@sanqianx/project-knowledge 4.7.0 → 5.0.0

package/_site/_test/desktop-hook-runtime-regression-test.js

@@ -1,204 +1,204 @@
-// _site/_test/desktop-hook-runtime-regression-test.js
-//
-// Characterization harness for the post-commit hook runtime contract.
-// The current regression (RC-01) is that buildHookBody defaults
-// nodeExecutable to process.execPath, which in Desktop mode points at the
-// Electron executable rather than a real Node binary. When Git invokes the
-// hook from a normal shell, the script therefore launches Electron instead
-// of executing hook-trigger.js.
-//
-// These tests must:
-//   - PASS for healthy CLI installs with an explicit Node executable;
-//   - EXPOSE the regression when the default is left to process.execPath in a
-//     simulated Desktop environment.
-
-const assert = require('assert');
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { spawnSync } = require('child_process');
-
-const {
-  buildHookBody,
-  installHook,
-  readHookStatus,
-  parseManagedMarker,
-  HOOK_MARKER,
-} = require('../lib/hook-manager');
-
-const ROOT = path.resolve(__dirname, '..', '..');
-const TRIGGER = path.join(ROOT, '_site', 'scripts', 'hook-trigger.js');
-
-function git(repo, args) {
-  const result = spawnSync('git', ['-C', repo, ...args], {
-    encoding: 'utf8',
-    windowsHide: true,
-    env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
-  });
-  if (result.status !== 0) throw new Error(result.stderr || `git ${args.join(' ')} failed: ${result.status}`);
-  return String(result.stdout || '').trim();
-}
-
-function makeRepo() {
-  const repo = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-desktop-hook-'));
-  git(repo, ['init', '-q', '-b', 'main']);
-  git(repo, ['config', 'user.email', 'desktop-hook@example.local']);
-  git(repo, ['config', 'user.name', 'Desktop Hook Test']);
-  fs.writeFileSync(path.join(repo, 'README.md'), '# desktop hook\n');
-  git(repo, ['add', 'README.md']);
-  git(repo, ['commit', '-q', '-m', 'initial']);
-  return repo;
-}
-
-(async () => {
-  // ---- Case 1: explicit real Node executable must be persisted verbatim ----
-  {
-    const repo = makeRepo();
-    const projectId = 'project-desktop-hook';
-    const fakeNode = path.join(ROOT, '_site', '_test', 'fixtures', 'fake-browser-exit.js');
-    const body = buildHookBody({
-      projectId,
-      triggerScriptPath: TRIGGER,
-      nodeExecutable: fakeNode,
-    });
-    assert(body.includes(fakeNode.replace(/\\/g, '/')), 'explicit Node executable must be embedded in hook body');
-    assert(body.includes('ELECTRON_RUN_AS_NODE=1'), 'T02 contract: hook body must prefix ELECTRON_RUN_AS_NODE=1 so Desktop packaging runs as Node');
-    fs.rmSync(repo, { recursive: true, force: true });
-  }
-
-  // ---- Case 2: installHook must accept an explicit nodeExecutable ----
-  {
-    const repo = makeRepo();
-    const projectId = 'project-desktop-hook-install';
-    const fakeNode = path.join(ROOT, '_site', '_test', 'fixtures', 'fake-browser-exit.js');
-    const installed = installHook({
-      repoPath: repo,
-      projectId,
-      triggerScriptPath: TRIGGER,
-      nodeExecutable: fakeNode,
-    });
-    assert.strictEqual(installed.ok, true);
-    const hookBody = fs.readFileSync(installed.hookPath, 'utf8');
-    assert(hookBody.includes(fakeNode.replace(/\\/g, '/')), 'installed hook body must embed the explicit Node executable');
-    assert.strictEqual(parseManagedMarker(hookBody).projectId, projectId);
-    fs.rmSync(repo, { recursive: true, force: true });
-  }
-
-  // ---- Case 3: CHARACTERIZATION — Desktop executable prefix ----
-  // The Desktop backend launches the core CLI through the Electron executable
-  // with ELECTRON_RUN_AS_NODE=1 in the backend child environment. A Git
-  // post-commit hook does NOT inherit that env var, so the hook body must
-  // explicitly set ELECTRON_RUN_AS_NODE=1 before invoking the executable,
-  // even when the executable is Electron (Desktop packaging).
-  {
-    const fakeElectron = path.join(os.tmpdir(), `fake-electron-${process.pid}.exe`);
-    const body = buildHookBody({
-      projectId: 'project-desktop-hook-default',
-      triggerScriptPath: TRIGGER,
-      nodeExecutable: fakeElectron,
-    });
-    assert(body.includes('ELECTRON_RUN_AS_NODE=1'),
-      'T02 contract: hook body must prefix ELECTRON_RUN_AS_NODE=1 so a Desktop Electron binary executes as Node');
-    assert(body.includes(fakeElectron.replace(/\\/g, '/')),
-      'hook body must embed the resolved executable verbatim');
-    assert(typeof body === 'string' && body.length > 0, 'hook body must be non-empty');
-  }
-
-  // ---- Case 4: hook runtime contract — trigger must run even with weird paths ----
-  // The hook body must work when the project path contains spaces. We install
-  // into a path that includes a literal space and confirm installHook + readback
-  // round-trip without escaping failures.
-  {
-    const base = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-desktop-hook-spaces-'));
-    const repo = path.join(base, 'project with spaces');
-    fs.mkdirSync(repo, { recursive: true });
-    git(repo, ['init', '-q', '-b', 'main']);
-    git(repo, ['config', 'user.email', 'spaces@example.local']);
-    git(repo, ['config', 'user.name', 'Spaces Test']);
-    fs.writeFileSync(path.join(repo, 'README.md'), '# spaces\n');
-    git(repo, ['add', 'README.md']);
-    git(repo, ['commit', '-q', '-m', 'initial']);
-    const fakeNode = path.join(ROOT, '_site', '_test', 'fixtures', 'fake-browser-exit.js');
-    const installed = installHook({
-      repoPath: repo,
-      projectId: 'project-spaces',
-      triggerScriptPath: TRIGGER,
-      nodeExecutable: fakeNode,
-    });
-    assert.strictEqual(installed.ok, true);
-    const status = readHookStatus({ repoPath: repo, projectId: 'project-spaces' });
-    assert.strictEqual(status.kbManaged, true);
-    fs.rmSync(base, { recursive: true, force: true });
-  }
-
-  // ---- Case 5: missing required args must still produce a valid hook body ----
-  // This guards the "fail-open" property required by I-12 (Git commit must
-  // never fail because Project-Knowledge is unavailable).
-  {
-    let threw = false;
-    try {
-      buildHookBody({ projectId: '', triggerScriptPath: TRIGGER, nodeExecutable: process.execPath });
-    } catch (error) { threw = true; }
-    assert.strictEqual(threw, true, 'empty projectId must be rejected by buildHookBody');
-  }
-
-  // ---- Case 6: end-to-end execution — hook body actually runs the trigger ----
-  // Build a tiny "trigger" that records its argv + ELECTRON_RUN_AS_NODE env
-  // to a journal, install the hook pointing at it, then exec the installed
-  // hook via sh and assert the journal was written. This proves the hook
-  // body resolves the executable correctly and that ELECTRON_RUN_AS_NODE=1
-  // is set before the trigger runs (so a Desktop Electron binary would
-  // execute as Node instead of launching as a GUI).
-  {
-    const repo = makeRepo();
-    const journal = path.join(os.tmpdir(), `pk-desktop-hook-journal-${process.pid}.json`);
-    const triggerBody = `#!/usr/bin/env node
-const fs = require('fs');
-fs.writeFileSync(${JSON.stringify(journal)}, JSON.stringify({
-  argv: process.argv.slice(2),
-  electronRunAsNode: process.env.ELECTRON_RUN_AS_NODE || null,
-  execPath: process.execPath,
-}, null, 2));
-process.exit(0);
-`;
-    const fakeTrigger = path.join(os.tmpdir(), `pk-fake-trigger-${process.pid}.js`);
-    fs.writeFileSync(fakeTrigger, triggerBody);
-    const projectId = 'project-hook-exec';
-    const fakeNode = process.execPath; // real Node in the test env
-    const installed = installHook({
-      repoPath: repo,
-      projectId,
-      triggerScriptPath: fakeTrigger,
-      nodeExecutable: fakeNode,
-    });
-    assert.strictEqual(installed.ok, true);
-    // Execute with Git for Windows' own POSIX shell. A bare `bash` can resolve
-    // to WSL, which cannot consume a Windows hook path.
-    let sh = 'sh';
-    if (process.platform === 'win32') {
-      const where = spawnSync('where.exe', ['git'], { encoding: 'utf8', windowsHide: true });
-      const gitPath = String(where.stdout || '').split(/\r?\n/).find(Boolean);
-      const candidate = gitPath && path.join(path.dirname(path.dirname(gitPath)), 'bin', 'sh.exe');
-      sh = candidate && fs.existsSync(candidate) ? candidate : 'bash';
-    }
-    const result = spawnSync(sh, [installed.hookPath], {
-      encoding: 'utf8',
-      windowsHide: true,
-      env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
-    });
-    assert.strictEqual(result.status, 0, `hook must exit 0 even when Project-Knowledge is unavailable; got ${result.status}\n${result.stderr || ''}`);
-    assert(fs.existsSync(journal), 'fake trigger must be executed by the hook body');
-    const recorded = JSON.parse(fs.readFileSync(journal, 'utf8'));
-    assert.strictEqual(recorded.electronRunAsNode, '1', 'ELECTRON_RUN_AS_NODE=1 must be set before the trigger runs');
-    assert(recorded.argv.includes('--project-id'), 'trigger argv must include --project-id');
-    assert(recorded.argv.includes(projectId), 'trigger argv must include the project id');
-    fs.rmSync(repo, { recursive: true, force: true });
-    fs.rmSync(fakeTrigger, { force: true });
-    fs.rmSync(journal, { force: true });
-  }
-
-  console.log('desktop-hook-runtime-regression-test PASS');
-})().catch(error => {
-  console.error(error.stack || error.message);
-  process.exit(1);
-});
+// _site/_test/desktop-hook-runtime-regression-test.js
+//
+// Characterization harness for the post-commit hook runtime contract.
+// The current regression (RC-01) is that buildHookBody defaults
+// nodeExecutable to process.execPath, which in Desktop mode points at the
+// Electron executable rather than a real Node binary. When Git invokes the
+// hook from a normal shell, the script therefore launches Electron instead
+// of executing hook-trigger.js.
+//
+// These tests must:
+//   - PASS for healthy CLI installs with an explicit Node executable;
+//   - EXPOSE the regression when the default is left to process.execPath in a
+//     simulated Desktop environment.
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const {
+  buildHookBody,
+  installHook,
+  readHookStatus,
+  parseManagedMarker,
+  HOOK_MARKER,
+} = require('../lib/hook-manager');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const TRIGGER = path.join(ROOT, '_site', 'scripts', 'hook-trigger.js');
+
+function git(repo, args) {
+  const result = spawnSync('git', ['-C', repo, ...args], {
+    encoding: 'utf8',
+    windowsHide: true,
+    env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+  });
+  if (result.status !== 0) throw new Error(result.stderr || `git ${args.join(' ')} failed: ${result.status}`);
+  return String(result.stdout || '').trim();
+}
+
+function makeRepo() {
+  const repo = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-desktop-hook-'));
+  git(repo, ['init', '-q', '-b', 'main']);
+  git(repo, ['config', 'user.email', 'desktop-hook@example.local']);
+  git(repo, ['config', 'user.name', 'Desktop Hook Test']);
+  fs.writeFileSync(path.join(repo, 'README.md'), '# desktop hook\n');
+  git(repo, ['add', 'README.md']);
+  git(repo, ['commit', '-q', '-m', 'initial']);
+  return repo;
+}
+
+(async () => {
+  // ---- Case 1: explicit real Node executable must be persisted verbatim ----
+  {
+    const repo = makeRepo();
+    const projectId = 'project-desktop-hook';
+    const fakeNode = path.join(ROOT, '_site', '_test', 'fixtures', 'fake-browser-exit.js');
+    const body = buildHookBody({
+      projectId,
+      triggerScriptPath: TRIGGER,
+      nodeExecutable: fakeNode,
+    });
+    assert(body.includes(fakeNode.replace(/\\/g, '/')), 'explicit Node executable must be embedded in hook body');
+    assert(body.includes('ELECTRON_RUN_AS_NODE=1'), 'T02 contract: hook body must prefix ELECTRON_RUN_AS_NODE=1 so Desktop packaging runs as Node');
+    fs.rmSync(repo, { recursive: true, force: true });
+  }
+
+  // ---- Case 2: installHook must accept an explicit nodeExecutable ----
+  {
+    const repo = makeRepo();
+    const projectId = 'project-desktop-hook-install';
+    const fakeNode = path.join(ROOT, '_site', '_test', 'fixtures', 'fake-browser-exit.js');
+    const installed = installHook({
+      repoPath: repo,
+      projectId,
+      triggerScriptPath: TRIGGER,
+      nodeExecutable: fakeNode,
+    });
+    assert.strictEqual(installed.ok, true);
+    const hookBody = fs.readFileSync(installed.hookPath, 'utf8');
+    assert(hookBody.includes(fakeNode.replace(/\\/g, '/')), 'installed hook body must embed the explicit Node executable');
+    assert.strictEqual(parseManagedMarker(hookBody).projectId, projectId);
+    fs.rmSync(repo, { recursive: true, force: true });
+  }
+
+  // ---- Case 3: CHARACTERIZATION — Desktop executable prefix ----
+  // The Desktop backend launches the core CLI through the Electron executable
+  // with ELECTRON_RUN_AS_NODE=1 in the backend child environment. A Git
+  // post-commit hook does NOT inherit that env var, so the hook body must
+  // explicitly set ELECTRON_RUN_AS_NODE=1 before invoking the executable,
+  // even when the executable is Electron (Desktop packaging).
+  {
+    const fakeElectron = path.join(os.tmpdir(), `fake-electron-${process.pid}.exe`);
+    const body = buildHookBody({
+      projectId: 'project-desktop-hook-default',
+      triggerScriptPath: TRIGGER,
+      nodeExecutable: fakeElectron,
+    });
+    assert(body.includes('ELECTRON_RUN_AS_NODE=1'),
+      'T02 contract: hook body must prefix ELECTRON_RUN_AS_NODE=1 so a Desktop Electron binary executes as Node');
+    assert(body.includes(fakeElectron.replace(/\\/g, '/')),
+      'hook body must embed the resolved executable verbatim');
+    assert(typeof body === 'string' && body.length > 0, 'hook body must be non-empty');
+  }
+
+  // ---- Case 4: hook runtime contract — trigger must run even with weird paths ----
+  // The hook body must work when the project path contains spaces. We install
+  // into a path that includes a literal space and confirm installHook + readback
+  // round-trip without escaping failures.
+  {
+    const base = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-desktop-hook-spaces-'));
+    const repo = path.join(base, 'project with spaces');
+    fs.mkdirSync(repo, { recursive: true });
+    git(repo, ['init', '-q', '-b', 'main']);
+    git(repo, ['config', 'user.email', 'spaces@example.local']);
+    git(repo, ['config', 'user.name', 'Spaces Test']);
+    fs.writeFileSync(path.join(repo, 'README.md'), '# spaces\n');
+    git(repo, ['add', 'README.md']);
+    git(repo, ['commit', '-q', '-m', 'initial']);
+    const fakeNode = path.join(ROOT, '_site', '_test', 'fixtures', 'fake-browser-exit.js');
+    const installed = installHook({
+      repoPath: repo,
+      projectId: 'project-spaces',
+      triggerScriptPath: TRIGGER,
+      nodeExecutable: fakeNode,
+    });
+    assert.strictEqual(installed.ok, true);
+    const status = readHookStatus({ repoPath: repo, projectId: 'project-spaces' });
+    assert.strictEqual(status.kbManaged, true);
+    fs.rmSync(base, { recursive: true, force: true });
+  }
+
+  // ---- Case 5: missing required args must still produce a valid hook body ----
+  // This guards the "fail-open" property required by I-12 (Git commit must
+  // never fail because Project-Knowledge is unavailable).
+  {
+    let threw = false;
+    try {
+      buildHookBody({ projectId: '', triggerScriptPath: TRIGGER, nodeExecutable: process.execPath });
+    } catch (error) { threw = true; }
+    assert.strictEqual(threw, true, 'empty projectId must be rejected by buildHookBody');
+  }
+
+  // ---- Case 6: end-to-end execution — hook body actually runs the trigger ----
+  // Build a tiny "trigger" that records its argv + ELECTRON_RUN_AS_NODE env
+  // to a journal, install the hook pointing at it, then exec the installed
+  // hook via sh and assert the journal was written. This proves the hook
+  // body resolves the executable correctly and that ELECTRON_RUN_AS_NODE=1
+  // is set before the trigger runs (so a Desktop Electron binary would
+  // execute as Node instead of launching as a GUI).
+  {
+    const repo = makeRepo();
+    const journal = path.join(os.tmpdir(), `pk-desktop-hook-journal-${process.pid}.json`);
+    const triggerBody = `#!/usr/bin/env node
+const fs = require('fs');
+fs.writeFileSync(${JSON.stringify(journal)}, JSON.stringify({
+  argv: process.argv.slice(2),
+  electronRunAsNode: process.env.ELECTRON_RUN_AS_NODE || null,
+  execPath: process.execPath,
+}, null, 2));
+process.exit(0);
+`;
+    const fakeTrigger = path.join(os.tmpdir(), `pk-fake-trigger-${process.pid}.js`);
+    fs.writeFileSync(fakeTrigger, triggerBody);
+    const projectId = 'project-hook-exec';
+    const fakeNode = process.execPath; // real Node in the test env
+    const installed = installHook({
+      repoPath: repo,
+      projectId,
+      triggerScriptPath: fakeTrigger,
+      nodeExecutable: fakeNode,
+    });
+    assert.strictEqual(installed.ok, true);
+    // Execute with Git for Windows' own POSIX shell. A bare `bash` can resolve
+    // to WSL, which cannot consume a Windows hook path.
+    let sh = 'sh';
+    if (process.platform === 'win32') {
+      const where = spawnSync('where.exe', ['git'], { encoding: 'utf8', windowsHide: true });
+      const gitPath = String(where.stdout || '').split(/\r?\n/).find(Boolean);
+      const candidate = gitPath && path.join(path.dirname(path.dirname(gitPath)), 'bin', 'sh.exe');
+      sh = candidate && fs.existsSync(candidate) ? candidate : 'bash';
+    }
+    const result = spawnSync(sh, [installed.hookPath], {
+      encoding: 'utf8',
+      windowsHide: true,
+      env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+    });
+    assert.strictEqual(result.status, 0, `hook must exit 0 even when Project-Knowledge is unavailable; got ${result.status}\n${result.stderr || ''}`);
+    assert(fs.existsSync(journal), 'fake trigger must be executed by the hook body');
+    const recorded = JSON.parse(fs.readFileSync(journal, 'utf8'));
+    assert.strictEqual(recorded.electronRunAsNode, '1', 'ELECTRON_RUN_AS_NODE=1 must be set before the trigger runs');
+    assert(recorded.argv.includes('--project-id'), 'trigger argv must include --project-id');
+    assert(recorded.argv.includes(projectId), 'trigger argv must include the project id');
+    fs.rmSync(repo, { recursive: true, force: true });
+    fs.rmSync(fakeTrigger, { force: true });
+    fs.rmSync(journal, { force: true });
+  }
+
+  console.log('desktop-hook-runtime-regression-test PASS');
+})().catch(error => {
+  console.error(error.stack || error.message);
+  process.exit(1);
+});

package/_site/_test/explicit-commit-processor-test.js

@@ -1,37 +1,37 @@
-const assert = require('assert');
-const { CommitReconciler } = require('../lib/commit-reconciler');
-
-const sha = suffix => `${'a'.repeat(39)}${suffix}`;
-const calls = [];
-let active = 0;
-let maxActive = 0;
-const completed = new Set();
-const projectStore = { readConfig: id => ({ projectId: id, enabled: true, repoPath: 'C:/fixture', knowledgePath: 'C:/knowledge' }) };
-const reconciler = new CommitReconciler({ projectStore, registryStore: {}, requireAiProfile: false });
-reconciler.processingLedger = {
-  read: (projectId, commitSha) => completed.has(`${projectId}:${commitSha}`) ? { status: 'completed' } : null,
-  complete: (projectId, commitSha) => { completed.add(`${projectId}:${commitSha}`); return { status: 'completed' }; },
-};
-reconciler.processCommit = async (projectId, _trigger, _operationId, _config, _branch, commitSha) => {
-  active += 1; maxActive = Math.max(maxActive, active); calls.push(`${projectId}:${commitSha}`);
-  await new Promise(resolve => setTimeout(resolve, 20));
-  active -= 1;
-  return { ok: true, commitSha, runId: `run-${commitSha.slice(-1)}`, claimFingerprint: `fp-${commitSha.slice(-1)}` };
-};
-
-(async () => {
-  const d = sha('d'); const e = sha('e'); const f = sha('f');
-  const duplicateA = reconciler.processCommitEvent({ projectId: 'project-a', commitSha: d, branch: 'main' });
-  const duplicateB = reconciler.processCommitEvent({ projectId: 'project-a', commitSha: d, branch: 'main' });
-  const next = reconciler.processCommitEvent({ projectId: 'project-a', commitSha: e, branch: 'main' });
-  const other = reconciler.processCommitEvent({ projectId: 'project-b', commitSha: f, branch: 'main' });
-  const [first, second, third, fourth] = await Promise.all([duplicateA, duplicateB, next, other]);
-  assert.equal(first.status, 'completed'); assert.equal(second.status, 'completed');
-  assert.equal(third.status, 'completed'); assert.equal(fourth.status, 'completed');
-  assert.deepEqual(calls.filter(value => value.startsWith('project-a:')), [`project-a:${d}`, `project-a:${e}`]);
-  assert.equal(calls.filter(value => value === `project-a:${d}`).length, 1, 'duplicate explicit Hook event must join');
-  assert(maxActive >= 2, 'different projects may process in parallel');
-  const repeated = await reconciler.processCommitEvent({ projectId: 'project-a', commitSha: d, branch: 'main' });
-  assert.equal(repeated.status, 'already-completed');
-  console.log('explicit-commit-processor-test PASS');
-})().catch(error => { console.error(error.stack || error.message); process.exit(1); });
+const assert = require('assert');
+const { CommitReconciler } = require('../lib/commit-reconciler');
+
+const sha = suffix => `${'a'.repeat(39)}${suffix}`;
+const calls = [];
+let active = 0;
+let maxActive = 0;
+const completed = new Set();
+const projectStore = { readConfig: id => ({ projectId: id, enabled: true, repoPath: 'C:/fixture', knowledgePath: 'C:/knowledge' }) };
+const reconciler = new CommitReconciler({ projectStore, registryStore: {}, requireAiProfile: false });
+reconciler.processingLedger = {
+  read: (projectId, commitSha) => completed.has(`${projectId}:${commitSha}`) ? { status: 'completed' } : null,
+  complete: (projectId, commitSha) => { completed.add(`${projectId}:${commitSha}`); return { status: 'completed' }; },
+};
+reconciler.processCommit = async (projectId, _trigger, _operationId, _config, _branch, commitSha) => {
+  active += 1; maxActive = Math.max(maxActive, active); calls.push(`${projectId}:${commitSha}`);
+  await new Promise(resolve => setTimeout(resolve, 20));
+  active -= 1;
+  return { ok: true, commitSha, runId: `run-${commitSha.slice(-1)}`, claimFingerprint: `fp-${commitSha.slice(-1)}` };
+};
+
+(async () => {
+  const d = sha('d'); const e = sha('e'); const f = sha('f');
+  const duplicateA = reconciler.processCommitEvent({ projectId: 'project-a', commitSha: d, branch: 'main' });
+  const duplicateB = reconciler.processCommitEvent({ projectId: 'project-a', commitSha: d, branch: 'main' });
+  const next = reconciler.processCommitEvent({ projectId: 'project-a', commitSha: e, branch: 'main' });
+  const other = reconciler.processCommitEvent({ projectId: 'project-b', commitSha: f, branch: 'main' });
+  const [first, second, third, fourth] = await Promise.all([duplicateA, duplicateB, next, other]);
+  assert.equal(first.status, 'completed'); assert.equal(second.status, 'completed');
+  assert.equal(third.status, 'completed'); assert.equal(fourth.status, 'completed');
+  assert.deepEqual(calls.filter(value => value.startsWith('project-a:')), [`project-a:${d}`, `project-a:${e}`]);
+  assert.equal(calls.filter(value => value === `project-a:${d}`).length, 1, 'duplicate explicit Hook event must join');
+  assert(maxActive >= 2, 'different projects may process in parallel');
+  const repeated = await reconciler.processCommitEvent({ projectId: 'project-a', commitSha: d, branch: 'main' });
+  assert.equal(repeated.status, 'already-completed');
+  console.log('explicit-commit-processor-test PASS');
+})().catch(error => { console.error(error.stack || error.message); process.exit(1); });

package/_site/_test/fixtures/make-git-repos.js

@@ -47,7 +47,18 @@ function initRepo(repoPath) {
 function makeRepo({ kind = 'one-commit' } = {}) {
   const repoPath = fs.mkdtempSync(path.join(os.tmpdir(), `kb-fixture-${kind}-${process.pid}-`));
   const commits = [];
-  const cleanup = () => fs.rmSync(repoPath, { recursive: true, force: true });
+  const cleanup = () => {
+    if (path.dirname(repoPath) !== path.resolve(os.tmpdir()) || !path.basename(repoPath).startsWith(`kb-fixture-${kind}-${process.pid}-`)) throw new Error('Unsafe fixture cleanup');
+    function remove(directory) {
+      for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+        const file = path.join(directory, entry.name);
+        if (entry.isDirectory() && !entry.isSymbolicLink()) remove(file);
+        else { try { fs.unlinkSync(file); } catch (error) { if (error.code !== 'EPERM') throw error; fs.chmodSync(file, 0o600); fs.unlinkSync(file); } }
+      }
+      fs.rmdirSync(directory);
+    }
+    if (fs.existsSync(repoPath)) remove(repoPath);
+  };
 
   if (kind === 'not-git') {
     write(path.join(repoPath, 'README.md'), '# not git\n');

package/_site/_test/folder-picker-output-test.js

@@ -1,19 +1,19 @@
-const assert = require('assert');
-const { selectedDirectoryFromOutput } = require('../lib/folder-picker-output');
-
-const banner = '������µĿ�ƽ̨ PowerShell https://aka.ms/pscore6';
-assert.equal(selectedDirectoryFromOutput(banner, { exists: () => false }), '',
-  'PowerShell banner text must never be accepted as a selected folder');
-
-const folder = 'D:\\work\\project';
-assert.equal(selectedDirectoryFromOutput(`${banner}\r\n${folder}\r\n`, {
-  exists: candidate => candidate === folder,
-  stat: () => ({ isDirectory: () => true }),
-}), folder, 'the existing absolute directory should be selected from mixed output');
-
-assert.equal(selectedDirectoryFromOutput('relative-folder', {
-  exists: () => true,
-  stat: () => ({ isDirectory: () => true }),
-}), '', 'relative output must not be accepted');
-
-console.log('folder-picker-output-test PASS');
+const assert = require('assert');
+const { selectedDirectoryFromOutput } = require('../lib/folder-picker-output');
+
+const banner = '������µĿ�ƽ̨ PowerShell https://aka.ms/pscore6';
+assert.equal(selectedDirectoryFromOutput(banner, { exists: () => false }), '',
+  'PowerShell banner text must never be accepted as a selected folder');
+
+const folder = 'D:\\work\\project';
+assert.equal(selectedDirectoryFromOutput(`${banner}\r\n${folder}\r\n`, {
+  exists: candidate => candidate === folder,
+  stat: () => ({ isDirectory: () => true }),
+}), folder, 'the existing absolute directory should be selected from mixed output');
+
+assert.equal(selectedDirectoryFromOutput('relative-folder', {
+  exists: () => true,
+  stat: () => ({ isDirectory: () => true }),
+}), '', 'relative output must not be accepted');
+
+console.log('folder-picker-output-test PASS');

package/_site/_test/fresh-hook-reimport-test.js

@@ -0,0 +1,53 @@
+const assert = require('assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const { StorageLayout } = require('../lib/storage-layout');
+const { SettingsStore } = require('../lib/settings-store');
+const { ProjectRegistryStore } = require('../lib/project-registry-store');
+const { ProjectStore } = require('../lib/project-store');
+const { ProjectLifecycleService } = require('../lib/project-lifecycle-service');
+const hooks = require('../lib/hook-manager');
+
+(async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'kb-fresh-hook-'));
+  const layout = new StorageLayout({ dataDir: path.join(root, 'fresh') });
+  const settingsStore = new SettingsStore({ layout });
+  const registryStore = new ProjectRegistryStore({ layout });
+  const projectStore = new ProjectStore({ layout });
+  const triggerScriptPath = path.resolve(__dirname, '../scripts/hook-trigger.js');
+  await settingsStore.initialize({ knowledge: { rootPath: path.join(root, 'knowledge') } });
+  await registryStore.initialize();
+  const options = { layout, settingsStore, registryStore, projectStore, triggerScriptPath };
+  const lifecycle = new ProjectLifecycleService(options);
+  const repo = path.join(root, '中文 项目'); fs.mkdirSync(repo);
+  const git = args => execFileSync('git', args, { cwd: repo, windowsHide: true, encoding: 'utf8' }).trim();
+  git(['init', '-q']); git(['config', 'user.name', 'Fresh Test']); git(['config', 'user.email', 'fresh@example.invalid']);
+  fs.writeFileSync(path.join(repo, 'user-code.txt'), 'unchanged'); git(['add', '.']); git(['commit', '-qm', 'baseline']);
+  const old = hooks.installHook({ repoPath: repo, projectId: 'project-old', triggerScriptPath, dataDir: path.join(root, 'old') });
+  const oldBytes = fs.readFileSync(old.hookPath, 'utf8');
+  const input = { localPath: repo, projectId: 'project-new', storageName: 'new' };
+  const preflight = await lifecycle.preflightImport(input);
+  assert.equal(preflight.checks.hook.replacementProjectId, 'project-old');
+  for (const confirmation of [undefined, 'project-wrong']) {
+    await assert.rejects(lifecycle.importProject({ ...input, replaceManagedHookProjectId: confirmation }), { code: 'HOOK_CONFLICT' });
+    assert.equal(fs.readFileSync(old.hookPath, 'utf8'), oldBytes);
+    assert.equal(registryStore.listIds().length, 0);
+  }
+  const brokenRegistry = Object.create(registryStore);
+  brokenRegistry.add = async () => { throw new Error('registry write failed'); };
+  await assert.rejects(new ProjectLifecycleService({ ...options, registryStore: brokenRegistry }).importProject({ ...input, replaceManagedHookProjectId: 'project-old' }));
+  assert.equal(fs.readFileSync(old.hookPath, 'utf8'), oldBytes, 'failed import restores the old managed hook');
+  const result = await lifecycle.importProject({ ...input, replaceManagedHookProjectId: 'project-old' });
+  assert.equal(hooks.readHookStatus({ repoPath: repo }).projectId, 'project-new');
+  assert.equal(result.state.lastAnalyzedCommit, null);
+  assert.equal(result.state.trackingStartCommit, git(['rev-parse', 'HEAD']));
+  assert.deepEqual(fs.readdirSync(result.config.knowledgePath), []);
+  assert.equal(fs.readFileSync(path.join(repo, 'user-code.txt'), 'utf8'), 'unchanged');
+  await lifecycle.deleteProject('project-new');
+  const thirdParty = '#!/bin/sh\necho third-party\n'; fs.writeFileSync(old.hookPath, thirdParty);
+  await assert.rejects(lifecycle.importProject({ ...input, replaceManagedHookProjectId: 'project-old' }), { code: 'HOOK_CONFLICT' });
+  assert.equal(fs.readFileSync(old.hookPath, 'utf8'), thirdParty);
+  console.log('PASS explicit fresh Hook replacement, rollback, baseline, third-party protection');
+})().catch(error => { console.error(error); process.exitCode = 1; });