@sanqianx/project-knowledge 5.0.24 → 5.0.25

package/_site/scripts/hook-trigger.js

@@ -1,158 +1,158 @@
-const http = require('http');
-const crypto = require('crypto');
-const fs = require('fs');
-const path = require('path');
-const { execFileSync } = require('child_process');
-const { getDataDir } = require('../lib/data-dir');
-const { readLiveEndpoint } = require('../lib/runtime-endpoint');
-const { StorageLayout } = require('../lib/storage-layout');
-const { Logger } = require('../lib/structured-logger');
-const { BridgeAdapter } = require('../lib/bridge-adapter');
-const { resolveGitPath } = require('../lib/git-path');
-
-let bridgeIdentityModule = null;
-try {
-  const bridgePackage = require('@sanqianx/ai-coding-event-bridge-console/src/bridge');
-  if (bridgePackage && typeof bridgePackage.buildRepoIdentityV1 === 'function') bridgeIdentityModule = bridgePackage;
-} catch (_) {
-  bridgeIdentityModule = null;
-}
-
-const args = process.argv.slice(2);
-function arg(name, fallback = '') {
-  const index = args.indexOf(name);
-  return index >= 0 ? (args[index + 1] || fallback) : fallback;
-}
-
-const projectId = arg('--project-id', '');
-const repoRoot = arg('--repo-root', arg('--repo', ''));
-const fallbackHost = arg('--host', '127.0.0.1');
-const fallbackPort = Number(arg('--port', process.env.KB_SITE_PORT || '5757'));
-const dataDir = path.resolve(arg('--data-dir', getDataDir()));
-const layout = new StorageLayout({ dataDir });
-const logger = new Logger({
-  layout,
-  settingsProvider: () => ({ levels: ['trace', 'debug', 'info', 'warn', 'error', 'fatal'] }),
-  context: { component: 'git-hook', projectId },
-});
-const bridge = new BridgeAdapter({ dataDir, modulePath: arg('--bridge-module', ''), bridgeHomeDir: arg('--bridge-home', '') });
-if (bridge.module && typeof bridge.module.buildRepoIdentityV1 === 'function') bridgeIdentityModule = bridge.module;
-const timeoutMs = 2000;
-
-function git(gitArgs, fallback = '') {
-  if (!repoRoot) return fallback;
-  try {
-    return execFileSync('git', ['-C', repoRoot, ...gitArgs], {
-      encoding: 'utf8', windowsHide: true, timeout: timeoutMs,
-      stdio: ['ignore', 'pipe', 'ignore'], env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
-    }).trim();
-  } catch { return fallback; }
-}
-
-function target() {
-  const endpoint = readLiveEndpoint(dataDir);
-  return endpoint ? { host: endpoint.host, port: endpoint.port } : { host: fallbackHost, port: fallbackPort };
-}
-
-function post(body) {
-  return new Promise((resolve, reject) => {
-    const payload = JSON.stringify(body);
-    const endpoint = target();
-    const request = http.request({
-      host: endpoint.host,
-      port: endpoint.port,
-      method: 'POST',
-      path: '/api/hooks/post-commit',
-      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
-      timeout: timeoutMs,
-    }, response => {
-      response.resume();
-      response.on('end', () => resolve(response.statusCode || 0));
-    });
-    request.on('error', reject);
-    request.on('timeout', () => request.destroy(new Error('hook notification timeout')));
-    request.end(payload);
-  });
-}
-
-(async () => {
-  try {
-    if (!projectId || !repoRoot) {
-      await logger.warn('hook.notification.skipped', 'Hook payload is missing project identity or repository root.', { phase: 'validate' });
-      return;
-    }
-    const payload = {
-      schema: 'hook-event/v2',
-      projectId,
-      repoRoot,
-      head: git(['rev-parse', 'HEAD']),
-      branch: git(['branch', '--show-current']),
-    };
-    const operationId = arg('--operation-id', `op-${crypto.randomUUID()}`);
-    // Canonical repo-identity/v1 from the authoritative Git working tree.
-    // The old { commonDir }-only shape must never reach the Bridge again.
-    let repoIdentity = null;
-    if (bridgeIdentityModule) {
-      const toplevel = git(['rev-parse', '--show-toplevel']);
-      if (toplevel) {
-        let workspaceRoot = path.resolve(toplevel);
-        try { workspaceRoot = fs.realpathSync.native(workspaceRoot) || workspaceRoot; } catch { workspaceRoot = path.resolve(toplevel); }
-        const commonDir = git(['rev-parse', '--git-common-dir']);
-        const remoteRaw = git(['config', '--get', 'remote.origin.url']);
-        repoIdentity = bridgeIdentityModule.buildRepoIdentityV1({
-          workspaceRoot,
-          commonDir: commonDir ? resolveGitPath(repoRoot, commonDir) : null,
-          remote: remoteRaw ? bridgeIdentityModule.normalizeGitUrl(remoteRaw) : null,
-        });
-      }
-    }
-    const boundaryResult = await bridge.appendCommitBoundary({
-      projectId,
-      repoIdentity,
-      commitSha: payload.head,
-      parentShas: git(['show', '-s', '--format=%P', 'HEAD']).split(/\s+/).filter(Boolean),
-      branch: payload.branch || null,
-      committedAt: git(['show', '-s', '--format=%cI', 'HEAD']) || new Date().toISOString(),
-      operationId,
-    });
-    payload.operationId = operationId;
-    payload.boundary = boundaryResult;
-    if (boundaryResult.status === 'captured') {
-      await logger.debug('hook.boundary.captured', 'Commit conversation boundary was durably captured.', {
-        operationId,
-        phase: 'boundary',
-        commitSha: payload.head,
-        context: {
-          bridgeCursorAtCommit: boundaryResult.boundary.bridgeCursorAtCommit,
-          openTurnCount: boundaryResult.boundary.openTurnIdsAtCommit.length,
-        },
-      });
-    } else {
-      await logger.warn('hook.boundary.unavailable', 'Commit conversation boundary could not be captured.', {
-        operationId,
-        phase: 'boundary',
-        commitSha: payload.head,
-        context: { gapId: boundaryResult.gap && boundaryResult.gap.gapId, reason: boundaryResult.gap && boundaryResult.gap.reason },
-      });
-    }
-    try {
-      const status = await post(payload);
-      if (status < 200 || status >= 300) {
-        await logger.warn('hook.notification.failed', 'Knowledge service rejected the Hook notification.', { phase: 'notify', context: { status } });
-      } else {
-        await logger.debug('hook.notification.completed', 'Hook notification delivered.', { phase: 'notify' });
-      }
-    } catch (error) {
-      await logger.warn('hook.notification.degraded', 'Knowledge service is unavailable; this commit was not submitted for knowledge analysis.', { phase: 'notify', error });
-    }
-  } catch (error) {
-    await logger.error('hook.script.failed', 'Hook trigger failed.', { phase: 'runtime', error });
-  } finally {
-    await logger.close();
-  }
-})().then(() => process.exit(0), async error => {
-  try { await logger.error('hook.script.failed', 'Hook trigger failed unexpectedly.', { error }); await logger.close(); } catch {
-    // Hook execution must always exit zero even when logging is unavailable.
-  }
-  process.exit(0);
-});
+const http = require('http');
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const { getDataDir } = require('../lib/data-dir');
+const { readLiveEndpoint } = require('../lib/runtime-endpoint');
+const { StorageLayout } = require('../lib/storage-layout');
+const { Logger } = require('../lib/structured-logger');
+const { BridgeAdapter } = require('../lib/bridge-adapter');
+const { resolveGitPath } = require('../lib/git-path');
+
+let bridgeIdentityModule = null;
+try {
+  const bridgePackage = require('@sanqianx/ai-coding-event-bridge-console/src/bridge');
+  if (bridgePackage && typeof bridgePackage.buildRepoIdentityV1 === 'function') bridgeIdentityModule = bridgePackage;
+} catch (_) {
+  bridgeIdentityModule = null;
+}
+
+const args = process.argv.slice(2);
+function arg(name, fallback = '') {
+  const index = args.indexOf(name);
+  return index >= 0 ? (args[index + 1] || fallback) : fallback;
+}
+
+const projectId = arg('--project-id', '');
+const repoRoot = arg('--repo-root', arg('--repo', ''));
+const fallbackHost = arg('--host', '127.0.0.1');
+const fallbackPort = Number(arg('--port', process.env.KB_SITE_PORT || '5757'));
+const dataDir = path.resolve(arg('--data-dir', getDataDir()));
+const layout = new StorageLayout({ dataDir });
+const logger = new Logger({
+  layout,
+  settingsProvider: () => ({ levels: ['trace', 'debug', 'info', 'warn', 'error', 'fatal'] }),
+  context: { component: 'git-hook', projectId },
+});
+const bridge = new BridgeAdapter({ dataDir, modulePath: arg('--bridge-module', ''), bridgeHomeDir: arg('--bridge-home', '') });
+if (bridge.module && typeof bridge.module.buildRepoIdentityV1 === 'function') bridgeIdentityModule = bridge.module;
+const timeoutMs = 2000;
+
+function git(gitArgs, fallback = '') {
+  if (!repoRoot) return fallback;
+  try {
+    return execFileSync('git', ['-C', repoRoot, ...gitArgs], {
+      encoding: 'utf8', windowsHide: true, timeout: timeoutMs,
+      stdio: ['ignore', 'pipe', 'ignore'], env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+    }).trim();
+  } catch { return fallback; }
+}
+
+function target() {
+  const endpoint = readLiveEndpoint(dataDir);
+  return endpoint ? { host: endpoint.host, port: endpoint.port } : { host: fallbackHost, port: fallbackPort };
+}
+
+function post(body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const endpoint = target();
+    const request = http.request({
+      host: endpoint.host,
+      port: endpoint.port,
+      method: 'POST',
+      path: '/api/hooks/post-commit',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+      timeout: timeoutMs,
+    }, response => {
+      response.resume();
+      response.on('end', () => resolve(response.statusCode || 0));
+    });
+    request.on('error', reject);
+    request.on('timeout', () => request.destroy(new Error('hook notification timeout')));
+    request.end(payload);
+  });
+}
+
+(async () => {
+  try {
+    if (!projectId || !repoRoot) {
+      await logger.warn('hook.notification.skipped', 'Hook payload is missing project identity or repository root.', { phase: 'validate' });
+      return;
+    }
+    const payload = {
+      schema: 'hook-event/v2',
+      projectId,
+      repoRoot,
+      head: git(['rev-parse', 'HEAD']),
+      branch: git(['branch', '--show-current']),
+    };
+    const operationId = arg('--operation-id', `op-${crypto.randomUUID()}`);
+    // Canonical repo-identity/v1 from the authoritative Git working tree.
+    // The old { commonDir }-only shape must never reach the Bridge again.
+    let repoIdentity = null;
+    if (bridgeIdentityModule) {
+      const toplevel = git(['rev-parse', '--show-toplevel']);
+      if (toplevel) {
+        let workspaceRoot = path.resolve(toplevel);
+        try { workspaceRoot = fs.realpathSync.native(workspaceRoot) || workspaceRoot; } catch { workspaceRoot = path.resolve(toplevel); }
+        const commonDir = git(['rev-parse', '--git-common-dir']);
+        const remoteRaw = git(['config', '--get', 'remote.origin.url']);
+        repoIdentity = bridgeIdentityModule.buildRepoIdentityV1({
+          workspaceRoot,
+          commonDir: commonDir ? resolveGitPath(repoRoot, commonDir) : null,
+          remote: remoteRaw ? bridgeIdentityModule.normalizeGitUrl(remoteRaw) : null,
+        });
+      }
+    }
+    const boundaryResult = await bridge.appendCommitBoundary({
+      projectId,
+      repoIdentity,
+      commitSha: payload.head,
+      parentShas: git(['show', '-s', '--format=%P', 'HEAD']).split(/\s+/).filter(Boolean),
+      branch: payload.branch || null,
+      committedAt: git(['show', '-s', '--format=%cI', 'HEAD']) || new Date().toISOString(),
+      operationId,
+    });
+    payload.operationId = operationId;
+    payload.boundary = boundaryResult;
+    if (boundaryResult.status === 'captured') {
+      await logger.debug('hook.boundary.captured', 'Commit conversation boundary was durably captured.', {
+        operationId,
+        phase: 'boundary',
+        commitSha: payload.head,
+        context: {
+          bridgeCursorAtCommit: boundaryResult.boundary.bridgeCursorAtCommit,
+          openTurnCount: boundaryResult.boundary.openTurnIdsAtCommit.length,
+        },
+      });
+    } else {
+      await logger.warn('hook.boundary.unavailable', 'Commit conversation boundary could not be captured.', {
+        operationId,
+        phase: 'boundary',
+        commitSha: payload.head,
+        context: { gapId: boundaryResult.gap && boundaryResult.gap.gapId, reason: boundaryResult.gap && boundaryResult.gap.reason },
+      });
+    }
+    try {
+      const status = await post(payload);
+      if (status < 200 || status >= 300) {
+        await logger.warn('hook.notification.failed', 'Knowledge service rejected the Hook notification.', { phase: 'notify', context: { status } });
+      } else {
+        await logger.debug('hook.notification.completed', 'Hook notification delivered.', { phase: 'notify' });
+      }
+    } catch (error) {
+      await logger.warn('hook.notification.degraded', 'Knowledge service is unavailable; this commit was not submitted for knowledge analysis.', { phase: 'notify', error });
+    }
+  } catch (error) {
+    await logger.error('hook.script.failed', 'Hook trigger failed.', { phase: 'runtime', error });
+  } finally {
+    await logger.close();
+  }
+})().then(() => process.exit(0), async error => {
+  try { await logger.error('hook.script.failed', 'Hook trigger failed unexpectedly.', { error }); await logger.close(); } catch {
+    // Hook execution must always exit zero even when logging is unavailable.
+  }
+  process.exit(0);
+});

package/_site/scripts/install-module-candidates.js

@@ -1,69 +1,69 @@
-'use strict';
-const fs = require('node:fs');
-const os = require('node:os');
-const path = require('node:path');
-const crypto = require('node:crypto');
-const { createRequire } = require('node:module');
-const { spawnSync } = require('node:child_process');
-const AtomicFile = require('../lib/atomic-file');
-const { verifyInstalled, safeRelative } = require('./pack-module-candidates');
-const root = path.resolve(__dirname, '../..');
-const npmCli = process.env.npm_execpath || path.join(path.dirname(process.execPath), 'node_modules/npm/bin/npm-cli.js');
-function run(args, cwd) {
-  const result = spawnSync(process.execPath, [npmCli, ...args], { cwd, windowsHide: true, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
-  if (result.status !== 0) throw new Error(`npm ${args[0]} failed (${result.status})`);
-  return result.stdout;
-}
-function contentAddressedArtifact(packedCore) {
-  const sha256 = crypto.createHash('sha256').update(fs.readFileSync(packedCore)).digest('hex');
-  const file = packedCore.replace(/\.tgz$/, `-${sha256}.tgz`);
-  if (file === packedCore) throw new Error('Candidate must be a tarball');
-  fs.copyFileSync(packedCore, file);
-  return { file, sha256 };
-}
-function main() {
-  const manifestFile = path.resolve(process.argv[2]);
-  const manifest = JSON.parse(fs.readFileSync(manifestFile));
-  if (manifest.schema !== 'project-knowledge/module-candidates/v1') throw new Error('Invalid candidate manifest');
-  const artifactRoot = path.dirname(manifestFile);
-  const dependencies = {};
-  for (const module of Object.values(manifest.modules)) {
-    if (!safeRelative(module.tarball) || !module.tarball.endsWith('.tgz')) throw new Error('Unsafe artifact path');
-    const file = path.join(artifactRoot, module.tarball);
-    if (fs.lstatSync(file).isSymbolicLink() || crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex') !== module.sha256) throw new Error('Module artifact drift');
-    dependencies[module.installName] = `file:${file}`;
-  }
-  const candidate = JSON.parse(run(['pack', '--ignore-scripts', '--json', '--pack-destination', artifactRoot], root))[0];
-  const packedCore = path.join(artifactRoot, candidate.filename);
-  // Same-version local tarballs are cached by npm. Address each candidate by
-  // content so an update cannot silently keep an older runtime or UI.
-  const { sha256: shellSha256, file: shellArtifact } = contentAddressedArtifact(packedCore);
-  dependencies['@sanqianx/project-knowledge'] = `file:${shellArtifact}`;
-  const updateAt = process.argv.indexOf('--update');
-  const installedRoot = updateAt < 0 ? fs.mkdtempSync(path.join(os.tmpdir(), 'kb-installed-product-')) : path.resolve(process.argv[updateAt + 1]);
-  if (path.dirname(installedRoot) !== path.resolve(os.tmpdir()) || !path.basename(installedRoot).startsWith('kb-installed-product-') || fs.lstatSync(installedRoot).isSymbolicLink()) throw new Error('Only this task’s isolated installation can be updated');
-  if (updateAt >= 0 && JSON.parse(fs.readFileSync(path.join(installedRoot, 'installation-acceptance.json'))).installedRoot !== installedRoot) throw new Error('Installed fixture identity mismatch');
-  AtomicFile.writeJsonAtomic(path.join(installedRoot, 'package.json'), { name: 'kb-local-acceptance', version: '0.0.0', private: true, dependencies });
-  process.stdout.write(`Installing isolated product at ${installedRoot}\n`);
-  run(['install', '--omit=dev', '--ignore-scripts', '--no-audit', '--no-fund'], installedRoot);
-  verifyInstalled(manifest, installedRoot);
-  const core = path.join(installedRoot, 'node_modules/@sanqianx/project-knowledge');
-  const resolver = createRequire(path.join(core, 'package.json'));
-  for (const module of Object.values(manifest.modules)) {
-    const actual = resolver.resolve(`${module.installName}/package.json`);
-    if (actual !== path.join(installedRoot, 'node_modules', module.installName, 'package.json')) throw new Error(`A nested stale module shadows the tested candidate: ${module.installName}`);
-  }
-  const verify = spawnSync(process.execPath, [path.join(core, '_site/scripts/verify-module-runtime.js'), '--working-tree'], { cwd: installedRoot, windowsHide: true, encoding: 'utf8' });
-  if (verify.status !== 0) throw new Error('Packaged engine integrity failed');
-  require('./verify-product-runtime').verifyProductRuntime(core);
-  for (const relative of ['vendor-manifest.json', 'module-runtime-manifest.json']) {
-    if (!fs.readFileSync(path.join(core, relative)).equals(fs.readFileSync(path.join(root, relative)))) throw new Error(`Installed candidate is stale: ${relative}`);
-  }
-  const report = { schema: 'project-knowledge/installed-candidates/v1', mode: 'local npm candidate installation, not remote release', installedRoot, core, artifactManifest: manifestFile, shellVersion: candidate.version, shellSha256, shellArtifact, modules: Object.fromEntries(Object.entries(manifest.modules).map(([key, module]) => [key, { version: module.version, sha256: module.sha256 }])), integrityPassed: true, testedAt: new Date().toISOString() };
-  AtomicFile.writeJsonAtomic(path.join(installedRoot, 'installation-acceptance.json'), report);
-  process.stdout.write(`INSTALLED_PRODUCT ${path.join(installedRoot, 'installation-acceptance.json')}\n`);
-}
-if (require.main === module) {
-  try { main(); } catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 1; }
-}
-module.exports = { contentAddressedArtifact };
+'use strict';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { createRequire } = require('node:module');
+const { spawnSync } = require('node:child_process');
+const AtomicFile = require('../lib/atomic-file');
+const { verifyInstalled, safeRelative } = require('./pack-module-candidates');
+const root = path.resolve(__dirname, '../..');
+const npmCli = process.env.npm_execpath || path.join(path.dirname(process.execPath), 'node_modules/npm/bin/npm-cli.js');
+function run(args, cwd) {
+  const result = spawnSync(process.execPath, [npmCli, ...args], { cwd, windowsHide: true, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+  if (result.status !== 0) throw new Error(`npm ${args[0]} failed (${result.status})`);
+  return result.stdout;
+}
+function contentAddressedArtifact(packedCore) {
+  const sha256 = crypto.createHash('sha256').update(fs.readFileSync(packedCore)).digest('hex');
+  const file = packedCore.replace(/\.tgz$/, `-${sha256}.tgz`);
+  if (file === packedCore) throw new Error('Candidate must be a tarball');
+  fs.copyFileSync(packedCore, file);
+  return { file, sha256 };
+}
+function main() {
+  const manifestFile = path.resolve(process.argv[2]);
+  const manifest = JSON.parse(fs.readFileSync(manifestFile));
+  if (manifest.schema !== 'project-knowledge/module-candidates/v1') throw new Error('Invalid candidate manifest');
+  const artifactRoot = path.dirname(manifestFile);
+  const dependencies = {};
+  for (const module of Object.values(manifest.modules)) {
+    if (!safeRelative(module.tarball) || !module.tarball.endsWith('.tgz')) throw new Error('Unsafe artifact path');
+    const file = path.join(artifactRoot, module.tarball);
+    if (fs.lstatSync(file).isSymbolicLink() || crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex') !== module.sha256) throw new Error('Module artifact drift');
+    dependencies[module.installName] = `file:${file}`;
+  }
+  const candidate = JSON.parse(run(['pack', '--ignore-scripts', '--json', '--pack-destination', artifactRoot], root))[0];
+  const packedCore = path.join(artifactRoot, candidate.filename);
+  // Same-version local tarballs are cached by npm. Address each candidate by
+  // content so an update cannot silently keep an older runtime or UI.
+  const { sha256: shellSha256, file: shellArtifact } = contentAddressedArtifact(packedCore);
+  dependencies['@sanqianx/project-knowledge'] = `file:${shellArtifact}`;
+  const updateAt = process.argv.indexOf('--update');
+  const installedRoot = updateAt < 0 ? fs.mkdtempSync(path.join(os.tmpdir(), 'kb-installed-product-')) : path.resolve(process.argv[updateAt + 1]);
+  if (path.dirname(installedRoot) !== path.resolve(os.tmpdir()) || !path.basename(installedRoot).startsWith('kb-installed-product-') || fs.lstatSync(installedRoot).isSymbolicLink()) throw new Error('Only this task’s isolated installation can be updated');
+  if (updateAt >= 0 && JSON.parse(fs.readFileSync(path.join(installedRoot, 'installation-acceptance.json'))).installedRoot !== installedRoot) throw new Error('Installed fixture identity mismatch');
+  AtomicFile.writeJsonAtomic(path.join(installedRoot, 'package.json'), { name: 'kb-local-acceptance', version: '0.0.0', private: true, dependencies });
+  process.stdout.write(`Installing isolated product at ${installedRoot}\n`);
+  run(['install', '--omit=dev', '--ignore-scripts', '--no-audit', '--no-fund'], installedRoot);
+  verifyInstalled(manifest, installedRoot);
+  const core = path.join(installedRoot, 'node_modules/@sanqianx/project-knowledge');
+  const resolver = createRequire(path.join(core, 'package.json'));
+  for (const module of Object.values(manifest.modules)) {
+    const actual = resolver.resolve(`${module.installName}/package.json`);
+    if (actual !== path.join(installedRoot, 'node_modules', module.installName, 'package.json')) throw new Error(`A nested stale module shadows the tested candidate: ${module.installName}`);
+  }
+  const verify = spawnSync(process.execPath, [path.join(core, '_site/scripts/verify-module-runtime.js'), '--working-tree'], { cwd: installedRoot, windowsHide: true, encoding: 'utf8' });
+  if (verify.status !== 0) throw new Error('Packaged engine integrity failed');
+  require('./verify-product-runtime').verifyProductRuntime(core);
+  for (const relative of ['vendor-manifest.json', 'module-runtime-manifest.json']) {
+    if (!fs.readFileSync(path.join(core, relative)).equals(fs.readFileSync(path.join(root, relative)))) throw new Error(`Installed candidate is stale: ${relative}`);
+  }
+  const report = { schema: 'project-knowledge/installed-candidates/v1', mode: 'local npm candidate installation, not remote release', installedRoot, core, artifactManifest: manifestFile, shellVersion: candidate.version, shellSha256, shellArtifact, modules: Object.fromEntries(Object.entries(manifest.modules).map(([key, module]) => [key, { version: module.version, sha256: module.sha256 }])), integrityPassed: true, testedAt: new Date().toISOString() };
+  AtomicFile.writeJsonAtomic(path.join(installedRoot, 'installation-acceptance.json'), report);
+  process.stdout.write(`INSTALLED_PRODUCT ${path.join(installedRoot, 'installation-acceptance.json')}\n`);
+}
+if (require.main === module) {
+  try { main(); } catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 1; }
+}
+module.exports = { contentAddressedArtifact };