@sanqianx/project-knowledge 4.7.0 → 5.0.0

package/_site/_test/product-diagnostics-ui-test.js

@@ -0,0 +1,75 @@
+'use strict';
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const http = require('node:http');
+const { spawnServer } = require('./helpers/spawn-server');
+const { findChrome } = require('./helpers/find-chrome');
+const { launchCdpBrowser, waitFor } = require('./helpers/cdp-browser');
+const { createLoggingUiFixture } = require('./helpers/logging-ui-fixture');
+const ROOT = path.resolve(__dirname, '../..');
+
+async function main() {
+  const fixture = await createLoggingUiFixture({ totalLogs: 240 });
+  const offline = http.createServer((req, res) => { res.writeHead(503, { 'content-type': 'application/json' }); res.end(JSON.stringify({ ok: false, error: { message: '验收中的离线模块' } })); });
+  await new Promise(resolve => offline.listen(0, '127.0.0.1', resolve));
+  const offlineUrl = `http://127.0.0.1:${offline.address().port}`;
+  const port = 8050 + process.pid % 200;
+  const base = `http://127.0.0.1:${port}`;
+  const server = spawnServer({ root: ROOT, port, dataDir: fixture.dataDir, tag: 'product-diagnostics-ui', analysisOwner: 'engine', extraEnv: {
+    KB_TERMINAL_URL: offlineUrl, KB_VECTORHUB_URL: offlineUrl, KB_EVENTBRIDGE_URL: offlineUrl, KB_KNOWLEDGE_ENGINE_URL: offlineUrl,
+  } });
+  let browser;
+  try {
+    await waitFor(async () => { try { return (await fetch(base + '/api/health')).ok; } catch { return false; } }, 'web shell', 20000);
+    browser = await launchCdpBrowser({ chrome: findChrome(), profileDir: path.join(fixture.dataDir, 'browser'), url: base, width: 1920, height: 1080 });
+    await browser.setViewport(1920, 1080);
+    const run = expression => browser.evaluate(expression);
+    const click = selector => run(`document.querySelector(${JSON.stringify(selector)}).click()`);
+    await waitFor(() => run(`document.getElementById('projectSelect').value === ${JSON.stringify(fixture.projectId)}`), 'registry projection');
+    for (const view of ['home', 'memory', 'projects', 'activity']) {
+      await click(`[data-view="${view}"]`); assert.equal(await run('document.documentElement.scrollWidth > innerWidth'), false, view);
+    }
+    assert.ok(await run("document.getElementById('projectDetail').textContent.includes('视觉检测知识库')"));
+    assert.ok(await run("document.getElementById('activityUpdates').textContent.includes('离线')"), 'offline cannot masquerade as empty/success');
+    await click('#openSystem'); await click('#openLogs');
+    await waitFor(() => run("document.querySelectorAll('#logsContent .log-entry').length === 100"), 'bounded diagnostic rendering');
+    assert.equal(await run("document.querySelectorAll('#logsDialog img, #logsDialog script').length"), 0);
+    await run("document.getElementById('logsSearch').value='<img src=x onerror=window.__xss=1>'"); await click('#loadLogs');
+    await waitFor(() => run("document.querySelectorAll('#logsContent .log-entry').length === 1"), 'real server query filter');
+    assert.equal(await run('window.__xss'), undefined);
+    await run("document.getElementById('logsSearch').value='模型输出校验失败'"); await click('#loadLogs');
+    await waitFor(() => run("document.querySelectorAll('#logsContent .log-entry').length === 1 && document.getElementById('logsContent').textContent.includes('VALIDATION_FAILED')"), 'retained error detail');
+    await click('#logsContent summary');
+    assert.equal(await run("document.querySelector('#logsContent details').open"), true);
+    assert.ok(await run("document.querySelector('#logsContent .log-detail').textContent.includes('promotionStep')"), 'failure stack remains diagnosable');
+    assert.equal(await run('window.__xss'), undefined);
+    await browser.send('Page.setDownloadBehavior', { behavior: 'allow', downloadPath: fixture.dataDir });
+    await click('#exportLogs');
+    const exportFile = path.join(fixture.dataDir, 'knowledge-diagnostics.jsonl');
+    await waitFor(() => fs.existsSync(exportFile), 'UI diagnostic export');
+    const entries = fs.readFileSync(exportFile, 'utf8').trim().split(/\r?\n/).map(line => JSON.parse(line));
+    assert.equal(entries.length, 1); assert.equal(entries[0].projectId, fixture.projectId);
+    await click('[data-close="logsDialog"]'); await click('#themeToggle');
+    await browser.send('Page.navigate', { url: base + '/#projects' });
+    await waitFor(() => run("document.getElementById('projectDetail').textContent.includes('视觉检测知识库')"), 'reload');
+    assert.equal(await run('document.documentElement.dataset.theme'), 'dark');
+    const codeFiles = fs.readdirSync(fixture.repo.path);
+    // The registry does not own knowledge bytes. Use its actual double-directory binding.
+    const project = (await (await fetch(base + '/api/projects/aggregated')).json()).projects[0];
+    const retained = path.join(project.knowledgePath, 'keep.md'); fs.writeFileSync(retained, '# 保留知识\n');
+    await run('window.confirm = () => true'); await click('[data-action="unbind"]');
+    await waitFor(() => run("document.getElementById('toast').textContent.includes('无法安全停止写入')"), 'offline writer prevents unsafe unbind');
+    assert.equal((await (await fetch(base + '/api/projects/aggregated')).json()).projects.length, 1);
+    assert.deepEqual(fs.readdirSync(fixture.repo.path), codeFiles); assert.ok(fs.existsSync(retained));
+    assert.equal(browser.exceptions.length, 0, JSON.stringify(browser.exceptions));
+    console.log('product-diagnostics-ui-test PASS (1920x1080; XSS/filter/expanded failure/export/theme/offline writer protection)');
+  } catch (error) {
+    if (browser) console.error(await browser.evaluate("JSON.stringify({ toast:document.getElementById('toast').textContent, project:document.getElementById('projectSelect').value, detail:document.getElementById('projectDetail').textContent })"));
+    throw error;
+  } finally {
+    await browser?.close(); await server.cleanup(); offline.closeAllConnections(); await new Promise(resolve => offline.close(resolve)); fixture.cleanup();
+  }
+}
+main().catch(error => { console.error(error.stack || error.message); process.exitCode = 1; });

package/_site/_test/product-import-ui-test.js

@@ -0,0 +1,92 @@
+'use strict';
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const http = require('node:http');
+const { spawnSync } = require('node:child_process');
+const { spawnServer } = require('./helpers/spawn-server');
+const { findChrome } = require('./helpers/find-chrome');
+const { launchCdpBrowser, waitFor } = require('./helpers/cdp-browser');
+
+const ROOT = path.resolve(__dirname, '../..');
+const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-product-import-ui-'));
+const dataDir = path.join(fixture, 'data');
+const repo = path.join(fixture, '中文 空格项目');
+const knowledgeRoot = path.join(fixture, '知识目录');
+const knowledge = path.join(knowledgeRoot, '项目知识');
+const git = args => {
+  const result = spawnSync('git', args, { cwd: repo, windowsHide: true, encoding: 'utf8' });
+  assert.equal(result.status, 0, result.stderr); return result.stdout.trim();
+};
+async function main() {
+  fs.mkdirSync(repo); fs.mkdirSync(knowledgeRoot);
+  git(['init', '-q']); git(['config', 'user.email', 'ui-regression@local.invalid']); git(['config', 'user.name', 'UI Regression']);
+  fs.writeFileSync(path.join(repo, 'README.md'), '# UI regression baseline\n'); git(['add', '.']); git(['commit', '-qm', 'baseline']);
+  const baseline = git(['rev-parse', 'HEAD']);
+  // Offline modules are intentional: retain registration and report partial
+  // wiring, rather than fabricate successful links.
+  const offline = http.createServer((req, res) => { res.writeHead(503, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ ok: false, error: { code: 'MODULE_OFFLINE', message: '验收中的离线模块' } })); });
+  await new Promise(resolve => offline.listen(0, '127.0.0.1', resolve));
+  const offlineUrl = `http://127.0.0.1:${offline.address().port}`;
+  const port = 7960 + process.pid % 200;
+  const base = `http://127.0.0.1:${port}`;
+  const server = spawnServer({ root: ROOT, port, dataDir, tag: 'product-import-ui', analysisOwner: 'engine', extraEnv: {
+    KB_MODULES_REGISTER: '1', KB_TERMINAL_URL: offlineUrl, KB_VECTORHUB_URL: offlineUrl,
+    KB_EVENTBRIDGE_URL: offlineUrl, KB_KNOWLEDGE_ENGINE_URL: offlineUrl,
+  } });
+  let browser;
+  const api = async route => { const response = await fetch(base + route, { signal: AbortSignal.timeout(10000) }); assert.ok(response.ok, route); return response.json(); };
+  try {
+    await waitFor(async () => { try { return (await api('/api/health')).ok; } catch { return false; } }, 'isolated shell', 20000);
+    browser = await launchCdpBrowser({ chrome: findChrome(), profileDir: path.join(fixture, 'browser'), url: base, width: 1920, height: 1080 });
+    await browser.setViewport(1920, 1080);
+    const run = expression => browser.evaluate(expression);
+    const click = selector => run(`document.querySelector(${JSON.stringify(selector)}).click()`);
+    const fill = (selector, value) => run(`(() => { const field=document.querySelector(${JSON.stringify(selector)}); field.value=${JSON.stringify(value)}; field.dispatchEvent(new Event('input',{bubbles:true})); })()`);
+    await waitFor(() => run("document.getElementById('homeContent').textContent.includes('第一个项目')"), 'real empty state');
+    for (const view of ['work', 'search', 'memory', 'projects', 'activity', 'home']) {
+      await click(`[data-view="${view}"]`);
+      assert.equal(await run(`document.getElementById('view-${view}').classList.contains('active')`), true);
+      assert.equal(await run('document.documentElement.scrollWidth > innerWidth'), false, `desktop overflow in ${view}`);
+    }
+    await click('#themeToggle'); assert.equal(await run('document.documentElement.dataset.theme'), 'dark');
+    await click('[data-view="projects"]'); await click('#createDomain');
+    await fill('#domainForm input[name="name"]', '回归领域'); await click('#domainForm button[type="submit"]');
+    await waitFor(() => run("!document.getElementById('domainDialog').open && document.getElementById('projectTree').textContent.includes('回归领域')"), 'domain persisted from UI');
+    await click('.view.active [data-action="import"]');
+    assert.equal(await run("document.getElementById('confirmImport').disabled"), true);
+    assert.equal(await run("document.getElementById('pickCode').hidden || document.getElementById('pickKnowledge').hidden"), false);
+    await fill('#importCode', repo); await fill('#importName', '回归项目'); await fill('#importKnowledge', knowledge);
+    const domainId = await run("[...document.getElementById('importDomain').options].find(o=>o.textContent==='回归领域').value");
+    await run(`document.getElementById('importDomain').value=${JSON.stringify(domainId)}`);
+    await waitFor(() => run("!document.getElementById('setupImportRoot').hidden"), 'root missing action');
+    assert.equal(await run("document.getElementById('confirmImport').disabled"), true);
+    await click('#setupImportRoot'); await fill('#knowledgeRoot', knowledgeRoot); await click('#saveBrainSettings');
+    await waitFor(() => run("document.getElementById('importDialog').open && !document.getElementById('confirmImport').disabled"), 'setup returns to ready import');
+    const values = await run("Object.fromEntries(['importCode','importKnowledge','importName','importDomain'].map(id=>[id,document.getElementById(id).value]))");
+    assert.deepEqual(values, { importCode: repo, importKnowledge: knowledge, importName: '回归项目', importDomain: domainId });
+    await click('#confirmImport');
+    await waitFor(() => run("!document.getElementById('importDialog').open && document.getElementById('projectDetail').textContent.includes('回归项目')"), 'import feedback', 30000);
+    const selected = await run("document.getElementById('projectSelect').value");
+    const project = (await api('/api/projects/aggregated')).projects.find(p => p.projectId === selected);
+    assert.ok(project && Object.values(project.modules).every(module => !module.registered));
+    assert.equal(path.resolve(project.workspacePath), path.resolve(repo)); assert.equal(path.resolve(project.knowledgePath), path.resolve(knowledge));
+    assert.equal(project.domainId, domainId);
+    assert.ok(fs.existsSync(path.join(repo, '.git/hooks/post-commit')));
+    assert.ok(fs.existsSync(knowledge)); assert.equal(git(['rev-parse', 'HEAD']), baseline, 'import must not commit or analyze history');
+    assert.match(await run("document.getElementById('toast').textContent"), /部分接线待恢复/);
+    await click('.view.active [data-action="import"]'); await fill('#importCode', repo); await fill('#importKnowledge', knowledge);
+    await waitFor(() => run("document.getElementById('preflightStatus').textContent.includes('此项目已导入')"), 'duplicate rejected');
+    assert.equal(await run("document.getElementById('confirmImport').disabled"), true);
+    assert.equal((await api('/api/projects/aggregated')).projects.length, 1);
+    assert.equal(browser.exceptions.length, 0, 'no uncaught product JavaScript exceptions');
+    console.log('product-import-ui-test PASS (1920×1080; real UI → registry/Hook/directories; offline module wiring remains partial)');
+  } finally {
+    await browser?.close(); await server.cleanup();
+    offline.closeAllConnections(); await new Promise(resolve => offline.close(resolve));
+    assert.equal(path.dirname(fixture), path.resolve(os.tmpdir())); assert.ok(path.basename(fixture).startsWith('pk-product-import-ui-'));
+    fs.rmSync(fixture, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+  }
+}
+main().catch(error => { console.error(error.stack || error.message); process.exitCode = 1; });

package/_site/_test/project-delete-recovery-test.js

@@ -1,64 +1,64 @@
-const assert = require('assert');
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { StorageLayout } = require('../lib/storage-layout');
-const { ProjectRegistryStore } = require('../lib/project-registry-store');
-const { ProjectStore } = require('../lib/project-store');
-const { ProjectLifecycleService } = require('../lib/project-lifecycle-service');
-
-(async () => {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-delete-recovery-'));
-  const layout = new StorageLayout({ dataDir: path.join(root, 'data') });
-  const registry = new ProjectRegistryStore({ layout });
-  const projects = new ProjectStore({ layout });
-  await registry.initialize();
-  const faultPoints = [
-    'delete-tombstoned',
-    'delete-before-hook', 'delete-after-hook',
-    'delete-before-registry', 'delete-after-registry',
-    'delete-before-metadata', 'delete-after-metadata',
-    'delete-before-knowledge', 'delete-after-knowledge',
-    'delete-before-completed',
-  ];
-  const hooks = {
-    uninstallHook({ projectId }) { return { ok: true, removed: true, projectId }; },
-  };
-  for (let index = 0; index < faultPoints.length; index += 1) {
-    const projectId = `project-delete-${String(index).padStart(2, '0')}`;
-    const repoPath = path.join(root, 'repos', projectId);
-    const knowledgePath = path.join(root, 'knowledge', projectId);
-    fs.mkdirSync(repoPath, { recursive: true });
-    fs.mkdirSync(knowledgePath, { recursive: true });
-    fs.writeFileSync(path.join(knowledgePath, 'README.md'), '# User knowledge\n', 'utf8');
-    await projects.create(projectId, { displayName: projectId, storageName: projectId, repoPath, knowledgePath });
-    await registry.add(projectId, { displayNameSnapshot: projectId });
-    let injected = false;
-    const failing = new ProjectLifecycleService({
-      layout, registryStore: registry, projectStore: projects, hookManager: hooks,
-      fault(point) {
-        if (!injected && point === faultPoints[index]) { injected = true; throw new Error(`fault:${point}`); }
-      },
-    });
-    await assert.rejects(
-      failing.deleteProject(projectId, { deleteKnowledge: true, confirmationToken: projectId }),
-      error => /fault:|can be retried/.test(error.message),
-      `fault ${faultPoints[index]} must stop the first attempt`,
-    );
-    assert(fs.existsSync(failing.deleteTransactionPath(projectId)), 'a durable tombstone must exist before any externally visible mutation');
-
-    const recovery = new ProjectLifecycleService({ layout, registryStore: registry, projectStore: projects, hookManager: hooks });
-    const recovered = await recovery.deleteProject(projectId, { deleteKnowledge: true, confirmationToken: projectId });
-    assert.strictEqual(recovered.ok, true, `fault ${faultPoints[index]} must recover on retry`);
-    assert(!registry.listIds().includes(projectId));
-    assert(!fs.existsSync(layout.getProjectMetadataDir(projectId)));
-    assert(!fs.existsSync(knowledgePath));
-    const journal = recovery.readDeleteJournal(projectId);
-    assert.strictEqual(journal.phase, 'completed');
-    assert(Object.values(journal.steps).every(step => step.completed), 'every delete step must be durably terminal');
-  }
-  console.log('project-delete-recovery-test PASS');
-})().catch(error => {
-  console.error(error.stack || error.message);
-  process.exitCode = 1;
-});
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { StorageLayout } = require('../lib/storage-layout');
+const { ProjectRegistryStore } = require('../lib/project-registry-store');
+const { ProjectStore } = require('../lib/project-store');
+const { ProjectLifecycleService } = require('../lib/project-lifecycle-service');
+
+(async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-delete-recovery-'));
+  const layout = new StorageLayout({ dataDir: path.join(root, 'data') });
+  const registry = new ProjectRegistryStore({ layout });
+  const projects = new ProjectStore({ layout });
+  await registry.initialize();
+  const faultPoints = [
+    'delete-tombstoned',
+    'delete-before-hook', 'delete-after-hook',
+    'delete-before-registry', 'delete-after-registry',
+    'delete-before-metadata', 'delete-after-metadata',
+    'delete-before-knowledge', 'delete-after-knowledge',
+    'delete-before-completed',
+  ];
+  const hooks = {
+    uninstallHook({ projectId }) { return { ok: true, removed: true, projectId }; },
+  };
+  for (let index = 0; index < faultPoints.length; index += 1) {
+    const projectId = `project-delete-${String(index).padStart(2, '0')}`;
+    const repoPath = path.join(root, 'repos', projectId);
+    const knowledgePath = path.join(root, 'knowledge', projectId);
+    fs.mkdirSync(repoPath, { recursive: true });
+    fs.mkdirSync(knowledgePath, { recursive: true });
+    fs.writeFileSync(path.join(knowledgePath, 'README.md'), '# User knowledge\n', 'utf8');
+    await projects.create(projectId, { displayName: projectId, storageName: projectId, repoPath, knowledgePath });
+    await registry.add(projectId, { displayNameSnapshot: projectId });
+    let injected = false;
+    const failing = new ProjectLifecycleService({
+      layout, registryStore: registry, projectStore: projects, hookManager: hooks,
+      fault(point) {
+        if (!injected && point === faultPoints[index]) { injected = true; throw new Error(`fault:${point}`); }
+      },
+    });
+    await assert.rejects(
+      failing.deleteProject(projectId, { deleteKnowledge: true, confirmationToken: projectId }),
+      error => /fault:|can be retried/.test(error.message),
+      `fault ${faultPoints[index]} must stop the first attempt`,
+    );
+    assert(fs.existsSync(failing.deleteTransactionPath(projectId)), 'a durable tombstone must exist before any externally visible mutation');
+
+    const recovery = new ProjectLifecycleService({ layout, registryStore: registry, projectStore: projects, hookManager: hooks });
+    const recovered = await recovery.deleteProject(projectId, { deleteKnowledge: true, confirmationToken: projectId });
+    assert.strictEqual(recovered.ok, true, `fault ${faultPoints[index]} must recover on retry`);
+    assert(!registry.listIds().includes(projectId));
+    assert(!fs.existsSync(layout.getProjectMetadataDir(projectId)));
+    assert(!fs.existsSync(knowledgePath));
+    const journal = recovery.readDeleteJournal(projectId);
+    assert.strictEqual(journal.phase, 'completed');
+    assert(Object.values(journal.steps).every(step => step.completed), 'every delete step must be durably terminal');
+  }
+  console.log('project-delete-recovery-test PASS');
+})().catch(error => {
+  console.error(error.stack || error.message);
+  process.exitCode = 1;
+});

package/_site/_test/project-goal-editor-test.js

@@ -1,145 +1,145 @@
-// _site/_test/project-goal-editor-test.js
-//
-// T13: Project Goal editor.
-//   GET /api/projects/:id/goal  -> read GOAL.md from project knowledge path
-//   PUT /api/projects/:id/goal  -> atomic write GOAL.md
-// Verifies:
-//   - missing GOAL.md returns exists=false;
-//   - PUT creates the file atomically;
-//   - subsequent GET returns the persisted content;
-//   - empty content allowed (no auto-template);
-//   - the file is scoped to the project's own knowledgePath (no
-//     cross-project writes);
-//   - 413 when content exceeds 256KB.
-
-const assert = require('assert');
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { spawnSync } = require('child_process');
-const { spawnServer } = require('./helpers/spawn-server');
-
-const ROOT = path.resolve(__dirname, '..', '..');
-const sitePort = 8000 + (process.pid % 200);
-const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-goal-' + process.pid + '-'));
-const repo = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-goal-repo-' + process.pid + '-'));
-
-function git(args) {
-  const result = spawnSync('git', ['-C', repo, ...args], {
-    encoding: 'utf8', windowsHide: true,
-    env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
-  });
-  if (result.status !== 0) throw new Error(result.stderr || `git ${args.join(' ')} failed: ${result.status}`);
-  return String(result.stdout || '').trim();
-}
-
-async function serverFetch(url, init, timeoutMs = 10000) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const response = await fetch(url, { ...init, signal: controller.signal });
-    const text = await response.text();
-    return { status: response.status, body: text ? JSON.parse(text) : {} };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-(async () => {
-  git(['init', '-q', '-b', 'main']);
-  git(['config', 'user.email', 'goal@example.local']);
-  git(['config', 'user.name', 'Goal']);
-  fs.writeFileSync(path.join(repo, 'README.md'), '# goal\n');
-  git(['add', 'README.md']);
-  git(['commit', '-q', '-m', 'baseline']);
-  const knowledgeRoot = path.join(dataDir, 'knowledge');
-  fs.mkdirSync(knowledgeRoot, { recursive: true });
-  const server = spawnServer({
-    root: ROOT, port: sitePort, dataDir, tag: 'goal',
-    extraEnv: { KB_AUTOMATION_FAKE_CLAUDE: '1', KB_EMBEDDING_FAKE: '1', KB_SKIP_MIGRATION: '1' },
-  });
-  try {
-    for (let attempt = 0; attempt < 100; attempt += 1) {
-      try { const r = await serverFetch(`http://127.0.0.1:${sitePort}/api/health`); if (r.body.ok) break; } catch {}
-      await new Promise(resolve => setTimeout(resolve, 100));
-    }
-    await serverFetch(`http://127.0.0.1:${sitePort}/api/settings`, {
-      method: 'PATCH', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ knowledge: { rootPath: knowledgeRoot } }),
-    });
-    await serverFetch(`http://127.0.0.1:${sitePort}/api/ai-profiles`, {
-      method: 'PUT', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({
-        schema: 'ai-profiles/v1', defaultProfileId: 'fake',
-        profiles: [{ id: 'fake', name: 'Fake', enabled: true, vendor: 'anthropic', model: 'fake', apiKeyUpdate: { mode: 'replace', value: 'k' } }],
-      }),
-    });
-    const importR = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/import`, {
-      method: 'POST', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ localPath: repo, aiProfileId: 'fake' }),
-    });
-    assert.strictEqual(importR.status, 201, JSON.stringify(importR.body));
-    const projectId = importR.body.projectId;
-    const knowledgePath = importR.body.config.knowledgePath;
-
-    // Case 1: GET on missing GOAL.md returns exists=false
-    let r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${projectId}/goal`, undefined);
-    assert.strictEqual(r.status, 200);
-    assert.strictEqual(r.body.exists, false);
-    assert.strictEqual(r.body.content, '');
-
-    // Case 2: PUT creates the file atomically with the supplied content
-    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${projectId}/goal`, {
-      method: 'PUT', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ content: '# Project Goal\n\nBuild a knowledge base for v4.1.22 -> main recovery.\n' }),
-    });
-    assert.strictEqual(r.status, 200, JSON.stringify(r.body));
-    const goalPath = path.join(knowledgePath, 'GOAL.md');
-    assert(fs.existsSync(goalPath), 'GOAL.md must be created');
-    assert(fs.readFileSync(goalPath, 'utf8').includes('v4.1.22'), 'goal content must include the user-supplied text');
-
-    // Case 3: GET now returns the persisted content
-    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${projectId}/goal`, undefined);
-    assert.strictEqual(r.status, 200);
-    assert.strictEqual(r.body.exists, true);
-    assert(r.body.content.includes('v4.1.22'));
-
-    // Case 4: empty content is allowed (no auto-template)
-    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${projectId}/goal`, {
-      method: 'PUT', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ content: '' }),
-    });
-    assert.strictEqual(r.status, 200);
-    assert.strictEqual(fs.readFileSync(goalPath, 'utf8'), '', 'empty content must clear the file');
-
-    // Case 5: writes are scoped to the project's own knowledgePath
-    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${projectId}/goal`, {
-      method: 'PUT', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ content: 'real content\n' }),
-    });
-    assert.strictEqual(r.status, 200);
-    const otherFiles = fs.readdirSync(knowledgePath).filter(name => name !== 'GOAL.md');
-    assert.deepStrictEqual(otherFiles, [], 'only GOAL.md must be created in the project knowledge path');
-
-    // Case 6: 413 when content exceeds 256KB
-    const huge = 'x'.repeat(257 * 1024);
-    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${projectId}/goal`, {
-      method: 'PUT', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ content: huge }),
-    });
-    assert.strictEqual(r.status, 413);
-
-    // Case 7: GET on a non-existent project returns 404
-    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/does-not-exist/goal`, undefined);
-    assert.strictEqual(r.status, 404);
-  } finally {
-    server.child.kill();
-    await new Promise(resolve => server.child.once('exit', resolve));
-    fs.rmSync(dataDir, { recursive: true, force: true });
-    fs.rmSync(repo, { recursive: true, force: true });
-  }
-  console.log('project-goal-editor-test PASS');
-})().catch(error => {
-  console.error(error.stack || error.message);
-  process.exit(1);
+// _site/_test/project-goal-editor-test.js
+//
+// T13: Project Goal editor.
+//   GET /api/projects/:id/goal  -> read GOAL.md from project knowledge path
+//   PUT /api/projects/:id/goal  -> atomic write GOAL.md
+// Verifies:
+//   - missing GOAL.md returns exists=false;
+//   - PUT creates the file atomically;
+//   - subsequent GET returns the persisted content;
+//   - empty content allowed (no auto-template);
+//   - the file is scoped to the project's own knowledgePath (no
+//     cross-project writes);
+//   - 413 when content exceeds 256KB.
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { spawnServer } = require('./helpers/spawn-server');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const sitePort = 8000 + (process.pid % 200);
+const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-goal-' + process.pid + '-'));
+const repo = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-goal-repo-' + process.pid + '-'));
+
+function git(args) {
+  const result = spawnSync('git', ['-C', repo, ...args], {
+    encoding: 'utf8', windowsHide: true,
+    env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+  });
+  if (result.status !== 0) throw new Error(result.stderr || `git ${args.join(' ')} failed: ${result.status}`);
+  return String(result.stdout || '').trim();
+}
+
+async function serverFetch(url, init, timeoutMs = 10000) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(url, { ...init, signal: controller.signal });
+    const text = await response.text();
+    return { status: response.status, body: text ? JSON.parse(text) : {} };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+(async () => {
+  git(['init', '-q', '-b', 'main']);
+  git(['config', 'user.email', 'goal@example.local']);
+  git(['config', 'user.name', 'Goal']);
+  fs.writeFileSync(path.join(repo, 'README.md'), '# goal\n');
+  git(['add', 'README.md']);
+  git(['commit', '-q', '-m', 'baseline']);
+  const knowledgeRoot = path.join(dataDir, 'knowledge');
+  fs.mkdirSync(knowledgeRoot, { recursive: true });
+  const server = spawnServer({
+    root: ROOT, port: sitePort, dataDir, tag: 'goal',
+    extraEnv: { KB_AUTOMATION_FAKE_CLAUDE: '1', KB_EMBEDDING_FAKE: '1', KB_SKIP_MIGRATION: '1' },
+  });
+  try {
+    for (let attempt = 0; attempt < 100; attempt += 1) {
+      try { const r = await serverFetch(`http://127.0.0.1:${sitePort}/api/health`); if (r.body.ok) break; } catch {}
+      await new Promise(resolve => setTimeout(resolve, 100));
+    }
+    await serverFetch(`http://127.0.0.1:${sitePort}/api/settings`, {
+      method: 'PATCH', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ knowledge: { rootPath: knowledgeRoot } }),
+    });
+    await serverFetch(`http://127.0.0.1:${sitePort}/api/ai-profiles`, {
+      method: 'PUT', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        schema: 'ai-profiles/v1', defaultProfileId: 'fake',
+        profiles: [{ id: 'fake', name: 'Fake', enabled: true, vendor: 'anthropic', model: 'fake', apiKeyUpdate: { mode: 'replace', value: 'k' } }],
+      }),
+    });
+    const importR = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/import`, {
+      method: 'POST', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ localPath: repo, aiProfileId: 'fake' }),
+    });
+    assert.strictEqual(importR.status, 201, JSON.stringify(importR.body));
+    const projectId = importR.body.projectId;
+    const knowledgePath = importR.body.config.knowledgePath;
+
+    // Case 1: GET on missing GOAL.md returns exists=false
+    let r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${projectId}/goal`, undefined);
+    assert.strictEqual(r.status, 200);
+    assert.strictEqual(r.body.exists, false);
+    assert.strictEqual(r.body.content, '');
+
+    // Case 2: PUT creates the file atomically with the supplied content
+    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${projectId}/goal`, {
+      method: 'PUT', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ content: '# Project Goal\n\nBuild a knowledge base for v4.1.22 -> main recovery.\n' }),
+    });
+    assert.strictEqual(r.status, 200, JSON.stringify(r.body));
+    const goalPath = path.join(knowledgePath, 'GOAL.md');
+    assert(fs.existsSync(goalPath), 'GOAL.md must be created');
+    assert(fs.readFileSync(goalPath, 'utf8').includes('v4.1.22'), 'goal content must include the user-supplied text');
+
+    // Case 3: GET now returns the persisted content
+    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${projectId}/goal`, undefined);
+    assert.strictEqual(r.status, 200);
+    assert.strictEqual(r.body.exists, true);
+    assert(r.body.content.includes('v4.1.22'));
+
+    // Case 4: empty content is allowed (no auto-template)
+    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${projectId}/goal`, {
+      method: 'PUT', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ content: '' }),
+    });
+    assert.strictEqual(r.status, 200);
+    assert.strictEqual(fs.readFileSync(goalPath, 'utf8'), '', 'empty content must clear the file');
+
+    // Case 5: writes are scoped to the project's own knowledgePath
+    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${projectId}/goal`, {
+      method: 'PUT', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ content: 'real content\n' }),
+    });
+    assert.strictEqual(r.status, 200);
+    const otherFiles = fs.readdirSync(knowledgePath).filter(name => name !== 'GOAL.md');
+    assert.deepStrictEqual(otherFiles, [], 'only GOAL.md must be created in the project knowledge path');
+
+    // Case 6: 413 when content exceeds 256KB
+    const huge = 'x'.repeat(257 * 1024);
+    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${projectId}/goal`, {
+      method: 'PUT', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ content: huge }),
+    });
+    assert.strictEqual(r.status, 413);
+
+    // Case 7: GET on a non-existent project returns 404
+    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/does-not-exist/goal`, undefined);
+    assert.strictEqual(r.status, 404);
+  } finally {
+    server.child.kill();
+    await new Promise(resolve => server.child.once('exit', resolve));
+    fs.rmSync(dataDir, { recursive: true, force: true });
+    fs.rmSync(repo, { recursive: true, force: true });
+  }
+  console.log('project-goal-editor-test PASS');
+})().catch(error => {
+  console.error(error.stack || error.message);
+  process.exit(1);
 });