@sanqianx/project-knowledge 5.0.16-rc.4 → 5.0.16-rc.6

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "project-knowledge",
-      "version": "5.0.16-rc.4",
+      "version": "5.0.16-rc.6",
       "source": "./plugins/project-knowledge",
       "description": "Search durable project decisions and implementation history through MCP."
     }

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [5.0.16-rc.6] - 2026-10-15
+
+- 修复 Codex 0.137 将 scoped npm 目录中的 `@` 误作 Git ref：本地目录含 `@` 时从该目录执行 `marketplace add .`，更换和回退分别使用自己的工作目录，不复制目录、不访问 GitHub。
+- CLI 子操作日志关联原操作 ID，允许继续处理的失败仍记录安全诊断；本地路径误判保留 `CODEX_LOCAL_SOURCE_REF`，不写入原始 CLI 输出。
+- 保留 rc.5 的已验证四模块版本、索引与知识功能。rc.5 本机保真升级已通过：7 项目、43 历史文件、565 索引文件保留；真实记忆闭环与双 Node 浏览器门禁通过，热查询 P95 为 693ms（1000 文档合成语料）。
+- 本机 Codex 已通过原生本地市场操作恢复，MCP 声明入口 initialize/六工具/resolve/search/get 验证通过；Hook 尚待用户审核，不计自动上下文通过。候选不更新 latest。
+
+## [5.0.16-rc.5] - 2026-10-15
+
+- 精确锁定 Workbench 0.13.2-rc.13：模型目录加载失败不再伪装成空目录；保留上次有效结果，提供明确错误与重试，打开菜单可恢复请求，关闭菜单后的迟到响应不会重开菜单。保存或删除供应商后不复用保存前的旧快照，普通菜单打开仍共享请求。
+- 保留 rc.4 的引擎与向量检索修复；模型菜单错误不显示原始异常或凭据。补充连续保存的竞态回归及测试服务器模块隔离，安装版故障恢复仍须单独验收。
+- Leader 负责关键开发和发布收尾，GLM 并行独立做故障测试与审查。候选发布到 next，不改变 latest。
+
 ## [5.0.16-rc.4] - 2026-10-14
 
 - 引擎 0.2.7-rc.7 复用同一次检索刚读取的知识正文，保留晚到响应后的文件与范围校验；vector-hub 1.0.8-rc.8 将有界查询缓存延长到 10 分钟，并防止旧请求失败删除新缓存。源码真实向量热查询 P95 为 1069ms，不代表安装版验收通过。

package/_site/_test/codex-marketplace-scoped-path-test.js

@@ -0,0 +1,186 @@
+'use strict';
+// Red-first regression (Q7): Codex CLI 0.137 rejects
+// `plugin marketplace add <SOURCE>` with
+// "Error: --ref is only supported for git marketplace sources"
+// whenever the SOURCE string contains '@', which every scoped npm root
+// (node_modules/@sanqianx/project-knowledge) does. Running the same add from
+// the package directory's own cwd with SOURCE '.' avoids the '@' entirely.
+// ensureCodexMarketplace() must use that form for the target add and for the
+// rollback re-add of a previous scoped root, while non-'@' absolute paths keep
+// the original invocation and third-party same-name sources stay untouched.
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { IntegrationManager } = require('../lib/integration-installer');
+
+const TEMP_BASE = fs.mkdtempSync(path.join(os.tmpdir(), 'codex-marketplace-scoped-path-'));
+const TEST_HOME = path.join(TEMP_BASE, 'home');
+const MARKETPLACE = 'project-knowledge';
+const REF_ERROR = 'Error: --ref is only supported for git marketplace sources';
+const NEW_ROOT = path.join(TEMP_BASE, 'new-root', '@sanqianx', 'project-knowledge');
+const OLD_ROOT = path.join(TEMP_BASE, 'old-root', '@sanqianx-previous', 'project-knowledge');
+const PLAIN_ROOT = path.join(TEMP_BASE, 'plain-root', 'project-knowledge');
+const THIRD_PARTY_ROOT = path.join(TEMP_BASE, 'third-party', 'marketplace');
+
+function writePackage(directory, name, version) {
+  fs.mkdirSync(directory, { recursive: true });
+  fs.writeFileSync(path.join(directory, 'package.json'), JSON.stringify({ name, version }, null, 2));
+}
+
+// Native-style in-memory codex CLI mirroring 0.137 marketplace semantics:
+// a marketplace add SOURCE containing '@' is parsed as <repo>@<ref> and
+// rejected; SOURCE '.' resolves against runnerOptions.cwd.
+function createCodexCli() {
+  const state = { marketplaces: new Map(), calls: [], addCalls: [], removeCalls: [], failAddDirs: new Set() };
+  const runner = (command, args, runnerOptions = {}) => {
+    state.calls.push({ command, args: [...args], cwd: runnerOptions.cwd || null });
+    if (args[0] !== 'plugin' || args[1] !== 'marketplace') {
+      return { status: 1, stdout: '', stderr: `fake codex CLI: unsupported command: ${args.join(' ')}` };
+    }
+    if (args[2] === 'list') {
+      const lines = [...state.marketplaces].map(([name, source]) => `${name} ${source}`);
+      return { status: 0, stdout: lines.length ? `${lines.join('\n')}\n` : '', stderr: '' };
+    }
+    if (args[2] === 'remove') {
+      state.marketplaces.delete(args[3]);
+      state.removeCalls.push(args[3]);
+      return { status: 0, stdout: '', stderr: '' };
+    }
+    if (args[2] === 'add') {
+      const source = String(args[3]);
+      const resolved = path.resolve(String(runnerOptions.cwd || process.cwd()), source);
+      state.addCalls.push({ source, cwd: runnerOptions.cwd || null, resolved });
+      if (source.includes('@')) return { status: 1, stdout: '', stderr: REF_ERROR };
+      if (state.failAddDirs.has(resolved)) return { status: 1, stdout: '', stderr: 'forced marketplace add failure (test)' };
+      let stat = null;
+      try { stat = fs.statSync(resolved); } catch { /* missing source handled below */ }
+      if (!stat || !stat.isDirectory()) return { status: 1, stdout: '', stderr: `Error: marketplace source not found: ${source}` };
+      state.marketplaces.set(MARKETPLACE, resolved);
+      return { status: 0, stdout: '', stderr: '' };
+    }
+    return { status: 1, stdout: '', stderr: `fake codex CLI: unsupported marketplace command: ${args.join(' ')}` };
+  };
+  return { runner, state };
+}
+
+function createManager(cli, rootDir) {
+  return new IntegrationManager({
+    rootDir,
+    homeDir: TEST_HOME,
+    bridgeHomeDir: path.join(TEMP_BASE, 'bridge'),
+    env: {},
+    commandResolver: name => `fake-${name}`,
+    runner: cli.runner,
+  });
+}
+
+function registeredSource(cli) {
+  const line = [...cli.state.marketplaces].map(([name, source]) => `${name} ${source}`)
+    .find(item => item.startsWith(`${MARKETPLACE} `));
+  return line ? line.slice(MARKETPLACE.length).trim() : null;
+}
+
+function lastAdd(cli) {
+  assert.ok(cli.state.addCalls.length, 'expected at least one marketplace add call');
+  return cli.state.addCalls[cli.state.addCalls.length - 1];
+}
+
+function assertDotAdd(add, expectedRoot, label) {
+  assert.equal(add.source, '.', `${label}: scoped root must be added via the "." source, not an "@"-containing path`);
+  assert.equal(path.resolve(add.cwd || ''), expectedRoot, `${label}: "." must resolve against the package directory's own cwd`);
+}
+
+function main() {
+  writePackage(NEW_ROOT, '@sanqianx/project-knowledge', '5.0.16');
+  writePackage(OLD_ROOT, '@sanqianx/project-knowledge', '5.0.15');
+  writePackage(PLAIN_ROOT, '@sanqianx/project-knowledge', '5.0.16');
+  writePackage(THIRD_PARTY_ROOT, 'third-party-market', '1.0.0');
+
+  const results = [];
+  const scenario = (name, fn) => {
+    try { fn(); results.push({ name, ok: true }); }
+    catch (error) { results.push({ name, ok: false, error: String((error && error.message) || error) }); }
+  };
+
+  scenario('fresh: scoped npm root installs via "." from its own cwd', () => {
+    const cli = createCodexCli();
+    createManager(cli, NEW_ROOT).ensureCodexMarketplace();
+    assert.equal(registeredSource(cli), NEW_ROOT, 'fresh install must register the scoped npm root');
+    assertDotAdd(lastAdd(cli), NEW_ROOT, 'fresh install');
+    assert.equal(cli.state.removeCalls.length, 0, 'fresh install must not remove anything');
+  });
+
+  scenario('switch: replacing a previous scoped root registers the new root', () => {
+    const cli = createCodexCli();
+    cli.state.marketplaces.set(MARKETPLACE, OLD_ROOT);
+    createManager(cli, NEW_ROOT).ensureCodexMarketplace();
+    assert.ok(cli.state.removeCalls.includes(MARKETPLACE), 'switch must remove the previous marketplace first');
+    assert.equal(registeredSource(cli), NEW_ROOT, 'switch must end registered on the new scoped root');
+    assertDotAdd(lastAdd(cli), NEW_ROOT, 'switch');
+    assert.ok(cli.state.addCalls.every(add => !add.source.includes('@')), 'no add may pass an "@"-containing source');
+  });
+
+  scenario('rollback: failed switch restores the old scoped root', () => {
+    const cli = createCodexCli();
+    cli.state.marketplaces.set(MARKETPLACE, OLD_ROOT);
+    cli.state.failAddDirs.add(NEW_ROOT);
+    assert.throws(() => createManager(cli, NEW_ROOT).ensureCodexMarketplace(), /已恢复原市场来源/);
+    assert.equal(registeredSource(cli), OLD_ROOT, 'rollback must restore the previous scoped root');
+    assertDotAdd(lastAdd(cli), OLD_ROOT, 'rollback');
+    assert.ok(cli.state.addCalls.every(add => !add.source.includes('@')), 'rollback add must also avoid "@" in the source');
+  });
+
+  scenario('plain path: non-"@" absolute source keeps the original invocation', () => {
+    const cli = createCodexCli();
+    createManager(cli, PLAIN_ROOT).ensureCodexMarketplace();
+    assert.equal(registeredSource(cli), PLAIN_ROOT);
+    const add = lastAdd(cli);
+    assert.equal(add.source, PLAIN_ROOT, 'non-scoped absolute path must keep being passed as the add source');
+    assert.notEqual(add.source, '.', 'the "." form is reserved for "@"-containing paths');
+  });
+
+  scenario('third-party: same-name marketplace is never overwritten', () => {
+    const cli = createCodexCli();
+    cli.state.marketplaces.set(MARKETPLACE, THIRD_PARTY_ROOT);
+    assert.throws(() => createManager(cli, NEW_ROOT).ensureCodexMarketplace(), /未覆盖第三方来源/);
+    assert.equal(cli.state.addCalls.length, 0, 'third-party source must not be replaced');
+    assert.equal(cli.state.removeCalls.length, 0, 'third-party source must not be removed');
+    assert.equal(registeredSource(cli), THIRD_PARTY_ROOT, 'third-party registration must be untouched');
+  });
+
+  scenario('allowed failure keeps operation linkage and a safe diagnostic code', () => {
+    const cli = createCodexCli();
+    const logs = [];
+    const manager = createManager(cli, NEW_ROOT);
+    manager.operationId = 'op-native-source-test';
+    manager.logger = Object.fromEntries(['info', 'warn', 'error'].map(level => [level, (event, message, meta) => logs.push({ event, message, meta })]));
+    manager.execute('codex', ['plugin', 'marketplace', 'add', NEW_ROOT], { allowFailure: true });
+    const failure = logs.find(log => log.event === 'integration.command_failed');
+    assert.ok(failure, 'a tolerated CLI failure must not be logged as success');
+    assert.equal(failure.meta.operationId, 'op-native-source-test');
+    assert.equal(failure.meta.error.code, 'CODEX_LOCAL_SOURCE_REF');
+    assert.equal(failure.meta.context.status, 1);
+    assert.ok(!JSON.stringify(logs).includes(REF_ERROR), 'never save raw CLI output');
+  });
+
+  assert.equal(path.dirname(TEMP_BASE), path.resolve(os.tmpdir()));
+  assert.equal(fs.lstatSync(TEMP_BASE).isSymbolicLink(), false);
+  fs.rmSync(TEMP_BASE, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+
+  const failed = results.filter(item => !item.ok);
+  for (const item of results) console.log(`${item.ok ? 'PASS' : 'FAIL'} ${item.name}${item.ok ? '' : ` :: ${item.error}`}`);
+  if (failed.length) {
+    console.error(`codex-marketplace-scoped-path-test: ${failed.length} of ${results.length} case(s) failed.`);
+    process.exitCode = 1;
+    return;
+  }
+  console.log('codex-marketplace-scoped-path-test passed.');
+}
+
+try {
+  main();
+} catch (error) {
+  console.error(error);
+  process.exitCode = 1;
+}

package/_site/_test/test-server-module-isolation-test.js

@@ -0,0 +1,37 @@
+'use strict';
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+
+const helper = path.join(__dirname, 'helpers/spawn-server.js');
+const calls = [];
+const moduleObject = { exports: {} };
+const inherited = {
+  KB_TERMINAL_URL: 'http://127.0.0.1:5760',
+  KB_VECTORHUB_URL: 'http://127.0.0.1:8787',
+  KB_EVENTBRIDGE_URL: 'http://127.0.0.1:8790',
+  KB_KNOWLEDGE_ENGINE_URL: 'http://127.0.0.1:5790',
+};
+vm.runInNewContext(fs.readFileSync(helper, 'utf8'), {
+  module: moduleObject,
+  require(id) {
+    if (id === 'child_process') return { spawn: (...args) => { calls.push(args); return { pid: 1 }; } };
+    if (id === 'fs') return { mkdtempSync: prefix => prefix + 'owned' };
+    if (id === '../../lib/runtime-control' || id === '../../lib/runtime-endpoint') return {};
+    return require(id);
+  },
+  process: { execPath: process.execPath, pid: process.pid, env: inherited },
+});
+const spawnServer = moduleObject.exports.spawnServer;
+spawnServer({ root: path.resolve(__dirname, '../..'), port: 0, dataDir: 'isolated-data' });
+const defaults = calls[0][2].env;
+for (const key of Object.keys(inherited)) assert.equal(defaults[key], 'http://127.0.0.1:0', key + ' must not consult a live user module');
+assert.equal(defaults.KB_DATA_DIR, 'isolated-data');
+assert.equal(defaults.KB_MODULES_AUTOSTART, '0');
+assert.equal(defaults.KB_MODULES_REGISTER, '0');
+assert.notEqual(defaults.AI_CODING_EVENT_BRIDGE_HOME, process.env.AI_CODING_EVENT_BRIDGE_HOME);
+const ownUrls = Object.fromEntries(Object.keys(inherited).map(key => [key, 'http://127.0.0.1:12345']));
+spawnServer({ root: path.resolve(__dirname, '../..'), port: 0, dataDir: 'isolated-data', extraEnv: ownUrls });
+for (const key of Object.keys(inherited)) assert.equal(calls[1][2].env[key], ownUrls[key], 'explicit owned fixture remains supported');
+console.log('test-server-module-isolation-test PASS');

package/_site/lib/integration-installer.js

@@ -436,7 +436,7 @@ class IntegrationManager {
 
   log(level, event, message, input = {}) {
     if (!this.logger || typeof this.logger[level] !== 'function') return;
-    Promise.resolve(this.logger[level](event, message, { component: 'integration-manager', ...input })).catch(() => {
+    Promise.resolve(this.logger[level](event, message, { component: 'integration-manager', operationId: this.operationId, ...input })).catch(() => {
       try { process.stderr.write(`[integration-manager logger fallback] ${event}\n`); } catch {
         // stderr is the final non-recursive observer fallback.
       }
@@ -638,19 +638,29 @@ class IntegrationManager {
     }
     const result = this.runner(command, args, {
       env: this.env,
-      cwd: this.rootDir,
+      cwd: options.cwd || this.rootDir,
       timeout: options.timeout,
     });
     if (result.error) {
       this.log('error', 'integration.command_failed', 'Integration CLI command failed.', { durationMs: Date.now() - startedAt, error: Object.assign(new Error('Integration CLI command failed.'), { code: result.error.code || 'INTEGRATION_COMMAND_FAILED' }), context: { client, argsHash } });
       throw result.error;
     }
+    const localRefFailure = client === 'codex' && String(result.stderr || '').trim() === 'Error: --ref is only supported for git marketplace sources';
     if (result.status !== 0 && !options.allowFailure) {
       const detail = String(result.stderr || result.stdout || '').trim();
-      this.log('error', 'integration.command_failed', 'Integration CLI command failed.', { durationMs: Date.now() - startedAt, error: Object.assign(new Error('Integration CLI command failed.'), { code: 'INTEGRATION_COMMAND_FAILED' }), context: { client, status: result.status, argsHash, outputHash: `sha256:${crypto.createHash('sha256').update(detail, 'utf8').digest('hex')}` } });
+      this.log('error', 'integration.command_failed', 'Integration CLI command failed.', { durationMs: Date.now() - startedAt, error: Object.assign(new Error('Integration CLI command failed.'), { code: localRefFailure ? 'CODEX_LOCAL_SOURCE_REF' : 'INTEGRATION_COMMAND_FAILED' }), context: { client, status: result.status, argsHash, outputHash: `sha256:${crypto.createHash('sha256').update(detail, 'utf8').digest('hex')}` } });
       throw new Error(detail || `${CLIENT_LABELS[client]} command failed with exit code ${result.status}`);
     }
-    this.log('info', 'integration.command_completed', 'Integration CLI command completed.', { durationMs: Date.now() - startedAt, context: { client, status: result.status, argsHash } });
+    const completed = result.status === 0;
+    const safeError = completed ? undefined : Object.assign(new Error(localRefFailure
+      ? 'Codex 把本地目录中的 @ 误当作 Git ref；请使用目录内相对路径重试。'
+      : 'Integration CLI command returned a failure.'), {
+      code: localRefFailure ? 'CODEX_LOCAL_SOURCE_REF' : 'INTEGRATION_COMMAND_FAILED',
+    });
+    this.log(completed ? 'info' : 'warn', completed ? 'integration.command_completed' : 'integration.command_failed', completed ? 'Integration CLI command completed.' : 'Integration CLI command returned a failure.', {
+      durationMs: Date.now() - startedAt, error: safeError,
+      context: { client, status: result.status, argsHash },
+    });
     return result;
   }
 
@@ -718,6 +728,16 @@ class IntegrationManager {
     this.execute('claude', ['plugin', 'marketplace', 'add', this.claudeMarketplaceSource]);
   }
 
+  addCodexMarketplaceSource(source, options = {}) {
+    // Codex 0.137 parses @ in an absolute npm path as a Git ref. Resolve a
+    // real local directory via cwd instead; rollback must use its own cwd.
+    let local = false;
+    if (path.isAbsolute(source) && source.includes('@')) {
+      try { local = fs.statSync(source).isDirectory(); } catch {}
+    }
+    return this.execute('codex', ['plugin', 'marketplace', 'add', local ? '.' : source], local ? { ...options, cwd: source } : options);
+  }
+
   ensureCodexMarketplace() {
     const target = path.resolve(this.codexMarketplaceAddSource);
     if (!this.dryRun) {
@@ -727,9 +747,9 @@ class IntegrationManager {
         if (path.resolve(existing).toLowerCase() === target.toLowerCase()) return;
         if (!this.isOwnCodexMarketplaceSource(existing)) throw new Error('同名 Codex 插件市场来源不是当前安装包，且无法确认属于本产品；未覆盖第三方来源。请检查 Codex 插件市场配置。');
         this.execute('codex', ['plugin', 'marketplace', 'remove', MARKETPLACE_NAME]);
-        const added = this.execute('codex', ['plugin', 'marketplace', 'add', target], { allowFailure: true });
+        const added = this.addCodexMarketplaceSource(target, { allowFailure: true });
         if (added.status !== 0) {
-          const restored = this.execute('codex', ['plugin', 'marketplace', 'add', existing], { allowFailure: true });
+          const restored = this.addCodexMarketplaceSource(existing, { allowFailure: true });
           throw new Error(restored.status === 0
             ? 'Codex 插件市场更换为当前安装包失败，已恢复原市场来源；请重试接入。'
             : 'Codex 插件市场更换为当前安装包失败，恢复原市场来源也未成功；请手动检查 codex 插件市场。');
@@ -737,7 +757,7 @@ class IntegrationManager {
         return;
       }
     }
-    this.execute('codex', ['plugin', 'marketplace', 'add', target]);
+    this.addCodexMarketplaceSource(target);
   }
 
   installClaude(options = {}) {

package/docs/leader-glm-workbench-playbook.md

@@ -2,7 +2,9 @@
 
 ## 角色与边界
 
-Leader 负责知识检索、接口决策、任务派发、代码审查、独立复测和发布判断。GLM-5.3 负责限定范围内的实现与测试。最多两条独立执行线；修改相同文件、用户配置、运行实例、npm 安装和固定端口验收必须串行。
+Leader 负责知识检索、关键开发、接口决策、打包升级和最终交付。GLM-5.3 主要负责独立故障测试、回归和代码审查，明确独立的小改动才单独派发。允许多条 GLM 检查线并行；修改相同文件、用户配置、运行实例、npm 安装和固定端口验收必须串行。真实性能测试单独运行，避免并发负载污染结果。
+
+先交付固定范围的可用版本，不因审查不断追加功能。每条检查线使用短任务合同与独立证据目录，发现问题交给 Leader 收敛修复；不重复跑已经绑定同一运行文件的完整源码回归。GLM token 充足不等于本机 CPU、内存、模型服务和文件锁无限，实际并发按资源与隔离条件安排。
 
 使用真实 Workbench，不以其他模型的原生子代理冒充 GLM。完全模式不是扩大授权：禁止自行清空数据、覆盖第三方配置、修改客户端信任记录或发布软件。
 

package/docs/release-5.0.16-acceptance.md

@@ -2,8 +2,28 @@
 
 ## 当前结论
 
+最新候选收敛到 `5.0.16-rc.6`，四模块仍锁定 Workbench rc.13、引擎 rc.7、vector-hub rc.8、bridge 0.7.2。修复限于 Codex 本地市场路径与关联日志；发布和安装版验收尚待执行，latest 仍为 5.0.14。
+
+rc.5 官方安装收据 `kb-registry-product-2PqRja/registry-installation.json` 已验证。五仓库冻结回归在 Node 22/24 均通过：外壳 138、Workbench 365、vector-hub 73、bridge 30；引擎 169 通过、1 项 Windows 符号链接权限跳过。安装版正常页面、一次 503 恢复、故障和生命周期八项均通过。真实 MiniMax 记忆、流式、单/并发提交、1536 维索引及重启 10 项通过；固定留出集 Recall@5=1、MRR=0.9667，单独热查询 P95=692.9615ms。
+
+已通过保护备份与 npm 全局升级把本机安装为 rc.5，7 个现有项目、43 个历史文件、565 个 D 盘索引文件及配置保持不变，运行字节与官方下载包一致。首次本机客户端修复的 Codex 失败操作 `op-29b0bc154aa94f43aa2dc759cf898697` 保留：隔离原生 CLI 复现绝对路径中的 `@` 被当作 ref，目录内 `add .` 成功；随后仅通过原生命令恢复本产品市场，正常修复操作 `op-d6d22efd9e534b1f9d06cd0ba06680cb` 成功。未修改信任记录。
+
+Codex 声明入口的真实 MCP initialize/六工具/resolve/search/get 已通过；该结果不等于 Codex 原生模型任务自动收到知识。当前 Hook 为 modified，尚未运行此模型门禁。Claude、ZCode、OpenCode 接线已完成，实际原生送达、二次开发及正式包验收仍需完成。用于实际 Codex 路径回归的 GLM 测试文件经 Leader 修正为跨平台唯一临时目录，避免共享目录清理；首次红测试保留。
+
 2026-10-14 开始执行本轮计划。状态：**实施中，未完成系统验收，不更新 latest**。
 
+2026-10-15 收敛到候选 `5.0.16-rc.5`，精确锁定 Workbench `0.13.2-rc.13`，其余模块保留 rc.4 的已验收运行文件。Leader 负责关键开发与交付，GLM 独立并行故障测试、回归和审查；不新增产品功能。
+
+rc.4 官方安装收据 `kb-registry-product-NPyWjR/registry-installation.json` 已通过内容与 integrity 核对，真实向量热查询 P95 为 1083.6643ms，固定留出集 Recall@5 为 1、MRR 为 0.9667。真实 MiniMax 领域/项目/全局记忆、工作台流式回答、单提交、跨项目并发与重启保真共 10 项通过；这些结果不等于本机原生客户端接入或另一台电脑私有语料验收。
+
+rc.4 首次 Node 22 网页失败的历史原因仍无法确定，后续正常路径重复通过。另以一次 `/profiles` HTTP 503 在真实 Workbench iframe 中稳定复现了「首次失败后模型列表一直为空且不再请求」；两次失败记录保留。Workbench rc.12 已修复这一缺陷类，Leader 冻结源码回归 Node 22/24 各 362/362；新整包必须通过同一故障注入用例才能计为恢复。
+
+用户当前仍运行 rc.1。其六条索引失败已通过公开索引阶段重试恢复，知识正文、晋升时间和分析运行 ID 不变；原 `532d` 运行在操作前已成功，未重复分析。候选安装、原生客户端、新版保真升级与正式发布门禁仍待完成。
+
+GLM 独立审查复现 rc.12 连续保存供应商时复用保存前快照，Leader 修复为保存后等待旧读取结束、再发起可共享的新读取；普通菜单仍 single-flight。两条新竞态测试先失败后修复。菜单异步重绘清空过滤词属于已记录的低风险体验限制，未作为核心修复扩展。
+
+rc.5 首次外壳 Node 22 回归为 134/137：工作台密集并发输出期间暂时不可达，三个隔离测试仍读取默认真实模块而超时，首次失败收据保留。测试服务器现在默认使用不可连接的本地端口 0，真实模块场景必须显式传入自有服务地址；三个失败用例定向复测通过，完整冻结回归仍须重跑。此修复不调整生产请求超时或测试断言。
+
 运行基线：知识库 `5.0.16-rc.1`、Workbench `0.13.2-rc.10`、vendored 引擎 `0.2.7-rc.5`。发布 stable 标签仍为 `5.0.14`。
 
 候选 `5.0.16-rc.2`（`21f67dc`）已发布 `next`，锁定 Workbench rc.11、引擎 rc.6、vector-hub rc.5。独立验收发现 vector-hub 公开 ESM 入口不能加载，因此本候选不能通过全部门禁，待修复后推进下一候选；本机仍运行 rc.1。

package/module-runtime-manifest.json

@@ -9,20 +9,20 @@
     "plugins/project-knowledge/hooks/codex.json": "216e03c07295606ef6ebb2c4f669ad0d790b5e7c4f3f34600488033db75e4239",
     "plugins/project-knowledge/scripts/context-hook.cjs": "da666153ad5723592cce42d25337ae649f7d93e43fab76b3c6d1263933de063f",
     "plugins/project-knowledge/scripts/mcp-launcher.cjs": "7c68830b5c73eb53ef030756a4de33987f7eab6b1a6cc15602835aac3f954893",
-    "plugins/project-knowledge/.claude-plugin/plugin.json": "3316822d609f4a4db328596befcfc3c35c6dc2c289cacc80d8e0886db8f18b8c",
-    "plugins/project-knowledge/.codex-plugin/plugin.json": "828b77c3c5bd03ae3f8b2c2e9743d57a6ccabfd26056b61fdfad884570288ecd",
-    "plugins/project-knowledge/.mcp.json": "a987097f620b987223490012f6584a7fb66028026b5bc38431b31b296b6e76be"
+    "plugins/project-knowledge/.claude-plugin/plugin.json": "3fcae0e4c576273eb1b92d6e5445a63c70e4c7a47d3f39e5c4d2cd7b9f8fa54c",
+    "plugins/project-knowledge/.codex-plugin/plugin.json": "f310840f564417ea12a1d510fce4ab672a6679aa30a0eb5b767b830cfc9995df",
+    "plugins/project-knowledge/.mcp.json": "807e061ce4bf14353ae35a95a282f01384828f36832b93c65513643b133669aa"
   },
   "modules": {
     "terminal": {
       "name": "@sanqianx/claude-ai-workbench",
       "installName": "claude-ai-workbench",
-      "version": "0.13.2-rc.11",
+      "version": "0.13.2-rc.13",
       "files": {
         "LICENSE": "c1b9df1275e769f3dbab000d1e457a2d4b0f28eb5da6c77e48dc37eeba202ed7",
-        "README.md": "7227e5dccce535f48d7e42c5f72c96f3d659d3a664476c0b304f461315a424c3",
+        "README.md": "beea9acbbcb7875406c0ce9704ade51eb546195b47ac01ce4627386b7d5f7054",
         "apps/agent-terminal/app.css": "ede36d9fdb1f7036e3453134c0d5a86197bfc30e3ac547a24b4fc1d17847277e",
-        "apps/agent-terminal/app.js": "e666644cab48e2e355d3d31e33931bd5050939fd3acd1aef9860c006283c3741",
+        "apps/agent-terminal/app.js": "7494d0e4f11bf84f925a7182b6f1d59e7a8676208b43ff682bfacc5d7fce2a3e",
         "apps/agent-terminal/index.html": "cdffd5c535c81f56aba70ec5dd3bc060f59ec2abcdc8676b79c8f327126be605",
         "apps/ai-profile-settings-host/index.html": "bc158f68954506d2b8e43c690f28dbe931eff9a02b1524855ac17e74ea4df736",
         "apps/ai-profile-settings-host/page.css": "8b75cbf7f1ea5aaa92f2889390720ece310a8fd4b9ca38c890fa447d4323a557",
@@ -34,20 +34,20 @@
         "apps/minimal-test-host/README.md": "fa73136f4ee3865c2d91eb97b2e8c03679aa4688e44c1e1c8ec6e27d604b0de5",
         "docs/sdk/FILE_LAYOUT.md": "17882f96505c8161bfb66876684b9d2d3f50021a111b8b844502d3cb4e97870a",
         "docs/sdk/INTEGRATION.md": "d4c0c80d2d2fc610205102d703a429bfaa20f9f3a48f1718f5bab02ee90138df",
-        "docs/sdk/openapi.yaml": "a686aba65e07f314b87326e3d15b824dd4676ebbd0d1d733f593dab10d07a655",
+        "docs/sdk/openapi.yaml": "8483e3eda18fbdd6c896e7ae428d4cc7ee16ec3bc8485da1c6dfbb987e68eaed",
         "docs/sdk/README.md": "7ab591d39c36a3b84cfdf487ff567040ec453975f3ef0fba86dc822094667b61",
-        "package.json": "e2ca3c4f2595c56eb42e9cb4311487c47d94eefb1187197797cf4128c41f420e",
+        "package.json": "61e2770c9a00b4abe2fa56b735f9a450c5ac076daf580e125f71562c6840435b",
         "packages/client/index.d.ts": "fb66b7b21ac936cddcb7f74543cf4f3bb7e80c169534ec249ab8ef2356224162",
         "packages/client/index.js": "a28fa3c38c13e8448cff4d3e0ec95ec2d541d5e57de4b5564fa2a65b2ae892c9",
-        "packages/client/package.json": "b2ddf3f1bf3c6f11ddddeacd82be16cbca576bf9427c40c9edb3861f7ef30aee",
+        "packages/client/package.json": "852eea37302a4f8743a9246641fcd4bb026878323d08882ce9e528e5477bf2e2",
         "packages/client/README.md": "342dff9b1dcbc85fccc9b980ed3e4e455aa71133af1d0805b8431ea2ac564ef8",
         "packages/contracts/index.d.ts": "157f3cd80f4b27b53c63b2de41575d8332028be2e7491c4730e44b7302bd4dab",
         "packages/contracts/index.js": "5eeb195d9c4cc54dab064510684ae1350d325fbaf47ff824dad4a04a5bb67d11",
-        "packages/contracts/package.json": "5a44115e2283e3a36a625a9ce6f3c38dfbc45d5b69b9c859dbefe735974ca407",
+        "packages/contracts/package.json": "c9b491a2bd3a4b3c3f20fba0e42a877d75474a79777567e47934c5d6814d74e0",
         "packages/contracts/README.md": "44d83a3cc508cec6c5c20dfa1f2c08d5ea03e3afb2853639fdc0a9cc8eb5b9c8",
         "packages/core/index.d.ts": "c95b24a13f8aeeb128497833cf298790563baca6036ea5d29a9d8daff53199d7",
         "packages/core/index.js": "825640d0edc7dd130f22da1f580d2cda355566a40b0b36e42e5f38909605bbfa",
-        "packages/core/package.json": "ffb58104bc51633dd048ad63295b766af2eabc4932b4d4c0916d5d377267e9b8",
+        "packages/core/package.json": "25efb6c60e8b2256adc2202ddae585cd3d14b56d1951b3bbdb833a23dc3220db",
         "packages/core/README.md": "e222c546104a168f1038d95c6c4efb8e5603edd6145ab2cab79cab977fb710e5",
         "packages/server/bin/agent-terminal-server.js": "043dff4d76e3fd213b666a55e581ed1e72f9e5b8de6cb798fbf42bd39ed26861",
         "packages/server/bin/claude-workbench-server.js": "b03c730b6d86faf6974afea26c74109d59b1bbc1ecc656c1d6270258708694ac",
@@ -82,7 +82,7 @@
         "packages/server/lib/system-doctor.js": "2b0e858d69d8fb268eaed950c9883473ee9850684b532bc2db8e14674a974919",
         "packages/server/lib/ui-preferences-store.js": "e108cb22e7cc1f3438704913d5401e01de2c0e717eb2abd3bdc4727209393819",
         "packages/server/lib/workbench-service.js": "19781d2a27fa849e5508a5e233b29008b3ff18e1f10344615c371e5947601437",
-        "packages/server/package.json": "dc01b9c56ec63a7113894bd12e7842aa49e86ca4e85527085f421412946ed3b0",
+        "packages/server/package.json": "91109d94332bab9ba058a8d2950147d42f051da42271e9396b3baba4df6ea580",
         "packages/server/README.md": "a34cfaa4f4e859008b44e2be8e1aafb56e97fe83e6129c968a8562945fa843f3",
         "packages/ui/ai-profile-settings.d.ts": "0551b6c6eda6d18ea89a976daddf01b2161195f4874fe2d67a57cd9ecc6ce643",
         "packages/ui/ai-profile-settings.js": "e92bbac67a1199d473e4e44b32d1cc76c5b6c79306d4fef9d9067a1bb6ec42ca",
@@ -90,7 +90,7 @@
         "packages/ui/claude-terminal.js": "96bd217a4a7e4792ae3fbaaf46249ecee13b0f4e01fc6d25a1b8b22d8f8fe00c",
         "packages/ui/index.d.ts": "e547ab39640fe7519fb367b78442dc8a2c51b2efd17b66f8b0a003b154b36ead",
         "packages/ui/index.js": "f4394aabd395938f5c3fe587e430471d4033e83945a9b9c7e0149ad4040982c9",
-        "packages/ui/package.json": "6ea8f77640b11175ea0591c51bb9ee8354ae28ebe3d124ab1d8e3ffc21e23e86",
+        "packages/ui/package.json": "4ca5566453e06af0a497b7419e4c76cc7a0f55184c2c3d2f79392e5b78eee973",
         "packages/ui/README.md": "793c4a9c286fee23f39062a1976ca3afe9d2816dcdb55e156ba940e1ef514f89",
         "packages/ui/theme.css": "8f03a081272a7db11b196f7a70d0fafb1f8d954778f329f1ba53d110d9d5fd98",
         "src/assets/claude-prompts.json": "cb111f2e0a45afe8a31c251a504d1ab5375966ed61291660e61fd2efd77f6d9f",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanqianx/project-knowledge",
-  "version": "5.0.16-rc.4",
+  "version": "5.0.16-rc.6",
   "description": "Knowledge base manager with Git integration, AI-driven analysis, and bilingual (zh-CN/en-US) knowledge output",
   "main": "_site/server.js",
   "scripts": {
@@ -86,7 +86,7 @@
     "@sanqianx/vector-hub": "1.0.8-rc.8",
     "buffer": "^6.0.3",
     "cheerio": "^1.2.0",
-    "claude-ai-workbench": "npm:@sanqianx/claude-ai-workbench@0.13.2-rc.11",
+    "claude-ai-workbench": "npm:@sanqianx/claude-ai-workbench@0.13.2-rc.13",
     "cross-spawn": "7.0.6",
     "dotenv": "^17.4.2",
     "gpt-tokenizer": "^3.4.0",

package/plugins/project-knowledge/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "project-knowledge",
   "hooks": "./hooks/claude.json",
-  "version": "5.0.16-rc.4",
+  "version": "5.0.16-rc.6",
   "description": "Read durable project decisions and implementation history from Project Knowledge.",
   "author": {
     "name": "SanQianX",

package/plugins/project-knowledge/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "project-knowledge",
-  "version": "5.0.16-rc.4",
+  "version": "5.0.16-rc.6",
   "description": "Read durable project decisions and implementation history from Project Knowledge.",
   "author": {
     "name": "SanQianX",

package/plugins/project-knowledge/.mcp.json

@@ -8,7 +8,7 @@
         "const fs=require('fs'),path=require('path'),os=require('os');const PKG='@sanqianx/project-knowledge',SC='project-knowledge/integration-runtime/v1';let f='';const root=process.env.CLAUDE_PLUGIN_ROOT||process.env.PLUGIN_ROOT;if(root){f=path.join(root,'scripts','mcp-launcher.cjs');if(!fs.existsSync(f))f=''}if(!f){const dd=process.env.KB_DATA_DIR||path.join(os.homedir(),'.project-knowledge-v5');try{const bp=path.join(dd,'integration-runtime.json');const st=fs.statSync(bp);if(st.isFile()&&st.size<=32768){const b=JSON.parse(fs.readFileSync(bp,'utf8'));if(b&&b.schema===SC&&b.packageName===PKG&&typeof b.packageRoot==='string'&&path.isAbsolute(b.packageRoot)){const c=path.join(b.packageRoot,'plugins','project-knowledge','scripts','mcp-launcher.cjs');const rr=fs.realpathSync(b.packageRoot),cr=fs.realpathSync(c);const rel=path.relative(rr,cr);if(rel&&rel!=='..'&&!rel.startsWith('..'+path.sep)&&!path.isAbsolute(rel)&&fs.statSync(cr).isFile())f=cr}}}catch(e){}}if(!f){console.error('[project-knowledge-mcp] 未能通过受信任插件根或已验证的安装绑定定位启动器，已停止；不访问网络，也不加载工作目录源码。');process.exit(127)}require(f);"
       ],
       "env": {
-        "KB_PLUGIN_VERSION": "5.0.16-rc.4"
+        "KB_PLUGIN_VERSION": "5.0.16-rc.6"
       }
     }
   }