@sanqianx/project-knowledge 5.0.20-rc.1 → 5.0.21

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "project-knowledge",
-      "version": "5.0.20-rc.1",
+      "version": "5.0.21",
       "source": "./plugins/project-knowledge",
       "description": "Search durable project decisions and implementation history through MCP."
     }

package/CHANGELOG.md

@@ -1,6 +1,11 @@
 # Changelog
 
-## [Unreleased]
+## [5.0.21] - 2026-10-20
+
+- 开始工作采用并排工作区：从加号新建子代理或按需添加知识引用，使用统一的对话、工具步骤、文件修改和输入框；移除面向客户的任务标识、派发阶段及诊断信息。
+- 子代理首次发送时继承当前项目、Agent、模型及主对话的冻结上下文，之后独立交流；原生任务可从主对话打开，并基于结果继续创建子对话。
+- 知识引用仅保留会话内单一标签，检索不自动展开、不抢焦点；修复刷新时内容提前投递的问题，并跟随产品深浅主题。
+- 主子草稿、标签和阅读位置可恢复；关闭标签不停止任务，窄窗口自动使用抽屉。精确锁定 Workbench 0.13.3。
 
 - 默认维护模型明确报告额度不足时，保留并展示可重试的失败原因；请求限流、认证失败分别展示。同项目后续提交等待前一条恢复，失败及排队记录跨重启保留。
 - 事件消费在分析任务建单前受阻时，活动页与系统状态展示故障，不再只显示空记录；故障及恢复通过现有实时连接更新，稳定状态不触发额外数据轮询。

package/_site/_test/agent-capture-mcp-ui-test.js

@@ -58,10 +58,11 @@ async function main() {
     assert.equal(browser.exceptions.length, 0, JSON.stringify(browser.exceptions));
     console.log('agent-capture-mcp-ui-test PASS (MCP line rendered separately; hostile detail escaped; no XSS execution)');
   } finally {
+    runtime.integrationStatusScan?.close();
     await browser?.close(); server.closeAllConnections(); await new Promise(resolve => server.close(resolve));
     offline.closeAllConnections(); await new Promise(resolve => offline.close(resolve)); await runtime.logger.close();
     assert.equal(path.dirname(temp), path.resolve(os.tmpdir())); assert.ok(path.basename(temp).startsWith('kb-agent-mcp-ui-'));
-    fs.rmSync(temp, { recursive: true, force: true, maxRetries: 12, retryDelay: 200 });
+    await fs.promises.rm(temp, { recursive: true, force: true, maxRetries: 12, retryDelay: 200 });
   }
 }
 main().catch(error => { console.error(error.stack); process.exitCode = 1; });

package/_site/_test/agent-capture-ui-test.js

@@ -91,10 +91,11 @@ async function main() {
     assert.equal(browser.exceptions.length, 0, JSON.stringify(browser.exceptions));
     console.log(`agent-capture-ui-test PASS (1920x1080; single-switch install/repair/Hook/journal/error logs/intent/removal/light+dark; core=${coreRoot})`);
   } finally {
+    runtime.integrationStatusScan?.close();
     await browser?.close(); server.closeAllConnections(); await new Promise(resolve => server.close(resolve));
     offline.closeAllConnections(); await new Promise(resolve => offline.close(resolve)); await runtime.logger.close();
     assert.equal(path.dirname(temp), path.resolve(os.tmpdir())); assert.ok(path.basename(temp).startsWith('kb-agent-capture-ui-'));
-    fs.rmSync(temp, { recursive: true, force: true, maxRetries: 12, retryDelay: 200 });
+    await fs.promises.rm(temp, { recursive: true, force: true, maxRetries: 12, retryDelay: 200 });
   }
 }
 main().catch(error => { console.error(error.stack); process.exitCode = 1; });

package/_site/_test/knowledge-panel-lifecycle-test.js

@@ -0,0 +1,154 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+const source = fs.readFileSync(path.join(__dirname, '../../ui/product.js'), 'utf8');
+const lifecycle = source.slice(source.indexOf('  function knowledgePanelFailed('), source.indexOf('  function panelRequest('))
+  + source.slice(source.indexOf('  async function resetKnowledgePanel('), source.indexOf('  function setView('));
+const settle = async () => { for (let i = 0; i < 5; i++) await new Promise(resolve => setImmediate(resolve)); };
+function harness(options = {}) {
+  const calls = [], notices = [], timers = new Map();
+  const panel = { providerId: 'knowledge', registered: true, registering: false, failed: false, error: null, panelId: '', version: 0, pending: null, sending: null, queued: false, deliveredPanelId: '' };
+  const state = { projectId: 'project-a', epoch: 0 };
+  let serial = 0, context;
+  const deliver = (id, content = null, error = null) => context.handlePanelState({ panels: id ? [{ providerId: 'knowledge', panelId: id, content, error }] : [] });
+  context = vm.createContext({
+    knowledgePanel: panel, state, frames: { terminal: { ready: true } },
+    knowledgePayload: id => ({ projectId: id, references: [{ title: state.reference || id + '-fact' }] }),
+    toast: text => notices.push(text),
+    setTimeout(fn) { timers.set(++serial, fn); return serial; }, clearTimeout: id => timers.delete(id),
+    panelRequest: async (type, payload) => {
+      calls.push({ type, payload });
+      if (options.request) {
+        const response = options.request(type, payload, { deliver, panel, state });
+        if (response !== undefined) return response;
+      }
+      if (type === 'kb:panel/register') return { ok: true };
+      if (type === 'kb:panel/content') {
+        deliver(payload.panelId, { ack: { version: payload.version, ok: true } });
+        return { ok: true };
+      }
+      throw new Error('Knowledge delivery cannot open, activate or unregister a view: ' + type);
+    },
+  });
+  vm.runInContext(lifecycle, context);
+  const show = async id => { deliver(id); await settle(); };
+  return { context, panel, state, calls, notices, timers, deliver, show };
+}
+
+test('startup registration and cached updates never create a knowledge tab', async () => {
+  const h = harness();
+  await h.context.resetKnowledgePanel();
+  assert.equal(h.panel.registered, true);
+  assert.equal(h.panel.panelId, '');
+  await h.context.pushKnowledgeToPanel();
+  h.state.projectId = 'project-b'; h.state.epoch++;
+  await h.context.pushKnowledgeToPanel();
+  assert.deepEqual(h.calls.map(call => call.type), ['kb:panel/register']);
+  assert.equal(h.timers.size, 0);
+});
+
+test('user-added tabs receive content and fast acknowledgements without opening another view', async () => {
+  const h = harness();
+  await h.show('tab-1');
+  assert.equal(h.panel.pending, null);
+  assert.equal(h.panel.deliveredPanelId, 'tab-1');
+  assert.equal(h.timers.size, 0);
+  assert.deepEqual(h.calls.map(call => call.type), ['kb:panel/content']);
+});
+
+test('closing keeps cached updates invisible until the user adds the page again', async () => {
+  const h = harness();
+  await h.show('tab-1');
+  h.deliver(null);
+  h.state.reference = 'updated while closed';
+  await h.context.pushKnowledgeToPanel();
+  assert.equal(h.panel.panelId, '');
+  assert.equal(h.calls.length, 1, 'closing or receiving knowledge must not create another view');
+  await h.show('tab-2');
+  assert.equal(h.calls.length, 2);
+  assert.equal(h.calls[1].payload.panelId, 'tab-2');
+  assert.equal(h.calls[1].payload.content.references[0].title, 'updated while closed');
+  assert.equal(h.panel.deliveredPanelId, 'tab-2');
+  h.deliver('tab-2', { ack: { version: h.panel.version, ok: true } });
+  await settle();
+  assert.equal(h.calls.length, 2, 'focus and repeated receipts cannot create a delivery loop');
+});
+
+test('errors never create an outside fallback and a newly added page can retry', async () => {
+  let first = true;
+  const h = harness({ request(type) {
+    if (type === 'kb:panel/content' && first) { first = false; return { ok: false }; }
+  } });
+  await h.show('tab-1');
+  assert.equal(h.panel.failed, true);
+  assert.equal(h.panel.registered, true, 'the page remains available in the dock selector');
+  assert.match(h.notices.join(' '), /关闭引用标签/);
+  assert.deepEqual(h.calls.map(call => call.type), ['kb:panel/content']);
+  h.deliver(null);
+  await h.show('tab-2');
+  assert.equal(h.panel.failed, false);
+  assert.equal(h.panel.deliveredPanelId, 'tab-2');
+});
+
+test('closing during a content transfer makes late replies inert', async () => {
+  let reply;
+  const h = harness({ request(type) {
+    if (type === 'kb:panel/content') return new Promise(resolve => { reply = resolve; });
+  } });
+  await h.show('tab-1');
+  h.deliver(null);
+  reply({ ok: true });
+  await settle();
+  assert.equal(h.panel.panelId, '');
+  assert.equal(h.panel.pending, null);
+  assert.equal(h.timers.size, 0);
+  assert.equal(h.calls.length, 1);
+});
+
+test('an older failed acknowledgement cannot close the current reference view', async () => {
+  const h = harness({ request(type) { if (type === 'kb:panel/content') return { ok: true }; } });
+  await h.show('tab-1');
+  await h.context.pushKnowledgeToPanel();
+  const version = h.panel.pending.version;
+  h.deliver('tab-1', { ack: { version: version - 1, ok: false } }, 'CONTENT_ACK_ERROR');
+  await settle();
+  assert.equal(h.panel.pending.version, version);
+  assert.equal(h.panel.failed, false);
+  assert.equal(h.calls.length, 2);
+  h.deliver('tab-1', { ack: { version, ok: true } });
+  assert.equal(h.panel.deliveredPanelId, 'tab-1');
+});
+
+test('a queued project switch sends only the latest scope and rejects a stale acknowledgement', async () => {
+  let oldReply;
+  const h = harness({ request(type, payload) {
+    if (type === 'kb:panel/content' && payload.content.projectId === 'project-a') return new Promise(resolve => { oldReply = resolve; });
+  } });
+  await h.show('tab-1');
+  h.state.projectId = 'project-b'; h.state.epoch++;
+  await h.context.pushKnowledgeToPanel();
+  h.deliver('tab-1', { ack: { version: 1, ok: true } });
+  assert.equal(h.panel.deliveredPanelId, '');
+  oldReply({ ok: true });
+  await settle();
+  assert.deepEqual(h.calls.map(call => call.payload.content.projectId), ['project-a', 'project-b']);
+  assert.equal(h.panel.deliveredPanelId, 'tab-1');
+  assert.equal(h.panel.pending, null);
+});
+
+test('restored inactive reference tabs wait for their page to load before content delivery', async () => {
+  const h = harness();
+  await h.context.resetKnowledgePanel();
+  h.context.handlePanelState({ panels: [{ providerId: 'knowledge', panelId: 'restored', ready: false }] });
+  await h.context.pushKnowledgeToPanel(); await settle();
+  assert.deepEqual(h.calls.map(call => call.type), ['kb:panel/register']);
+  assert.equal(h.panel.failed, false);
+  assert.equal(h.timers.size, 0);
+  h.context.handlePanelState({ panels: [{ providerId: 'knowledge', panelId: 'restored', ready: true }] });
+  await settle();
+  assert.deepEqual(h.calls.map(call => call.type), ['kb:panel/register', 'kb:panel/content']);
+  assert.equal(h.panel.deliveredPanelId, 'restored');
+});

package/_site/_test/knowledge-panel-ui-contract-test.js

@@ -1,112 +1,110 @@
-'use strict';
-// K1 knowledge panel contract: the shell registers a same-origin provider with
-// the workbench, streams structured references, folds the fixed column only
-// after a version-matched panel ack, restores it on any failure, and the panel
-// page itself renders external strings through textContent only.
-const assert = require('node:assert/strict');
-const fs = require('node:fs');
-const path = require('node:path');
-const root = path.resolve(__dirname, '../..');
-const html = fs.readFileSync(path.join(root, 'ui/index.html'), 'utf8');
-const script = fs.readFileSync(path.join(root, 'ui/product.js'), 'utf8');
-const css = fs.readFileSync(path.join(root, 'ui/product.css'), 'utf8');
-const panelPath = path.join(root, 'ui/knowledge-panel.html');
-const panelHtml = fs.readFileSync(panelPath, 'utf8');
-
-/* ===================== panel page source contract ===================== */
-assert.ok(panelHtml.includes('KB-K1-KNOWLEDGE-PANEL-v1'), 'the panel page shows the stable marker');
-assert.ok(panelHtml.includes('event.source !== window.parent'), 'the panel only accepts its Workbench parent as the message source');
-assert.ok(panelHtml.includes("data.type !== 'kb:panel/content'"), 'kb:panel/content is the only inbound verb');
-assert.ok(panelHtml.includes("'kb:panel/content-ack'"), 'the panel answers with a content ack');
-assert.ok(!panelHtml.includes('innerHTML') && !panelHtml.includes('insertAdjacentHTML') && !panelHtml.includes('document.write'), 'no string becomes markup');
-assert.ok(!/<(?:script|link|img)[^>]+(?:src|href)=/.test(panelHtml.replace(/<script>[\s\S]*?<\/script>/, '')), 'the panel page loads no external resources');
-assert.ok(!panelHtml.includes('fetch(') && !panelHtml.includes('XMLHttpRequest'), 'the sandboxed panel never talks to APIs directly');
-const panelScriptMatch = panelHtml.match(/<script>([\s\S]*?)<\/script>/);
-assert.ok(panelScriptMatch, 'the panel page carries an inline script');
-assert.doesNotThrow(() => new Function(panelScriptMatch[1]));
-
-/* ===================== panel page behavior (minimal DOM) ===================== */
-function runPanelPage() {
-  const acks = [];
-  const node = () => ({ children: [], textContent: '', append(...items) { this.children.push(...items); }, replaceChildren() { this.children.length = 0; } });
-  const elements = { panelTitle: node(), panelProject: node(), panelStatus: node(), panelReferences: node(), panelMarker: node() };
-  let listener = null;
-  const parent = { postMessage(message) { acks.push(message); } };
-  const fakeWindow = { parent, addEventListener(type, fn) { if (type === 'message') listener = fn; } };
-  const fakeDocument = {
-    getElementById: id => elements[id] || null,
-    createElement: () => node(),
-  };
-  new Function('window', 'document', panelScriptMatch[1])(fakeWindow, fakeDocument);
-  assert.equal(typeof listener, 'function', 'the panel registers a message listener');
-  const deliver = (data, source = parent) => listener({ source, data });
-  return { acks, elements, deliver };
-}
-
-{
-  const page = runPanelPage();
-  page.deliver({ type: 'kb:panel/content', panelId: 'tab-1', version: 3, content: {
-    title: '本次知识引用', projectId: 'proj-a', status: 'ready',
-    references: [{ entryId: 'docs/a.md', title: 'T', text: '<img src=x onerror=alert(1)>', source: 'proj / docs/a.md' }],
-  } });
-  const ack = page.acks[page.acks.length - 1];
-  assert.equal(ack.type, 'kb:panel/content-ack');
-  assert.equal(ack.panelId, 'tab-1');
-  assert.equal(ack.version, 3);
-  assert.equal(ack.ok, true);
-  assert.equal(page.elements.panelTitle.textContent, '本次知识引用');
-  assert.equal(page.elements.panelProject.textContent, 'proj-a');
-  const reference = page.elements.panelReferences.children[0];
-  assert.ok(reference, 'one reference card rendered');
-  const text = reference.children.find(child => child.textContent.includes('<img'));
-  assert.ok(text, 'the reference body exists');
-  assert.equal(text.textContent, '<img src=x onerror=alert(1)>', 'markup-looking strings stay inert text');
-}
-{
-  const page = runPanelPage();
-  const stranger = { postMessage() {} };
-  page.deliver({ type: 'kb:panel/content', panelId: 'tab-1', version: 1, content: { title: 'x' } }, stranger);
-  assert.equal(page.acks.length, 0, 'a non-parent source is ignored without any ack');
-  page.deliver({ type: 'kb:panel/command', panelId: 'tab-1' });
-  assert.equal(page.acks.length, 0, 'non-content verbs are ignored');
-  page.deliver({ type: 'kb:panel/content', panelId: 'tab-1', version: 2, content: ['not', 'an', 'object'] });
-  const failure = page.acks[page.acks.length - 1];
-  assert.equal(failure.ok, false, 'illegal content is refused with an explicit receipt');
-  assert.ok(failure.error, 'the refusal carries an error message');
-}
-
-/* ===================== shell (product.js) contract ===================== */
-assert.ok(script.includes('kb.knowledge.references'), 'the provider id is stable');
-assert.match(script, /url: '\/knowledge-panel\.html'/, 'the provider URL is the KB-owned panel page');
-assert.match(script, /panelType: 'knowledge', title: '本次知识引用'/, 'panel type and title match the product');
-assert.match(script, /capabilities: \['read-only'\]/, 'the panel declares itself read-only');
-assert.match(script, /multiInstance: 'single'/, 'the provider is single-instance');
-assert.match(script, /if \(message\.type === 'kb:ready'\)[\s\S]*?if \(key === 'terminal'\) void resetKnowledgePanel\(\)/, 'registration starts from the terminal kb:ready');
-assert.ok(script.includes("'kb:panel/register'") && script.includes("'kb:panel/open'") && script.includes("'kb:panel/content'"), 'the shell uses the W3 verbs');
-assert.match(script, /if \(message\.type === 'kb:knowledge' && key === 'terminal'\)[\s\S]*?renderContext\(\); void pushKnowledgeToPanel/, 'kb:knowledge still refreshes the fixed column first, then streams the panel');
-assert.match(script, /const ack = panel\.content\?\.ack;[\s\S]*?if \(ack && String\(ack\.version\) === String\(pending\.version\)\)/, 'collapse waits for the version-matched ack');
-assert.match(script, /if \(ack\.ok && !panel\.error\) \{ setKnowledgeCollapsed\(true\)/, 'folding requires an error-free ack');
-assert.match(script, /if \(!panel\) \{[\s\S]*?if \(knowledgePanel\.collapsed\) setKnowledgeCollapsed\(false\);[\s\S]*?return;/, 'closing the dock panel unfolds the fixed column again');
-assert.match(script, /function knowledgePanelFailed\(reason\)[\s\S]*?setKnowledgeCollapsed\(false\);[\s\S]*?panelNotice\(/, 'every failure path restores the full column with a non-blocking notice');
-assert.match(script, /function selectProject\(id\)[\s\S]*?setKnowledgeCollapsed\(false\);[\s\S]*?pushKnowledgeToPanel\(id\)/, 'a project switch re-scopes the panel to the new project before folding again');
-assert.match(script, /renderProjectOptions\(\); setKnowledgeCollapsed\(false\); render\(\)/, 'unbinding a project also restores the fixed column');
-assert.match(script, /\.slice\(0, 50\)\.map\(r => \(\{/, 'the payload bounds the reference count');
-assert.match(script, /text: String\(r\.text \|\| ''\)\.slice\(0, 800\)/, 'the payload bounds reference text');
-assert.match(script, /knowledgePayload\(projectId\)[\s\S]*?entryId: String\(/, 'payload fields are coerced to plain strings');
-assert.equal((script.match(/classList\.toggle\('kb-panel-collapsed'/g) || []).length, 1, 'collapse is driven only through the work-layout class');
-assert.ok(!/data-action="collapse|toggle-context|折叠知识栏/.test(script + html), 'no duplicate column control button is introduced');
-assert.match(script, /panelRequest\('kb:panel\/content', \{ panelId: knowledgePanel\.panelId, providerId: knowledgePanel\.providerId, version, content: knowledgePayload\(projectId\) \}\)/, 'content carries panelId, providerId and version');
-assert.match(script, /message\.type\.startsWith\('kb:panel\/'\)/, 'panel replies are routed before the frame-context staleness drop');
-assert.match(script, /if \(message\.requestId && message\.requestId !== frames\[key\]\.requestId\) return;/, 'the legacy staleness drop stays intact for module traffic');
-assert.doesNotThrow(() => new Function(script));
-
-/* ===================== markup and css contract ===================== */
-assert.equal((html.match(/id="panelNotice"/g) || []).length, 1, 'exactly one non-blocking panel notice exists');
-assert.ok(html.includes('knowledge-context') && html.includes('id="contextContent"'), 'the fixed knowledge column markup is untouched');
-assert.ok(css.includes('.work-layout.kb-panel-collapsed{grid-template-columns:minmax(0,1fr) 0px}'), 'the fold animates the grid track instead of removing the column');
-assert.match(css, /\.work-layout\{[^}]*transition:grid-template-columns/, 'the fold is a smooth transition');
-assert.match(css, /@media \(prefers-reduced-motion: reduce\)\{\.work-layout,\.knowledge-context\{transition:none\}\}/, 'reduced-motion users get no animation');
-assert.ok(css.includes('.panel-notice'), 'the notice has styling');
-assert.match(css, /\.work-layout\{display:grid;grid-template-columns:minmax\(0,1fr\) 288px/, 'the default full-width column is unchanged');
-
-console.log('knowledge panel UI contract test PASS (source contract + sandboxed render behavior; not browser acceptance)');
+'use strict';
+// K1 knowledge panel contract: the shell registers a same-origin provider with
+// the workbench, streams structured references only to user-added tabs,
+// validates matching receipts, never renders an outside column, and the panel
+// page itself renders external strings through textContent only.
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const root = path.resolve(__dirname, '../..');
+const html = fs.readFileSync(path.join(root, 'ui/index.html'), 'utf8');
+const script = fs.readFileSync(path.join(root, 'ui/product.js'), 'utf8');
+const css = fs.readFileSync(path.join(root, 'ui/product.css'), 'utf8');
+const panelPath = path.join(root, 'ui/knowledge-panel.html');
+const panelHtml = fs.readFileSync(panelPath, 'utf8');
+
+/* ===================== panel page source contract ===================== */
+assert.ok(!panelHtml.includes('KB-K1-KNOWLEDGE-PANEL-v1'), 'test contract markers never enter customer markup');
+assert.ok(panelHtml.includes('event.source !== window.parent'), 'the panel only accepts its Workbench parent as the message source');
+assert.ok(panelHtml.includes("data.type !== 'kb:panel/content'"), 'kb:panel/content is the only inbound verb');
+assert.ok(panelHtml.includes("'kb:panel/content-ack'"), 'the panel answers with a content ack');
+assert.ok(!panelHtml.includes('innerHTML') && !panelHtml.includes('insertAdjacentHTML') && !panelHtml.includes('document.write'), 'no string becomes markup');
+assert.ok(!/<(?:script|link|img)[^>]+(?:src|href)=/.test(panelHtml.replace(/<script>[\s\S]*?<\/script>/, '')), 'the panel page loads no external resources');
+assert.ok(!panelHtml.includes('fetch(') && !panelHtml.includes('XMLHttpRequest'), 'the sandboxed panel never talks to APIs directly');
+const panelScriptMatch = panelHtml.match(/<script>([\s\S]*?)<\/script>/);
+assert.ok(panelScriptMatch, 'the panel page carries an inline script');
+assert.doesNotThrow(() => new Function(panelScriptMatch[1]));
+
+/* ===================== panel page behavior (minimal DOM) ===================== */
+function runPanelPage() {
+  const acks = [];
+  const node = () => ({ children: [], textContent: '', append(...items) { this.children.push(...items); }, replaceChildren() { this.children.length = 0; } });
+  const elements = { panelTitle: node(), panelProject: node(), panelStatus: node(), panelReferences: node(), panelMarker: node() };
+  let listener = null;
+  const parent = { postMessage(message) { acks.push(message); } };
+  const fakeWindow = { parent, addEventListener(type, fn) { if (type === 'message') listener = fn; } };
+  const fakeDocument = {
+    documentElement: { dataset: {} },
+    getElementById: id => elements[id] || null,
+    createElement: () => node(),
+  };
+  new Function('window', 'document', panelScriptMatch[1])(fakeWindow, fakeDocument);
+  assert.equal(typeof listener, 'function', 'the panel registers a message listener');
+  const deliver = (data, source = parent) => listener({ source, data });
+  return { acks, elements, deliver, document: fakeDocument };
+}
+
+{
+  const page = runPanelPage();
+  page.deliver({ type: 'kb:panel/content', panelId: 'tab-1', version: 3, content: {
+    title: '本次知识引用', projectId: 'proj-a', projectName: '项目 A', status: 'ready', theme: 'dark',
+    references: [{ entryId: 'docs/a.md', title: 'T', text: '<img src=x onerror=alert(1)>', source: 'proj / docs/a.md' }],
+  } });
+  const ack = page.acks[page.acks.length - 1];
+  assert.equal(ack.type, 'kb:panel/content-ack');
+  assert.equal(ack.panelId, 'tab-1');
+  assert.equal(ack.version, 3);
+  assert.equal(ack.ok, true);
+  assert.equal(page.elements.panelTitle.textContent, '本次知识引用');
+  assert.equal(page.elements.panelProject.textContent, '项目 A');
+  assert.equal(page.document.documentElement.dataset.theme, 'dark', 'the reference page follows the host theme');
+  const reference = page.elements.panelReferences.children[0];
+  assert.ok(reference, 'one reference card rendered');
+  assert.equal(reference.children.length, 3, 'reference cards show title, source and excerpt without a repeated internal entry identifier');
+  const text = reference.children.find(child => child.textContent.includes('<img'));
+  assert.ok(text, 'the reference body exists');
+  assert.equal(text.textContent, '<img src=x onerror=alert(1)>', 'markup-looking strings stay inert text');
+}
+{
+  const page = runPanelPage();
+  const stranger = { postMessage() {} };
+  page.deliver({ type: 'kb:panel/content', panelId: 'tab-1', version: 1, content: { title: 'x' } }, stranger);
+  assert.equal(page.acks.length, 0, 'a non-parent source is ignored without any ack');
+  page.deliver({ type: 'kb:panel/command', panelId: 'tab-1' });
+  assert.equal(page.acks.length, 0, 'non-content verbs are ignored');
+  page.deliver({ type: 'kb:panel/content', panelId: 'tab-1', version: 2, content: ['not', 'an', 'object'] });
+  const failure = page.acks[page.acks.length - 1];
+  assert.equal(failure.ok, false, 'illegal content is refused with an explicit receipt');
+  assert.ok(failure.error, 'the refusal carries an error message');
+}
+
+/* ===================== shell (product.js) contract ===================== */
+assert.ok(script.includes('kb.knowledge.references'), 'the provider id is stable');
+assert.match(script, /url: '\/knowledge-panel\.html'/, 'the provider URL is the KB-owned panel page');
+assert.match(script, /panelType: 'knowledge', title: '本次知识引用'/, 'panel type and title match the product');
+assert.match(script, /capabilities: \['read-only'\]/, 'the panel declares itself read-only');
+assert.match(script, /multiInstance: 'single'/, 'the provider is single-instance');
+assert.match(script, /if \(message\.type === 'kb:ready'\)[\s\S]*?if \(key === 'terminal'\) void resetKnowledgePanel\(\)/, 'registration starts from the terminal kb:ready');
+assert.ok(script.includes("'kb:panel/register'") && script.includes("'kb:panel/content'"), 'the host registers the page and supplies its content');
+assert.ok(!script.includes("'kb:panel/open'"), 'registration and retrieval cannot open a page');
+assert.match(script, /if \(message\.type === 'kb:knowledge' && key === 'terminal'\)[\s\S]*?state\.contexts\.set[\s\S]*?void pushKnowledgeToPanel/, 'retrieved knowledge stays cached and updates existing pages only');
+assert.match(script, /const ack = panel\.content\?\.ack;[\s\S]*?if \(ack && String\(ack\.version\) === String\(pending\.version\)\)/, 'receipts match the currently pending content');
+assert.match(script, /if \(ack\.ok && !panel\.error\) \{ knowledgePanel\.deliveredPanelId = panel\.panelId;/, 'delivery is confirmed only by an error-free acknowledgement');
+assert.match(script, /if \(!panel\) \{[\s\S]*?knowledgePanel\.panelId = '';[\s\S]*?return;/, 'closing a page cancels its delivery');
+assert.match(script, /if \(!knowledgePanel\.registered \|\| knowledgePanel\.failed \|\| !projectId \|\| !panelId\) return;/, 'closed pages cannot be opened by background updates');
+assert.ok(!/setKnowledgeCollapsed|panelNotice|contextContent|knowledge-context/.test(script), 'the old outside-column paths are removed');
+assert.match(script, /\.slice\(0, 50\)\.map\(r => \(\{/, 'the payload bounds the reference count');
+assert.match(script, /text: String\(r\.text \|\| ''\)\.slice\(0, 800\)/, 'the payload bounds reference text');
+assert.match(script, /knowledgePayload\(projectId\)[\s\S]*?entryId: String\(/, 'payload fields are coerced to plain strings');
+assert.ok(!/data-action="collapse|toggle-context|折叠知识栏/.test(script + html), 'no duplicate column control button is introduced');
+assert.match(script, /panelRequest\('kb:panel\/content', \{ panelId: knowledgePanel\.panelId, providerId: knowledgePanel\.providerId, version, content: knowledgePayload\(projectId\) \}\)/, 'content carries panelId, providerId and version');
+assert.match(script, /message\.type\.startsWith\('kb:panel\/'\)/, 'panel replies are routed before the frame-context staleness drop');
+assert.match(script, /if \(message\.requestId && message\.requestId !== frames\[key\]\.requestId\) return;/, 'the legacy staleness drop stays intact for module traffic');
+assert.doesNotThrow(() => new Function(script));
+
+/* ===================== markup and css contract ===================== */
+assert.ok(!/knowledge-context|contextContent|contextScope|panelNotice/.test(html), 'there is no outside knowledge column, including hidden markup');
+assert.ok(!/knowledge-context|kb-panel-collapsed|panel-notice/.test(css), 'no space or fallback layout is reserved for a second column');
+assert.match(css, /\.work-layout\{display:grid;grid-template-columns:minmax\(0,1fr\);/, 'the host gives the whole workspace to the conversation and its dock');
+
+console.log('knowledge panel UI contract test PASS (source contract + sandboxed render behavior; not browser acceptance)');

package/_site/_test/workspace-ui-contract-test.js

@@ -1,31 +1,31 @@
-'use strict';
-const assert = require('node:assert/strict');
-const fs = require('node:fs');
-const path = require('node:path');
-const root = path.resolve(__dirname, '../..');
-const html = fs.readFileSync(path.join(root, 'ui/index.html'), 'utf8');
-const script = fs.readFileSync(path.join(root, 'ui/product.js'), 'utf8');
-const css = fs.readFileSync(path.join(root, 'ui/product.css'), 'utf8');
-for (const view of ['home', 'work', 'search', 'memory', 'projects', 'activity']) {
-  assert.equal((html.match(new RegExp(`data-view="${view}"`, 'g')) || []).length, 1);
-  assert.ok(html.includes(`id="view-${view}"`));
-}
-assert.equal((html.match(/data-view=/g) || []).length, 6, 'diagnostics must not become another primary product');
-assert.match(html, /<select\b[^>]*id="projectSelect"[^>]*\bdisabled\b/, 'project selection is disabled until the initial registry snapshot has loaded');
-for (const id of ['workFrame', 'vectorFrame', 'bridgeFrame', 'engineFrame', 'importDialog', 'importCode', 'importKnowledge', 'importDomain', 'setupImportRoot', 'createDomain', 'logsDialog', 'systemDrawer', 'copyReference']) assert.equal((html.match(new RegExp(`id="${id}"`, 'g')) || []).length, 1);
-assert.ok(html.includes('data-action="import"') && html.includes('不分析全部历史'));
-assert.ok(!html.includes('srcdoc') && !/data-simulate|data-analyze|data-install-hook/.test(html));
-assert.equal((script.match(/\.src = /g) || []).length, 1, 'frames initialize once, not on project/theme/page changes');
-for (const contract of ['kb:theme', 'kb:select-project', 'kb:scope', 'kb:knowledge', 'kb:ready']) assert.ok(script.includes(contract));
-assert.ok(script.includes('event.origin !== location.origin') && script.includes('contentWindow === event.source'), 'module messages must be from the expected frame and origin');
-assert.ok(script.includes('state.epoch++') && script.includes('referenceEpoch') && script.includes('logEpoch'), 'late project/reference/log feedback must be isolated');
-assert.match(script, /on\('domainForm'[\s\S]*?await refreshRegistry\(true\)/, 'domain writes must invalidate pre-mutation reads');
-assert.match(script, /registered = true;[\s\S]*?await refreshRegistry\(true\)/, 'import must not reuse a pre-import snapshot');
-assert.ok(script.includes('esc(r.title)') && script.includes('esc(m.text)') && script.includes('esc(project.name)'));
-assert.ok(script.includes('text.textContent = record.message') && script.includes("'logs/appended'"), 'diagnostics stay inert and stream live');
-assert.ok(script.includes('URL.revokeObjectURL(url)') && script.includes('logStream?.close()'));
-assert.ok(script.includes('resumeImport = true') && script.includes("$('importDialog').showModal()") && script.includes("p.code === 'KNOWLEDGE_ROOT_MISSING'"), 'first import can return from setup without resetting its input');
-assert.ok(css.includes('height:100%') && css.includes('.view.module-view{padding:0;overflow:hidden}') && css.includes('overflow-wrap:anywhere'));
-assert.ok(css.includes('html[data-theme=dark]') && css.includes('prefers-reduced-motion'));
-assert.doesNotThrow(() => new Function(script));
-console.log('workspace UI contract test PASS (source contract; not browser acceptance)');
+'use strict';
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const root = path.resolve(__dirname, '../..');
+const html = fs.readFileSync(path.join(root, 'ui/index.html'), 'utf8');
+const script = fs.readFileSync(path.join(root, 'ui/product.js'), 'utf8');
+const css = fs.readFileSync(path.join(root, 'ui/product.css'), 'utf8');
+for (const view of ['home', 'work', 'search', 'memory', 'projects', 'activity']) {
+  assert.equal((html.match(new RegExp(`data-view="${view}"`, 'g')) || []).length, 1);
+  assert.ok(html.includes(`id="view-${view}"`));
+}
+assert.equal((html.match(/data-view=/g) || []).length, 6, 'diagnostics must not become another primary product');
+assert.match(html, /<select\b[^>]*id="projectSelect"[^>]*\bdisabled\b/, 'project selection is disabled until the initial registry snapshot has loaded');
+for (const id of ['workFrame', 'vectorFrame', 'bridgeFrame', 'engineFrame', 'importDialog', 'importCode', 'importKnowledge', 'importDomain', 'setupImportRoot', 'createDomain', 'logsDialog', 'systemDrawer', 'copyReference']) assert.equal((html.match(new RegExp(`id="${id}"`, 'g')) || []).length, 1);
+assert.ok(html.includes('data-action="import"') && html.includes('不分析全部历史'));
+assert.ok(!html.includes('srcdoc') && !/data-simulate|data-analyze|data-install-hook/.test(html));
+assert.equal((script.match(/\.src = /g) || []).length, 1, 'frames initialize once, not on project/theme/page changes');
+for (const contract of ['kb:theme', 'kb:select-project', 'kb:scope', 'kb:knowledge', 'kb:ready']) assert.ok(script.includes(contract));
+assert.ok(script.includes('event.origin !== location.origin') && script.includes('contentWindow === event.source'), 'module messages must be from the expected frame and origin');
+assert.ok(script.includes('state.epoch++') && script.includes('referenceEpoch') && script.includes('logEpoch'), 'late project/reference/log feedback must be isolated');
+assert.match(script, /on\('domainForm'[\s\S]*?await refreshRegistry\(true\)/, 'domain writes must invalidate pre-mutation reads');
+assert.match(script, /registered = true;[\s\S]*?await refreshRegistry\(true\)/, 'import must not reuse a pre-import snapshot');
+assert.ok(script.includes("title: String(r.title || r.entryId || '')") && script.includes('esc(m.text)') && script.includes('esc(project.name)'));
+assert.ok(script.includes('text.textContent = record.message') && script.includes("'logs/appended'"), 'diagnostics stay inert and stream live');
+assert.ok(script.includes('URL.revokeObjectURL(url)') && script.includes('logStream?.close()'));
+assert.ok(script.includes('resumeImport = true') && script.includes("$('importDialog').showModal()") && script.includes("p.code === 'KNOWLEDGE_ROOT_MISSING'"), 'first import can return from setup without resetting its input');
+assert.ok(css.includes('height:100%') && css.includes('.view.module-view{padding:0;overflow:hidden}') && css.includes('overflow-wrap:anywhere'));
+assert.ok(css.includes('html[data-theme=dark]') && css.includes('prefers-reduced-motion'));
+assert.doesNotThrow(() => new Function(script));
+console.log('workspace UI contract test PASS (source contract; not browser acceptance)');