@sanqianx/project-knowledge 5.0.23 → 5.0.25

package/_site/scripts/pack-module-candidates.js

@@ -1,89 +1,89 @@
-'use strict';
-const fs = require('node:fs');
-const path = require('node:path');
-const os = require('node:os');
-const crypto = require('node:crypto');
-const { spawnSync } = require('node:child_process');
-const AtomicFile = require('../lib/atomic-file');
-const hash = bytes => crypto.createHash('sha256').update(bytes).digest('hex');
-const root = path.resolve(__dirname, '../..');
-const npmCli = process.env.npm_execpath || path.join(path.dirname(process.execPath), 'node_modules/npm/bin/npm-cli.js');
-const definitions = {
-  terminal: { option: '--terminal-source', name: '@sanqianx/claude-ai-workbench', installName: 'claude-ai-workbench', required: ['apps/agent-terminal/app.js', 'apps/agent-terminal/app.css', 'packages/server/lib/knowledge-context.js'] },
-  vectorHub: { option: '--vector-source', name: '@sanqianx/vector-hub', installName: '@sanqianx/vector-hub', required: ['dist/cjs/bin.js', 'dist/cjs/server/manager.js', 'ui/index.html'] },
-  eventBridge: { option: '--bridge-source', name: '@sanqianx/ai-coding-event-bridge-console', installName: '@sanqianx/ai-coding-event-bridge-console', required: ['src/server.js', 'src/bridge/core/consumer-registry.js', 'console/index.html'] },
-};
-function run(command, args, cwd) {
-  const result = spawnSync(command, args, { cwd, windowsHide: true, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
-  if (result.status !== 0) throw new Error(`${path.basename(command)} failed (${result.status}): ${result.error?.message || result.stderr}`);
-  return result.stdout;
-}
-function safeRelative(file) { return typeof file === 'string' && !path.isAbsolute(file) && !/[\\\x00-\x1f]/.test(file) && !file.split('/').some(p => p === '..' || p === '.'); }
-function installedFileBytes(pkg, relative, bytes) {
-  const bins = typeof pkg.bin === 'string' ? [pkg.bin] : Object.values(pkg.bin || {});
-  const isBin = bins.some(file => String(file).replace(/\\/g, '/').replace(/^\.\//, '') === relative);
-  // npm bin-links removes CRLF from the shebang only, on every platform.
-  // Hash the installed bytes; keep body line endings and ordinary files exact.
-  if (isBin && /^#![^\n]+\r\n/.test(bytes.subarray(0, 2048).toString('utf8'))) return Buffer.from(bytes.toString('utf8').replace(/^(#![^\n]+)\r\n/, '$1\n'));
-  return bytes;
-}
-function productFiles(directory) {
-  const previous = JSON.parse(fs.readFileSync(path.join(directory, 'module-runtime-manifest.json'), 'utf8'));
-  const files = new Set(['ui/index.html', 'ui/knowledge-panel.html', 'ui/product.js', 'ui/live-client.js', 'ui/product.css', 'ui/favicon.svg', ...Object.keys(previous.productFiles || {})]);
-  return Object.fromEntries([...files].map(file => {
-    if (!safeRelative(file)) throw new Error('Unsafe product asset path');
-    const target = path.join(directory, file);
-    if (fs.lstatSync(target).isSymbolicLink()) throw new Error('Symlink in product assets');
-    return [file, hash(fs.readFileSync(target))];
-  }));
-}
-function verifyInstalled(manifest, installedRoot) {
-  for (const [key, module] of Object.entries(manifest.modules)) {
-    const directory = path.join(installedRoot, 'node_modules', module.installName);
-    const pkg = JSON.parse(fs.readFileSync(path.join(directory, 'package.json')));
-    if (pkg.name !== module.name || pkg.version !== module.version) throw new Error(`Installed module identity mismatch: ${key}`);
-    for (const [relative, expected] of Object.entries(module.files)) {
-      if (!safeRelative(relative)) throw new Error('Unsafe module manifest path');
-      const file = path.join(directory, relative);
-      if (fs.lstatSync(file).isSymbolicLink() || hash(fs.readFileSync(file)) !== expected) throw new Error(`Installed module is stale or altered: ${key}/${relative}`);
-    }
-  }
-}
-function pack(sources) {
-  const output = fs.mkdtempSync(path.join(os.tmpdir(), 'kb-module-candidates-'));
-  const manifest = { schema: 'project-knowledge/module-candidates/v1', createdAt: new Date().toISOString(), modules: {} };
-  for (const [key, definition] of Object.entries(definitions)) {
-    const source = path.resolve(sources[key]);
-    const pkg = JSON.parse(fs.readFileSync(path.join(source, 'package.json')));
-    if (pkg.name !== definition.name) throw new Error(`Unexpected source identity: ${key}`);
-    const expectedVersion = JSON.parse(fs.readFileSync(path.join(root, 'package.json'))).dependencies[definition.installName];
-    if (expectedVersion !== pkg.version && expectedVersion !== `npm:${pkg.name}@${pkg.version}`) throw new Error(`Source version is not pinned by the shell: ${key}`);
-    const result = JSON.parse(run(process.execPath, [npmCli, 'pack', '--ignore-scripts', '--json', '--pack-destination', output], source))[0];
-    const files = {};
-    for (const entry of result.files) {
-      if (!safeRelative(entry.path)) throw new Error('Unsafe npm package path');
-      const file = path.join(source, entry.path);
-      if (fs.lstatSync(file).isSymbolicLink()) throw new Error(`Symlink in module package: ${key}/${entry.path}`);
-      files[entry.path] = hash(installedFileBytes(pkg, entry.path, fs.readFileSync(file)));
-    }
-    if (definition.required.some(file => !files[file])) throw new Error(`Incomplete module runtime: ${key}`);
-    manifest.modules[key] = { name: pkg.name, installName: definition.installName, version: pkg.version, tarball: result.filename, sha256: hash(fs.readFileSync(path.join(output, result.filename))), files };
-    process.stdout.write(`Packed ${key} ${pkg.version}: ${result.files.length} files\n`);
-  }
-  const manifestPath = path.join(output, 'module-candidates.json'); AtomicFile.writeJsonAtomic(manifestPath, manifest);
-  AtomicFile.writeJsonAtomic(path.join(root, 'module-runtime-manifest.json'), { schema: 'project-knowledge/module-content/v1', productFiles: productFiles(root), modules: Object.fromEntries(Object.entries(manifest.modules).map(([key, module]) => [key, { name: module.name, installName: module.installName, version: module.version, files: module.files }])) });
-  process.stdout.write(`MODULE_CANDIDATES ${manifestPath}\n`);
-  return manifestPath;
-}
-if (require.main === module) {
-  try {
-    const at = process.argv.indexOf('--verify-installed');
-    if (at >= 0) { const manifest = JSON.parse(fs.readFileSync(process.argv[at + 1])); verifyInstalled(manifest, path.resolve(process.argv[at + 2])); process.stdout.write('Installed module bytes verified against candidate artifacts.\n'); }
-    else {
-      const sources = {};
-      for (const [key, d] of Object.entries(definitions)) { const i = process.argv.indexOf(d.option); if (i < 0 || !process.argv[i + 1]) throw new Error(`Explicit source required: ${d.option}`); sources[key] = process.argv[i + 1]; }
-      pack(sources);
-    }
-  } catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 1; }
-}
-module.exports = { verifyInstalled, safeRelative, productFiles, installedFileBytes };
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const crypto = require('node:crypto');
+const { spawnSync } = require('node:child_process');
+const AtomicFile = require('../lib/atomic-file');
+const hash = bytes => crypto.createHash('sha256').update(bytes).digest('hex');
+const root = path.resolve(__dirname, '../..');
+const npmCli = process.env.npm_execpath || path.join(path.dirname(process.execPath), 'node_modules/npm/bin/npm-cli.js');
+const definitions = {
+  terminal: { option: '--terminal-source', name: '@sanqianx/claude-ai-workbench', installName: 'claude-ai-workbench', required: ['apps/agent-terminal/app.js', 'apps/agent-terminal/app.css', 'packages/server/lib/knowledge-context.js'] },
+  vectorHub: { option: '--vector-source', name: '@sanqianx/vector-hub', installName: '@sanqianx/vector-hub', required: ['dist/cjs/bin.js', 'dist/cjs/server/manager.js', 'ui/index.html'] },
+  eventBridge: { option: '--bridge-source', name: '@sanqianx/ai-coding-event-bridge-console', installName: '@sanqianx/ai-coding-event-bridge-console', required: ['src/server.js', 'src/bridge/core/consumer-registry.js', 'console/index.html'] },
+};
+function run(command, args, cwd) {
+  const result = spawnSync(command, args, { cwd, windowsHide: true, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+  if (result.status !== 0) throw new Error(`${path.basename(command)} failed (${result.status}): ${result.error?.message || result.stderr}`);
+  return result.stdout;
+}
+function safeRelative(file) { return typeof file === 'string' && !path.isAbsolute(file) && !/[\\\x00-\x1f]/.test(file) && !file.split('/').some(p => p === '..' || p === '.'); }
+function installedFileBytes(pkg, relative, bytes) {
+  const bins = typeof pkg.bin === 'string' ? [pkg.bin] : Object.values(pkg.bin || {});
+  const isBin = bins.some(file => String(file).replace(/\\/g, '/').replace(/^\.\//, '') === relative);
+  // npm bin-links removes CRLF from the shebang only, on every platform.
+  // Hash the installed bytes; keep body line endings and ordinary files exact.
+  if (isBin && /^#![^\n]+\r\n/.test(bytes.subarray(0, 2048).toString('utf8'))) return Buffer.from(bytes.toString('utf8').replace(/^(#![^\n]+)\r\n/, '$1\n'));
+  return bytes;
+}
+function productFiles(directory) {
+  const previous = JSON.parse(fs.readFileSync(path.join(directory, 'module-runtime-manifest.json'), 'utf8'));
+  const files = new Set(['ui/index.html', 'ui/knowledge-panel.html', 'ui/product.js', 'ui/live-client.js', 'ui/product.css', 'ui/favicon.svg', ...Object.keys(previous.productFiles || {})]);
+  return Object.fromEntries([...files].map(file => {
+    if (!safeRelative(file)) throw new Error('Unsafe product asset path');
+    const target = path.join(directory, file);
+    if (fs.lstatSync(target).isSymbolicLink()) throw new Error('Symlink in product assets');
+    return [file, hash(fs.readFileSync(target))];
+  }));
+}
+function verifyInstalled(manifest, installedRoot) {
+  for (const [key, module] of Object.entries(manifest.modules)) {
+    const directory = path.join(installedRoot, 'node_modules', module.installName);
+    const pkg = JSON.parse(fs.readFileSync(path.join(directory, 'package.json')));
+    if (pkg.name !== module.name || pkg.version !== module.version) throw new Error(`Installed module identity mismatch: ${key}`);
+    for (const [relative, expected] of Object.entries(module.files)) {
+      if (!safeRelative(relative)) throw new Error('Unsafe module manifest path');
+      const file = path.join(directory, relative);
+      if (fs.lstatSync(file).isSymbolicLink() || hash(fs.readFileSync(file)) !== expected) throw new Error(`Installed module is stale or altered: ${key}/${relative}`);
+    }
+  }
+}
+function pack(sources) {
+  const output = fs.mkdtempSync(path.join(os.tmpdir(), 'kb-module-candidates-'));
+  const manifest = { schema: 'project-knowledge/module-candidates/v1', createdAt: new Date().toISOString(), modules: {} };
+  for (const [key, definition] of Object.entries(definitions)) {
+    const source = path.resolve(sources[key]);
+    const pkg = JSON.parse(fs.readFileSync(path.join(source, 'package.json')));
+    if (pkg.name !== definition.name) throw new Error(`Unexpected source identity: ${key}`);
+    const expectedVersion = JSON.parse(fs.readFileSync(path.join(root, 'package.json'))).dependencies[definition.installName];
+    if (expectedVersion !== pkg.version && expectedVersion !== `npm:${pkg.name}@${pkg.version}`) throw new Error(`Source version is not pinned by the shell: ${key}`);
+    const result = JSON.parse(run(process.execPath, [npmCli, 'pack', '--ignore-scripts', '--json', '--pack-destination', output], source))[0];
+    const files = {};
+    for (const entry of result.files) {
+      if (!safeRelative(entry.path)) throw new Error('Unsafe npm package path');
+      const file = path.join(source, entry.path);
+      if (fs.lstatSync(file).isSymbolicLink()) throw new Error(`Symlink in module package: ${key}/${entry.path}`);
+      files[entry.path] = hash(installedFileBytes(pkg, entry.path, fs.readFileSync(file)));
+    }
+    if (definition.required.some(file => !files[file])) throw new Error(`Incomplete module runtime: ${key}`);
+    manifest.modules[key] = { name: pkg.name, installName: definition.installName, version: pkg.version, tarball: result.filename, sha256: hash(fs.readFileSync(path.join(output, result.filename))), files };
+    process.stdout.write(`Packed ${key} ${pkg.version}: ${result.files.length} files\n`);
+  }
+  const manifestPath = path.join(output, 'module-candidates.json'); AtomicFile.writeJsonAtomic(manifestPath, manifest);
+  AtomicFile.writeJsonAtomic(path.join(root, 'module-runtime-manifest.json'), { schema: 'project-knowledge/module-content/v1', productFiles: productFiles(root), modules: Object.fromEntries(Object.entries(manifest.modules).map(([key, module]) => [key, { name: module.name, installName: module.installName, version: module.version, files: module.files }])) });
+  process.stdout.write(`MODULE_CANDIDATES ${manifestPath}\n`);
+  return manifestPath;
+}
+if (require.main === module) {
+  try {
+    const at = process.argv.indexOf('--verify-installed');
+    if (at >= 0) { const manifest = JSON.parse(fs.readFileSync(process.argv[at + 1])); verifyInstalled(manifest, path.resolve(process.argv[at + 2])); process.stdout.write('Installed module bytes verified against candidate artifacts.\n'); }
+    else {
+      const sources = {};
+      for (const [key, d] of Object.entries(definitions)) { const i = process.argv.indexOf(d.option); if (i < 0 || !process.argv[i + 1]) throw new Error(`Explicit source required: ${d.option}`); sources[key] = process.argv[i + 1]; }
+      pack(sources);
+    }
+  } catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 1; }
+}
+module.exports = { verifyInstalled, safeRelative, productFiles, installedFileBytes };

package/_site/scripts/sync-product-content.js

@@ -1,28 +1,28 @@
-'use strict';
-const fs = require('node:fs');
-const path = require('node:path');
-const crypto = require('node:crypto');
-const { createRequire } = require('node:module');
-const { execFileSync } = require('node:child_process');
-const { safeRelative } = require('./pack-module-candidates');
-const AtomicFile = require('../lib/atomic-file');
-const root = path.resolve(__dirname, '../..');
-const file = path.join(root, 'module-runtime-manifest.json');
-const manifest = JSON.parse(fs.readFileSync(file));
-const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json')));
-const resolve = createRequire(path.join(root, 'package.json'));
-const digest = file => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
-for (const module of Object.values(manifest.modules)) {
-  const directory = path.dirname(resolve.resolve(`${module.installName}/package.json`));
-  if (!directory.startsWith(path.join(root, 'node_modules') + path.sep)) throw new Error('Module must resolve inside this installed dependency tree.');
-  const installed = JSON.parse(fs.readFileSync(path.join(directory, 'package.json')));
-  const expected = pkg.dependencies[module.installName];
-  if (installed.name !== module.name || ![installed.version, `npm:${installed.name}@${installed.version}`].includes(expected)) throw new Error('Install the exact registry module version before content synchronization.');
-  module.version = installed.version;
-  const npmCli = process.env.npm_execpath || path.join(path.dirname(process.execPath), 'node_modules/npm/bin/npm-cli.js');
-  const packed = JSON.parse(execFileSync(process.execPath, [npmCli, 'pack', '--dry-run', '--ignore-scripts', '--json'], { cwd: directory, windowsHide: true, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 }))[0];
-  module.files = Object.fromEntries(packed.files.map(entry => { const relative = entry.path; if (!safeRelative(relative)) throw new Error('Unsafe content path'); const target = path.join(directory, relative); if (fs.lstatSync(target).isSymbolicLink()) throw new Error('Unsafe content symlink'); return [relative, digest(target)]; }));
-}
-for (const relative of ['ui/index.html', 'ui/knowledge-panel.html', 'ui/product.js', 'ui/live-client.js', 'ui/product.css', 'ui/favicon.svg', 'plugins/project-knowledge/hooks/claude.json', 'plugins/project-knowledge/hooks/codex.json', 'plugins/project-knowledge/scripts/context-hook.cjs', 'plugins/project-knowledge/scripts/mcp-launcher.cjs', 'plugins/project-knowledge/.claude-plugin/plugin.json', 'plugins/project-knowledge/.codex-plugin/plugin.json', 'plugins/project-knowledge/.mcp.json']) manifest.productFiles[relative] = digest(path.join(root, relative));
-AtomicFile.writeJsonAtomic(file, manifest);
-console.log('Updated content hashes from exact installed modules and reviewed product assets; this is not release acceptance.');
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { createRequire } = require('node:module');
+const { execFileSync } = require('node:child_process');
+const { safeRelative } = require('./pack-module-candidates');
+const AtomicFile = require('../lib/atomic-file');
+const root = path.resolve(__dirname, '../..');
+const file = path.join(root, 'module-runtime-manifest.json');
+const manifest = JSON.parse(fs.readFileSync(file));
+const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json')));
+const resolve = createRequire(path.join(root, 'package.json'));
+const digest = file => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+for (const module of Object.values(manifest.modules)) {
+  const directory = path.dirname(resolve.resolve(`${module.installName}/package.json`));
+  if (!directory.startsWith(path.join(root, 'node_modules') + path.sep)) throw new Error('Module must resolve inside this installed dependency tree.');
+  const installed = JSON.parse(fs.readFileSync(path.join(directory, 'package.json')));
+  const expected = pkg.dependencies[module.installName];
+  if (installed.name !== module.name || ![installed.version, `npm:${installed.name}@${installed.version}`].includes(expected)) throw new Error('Install the exact registry module version before content synchronization.');
+  module.version = installed.version;
+  const npmCli = process.env.npm_execpath || path.join(path.dirname(process.execPath), 'node_modules/npm/bin/npm-cli.js');
+  const packed = JSON.parse(execFileSync(process.execPath, [npmCli, 'pack', '--dry-run', '--ignore-scripts', '--json'], { cwd: directory, windowsHide: true, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 }))[0];
+  module.files = Object.fromEntries(packed.files.map(entry => { const relative = entry.path; if (!safeRelative(relative)) throw new Error('Unsafe content path'); const target = path.join(directory, relative); if (fs.lstatSync(target).isSymbolicLink()) throw new Error('Unsafe content symlink'); return [relative, digest(target)]; }));
+}
+for (const relative of ['ui/index.html', 'ui/knowledge-panel.html', 'ui/product.js', 'ui/live-client.js', 'ui/product.css', 'ui/favicon.svg', 'plugins/project-knowledge/hooks/claude.json', 'plugins/project-knowledge/hooks/codex.json', 'plugins/project-knowledge/scripts/context-hook.cjs', 'plugins/project-knowledge/scripts/mcp-launcher.cjs', 'plugins/project-knowledge/.claude-plugin/plugin.json', 'plugins/project-knowledge/.codex-plugin/plugin.json', 'plugins/project-knowledge/.mcp.json']) manifest.productFiles[relative] = digest(path.join(root, relative));
+AtomicFile.writeJsonAtomic(file, manifest);
+console.log('Updated content hashes from exact installed modules and reviewed product assets; this is not release acceptance.');

package/_site/scripts/sync-release-version.js

@@ -1,164 +1,164 @@
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const { spawnSync } = require('child_process');
-
-function readJson(filePath) {
-  return JSON.parse(fs.readFileSync(filePath, 'utf8'));
-}
-
-function writeJson(filePath, value) {
-  fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
-}
-
-function packageVersion(rootDir) {
-  const version = String(readJson(path.join(rootDir, 'package.json')).version || '').trim();
-  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version)) {
-    throw new Error(`package.json must contain a SemVer version, received: ${version || '(empty)'}`);
-  }
-  return version;
-}
-
-function releaseVersionTargets(rootDir, version, { webOnly = false } = {}) {
-  return [
-    {
-      file: 'package-lock.json',
-      update(value) {
-        value.version = version;
-        if (!value.packages || !value.packages['']) throw new Error('package-lock.json has no root package entry');
-        value.packages[''].version = version;
-      },
-    },
-    {
-      file: 'desktop/package.json',
-      update(value) { value.version = version; },
-    },
-    {
-      file: 'desktop/package-lock.json',
-      update(value) {
-        value.version = version;
-        if (!value.packages || !value.packages['']) throw new Error('desktop/package-lock.json has no root package entry');
-        value.packages[''].version = version;
-      },
-    },
-    {
-      file: 'plugins/project-knowledge/.claude-plugin/plugin.json',
-      update(value) { value.version = version; },
-    },
-    {
-      file: 'plugins/project-knowledge/.codex-plugin/plugin.json',
-      update(value) { value.version = version; },
-    },
-    {
-      file: '.claude-plugin/marketplace.json',
-      update(value) {
-        if (!Array.isArray(value.plugins) || !value.plugins[0]) throw new Error('Claude marketplace has no project plugin');
-        value.plugins[0].version = version;
-      },
-    },
-    {
-      file: 'plugins/project-knowledge/.mcp.json',
-      update(value) {
-        const server = value && value.mcpServers && value.mcpServers['project-knowledge'];
-        const serialized = JSON.stringify(server || {});
-        if (/npx/i.test(serialized) || /@sanqianx\/project-knowledge@/.test(serialized)) throw new Error('project-knowledge MCP server must use the bundled launcher; the npx/pinned package form is rejected');
-        const args = Array.isArray(server && server.args) ? server.args : [];
-        const bootstrap = String(args[1] || '');
-        if (!server || server.command !== 'node' || args[0] !== '-e' || !bootstrap.includes('mcp-launcher.cjs')) throw new Error('project-knowledge MCP server must launch the bundled mcp-launcher.cjs via node -e');
-        if (server.cwd !== undefined) throw new Error('project-knowledge MCP server must not pin a cwd; the plugin version is carried by env.KB_PLUGIN_VERSION');
-        if (bootstrap.includes('process.cwd')) throw new Error('the MCP bootstrap must never consult process.cwd');
-        server.env = { ...(server.env || {}), KB_PLUGIN_VERSION: version };
-      },
-    },
-  ].filter(target => !webOnly || !target.file.startsWith('desktop/')).map(target => ({ ...target, path: path.join(rootDir, target.file) }));
-}
-
-function inspectReleaseVersion(rootDir, options) {
-  const version = packageVersion(rootDir);
-  const drift = [];
-  for (const target of releaseVersionTargets(rootDir, version, options)) {
-    const before = fs.readFileSync(target.path, 'utf8');
-    const value = JSON.parse(before);
-    target.update(value);
-    const after = `${JSON.stringify(value, null, 2)}\n`;
-    if (before.replace(/\r\n/g, '\n') !== after) drift.push(target.file);
-  }
-  return { version, drift };
-}
-
-function syncReleaseVersion(rootDir, options) {
-  const version = packageVersion(rootDir);
-  const changed = [];
-  for (const target of releaseVersionTargets(rootDir, version, options)) {
-    const before = fs.readFileSync(target.path, 'utf8');
-    const value = JSON.parse(before);
-    target.update(value);
-    const after = `${JSON.stringify(value, null, 2)}\n`;
-    if (before.replace(/\r\n/g, '\n') === after) continue;
-    writeJson(target.path, value);
-    changed.push(target.file);
-  }
-  return { version, changed };
-}
-
-function stageReleaseVersionFiles(rootDir, files) {
-  if (!files.length) return;
-  const result = spawnSync('git', ['-C', rootDir, 'add', '--', ...files], {
-    encoding: 'utf8',
-    windowsHide: true,
-  });
-  if (result.status !== 0) {
-    throw new Error(`failed to stage synchronized release files: ${(result.stderr || result.stdout || '').trim()}`);
-  }
-}
-
-function parseArgs(argv) {
-  let rootDir = path.resolve(__dirname, '..', '..');
-  let check = false;
-  let tag = null;
-  let stage = false;
-  let webOnly = false;
-  for (let index = 0; index < argv.length; index += 1) {
-    const arg = argv[index];
-    if (arg === '--check') check = true;
-    else if (arg === '--stage') stage = true;
-    else if (arg === '--web-only') webOnly = true;
-    else if (arg === '--root') rootDir = path.resolve(argv[++index] || '');
-    else if (arg === '--tag') tag = String(argv[++index] || '').trim();
-    else throw new Error(`Unknown argument: ${arg}`);
-  }
-  return { rootDir, check, tag, stage, webOnly };
-}
-
-function main(argv = process.argv.slice(2)) {
-  const { rootDir, check, tag, stage, webOnly } = parseArgs(argv);
-  if (check) {
-    const result = inspectReleaseVersion(rootDir, { webOnly });
-    if (result.drift.length) {
-      throw new Error(`Release version ${result.version} is out of sync: ${result.drift.join(', ')}`);
-    }
-    if (tag && tag !== `v${result.version}`) {
-      throw new Error(`Release tag ${tag} must match package version v${result.version}`);
-    }
-    console.log(`release version ${result.version} is synchronized`);
-    return result;
-  }
-  const result = syncReleaseVersion(rootDir, { webOnly });
-  if (stage) stageReleaseVersionFiles(rootDir, result.changed);
-  console.log(result.changed.length
-    ? `${stage ? 'synchronized and staged' : 'synchronized'} release version ${result.version}: ${result.changed.join(', ')}`
-    : `release version ${result.version} is already synchronized`);
-  return result;
-}
-
-if (require.main === module) {
-  try {
-    main();
-  } catch (error) {
-    console.error(`release version synchronization failed: ${error.message}`);
-    process.exitCode = 1;
-  }
-}
-
-module.exports = { inspectReleaseVersion, main, releaseVersionTargets, stageReleaseVersionFiles, syncReleaseVersion };
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+function readJson(filePath) {
+  return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+}
+
+function writeJson(filePath, value) {
+  fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
+}
+
+function packageVersion(rootDir) {
+  const version = String(readJson(path.join(rootDir, 'package.json')).version || '').trim();
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version)) {
+    throw new Error(`package.json must contain a SemVer version, received: ${version || '(empty)'}`);
+  }
+  return version;
+}
+
+function releaseVersionTargets(rootDir, version, { webOnly = false } = {}) {
+  return [
+    {
+      file: 'package-lock.json',
+      update(value) {
+        value.version = version;
+        if (!value.packages || !value.packages['']) throw new Error('package-lock.json has no root package entry');
+        value.packages[''].version = version;
+      },
+    },
+    {
+      file: 'desktop/package.json',
+      update(value) { value.version = version; },
+    },
+    {
+      file: 'desktop/package-lock.json',
+      update(value) {
+        value.version = version;
+        if (!value.packages || !value.packages['']) throw new Error('desktop/package-lock.json has no root package entry');
+        value.packages[''].version = version;
+      },
+    },
+    {
+      file: 'plugins/project-knowledge/.claude-plugin/plugin.json',
+      update(value) { value.version = version; },
+    },
+    {
+      file: 'plugins/project-knowledge/.codex-plugin/plugin.json',
+      update(value) { value.version = version; },
+    },
+    {
+      file: '.claude-plugin/marketplace.json',
+      update(value) {
+        if (!Array.isArray(value.plugins) || !value.plugins[0]) throw new Error('Claude marketplace has no project plugin');
+        value.plugins[0].version = version;
+      },
+    },
+    {
+      file: 'plugins/project-knowledge/.mcp.json',
+      update(value) {
+        const server = value && value.mcpServers && value.mcpServers['project-knowledge'];
+        const serialized = JSON.stringify(server || {});
+        if (/npx/i.test(serialized) || /@sanqianx\/project-knowledge@/.test(serialized)) throw new Error('project-knowledge MCP server must use the bundled launcher; the npx/pinned package form is rejected');
+        const args = Array.isArray(server && server.args) ? server.args : [];
+        const bootstrap = String(args[1] || '');
+        if (!server || server.command !== 'node' || args[0] !== '-e' || !bootstrap.includes('mcp-launcher.cjs')) throw new Error('project-knowledge MCP server must launch the bundled mcp-launcher.cjs via node -e');
+        if (server.cwd !== undefined) throw new Error('project-knowledge MCP server must not pin a cwd; the plugin version is carried by env.KB_PLUGIN_VERSION');
+        if (bootstrap.includes('process.cwd')) throw new Error('the MCP bootstrap must never consult process.cwd');
+        server.env = { ...(server.env || {}), KB_PLUGIN_VERSION: version };
+      },
+    },
+  ].filter(target => !webOnly || !target.file.startsWith('desktop/')).map(target => ({ ...target, path: path.join(rootDir, target.file) }));
+}
+
+function inspectReleaseVersion(rootDir, options) {
+  const version = packageVersion(rootDir);
+  const drift = [];
+  for (const target of releaseVersionTargets(rootDir, version, options)) {
+    const before = fs.readFileSync(target.path, 'utf8');
+    const value = JSON.parse(before);
+    target.update(value);
+    const after = `${JSON.stringify(value, null, 2)}\n`;
+    if (before.replace(/\r\n/g, '\n') !== after) drift.push(target.file);
+  }
+  return { version, drift };
+}
+
+function syncReleaseVersion(rootDir, options) {
+  const version = packageVersion(rootDir);
+  const changed = [];
+  for (const target of releaseVersionTargets(rootDir, version, options)) {
+    const before = fs.readFileSync(target.path, 'utf8');
+    const value = JSON.parse(before);
+    target.update(value);
+    const after = `${JSON.stringify(value, null, 2)}\n`;
+    if (before.replace(/\r\n/g, '\n') === after) continue;
+    writeJson(target.path, value);
+    changed.push(target.file);
+  }
+  return { version, changed };
+}
+
+function stageReleaseVersionFiles(rootDir, files) {
+  if (!files.length) return;
+  const result = spawnSync('git', ['-C', rootDir, 'add', '--', ...files], {
+    encoding: 'utf8',
+    windowsHide: true,
+  });
+  if (result.status !== 0) {
+    throw new Error(`failed to stage synchronized release files: ${(result.stderr || result.stdout || '').trim()}`);
+  }
+}
+
+function parseArgs(argv) {
+  let rootDir = path.resolve(__dirname, '..', '..');
+  let check = false;
+  let tag = null;
+  let stage = false;
+  let webOnly = false;
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === '--check') check = true;
+    else if (arg === '--stage') stage = true;
+    else if (arg === '--web-only') webOnly = true;
+    else if (arg === '--root') rootDir = path.resolve(argv[++index] || '');
+    else if (arg === '--tag') tag = String(argv[++index] || '').trim();
+    else throw new Error(`Unknown argument: ${arg}`);
+  }
+  return { rootDir, check, tag, stage, webOnly };
+}
+
+function main(argv = process.argv.slice(2)) {
+  const { rootDir, check, tag, stage, webOnly } = parseArgs(argv);
+  if (check) {
+    const result = inspectReleaseVersion(rootDir, { webOnly });
+    if (result.drift.length) {
+      throw new Error(`Release version ${result.version} is out of sync: ${result.drift.join(', ')}`);
+    }
+    if (tag && tag !== `v${result.version}`) {
+      throw new Error(`Release tag ${tag} must match package version v${result.version}`);
+    }
+    console.log(`release version ${result.version} is synchronized`);
+    return result;
+  }
+  const result = syncReleaseVersion(rootDir, { webOnly });
+  if (stage) stageReleaseVersionFiles(rootDir, result.changed);
+  console.log(result.changed.length
+    ? `${stage ? 'synchronized and staged' : 'synchronized'} release version ${result.version}: ${result.changed.join(', ')}`
+    : `release version ${result.version} is already synchronized`);
+  return result;
+}
+
+if (require.main === module) {
+  try {
+    main();
+  } catch (error) {
+    console.error(`release version synchronization failed: ${error.message}`);
+    process.exitCode = 1;
+  }
+}
+
+module.exports = { inspectReleaseVersion, main, releaseVersionTargets, stageReleaseVersionFiles, syncReleaseVersion };