@sanqianx/project-knowledge 5.0.19 → 5.0.20-rc.1

package/_site/scripts/install-module-candidates.js

@@ -1,69 +1,69 @@
-'use strict';
-const fs = require('node:fs');
-const os = require('node:os');
-const path = require('node:path');
-const crypto = require('node:crypto');
-const { createRequire } = require('node:module');
-const { spawnSync } = require('node:child_process');
-const AtomicFile = require('../lib/atomic-file');
-const { verifyInstalled, safeRelative } = require('./pack-module-candidates');
-const root = path.resolve(__dirname, '../..');
-const npmCli = process.env.npm_execpath || path.join(path.dirname(process.execPath), 'node_modules/npm/bin/npm-cli.js');
-function run(args, cwd) {
-  const result = spawnSync(process.execPath, [npmCli, ...args], { cwd, windowsHide: true, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
-  if (result.status !== 0) throw new Error(`npm ${args[0]} failed (${result.status})`);
-  return result.stdout;
-}
-function contentAddressedArtifact(packedCore) {
-  const sha256 = crypto.createHash('sha256').update(fs.readFileSync(packedCore)).digest('hex');
-  const file = packedCore.replace(/\.tgz$/, `-${sha256}.tgz`);
-  if (file === packedCore) throw new Error('Candidate must be a tarball');
-  fs.copyFileSync(packedCore, file);
-  return { file, sha256 };
-}
-function main() {
-  const manifestFile = path.resolve(process.argv[2]);
-  const manifest = JSON.parse(fs.readFileSync(manifestFile));
-  if (manifest.schema !== 'project-knowledge/module-candidates/v1') throw new Error('Invalid candidate manifest');
-  const artifactRoot = path.dirname(manifestFile);
-  const dependencies = {};
-  for (const module of Object.values(manifest.modules)) {
-    if (!safeRelative(module.tarball) || !module.tarball.endsWith('.tgz')) throw new Error('Unsafe artifact path');
-    const file = path.join(artifactRoot, module.tarball);
-    if (fs.lstatSync(file).isSymbolicLink() || crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex') !== module.sha256) throw new Error('Module artifact drift');
-    dependencies[module.installName] = `file:${file}`;
-  }
-  const candidate = JSON.parse(run(['pack', '--ignore-scripts', '--json', '--pack-destination', artifactRoot], root))[0];
-  const packedCore = path.join(artifactRoot, candidate.filename);
-  // Same-version local tarballs are cached by npm. Address each candidate by
-  // content so an update cannot silently keep an older runtime or UI.
-  const { sha256: shellSha256, file: shellArtifact } = contentAddressedArtifact(packedCore);
-  dependencies['@sanqianx/project-knowledge'] = `file:${shellArtifact}`;
-  const updateAt = process.argv.indexOf('--update');
-  const installedRoot = updateAt < 0 ? fs.mkdtempSync(path.join(os.tmpdir(), 'kb-installed-product-')) : path.resolve(process.argv[updateAt + 1]);
-  if (path.dirname(installedRoot) !== path.resolve(os.tmpdir()) || !path.basename(installedRoot).startsWith('kb-installed-product-') || fs.lstatSync(installedRoot).isSymbolicLink()) throw new Error('Only this task’s isolated installation can be updated');
-  if (updateAt >= 0 && JSON.parse(fs.readFileSync(path.join(installedRoot, 'installation-acceptance.json'))).installedRoot !== installedRoot) throw new Error('Installed fixture identity mismatch');
-  AtomicFile.writeJsonAtomic(path.join(installedRoot, 'package.json'), { name: 'kb-local-acceptance', version: '0.0.0', private: true, dependencies });
-  process.stdout.write(`Installing isolated product at ${installedRoot}\n`);
-  run(['install', '--omit=dev', '--ignore-scripts', '--no-audit', '--no-fund'], installedRoot);
-  verifyInstalled(manifest, installedRoot);
-  const core = path.join(installedRoot, 'node_modules/@sanqianx/project-knowledge');
-  const resolver = createRequire(path.join(core, 'package.json'));
-  for (const module of Object.values(manifest.modules)) {
-    const actual = resolver.resolve(`${module.installName}/package.json`);
-    if (actual !== path.join(installedRoot, 'node_modules', module.installName, 'package.json')) throw new Error(`A nested stale module shadows the tested candidate: ${module.installName}`);
-  }
-  const verify = spawnSync(process.execPath, [path.join(core, '_site/scripts/verify-module-runtime.js'), '--working-tree'], { cwd: installedRoot, windowsHide: true, encoding: 'utf8' });
-  if (verify.status !== 0) throw new Error('Packaged engine integrity failed');
-  require('./verify-product-runtime').verifyProductRuntime(core);
-  for (const relative of ['vendor-manifest.json', 'module-runtime-manifest.json']) {
-    if (!fs.readFileSync(path.join(core, relative)).equals(fs.readFileSync(path.join(root, relative)))) throw new Error(`Installed candidate is stale: ${relative}`);
-  }
-  const report = { schema: 'project-knowledge/installed-candidates/v1', mode: 'local npm candidate installation, not remote release', installedRoot, core, artifactManifest: manifestFile, shellVersion: candidate.version, shellSha256, shellArtifact, modules: Object.fromEntries(Object.entries(manifest.modules).map(([key, module]) => [key, { version: module.version, sha256: module.sha256 }])), integrityPassed: true, testedAt: new Date().toISOString() };
-  AtomicFile.writeJsonAtomic(path.join(installedRoot, 'installation-acceptance.json'), report);
-  process.stdout.write(`INSTALLED_PRODUCT ${path.join(installedRoot, 'installation-acceptance.json')}\n`);
-}
-if (require.main === module) {
-  try { main(); } catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 1; }
-}
-module.exports = { contentAddressedArtifact };
+'use strict';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { createRequire } = require('node:module');
+const { spawnSync } = require('node:child_process');
+const AtomicFile = require('../lib/atomic-file');
+const { verifyInstalled, safeRelative } = require('./pack-module-candidates');
+const root = path.resolve(__dirname, '../..');
+const npmCli = process.env.npm_execpath || path.join(path.dirname(process.execPath), 'node_modules/npm/bin/npm-cli.js');
+function run(args, cwd) {
+  const result = spawnSync(process.execPath, [npmCli, ...args], { cwd, windowsHide: true, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+  if (result.status !== 0) throw new Error(`npm ${args[0]} failed (${result.status})`);
+  return result.stdout;
+}
+function contentAddressedArtifact(packedCore) {
+  const sha256 = crypto.createHash('sha256').update(fs.readFileSync(packedCore)).digest('hex');
+  const file = packedCore.replace(/\.tgz$/, `-${sha256}.tgz`);
+  if (file === packedCore) throw new Error('Candidate must be a tarball');
+  fs.copyFileSync(packedCore, file);
+  return { file, sha256 };
+}
+function main() {
+  const manifestFile = path.resolve(process.argv[2]);
+  const manifest = JSON.parse(fs.readFileSync(manifestFile));
+  if (manifest.schema !== 'project-knowledge/module-candidates/v1') throw new Error('Invalid candidate manifest');
+  const artifactRoot = path.dirname(manifestFile);
+  const dependencies = {};
+  for (const module of Object.values(manifest.modules)) {
+    if (!safeRelative(module.tarball) || !module.tarball.endsWith('.tgz')) throw new Error('Unsafe artifact path');
+    const file = path.join(artifactRoot, module.tarball);
+    if (fs.lstatSync(file).isSymbolicLink() || crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex') !== module.sha256) throw new Error('Module artifact drift');
+    dependencies[module.installName] = `file:${file}`;
+  }
+  const candidate = JSON.parse(run(['pack', '--ignore-scripts', '--json', '--pack-destination', artifactRoot], root))[0];
+  const packedCore = path.join(artifactRoot, candidate.filename);
+  // Same-version local tarballs are cached by npm. Address each candidate by
+  // content so an update cannot silently keep an older runtime or UI.
+  const { sha256: shellSha256, file: shellArtifact } = contentAddressedArtifact(packedCore);
+  dependencies['@sanqianx/project-knowledge'] = `file:${shellArtifact}`;
+  const updateAt = process.argv.indexOf('--update');
+  const installedRoot = updateAt < 0 ? fs.mkdtempSync(path.join(os.tmpdir(), 'kb-installed-product-')) : path.resolve(process.argv[updateAt + 1]);
+  if (path.dirname(installedRoot) !== path.resolve(os.tmpdir()) || !path.basename(installedRoot).startsWith('kb-installed-product-') || fs.lstatSync(installedRoot).isSymbolicLink()) throw new Error('Only this task’s isolated installation can be updated');
+  if (updateAt >= 0 && JSON.parse(fs.readFileSync(path.join(installedRoot, 'installation-acceptance.json'))).installedRoot !== installedRoot) throw new Error('Installed fixture identity mismatch');
+  AtomicFile.writeJsonAtomic(path.join(installedRoot, 'package.json'), { name: 'kb-local-acceptance', version: '0.0.0', private: true, dependencies });
+  process.stdout.write(`Installing isolated product at ${installedRoot}\n`);
+  run(['install', '--omit=dev', '--ignore-scripts', '--no-audit', '--no-fund'], installedRoot);
+  verifyInstalled(manifest, installedRoot);
+  const core = path.join(installedRoot, 'node_modules/@sanqianx/project-knowledge');
+  const resolver = createRequire(path.join(core, 'package.json'));
+  for (const module of Object.values(manifest.modules)) {
+    const actual = resolver.resolve(`${module.installName}/package.json`);
+    if (actual !== path.join(installedRoot, 'node_modules', module.installName, 'package.json')) throw new Error(`A nested stale module shadows the tested candidate: ${module.installName}`);
+  }
+  const verify = spawnSync(process.execPath, [path.join(core, '_site/scripts/verify-module-runtime.js'), '--working-tree'], { cwd: installedRoot, windowsHide: true, encoding: 'utf8' });
+  if (verify.status !== 0) throw new Error('Packaged engine integrity failed');
+  require('./verify-product-runtime').verifyProductRuntime(core);
+  for (const relative of ['vendor-manifest.json', 'module-runtime-manifest.json']) {
+    if (!fs.readFileSync(path.join(core, relative)).equals(fs.readFileSync(path.join(root, relative)))) throw new Error(`Installed candidate is stale: ${relative}`);
+  }
+  const report = { schema: 'project-knowledge/installed-candidates/v1', mode: 'local npm candidate installation, not remote release', installedRoot, core, artifactManifest: manifestFile, shellVersion: candidate.version, shellSha256, shellArtifact, modules: Object.fromEntries(Object.entries(manifest.modules).map(([key, module]) => [key, { version: module.version, sha256: module.sha256 }])), integrityPassed: true, testedAt: new Date().toISOString() };
+  AtomicFile.writeJsonAtomic(path.join(installedRoot, 'installation-acceptance.json'), report);
+  process.stdout.write(`INSTALLED_PRODUCT ${path.join(installedRoot, 'installation-acceptance.json')}\n`);
+}
+if (require.main === module) {
+  try { main(); } catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 1; }
+}
+module.exports = { contentAddressedArtifact };

package/_site/scripts/pack-module-candidates.js

@@ -1,89 +1,89 @@
-'use strict';
-const fs = require('node:fs');
-const path = require('node:path');
-const os = require('node:os');
-const crypto = require('node:crypto');
-const { spawnSync } = require('node:child_process');
-const AtomicFile = require('../lib/atomic-file');
-const hash = bytes => crypto.createHash('sha256').update(bytes).digest('hex');
-const root = path.resolve(__dirname, '../..');
-const npmCli = process.env.npm_execpath || path.join(path.dirname(process.execPath), 'node_modules/npm/bin/npm-cli.js');
-const definitions = {
-  terminal: { option: '--terminal-source', name: '@sanqianx/claude-ai-workbench', installName: 'claude-ai-workbench', required: ['apps/agent-terminal/app.js', 'apps/agent-terminal/app.css', 'packages/server/lib/knowledge-context.js'] },
-  vectorHub: { option: '--vector-source', name: '@sanqianx/vector-hub', installName: '@sanqianx/vector-hub', required: ['dist/cjs/bin.js', 'dist/cjs/server/manager.js', 'ui/index.html'] },
-  eventBridge: { option: '--bridge-source', name: '@sanqianx/ai-coding-event-bridge-console', installName: '@sanqianx/ai-coding-event-bridge-console', required: ['src/server.js', 'src/bridge/core/consumer-registry.js', 'console/index.html'] },
-};
-function run(command, args, cwd) {
-  const result = spawnSync(command, args, { cwd, windowsHide: true, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
-  if (result.status !== 0) throw new Error(`${path.basename(command)} failed (${result.status}): ${result.error?.message || result.stderr}`);
-  return result.stdout;
-}
-function safeRelative(file) { return typeof file === 'string' && !path.isAbsolute(file) && !/[\\\x00-\x1f]/.test(file) && !file.split('/').some(p => p === '..' || p === '.'); }
-function installedFileBytes(pkg, relative, bytes) {
-  const bins = typeof pkg.bin === 'string' ? [pkg.bin] : Object.values(pkg.bin || {});
-  const isBin = bins.some(file => String(file).replace(/\\/g, '/').replace(/^\.\//, '') === relative);
-  // npm bin-links removes CRLF from the shebang only, on every platform.
-  // Hash the installed bytes; keep body line endings and ordinary files exact.
-  if (isBin && /^#![^\n]+\r\n/.test(bytes.subarray(0, 2048).toString('utf8'))) return Buffer.from(bytes.toString('utf8').replace(/^(#![^\n]+)\r\n/, '$1\n'));
-  return bytes;
-}
-function productFiles(directory) {
-  const previous = JSON.parse(fs.readFileSync(path.join(directory, 'module-runtime-manifest.json'), 'utf8'));
-  const files = new Set(['ui/index.html', 'ui/product.js', 'ui/live-client.js', 'ui/product.css', 'ui/favicon.svg', ...Object.keys(previous.productFiles || {})]);
-  return Object.fromEntries([...files].map(file => {
-    if (!safeRelative(file)) throw new Error('Unsafe product asset path');
-    const target = path.join(directory, file);
-    if (fs.lstatSync(target).isSymbolicLink()) throw new Error('Symlink in product assets');
-    return [file, hash(fs.readFileSync(target))];
-  }));
-}
-function verifyInstalled(manifest, installedRoot) {
-  for (const [key, module] of Object.entries(manifest.modules)) {
-    const directory = path.join(installedRoot, 'node_modules', module.installName);
-    const pkg = JSON.parse(fs.readFileSync(path.join(directory, 'package.json')));
-    if (pkg.name !== module.name || pkg.version !== module.version) throw new Error(`Installed module identity mismatch: ${key}`);
-    for (const [relative, expected] of Object.entries(module.files)) {
-      if (!safeRelative(relative)) throw new Error('Unsafe module manifest path');
-      const file = path.join(directory, relative);
-      if (fs.lstatSync(file).isSymbolicLink() || hash(fs.readFileSync(file)) !== expected) throw new Error(`Installed module is stale or altered: ${key}/${relative}`);
-    }
-  }
-}
-function pack(sources) {
-  const output = fs.mkdtempSync(path.join(os.tmpdir(), 'kb-module-candidates-'));
-  const manifest = { schema: 'project-knowledge/module-candidates/v1', createdAt: new Date().toISOString(), modules: {} };
-  for (const [key, definition] of Object.entries(definitions)) {
-    const source = path.resolve(sources[key]);
-    const pkg = JSON.parse(fs.readFileSync(path.join(source, 'package.json')));
-    if (pkg.name !== definition.name) throw new Error(`Unexpected source identity: ${key}`);
-    const expectedVersion = JSON.parse(fs.readFileSync(path.join(root, 'package.json'))).dependencies[definition.installName];
-    if (expectedVersion !== pkg.version && expectedVersion !== `npm:${pkg.name}@${pkg.version}`) throw new Error(`Source version is not pinned by the shell: ${key}`);
-    const result = JSON.parse(run(process.execPath, [npmCli, 'pack', '--ignore-scripts', '--json', '--pack-destination', output], source))[0];
-    const files = {};
-    for (const entry of result.files) {
-      if (!safeRelative(entry.path)) throw new Error('Unsafe npm package path');
-      const file = path.join(source, entry.path);
-      if (fs.lstatSync(file).isSymbolicLink()) throw new Error(`Symlink in module package: ${key}/${entry.path}`);
-      files[entry.path] = hash(installedFileBytes(pkg, entry.path, fs.readFileSync(file)));
-    }
-    if (definition.required.some(file => !files[file])) throw new Error(`Incomplete module runtime: ${key}`);
-    manifest.modules[key] = { name: pkg.name, installName: definition.installName, version: pkg.version, tarball: result.filename, sha256: hash(fs.readFileSync(path.join(output, result.filename))), files };
-    process.stdout.write(`Packed ${key} ${pkg.version}: ${result.files.length} files\n`);
-  }
-  const manifestPath = path.join(output, 'module-candidates.json'); AtomicFile.writeJsonAtomic(manifestPath, manifest);
-  AtomicFile.writeJsonAtomic(path.join(root, 'module-runtime-manifest.json'), { schema: 'project-knowledge/module-content/v1', productFiles: productFiles(root), modules: Object.fromEntries(Object.entries(manifest.modules).map(([key, module]) => [key, { name: module.name, installName: module.installName, version: module.version, files: module.files }])) });
-  process.stdout.write(`MODULE_CANDIDATES ${manifestPath}\n`);
-  return manifestPath;
-}
-if (require.main === module) {
-  try {
-    const at = process.argv.indexOf('--verify-installed');
-    if (at >= 0) { const manifest = JSON.parse(fs.readFileSync(process.argv[at + 1])); verifyInstalled(manifest, path.resolve(process.argv[at + 2])); process.stdout.write('Installed module bytes verified against candidate artifacts.\n'); }
-    else {
-      const sources = {};
-      for (const [key, d] of Object.entries(definitions)) { const i = process.argv.indexOf(d.option); if (i < 0 || !process.argv[i + 1]) throw new Error(`Explicit source required: ${d.option}`); sources[key] = process.argv[i + 1]; }
-      pack(sources);
-    }
-  } catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 1; }
-}
-module.exports = { verifyInstalled, safeRelative, productFiles, installedFileBytes };
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const crypto = require('node:crypto');
+const { spawnSync } = require('node:child_process');
+const AtomicFile = require('../lib/atomic-file');
+const hash = bytes => crypto.createHash('sha256').update(bytes).digest('hex');
+const root = path.resolve(__dirname, '../..');
+const npmCli = process.env.npm_execpath || path.join(path.dirname(process.execPath), 'node_modules/npm/bin/npm-cli.js');
+const definitions = {
+  terminal: { option: '--terminal-source', name: '@sanqianx/claude-ai-workbench', installName: 'claude-ai-workbench', required: ['apps/agent-terminal/app.js', 'apps/agent-terminal/app.css', 'packages/server/lib/knowledge-context.js'] },
+  vectorHub: { option: '--vector-source', name: '@sanqianx/vector-hub', installName: '@sanqianx/vector-hub', required: ['dist/cjs/bin.js', 'dist/cjs/server/manager.js', 'ui/index.html'] },
+  eventBridge: { option: '--bridge-source', name: '@sanqianx/ai-coding-event-bridge-console', installName: '@sanqianx/ai-coding-event-bridge-console', required: ['src/server.js', 'src/bridge/core/consumer-registry.js', 'console/index.html'] },
+};
+function run(command, args, cwd) {
+  const result = spawnSync(command, args, { cwd, windowsHide: true, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+  if (result.status !== 0) throw new Error(`${path.basename(command)} failed (${result.status}): ${result.error?.message || result.stderr}`);
+  return result.stdout;
+}
+function safeRelative(file) { return typeof file === 'string' && !path.isAbsolute(file) && !/[\\\x00-\x1f]/.test(file) && !file.split('/').some(p => p === '..' || p === '.'); }
+function installedFileBytes(pkg, relative, bytes) {
+  const bins = typeof pkg.bin === 'string' ? [pkg.bin] : Object.values(pkg.bin || {});
+  const isBin = bins.some(file => String(file).replace(/\\/g, '/').replace(/^\.\//, '') === relative);
+  // npm bin-links removes CRLF from the shebang only, on every platform.
+  // Hash the installed bytes; keep body line endings and ordinary files exact.
+  if (isBin && /^#![^\n]+\r\n/.test(bytes.subarray(0, 2048).toString('utf8'))) return Buffer.from(bytes.toString('utf8').replace(/^(#![^\n]+)\r\n/, '$1\n'));
+  return bytes;
+}
+function productFiles(directory) {
+  const previous = JSON.parse(fs.readFileSync(path.join(directory, 'module-runtime-manifest.json'), 'utf8'));
+  const files = new Set(['ui/index.html', 'ui/knowledge-panel.html', 'ui/product.js', 'ui/live-client.js', 'ui/product.css', 'ui/favicon.svg', ...Object.keys(previous.productFiles || {})]);
+  return Object.fromEntries([...files].map(file => {
+    if (!safeRelative(file)) throw new Error('Unsafe product asset path');
+    const target = path.join(directory, file);
+    if (fs.lstatSync(target).isSymbolicLink()) throw new Error('Symlink in product assets');
+    return [file, hash(fs.readFileSync(target))];
+  }));
+}
+function verifyInstalled(manifest, installedRoot) {
+  for (const [key, module] of Object.entries(manifest.modules)) {
+    const directory = path.join(installedRoot, 'node_modules', module.installName);
+    const pkg = JSON.parse(fs.readFileSync(path.join(directory, 'package.json')));
+    if (pkg.name !== module.name || pkg.version !== module.version) throw new Error(`Installed module identity mismatch: ${key}`);
+    for (const [relative, expected] of Object.entries(module.files)) {
+      if (!safeRelative(relative)) throw new Error('Unsafe module manifest path');
+      const file = path.join(directory, relative);
+      if (fs.lstatSync(file).isSymbolicLink() || hash(fs.readFileSync(file)) !== expected) throw new Error(`Installed module is stale or altered: ${key}/${relative}`);
+    }
+  }
+}
+function pack(sources) {
+  const output = fs.mkdtempSync(path.join(os.tmpdir(), 'kb-module-candidates-'));
+  const manifest = { schema: 'project-knowledge/module-candidates/v1', createdAt: new Date().toISOString(), modules: {} };
+  for (const [key, definition] of Object.entries(definitions)) {
+    const source = path.resolve(sources[key]);
+    const pkg = JSON.parse(fs.readFileSync(path.join(source, 'package.json')));
+    if (pkg.name !== definition.name) throw new Error(`Unexpected source identity: ${key}`);
+    const expectedVersion = JSON.parse(fs.readFileSync(path.join(root, 'package.json'))).dependencies[definition.installName];
+    if (expectedVersion !== pkg.version && expectedVersion !== `npm:${pkg.name}@${pkg.version}`) throw new Error(`Source version is not pinned by the shell: ${key}`);
+    const result = JSON.parse(run(process.execPath, [npmCli, 'pack', '--ignore-scripts', '--json', '--pack-destination', output], source))[0];
+    const files = {};
+    for (const entry of result.files) {
+      if (!safeRelative(entry.path)) throw new Error('Unsafe npm package path');
+      const file = path.join(source, entry.path);
+      if (fs.lstatSync(file).isSymbolicLink()) throw new Error(`Symlink in module package: ${key}/${entry.path}`);
+      files[entry.path] = hash(installedFileBytes(pkg, entry.path, fs.readFileSync(file)));
+    }
+    if (definition.required.some(file => !files[file])) throw new Error(`Incomplete module runtime: ${key}`);
+    manifest.modules[key] = { name: pkg.name, installName: definition.installName, version: pkg.version, tarball: result.filename, sha256: hash(fs.readFileSync(path.join(output, result.filename))), files };
+    process.stdout.write(`Packed ${key} ${pkg.version}: ${result.files.length} files\n`);
+  }
+  const manifestPath = path.join(output, 'module-candidates.json'); AtomicFile.writeJsonAtomic(manifestPath, manifest);
+  AtomicFile.writeJsonAtomic(path.join(root, 'module-runtime-manifest.json'), { schema: 'project-knowledge/module-content/v1', productFiles: productFiles(root), modules: Object.fromEntries(Object.entries(manifest.modules).map(([key, module]) => [key, { name: module.name, installName: module.installName, version: module.version, files: module.files }])) });
+  process.stdout.write(`MODULE_CANDIDATES ${manifestPath}\n`);
+  return manifestPath;
+}
+if (require.main === module) {
+  try {
+    const at = process.argv.indexOf('--verify-installed');
+    if (at >= 0) { const manifest = JSON.parse(fs.readFileSync(process.argv[at + 1])); verifyInstalled(manifest, path.resolve(process.argv[at + 2])); process.stdout.write('Installed module bytes verified against candidate artifacts.\n'); }
+    else {
+      const sources = {};
+      for (const [key, d] of Object.entries(definitions)) { const i = process.argv.indexOf(d.option); if (i < 0 || !process.argv[i + 1]) throw new Error(`Explicit source required: ${d.option}`); sources[key] = process.argv[i + 1]; }
+      pack(sources);
+    }
+  } catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 1; }
+}
+module.exports = { verifyInstalled, safeRelative, productFiles, installedFileBytes };

package/_site/scripts/sync-product-content.js

@@ -1,28 +1,28 @@
-'use strict';
-const fs = require('node:fs');
-const path = require('node:path');
-const crypto = require('node:crypto');
-const { createRequire } = require('node:module');
-const { execFileSync } = require('node:child_process');
-const { safeRelative } = require('./pack-module-candidates');
-const AtomicFile = require('../lib/atomic-file');
-const root = path.resolve(__dirname, '../..');
-const file = path.join(root, 'module-runtime-manifest.json');
-const manifest = JSON.parse(fs.readFileSync(file));
-const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json')));
-const resolve = createRequire(path.join(root, 'package.json'));
-const digest = file => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
-for (const module of Object.values(manifest.modules)) {
-  const directory = path.dirname(resolve.resolve(`${module.installName}/package.json`));
-  if (!directory.startsWith(path.join(root, 'node_modules') + path.sep)) throw new Error('Module must resolve inside this installed dependency tree.');
-  const installed = JSON.parse(fs.readFileSync(path.join(directory, 'package.json')));
-  const expected = pkg.dependencies[module.installName];
-  if (installed.name !== module.name || ![installed.version, `npm:${installed.name}@${installed.version}`].includes(expected)) throw new Error('Install the exact registry module version before content synchronization.');
-  module.version = installed.version;
-  const npmCli = process.env.npm_execpath || path.join(path.dirname(process.execPath), 'node_modules/npm/bin/npm-cli.js');
-  const packed = JSON.parse(execFileSync(process.execPath, [npmCli, 'pack', '--dry-run', '--ignore-scripts', '--json'], { cwd: directory, windowsHide: true, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 }))[0];
-  module.files = Object.fromEntries(packed.files.map(entry => { const relative = entry.path; if (!safeRelative(relative)) throw new Error('Unsafe content path'); const target = path.join(directory, relative); if (fs.lstatSync(target).isSymbolicLink()) throw new Error('Unsafe content symlink'); return [relative, digest(target)]; }));
-}
-for (const relative of ['ui/index.html', 'ui/product.js', 'ui/live-client.js', 'ui/product.css', 'ui/favicon.svg', 'plugins/project-knowledge/hooks/claude.json', 'plugins/project-knowledge/hooks/codex.json', 'plugins/project-knowledge/scripts/context-hook.cjs', 'plugins/project-knowledge/scripts/mcp-launcher.cjs', 'plugins/project-knowledge/.claude-plugin/plugin.json', 'plugins/project-knowledge/.codex-plugin/plugin.json', 'plugins/project-knowledge/.mcp.json']) manifest.productFiles[relative] = digest(path.join(root, relative));
-AtomicFile.writeJsonAtomic(file, manifest);
-console.log('Updated content hashes from exact installed modules and reviewed product assets; this is not release acceptance.');
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { createRequire } = require('node:module');
+const { execFileSync } = require('node:child_process');
+const { safeRelative } = require('./pack-module-candidates');
+const AtomicFile = require('../lib/atomic-file');
+const root = path.resolve(__dirname, '../..');
+const file = path.join(root, 'module-runtime-manifest.json');
+const manifest = JSON.parse(fs.readFileSync(file));
+const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json')));
+const resolve = createRequire(path.join(root, 'package.json'));
+const digest = file => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+for (const module of Object.values(manifest.modules)) {
+  const directory = path.dirname(resolve.resolve(`${module.installName}/package.json`));
+  if (!directory.startsWith(path.join(root, 'node_modules') + path.sep)) throw new Error('Module must resolve inside this installed dependency tree.');
+  const installed = JSON.parse(fs.readFileSync(path.join(directory, 'package.json')));
+  const expected = pkg.dependencies[module.installName];
+  if (installed.name !== module.name || ![installed.version, `npm:${installed.name}@${installed.version}`].includes(expected)) throw new Error('Install the exact registry module version before content synchronization.');
+  module.version = installed.version;
+  const npmCli = process.env.npm_execpath || path.join(path.dirname(process.execPath), 'node_modules/npm/bin/npm-cli.js');
+  const packed = JSON.parse(execFileSync(process.execPath, [npmCli, 'pack', '--dry-run', '--ignore-scripts', '--json'], { cwd: directory, windowsHide: true, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 }))[0];
+  module.files = Object.fromEntries(packed.files.map(entry => { const relative = entry.path; if (!safeRelative(relative)) throw new Error('Unsafe content path'); const target = path.join(directory, relative); if (fs.lstatSync(target).isSymbolicLink()) throw new Error('Unsafe content symlink'); return [relative, digest(target)]; }));
+}
+for (const relative of ['ui/index.html', 'ui/knowledge-panel.html', 'ui/product.js', 'ui/live-client.js', 'ui/product.css', 'ui/favicon.svg', 'plugins/project-knowledge/hooks/claude.json', 'plugins/project-knowledge/hooks/codex.json', 'plugins/project-knowledge/scripts/context-hook.cjs', 'plugins/project-knowledge/scripts/mcp-launcher.cjs', 'plugins/project-knowledge/.claude-plugin/plugin.json', 'plugins/project-knowledge/.codex-plugin/plugin.json', 'plugins/project-knowledge/.mcp.json']) manifest.productFiles[relative] = digest(path.join(root, relative));
+AtomicFile.writeJsonAtomic(file, manifest);
+console.log('Updated content hashes from exact installed modules and reviewed product assets; this is not release acceptance.');