fix(distribution): install DSH plugin without build scripts

.github/workflows/ci.yml

@@ -26,14 +26,4 @@ jobs:
       - run: npm install --no-audit --no-fund
       - run: npm run build
       - run: npm test
-      - name: Verify publishable package
-        shell: bash
-        run: |
-          npm pack --dry-run --json > pack.json
-          node - <<'NODE'
-          const report = require('./pack.json')[0]
-          const files = new Set(report.files.map((entry) => entry.path))
-          for (const required of ['dist/index.js', 'dist/dsh.js', 'index.ts', 'dsh.ts', 'tsconfig.json', 'tsconfig.dsh.json']) {
-            if (!files.has(required)) throw new Error(`packed artifact is missing ${required}`)
-          }
-          NODE
+      - run: npm run verify:package

.gitignore

@@ -1,5 +1,4 @@
 node_modules/
-dist/
 *.db
 *.db-wal
 *.db-shm

README.md

@@ -191,7 +191,7 @@ graph-memory/
 | Visible plugin state | **Done** | Active in Plugin Inventory |
 | Pro visual workbench | **Experimental** | Separate DSH Client Plugin with a read-only card snapshot |
 
-Current beta: `1.6.0-beta.8`. Local acceptance used DeepSeek Harness `0.1.0-rc.8`. Testing covered tarball installation, Web profile loading, configurable five-turn rolling compaction through the public agent-preset compaction service, exact source provenance, token-budget enforcement, high-precision automatic recall, FTS5 fallback, and the Pro Lite Host, Typed Remote, and Client bundle boundaries. All 127 automated tests passed. Real model-backed acceptance also verified rolling checkpoint replacement, 1024-dimensional `text-embedding-v4` vectors, and automatic cross-project recall without an explicit memory tool call.
+Current beta: `1.6.0-beta.9`. Local acceptance used DeepSeek Harness `0.1.0-rc.8`. Testing covered script-free Git and tarball installation, Web profile loading, configurable five-turn rolling compaction through the public agent-preset compaction service, exact source provenance, token-budget enforcement, high-precision automatic recall, FTS5 fallback, and the Pro Lite Host, Typed Remote, and Client bundle boundaries. All 130 automated tests passed. Real model-backed acceptance also verified rolling checkpoint replacement, 1024-dimensional `text-embedding-v4` vectors, and automatic cross-project recall without an explicit memory tool call.
 
 <p align="center">
   <strong>Plugin enabled: graph-memory/dsh is active in the DSH plugin list</strong><br>
@@ -205,27 +205,23 @@ Current beta: `1.6.0-beta.8`. Local acceptance used DeepSeek Harness `0.1.0-rc.8
 
 ## Install on DeepSeek Harness
 
-Prerequisites: Node.js `22.19+` or `24+`. The current beta is not yet published to npm, so build the tarball from source:
+Prerequisite: Node.js `22.13+`. The current beta is not yet published to npm, but the repository ships its prebuilt runtime and can be installed without authorizing install scripts:
+
+```bash
+npx @deepseek-ai/dsh plugin --profile web add git+https://github.com/adoresever/graph-memory.git
+npx @deepseek-ai/dsh --profile web --dump-config
+npx @deepseek-ai/dsh web
+```
+
+Alternatively, build and install a tarball from a checkout:
 
 ```bash
 git clone https://github.com/adoresever/graph-memory.git
 cd graph-memory
 npm install
 npm test
-npm run build
 npm pack
-```
-
-Install the generated tarball into the DSH Web profile:
-
-```bash
-npx @deepseek-ai/dsh plugin --profile web add /absolute/path/to/graph-memory-1.6.0-beta.8.tgz
-npx @deepseek-ai/dsh --profile web --dump-config
-npx @deepseek-ai/dsh web
-
-# From a deepseek-harness source checkout:
-pnpm dsh plugin --profile web add /absolute/path/to/graph-memory-1.6.0-beta.8.tgz
-pnpm dsh web
+npx @deepseek-ai/dsh plugin --profile web add /absolute/path/to/graph-memory-1.6.0-beta.9.tgz
 ```
 
 After installation, verify that `graph-memory/dsh` is enabled under **Settings → Plugins → Plugin list**.
@@ -312,12 +308,11 @@ The first milestone should be **Pro Lite**: reuse the existing SQLite graph and
 
 ### Current local installation
 
-The npm package `graph-memory@1.5.8` is still the OpenClaw release. The new Community beta and `graph-memory-pro-dsh` have not been published to npm, so install them from this checkout:
+The npm package `graph-memory@1.5.8` is still the OpenClaw release. The new Community beta can be installed from GitHub; `graph-memory-pro-dsh` still installs from a checkout:
 
 ```bash
 dsh plugin --profile web add \
-  --allow-build=@photostructure/sqlite \
-  /absolute/path/to/graph-memory
+  git+https://github.com/adoresever/graph-memory.git
 
 dsh plugin --profile web add \
   /absolute/path/to/graph-memory/dsh-pro

README_CN.md

@@ -173,7 +173,7 @@ graph-memory/
 | 插件状态可见 | **已完成** | 设置页 Plugin Inventory 显示 active |
 | Pro 可视化工作台 | **实验版可用** | 独立 DSH Client Plugin，当前为只读卡片式快照 |
 
-当前 beta：`1.6.0-beta.8`。本机验收宿主为 DeepSeek Harness `0.1.0-rc.8`。验收已覆盖 tarball 安装、Web profile 原生加载、通过 Agent 公共 compaction 服务执行的可配置最近 5 轮滚动压缩、精确原文溯源、token 预算、高精度自动召回、FTS5 降级，以及 Pro Lite Host、Typed Remote 和 Client bundle 边界；127 项自动化测试通过。真实模型验收还完成了滚动 checkpoint 替换、`text-embedding-v4` 1024 维向量写入，以及不调用记忆工具的跨项目自动召回。
+当前 beta：`1.6.0-beta.9`。本机验收宿主为 DeepSeek Harness `0.1.0-rc.8`。验收已覆盖无安装脚本的 Git 与 tarball 安装、Web profile 原生加载、通过 Agent 公共 compaction 服务执行的可配置最近 5 轮滚动压缩、精确原文溯源、token 预算、高精度自动召回、FTS5 降级，以及 Pro Lite Host、Typed Remote 和 Client bundle 边界；130 项自动化测试通过。真实模型验收还完成了滚动 checkpoint 替换、`text-embedding-v4` 1024 维向量写入，以及不调用记忆工具的跨项目自动召回。
 
 <p align="center">
   <strong>插件已启用：graph-memory/dsh 在 DSH 插件列表中处于 active</strong><br>
@@ -187,30 +187,23 @@ graph-memory/
 
 ## 安装到 DeepSeek Harness
 
-前置条件：Node.js `22.19+` 或 `24+`。当前 beta 尚未发布到 npm，必须先从源码构建 tarball：
+前置条件：Node.js `22.13+`。当前 beta 尚未发布到 npm，但仓库已经包含预构建运行产物，可以直接安装且不需要授权安装脚本：
 
 ```bash
-git clone https://github.com/adoresever/graph-memory.git
-cd graph-memory
-npm install
-npm test
-npm run build
-npm pack
-```
-
-安装到 DSH Web profile：
-
-```bash
-npx @deepseek-ai/dsh plugin --profile web add /absolute/path/to/graph-memory-1.6.0-beta.8.tgz
+npx @deepseek-ai/dsh plugin --profile web add git+https://github.com/adoresever/graph-memory.git
 npx @deepseek-ai/dsh --profile web --dump-config
 npx @deepseek-ai/dsh web
 ```
 
-在 DeepSeek Harness 源码仓库内，也可以使用：
+也可以从 checkout 构建并安装 tarball：
 
 ```bash
-pnpm dsh plugin --profile web add /absolute/path/to/graph-memory-1.6.0-beta.8.tgz
-pnpm dsh web
+git clone https://github.com/adoresever/graph-memory.git
+cd graph-memory
+npm install
+npm test
+npm pack
+npx @deepseek-ai/dsh plugin --profile web add /absolute/path/to/graph-memory-1.6.0-beta.9.tgz
 ```
 
 安装后，在 **设置 → 插件 → 插件列表 → graph-memory/dsh** 中确认状态为“已启用”。默认数据库路径：
@@ -282,12 +275,11 @@ graph-memory-pro-dsh                # Pro Lite：Host + Client Plugin（本地 b
 
 ### 当前本地安装方式
 
-当前 npm 上的 `graph-memory@1.5.8` 仍是 OpenClaw 包，新的 Community beta 与 `graph-memory-pro-dsh` 尚未发布到 npm，需从当前源码本地安装：
+当前 npm 上的 `graph-memory@1.5.8` 仍是 OpenClaw 包，新的 Community beta 与 `graph-memory-pro-dsh` 尚未发布到 npm。Community 可以直接从 GitHub 安装，Pro Lite 仍从 checkout 安装：
 
 ```bash
 dsh plugin --profile web add \
-  --allow-build=@photostructure/sqlite \
-  /absolute/path/to/graph-memory
+  git+https://github.com/adoresever/graph-memory.git
 
 dsh plugin --profile web add \
   /absolute/path/to/graph-memory/dsh-pro