@sanqianx/project-knowledge 5.0.23 → 5.0.25

package/_site/_test/knowledge-engine-client-test.js

@@ -1,109 +1,120 @@
-'use strict';
-const assert = require('node:assert/strict');
-const fs = require('node:fs');
-const os = require('node:os');
-const path = require('node:path');
-const http = require('node:http');
-const { spawn } = require('node:child_process');
-const { StorageLayout } = require('../lib/storage-layout');
-const { SettingsStore } = require('../lib/settings-store');
-const { ProjectRegistryStore } = require('../lib/project-registry-store');
-const { ProjectStore } = require('../lib/project-store');
-const { KnowledgeToolRuntime } = require('../lib/knowledge-tool-runtime');
-const endpoint = require('../lib/runtime-endpoint');
-const control = require('../lib/runtime-control');
-const { EngineKnowledgeClient } = require('../lib/engine-knowledge-client');
-
-(async () => {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'knowledge-engine-client-'));
-  const layout = new StorageLayout({ dataDir: path.join(root, 'data') });
-  const settings = new SettingsStore({ layout }), registry = new ProjectRegistryStore({ layout }), projects = new ProjectStore({ layout });
-  const projectId = 'project-test', repoPath = path.join(root, 'repo'), knowledgePath = path.join(root, 'knowledge');
-  fs.mkdirSync(repoPath); fs.mkdirSync(knowledgePath);
-  fs.writeFileSync(path.join(knowledgePath, 'README.md'), '# Legacy\n\nlegacy-local-only\n');
-  await settings.initialize(); await registry.initialize();
-  await projects.create(projectId, { repoPath, knowledgePath }, { modules: { engine: { status: 'registered', projectId } } });
-  await projects.updateState(projectId, state => { state.modules = { engine: { status: 'registered', projectId } }; });
-  await registry.add(projectId, { displayNameSnapshot: 'Test' });
-  let invalidIdentity = false, malformed = false, businessError = false, oversized = false, wrongBinding = false, scopeChanged = false;
-  const calls = [];
-  const reference = { scope_project_id: projectId, entry_id: 'changes/aaaaaaaaaaaa.md', commitSha: 'a'.repeat(40), chunk_text: 'Engine authoritative knowledge' };
-  const payload = { ok: true, projectId, backend: 'hybrid+markdown-truth', results: [reference], answer: reference.chunk_text, citations: [{ ...reference, entryId: reference.entry_id }], chunks: [{ chunk_text: reference.chunk_text }] };
-  const server = http.createServer(async (req, res) => {
-    res.setHeader('Content-Type', 'application/json');
-    if (req.url === '/api/runtime/identity') return res.end(JSON.stringify(control.identity(invalidIdentity ? root : layout.getDataDir(), { port: server.address().port, host: '127.0.0.1', startedAt: 'test-start' })));
-    if (req.url === '/api/health') return res.end(JSON.stringify({ name: 'knowledge-engine', dataSchemaVersion: 3 }));
-    if (req.url === '/api/projects') return res.end(JSON.stringify({ projects: [{ projectId, repoPath, knowledgePath: wrongBinding ? root : knowledgePath }] }));
-    let text = ''; for await (const bytes of req) text += bytes;
-    calls.push({ route: req.url, input: JSON.parse(text || '{}') });
-    if (oversized) return res.end(JSON.stringify({ ok: true, text: 'x'.repeat(2 * 1024 * 1024) }));
-    if (scopeChanged) { res.statusCode = 409; return res.end(JSON.stringify({ ok: false, error: { code: 'PROJECT_SCOPE_CHANGED' } })); }
-    if (businessError) { res.statusCode = 403; return res.end(JSON.stringify({ ok: false, error: { code: 'PATH_OUTSIDE_ROOT', message: 'private-test-secret' } })); }
-    res.end(malformed ? '[]' : JSON.stringify(payload));
-  });
-  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
-  endpoint.writeEndpoint(layout.getDataDir(), { pid: process.pid, port: server.address().port, host: '127.0.0.1', startedAt: 'test-start' });
-  const runtime = new KnowledgeToolRuntime({ layout, settingsStore: settings, registryStore: registry, projectStore: projects });
-  try {
-    for (const action of ['search', 'ask', 'get', 'history']) {
-      assert.deepEqual(await runtime[action]({ project: projectId, query: 'knowledge', entry: reference.entry_id, scope: 'brain', apiKey: 'must-not-forward', password: 'must-not-forward' }), payload);
-      const call = calls.at(-1);
-      assert.equal(call.route, `/api/engine/${action}`);
-      assert.equal(call.input.projectId, projectId); assert.equal(call.input.scope, 'brain');
-      assert.ok(!JSON.stringify(call.input).includes('must-not-forward'));
-    }
-    const subprocess = (file, args) => new Promise((resolve, reject) => {
-      const child = spawn(process.execPath, [file, ...args], { env: { ...process.env, KB_DATA_DIR: layout.getDataDir() }, windowsHide: true });
-      let out = '', err = ''; child.stdout.on('data', b => { out += b; }); child.stderr.on('data', b => { err += b; });
-      child.once('error', reject); child.once('close', code => resolve({ code, out, err }));
-    });
-    const cli = await subprocess(path.resolve(__dirname, '../../bin/project-knowledge-kb.js'), ['search', '--project', projectId, '--query', 'knowledge', '--scope', 'brain', '--json']);
-    assert.equal(cli.code, 0, cli.err); assert.deepEqual(JSON.parse(cli.out), payload);
-    assert.equal(calls.at(-1).input.scope, 'brain');
-    await runtime.get({ projectId, entry: reference.entry_id, space: 'brain:test' });
-    assert.equal(calls.at(-1).input.spaceId, 'brain:test', 'legacy space alias is forwarded');
-    const { createRequire } = require('node:module');
-    const sdk = createRequire(path.resolve(__dirname, '../../package.json'));
-    const { Client } = sdk('@modelcontextprotocol/sdk/client/index.js');
-    const { StdioClientTransport } = sdk('@modelcontextprotocol/sdk/client/stdio.js');
-    const transport = new StdioClientTransport({ command: process.execPath, args: [path.resolve(__dirname, '../../bin/project-knowledge-mcp.js')], env: { ...process.env, KB_DATA_DIR: layout.getDataDir() }, stderr: 'pipe' });
-    const client = new Client({ name: 'engine-regression', version: '1.0.0' });
-    try {
-      await client.connect(transport);
-      const tools = await client.listTools();
-      assert.deepEqual(tools.tools.find(t => t.name === 'project_knowledge_search').inputSchema.properties.scope.enum, ['project', 'domain', 'brain']);
-      for (const action of ['search', 'ask', 'get', 'history']) {
-        const result = await client.callTool({ name: `project_knowledge_${action}`, arguments: { projectId, scope: 'brain', ...(action === 'get' ? { entry: reference.entry_id, space: 'brain:test' } : action === 'history' ? {} : { query: 'knowledge' }) } });
-        assert.ok(!result.isError); assert.deepEqual(JSON.parse(result.content[0].text), payload);
-        assert.equal(calls.at(-1).input.scope, 'brain');
-      }
-    } finally { await client.close(); }
-    invalidIdentity = true;
-    await assert.rejects(runtime.search({ projectId, query: 'knowledge' }), e => e.code === 'ENGINE_IDENTITY_MISMATCH');
-    invalidIdentity = false; malformed = true;
-    await assert.rejects(runtime.search({ projectId, query: 'knowledge' }), e => e.code === 'ENGINE_INVALID_RESPONSE');
-    malformed = false; businessError = true;
-    await assert.rejects(runtime.get({ projectId, entry: '../outside.md' }), e => e.code === 'PATH_OUTSIDE_ROOT' && !e.message.includes('private-test-secret'));
-    businessError = false; oversized = true;
-    await assert.rejects(runtime.search({ projectId, query: 'knowledge' }), e => e.code === 'ENGINE_INVALID_RESPONSE');
-    oversized = false;
-    scopeChanged = true;
-    await assert.rejects(runtime.search({ projectId, query: 'knowledge' }), e => e.code === 'PROJECT_SCOPE_CHANGED' && e.status === 409);
-    scopeChanged = false;
-    const direct = new EngineKnowledgeClient({ layout, engineUrl: `http://127.0.0.1:${server.address().port}` });
-    assert.deepEqual(await direct.request('search', {}, runtime.resolveProject({ projectId })), payload);
-    assert.equal(calls.at(-1).route, '/api/search');
-    wrongBinding = true;
-    await assert.rejects(direct.request('search', {}, runtime.resolveProject({ projectId })), e => e.code === 'ENGINE_IDENTITY_MISMATCH');
-    wrongBinding = false;
-    for (const engineUrl of ['http://example.com', 'http://secret@127.0.0.1', 'http://127.0.0.1/?apiKey=secret', 'file:///private']) {
-      const unsafe = new EngineKnowledgeClient({ layout, engineUrl });
-      await assert.rejects(unsafe.request('search', {}, runtime.resolveProject({ projectId })), e => e.code === 'ENGINE_URL_INVALID' && !e.message.includes('secret'));
-    }
-    await assert.rejects(direct.request('../runtime-config', {}, {}), e => e.code === 'INVALID_ARGUMENT');
-    await assert.rejects(runtime.search({ projectId, scope: 'another-brain' }), e => e.code === 'INVALID_ARGUMENT');
-    const unavailable = new EngineKnowledgeClient({ layout, fetchImpl: async () => { throw new Error('private-test-secret'); } });
-    await assert.rejects(unavailable.request('search', {}, runtime.resolveProject({ projectId })), e => e.code === 'ENGINE_UNAVAILABLE' && !e.message.includes('private-test-secret'));
-    console.log('knowledge-engine-client-test PASS (native runtime, CLI and MCP share engine facts)');
-  } finally { await runtime.close(); server.closeAllConnections(); await new Promise(resolve => server.close(resolve)); fs.rmSync(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 }); }
-})().catch(error => { console.error(error); process.exitCode = 1; });
+'use strict';
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const http = require('node:http');
+const { spawn } = require('node:child_process');
+const { StorageLayout } = require('../lib/storage-layout');
+const { SettingsStore } = require('../lib/settings-store');
+const { ProjectRegistryStore } = require('../lib/project-registry-store');
+const { ProjectStore } = require('../lib/project-store');
+const { KnowledgeToolRuntime } = require('../lib/knowledge-tool-runtime');
+const endpoint = require('../lib/runtime-endpoint');
+const control = require('../lib/runtime-control');
+const { EngineKnowledgeClient } = require('../lib/engine-knowledge-client');
+
+// A unit test must be decided by its own fixture, never by the developer
+// shell. Ambient module URLs (a shell exporting KB_KNOWLEDGE_ENGINE_URL at
+// the live instance, e.g. http://127.0.0.1:5790) used to redirect this
+// test's implicit runtime client to the real engine, which then correctly
+// refused the fixture binding with ENGINE_IDENTITY_MISMATCH (F-ENV-LEAK-001).
+// Drop the ambient module addresses for this process and its children; the
+// explicit engineUrl option used below remains the supported way to aim a
+// client at a chosen fixture on purpose, and the identity assertions below
+// still expect the mismatch to surface, never to be swallowed.
+for (const ambientModuleUrl of ['KB_KNOWLEDGE_ENGINE_URL', 'KB_VECTORHUB_URL', 'KB_TERMINAL_URL', 'KB_EVENTBRIDGE_URL']) delete process.env[ambientModuleUrl];
+
+(async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'knowledge-engine-client-'));
+  const layout = new StorageLayout({ dataDir: path.join(root, 'data') });
+  const settings = new SettingsStore({ layout }), registry = new ProjectRegistryStore({ layout }), projects = new ProjectStore({ layout });
+  const projectId = 'project-test', repoPath = path.join(root, 'repo'), knowledgePath = path.join(root, 'knowledge');
+  fs.mkdirSync(repoPath); fs.mkdirSync(knowledgePath);
+  fs.writeFileSync(path.join(knowledgePath, 'README.md'), '# Legacy\n\nlegacy-local-only\n');
+  await settings.initialize(); await registry.initialize();
+  await projects.create(projectId, { repoPath, knowledgePath }, { modules: { engine: { status: 'registered', projectId } } });
+  await projects.updateState(projectId, state => { state.modules = { engine: { status: 'registered', projectId } }; });
+  await registry.add(projectId, { displayNameSnapshot: 'Test' });
+  let invalidIdentity = false, malformed = false, businessError = false, oversized = false, wrongBinding = false, scopeChanged = false;
+  const calls = [];
+  const reference = { scope_project_id: projectId, entry_id: 'changes/aaaaaaaaaaaa.md', commitSha: 'a'.repeat(40), chunk_text: 'Engine authoritative knowledge' };
+  const payload = { ok: true, projectId, backend: 'hybrid+markdown-truth', results: [reference], answer: reference.chunk_text, citations: [{ ...reference, entryId: reference.entry_id }], chunks: [{ chunk_text: reference.chunk_text }] };
+  const server = http.createServer(async (req, res) => {
+    res.setHeader('Content-Type', 'application/json');
+    if (req.url === '/api/runtime/identity') return res.end(JSON.stringify(control.identity(invalidIdentity ? root : layout.getDataDir(), { port: server.address().port, host: '127.0.0.1', startedAt: 'test-start' })));
+    if (req.url === '/api/health') return res.end(JSON.stringify({ name: 'knowledge-engine', dataSchemaVersion: 3 }));
+    if (req.url === '/api/projects') return res.end(JSON.stringify({ projects: [{ projectId, repoPath, knowledgePath: wrongBinding ? root : knowledgePath }] }));
+    let text = ''; for await (const bytes of req) text += bytes;
+    calls.push({ route: req.url, input: JSON.parse(text || '{}') });
+    if (oversized) return res.end(JSON.stringify({ ok: true, text: 'x'.repeat(2 * 1024 * 1024) }));
+    if (scopeChanged) { res.statusCode = 409; return res.end(JSON.stringify({ ok: false, error: { code: 'PROJECT_SCOPE_CHANGED' } })); }
+    if (businessError) { res.statusCode = 403; return res.end(JSON.stringify({ ok: false, error: { code: 'PATH_OUTSIDE_ROOT', message: 'private-test-secret' } })); }
+    res.end(malformed ? '[]' : JSON.stringify(payload));
+  });
+  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+  endpoint.writeEndpoint(layout.getDataDir(), { pid: process.pid, port: server.address().port, host: '127.0.0.1', startedAt: 'test-start' });
+  const runtime = new KnowledgeToolRuntime({ layout, settingsStore: settings, registryStore: registry, projectStore: projects });
+  try {
+    for (const action of ['search', 'ask', 'get', 'history']) {
+      assert.deepEqual(await runtime[action]({ project: projectId, query: 'knowledge', entry: reference.entry_id, scope: 'brain', apiKey: 'must-not-forward', password: 'must-not-forward' }), payload);
+      const call = calls.at(-1);
+      assert.equal(call.route, `/api/engine/${action}`);
+      assert.equal(call.input.projectId, projectId); assert.equal(call.input.scope, 'brain');
+      assert.ok(!JSON.stringify(call.input).includes('must-not-forward'));
+    }
+    const subprocess = (file, args) => new Promise((resolve, reject) => {
+      const child = spawn(process.execPath, [file, ...args], { env: { ...process.env, KB_DATA_DIR: layout.getDataDir() }, windowsHide: true });
+      let out = '', err = ''; child.stdout.on('data', b => { out += b; }); child.stderr.on('data', b => { err += b; });
+      child.once('error', reject); child.once('close', code => resolve({ code, out, err }));
+    });
+    const cli = await subprocess(path.resolve(__dirname, '../../bin/project-knowledge-kb.js'), ['search', '--project', projectId, '--query', 'knowledge', '--scope', 'brain', '--json']);
+    assert.equal(cli.code, 0, cli.err); assert.deepEqual(JSON.parse(cli.out), payload);
+    assert.equal(calls.at(-1).input.scope, 'brain');
+    await runtime.get({ projectId, entry: reference.entry_id, space: 'brain:test' });
+    assert.equal(calls.at(-1).input.spaceId, 'brain:test', 'legacy space alias is forwarded');
+    const { createRequire } = require('node:module');
+    const sdk = createRequire(path.resolve(__dirname, '../../package.json'));
+    const { Client } = sdk('@modelcontextprotocol/sdk/client/index.js');
+    const { StdioClientTransport } = sdk('@modelcontextprotocol/sdk/client/stdio.js');
+    const transport = new StdioClientTransport({ command: process.execPath, args: [path.resolve(__dirname, '../../bin/project-knowledge-mcp.js')], env: { ...process.env, KB_DATA_DIR: layout.getDataDir() }, stderr: 'pipe' });
+    const client = new Client({ name: 'engine-regression', version: '1.0.0' });
+    try {
+      await client.connect(transport);
+      const tools = await client.listTools();
+      assert.deepEqual(tools.tools.find(t => t.name === 'project_knowledge_search').inputSchema.properties.scope.enum, ['project', 'domain', 'brain']);
+      for (const action of ['search', 'ask', 'get', 'history']) {
+        const result = await client.callTool({ name: `project_knowledge_${action}`, arguments: { projectId, scope: 'brain', ...(action === 'get' ? { entry: reference.entry_id, space: 'brain:test' } : action === 'history' ? {} : { query: 'knowledge' }) } });
+        assert.ok(!result.isError); assert.deepEqual(JSON.parse(result.content[0].text), payload);
+        assert.equal(calls.at(-1).input.scope, 'brain');
+      }
+    } finally { await client.close(); }
+    invalidIdentity = true;
+    await assert.rejects(runtime.search({ projectId, query: 'knowledge' }), e => e.code === 'ENGINE_IDENTITY_MISMATCH');
+    invalidIdentity = false; malformed = true;
+    await assert.rejects(runtime.search({ projectId, query: 'knowledge' }), e => e.code === 'ENGINE_INVALID_RESPONSE');
+    malformed = false; businessError = true;
+    await assert.rejects(runtime.get({ projectId, entry: '../outside.md' }), e => e.code === 'PATH_OUTSIDE_ROOT' && !e.message.includes('private-test-secret'));
+    businessError = false; oversized = true;
+    await assert.rejects(runtime.search({ projectId, query: 'knowledge' }), e => e.code === 'ENGINE_INVALID_RESPONSE');
+    oversized = false;
+    scopeChanged = true;
+    await assert.rejects(runtime.search({ projectId, query: 'knowledge' }), e => e.code === 'PROJECT_SCOPE_CHANGED' && e.status === 409);
+    scopeChanged = false;
+    const direct = new EngineKnowledgeClient({ layout, engineUrl: `http://127.0.0.1:${server.address().port}` });
+    assert.deepEqual(await direct.request('search', {}, runtime.resolveProject({ projectId })), payload);
+    assert.equal(calls.at(-1).route, '/api/search');
+    wrongBinding = true;
+    await assert.rejects(direct.request('search', {}, runtime.resolveProject({ projectId })), e => e.code === 'ENGINE_IDENTITY_MISMATCH');
+    wrongBinding = false;
+    for (const engineUrl of ['http://example.com', 'http://secret@127.0.0.1', 'http://127.0.0.1/?apiKey=secret', 'file:///private']) {
+      const unsafe = new EngineKnowledgeClient({ layout, engineUrl });
+      await assert.rejects(unsafe.request('search', {}, runtime.resolveProject({ projectId })), e => e.code === 'ENGINE_URL_INVALID' && !e.message.includes('secret'));
+    }
+    await assert.rejects(direct.request('../runtime-config', {}, {}), e => e.code === 'INVALID_ARGUMENT');
+    await assert.rejects(runtime.search({ projectId, scope: 'another-brain' }), e => e.code === 'INVALID_ARGUMENT');
+    const unavailable = new EngineKnowledgeClient({ layout, fetchImpl: async () => { throw new Error('private-test-secret'); } });
+    await assert.rejects(unavailable.request('search', {}, runtime.resolveProject({ projectId })), e => e.code === 'ENGINE_UNAVAILABLE' && !e.message.includes('private-test-secret'));
+    console.log('knowledge-engine-client-test PASS (native runtime, CLI and MCP share engine facts)');
+  } finally { await runtime.close(); server.closeAllConnections(); await new Promise(resolve => server.close(resolve)); fs.rmSync(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 }); }
+})().catch(error => { console.error(error); process.exitCode = 1; });

package/_site/_test/knowledge-language-control-test.js

@@ -1,170 +1,170 @@
-// _site/_test/knowledge-language-control-test.js
-//
-// T11: knowledge output language controls. Verifies:
-//   - import accepts knowledgeLanguage ('zh-CN' / 'en-US');
-//   - per-project PATCH updates knowledgeLanguage;
-//   - the value is persisted in config.knowledgeLanguage;
-//   - the value is what the next analyzer invocation would see (we
-//     verify it via the public state API which surfaces the same
-//     config object the reconciler reads);
-//   - changing language does NOT silently rewrite historical knowledge;
-//   - invalid values are rejected with 400.
-
-const assert = require('assert');
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { spawnSync } = require('child_process');
-const { spawnServer } = require('./helpers/spawn-server');
-
-const ROOT = path.resolve(__dirname, '..', '..');
-const sitePort = 7990 + (process.pid % 200);
-const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-knowledge-language-' + process.pid + '-'));
-const repo = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-knowledge-language-repo-' + process.pid + '-'));
-
-function git(args) {
-  const result = spawnSync('git', ['-C', repo, ...args], {
-    encoding: 'utf8', windowsHide: true,
-    env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
-  });
-  if (result.status !== 0) throw new Error(result.stderr || `git ${args.join(' ')} failed: ${result.status}`);
-  return String(result.stdout || '').trim();
-}
-
-async function serverFetch(url, init, timeoutMs = 10000) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const response = await fetch(url, { ...init, signal: controller.signal });
-    const text = await response.text();
-    return { status: response.status, body: text ? JSON.parse(text) : {} };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-(async () => {
-  git(['init', '-q', '-b', 'main']);
-  git(['config', 'user.email', 'kl@example.local']);
-  git(['config', 'user.name', 'Knowledge Language']);
-  fs.writeFileSync(path.join(repo, 'README.md'), '# kl\n');
-  git(['add', 'README.md']);
-  git(['commit', '-q', '-m', 'baseline']);
-  const knowledgeRoot = path.join(dataDir, 'knowledge');
-  fs.mkdirSync(knowledgeRoot, { recursive: true });
-  const server = spawnServer({
-    root: ROOT, port: sitePort, dataDir, tag: 'knowledge-language',
-    extraEnv: { KB_AUTOMATION_FAKE_CLAUDE: '1', KB_EMBEDDING_FAKE: '1', KB_SKIP_MIGRATION: '1' },
-  });
-  try {
-    // waitForServer-equivalent
-    for (let attempt = 0; attempt < 100; attempt += 1) {
-      try {
-        const r = await serverFetch(`http://127.0.0.1:${sitePort}/api/health`);
-        if (r.body.ok) break;
-      } catch {}
-      await new Promise(resolve => setTimeout(resolve, 100));
-    }
-    await serverFetch(`http://127.0.0.1:${sitePort}/api/settings`, {
-      method: 'PATCH', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ knowledge: { rootPath: knowledgeRoot } }),
-    });
-    await serverFetch(`http://127.0.0.1:${sitePort}/api/ai-profiles`, {
-      method: 'PUT', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({
-        schema: 'ai-profiles/v1', defaultProfileId: 'fake',
-        profiles: [{ id: 'fake', name: 'Fake', enabled: true, vendor: 'anthropic', model: 'fake', apiKeyUpdate: { mode: 'replace', value: 'k' } }],
-      }),
-    });
-
-    // Case 1: import with zh-CN (default)
-    let r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/import`, {
-      method: 'POST', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ localPath: repo, aiProfileId: 'fake', knowledgeLanguage: 'zh-CN' }),
-    });
-    assert.strictEqual(r.status, 201, JSON.stringify(r.body));
-    assert.strictEqual(r.body.config.knowledgeLanguage, 'zh-CN');
-    const PROJECT_ID = r.body.projectId;
-
-    // Case 2: import with en-US
-    const repo2 = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-kl-repo2-' + process.pid + '-'));
-    const git2 = (args) => git(['-C', repo2, ...args]);
-    git2(['init', '-q', '-b', 'main']);
-    git2(['config', 'user.email', 'kl2@example.local']);
-    git2(['config', 'user.name', 'KL2']);
-    fs.writeFileSync(path.join(repo2, 'README.md'), '# en\n');
-    git2(['add', 'README.md']);
-    git2(['commit', '-q', '-m', 'baseline']);
-    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/import`, {
-      method: 'POST', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ localPath: repo2, aiProfileId: 'fake', knowledgeLanguage: 'en-US' }),
-    });
-    assert.strictEqual(r.status, 201);
-    assert.strictEqual(r.body.config.knowledgeLanguage, 'en-US');
-    fs.rmSync(repo2, { recursive: true, force: true });
-
-    // Case 3: invalid language rejected
-    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/import`, {
-      method: 'POST', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ localPath: repo2, aiProfileId: 'fake', knowledgeLanguage: 'xx-INVALID' }),
-    });
-    assert.strictEqual(r.status, 400);
-    assert.strictEqual(r.body.error.code, 'INVALID_ARGUMENT');
-
-    // Case 4: per-project PATCH updates knowledgeLanguage
-    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${PROJECT_ID}`, {
-      method: 'PATCH', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ knowledgeLanguage: 'en-US' }),
-    });
-    assert.strictEqual(r.status, 200, JSON.stringify(r.body));
-    assert.strictEqual(r.body.config.knowledgeLanguage, 'en-US');
-    // Verify state-side persists
-    const readBack = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${PROJECT_ID}`, undefined);
-    assert.strictEqual(readBack.body.project.config.knowledgeLanguage, 'en-US');
-
-    // Case 5: invalid value via PATCH also rejected
-    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${PROJECT_ID}`, {
-      method: 'PATCH', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ knowledgeLanguage: 'klingon' }),
-    });
-    assert.strictEqual(r.status, 400);
-
-    // Case 6: project status surfaces knowledgeLanguage in the public state.
-    // The CommitReconciler reads config.knowledgeLanguage via projectStore,
-    // so anything the UI sees the analyzer also sees.
-    const stateR = await serverFetch(`http://127.0.0.1:${sitePort}/api/state`, undefined);
-    assert.strictEqual(stateR.status, 200);
-    const project = stateR.body.projects.find(p => p.projectId === PROJECT_ID);
-    assert(project, 'project must appear in /api/state');
-    assert.strictEqual(project.config.knowledgeLanguage, 'en-US');
-
-    // Case 7: changing language does NOT silently rewrite historical files.
-    // We snapshot the knowledge directory before and after a language flip;
-    // the existing files (if any) must remain identical and only NEW
-    // commits should produce output under the new language.
-    const knowledgePath = readBack.body.project.config.knowledgePath;
-    fs.mkdirSync(knowledgePath, { recursive: true });
-    const marker = path.join(knowledgePath, 'marker.txt');
-    fs.writeFileSync(marker, 'do-not-touch\n');
-    const mtimeBefore = fs.statSync(marker).mtimeMs;
-    const contentBefore = fs.readFileSync(marker, 'utf8');
-    await new Promise(resolve => setTimeout(resolve, 20));
-    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${PROJECT_ID}`, {
-      method: 'PATCH', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ knowledgeLanguage: 'zh-CN' }),
-    });
-    assert.strictEqual(r.status, 200);
-    assert(fs.existsSync(marker), 'historical knowledge files must not be deleted by a language change');
-    assert.strictEqual(fs.readFileSync(marker, 'utf8'), contentBefore, 'historical content must remain intact');
-    assert.strictEqual(fs.statSync(marker).mtimeMs, mtimeBefore, 'historical files must not be touched');
-  } finally {
-    server.child.kill();
-    await new Promise(resolve => server.child.once('exit', resolve));
-    fs.rmSync(dataDir, { recursive: true, force: true });
-    fs.rmSync(repo, { recursive: true, force: true });
-  }
-  console.log('knowledge-language-control-test PASS');
-})().catch(error => {
-  console.error(error.stack || error.message);
-  process.exit(1);
-});
+// _site/_test/knowledge-language-control-test.js
+//
+// T11: knowledge output language controls. Verifies:
+//   - import accepts knowledgeLanguage ('zh-CN' / 'en-US');
+//   - per-project PATCH updates knowledgeLanguage;
+//   - the value is persisted in config.knowledgeLanguage;
+//   - the value is what the next analyzer invocation would see (we
+//     verify it via the public state API which surfaces the same
+//     config object the reconciler reads);
+//   - changing language does NOT silently rewrite historical knowledge;
+//   - invalid values are rejected with 400.
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { spawnServer } = require('./helpers/spawn-server');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const sitePort = 7990 + (process.pid % 200);
+const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-knowledge-language-' + process.pid + '-'));
+const repo = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-knowledge-language-repo-' + process.pid + '-'));
+
+function git(args) {
+  const result = spawnSync('git', ['-C', repo, ...args], {
+    encoding: 'utf8', windowsHide: true,
+    env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+  });
+  if (result.status !== 0) throw new Error(result.stderr || `git ${args.join(' ')} failed: ${result.status}`);
+  return String(result.stdout || '').trim();
+}
+
+async function serverFetch(url, init, timeoutMs = 10000) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(url, { ...init, signal: controller.signal });
+    const text = await response.text();
+    return { status: response.status, body: text ? JSON.parse(text) : {} };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+(async () => {
+  git(['init', '-q', '-b', 'main']);
+  git(['config', 'user.email', 'kl@example.local']);
+  git(['config', 'user.name', 'Knowledge Language']);
+  fs.writeFileSync(path.join(repo, 'README.md'), '# kl\n');
+  git(['add', 'README.md']);
+  git(['commit', '-q', '-m', 'baseline']);
+  const knowledgeRoot = path.join(dataDir, 'knowledge');
+  fs.mkdirSync(knowledgeRoot, { recursive: true });
+  const server = spawnServer({
+    root: ROOT, port: sitePort, dataDir, tag: 'knowledge-language',
+    extraEnv: { KB_AUTOMATION_FAKE_CLAUDE: '1', KB_EMBEDDING_FAKE: '1', KB_SKIP_MIGRATION: '1' },
+  });
+  try {
+    // waitForServer-equivalent
+    for (let attempt = 0; attempt < 100; attempt += 1) {
+      try {
+        const r = await serverFetch(`http://127.0.0.1:${sitePort}/api/health`);
+        if (r.body.ok) break;
+      } catch {}
+      await new Promise(resolve => setTimeout(resolve, 100));
+    }
+    await serverFetch(`http://127.0.0.1:${sitePort}/api/settings`, {
+      method: 'PATCH', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ knowledge: { rootPath: knowledgeRoot } }),
+    });
+    await serverFetch(`http://127.0.0.1:${sitePort}/api/ai-profiles`, {
+      method: 'PUT', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        schema: 'ai-profiles/v1', defaultProfileId: 'fake',
+        profiles: [{ id: 'fake', name: 'Fake', enabled: true, vendor: 'anthropic', model: 'fake', apiKeyUpdate: { mode: 'replace', value: 'k' } }],
+      }),
+    });
+
+    // Case 1: import with zh-CN (default)
+    let r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/import`, {
+      method: 'POST', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ localPath: repo, aiProfileId: 'fake', knowledgeLanguage: 'zh-CN' }),
+    });
+    assert.strictEqual(r.status, 201, JSON.stringify(r.body));
+    assert.strictEqual(r.body.config.knowledgeLanguage, 'zh-CN');
+    const PROJECT_ID = r.body.projectId;
+
+    // Case 2: import with en-US
+    const repo2 = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-kl-repo2-' + process.pid + '-'));
+    const git2 = (args) => git(['-C', repo2, ...args]);
+    git2(['init', '-q', '-b', 'main']);
+    git2(['config', 'user.email', 'kl2@example.local']);
+    git2(['config', 'user.name', 'KL2']);
+    fs.writeFileSync(path.join(repo2, 'README.md'), '# en\n');
+    git2(['add', 'README.md']);
+    git2(['commit', '-q', '-m', 'baseline']);
+    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/import`, {
+      method: 'POST', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ localPath: repo2, aiProfileId: 'fake', knowledgeLanguage: 'en-US' }),
+    });
+    assert.strictEqual(r.status, 201);
+    assert.strictEqual(r.body.config.knowledgeLanguage, 'en-US');
+    fs.rmSync(repo2, { recursive: true, force: true });
+
+    // Case 3: invalid language rejected
+    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/import`, {
+      method: 'POST', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ localPath: repo2, aiProfileId: 'fake', knowledgeLanguage: 'xx-INVALID' }),
+    });
+    assert.strictEqual(r.status, 400);
+    assert.strictEqual(r.body.error.code, 'INVALID_ARGUMENT');
+
+    // Case 4: per-project PATCH updates knowledgeLanguage
+    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${PROJECT_ID}`, {
+      method: 'PATCH', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ knowledgeLanguage: 'en-US' }),
+    });
+    assert.strictEqual(r.status, 200, JSON.stringify(r.body));
+    assert.strictEqual(r.body.config.knowledgeLanguage, 'en-US');
+    // Verify state-side persists
+    const readBack = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${PROJECT_ID}`, undefined);
+    assert.strictEqual(readBack.body.project.config.knowledgeLanguage, 'en-US');
+
+    // Case 5: invalid value via PATCH also rejected
+    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${PROJECT_ID}`, {
+      method: 'PATCH', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ knowledgeLanguage: 'klingon' }),
+    });
+    assert.strictEqual(r.status, 400);
+
+    // Case 6: project status surfaces knowledgeLanguage in the public state.
+    // The CommitReconciler reads config.knowledgeLanguage via projectStore,
+    // so anything the UI sees the analyzer also sees.
+    const stateR = await serverFetch(`http://127.0.0.1:${sitePort}/api/state`, undefined);
+    assert.strictEqual(stateR.status, 200);
+    const project = stateR.body.projects.find(p => p.projectId === PROJECT_ID);
+    assert(project, 'project must appear in /api/state');
+    assert.strictEqual(project.config.knowledgeLanguage, 'en-US');
+
+    // Case 7: changing language does NOT silently rewrite historical files.
+    // We snapshot the knowledge directory before and after a language flip;
+    // the existing files (if any) must remain identical and only NEW
+    // commits should produce output under the new language.
+    const knowledgePath = readBack.body.project.config.knowledgePath;
+    fs.mkdirSync(knowledgePath, { recursive: true });
+    const marker = path.join(knowledgePath, 'marker.txt');
+    fs.writeFileSync(marker, 'do-not-touch\n');
+    const mtimeBefore = fs.statSync(marker).mtimeMs;
+    const contentBefore = fs.readFileSync(marker, 'utf8');
+    await new Promise(resolve => setTimeout(resolve, 20));
+    r = await serverFetch(`http://127.0.0.1:${sitePort}/api/projects/${PROJECT_ID}`, {
+      method: 'PATCH', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ knowledgeLanguage: 'zh-CN' }),
+    });
+    assert.strictEqual(r.status, 200);
+    assert(fs.existsSync(marker), 'historical knowledge files must not be deleted by a language change');
+    assert.strictEqual(fs.readFileSync(marker, 'utf8'), contentBefore, 'historical content must remain intact');
+    assert.strictEqual(fs.statSync(marker).mtimeMs, mtimeBefore, 'historical files must not be touched');
+  } finally {
+    server.child.kill();
+    await new Promise(resolve => server.child.once('exit', resolve));
+    fs.rmSync(dataDir, { recursive: true, force: true });
+    fs.rmSync(repo, { recursive: true, force: true });
+  }
+  console.log('knowledge-language-control-test PASS');
+})().catch(error => {
+  console.error(error.stack || error.message);
+  process.exit(1);
+});