@sanqianx/project-knowledge 5.0.9-rc.14 → 5.0.9-rc.15

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
   "plugins": [
     {
       "name": "project-knowledge",
-      "version": "5.0.9-rc.14",
+      "version": "5.0.9-rc.15",
       "source": "./plugins/project-knowledge",
       "description": "Search durable project decisions and implementation history through MCP."
     }

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [5.0.9-rc.15] - 2026-10-11
+
+- Serialize registration, module removal and registry deletion for each project.
+  Recheck membership inside the wiring lease so delayed supervisor registration
+  cannot resurrect a project after keep-data unbind. Unrelated projects remain
+  independent; failed deletion can still be repaired and retried.
+- Reproduce the race with a delayed real HTTP registration and preserve the
+  downloaded rc.14 Node 22 UI failure. Include the regression in the package.
+- Use non-binding CLI readiness probes in tests; the old bind probe could take
+  the exact port while its own foreground child was starting.
+- Real MiniMax acceptance covers overlapping analyses, another commit and a
+  dirty developer draft during analysis, streaming, secondary development,
+  four installed clients and evidenced preference candidates. New downloaded
+  candidate acceptance and actual-user cutover still precede stable latest.
+
 ## [5.0.9-rc.14] - 2026-10-11
 
 - Vendor engine 0.2.3-rc.7: isolated maintenance consumes frozen evidence even

package/_site/_test/bin-cli-test.js

@@ -78,12 +78,25 @@ function isPortListening(port) {
 async function waitForListening(port, deadlineMs = 8000) {
   const deadline = Date.now() + deadlineMs;
   while (Date.now() < deadline) {
-    if (await isPortListening(port)) return true;
+    if (await canConnect(port)) return true;
     await new Promise(resolve => setTimeout(resolve, 150));
   }
   return false;
 }
 
+function canConnect(port) {
+  // A bind probe can steal the selected port exactly as the child starts.
+  // Readiness checks must connect, never compete with the server's listener.
+  return new Promise(resolve => {
+    const socket = net.createConnection({ host: '127.0.0.1', port });
+    let settled = false;
+    const finish = result => { if (settled) return; settled = true; socket.destroy(); resolve(result); };
+    socket.setTimeout(500, () => finish(false));
+    socket.once('connect', () => finish(true));
+    socket.once('error', () => finish(false));
+  });
+}
+
 (async () => {
   // Make sure no leftover PID file or server from a previous run.
   removePidFile();
@@ -185,7 +198,7 @@ async function waitForListening(port, deadlineMs = 8000) {
   while (Date.now() < deadline && !detectedPort) {
     const rec = readPidFile();
     if (rec && rec.port && rec.port !== busyPort) {
-      if (await isPortListening(rec.port)) {
+      if (await canConnect(rec.port)) {
         detectedPort = rec.port;
         break;
       }

package/_site/_test/module-bridge-eventbridge-test.js

@@ -108,7 +108,7 @@ async function main() {
       vectorHubUrl: DEAD_URL,
       eventBridgeUrl: stubUrl,
       engineUrl: DEAD_URL,
-      registryStore: { listIds: () => ['demo-proj'] },
+      registryStore: { listIds: () => ['demo-proj'], readDisplaySnapshot: id => id === 'demo-proj' ? { displayName: 'demo' } : null },
       projectStore: makeStoreStub(),
     });
 

package/_site/_test/module-wiring-unbind-race-test.js

@@ -0,0 +1,59 @@
+'use strict';
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const { ModuleBridge } = require('../lib/module-bridge');
+
+async function main() {
+  let releaseRegister, registerStarted, registered = true;
+  const started = new Promise(resolve => { registerStarted = resolve; });
+  const gate = new Promise(resolve => { releaseRegister = resolve; });
+  const engineProjects = new Set();
+  const calls = [];
+  const server = http.createServer(async (req, res) => {
+    req.resume();
+    if (req.method === 'POST' && req.url === '/engine/api/projects') {
+      registerStarted(); await gate;
+      engineProjects.add('project-race'); calls.push('register');
+    }
+    if (req.method === 'DELETE' && req.url === '/engine/api/projects/project-race') { engineProjects.delete('project-race'); calls.push('remove'); }
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify({ ok: true, projects: [], id: 'terminal-race', project: { id: 'event-race' }, sequence: 0 }));
+  });
+  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+  const base = `http://127.0.0.1:${server.address().port}`;
+  const state = { modules: {} };
+  const bridge = new ModuleBridge({ terminalUrl: base + '/terminal', vectorHubUrl: base + '/vector', eventBridgeUrl: base + '/event', engineUrl: base + '/engine', registryStore: { readDisplaySnapshot: () => registered ? { displayName: 'Race' } : null }, projectStore: { readState: () => state, readConfig: () => ({}), updateState: async (_id, apply) => { apply(state); } } });
+  try {
+    const input = { projectId: 'project-race', name: 'Race', workspacePath: process.cwd(), knowledgePath: process.cwd() };
+    const wiring = bridge.registerProjectLinks(input);
+    await started;
+    const removing = bridge.removeProjectLinks({ projectId: 'project-race', onRemoved: async () => { registered = false; } }).then(() => { registered = false; });
+    // A delayed supervisor registration must settle before removal, never after.
+    await new Promise(resolve => setTimeout(resolve, 100)); releaseRegister();
+    await Promise.all([wiring, removing]);
+    assert.deepEqual([...engineProjects], [], 'delayed wiring must not resurrect a removed engine project');
+    assert.deepEqual(calls, ['register', 'remove']);
+    const before = calls.length;
+    const stale = await bridge.registerProjectLinks(input);
+    assert.equal(calls.length, before, 'a stale registry snapshot cannot register an absent project');
+    assert.equal(stale.engine.status, 'removed');
+    assert.equal(bridge.projectWiringQueue?.size || 0, 0, 'settled operations must not leak per-project queues');
+    let releaseOther;
+    const otherGate = new Promise(resolve => { releaseOther = resolve; });
+    const order = [];
+    const held = bridge._withProjectWiring('project-a', async () => { await otherGate; order.push('a'); });
+    const independent = bridge._withProjectWiring('project-b', async () => { order.push('b'); });
+    await independent; assert.deepEqual(order, ['b'], 'unrelated projects do not share a global wiring lock');
+    releaseOther(); await held; assert.deepEqual(order, ['b', 'a']);
+    // Failed deletion keeps its registry, then a retry can still repair/remove it.
+    registered = true;
+    await assert.rejects(bridge.removeProjectLinks({ projectId: 'project-race', onRemoved: async () => { throw new Error('controlled hook conflict'); } }), /controlled hook conflict/);
+    assert.equal(registered, true);
+    await bridge.registerProjectLinks(input);
+    assert.ok(engineProjects.has('project-race'));
+    await bridge.removeProjectLinks({ projectId: 'project-race', onRemoved: async () => { registered = false; } });
+    assert.deepEqual([...engineProjects], []);
+    console.log('module-wiring-unbind-race-test PASS');
+  } finally { releaseRegister(); server.closeAllConnections(); await new Promise(resolve => server.close(resolve)); }
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });

package/_site/lib/engine-connection.js

@@ -24,7 +24,10 @@ async function connectEngine(runtime) {
     step = 'project-wiring';
     for (const id of runtime.registryStore.listIds()) {
       projectId = id;
-      const config = runtime.projectStore.readConfig(id);
+      if (!runtime.registryStore.readDisplaySnapshot(id)) continue;
+      let config;
+      try { config = runtime.projectStore.readConfig(id); }
+      catch (error) { if (!runtime.registryStore.readDisplaySnapshot(id)) continue; throw error; }
       const modules = await bridge.registerProjectLinks({ projectId: id, name: config.displayName, workspacePath: config.repoPath, knowledgePath: config.knowledgePath });
       if (!modules.engine.ok || !modules.eventBridge.ok) throw new Error('PROJECT_WIRING_PENDING');
     }

package/_site/lib/module-bridge.js

@@ -93,6 +93,7 @@ class ModuleBridge {
     this.runtimeToken = options.runtimeToken || crypto.randomBytes(32).toString('hex');
     this.registryStore = options.registryStore || null;
     this.projectStore = options.projectStore || null;
+    this.projectWiringQueue = new Map();
     this.settingsStore = options.settingsStore || null;
     this.dataDir = options.dataDir || null;
     this.supervised = [];
@@ -398,7 +399,24 @@ class ModuleBridge {
    * (retry on the next register call or health-check pass), never a hard error.
    * KB_MODULES_REGISTER=0 disables fan-out entirely (test isolation).
    */
-  async registerProjectLinks({ projectId, name, workspacePath, knowledgePath }) {
+  _withProjectWiring(projectId, action) {
+    const prior = this.projectWiringQueue.get(projectId) || Promise.resolve();
+    const operation = prior.catch(() => {}).then(action);
+    const settled = operation.finally(() => { if (this.projectWiringQueue.get(projectId) === settled) this.projectWiringQueue.delete(projectId); });
+    this.projectWiringQueue.set(projectId, settled);
+    return settled;
+  }
+
+  registerProjectLinks(input) {
+    return this._withProjectWiring(input.projectId, () => {
+      // A supervisor may have captured this project before a concurrent unbind.
+      // Recheck the spine after acquiring the same lease as the removal path.
+      if (this.registryStore && !this.registryStore.readDisplaySnapshot(input.projectId)) return Object.fromEntries(['terminal', 'vectorHub', 'eventBridge', 'engine'].map(key => [key, { ok: true, status: 'removed', skipped: 'project-not-registered' }]));
+      return this._registerProjectLinks(input);
+    });
+  }
+
+  async _registerProjectLinks({ projectId, name, workspacePath, knowledgePath }) {
     const result = { terminal: { ok: false }, vectorHub: { ok: false }, eventBridge: { ok: false }, engine: { ok: false } };
     if (String(process.env.KB_MODULES_REGISTER || '') === '0') {
       result.terminal = { ok: false, status: 'disabled' };
@@ -490,7 +508,17 @@ class ModuleBridge {
    * only drops its derived index (source untouched); terminal removes the project
    * with keepSessions=1 so session records survive; the event-bridge console only
    * unregisters the project — journals and sealed commit documents stay on disk. */
-  async removeProjectLinks({ projectId, requireEngine = true }) {
+  removeProjectLinks(input) {
+    return this._withProjectWiring(input.projectId, async () => {
+      const result = await this._removeProjectLinks(input);
+      // The caller owns registry/lifecycle changes. Hold the wiring lease until
+      // its transaction settles, so delayed reconfiguration cannot resurrect it.
+      await input.onRemoved?.(result);
+      return result;
+    });
+  }
+
+  async _removeProjectLinks({ projectId, requireEngine = true }) {
     const wiring = (this.projectStore ? this.projectStore.readState(projectId).modules : null) || {};
     const result = { terminal: { ok: false }, vectorHub: { ok: false }, eventBridge: { ok: false }, engine: { ok: false } };
     // Stop the writer first, before removing hooks/index registrations.

package/_site/lib/server-app.js

@@ -1057,11 +1057,13 @@ function createRequestHandler(runtime, options = {}) {
           throw new DomainError('PROJECT_NOT_FOUND', 'Project was not found.', { status: 404 });
         }
         const body = await readJsonBody(req);
-        if (runtime.registryStore.readDisplaySnapshot(projectId)) await runtime.moduleBridge.removeProjectLinks({ projectId, requireEngine: runtime.analysisOwner !== 'legacy' });
-        const result = await runtime.lifecycleService.deleteProject(projectId, {
+        const remove = () => runtime.lifecycleService.deleteProject(projectId, {
           deleteKnowledge: body.deleteKnowledge === true,
           confirmationToken: body.confirmationToken || '',
         });
+        let result;
+        if (runtime.registryStore.readDisplaySnapshot(projectId)) await runtime.moduleBridge.removeProjectLinks({ projectId, requireEngine: runtime.analysisOwner !== 'legacy', onRemoved: async () => { result = await remove(); } });
+        else result = await remove();
         return send(res, 200, result);
       }
       const gitStatusMatch = pathname.match(/^\/api\/projects\/([^/]+)\/git-status$/);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanqianx/project-knowledge",
-  "version": "5.0.9-rc.14",
+  "version": "5.0.9-rc.15",
   "description": "Knowledge base manager with Git integration, AI-driven analysis, and bilingual (zh-CN/en-US) knowledge output",
   "main": "_site/server.js",
   "scripts": {

package/plugins/project-knowledge/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "project-knowledge",
-  "version": "5.0.9-rc.14",
+  "version": "5.0.9-rc.15",
   "description": "Read durable project decisions and implementation history from Project Knowledge.",
   "author": {
     "name": "SanQianX",

package/plugins/project-knowledge/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "project-knowledge",
-  "version": "5.0.9-rc.14",
+  "version": "5.0.9-rc.15",
   "description": "Read durable project decisions and implementation history from Project Knowledge.",
   "author": {
     "name": "SanQianX",

package/plugins/project-knowledge/.mcp.json

@@ -6,7 +6,7 @@
       "args": [
         "-y",
         "--package",
-        "@sanqianx/project-knowledge@5.0.9-rc.14",
+        "@sanqianx/project-knowledge@5.0.9-rc.15",
         "project-knowledge-mcp"
       ]
     }