import { bootstrapFromDirectory } from "./bootstrap.js";
+import { PACKAGE_VERSION } from "./version-check.js";
 
 const DEFAULT_PORT = 8790;
 const DEFAULT_HOST = "127.0.0.1";
-// Hardcoded release version (package.json is bumped at publish time and may
-// lag the code that ships in between).
-const VERSION = "0.7.12";
 const MAX_PORT_ATTEMPTS = 20;
 
 /**
@@ -260,7 +258,7 @@ export function createStandaloneApi({ service, store, config = {}, logger, setti
           entities = store.db.prepare("SELECT count(*) AS c FROM entities").get().c;
         } catch { /* entities storage unavailable → 0 */ }
         sendJson(res, 200, {
-          version: VERSION,
+          version: PACKAGE_VERSION,
           memories: { total: service.count(), byType },
           entities,
           uptime_s: Math.floor(process.uptime())

dsh-mneme/test/standalone-api.test.js

@@ -4,6 +4,7 @@ import { createStore } from "../src/store.js";
 import { createService } from "../src/service.js";
 import { createSettings } from "../src/settings.js";
 import { createStandaloneApi } from "../src/api-standalone.js";
+import { PACKAGE_VERSION } from "../src/version-check.js";
 import { Config, applyLightModePreset } from "../src/config.js";
 
 // Real HTTP server on an OS-assigned port (port: 0), driven with fetch.
@@ -249,7 +250,9 @@ test("GET /status reports version, per-type totals, entities and uptime", async
     const res = await fetch(`${base}/status`, { headers: auth });
     assert.equal(res.status, 200);
     const body = await res.json();
-    assert.equal(body.version, "0.7.12");
+    // 回归锁：/status 的版本必须来自 package.json（PACKAGE_VERSION），不是散落的
+    // 字面量——曾经此处硬编码常量在发版时漏 bump，运行 0.8.13 却对外报 0.7.12。
+    assert.equal(body.version, PACKAGE_VERSION);
     assert.equal(body.memories.total, 3);
     assert.equal(body.memories.byType.preference, 1);
     assert.equal(body.memories.byType.project, 2);