@sanqianx/project-knowledge 5.0.18 → 5.0.20-rc.1

package/_site/_test/server-security-test.js

@@ -1,96 +1,96 @@
-const assert = require('assert');
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { spawnServer } = require('./helpers/spawn-server');
-const { createRequestHandler } = require('../lib/server-app');
-
-const ROOT = path.resolve(__dirname, '..', '..');
-const PORT = 7832;
-const BASE = `http://127.0.0.1:${PORT}`;
-const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pkb-security-v2-'));
-const REMOTE_PORT = 7833;
-const REMOTE_BASE = `http://127.0.0.1:${REMOTE_PORT}`;
-const remoteDataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pkb-security-remote-v2-'));
-
-async function waitForServer() {
-  for (let attempt = 0; attempt < 100; attempt += 1) {
-    try { if ((await fetch(`${BASE}/api/health`)).ok) return; } catch {}
-    await new Promise(resolve => setTimeout(resolve, 100));
-  }
-  throw new Error('server did not start');
-}
-
-(async () => {
-  assert.throws(
-    () => createRequestHandler({}, { host: '0.0.0.0', port: 9999 }),
-    error => error && error.code === 'AUTH_REQUIRED',
-    'non-loopback bind must require authentication',
-  );
-
-  const spawned = spawnServer({ root: ROOT, port: PORT, dataDir, tag: 'security-v2', extraEnv: { KB_SKIP_MIGRATION: '1' } });
-  try {
-    await waitForServer();
-    let response = await fetch(`${BASE}/api/ai-profiles`, { headers: { Origin: 'https://evil.example' } });
-    assert.strictEqual(response.status, 403);
-    assert.strictEqual(response.headers.get('access-control-allow-origin'), null);
-
-    response = await fetch(`${BASE}/api/ai-profiles`, {
-      method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify({
-        schema: 'ai-profiles/v1', profiles: [{ id: 'secret', enabled: true, apiKeyUpdate: { mode: 'replace', value: 'top-secret-api-key' } }],
-      }),
-    });
-    assert.strictEqual(response.status, 200);
-    response = await fetch(`${BASE}/api/ai-profiles`);
-    const profileText = await response.text();
-    assert(!profileText.includes('top-secret-api-key'));
-    assert(!/"apiKey"\s*:/.test(profileText));
-
-    response = await fetch(`${BASE}/api/raw?path=../../settings.json`);
-    assert.strictEqual(response.status, 404);
-    const rawText = await response.text();
-    assert(!rawText.includes('top-secret-api-key'));
-
-    response = await fetch(`${BASE}/api/projects/not-valid%2Fid`);
-    const errorText = await response.text();
-    assert(!/\bstack\b/i.test(errorText));
-    assert(!errorText.includes('top-secret-api-key'));
-    const error = JSON.parse(errorText);
-    assert(error.error.operationId);
-
-    const remote = spawnServer({
-      root: ROOT,
-      port: REMOTE_PORT,
-      host: '0.0.0.0',
-      dataDir: remoteDataDir,
-      tag: 'security-remote-v2',
-      extraEnv: {
-        KB_SKIP_MIGRATION: '1',
-        KB_SITE_AUTH_TOKEN: 'remote-auth-secret',
-        KB_ALLOWED_ORIGINS: 'https://allowed.example',
-      },
-    });
-    try {
-      for (let attempt = 0; attempt < 100; attempt += 1) {
-        try {
-          const ready = await fetch(`${REMOTE_BASE}/api/health`, { headers: { Authorization: 'Bearer remote-auth-secret', Origin: 'https://allowed.example' } });
-          if (ready.ok) break;
-        } catch {}
-        await new Promise(resolve => setTimeout(resolve, 100));
-      }
-      let remoteResponse = await fetch(`${REMOTE_BASE}/api/health`, { headers: { Origin: 'https://allowed.example' } });
-      assert.strictEqual(remoteResponse.status, 401, 'non-loopback request without token must fail');
-      remoteResponse = await fetch(`${REMOTE_BASE}/api/health`, { headers: { Authorization: 'Bearer remote-auth-secret', Origin: 'https://evil.example' } });
-      assert.strictEqual(remoteResponse.status, 403, 'non-loopback request from an unlisted Origin must fail');
-      remoteResponse = await fetch(`${REMOTE_BASE}/api/health`, { headers: { Authorization: 'Bearer remote-auth-secret', Origin: 'https://allowed.example' } });
-      assert.strictEqual(remoteResponse.status, 200);
-      assert.strictEqual(remoteResponse.headers.get('access-control-allow-origin'), 'https://allowed.example');
-    } finally {
-      remote.cleanup();
-    }
-    console.log('server-security-test PASS');
-  } finally {
-    await spawned.cleanup();
-    fs.rmSync(remoteDataDir, { recursive: true, force: true });
-  }
-})().catch(error => { console.error(error); process.exitCode = 1; });
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnServer } = require('./helpers/spawn-server');
+const { createRequestHandler } = require('../lib/server-app');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const PORT = 7832;
+const BASE = `http://127.0.0.1:${PORT}`;
+const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pkb-security-v2-'));
+const REMOTE_PORT = 7833;
+const REMOTE_BASE = `http://127.0.0.1:${REMOTE_PORT}`;
+const remoteDataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pkb-security-remote-v2-'));
+
+async function waitForServer() {
+  for (let attempt = 0; attempt < 100; attempt += 1) {
+    try { if ((await fetch(`${BASE}/api/health`)).ok) return; } catch {}
+    await new Promise(resolve => setTimeout(resolve, 100));
+  }
+  throw new Error('server did not start');
+}
+
+(async () => {
+  assert.throws(
+    () => createRequestHandler({}, { host: '0.0.0.0', port: 9999 }),
+    error => error && error.code === 'AUTH_REQUIRED',
+    'non-loopback bind must require authentication',
+  );
+
+  const spawned = spawnServer({ root: ROOT, port: PORT, dataDir, tag: 'security-v2', extraEnv: { KB_SKIP_MIGRATION: '1' } });
+  try {
+    await waitForServer();
+    let response = await fetch(`${BASE}/api/ai-profiles`, { headers: { Origin: 'https://evil.example' } });
+    assert.strictEqual(response.status, 403);
+    assert.strictEqual(response.headers.get('access-control-allow-origin'), null);
+
+    response = await fetch(`${BASE}/api/ai-profiles`, {
+      method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify({
+        schema: 'ai-profiles/v1', profiles: [{ id: 'secret', enabled: true, apiKeyUpdate: { mode: 'replace', value: 'top-secret-api-key' } }],
+      }),
+    });
+    assert.strictEqual(response.status, 200);
+    response = await fetch(`${BASE}/api/ai-profiles`);
+    const profileText = await response.text();
+    assert(!profileText.includes('top-secret-api-key'));
+    assert(!/"apiKey"\s*:/.test(profileText));
+
+    response = await fetch(`${BASE}/api/raw?path=../../settings.json`);
+    assert.strictEqual(response.status, 404);
+    const rawText = await response.text();
+    assert(!rawText.includes('top-secret-api-key'));
+
+    response = await fetch(`${BASE}/api/projects/not-valid%2Fid`);
+    const errorText = await response.text();
+    assert(!/\bstack\b/i.test(errorText));
+    assert(!errorText.includes('top-secret-api-key'));
+    const error = JSON.parse(errorText);
+    assert(error.error.operationId);
+
+    const remote = spawnServer({
+      root: ROOT,
+      port: REMOTE_PORT,
+      host: '0.0.0.0',
+      dataDir: remoteDataDir,
+      tag: 'security-remote-v2',
+      extraEnv: {
+        KB_SKIP_MIGRATION: '1',
+        KB_SITE_AUTH_TOKEN: 'remote-auth-secret',
+        KB_ALLOWED_ORIGINS: 'https://allowed.example',
+      },
+    });
+    try {
+      for (let attempt = 0; attempt < 100; attempt += 1) {
+        try {
+          const ready = await fetch(`${REMOTE_BASE}/api/health`, { headers: { Authorization: 'Bearer remote-auth-secret', Origin: 'https://allowed.example' } });
+          if (ready.ok) break;
+        } catch {}
+        await new Promise(resolve => setTimeout(resolve, 100));
+      }
+      let remoteResponse = await fetch(`${REMOTE_BASE}/api/health`, { headers: { Origin: 'https://allowed.example' } });
+      assert.strictEqual(remoteResponse.status, 401, 'non-loopback request without token must fail');
+      remoteResponse = await fetch(`${REMOTE_BASE}/api/health`, { headers: { Authorization: 'Bearer remote-auth-secret', Origin: 'https://evil.example' } });
+      assert.strictEqual(remoteResponse.status, 403, 'non-loopback request from an unlisted Origin must fail');
+      remoteResponse = await fetch(`${REMOTE_BASE}/api/health`, { headers: { Authorization: 'Bearer remote-auth-secret', Origin: 'https://allowed.example' } });
+      assert.strictEqual(remoteResponse.status, 200);
+      assert.strictEqual(remoteResponse.headers.get('access-control-allow-origin'), 'https://allowed.example');
+    } finally {
+      remote.cleanup();
+    }
+    console.log('server-security-test PASS');
+  } finally {
+    await spawned.cleanup();
+    fs.rmSync(remoteDataDir, { recursive: true, force: true });
+  }
+})().catch(error => { console.error(error); process.exitCode = 1; });

package/_site/_test/sessions-stream-test.js

@@ -1,93 +1,93 @@
-const assert = require('assert');
-const fs = require('fs');
-const http = require('http');
-const os = require('os');
-const path = require('path');
-const { spawnSync } = require('child_process');
-const { spawnServer } = require('./helpers/spawn-server');
-const freePort = require('./helpers/free-port');
-
-const ROOT = path.resolve(__dirname, '..', '..');
-let PORT, BASE;
-const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pkb-sse-v2-'));
-const repoPath = fs.mkdtempSync(path.join(os.tmpdir(), 'pkb-sse-repo-'));
-
-function git(args) {
-  const result = spawnSync('git', args, { cwd: repoPath, encoding: 'utf8' });
-  assert.strictEqual(result.status, 0, result.stderr);
-}
-
-async function json(method, pathname, body) {
-  const response = await fetch(`${BASE}${pathname}`, { method, headers: body === undefined ? undefined : { 'content-type': 'application/json' }, body: body === undefined ? undefined : JSON.stringify(body) });
-  return { status: response.status, data: await response.json() };
-}
-
-async function waitForServer() {
-  for (let attempt = 0; attempt < 100; attempt += 1) {
-    try { if ((await fetch(`${BASE}/api/health`)).ok) return; } catch {}
-    await new Promise(resolve => setTimeout(resolve, 100));
-  }
-  throw new Error('server did not start');
-}
-
-function openSse() {
-  const frames = [];
-  let buffer = '';
-  const request = http.get(`${BASE}/api/claude/sessions-stream`, response => {
-    assert.strictEqual(response.statusCode, 200);
-    response.on('data', chunk => {
-      buffer += chunk.toString('utf8');
-      let boundary;
-      while ((boundary = buffer.indexOf('\n\n')) >= 0) {
-        const block = buffer.slice(0, boundary);
-        buffer = buffer.slice(boundary + 2);
-        const event = /^event:\s*(.+)$/m.exec(block);
-        const data = /^data:\s*(.+)$/m.exec(block);
-        if (event && data) frames.push({ event: event[1], data: JSON.parse(data[1]) });
-      }
-    });
-  });
-  request.on('error', error => { frames.push({ event: 'transport-error', data: { message: error.message } }); });
-  return { frames, close: () => request.destroy() };
-}
-
-async function waitFor(predicate) {
-  for (let attempt = 0; attempt < 100; attempt += 1) {
-    if (predicate()) return;
-    await new Promise(resolve => setTimeout(resolve, 50));
-  }
-  throw new Error('timed out waiting for SSE frame');
-}
-
-(async () => {
-  PORT = await freePort(); BASE = `http://127.0.0.1:${PORT}`;
-  git(['init', '--initial-branch=main']);
-  git(['config', 'user.email', 'sse@example.test']);
-  git(['config', 'user.name', 'SSE Test']);
-  const spawned = spawnServer({ root: ROOT, port: PORT, dataDir, tag: 'sse-v2', extraEnv: { KB_SKIP_MIGRATION: '1' } });
-  try {
-    await waitForServer();
-    await json('PATCH', '/api/settings', { knowledge: { rootPath: path.join(dataDir, 'knowledge') } });
-    await json('PUT', '/api/ai-profiles', { schema: 'ai-profiles/v1', defaultProfileId: 'test', profiles: [{ id: 'test', name: 'Test', enabled: true, implementation: 'claude-code-agent', apiKeyUpdate: { mode: 'replace', value: 'sk-test' } }] });
-    const imported = await json('POST', '/api/projects/import', { localPath: repoPath, aiProfileId: 'test' });
-    assert.strictEqual(imported.status, 201, JSON.stringify(imported.data));
-
-    const stream = openSse();
-    await waitFor(() => stream.frames.some(frame => frame.event === 'claude/snapshot'));
-    const snapshot = stream.frames.find(frame => frame.event === 'claude/snapshot');
-    assert(Array.isArray(snapshot.data.sessions));
-
-    const started = await json('POST', '/api/claude/sessions', { projectId: imported.data.projectId });
-    assert.strictEqual(started.status, 201, JSON.stringify(started.data));
-    await waitFor(() => stream.frames.some(frame => frame.event === 'claude/sessions-changed' && frame.data.kind === 'create'));
-    const created = stream.frames.find(frame => frame.event === 'claude/sessions-changed' && frame.data.kind === 'create');
-    assert.strictEqual(created.data.projectSlug, imported.data.projectId);
-    const sessions = await json('GET', `/api/claude/sessions?projectId=${encodeURIComponent(imported.data.projectId)}`);
-    assert(sessions.data.sessions.some(session => session.sessionId === started.data.sessionId));
-    stream.close();
-    console.log('sessions-stream-test PASS');
-  } finally {
-    await spawned.cleanup();
-    fs.rmSync(repoPath, { recursive: true, force: true });
-  }
-})().catch(error => { console.error(error); process.exitCode = 1; });
+const assert = require('assert');
+const fs = require('fs');
+const http = require('http');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { spawnServer } = require('./helpers/spawn-server');
+const freePort = require('./helpers/free-port');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+let PORT, BASE;
+const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pkb-sse-v2-'));
+const repoPath = fs.mkdtempSync(path.join(os.tmpdir(), 'pkb-sse-repo-'));
+
+function git(args) {
+  const result = spawnSync('git', args, { cwd: repoPath, encoding: 'utf8' });
+  assert.strictEqual(result.status, 0, result.stderr);
+}
+
+async function json(method, pathname, body) {
+  const response = await fetch(`${BASE}${pathname}`, { method, headers: body === undefined ? undefined : { 'content-type': 'application/json' }, body: body === undefined ? undefined : JSON.stringify(body) });
+  return { status: response.status, data: await response.json() };
+}
+
+async function waitForServer() {
+  for (let attempt = 0; attempt < 100; attempt += 1) {
+    try { if ((await fetch(`${BASE}/api/health`)).ok) return; } catch {}
+    await new Promise(resolve => setTimeout(resolve, 100));
+  }
+  throw new Error('server did not start');
+}
+
+function openSse() {
+  const frames = [];
+  let buffer = '';
+  const request = http.get(`${BASE}/api/claude/sessions-stream`, response => {
+    assert.strictEqual(response.statusCode, 200);
+    response.on('data', chunk => {
+      buffer += chunk.toString('utf8');
+      let boundary;
+      while ((boundary = buffer.indexOf('\n\n')) >= 0) {
+        const block = buffer.slice(0, boundary);
+        buffer = buffer.slice(boundary + 2);
+        const event = /^event:\s*(.+)$/m.exec(block);
+        const data = /^data:\s*(.+)$/m.exec(block);
+        if (event && data) frames.push({ event: event[1], data: JSON.parse(data[1]) });
+      }
+    });
+  });
+  request.on('error', error => { frames.push({ event: 'transport-error', data: { message: error.message } }); });
+  return { frames, close: () => request.destroy() };
+}
+
+async function waitFor(predicate) {
+  for (let attempt = 0; attempt < 100; attempt += 1) {
+    if (predicate()) return;
+    await new Promise(resolve => setTimeout(resolve, 50));
+  }
+  throw new Error('timed out waiting for SSE frame');
+}
+
+(async () => {
+  PORT = await freePort(); BASE = `http://127.0.0.1:${PORT}`;
+  git(['init', '--initial-branch=main']);
+  git(['config', 'user.email', 'sse@example.test']);
+  git(['config', 'user.name', 'SSE Test']);
+  const spawned = spawnServer({ root: ROOT, port: PORT, dataDir, tag: 'sse-v2', extraEnv: { KB_SKIP_MIGRATION: '1' } });
+  try {
+    await waitForServer();
+    await json('PATCH', '/api/settings', { knowledge: { rootPath: path.join(dataDir, 'knowledge') } });
+    await json('PUT', '/api/ai-profiles', { schema: 'ai-profiles/v1', defaultProfileId: 'test', profiles: [{ id: 'test', name: 'Test', enabled: true, implementation: 'claude-code-agent', apiKeyUpdate: { mode: 'replace', value: 'sk-test' } }] });
+    const imported = await json('POST', '/api/projects/import', { localPath: repoPath, aiProfileId: 'test' });
+    assert.strictEqual(imported.status, 201, JSON.stringify(imported.data));
+
+    const stream = openSse();
+    await waitFor(() => stream.frames.some(frame => frame.event === 'claude/snapshot'));
+    const snapshot = stream.frames.find(frame => frame.event === 'claude/snapshot');
+    assert(Array.isArray(snapshot.data.sessions));
+
+    const started = await json('POST', '/api/claude/sessions', { projectId: imported.data.projectId });
+    assert.strictEqual(started.status, 201, JSON.stringify(started.data));
+    await waitFor(() => stream.frames.some(frame => frame.event === 'claude/sessions-changed' && frame.data.kind === 'create'));
+    const created = stream.frames.find(frame => frame.event === 'claude/sessions-changed' && frame.data.kind === 'create');
+    assert.strictEqual(created.data.projectSlug, imported.data.projectId);
+    const sessions = await json('GET', `/api/claude/sessions?projectId=${encodeURIComponent(imported.data.projectId)}`);
+    assert(sessions.data.sessions.some(session => session.sessionId === started.data.sessionId));
+    stream.close();
+    console.log('sessions-stream-test PASS');
+  } finally {
+    await spawned.cleanup();
+    fs.rmSync(repoPath, { recursive: true, force: true });
+  }
+})().catch(error => { console.error(error); process.exitCode = 1; });

package/_site/_test/shared-scope-root-binding-test.js

@@ -1,67 +1,67 @@
-'use strict';
-const assert = require('node:assert/strict');
-const fs = require('node:fs');
-const path = require('node:path');
-const os = require('node:os');
-const { createEngineServer } = require('../../_modules/knowledge-engine/src/server');
-const { SettingsStore } = require('../lib/settings-store');
-const { ModuleBridge } = require('../lib/module-bridge');
-
-(async () => {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'kb-shared-bindings-'));
-  const oldRoot = path.join(root, '原知识根目录'), newRoot = path.join(root, '新知识根目录');
-  const settings = new SettingsStore({ dataDir: path.join(root, 'shell') });
-  await settings.initialize({ knowledge: { rootPath: oldRoot } });
-  await settings.addDomain({ id: 'domain-tools', name: '开发工具' });
-  let engine;
-  async function start() {
-    engine = createEngineServer({ dataDir: path.join(root, 'engine'), consume: false, runtimeToken: 'scope-binding-test' });
-    await engine.ready;
-    await new Promise(resolve => engine.server.listen(0, '127.0.0.1', resolve));
-    return `http://127.0.0.1:${engine.server.address().port}`;
-  }
-  const logs = [];
-  const bridge = new ModuleBridge({ settingsStore: settings, runtimeToken: 'scope-binding-test', logger: { warn: (...args) => logs.push(args) } });
-  const upstream = bridge._fetch.bind(bridge);
-  bridge._fetch = (url, init) => url.startsWith(bridge.engineUrl) ? upstream(url, init) : Promise.resolve({ ok: false });
-  try {
-    bridge.engineUrl = await start();
-    assert.equal((await bridge.syncEngineConfiguration()).scopes, true);
-    const scopes = structuredClone(engine.store.state.sharedScopes);
-    const brain = scopes.find(scope => scope.kind === 'brain');
-    const domain = scopes.find(scope => scope.kind === 'domain');
-    engine.store.addProject({ projectId: 'project-test', repoPath: path.join(root, 'code'), knowledgePath: path.join(root, 'project-knowledge'), domainId: domain.id });
-    engine.store.state.memories.push({ id: 'memory-test', brainId: brain.id, status: 'candidate', text: '保持目录绑定稳定', evidence: { projectId: 'project-test', commitSha: 'a'.repeat(40), entryId: 'README.md' } });
-    engine.store.save();
-    await engine.coordinator.memories.update('memory-test', { status: 'confirmed' });
-    fs.writeFileSync(path.join(domain.knowledgePath, 'README.md'), '# 领域经验\n\n领域知识不能随根目录设置隐式移动。\n');
-    const memoryFile = engine.coordinator.memories.file(brain);
-    const before = fs.readFileSync(memoryFile);
-    await settings.updatePatch({ knowledge: { rootPath: newRoot } });
-    assert.equal((await bridge.syncEngineConfiguration()).scopes, true, 'changing index root must not invalidate shared memory wiring');
-    assert.deepEqual(engine.store.state.sharedScopes.map(scope => scope.knowledgePath), scopes.map(scope => scope.knowledgePath));
-    assert.deepEqual(fs.readFileSync(memoryFile), before);
-    assert.equal(settings.read().brain.knowledgePath, brain.knowledgePath);
-    assert.equal(settings.read().brain.domains[0].knowledgePath, domain.knowledgePath);
-    await assert.rejects(settings.updatePatch({ brain: { knowledgePath: newRoot } }), { code: 'INVALID_ARGUMENT' });
-    await assert.rejects(settings.bindSharedKnowledgePaths([{ ...brain, knowledgePath: newRoot }]), { code: 'IMMUTABLE_FIELD' });
-    await settings.addDomain({ id: 'domain-new', name: '新领域' });
-    assert.equal((await bridge.syncEngineConfiguration()).scopes, true);
-    assert.equal(engine.store.state.sharedScopes.find(scope => scope.id === 'domain-new').knowledgePath, path.join(newRoot, '_shared', 'domain-new'));
-    await engine.close();
-    bridge.engineUrl = await start();
-    assert.equal((await bridge.syncEngineConfiguration()).scopes, true);
-    assert.deepEqual(fs.readFileSync(memoryFile), before);
-    const memory = await engine.coordinator.retrieval.get({ projectId: 'project-test', spaceId: 'brain:brain-default', entryId: 'memories/confirmed.md' });
-    assert.ok(memory.chunks.some(chunk => chunk.chunk_text.includes('保持目录绑定稳定')));
-    const shared = await engine.coordinator.retrieval.get({ projectId: 'project-test', spaceId: 'domain:domain-tools', entryId: 'README.md' });
-    assert.ok(shared.chunks.some(chunk => chunk.chunk_text.includes('不能随根目录设置隐式移动')));
-    await engine.close(); engine = null;
-    const pending = await bridge.syncEngineConfiguration();
-    assert.equal(pending.scopes, false);
-    assert.equal(pending.scopeStatus.status, 'pending');
-    assert.ok(logs.some(entry => entry[0] === 'modules.scopes.pending'));
-    assert.equal(settings.read().brain.knowledgePath, brain.knowledgePath);
-    console.log('shared-scope-root-binding-test PASS');
-  } finally { if (engine) await engine.close(); }
-})().catch(error => { console.error(error); process.exitCode = 1; });
+'use strict';
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const { createEngineServer } = require('../../_modules/knowledge-engine/src/server');
+const { SettingsStore } = require('../lib/settings-store');
+const { ModuleBridge } = require('../lib/module-bridge');
+
+(async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'kb-shared-bindings-'));
+  const oldRoot = path.join(root, '原知识根目录'), newRoot = path.join(root, '新知识根目录');
+  const settings = new SettingsStore({ dataDir: path.join(root, 'shell') });
+  await settings.initialize({ knowledge: { rootPath: oldRoot } });
+  await settings.addDomain({ id: 'domain-tools', name: '开发工具' });
+  let engine;
+  async function start() {
+    engine = createEngineServer({ dataDir: path.join(root, 'engine'), consume: false, runtimeToken: 'scope-binding-test' });
+    await engine.ready;
+    await new Promise(resolve => engine.server.listen(0, '127.0.0.1', resolve));
+    return `http://127.0.0.1:${engine.server.address().port}`;
+  }
+  const logs = [];
+  const bridge = new ModuleBridge({ settingsStore: settings, runtimeToken: 'scope-binding-test', logger: { warn: (...args) => logs.push(args) } });
+  const upstream = bridge._fetch.bind(bridge);
+  bridge._fetch = (url, init) => url.startsWith(bridge.engineUrl) ? upstream(url, init) : Promise.resolve({ ok: false });
+  try {
+    bridge.engineUrl = await start();
+    assert.equal((await bridge.syncEngineConfiguration()).scopes, true);
+    const scopes = structuredClone(engine.store.state.sharedScopes);
+    const brain = scopes.find(scope => scope.kind === 'brain');
+    const domain = scopes.find(scope => scope.kind === 'domain');
+    engine.store.addProject({ projectId: 'project-test', repoPath: path.join(root, 'code'), knowledgePath: path.join(root, 'project-knowledge'), domainId: domain.id });
+    engine.store.state.memories.push({ id: 'memory-test', brainId: brain.id, status: 'candidate', text: '保持目录绑定稳定', evidence: { projectId: 'project-test', commitSha: 'a'.repeat(40), entryId: 'README.md' } });
+    engine.store.save();
+    await engine.coordinator.memories.update('memory-test', { status: 'confirmed' });
+    fs.writeFileSync(path.join(domain.knowledgePath, 'README.md'), '# 领域经验\n\n领域知识不能随根目录设置隐式移动。\n');
+    const memoryFile = engine.coordinator.memories.file(brain);
+    const before = fs.readFileSync(memoryFile);
+    await settings.updatePatch({ knowledge: { rootPath: newRoot } });
+    assert.equal((await bridge.syncEngineConfiguration()).scopes, true, 'changing index root must not invalidate shared memory wiring');
+    assert.deepEqual(engine.store.state.sharedScopes.map(scope => scope.knowledgePath), scopes.map(scope => scope.knowledgePath));
+    assert.deepEqual(fs.readFileSync(memoryFile), before);
+    assert.equal(settings.read().brain.knowledgePath, brain.knowledgePath);
+    assert.equal(settings.read().brain.domains[0].knowledgePath, domain.knowledgePath);
+    await assert.rejects(settings.updatePatch({ brain: { knowledgePath: newRoot } }), { code: 'INVALID_ARGUMENT' });
+    await assert.rejects(settings.bindSharedKnowledgePaths([{ ...brain, knowledgePath: newRoot }]), { code: 'IMMUTABLE_FIELD' });
+    await settings.addDomain({ id: 'domain-new', name: '新领域' });
+    assert.equal((await bridge.syncEngineConfiguration()).scopes, true);
+    assert.equal(engine.store.state.sharedScopes.find(scope => scope.id === 'domain-new').knowledgePath, path.join(newRoot, '_shared', 'domain-new'));
+    await engine.close();
+    bridge.engineUrl = await start();
+    assert.equal((await bridge.syncEngineConfiguration()).scopes, true);
+    assert.deepEqual(fs.readFileSync(memoryFile), before);
+    const memory = await engine.coordinator.retrieval.get({ projectId: 'project-test', spaceId: 'brain:brain-default', entryId: 'memories/confirmed.md' });
+    assert.ok(memory.chunks.some(chunk => chunk.chunk_text.includes('保持目录绑定稳定')));
+    const shared = await engine.coordinator.retrieval.get({ projectId: 'project-test', spaceId: 'domain:domain-tools', entryId: 'README.md' });
+    assert.ok(shared.chunks.some(chunk => chunk.chunk_text.includes('不能随根目录设置隐式移动')));
+    await engine.close(); engine = null;
+    const pending = await bridge.syncEngineConfiguration();
+    assert.equal(pending.scopes, false);
+    assert.equal(pending.scopeStatus.status, 'pending');
+    assert.ok(logs.some(entry => entry[0] === 'modules.scopes.pending'));
+    assert.equal(settings.read().brain.knowledgePath, brain.knowledgePath);
+    console.log('shared-scope-root-binding-test PASS');
+  } finally { if (engine) await engine.close(); }
+})().catch(error => { console.error(error); process.exitCode = 1; });