fix: resolve windows ci and add preview site

Author: sviat-barbutsa

README.md

@@ -4,6 +4,20 @@ Zharwing Memory is a local-first project context manager for AI-assisted coding
 
 The product keeps project knowledge, AI session history, context bundles, diagrams, decisions, commands, gotchas, and optional review proposals organized per project. A human can open the desktop app to understand current work, inspect AI context, inspect the graph, search previous work, and enable review workflows only when wanted.
 
+> **Status: standalone personal developer preview.** The current product is
+> intended for a trusted developer using a local, single-user environment. It
+> is not presented as a production, multi-tenant, or hardened harness release.
+> See the [developer preview boundary](docs/DEVELOPER_PREVIEW.md) for the exact
+> profile, limitations, compatibility policy, and validation gates.
+
+![Zharwing Memory project dashboard](docs/assets/zharwing-memory-dashboard.png)
+
+The dependency-free [public documentation website](website/memory/README.md)
+is maintained in this repository and is designed for
+`https://zharwing.barbutsa.com/memory/`. It explains the downloadable local
+application; it is not a hosted version of Memory and cannot access a user's
+memory store.
+
 ## Current Implementation Status
 
 This repository is the generic, project-neutral Zharwing Memory application source.
@@ -149,6 +163,9 @@ docs/
   OPERATIONS.md     Setup, runtime, backup, validation notes
   AI_TESTING.md     Manual AI-provider and semantic graph smoke tests
 
+website/
+  memory/           Dependency-free public documentation website
+
 templates/
   bootstrap/        Generic AGENTS.md and CLAUDE.md templates for linked repos
   mcp/              Generic Codex and Claude MCP config examples
@@ -474,6 +491,8 @@ The visual direction follows the Graphite + Copper theme from the product plan.
 
 Start here:
 
+- [Public Documentation Website Source](website/memory/README.md)
+- [Developer Preview Boundary](docs/DEVELOPER_PREVIEW.md)
 - [Documentation Index](docs/README.md)
 - [Architecture](docs/ARCHITECTURE.md)
 - [Data Model](docs/DATA_MODEL.md)

docs/DEVELOPER_PREVIEW.md

@@ -0,0 +1,112 @@
+# Developer Preview Boundary
+
+Zharwing Memory is being prepared as a **standalone personal developer
+preview**. This preview is useful for developers who want a local, inspectable
+memory layer for AI-assisted coding, but it is not a production, multi-user, or
+hardened agent-control-plane release.
+
+Preparing this preview does not publish the repository, create a release, or
+change any private memory store. Those are separate owner-approved actions.
+
+## Frozen Preview Baseline
+
+- Release branch and upstream: `main` on `origin`
+- Source baseline: `fff3de45e6d769774a0a85ca18d6a1c64a322bcd`
+- Runtime/filesystem owner: Windows-native
+- Node.js: `22.21.0` (the repository also declares the supported Node 24 range)
+- pnpm: `9.0.0`
+- Canonical execution-plan fingerprint:
+  `sha256:f8ef7336ce593e4eba84511d547e460b2f9580a5fcce6ed3ce1b0afb7a11b74c`
+
+The source candidate starts from a clean baseline. Generated output,
+dependencies, private stores, credentials, and machine-specific evidence are
+not release source.
+
+## Product Profile Decision
+
+The standalone personal preview and the future hardened harness integration
+are separate profiles.
+
+The preview preserves the current personal workflow:
+
+- **Authentication:** token authentication remains the default. Explicit
+  no-auth mode is limited to a loopback-bound personal daemon.
+- **Visibility:** selected-project memory is AI-eligible by default. Explicit
+  visibility exclusions, never-send patterns, secret detection, redaction, and
+  high-risk blocking remain enforced.
+- **Durable writes:** routine agent writes are allowed when project review mode
+  is off. Review mode and Memory Inbox proposals remain available when the user
+  wants approval or when a change is risky or uncertain.
+- **Browser authority:** the browser and desktop UI are the human control
+  plane. The browser uses the authenticated daemon and does not gain arbitrary
+  local filesystem access. Destructive and administrative operations are not
+  part of the eleven-tool MCP daily-memory surface.
+- **Compatibility:** the current CLI, daemon, browser/desktop UI, pointer-file
+  format, Markdown store, and eleven MCP tools remain compatible for this
+  preview. Existing stores are not silently migrated to a different policy.
+- **Migration and rollback:** the preview performs no profile-policy migration.
+  A future hardened profile must be opt-in, versioned, preceded by a verified
+  backup, and reversible to the standalone profile without rewriting canonical
+  memory content.
+
+The future hardened harness profile must add project-scoped least-privilege
+credentials, import-safe visibility, proposal-only durable knowledge changes,
+browser session credentials, and explicit migration and rollback behavior. It
+must not silently change the standalone preview's behavior.
+
+## Product Screenshots
+
+The screenshots below use a disposable demonstration store and repository.
+They contain no private project memory, credentials, or personal paths.
+
+![Project dashboard](assets/zharwing-memory-dashboard.png)
+
+![Active work session](assets/zharwing-memory-current-work.png)
+
+## Preview Limitations
+
+- Intended for a trusted developer operating a local, single-user environment.
+- Not qualified for multi-tenant, shared-host, or untrusted-network use.
+- Broad end-to-end coverage across every desktop workflow is still incomplete.
+- Optional live-provider compatibility requires opt-in testing with each
+  provider; normal memory, search, graph, and context workflows do not require
+  a model.
+- Installer generation and installer-level smoke testing remain outstanding.
+  A packaged Windows executable has been built, but it is not being published
+  as part of this source preview.
+- The hardened harness profile and its security/data-integrity qualification
+  remain future work and are not implied by this preview.
+
+## Local Preview Gates
+
+Run the following commands from a clean Windows checkout of the exact candidate
+commit using Node.js `22.21.0` and pnpm `9.0.0`:
+
+```powershell
+corepack pnpm install --frozen-lockfile
+corepack pnpm check:source-artifacts
+corepack pnpm typecheck
+corepack pnpm test
+corepack pnpm build
+corepack pnpm test:desktop-browser
+cargo test --locked --manifest-path apps/desktop/src-tauri/Cargo.toml
+```
+
+The release evidence must record the candidate commit, branch, upstream, OS,
+Node and pnpm versions, command, exit code, timestamp, and any intentional skip.
+It must also include:
+
+1. `git status --short --branch` before and after validation.
+2. A clean-clone or fresh-checkout result using only tracked source and the
+   frozen lockfile.
+3. A screenshot made only from disposable demonstration data.
+4. An independently reviewed diff with no secrets, private memory, generated
+   source artifacts, or machine-specific paths.
+
+Installer generation and installer-level smoke testing are explicitly outside
+this developer-preview source release and must not be reported as passed.
+
+Remote CI and repository visibility changes happen only after a separate
+owner approval. If preview validation fails, keep the repository private,
+retain the current installation, and revert only the preview-specific source
+and documentation changes.

docs/assets/zharwing-memory-current-work.png

@@ -80,7 +80,8 @@ test("stdio install from the development CLI resolves the compiled entry", async
     nodePath: "node"
   });
 
-  assert.deepEqual(result.args, [compiledEntry, "mcp", "serve"]);
+  const resolvedCompiledEntry = await fs.realpath(compiledEntry);
+  assert.deepEqual(result.args, [resolvedCompiledEntry, "mcp", "serve"]);
 });
 
 test("canonical install removes the legacy Codex MCP table", async () => {

docs/assets/zharwing-memory-dashboard.png

@@ -0,0 +1,17 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { formatMarkdown, parseMarkdown } from "./markdown.js";
+
+test("quoted Windows paths remain stable across repeated Markdown round trips", () => {
+  const workingDirectory = String.raw`C:\Users\RUNNER~1\AppData\Local\Temp\zharwing-memory`;
+  const original = formatMarkdown({ working_directory: workingDirectory }, "# Session\n");
+  let markdown = original;
+
+  for (let iteration = 0; iteration < 1_000; iteration += 1) {
+    const parsed = parseMarkdown(markdown);
+    assert.equal(parsed.frontmatter.working_directory, workingDirectory);
+    markdown = formatMarkdown(parsed.frontmatter, parsed.body);
+  }
+
+  assert.equal(markdown, original);
+});

packages/mcp-tools/src/install.test.ts

@@ -79,7 +79,18 @@ function quote(input: string): string {
 }
 
 function unquote(input: string): string {
-  if ((input.startsWith('"') && input.endsWith('"')) || (input.startsWith("'") && input.endsWith("'"))) {
+  if (input.startsWith('"') && input.endsWith('"')) {
+    try {
+      const parsed = JSON.parse(input);
+      if (typeof parsed === "string") {
+        return parsed;
+      }
+    } catch {
+      // Preserve compatibility with previously stored, non-JSON quoted values.
+    }
+    return input.slice(1, -1);
+  }
+  if (input.startsWith("'") && input.endsWith("'")) {
     return input.slice(1, -1);
   }
   return input;

packages/storage/src/markdown.test.ts

@@ -0,0 +1,41 @@
+# Zharwing Memory brand assets
+
+The documentation website uses a plain **Zharwing Memory** text wordmark. It
+does not currently claim a permanent pictorial logo.
+
+The compact browser and application icon is a deliberately simple context
+graph: one active memory node connected to four stored-context nodes. It is a
+functional project identifier for the developer preview, not a finished master
+brand.
+
+## Files
+
+- `assets/brand/zharwing-memory-mark.svg` — dark square context-graph icon.
+- `assets/brand/zharwing-memory-mark-transparent.svg` — transparent graph for
+  light backgrounds.
+- `assets/brand/zharwing-memory-mark-monochrome.svg` — one-color accessible
+  variant.
+- `assets/brand/favicon.svg` — simplified small-size browser icon.
+- `assets/brand/favicon-16.png` and `favicon-32.png` — legacy browser sizes.
+- `assets/brand/favicon.ico` — multi-size legacy favicon.
+- `assets/brand/apple-touch-icon.png` — 180×180 Apple touch icon.
+- `assets/brand/icon-192.png` and `icon-512.png` — manifest/application icons.
+
+## Usage
+
+- Use the text-only Zharwing Memory wordmark in website headers and footers.
+- Use the graph icon only where a compact square identifier is required, such
+  as browser tabs, launchers, and repository avatars.
+- Use the transparent version on light, visually quiet backgrounds.
+- Use the monochrome version when the warm accent is unavailable.
+
+## Avoid
+
+- Do not place the graph beside the text wordmark as though it were a finalized
+  permanent logo.
+- Do not add letters, feathers, circuits, gradients, shadows, or glow.
+- Do not rotate, stretch, or add more nodes.
+- Do not introduce additional foreground colors.
+
+The SVG sources are canonical. Raster files are derived outputs and should be
+regenerated whenever the canonical icon changes.

packages/storage/src/markdown.ts

@@ -0,0 +1,75 @@
+# Deployment checklist for `/memory`
+
+This package is prepared for integration into the existing Zharwing website at:
+
+```text
+https://zharwing.barbutsa.com/memory/
+```
+
+No deployment, DNS change, or external resource creation has been performed.
+
+## Preferred integration
+
+Copy the complete `memory/` directory into the existing site's public route for
+`/memory`. Preserve the relative relationship between `index.html`,
+`styles.css`, `script.js`, and `assets/`.
+
+The page intentionally uses relative asset URLs, so it can be hosted beneath a
+path without a build-time base-path setting.
+
+## Required routing behavior
+
+The host must serve:
+
+```text
+/memory/            -> /memory/index.html
+/memory/styles.css  -> styles.css
+/memory/script.js   -> script.js
+/memory/assets/*    -> assets/*
+```
+
+Direct requests to `/memory` should redirect to `/memory/` or serve the same
+HTML. The trailing slash ensures relative asset URLs resolve consistently.
+
+## Before publishing
+
+1. Confirm `https://github.com/zharwing/memory` is public and is the desired
+   canonical source link.
+2. Confirm the current README installation commands still match the quick start.
+3. Confirm current limitations are truthful for the release being described.
+4. Open every GitHub and in-page navigation link.
+5. Test desktop at 1440×900 and mobile at 390×844.
+6. Verify the page with JavaScript disabled; all essential content must remain.
+7. Confirm no local paths, environment values, real project names, or private
+   memory content appear in the output.
+8. Validate that `/memory` and `/memory/` both work on the final host.
+
+## Search and social metadata
+
+`index.html` already contains:
+
+- canonical URL for `https://zharwing.barbutsa.com/memory/`;
+- title and description metadata;
+- Open Graph and Twitter card fields;
+- `SoftwareApplication` structured data;
+- a local SVG favicon.
+- a web manifest plus 16, 32, 180, 192, and 512 pixel feather/circuit icons.
+
+The current Open Graph image points to the public dashboard screenshot. A custom
+1200×630 social image can replace it later, but it is not required for the first
+publication.
+
+## Deliberately excluded
+
+- analytics and tracking;
+- cookies, accounts, or sign-in;
+- a hosted Memory daemon or API;
+- downloads that do not yet have a supported release artifact;
+- duplicated copies of the repository's complete technical documentation;
+- any dependency or framework requirement.
+
+## Rollback
+
+Because this is a static route, rollback is simply removing the `/memory`
+route or restoring the previous static directory from the site's normal source
+control/deployment history.