@sanqianx/project-knowledge 5.0.9-rc.11 → 5.0.9-rc.13

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "project-knowledge",
-      "version": "5.0.9-rc.11",
+      "version": "5.0.9-rc.13",
       "source": "./plugins/project-knowledge",
       "description": "Search durable project decisions and implementation history through MCP."
     }

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [5.0.9-rc.13] - 2026-10-11
+
+- Give native Agent session creation and input setup a bounded 90-second proxy
+  budget. Ordinary API reads/abort/permissions retain 10 seconds; SSE streaming
+  and folder-picker contracts are unchanged.
+- Record safe proxy failure categories and deadlines without raw errors or URL
+  queries. Preserve MODULE_UNREACHABLE compatibility and add optional details.
+- Reproduce the installed OpenCode cold-start failure with a real delayed HTTP
+  server; verify the targeted budget, unrelated routes and credential redaction.
+- Retain rc.12 real acceptance and failed OpenCode results separately; require
+  a newly downloaded candidate and cold-client retest before user upgrade.
+
+## [5.0.9-rc.12] - 2026-10-11
+
+- Vendor engine 0.2.3-rc.6 to address the Windows transient state-file rename
+  failure exposed by installed rc.11 fault acceptance. Use exclusive random
+  temporary files and bounded sharing retries, retain durable state on failure,
+  and never unlink live state to force replacement.
+- Add deterministic sharing-violation, permanent-lock, foreign-temp and
+  disk-full regressions; all 39 engine tests pass on Node 22 and Node 24.
+- Preserve the rc.11 failure and require new installed acceptance before any
+  existing-user upgrade or stable latest promotion.
+
 ## [5.0.9-rc.11] - 2026-10-11
 
 - Pin vector-hub 1.0.8-rc.3 and vendor engine 0.2.3-rc.5. Raw commit

package/_modules/knowledge-engine/README.md

@@ -84,6 +84,7 @@ node src/bin.js serve [--port 5790] [--host 127.0.0.1] [--data DIR]
 - 已晋升提交的 SHA 或短 SHA 在自然语言查询中仍作为标识符匹配，只返回当前文件的晋升依据；仅在原始会话中提到相同 SHA 不构成知识晋升引用。多个提交标识符可以一起查询。
 - 候选必须有已晋升文件中的引用依据，未确认候选不能进入任务。确认记录原子持久化后写共享记忆文件，派生索引异步更新，索引失败不会撤销有效记忆。
 - 旧格式不读取、不自动迁移。损坏的正式状态不覆盖、不清空。
+- 引擎状态复用受控原子写入：独占随机临时文件、文件同步、Windows 短暂共享冲突有界重试；永久失败保留原状态并清理本次临时文件，绝不先删正式状态。
 
 ## 验证与尚未验收项
 

package/_modules/knowledge-engine/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanqianx/ai-coding-knowledge-engine",
-  "version": "0.2.3-rc.5",
+  "version": "0.2.3-rc.6",
   "description": "Knowledge engine module for project-knowledge: commit-boundary triggered knowledge analysis/generation (trigger plane) and retrieval for development assistants (retrieval plane).",
   "license": "Apache-2.0",
   "main": "src/server.js",

package/_modules/knowledge-engine/src/store.js

@@ -5,6 +5,7 @@ const path = require('path');
 const crypto = require('crypto');
 const { validateProjectId } = require('./runtime/contracts');
 const { RuntimeLayout } = require('./runtime/layout');
+const AtomicFile = require('./runtime/atomic-file');
 
 /**
  * 单文件 JSON 状态层（<data>/engine-state.json）：注册项目、分析运行、事件流。
@@ -56,12 +57,9 @@ class EngineStore {
   }
 
   save() {
-    fs.mkdirSync(this.dataDir, { recursive: true });
-    const tmp = this.file + '.tmp';
-    const fd = fs.openSync(tmp, 'w', 0o600);
-    try { fs.writeFileSync(fd, JSON.stringify(this.state, null, 2), 'utf8'); fs.fsyncSync(fd); }
-    finally { fs.closeSync(fd); }
-    fs.renameSync(tmp, this.file);
+    // Windows scanners/readers may briefly hold the destination; never unlink
+    // durable state to force a replace, or share a fixed temp name with writers.
+    AtomicFile.writeJsonAtomic(this.file, this.state);
   }
 
   listProjects() {

package/_site/_test/module-agent-start-proxy-test.js

@@ -0,0 +1,65 @@
+'use strict';
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const { Readable } = require('node:stream');
+const { EventEmitter } = require('node:events');
+const { ModuleBridge } = require('../lib/module-bridge');
+
+async function budget(method, pathname) {
+  const timers = [], originalTimer = global.setTimeout, originalFetch = global.fetch;
+  const req = Readable.from([]); req.method = method; req.headers = {};
+  const res = new EventEmitter();
+  res.writeHead = () => {}; res.end = () => { res.writableEnded = true; };
+  try {
+    global.setTimeout = (fn, ms, ...args) => { timers.push(ms); return originalTimer(fn, ms, ...args); };
+    global.fetch = async () => new Response('{}', { headers: { 'Content-Type': 'application/json' } });
+    await new ModuleBridge().proxy(req, res, 'http://127.0.0.1:5760' + pathname);
+    return timers[0];
+  } finally { global.setTimeout = originalTimer; global.fetch = originalFetch; }
+}
+
+(async () => {
+  const upstream = http.createServer((req, res) => {
+    const timer = setTimeout(() => { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end('{"accepted":true}'); }, 11000);
+    res.on('close', () => clearTimeout(timer));
+  });
+  await new Promise(resolve => upstream.listen(0, '127.0.0.1', resolve));
+  const bridge = new ModuleBridge();
+  const target = `http://127.0.0.1:${upstream.address().port}/api/claude-workbench/v1/sessions/cold-client/input`;
+  const shell = http.createServer((req, res) => bridge.proxy(req, res, target));
+  await new Promise(resolve => shell.listen(0, '127.0.0.1', resolve));
+  try {
+    const response = await fetch(`http://127.0.0.1:${shell.address().port}/send`, { method: 'POST', body: '{}' });
+    assert.equal(response.status, 200, 'cold native client startup must not be reported as unreachable after ten seconds');
+    assert.equal((await response.json()).accepted, true);
+  } finally {
+    for (const server of [shell, upstream]) { server.closeAllConnections(); await new Promise(resolve => server.close(resolve)); }
+  }
+  assert.equal(await budget('POST', '/api/claude-workbench/v1/sessions'), 90000);
+  assert.equal(await budget('POST', '/api/claude-workbench/v1/sessions/cold-client/input?scope=project'), 90000);
+  for (const [method, route] of [
+    ['GET', '/api/claude-workbench/v1/sessions'],
+    ['POST', '/api/claude-workbench/v1/sessions/cold-client/abort'],
+    ['POST', '/api/claude-workbench/v1/sessions/cold-client/permission'],
+    ['POST', '/api/engine/runs'],
+    ['POST', '/api/sessions/cold-client/input'],
+  ]) assert.equal(await budget(method, route), 10000, 'unrelated APIs must keep their ordinary timeout');
+  assert.equal(await budget('POST', '/api/claude-workbench/v1/system/pick-folder'), 600000);
+  const originalFetch = global.fetch;
+  let warning, failure;
+  const request = Readable.from([]); request.method = 'GET'; request.headers = {};
+  const response = new EventEmitter(); response.writeHead = () => {};
+  response.end = bytes => { response.writableEnded = true; failure = JSON.parse(bytes); };
+  try {
+    global.fetch = async () => { throw new Error('upstream leaked credential: secret-proxy-fixture'); };
+    const safeBridge = new ModuleBridge({ logger: { warn(...args) { warning = args; } } });
+    await safeBridge.proxy(request, response, 'http://127.0.0.1:5760/api/health?apiKey=secret-proxy-fixture');
+    assert.equal(failure.error, 'MODULE_UNREACHABLE');
+    assert.equal(failure.details.failureKind, 'NETWORK_ERROR');
+    assert.equal(failure.details.timeoutMs, 10000);
+    assert.equal(warning[0], 'module.proxy.failed');
+    assert.equal(warning[2].context.path, '/api/health');
+    assert.ok(!JSON.stringify([failure, warning]).includes('secret-proxy-fixture'), 'diagnostics omit queries, raw errors and credentials');
+  } finally { global.fetch = originalFetch; }
+  console.log('module-agent-start-proxy-test PASS');
+})().catch(error => { console.error(error); process.exitCode = 1; });

package/_site/lib/module-bridge.js

@@ -31,6 +31,9 @@ const { once } = require('events');
 const { DomainError } = require('./contracts');
 
 const PROXY_TIMEOUT_MS = 10000;
+// Native client startup includes knowledge retrieval and a local server/CLI
+// handshake. It has a bounded setup budget, separate from ordinary reads/SSE.
+const AGENT_START_TIMEOUT_MS = 90000;
 // Registration drives a full embedding pass in vector-hub (remote API); a
 // fresh knowledge folder can easily exceed the interactive proxy budget.
 const REGISTER_TIMEOUT_MS = 60000;
@@ -131,7 +134,11 @@ class ModuleBridge {
     // The native folder pickers hold the request open until the user closes
     // the dialog — they need a human-scale budget, not the API budget.
     const isPicker = /\/(system\/)?pick-folder/.test(target);
-    const timeoutMs = isPicker ? PICKER_TIMEOUT_MS : PROXY_TIMEOUT_MS;
+    const targetUrl = new URL(target);
+    const pathname = targetUrl.pathname;
+    const isAgentStart = req.method === 'POST' && /^\/api\/claude-workbench\/v1\/sessions(?:\/[^/]+\/input)?\/?$/.test(pathname);
+    const timeoutMs = isPicker ? PICKER_TIMEOUT_MS : isAgentStart ? AGENT_START_TIMEOUT_MS : PROXY_TIMEOUT_MS;
+    const startedAt = Date.now();
     let upstream;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -148,8 +155,13 @@ class ModuleBridge {
       clearTimeout(timer);
       res.off?.('close', disconnected);
       if (res.destroyed) return;
+      const details = { failureKind: controller.signal.aborted ? 'UPSTREAM_TIMEOUT' : 'NETWORK_ERROR', timeoutMs };
+      this.logger.warn('module.proxy.failed', '模块请求未完成，请检查连接或客户端启动。', {
+        component: 'module-bridge', phase: 'proxy', durationMs: Date.now() - startedAt,
+        context: { ...details, method: req.method, path: pathname },
+      });
       res.writeHead(502, { 'Content-Type': 'application/json; charset=utf-8' });
-      res.end(JSON.stringify({ ok: false, error: 'MODULE_UNREACHABLE', target }));
+      res.end(JSON.stringify({ ok: false, error: 'MODULE_UNREACHABLE', target: targetUrl.origin + pathname, details }));
       return;
     }
     const contentType = upstream.headers.get('content-type') || 'application/json; charset=utf-8';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanqianx/project-knowledge",
-  "version": "5.0.9-rc.11",
+  "version": "5.0.9-rc.13",
   "description": "Knowledge base manager with Git integration, AI-driven analysis, and bilingual (zh-CN/en-US) knowledge output",
   "main": "_site/server.js",
   "scripts": {

package/plugins/project-knowledge/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "project-knowledge",
-  "version": "5.0.9-rc.11",
+  "version": "5.0.9-rc.13",
   "description": "Read durable project decisions and implementation history from Project Knowledge.",
   "author": {
     "name": "SanQianX",

package/plugins/project-knowledge/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "project-knowledge",
-  "version": "5.0.9-rc.11",
+  "version": "5.0.9-rc.13",
   "description": "Read durable project decisions and implementation history from Project Knowledge.",
   "author": {
     "name": "SanQianX",

package/plugins/project-knowledge/.mcp.json

@@ -6,7 +6,7 @@
       "args": [
         "-y",
         "--package",
-        "@sanqianx/project-knowledge@5.0.9-rc.11",
+        "@sanqianx/project-knowledge@5.0.9-rc.13",
         "project-knowledge-mcp"
       ]
     }

package/vendor-manifest.json

@@ -3,11 +3,11 @@
   "modules": {
     "knowledge-engine": {
       "name": "@sanqianx/ai-coding-knowledge-engine",
-      "version": "0.2.3-rc.5",
+      "version": "0.2.3-rc.6",
       "root": "_modules/knowledge-engine",
       "files": {
-        "README.md": "8c501eebd770b4a54f3ec97bb2c21b8953eed7d7b21ce1a0ecdb9e11ac795c7b",
-        "package.json": "bb46aa0bb25124f104eedd14287003201da26d6dfdbd0bde9218d65997eb0801",
+        "README.md": "efcef635df01736a8672219642a76175f3059d23b466f529140d791ec75000d5",
+        "package.json": "09e32aacd4ec5c3b596e60f3210f62515c625844e31866261c5596937195db30",
         "src/analysis-contract.js": "fee063967d32eefc955cf0729f7dc8cb31bd690b85e22471c9059494a599c77a",
         "src/analysis-output.js": "95a3c19dcc9ab85d1dba7fee5b9aec80f9c000dfba89da3fd0be25a81e2fb680",
         "src/analysis-worker.js": "a105cabe6e1573b2d986b1e7a5aaf615e2fb53524156fc8e4e2c0a71f2c97e55",
@@ -39,7 +39,7 @@
         "src/runtime/markdown-knowledge-indexer.js": "4d6b5b955849d274ca0614ef030c94526da7c39ab0874f02c168d0681f5b1406",
         "src/runtime/scanner.js": "d99fa8d74a6fbbaae75ca49f62127e14cf9e48b1404e4b4d597ef39df5441410",
         "src/server.js": "7deff466d28b94ec8975cd87ebd55c59d0aa6b49a8dfa447b552b1d32aa9c4b7",
-        "src/store.js": "71f0417c2c1e42b89429e3dee1adff7b2c09e86682cb3f4843ce6d9e5aafd7ec",
+        "src/store.js": "7dd1a60fd5338cf91ff8836c0c18f29b101dcaf17d4b9f07d07716799543f577",
         "ui/app.css": "7ad370c269e60a7b5ec907d81a607b2d16bd07b2d7c22a81f102dab51eeb2889",
         "ui/app.js": "33a2ba38f0dafbbb2e30a1eb3fc93476bfcaf528e124e1a9b2edd2fb69221e9e",
         "ui/index.html": "ce3565cfefd4838b11d37a91a906ef26ca5a1834844fe3f7c897b56851a3c418"