@sanqianx/project-knowledge 5.0.19 → 5.0.20-rc.1

package/_site/scripts/sync-release-version.js

@@ -1,164 +1,164 @@
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const { spawnSync } = require('child_process');
-
-function readJson(filePath) {
-  return JSON.parse(fs.readFileSync(filePath, 'utf8'));
-}
-
-function writeJson(filePath, value) {
-  fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
-}
-
-function packageVersion(rootDir) {
-  const version = String(readJson(path.join(rootDir, 'package.json')).version || '').trim();
-  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version)) {
-    throw new Error(`package.json must contain a SemVer version, received: ${version || '(empty)'}`);
-  }
-  return version;
-}
-
-function releaseVersionTargets(rootDir, version, { webOnly = false } = {}) {
-  return [
-    {
-      file: 'package-lock.json',
-      update(value) {
-        value.version = version;
-        if (!value.packages || !value.packages['']) throw new Error('package-lock.json has no root package entry');
-        value.packages[''].version = version;
-      },
-    },
-    {
-      file: 'desktop/package.json',
-      update(value) { value.version = version; },
-    },
-    {
-      file: 'desktop/package-lock.json',
-      update(value) {
-        value.version = version;
-        if (!value.packages || !value.packages['']) throw new Error('desktop/package-lock.json has no root package entry');
-        value.packages[''].version = version;
-      },
-    },
-    {
-      file: 'plugins/project-knowledge/.claude-plugin/plugin.json',
-      update(value) { value.version = version; },
-    },
-    {
-      file: 'plugins/project-knowledge/.codex-plugin/plugin.json',
-      update(value) { value.version = version; },
-    },
-    {
-      file: '.claude-plugin/marketplace.json',
-      update(value) {
-        if (!Array.isArray(value.plugins) || !value.plugins[0]) throw new Error('Claude marketplace has no project plugin');
-        value.plugins[0].version = version;
-      },
-    },
-    {
-      file: 'plugins/project-knowledge/.mcp.json',
-      update(value) {
-        const server = value && value.mcpServers && value.mcpServers['project-knowledge'];
-        const serialized = JSON.stringify(server || {});
-        if (/npx/i.test(serialized) || /@sanqianx\/project-knowledge@/.test(serialized)) throw new Error('project-knowledge MCP server must use the bundled launcher; the npx/pinned package form is rejected');
-        const args = Array.isArray(server && server.args) ? server.args : [];
-        const bootstrap = String(args[1] || '');
-        if (!server || server.command !== 'node' || args[0] !== '-e' || !bootstrap.includes('mcp-launcher.cjs')) throw new Error('project-knowledge MCP server must launch the bundled mcp-launcher.cjs via node -e');
-        if (server.cwd !== undefined) throw new Error('project-knowledge MCP server must not pin a cwd; the plugin version is carried by env.KB_PLUGIN_VERSION');
-        if (bootstrap.includes('process.cwd')) throw new Error('the MCP bootstrap must never consult process.cwd');
-        server.env = { ...(server.env || {}), KB_PLUGIN_VERSION: version };
-      },
-    },
-  ].filter(target => !webOnly || !target.file.startsWith('desktop/')).map(target => ({ ...target, path: path.join(rootDir, target.file) }));
-}
-
-function inspectReleaseVersion(rootDir, options) {
-  const version = packageVersion(rootDir);
-  const drift = [];
-  for (const target of releaseVersionTargets(rootDir, version, options)) {
-    const before = fs.readFileSync(target.path, 'utf8');
-    const value = JSON.parse(before);
-    target.update(value);
-    const after = `${JSON.stringify(value, null, 2)}\n`;
-    if (before.replace(/\r\n/g, '\n') !== after) drift.push(target.file);
-  }
-  return { version, drift };
-}
-
-function syncReleaseVersion(rootDir, options) {
-  const version = packageVersion(rootDir);
-  const changed = [];
-  for (const target of releaseVersionTargets(rootDir, version, options)) {
-    const before = fs.readFileSync(target.path, 'utf8');
-    const value = JSON.parse(before);
-    target.update(value);
-    const after = `${JSON.stringify(value, null, 2)}\n`;
-    if (before.replace(/\r\n/g, '\n') === after) continue;
-    writeJson(target.path, value);
-    changed.push(target.file);
-  }
-  return { version, changed };
-}
-
-function stageReleaseVersionFiles(rootDir, files) {
-  if (!files.length) return;
-  const result = spawnSync('git', ['-C', rootDir, 'add', '--', ...files], {
-    encoding: 'utf8',
-    windowsHide: true,
-  });
-  if (result.status !== 0) {
-    throw new Error(`failed to stage synchronized release files: ${(result.stderr || result.stdout || '').trim()}`);
-  }
-}
-
-function parseArgs(argv) {
-  let rootDir = path.resolve(__dirname, '..', '..');
-  let check = false;
-  let tag = null;
-  let stage = false;
-  let webOnly = false;
-  for (let index = 0; index < argv.length; index += 1) {
-    const arg = argv[index];
-    if (arg === '--check') check = true;
-    else if (arg === '--stage') stage = true;
-    else if (arg === '--web-only') webOnly = true;
-    else if (arg === '--root') rootDir = path.resolve(argv[++index] || '');
-    else if (arg === '--tag') tag = String(argv[++index] || '').trim();
-    else throw new Error(`Unknown argument: ${arg}`);
-  }
-  return { rootDir, check, tag, stage, webOnly };
-}
-
-function main(argv = process.argv.slice(2)) {
-  const { rootDir, check, tag, stage, webOnly } = parseArgs(argv);
-  if (check) {
-    const result = inspectReleaseVersion(rootDir, { webOnly });
-    if (result.drift.length) {
-      throw new Error(`Release version ${result.version} is out of sync: ${result.drift.join(', ')}`);
-    }
-    if (tag && tag !== `v${result.version}`) {
-      throw new Error(`Release tag ${tag} must match package version v${result.version}`);
-    }
-    console.log(`release version ${result.version} is synchronized`);
-    return result;
-  }
-  const result = syncReleaseVersion(rootDir, { webOnly });
-  if (stage) stageReleaseVersionFiles(rootDir, result.changed);
-  console.log(result.changed.length
-    ? `${stage ? 'synchronized and staged' : 'synchronized'} release version ${result.version}: ${result.changed.join(', ')}`
-    : `release version ${result.version} is already synchronized`);
-  return result;
-}
-
-if (require.main === module) {
-  try {
-    main();
-  } catch (error) {
-    console.error(`release version synchronization failed: ${error.message}`);
-    process.exitCode = 1;
-  }
-}
-
-module.exports = { inspectReleaseVersion, main, releaseVersionTargets, stageReleaseVersionFiles, syncReleaseVersion };
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+function readJson(filePath) {
+  return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+}
+
+function writeJson(filePath, value) {
+  fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
+}
+
+function packageVersion(rootDir) {
+  const version = String(readJson(path.join(rootDir, 'package.json')).version || '').trim();
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version)) {
+    throw new Error(`package.json must contain a SemVer version, received: ${version || '(empty)'}`);
+  }
+  return version;
+}
+
+function releaseVersionTargets(rootDir, version, { webOnly = false } = {}) {
+  return [
+    {
+      file: 'package-lock.json',
+      update(value) {
+        value.version = version;
+        if (!value.packages || !value.packages['']) throw new Error('package-lock.json has no root package entry');
+        value.packages[''].version = version;
+      },
+    },
+    {
+      file: 'desktop/package.json',
+      update(value) { value.version = version; },
+    },
+    {
+      file: 'desktop/package-lock.json',
+      update(value) {
+        value.version = version;
+        if (!value.packages || !value.packages['']) throw new Error('desktop/package-lock.json has no root package entry');
+        value.packages[''].version = version;
+      },
+    },
+    {
+      file: 'plugins/project-knowledge/.claude-plugin/plugin.json',
+      update(value) { value.version = version; },
+    },
+    {
+      file: 'plugins/project-knowledge/.codex-plugin/plugin.json',
+      update(value) { value.version = version; },
+    },
+    {
+      file: '.claude-plugin/marketplace.json',
+      update(value) {
+        if (!Array.isArray(value.plugins) || !value.plugins[0]) throw new Error('Claude marketplace has no project plugin');
+        value.plugins[0].version = version;
+      },
+    },
+    {
+      file: 'plugins/project-knowledge/.mcp.json',
+      update(value) {
+        const server = value && value.mcpServers && value.mcpServers['project-knowledge'];
+        const serialized = JSON.stringify(server || {});
+        if (/npx/i.test(serialized) || /@sanqianx\/project-knowledge@/.test(serialized)) throw new Error('project-knowledge MCP server must use the bundled launcher; the npx/pinned package form is rejected');
+        const args = Array.isArray(server && server.args) ? server.args : [];
+        const bootstrap = String(args[1] || '');
+        if (!server || server.command !== 'node' || args[0] !== '-e' || !bootstrap.includes('mcp-launcher.cjs')) throw new Error('project-knowledge MCP server must launch the bundled mcp-launcher.cjs via node -e');
+        if (server.cwd !== undefined) throw new Error('project-knowledge MCP server must not pin a cwd; the plugin version is carried by env.KB_PLUGIN_VERSION');
+        if (bootstrap.includes('process.cwd')) throw new Error('the MCP bootstrap must never consult process.cwd');
+        server.env = { ...(server.env || {}), KB_PLUGIN_VERSION: version };
+      },
+    },
+  ].filter(target => !webOnly || !target.file.startsWith('desktop/')).map(target => ({ ...target, path: path.join(rootDir, target.file) }));
+}
+
+function inspectReleaseVersion(rootDir, options) {
+  const version = packageVersion(rootDir);
+  const drift = [];
+  for (const target of releaseVersionTargets(rootDir, version, options)) {
+    const before = fs.readFileSync(target.path, 'utf8');
+    const value = JSON.parse(before);
+    target.update(value);
+    const after = `${JSON.stringify(value, null, 2)}\n`;
+    if (before.replace(/\r\n/g, '\n') !== after) drift.push(target.file);
+  }
+  return { version, drift };
+}
+
+function syncReleaseVersion(rootDir, options) {
+  const version = packageVersion(rootDir);
+  const changed = [];
+  for (const target of releaseVersionTargets(rootDir, version, options)) {
+    const before = fs.readFileSync(target.path, 'utf8');
+    const value = JSON.parse(before);
+    target.update(value);
+    const after = `${JSON.stringify(value, null, 2)}\n`;
+    if (before.replace(/\r\n/g, '\n') === after) continue;
+    writeJson(target.path, value);
+    changed.push(target.file);
+  }
+  return { version, changed };
+}
+
+function stageReleaseVersionFiles(rootDir, files) {
+  if (!files.length) return;
+  const result = spawnSync('git', ['-C', rootDir, 'add', '--', ...files], {
+    encoding: 'utf8',
+    windowsHide: true,
+  });
+  if (result.status !== 0) {
+    throw new Error(`failed to stage synchronized release files: ${(result.stderr || result.stdout || '').trim()}`);
+  }
+}
+
+function parseArgs(argv) {
+  let rootDir = path.resolve(__dirname, '..', '..');
+  let check = false;
+  let tag = null;
+  let stage = false;
+  let webOnly = false;
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === '--check') check = true;
+    else if (arg === '--stage') stage = true;
+    else if (arg === '--web-only') webOnly = true;
+    else if (arg === '--root') rootDir = path.resolve(argv[++index] || '');
+    else if (arg === '--tag') tag = String(argv[++index] || '').trim();
+    else throw new Error(`Unknown argument: ${arg}`);
+  }
+  return { rootDir, check, tag, stage, webOnly };
+}
+
+function main(argv = process.argv.slice(2)) {
+  const { rootDir, check, tag, stage, webOnly } = parseArgs(argv);
+  if (check) {
+    const result = inspectReleaseVersion(rootDir, { webOnly });
+    if (result.drift.length) {
+      throw new Error(`Release version ${result.version} is out of sync: ${result.drift.join(', ')}`);
+    }
+    if (tag && tag !== `v${result.version}`) {
+      throw new Error(`Release tag ${tag} must match package version v${result.version}`);
+    }
+    console.log(`release version ${result.version} is synchronized`);
+    return result;
+  }
+  const result = syncReleaseVersion(rootDir, { webOnly });
+  if (stage) stageReleaseVersionFiles(rootDir, result.changed);
+  console.log(result.changed.length
+    ? `${stage ? 'synchronized and staged' : 'synchronized'} release version ${result.version}: ${result.changed.join(', ')}`
+    : `release version ${result.version} is already synchronized`);
+  return result;
+}
+
+if (require.main === module) {
+  try {
+    main();
+  } catch (error) {
+    console.error(`release version synchronization failed: ${error.message}`);
+    process.exitCode = 1;
+  }
+}
+
+module.exports = { inspectReleaseVersion, main, releaseVersionTargets, stageReleaseVersionFiles, syncReleaseVersion };

package/_site/scripts/vendor-modules.js

@@ -1,49 +1,49 @@
-'use strict';
-const fs = require('fs');
-const path = require('path');
-const crypto = require('crypto');
-const { execFileSync } = require('node:child_process');
-const AtomicFile = require('../lib/atomic-file');
-
-const root = path.resolve(__dirname, '../..');
-const destination = path.join(root, '_modules', 'knowledge-engine');
-const manifestFile = path.join(root, 'vendor-manifest.json');
-const hash = bytes => crypto.createHash('sha256').update(bytes).digest('hex');
-function sources(source) {
-  const files = ['package.json', 'README.md', 'ui/index.html', 'ui/app.js', 'ui/app.css'];
-  function walk(directory) {
-    for (const entry of fs.readdirSync(path.join(source, directory), { withFileTypes: true })) {
-      if (entry.isSymbolicLink()) throw new Error('Symlinks are not accepted in a vendored runtime');
-      const relative = `${directory}/${entry.name}`;
-      if (entry.isDirectory()) walk(relative); else if (entry.isFile()) files.push(relative);
-    }
-  }
-  walk('src'); return files.sort();
-}
-function vendor(source) {
-  source = path.resolve(source);
-  const pkg = JSON.parse(fs.readFileSync(path.join(source, 'package.json')));
-  if (pkg.name !== '@sanqianx/ai-coding-knowledge-engine' || Object.keys(pkg.dependencies || {}).length || Object.keys(pkg.devDependencies || {}).length) throw new Error('The engine must remain a dependency-free runtime');
-  const previous = fs.existsSync(manifestFile) ? JSON.parse(fs.readFileSync(manifestFile)) : { schema: 'project-knowledge/vendor-runtime/v1', modules: {} };
-  const priorFiles = previous.modules['knowledge-engine']?.files || {};
-  const files = {};
-  for (const relative of sources(source)) {
-    const sourceFile = path.join(source, relative), target = path.join(destination, relative);
-    if (fs.lstatSync(sourceFile).isSymbolicLink() || fs.existsSync(target) && fs.lstatSync(target).isSymbolicLink()) throw new Error('Unsafe runtime path');
-    const bytes = fs.readFileSync(sourceFile), digest = hash(bytes);
-    if (fs.existsSync(target)) {
-      const current = hash(fs.readFileSync(target));
-      if (current !== digest && current !== priorFiles[relative]) throw new Error(`Preserving unrecognized local runtime change: ${relative}`);
-    }
-    AtomicFile.writeFileAtomic(target, bytes); files[relative] = digest;
-  }
-  // No broad cleanup: obsolete files remain visible to the verifier until an
-  // explicit reviewed cleanup. Untracked/user changes are never overwritten.
-  previous.modules['knowledge-engine'] = { name: pkg.name, version: pkg.version, root: '_modules/knowledge-engine', files };
-  if (fs.existsSync(path.join(source, '.git'))) previous.modules['knowledge-engine'].sourceCommit = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: source, encoding: 'utf8', windowsHide: true }).trim();
-  AtomicFile.writeJsonAtomic(manifestFile, previous);
-  process.stdout.write(`Vendored knowledge-engine ${pkg.version}: ${Object.keys(files).length} runtime files\n`);
-}
-const option = process.argv.indexOf('--engine-source');
-if (option < 0 || !process.argv[option + 1]) { process.stderr.write('Usage: vendor-modules --engine-source <explicit checkout path>\n'); process.exitCode = 1; }
-else vendor(process.argv[option + 1]);
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const { execFileSync } = require('node:child_process');
+const AtomicFile = require('../lib/atomic-file');
+
+const root = path.resolve(__dirname, '../..');
+const destination = path.join(root, '_modules', 'knowledge-engine');
+const manifestFile = path.join(root, 'vendor-manifest.json');
+const hash = bytes => crypto.createHash('sha256').update(bytes).digest('hex');
+function sources(source) {
+  const files = ['package.json', 'README.md', 'ui/index.html', 'ui/app.js', 'ui/app.css'];
+  function walk(directory) {
+    for (const entry of fs.readdirSync(path.join(source, directory), { withFileTypes: true })) {
+      if (entry.isSymbolicLink()) throw new Error('Symlinks are not accepted in a vendored runtime');
+      const relative = `${directory}/${entry.name}`;
+      if (entry.isDirectory()) walk(relative); else if (entry.isFile()) files.push(relative);
+    }
+  }
+  walk('src'); return files.sort();
+}
+function vendor(source) {
+  source = path.resolve(source);
+  const pkg = JSON.parse(fs.readFileSync(path.join(source, 'package.json')));
+  if (pkg.name !== '@sanqianx/ai-coding-knowledge-engine' || Object.keys(pkg.dependencies || {}).length || Object.keys(pkg.devDependencies || {}).length) throw new Error('The engine must remain a dependency-free runtime');
+  const previous = fs.existsSync(manifestFile) ? JSON.parse(fs.readFileSync(manifestFile)) : { schema: 'project-knowledge/vendor-runtime/v1', modules: {} };
+  const priorFiles = previous.modules['knowledge-engine']?.files || {};
+  const files = {};
+  for (const relative of sources(source)) {
+    const sourceFile = path.join(source, relative), target = path.join(destination, relative);
+    if (fs.lstatSync(sourceFile).isSymbolicLink() || fs.existsSync(target) && fs.lstatSync(target).isSymbolicLink()) throw new Error('Unsafe runtime path');
+    const bytes = fs.readFileSync(sourceFile), digest = hash(bytes);
+    if (fs.existsSync(target)) {
+      const current = hash(fs.readFileSync(target));
+      if (current !== digest && current !== priorFiles[relative]) throw new Error(`Preserving unrecognized local runtime change: ${relative}`);
+    }
+    AtomicFile.writeFileAtomic(target, bytes); files[relative] = digest;
+  }
+  // No broad cleanup: obsolete files remain visible to the verifier until an
+  // explicit reviewed cleanup. Untracked/user changes are never overwritten.
+  previous.modules['knowledge-engine'] = { name: pkg.name, version: pkg.version, root: '_modules/knowledge-engine', files };
+  if (fs.existsSync(path.join(source, '.git'))) previous.modules['knowledge-engine'].sourceCommit = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: source, encoding: 'utf8', windowsHide: true }).trim();
+  AtomicFile.writeJsonAtomic(manifestFile, previous);
+  process.stdout.write(`Vendored knowledge-engine ${pkg.version}: ${Object.keys(files).length} runtime files\n`);
+}
+const option = process.argv.indexOf('--engine-source');
+if (option < 0 || !process.argv[option + 1]) { process.stderr.write('Usage: vendor-modules --engine-source <explicit checkout path>\n'); process.exitCode = 1; }
+else vendor(process.argv[option + 1]);

package/_site/scripts/verify-module-runtime.js

@@ -1,50 +1,50 @@
-'use strict';
-const fs = require('fs');
-const path = require('path');
-const crypto = require('crypto');
-const { spawnSync } = require('child_process');
-const root = path.resolve(__dirname, '../..');
-const workingTree = process.argv.includes('--working-tree');
-function isPinnedModuleVersion(name, value) {
-  const version = name === 'claude-ai-workbench' ? String(value || '').replace(/^npm:@sanqianx\/claude-ai-workbench@/, '') : value;
-  return /^\d+\.\d+\.\d+(?:-rc\.\d+)?$/.test(version || '');
-}
-function verify() {
-  const manifest = JSON.parse(fs.readFileSync(path.join(root, 'vendor-manifest.json'), 'utf8'));
-  if (manifest.schema !== 'project-knowledge/vendor-runtime/v1') throw new Error('Invalid runtime manifest');
-  const engine = manifest.modules['knowledge-engine'];
-  if (!engine || engine.root !== '_modules/knowledge-engine') throw new Error('Missing engine runtime');
-  const packageInfo = JSON.parse(fs.readFileSync(path.join(root, 'package.json')));
-  for (const dependency of ['claude-ai-workbench', '@sanqianx/vector-hub', '@sanqianx/ai-coding-event-bridge-console']) {
-    if (!isPinnedModuleVersion(dependency, packageInfo.dependencies[dependency])) throw new Error(`Module dependency must be pinned: ${dependency}`);
-  }
-  const required = ['package.json', 'src/bin.js', 'src/server.js', 'src/coordinator.js', 'src/analysis-worker.js', 'ui/index.html', 'ui/app.js', 'ui/app.css'];
-  if (required.some(file => !engine.files[file])) throw new Error('Incomplete runtime manifest');
-  const hasGit = fs.existsSync(path.join(root, '.git'));
-  function checkTree(directory, prefix = '') {
-    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
-      const relative = prefix + entry.name;
-      if (entry.isSymbolicLink()) throw new Error(`Unsafe runtime path: ${relative}`);
-      if (entry.isDirectory()) checkTree(path.join(directory, entry.name), relative + '/');
-      else if (!Object.hasOwn(engine.files, relative)) throw new Error(`Unreviewed runtime file: ${relative}`);
-    }
-  }
-  checkTree(path.join(root, engine.root));
-  for (const [relative, expected] of Object.entries(engine.files)) {
-    if (relative.includes('..') || path.isAbsolute(relative)) throw new Error('Unsafe manifest path');
-    const file = path.join(root, engine.root, relative);
-    if (fs.lstatSync(file).isSymbolicLink()) throw new Error('Unsafe vendored symlink');
-    if (crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex') !== expected) throw new Error(`Runtime drift: ${relative}`);
-    if (relative.endsWith('.js')) { const syntax = spawnSync(process.execPath, ['--check', file], { windowsHide: true, encoding: 'utf8' }); if (syntax.status !== 0) throw new Error(`Runtime syntax error: ${relative}`); }
-    if (hasGit && !workingTree) {
-      const indexed = spawnSync('git', ['show', `:${engine.root}/${relative}`], { cwd: root, windowsHide: true });
-      if (indexed.status !== 0) throw new Error(`Release blocked: runtime file is not Git tracked: ${relative}`);
-      if (crypto.createHash('sha256').update(indexed.stdout).digest('hex') !== expected) throw new Error(`Release blocked: Git runtime bytes differ from manifest: ${relative}`);
-    }
-  }
-  const enginePackage = JSON.parse(fs.readFileSync(path.join(root, engine.root, 'package.json')));
-  if (enginePackage.version !== engine.version || Object.keys(enginePackage.dependencies || {}).length || Object.keys(enginePackage.devDependencies || {}).length) throw new Error('Engine version/dependency contract failed');
-  process.stdout.write(workingTree ? 'Runtime content verified; uncommitted working tree is not release approval.\n' : 'Vendored runtime release gate passed.\n');
-}
-if (require.main === module) { try { verify(); } catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 1; } }
-module.exports = { isPinnedModuleVersion };
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const { spawnSync } = require('child_process');
+const root = path.resolve(__dirname, '../..');
+const workingTree = process.argv.includes('--working-tree');
+function isPinnedModuleVersion(name, value) {
+  const version = name === 'claude-ai-workbench' ? String(value || '').replace(/^npm:@sanqianx\/claude-ai-workbench@/, '') : value;
+  return /^\d+\.\d+\.\d+(?:-rc\.\d+)?$/.test(version || '');
+}
+function verify() {
+  const manifest = JSON.parse(fs.readFileSync(path.join(root, 'vendor-manifest.json'), 'utf8'));
+  if (manifest.schema !== 'project-knowledge/vendor-runtime/v1') throw new Error('Invalid runtime manifest');
+  const engine = manifest.modules['knowledge-engine'];
+  if (!engine || engine.root !== '_modules/knowledge-engine') throw new Error('Missing engine runtime');
+  const packageInfo = JSON.parse(fs.readFileSync(path.join(root, 'package.json')));
+  for (const dependency of ['claude-ai-workbench', '@sanqianx/vector-hub', '@sanqianx/ai-coding-event-bridge-console']) {
+    if (!isPinnedModuleVersion(dependency, packageInfo.dependencies[dependency])) throw new Error(`Module dependency must be pinned: ${dependency}`);
+  }
+  const required = ['package.json', 'src/bin.js', 'src/server.js', 'src/coordinator.js', 'src/analysis-worker.js', 'ui/index.html', 'ui/app.js', 'ui/app.css'];
+  if (required.some(file => !engine.files[file])) throw new Error('Incomplete runtime manifest');
+  const hasGit = fs.existsSync(path.join(root, '.git'));
+  function checkTree(directory, prefix = '') {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const relative = prefix + entry.name;
+      if (entry.isSymbolicLink()) throw new Error(`Unsafe runtime path: ${relative}`);
+      if (entry.isDirectory()) checkTree(path.join(directory, entry.name), relative + '/');
+      else if (!Object.hasOwn(engine.files, relative)) throw new Error(`Unreviewed runtime file: ${relative}`);
+    }
+  }
+  checkTree(path.join(root, engine.root));
+  for (const [relative, expected] of Object.entries(engine.files)) {
+    if (relative.includes('..') || path.isAbsolute(relative)) throw new Error('Unsafe manifest path');
+    const file = path.join(root, engine.root, relative);
+    if (fs.lstatSync(file).isSymbolicLink()) throw new Error('Unsafe vendored symlink');
+    if (crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex') !== expected) throw new Error(`Runtime drift: ${relative}`);
+    if (relative.endsWith('.js')) { const syntax = spawnSync(process.execPath, ['--check', file], { windowsHide: true, encoding: 'utf8' }); if (syntax.status !== 0) throw new Error(`Runtime syntax error: ${relative}`); }
+    if (hasGit && !workingTree) {
+      const indexed = spawnSync('git', ['show', `:${engine.root}/${relative}`], { cwd: root, windowsHide: true });
+      if (indexed.status !== 0) throw new Error(`Release blocked: runtime file is not Git tracked: ${relative}`);
+      if (crypto.createHash('sha256').update(indexed.stdout).digest('hex') !== expected) throw new Error(`Release blocked: Git runtime bytes differ from manifest: ${relative}`);
+    }
+  }
+  const enginePackage = JSON.parse(fs.readFileSync(path.join(root, engine.root, 'package.json')));
+  if (enginePackage.version !== engine.version || Object.keys(enginePackage.dependencies || {}).length || Object.keys(enginePackage.devDependencies || {}).length) throw new Error('Engine version/dependency contract failed');
+  process.stdout.write(workingTree ? 'Runtime content verified; uncommitted working tree is not release approval.\n' : 'Vendored runtime release gate passed.\n');
+}
+if (require.main === module) { try { verify(); } catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 1; } }
+module.exports = { isPinnedModuleVersion };

package/_site/scripts/verify-product-runtime.js

@@ -1,36 +1,36 @@
-'use strict';
-const fs = require('node:fs');
-const path = require('node:path');
-const crypto = require('node:crypto');
-const { createRequire } = require('node:module');
-const { safeRelative } = require('./pack-module-candidates');
-function verifyProductRuntime(coreRoot, resolveFrom = path.join(coreRoot, 'package.json')) {
-  const manifest = JSON.parse(fs.readFileSync(path.join(coreRoot, 'module-runtime-manifest.json')));
-  if (manifest.schema !== 'project-knowledge/module-content/v1' || Object.keys(manifest.modules).length !== 3) throw new Error('Incomplete module content manifest');
-  for (const file of ['ui/index.html', 'ui/product.js', 'ui/product.css', 'ui/favicon.svg', 'plugins/project-knowledge/hooks/claude.json', 'plugins/project-knowledge/hooks/codex.json', 'plugins/project-knowledge/scripts/context-hook.cjs', 'plugins/project-knowledge/scripts/mcp-launcher.cjs', 'plugins/project-knowledge/.claude-plugin/plugin.json', 'plugins/project-knowledge/.codex-plugin/plugin.json', 'plugins/project-knowledge/.mcp.json']) if (!manifest.productFiles?.[file]) throw new Error(`Product asset missing from content manifest: ${file}`);
-  const resolve = createRequire(resolveFrom);
-  if (!manifest.productFiles['ui/live-client.js']) throw new Error('Product live transport missing from content manifest');
-  for (const [relative, expected] of Object.entries(manifest.productFiles || {})) {
-    if (!safeRelative(relative) || crypto.createHash('sha256').update(fs.readFileSync(path.join(coreRoot, relative))).digest('hex') !== expected) throw new Error(`Product UI content mismatch: ${relative}`);
-  }
-  const modules = {};
-  for (const [key, module] of Object.entries(manifest.modules)) {
-    const pkgFile = resolve.resolve(`${module.installName}/package.json`);
-    const directory = path.dirname(pkgFile);
-    const pkg = JSON.parse(fs.readFileSync(pkgFile));
-    if (pkg.name !== module.name || pkg.version !== module.version) throw new Error(`Module version mismatch: ${key}`);
-    for (const [relative, expected] of Object.entries(module.files)) {
-      if (!safeRelative(relative) || !/^[a-f0-9]{64}$/.test(expected)) throw new Error('Unsafe module content manifest');
-      const file = path.join(directory, relative);
-      if (fs.lstatSync(file).isSymbolicLink() || crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex') !== expected) throw new Error(`Module content mismatch: ${key}/${relative}. Install the tested candidate before packaging.`);
-    }
-    modules[key] = { directory, version: pkg.version };
-  }
-  for (const file of ['ui/index.html', 'ui/product.js', 'ui/product.css', '_modules/knowledge-engine/src/bin.js', '_modules/knowledge-engine/src/coordinator.js']) if (!fs.existsSync(path.join(coreRoot, file))) throw new Error(`Product runtime missing: ${file}`);
-  return modules;
-}
-if (require.main === module) {
-  try { verifyProductRuntime(path.resolve(process.argv[2] || path.join(__dirname, '../..'))); process.stdout.write('All product module versions and contents verified.\n'); }
-  catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 1; }
-}
-module.exports = { verifyProductRuntime };
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { createRequire } = require('node:module');
+const { safeRelative } = require('./pack-module-candidates');
+function verifyProductRuntime(coreRoot, resolveFrom = path.join(coreRoot, 'package.json')) {
+  const manifest = JSON.parse(fs.readFileSync(path.join(coreRoot, 'module-runtime-manifest.json')));
+  if (manifest.schema !== 'project-knowledge/module-content/v1' || Object.keys(manifest.modules).length !== 3) throw new Error('Incomplete module content manifest');
+  for (const file of ['ui/index.html', 'ui/knowledge-panel.html', 'ui/product.js', 'ui/product.css', 'ui/favicon.svg', 'plugins/project-knowledge/hooks/claude.json', 'plugins/project-knowledge/hooks/codex.json', 'plugins/project-knowledge/scripts/context-hook.cjs', 'plugins/project-knowledge/scripts/mcp-launcher.cjs', 'plugins/project-knowledge/.claude-plugin/plugin.json', 'plugins/project-knowledge/.codex-plugin/plugin.json', 'plugins/project-knowledge/.mcp.json']) if (!manifest.productFiles?.[file]) throw new Error(`Product asset missing from content manifest: ${file}`);
+  const resolve = createRequire(resolveFrom);
+  if (!manifest.productFiles['ui/live-client.js']) throw new Error('Product live transport missing from content manifest');
+  for (const [relative, expected] of Object.entries(manifest.productFiles || {})) {
+    if (!safeRelative(relative) || crypto.createHash('sha256').update(fs.readFileSync(path.join(coreRoot, relative))).digest('hex') !== expected) throw new Error(`Product UI content mismatch: ${relative}`);
+  }
+  const modules = {};
+  for (const [key, module] of Object.entries(manifest.modules)) {
+    const pkgFile = resolve.resolve(`${module.installName}/package.json`);
+    const directory = path.dirname(pkgFile);
+    const pkg = JSON.parse(fs.readFileSync(pkgFile));
+    if (pkg.name !== module.name || pkg.version !== module.version) throw new Error(`Module version mismatch: ${key}`);
+    for (const [relative, expected] of Object.entries(module.files)) {
+      if (!safeRelative(relative) || !/^[a-f0-9]{64}$/.test(expected)) throw new Error('Unsafe module content manifest');
+      const file = path.join(directory, relative);
+      if (fs.lstatSync(file).isSymbolicLink() || crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex') !== expected) throw new Error(`Module content mismatch: ${key}/${relative}. Install the tested candidate before packaging.`);
+    }
+    modules[key] = { directory, version: pkg.version };
+  }
+  for (const file of ['ui/index.html', 'ui/knowledge-panel.html', 'ui/product.js', 'ui/product.css', '_modules/knowledge-engine/src/bin.js', '_modules/knowledge-engine/src/coordinator.js']) if (!fs.existsSync(path.join(coreRoot, file))) throw new Error(`Product runtime missing: ${file}`);
+  return modules;
+}
+if (require.main === module) {
+  try { verifyProductRuntime(path.resolve(process.argv[2] || path.join(__dirname, '../..'))); process.stdout.write('All product module versions and contents verified.\n'); }
+  catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 1; }
+}
+module.exports = { verifyProductRuntime };