noteconnection 1.8.0 → 1.9.0

package/dist/src/storage.provider.contract.test.js

@@ -35,6 +35,9 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const browserTestWindow = {};
+globalThis.window = browserTestWindow;
+const storageProvider = require('./frontend/storage_provider.js');
 describe('storage provider abstraction contract', () => {
     const repoRoot = path.resolve(__dirname, '..');
     const storageProviderPath = path.join(repoRoot, 'src', 'frontend', 'storage_provider.js');
@@ -43,6 +46,138 @@ describe('storage provider abstraction contract', () => {
         expect(source).toContain('window.NoteConnectionStorage = {');
         expect(source).toContain('createProvider');
         expect(source).toContain('class RuntimeStorageProvider');
+        expect(source).toContain('getStorageResolution()');
+        expect(source).toContain('async refreshStorageResolution()');
+        expect(source).toContain("sidecarFetchJson('api/knowledge/store-diagnostics')");
+        expect(source).toContain('supportsProjection');
+    });
+    test('forces projection resolution on Android even when a stale SQLite capability is reported', () => {
+        const provider = storageProvider.createProvider({
+            runtimeCaps: {
+                platform: 'android',
+                supports_projection_store: true,
+                supports_sqlite: true,
+                storage_requested_provider: 'sqlite',
+                storage_resolved_provider: 'sqlite',
+            },
+        });
+        expect(provider.getStorageResolution()).toEqual(expect.objectContaining({
+            requestedProvider: 'sqlite',
+            resolvedProvider: 'projection',
+            fallbackReason: 'native_sqlite_runtime_unavailable',
+            supportsSqlite: false,
+            supportsProjection: true,
+        }));
+    });
+    test('forces projection resolution for an iOS/mobile host without Capacitor globals', () => {
+        const provider = storageProvider.createProvider({
+            runtimeCaps: {
+                platform: 'ios',
+                supports_projection_store: true,
+                supports_sqlite: true,
+                storage_requested_provider: 'sqlite',
+                storage_resolved_provider: 'sqlite',
+            },
+        });
+        expect(provider.getStorageResolution()).toEqual(expect.objectContaining({
+            requestedProvider: 'sqlite',
+            resolvedProvider: 'projection',
+            fallbackReason: 'native_sqlite_runtime_unavailable',
+            supportsSqlite: false,
+            supportsProjection: true,
+        }));
+    });
+    test('keeps SQLite as the desktop default and exposes file fallback explicitly', () => {
+        const sqliteProvider = storageProvider.createProvider({
+            runtimeCaps: {
+                platform: 'win32',
+                supports_sidecar: true,
+                supports_sqlite: true,
+                storage_resolved_provider: 'sqlite',
+            },
+        });
+        expect(sqliteProvider.getStorageResolution()).toEqual(expect.objectContaining({
+            requestedProvider: 'sqlite',
+            resolvedProvider: 'sqlite',
+            supportsSqlite: true,
+        }));
+        const fallbackProvider = storageProvider.createProvider({
+            runtimeCaps: {
+                platform: 'linux',
+                supports_sidecar: false,
+                supports_sqlite: false,
+                storage_requested_provider: 'sqlite',
+                storage_resolved_provider: 'file',
+                storage_fallback_reason: 'sqlite_runtime_unavailable',
+            },
+        });
+        expect(fallbackProvider.getStorageResolution()).toEqual(expect.objectContaining({
+            requestedProvider: 'sqlite',
+            resolvedProvider: 'file',
+            fallbackReason: 'sqlite_runtime_unavailable',
+            supportsSqlite: false,
+            supportsProjection: false,
+        }));
+    });
+    test('does not treat desktop capability support as an active SQLite resolution before diagnostics', () => {
+        const provider = storageProvider.createProvider({
+            runtimeCaps: {
+                platform: 'win32',
+                supports_sidecar: true,
+                supports_sqlite: true,
+                storage_requested_provider: 'sqlite',
+                storage_resolved_provider: 'unknown',
+            },
+        });
+        expect(provider.getStorageResolution()).toEqual(expect.objectContaining({
+            requestedProvider: 'sqlite',
+            resolvedProvider: undefined,
+            supportsSqlite: false,
+        }));
+    });
+    test('refreshes desktop resolution from authoritative sidecar diagnostics', async () => {
+        const previousWindow = globalThis.window;
+        const previousFetch = globalThis.fetch;
+        const runtimeWindow = {
+            NoteConnectionRuntime: {
+                buildUrl: (resourcePath) => `http://127.0.0.1:3000/${resourcePath}`,
+                buildFetchOptions: () => ({ cache: 'no-store' }),
+            },
+        };
+        globalThis.window = runtimeWindow;
+        globalThis.fetch = jest.fn().mockResolvedValue({
+            ok: true,
+            json: async () => ({
+                store: {
+                    requestedProvider: 'sqlite',
+                    resolvedProvider: 'file',
+                    storageEngine: 'file',
+                    fallbackReason: 'sqlite_runtime_unavailable',
+                },
+            }),
+        });
+        try {
+            const provider = storageProvider.createProvider({
+                runtimeCaps: {
+                    platform: 'win32',
+                    supports_sidecar: true,
+                    supports_sqlite: true,
+                    storage_requested_provider: 'sqlite',
+                    storage_resolved_provider: 'sqlite',
+                },
+            });
+            await expect(provider.refreshStorageResolution()).resolves.toEqual(expect.objectContaining({
+                requestedProvider: 'sqlite',
+                resolvedProvider: 'file',
+                fallbackReason: 'sqlite_runtime_unavailable',
+                supportsSqlite: false,
+            }));
+            expect(globalThis.fetch).toHaveBeenCalledWith('http://127.0.0.1:3000/api/knowledge/store-diagnostics', { cache: 'no-store' });
+        }
+        finally {
+            globalThis.window = previousWindow;
+            globalThis.fetch = previousFetch;
+        }
     });
     test('supports sidecar, tauri, and read-only capability branches', () => {
         const source = fs.readFileSync(storageProviderPath, 'utf8');
@@ -53,6 +188,14 @@ describe('storage provider abstraction contract', () => {
         expect(source).toContain('getCapacitorFilesystemPlugin()');
         expect(source).toContain('ensureCapacitorFilesystemPermission');
         expect(source).toContain('normalizeCapacitorPath');
+        expect(source).toContain('createMobileResourceIdentity');
+        expect(source).toContain('canonicalMobileNodeIdFromIdentity');
+        expect(source).toContain('NoteConnectionMobileIdentity');
+        expect(source).toContain('extractMarkdownLinks');
+        expect(source).toContain('sourceUri: file.sourceUri ||');
+        expect(source).toContain('canonicalId: file.canonicalId ||');
+        expect(source).toContain('identityAliases: Array.isArray(file.identityAliases)');
+        expect(source).toContain('Capacitor graph contains duplicate legacy node id');
         expect(source).toContain('extractRelativePathFromKbMarker');
         expect(source).toContain('resolveCapacitorContentCandidatePath');
         expect(source).toContain('async function capacitorReadText(pathValue, options)');
@@ -64,11 +207,19 @@ describe('storage provider abstraction contract', () => {
         expect(source).toContain('CAPACITOR_GRAPH_BUILD_WORKER_TIMEOUT_MS');
         expect(source).toContain("buildMode: 'single-thread-fallback'");
         expect(source).toContain("buildMode: 'worker'");
+        expect(source).toContain('var linkedFile = resolveReference(file, rawLink, referenceIndex);');
+        expect(source).toContain('addEdge(sourceId, linkedFile && linkedFile.id, "wiki-link")');
+        expect(source).toContain('function buildCapacitorReferenceIndex(files)');
+        expect(source).toContain('Capacitor graph contains an ambiguous legacy basename');
+        expect(source).toContain('sourceUri: sourceNode && sourceNode.sourceUri');
         expect(source).toContain("const result = await capacitorBuildGraph(requestPayload || {}, this.runtimeCaps || {});");
         expect(source).toContain('buildModeDetail: resolveCapacitorBuildModeDetail(buildResult.buildMode, runtimeCaps || {})');
         expect(source).toContain('supportsMobileWasmCompute');
         expect(source).toContain('mobileWasmReason');
         expect(source).toContain("unsupportedOperationError('buildGraph')");
+        expect(source).toContain('storage_requested_provider');
+        expect(source).toContain('storage_resolved_provider');
+        expect(source).toContain('storage_fallback_reason');
     });
     test('defines core storage operations used by source manager and reader', () => {
         const source = fs.readFileSync(storageProviderPath, 'utf8');
@@ -80,7 +231,7 @@ describe('storage provider abstraction contract', () => {
         expect(source).toContain('async buildGraph(requestPayload)');
         expect(source).toContain('async readContent(filePath)');
         expect(source).toContain('const capacitorPath = resolveCapacitorContentCandidatePath(filePath);');
-        expect(source).toContain('return await capacitorReadText(capacitorPath);');
+        expect(source).toContain('return await capacitorReadText(capacitorPath, {');
         expect(source).toContain('async setKbPath(kbPath)');
         expect(source).toContain('async readGeneratedAsset(filename)');
     });

package/dist/src/tauri.frontend.build.contract.test.js

@@ -40,6 +40,7 @@ describe('tauri frontend build contracts', () => {
     const packageJsonPath = path.join(repoRoot, 'package.json');
     const tauriConfigPath = path.join(repoRoot, 'src-tauri', 'tauri.conf.json');
     const wrapperScriptPath = path.join(repoRoot, 'scripts', 'run-tauri-frontend-build.js');
+    const viteConfigPath = path.join(repoRoot, 'vite.config.ts');
     function readJson(filePath) {
         return JSON.parse(fs.readFileSync(filePath, 'utf8'));
     }
@@ -57,4 +58,11 @@ describe('tauri frontend build contracts', () => {
         expect(wrapper.resolveFrontendBuildCommand({ frontendBuildMode: 'full' })).toBe('npm run build:full');
         expect(() => wrapper.resolveFrontendBuildCommand({ frontendBuildMode: 'legacy-full' })).toThrow(/Unsupported tauri frontend build mode/i);
     });
+    test('keeps Vite verification output separate from the Tauri runtime frontend directory', () => {
+        const viteConfig = fs.readFileSync(viteConfigPath, 'utf8');
+        expect(viteConfig).toContain("const viteVerificationDir = resolve(__dirname, 'dist', 'vite-verify')");
+        expect(viteConfig).toContain('outDir: viteVerificationDir');
+        expect(viteConfig).toContain('emptyOutDir: true');
+        expect(viteConfig).not.toContain('emptyOutDir: false');
+    });
 });

package/dist/src/tauri.window.evidence.execution.test.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const child_process_1 = require("child_process");
+jest.mock('child_process', () => ({ ...jest.requireActual('child_process'), spawnSync: jest.fn() }));
+const { runRustWindowEvidenceTests } = require('../scripts/verify-agent-workspace-tauri-window-evidence');
+const { runRustContractTests } = require('../scripts/verify-agent-workspace-tauri-rust');
+const spawn = child_process_1.spawnSync;
+describe('native window test execution evidence', () => {
+    afterEach(() => jest.clearAllMocks());
+    test.each([
+        ['empty filter', 'running 0 tests\n\ntest result: ok. 0 passed; 0 failed; 0 ignored; 30 filtered out;\n'],
+        ['ignored test', 'test tests::{name} ... ignored\n\ntest result: ok. 0 passed; 0 failed; 1 ignored;\n'],
+        ['different test', 'test tests::some_other_test ... ok\n\ntest result: ok. 1 passed; 0 failed; 0 ignored;\n'],
+        ['failed test', 'test tests::{name} ... FAILED\n'],
+    ])('does not qualify a zero-exit Cargo run with %s', (_label, stdout) => {
+        spawn.mockImplementation((_command, args) => ({ status: 0, stdout: stdout.replace('{name}', args[3]), stderr: '' }));
+        const results = runRustWindowEvidenceTests();
+        expect(results).toHaveLength(2);
+        expect(results.every((result) => result.passed === false)).toBe(true);
+    });
+    test('requires the named test to pass even when other test executables run zero tests', () => {
+        spawn.mockImplementation((_command, args) => ({ status: 0, stderr: '', stdout: `running 0 tests\ntest result: ok. 0 passed; 0 failed;\n\ntest tests::${args[3]} ... ok\n\ntest result: ok. 1 passed; 0 failed;\n` }));
+        expect(runRustWindowEvidenceTests().every((result) => result.passed)).toBe(true);
+    });
+    test('rejects a passing named test when Cargo later fails', () => {
+        spawn.mockImplementation((_command, args) => ({ status: 101, stderr: 'later test executable failed', stdout: `test tests::${args[3]} ... ok\n` }));
+        expect(runRustWindowEvidenceTests().every((result) => result.passed === false)).toBe(true);
+    });
+    test('selects the native window feature and library target in separate Cargo processes', () => {
+        spawn.mockReturnValue({ status: 0, stdout: '', stderr: '' });
+        runRustWindowEvidenceTests();
+        expect(spawn).toHaveBeenCalledTimes(2);
+        for (const [command, args] of spawn.mock.calls) {
+            expect(command).toBe('cargo');
+            expect(args).toEqual(expect.arrayContaining(['--lib', '--locked', '--features', 'native-window-tests', '--ignored', '--show-output']));
+        }
+    });
+});
+describe('ordinary Rust contract execution evidence', () => {
+    afterEach(() => jest.clearAllMocks());
+    const names = [
+        'pathmode_window_toggle_plan_decouples_godot_signal_from_tauri_hide_restore_flags',
+        'pathmode_window_toggle_plan_restores_tauri_focus_when_restore_policy_is_enabled',
+        'pathmode_window_toggled_event_payload_contains_config_and_execution_plan',
+    ];
+    test.each([
+        ['empty selection', 0, 'running 0 tests\ntest result: ok. 0 passed; 0 failed;', ''],
+        ['unrelated passing test', 0, 'test tests::unrelated ... ok', ''],
+        ['ignored tests', 0, names.map(name => `test tests::${name} ... ignored`).join('\n'), ''],
+        ['failed Cargo invocation mentioning zero tests', 101, '', '0 tests matched after failure'],
+    ])('does not qualify %s', (_label, status, stdout, stderr) => {
+        spawn.mockReturnValue({ status, stdout, stderr });
+        const results = runRustContractTests();
+        expect(results.every((result) => result.passed === false)).toBe(true);
+        expect(results.every((result) => result.exitCode === status)).toBe(true);
+    });
+    test('requires every named case, including both toggle policy tests', () => {
+        spawn.mockReturnValue({ status: 0, stdout: `test tests::${names[0]} ... ok\n`, stderr: '' });
+        expect(runRustContractTests().every((result) => result.passed === false)).toBe(true);
+    });
+    test('qualifies executed names and preserves a later Cargo failure', () => {
+        const stdout = names.map(name => `test tests::${name} ... ok`).join('\n');
+        spawn.mockReturnValue({ status: 0, stdout, stderr: '' });
+        expect(runRustContractTests().every((result) => result.passed)).toBe(true);
+        spawn.mockReturnValue({ status: 101, stdout, stderr: 'process failed' });
+        expect(runRustContractTests().every((result) => result.passed === false)).toBe(true);
+    });
+});

package/dist/src/utils/RuntimePaths.js

@@ -142,6 +142,11 @@ function resolveRuntimePaths(moduleDir) {
         throw new Error(`Unable to provision writable runtime data directory: ${runtimeDataDirCandidate}`);
     }
     const runtimeDataDir = path.resolve(runtimeDataDirCandidate);
+    // pkg's projectRoot is a virtual, read-only asset tree. Mutable discovery
+    // credentials belong to the writable runtime directory in packaged builds.
+    const runtimeManifestPath = process.pkg
+        ? path.join(runtimeDataDir, 'active-sidecar-runtime.json')
+        : path.join(projectRoot, 'tmp', 'active-sidecar-runtime.json');
     const kbCandidates = uniqPaths([
         envKbRoot,
         path.join(projectRoot, 'Knowledge_Base'),
@@ -154,6 +159,7 @@ function resolveRuntimePaths(moduleDir) {
         projectRoot,
         frontendDir,
         runtimeDataDir,
+        runtimeManifestPath,
         kbRoot
     };
 }

package/dist/src/utils/RuntimePaths.test.js

@@ -97,6 +97,33 @@ describe('resolveRuntimePaths', () => {
         expect(resolved.runtimeDataDir).toBe(path.resolve(runtimeDataDir));
         expect(resolved.kbRoot).toBe(path.resolve(kbRoot));
     });
+    test('keeps packaged runtime manifests in the writable runtime directory', () => {
+        const previousPkg = Object.getOwnPropertyDescriptor(process, 'pkg');
+        Object.defineProperty(process, 'pkg', { configurable: true, value: { entrypoint: '/snapshot/app/server.js' } });
+        restoreEnv.push(() => {
+            if (previousPkg)
+                Object.defineProperty(process, 'pkg', previousPkg);
+            else
+                Reflect.deleteProperty(process, 'pkg');
+        });
+        const projectRoot = temp.mkdir('packaged_assets');
+        temp.mkdir(path.join('packaged_assets', 'dist', 'src', 'frontend'));
+        const runtimeDataDir = temp.mkdir('user_runtime');
+        restoreEnv.push(setEnv('NOTE_CONNECTION_PROJECT_ROOT', projectRoot));
+        restoreEnv.push(setEnv('NOTE_CONNECTION_RUNTIME_DATA_DIR', runtimeDataDir));
+        const resolved = (0, RuntimePaths_1.resolveRuntimePaths)(temp.child('module'));
+        expect('runtimeManifestPath' in resolved ? resolved.runtimeManifestPath : undefined)
+            .toBe(path.join(runtimeDataDir, 'active-sidecar-runtime.json'));
+    });
+    test('preserves the development manifest location used by diagnostic tools', () => {
+        const projectRoot = temp.mkdir('project');
+        temp.mkdir(path.join('project', 'Knowledge_Base'));
+        restoreEnv.push(setEnv('NOTE_CONNECTION_PROJECT_ROOT', projectRoot));
+        restoreEnv.push(setEnv('NOTE_CONNECTION_RUNTIME_DATA_DIR', temp.mkdir('runtime')));
+        const resolved = (0, RuntimePaths_1.resolveRuntimePaths)(temp.child('module'));
+        expect('runtimeManifestPath' in resolved ? resolved.runtimeManifestPath : undefined)
+            .toBe(path.join(projectRoot, 'tmp', 'active-sidecar-runtime.json'));
+    });
     test('normalizes env kb path that points to a folder inside Knowledge_Base', () => {
         const projectRoot = temp.mkdir('project');
         const kbRoot = temp.mkdir(path.join('project', 'Knowledge_Base'));

package/dist/src/windows.installer.build.test.js

@@ -0,0 +1,109 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+jest.mock('node:child_process', () => ({ ...jest.requireActual('node:child_process'), spawnSync: jest.fn() }));
+const { recordInstallerBuild, readInstallerBuild } = require('../scripts/verify-windows-installers');
+describe('installer build provenance across fresh runners', () => {
+    let directory;
+    let receiptPath;
+    const environment = { GITHUB_SHA: 'a'.repeat(40), GITHUB_RUN_ID: '123', GITHUB_RUN_ATTEMPT: '1' };
+    const write = (relative, contents) => {
+        const file = path.join(directory, relative);
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, contents);
+    };
+    beforeEach(() => {
+        const temporaryRoot = path.resolve(__dirname, '../output/verification/installer-build-tests');
+        fs.mkdirSync(temporaryRoot, { recursive: true });
+        directory = fs.mkdtempSync(path.join(temporaryRoot, 'receipt-'));
+        receiptPath = path.join(directory, 'output/verification/windows-installer-build.json');
+        write('package.json', JSON.stringify({ version: '1.8.0' }));
+        write('src/fixture.ts', 'export const source = 1;');
+        write('src-tauri/target/release/npm.exe', 'PE __TAURI_BUNDLE_TYPE_VAR_UNK fixture');
+        for (const name of ['server', 'godot', 'markdown-worker'])
+            write(`src-tauri/bin/${name}-x86_64-pc-windows-msvc.exe`, name);
+        write('output/desktop/path_mode.pck', 'GDPC fixture');
+        write('src-tauri/target/release/bundle/nsis/NoteConnection_1.8.0_x64-setup.exe', 'NSIS fixture');
+        write('src-tauri/target/release/bundle/msi/NoteConnection_1.8.0_x64_en-US.msi', 'MSI fixture');
+        recordInstallerBuild(directory, environment);
+    });
+    afterEach(() => {
+        expect(node_child_process_1.spawnSync).not.toHaveBeenCalled();
+        jest.clearAllMocks();
+        fs.rmSync(directory, { recursive: true, force: true });
+    });
+    test.each(['nsis', 'msi'])('accepts %s without build dependencies, including failed-only retries', format => {
+        // A qualification runner has only source, the receipt and its installer.
+        fs.rmSync(path.join(directory, 'src-tauri/bin'), { recursive: true });
+        fs.unlinkSync(path.join(directory, 'src-tauri/target/release/npm.exe'));
+        fs.rmSync(path.join(directory, 'output/desktop'), { recursive: true });
+        const receipt = readInstallerBuild(format, directory, { ...environment, GITHUB_RUN_ATTEMPT: '2' });
+        expect(receipt.buildRunAttempt).toBe('1');
+        expect(receipt.expectedFiles[format]).toHaveLength(5);
+        expect(readInstallerBuild(format, directory, environment)).toEqual(receipt);
+    });
+    test.each([
+        ['sourceRevision', 'b'.repeat(40), /source revision differs/],
+        ['runId', '456', /workflow run differs/],
+        ['version', '9.0.0', /version differs/],
+        ['buildRunAttempt', '0', /build attempt/],
+        ['buildRunAttempt', '2', /build attempt/],
+        ['sourceFingerprint', {}, /source fingerprint differs/],
+    ])('rejects tampered %s before executing anything', (field, replacement, message) => {
+        const receipt = JSON.parse(fs.readFileSync(receiptPath, 'utf8'));
+        receipt[field] = replacement;
+        fs.writeFileSync(receiptPath, JSON.stringify(receipt));
+        expect(() => readInstallerBuild('msi', directory, environment)).toThrow(message);
+    });
+    test.each(['name', 'path'])('rejects redirected installer %s', field => {
+        const receipt = JSON.parse(fs.readFileSync(receiptPath, 'utf8'));
+        receipt.installers.msi[field] = '../other.msi';
+        fs.writeFileSync(receiptPath, JSON.stringify(receipt));
+        expect(() => readInstallerBuild('msi', directory, environment)).toThrow(/Installer (basename|path) differs/);
+    });
+    test.each(['MSI altered', 'truncated'])('rejects altered installer bytes (%s)', contents => {
+        write('src-tauri/target/release/bundle/msi/NoteConnection_1.8.0_x64_en-US.msi', contents);
+        expect(() => readInstallerBuild('msi', directory, environment)).toThrow(/Installer (size|hash) differs/);
+    });
+    test('rejects changed source and missing receipts without recomputing build expectations', () => {
+        write('src/fixture.ts', 'export const source = 2;');
+        expect(() => readInstallerBuild('msi', directory, environment)).toThrow(/source fingerprint differs/);
+        fs.unlinkSync(receiptPath);
+        expect(() => readInstallerBuild('msi', directory, environment)).toThrow(/ENOENT/);
+    });
+});

package/dist/src/windows.installer.payload.test.js

@@ -0,0 +1,76 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const { verifyInstalledPayload, fingerprintTauriInstallerExecutable } = require('../scripts/verify-windows-installers');
+const { sha256File } = require('../scripts/sidecar-build-fingerprint');
+describe('installed Windows payload verification', () => {
+    let directory;
+    let expected;
+    beforeEach(() => {
+        directory = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), 'installed payload '));
+        fs.writeFileSync(path.join(directory, 'path_mode.pck'), 'GDPC fixture');
+        expected = [{ name: 'path_mode.pck', bytes: 12, sha256: sha256File(path.join(directory, 'path_mode.pck')) }];
+    });
+    afterEach(() => fs.rmSync(directory, { recursive: true, force: true }));
+    test('matches exact packaged bytes under paths containing spaces', () => {
+        expect(verifyInstalledPayload(directory, expected)).toEqual(expected);
+    });
+    test('rejects missing resources even when the installer reported success', () => {
+        fs.unlinkSync(path.join(directory, 'path_mode.pck'));
+        expect(() => verifyInstalledPayload(directory, expected)).toThrow(/missing path_mode.pck/);
+    });
+    test('rejects same-sized stale resources', () => {
+        fs.writeFileSync(path.join(directory, 'path_mode.pck'), 'GDPC altered');
+        expect(() => verifyInstalledPayload(directory, expected)).toThrow(/hash differs/);
+    });
+    test.each(['NSS', 'MSI'])('checks the exact Tauri %s stamp without ignoring executable bytes', (bundleCode) => {
+        const executable = path.join(directory, 'build.exe');
+        fs.writeFileSync(executable, 'PE before\0__TAURI_BUNDLE_TYPE_VAR_UNK\0PE after');
+        const fingerprint = fingerprintTauriInstallerExecutable(executable, bundleCode);
+        fs.writeFileSync(path.join(directory, 'npm.exe'), `PE before\0__TAURI_BUNDLE_TYPE_VAR_${bundleCode}\0PE after`);
+        expect(verifyInstalledPayload(directory, [fingerprint])).toEqual([fingerprint]);
+        fs.writeFileSync(path.join(directory, 'npm.exe'), `PE edited\0__TAURI_BUNDLE_TYPE_VAR_${bundleCode}\0PE after`);
+        expect(() => verifyInstalledPayload(directory, [fingerprint])).toThrow(/hash differs/);
+        expect(fs.readFileSync(executable, 'utf8')).toContain('_VAR_UNK');
+    });
+    test.each(['missing marker', '__TAURI_BUNDLE_TYPE_VAR_UNK__TAURI_BUNDLE_TYPE_VAR_UNK'])('rejects missing or ambiguous bundle stamps (%s)', (contents) => {
+        const executable = path.join(directory, 'build.exe');
+        fs.writeFileSync(executable, contents);
+        expect(() => fingerprintTauriInstallerExecutable(executable, 'NSS')).toThrow(/exactly one/);
+    });
+});

package/dist/src/windows.installer.runtime.test.js

@@ -0,0 +1,69 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+jest.mock('node:child_process', () => ({ ...jest.requireActual('node:child_process'), spawnSync: jest.fn() }));
+const { verifyInstalledRuntime } = require('../scripts/verify-windows-installers');
+const spawn = node_child_process_1.spawnSync;
+describe('installed runtime evidence verdict', () => {
+    let directory;
+    let run;
+    beforeEach(() => {
+        directory = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), 'installer-runtime-'));
+        run = path.join(directory, 'runtime');
+        fs.mkdirSync(run);
+        spawn.mockReturnValue({ status: 0, stdout: '', stderr: '' });
+        fs.writeFileSync(path.join(run, 'report.json'), JSON.stringify({ passed: true, checks: { godotLayout: true, windowTransitions: true } }));
+        fs.writeFileSync(path.join(run, 'native-debug-policy.json'), '\uFEFF' + JSON.stringify({ policyValuesRemoved: true }));
+    });
+    afterEach(() => { jest.resetAllMocks(); fs.rmSync(directory, { recursive: true, force: true }); });
+    test('accepts completed runtime evidence only after temporary policies are removed', () => {
+        expect(verifyInstalledRuntime(directory, run).passed).toBe(true);
+        expect(spawn.mock.calls[0][0]).toBe('powershell.exe');
+        expect(spawn.mock.calls[0][1]).toContain(path.resolve(__dirname, '../scripts/verify-elevated-desktop-runtime.ps1'));
+    });
+    test('rejects a successful runtime when machine policy cleanup did not complete', () => {
+        fs.writeFileSync(path.join(run, 'native-debug-policy.json'), JSON.stringify({ policyValuesRemoved: false }));
+        expect(() => verifyInstalledRuntime(directory, run)).toThrow(/policies must be removed/);
+    });
+    test('does not accept an empty successful process or lose its setup failure', () => {
+        fs.unlinkSync(path.join(run, 'report.json'));
+        spawn.mockReturnValue({ status: 1, stdout: '', stderr: 'Existing app policy cannot be overwritten' });
+        expect(() => verifyInstalledRuntime(directory, run)).toThrow(/Existing app policy cannot be overwritten/);
+    });
+});

package/dist/src/workspace/WorkspaceRegistry.js

@@ -80,6 +80,19 @@ class WorkspaceRegistry {
         }
         return this.bindings.get(bindingId) || null;
     }
+    /** Mirrors a committed document move for workspace-scoped path filters. */
+    updateDocumentSourcePath(documentId, sourcePath, updatedAt) {
+        const binding = this.resolveBindingByDocumentId(documentId);
+        if (!binding) {
+            return false;
+        }
+        this.bindings.set(binding.bindingId, {
+            ...binding,
+            sourcePath,
+            updatedAt,
+        });
+        return true;
+    }
     getWorkspaceById(workspaceId) {
         return this.workspaces.get(String(workspaceId || '').trim().toLowerCase()) || null;
     }