@agile-team/wl-skills-ui 1.20.0 → 1.21.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [1.21.0] — 2026-10-11
+
+- 协议参数校验运行依赖固定升级 Ajv 8.20.0，消除 GHSA-2g4f-4pwh-qvx6 已知版本风险；保留共享 Schema 与未受影响的依赖版本。
+- 定向修复 fast-uri 与开发工具传递依赖的已知公告；开发验证 Vue 链更新为 3.5.42 并保留生产 peer 范围，tmp 兼容性独立验证，主 CI 增加运行依赖审计门禁。
+- CI 兼容矩阵先冻结安装依赖并生成运行产物，再打包候选；验证与发布工作流显式固定 pnpm 版本，避免全新 checkout 缺少构建或包管理器版本。
+- 增加 executor-invoke-v1 结构化检查入口，复用本包原执行器并保留旧五操作。
+- 完整参数 Schema、任务准入和路径边界校验；共享快照来源及离线防漂移门禁。
+- 更新独立维护、Harness 兼容与持续验收说明。
+
+- 公开协议新增 `executor-invoke-v1` 与结构化 `execute`；UI 在包内维护 scan 参数映射，复用原 scanner CLI 和同 runId 回执，无兄弟包或 Harness 运行时依赖。
+- 执行前核对本项目有效计划、动作许可、目标及规则子集与参数 Schema；非法输入、计划外范围、解释、过期和禁用请求不启动检查。业务失败保留真实非零退出，调用成功不冒充验证通过。
+- execute 省略 rules 时只执行计划内 R 规则；CLI/MCP 的 only/skip 在扫描前选择实际回调，SFC_PARSE 保持独立且不可隐藏。
+- 原 scanner/修复器读取 Vue 叶子前核验实际项目根，拒绝目录内外部文件链接；保留本项目内部合法链接。
+- 异步执行直接复用 scanner，避免同步包装器形成二次子进程；协议等待检查结束，复用公共输出预算与进程树取消，并增加真实 R001 成功/违规及拒绝零记录回归。
+
+## [1.20.1] - 2026-10-11
+
+- 修复 task 在版本漂移后旧顶层 status/ready 与嵌套 decision、notice、公开协议准入不一致；从校正后的记录生成旧字段，gap 始终 ready=false。
+- task/route/explain/status 的旧顶层 ready 复用公开结果核心判定，并核对当前适用 scope；缺资产、歧义、未接入/移动项目、缺上下文或计划过期均不准入。
+- 增加真实 CLI 和协议版本漂移、恢复后重判、缺口/范围/新鲜度回归；ready 不证明宿主读取、代码执行或业务验证通过。
+
 ## [1.20.0] - 2026-10-11
 
 - scan 严格校验已注册规则、范围与参数，CLI/MCP 使用同源选择器；非法请求零检查零任务记录。

package/README.md

@@ -2,7 +2,7 @@
 
 > 项目范围：只对目标自身已接入且平台适用的项目判定规则；父工作区安装不启用子项目。移动端与未接入开源项目不套用。详见 [精准触发与范围配置](docs/project-scope.md)。
 
-**企业级 UI 一致性与 AI 精确治理工具包 v1.17.0** — 面向 Vue 3 + Element Plus 的设计令牌、能力 Profile、样式皮肤、页面骨架、运行时能力、静态扫描、确定性修复、AI Skill、MCP 与脱敏 UI 模板契约。
+**企业级 UI 一致性与 AI 精确治理工具包 v1.21.0** — 面向 Vue 3 + Element Plus 的设计令牌、能力 Profile、样式皮肤、页面骨架、运行时能力、静态扫描、确定性修复、AI Skill、MCP 与脱敏 UI 模板契约。
 
 它把“视觉统一、问题识别、机械修复、项目适配和样例沉淀”拆成可验证、可组合的工程能力。脚本、规则和 MCP 先完成确定性工作，AI 只处理业务语义与人工决策，从而减少重复读源码、上下文 token 和误修改。
 
@@ -17,6 +17,8 @@
 
 `wl-ui doctor-host --json` 对比已分发规范、本地执行器和正在运行的版本，漂移会显式报告。规范更新不会替代依赖升级：同步本包依赖、锁文件和受管入口；未使用的兄弟包无需安装。重开/刷新宿主加载后仍需观察真实任务调用，不能宣称所有 AI 自动触发。
 
+`task/route/explain/status` 的旧顶层 `ready` 与公开协议的 `result.integration.ready` 表示本次工作流的有效就绪状态：当前项目必须已接入且 `scope=applicable`，判定为 matched/baseline，所需资产完整、版本没有已知漂移、计划尚未过期。gap、歧义、缺上下文、未接入/移动项目均为 false，不能只因规范文件存在就称 ready。漂移时旧顶层 task 的 status/ready 与嵌套 decision、notice 保持一致；状态回查以当前 scope 和新鲜度为准。ready=true 不证明宿主读取、自动检查权限、工具执行或业务验证通过，执行仍需核对动作许可和 allowedExecutors。
+
 ## 你能获得什么
 
 | 目标 | 包提供的能力 | 带来的效果 |
@@ -106,20 +108,41 @@ CLI、安装器和 MCP 无需安装其他 wl-skills 包或统一客户端即可
 
 ## 公开集成协议 v1
 
-供 harness、客户端或其他编排层以统一 JSON 入口调用本包判定与状态能力（业务执行仍走本包 CLI/MCP，不因协议新增兄弟包依赖）。
+供 harness、客户端或其他编排层以统一 JSON 入口判定、查询并调用本包声明的业务只读检查器。业务执行复用本包原 CLI，参数映射由本包维护；不新增兄弟包或 Harness 运行时依赖。
 
 ```bash
-wl-ui protocol describe --json                      # 能力目录、五操作映射、请求/响应 Schema、错误码
+wl-ui protocol describe --json                      # 能力目录、六操作映射、请求/响应 Schema、错误码
 wl-ui protocol request --input-file request.json --json
 ```
 
-- 操作：`route` / `explain`（只读判定）、`task`（判定并持久化计划，尚未执行）、`status`（回查本包执行回执）、`doctor-host`（宿主入口静态诊断）。
-- 请求字段：`protocolVersion`(1)、`operation`、`requestId`、`runId`、`projectRoot`、`task`、`targets`、`skill`、`host`+ `profile`。
-- 统一信封：`{ ok, result | error, diagnostics }`；机器结果与诊断分离；非法输入在触达执行器前判 `invalid-input`，不写入任何记录。
-- 错误码：`unsupported-protocol` / `unknown-operation` / `missing-input` / `invalid-input` / `internal-error`；请求失败（exit 2）时 stdout 仍为可解析 JSON 信封。
+- 操作：`route` / `explain`（只读判定）、`task`（判定并持久化计划，尚未执行）、`status`（回查本包执行回执）、`doctor-host`（宿主入口静态诊断）、`execute`（按有效计划调用本包声明的业务只读检查器）。
+- 判定与查询请求字段：`protocolVersion`(1)、`operation`、`requestId`、`runId`、`projectRoot`、`task`、`targets`、`skill`、`host`+ `profile`。
+- 统一信封：`{ ok, result | error, diagnostics }`；机器结果与诊断分离；非法输入在触达执行器前拒绝（基础请求为 `invalid-input`，执行参数为 `invalid-executor-input`），不写入任何记录。
+- 基础错误码：`unsupported-protocol` / `unknown-operation` / `missing-input` / `invalid-input` / `internal-error`；执行请求另区分计划、授权、范围与参数拒绝，完整错误码见 `describe.errorCodes`。请求失败（exit 2）时 stdout 仍为可解析 JSON 信封。
 - **`ok=true` 只表示协议调用成功，不代表业务验证通过**；业务状态以 `result` 内 `validationStatus` / `executionStatus` 为准（仅计划时为 `unverified` / `not-executed`）。
-- 副作用：仅 `task` 写入本包自己的 runs 目录（见 describe 中各操作 `sideEffects`）；其余操作只读。
-- 协议实现为本包内置的同源快照 `integration-protocol.cjs`，五包一致；跨包一致性由 conformance `integration-protocol.check.cjs` 验收。
+- 副作用：`task` 保存计划，`execute` 复用原执行器写本包自己的 runs 回执并输出报告；均不通过本接口修改业务文件。其他操作只读，见 describe 中各操作 `sideEffects`。
+- 协议实现为本包内置的同源快照 `integration-protocol.cjs`，当前源码分发一致性由 conformance 验收。各包独立保留自己的快照与版本；已发布版本按协议、feature 和 Schema 判断兼容，不要求每次同步发版。
+
+### 稳定执行入口
+
+先用 `task` 创建当前项目的计划，核对 `result.integration.allowedExecutors`，再通过同一个 `protocol request` 发送：
+
+```json
+{
+  "protocolVersion": 1,
+  "operation": "execute",
+  "projectRoot": "/absolute/path/to/adopted-pc-project",
+  "runId": "task-returned-run-id",
+  "executorId": "scan",
+  "parameters": {"targets": ["src/views/example/index.vue"], "rules": ["R001"]}
+}
+```
+
+`projectRoot`、`runId`、`executorId`、`parameters` 必填；执行目标放在 `parameters.targets`，不接受顶层 `targets`。UI 的 `rules` 只接受本次计划内的规则子集；省略时执行当前计划的 R 规则，不扩大到全量规则。SFC 解析检查独立执行且不能被隐藏。未知执行器、非法参数、计划外目标/规则、未接入或不适用项目、禁止检查、过期或版本漂移的计划在启动业务 CLI 前拒绝。当前本包执行器为 `scan`；以 `describe.inventory.executors` 的实际目录与 Schema 为准。
+
+返回 `result.execution` 的真实 `exitCode`、`signal`、stdout/stderr，并重新读取同 runId 的包内状态形成 `result.integration`。`ok=true` 表示调用已完成，即使业务检查退出非零仍保留真实失败；宿主须查看执行与验证状态、实际检查文件和未验证项。输出有界，取消会终止本次业务 CLI 及其进程树。协议不代替真实宿主加载、模型读取或界面展示证据。
+
+适配器只发送执行器 ID 与结构化参数，无需维护本包 CLI argv。增加检查器时由本包更新目录、Schema 与原 CLI 映射；兼容接口下其他包与 Harness 不必同步发版。原 CLI/MCP 继续可独立使用。
 
 ## 能力地图
 
@@ -510,7 +533,7 @@ npx wl-ui doctor --project . --print-overrides
 
 ## 版本与进一步阅读
 
-当前 v1.20.0：公开集成协议 describe/request 统一信封（能力清单与路由语料经真实打包产物验证）、输入校验收口与 MCP 目录对齐真实 tools/list。v1.15.0：任务判定、真实执行/验证回执、实际检查范围和过期检测；Codex 原生薄入口按需加载 canonical Skill。确定性路由覆盖已发布目录与显式缺口，不保证识别所有自然语言。v1.14.0：明确独立能力边界，安装、更新、清理按本包贡献保护用户及其他包内容；共享文件采用单文件原子替换，支持历史路由与 `.clinerules` 目录迁移。v1.13.2：R044 审查多列表单超宽标签，R040 识别自定义 `stepper`，均供人工复核。v1.13.0：新增 `native-jh-ag` Profile、显式 Profile 兼容承诺与联邦 AG 依赖识别。
+当前 v1.21.0：公开集成协议 describe/request 统一信封（能力清单与路由语料经真实打包产物验证）、输入校验收口与 MCP 目录对齐真实 tools/list。v1.15.0：任务判定、真实执行/验证回执、实际检查范围和过期检测；Codex 原生薄入口按需加载 canonical Skill。确定性路由覆盖已发布目录与显式缺口，不保证识别所有自然语言。v1.14.0：明确独立能力边界，安装、更新、清理按本包贡献保护用户及其他包内容；共享文件采用单文件原子替换，支持历史路由与 `.clinerules` 目录迁移。v1.13.2：R044 审查多列表单超宽标签，R040 识别自定义 `stepper`，均供人工复核。v1.13.0：新增 `native-jh-ag` Profile、显式 Profile 兼容承诺与联邦 AG 依赖识别。
 
 - [版本摘要](docs/version-history.md)
 - [完整 Changelog](CHANGELOG.md)
@@ -537,13 +560,13 @@ npm run pack:dry
 
 任务判定保留原始文本，并将当前请求、历史引用和明确否定分开。自然语言判定覆盖已公开语料与规则，不能承诺任意表述都自动命中；遇到歧义或缺口应补充目标/领域或显式指定本包能力，不能静默选择。编辑前显示真实 `notice`，包括版本、技能、规则、目标、runId、动作与待检查项。
 
-`protocol describe --json` 声明 `task-intent-v1`、`result-core-v1`、`executor-catalog-v1`；`schemas.resultCore` 与五操作 `schemas.results` 可供宿主验证。原有结果字段保留，新增 `result.integration`：项目适用范围、动作模式、规则身份、目标、就绪状态、允许执行器和真实执行/验证状态。`ok` 只表示调用成功。未声明使用的输入字段进入 diagnostics，不会转成授权依据。
+`protocol describe --json` 声明 `task-intent-v1`、`result-core-v1`、`executor-catalog-v1`、`executor-invoke-v1`；`schemas.resultCore` 与六操作 `schemas.results` 可供宿主验证。原有结果字段保留，新增 `result.integration`：项目适用范围、动作模式、规则身份、目标、就绪状态、允许执行器和真实执行/验证状态。`ok` 只表示调用成功。判定与查询的未声明字段进入 diagnostics，不会转成授权依据；execute 的额外字段按 Schema 拒绝。
 
 `action.mode` 为 explain/plan/inspect/apply/unspecified；解释和规划不自动启动检查。`businessWritesAuthorized=false`，任务意图不能替代业务写入授权。`ruleRefs` 为包自有规则身份（包名、规则 ID、版本、来源、性质），自然语言约束有稳定 ID；原规则名称与列表保留。所有规则的机械/语义验证仍以实际回执为准。
 
-`inventory.executors` 声明本包业务只读检查器、目标与参数 Schema；其适用条件由本包判定。外部适配器须核对同项目、同包、同版本、同 runId 的真实计划、新鲜度与允许动作，指定一个目标，不能扩大范围；支持规则子集的执行器不得选择计划外规则。多目标需拆分调用。五包和 Harness 均为可选组合，不新增兄弟包或 Harness 运行时依赖；卸下适配器后原 CLI/MCP 继续独立使用。
+`inventory.executors` 声明本包业务只读检查器、目标与参数 Schema；其适用条件由本包判定。外部适配器须核对同项目、同包、同版本、同 runId 的真实计划、新鲜度与允许动作，指定一个目标，不能扩大范围；支持规则子集的执行器不得选择计划外规则。当前执行入口一次只接受与本包计划一致的一个目标；多目标应先拆分计划，再逐个执行。五包和 Harness 均为可选组合，不新增兄弟包或 Harness 运行时依赖；卸下适配器后原 CLI/MCP 继续独立使用。
 
-样式规则检查使用 `scan`（支持计划内规则子集）；`check` 只核验接入完整性。技能触发词由本包 `bin/task-triggers.json` 维护并接受目录一致性检查。
+样式规则检查使用 `scan`（支持计划内规则子集；`--only/--skip` 在扫描前选择实际规则回调）；`check` 只核验接入完整性。技能触发词由本包 `bin/task-triggers.json` 维护并接受目录一致性检查。
 
 `scan/audit/fix` 的未知参数、重复值选项、空值、多余位置参数和不存在的规则选择器在检查或写入前拒绝，机读输出返回 `invalid-input`，不会形成成功检查记录。CLI 与 MCP 共用注册规则选择器，支持单个 ID、逗号列表与三位编号范围（例如 `R031-R037`）；用 `wl-ui rules list` 核对实际规则。Vue 解析错误仍不能被 `--only/--skip` 隐藏。`wl-ui scan --help` 只输出帮助，不启动扫描。
 
@@ -552,3 +575,5 @@ npm run pack:dry
 编辑前展示实际 `notice` 的包版本、判定、动作、技能/规则、目标、runId、待检查项与版本对齐信息；解释/规划和明确禁止检查时不自动执行检查。`runtime=mismatch/invalid` 或 `planStale=true` 必须先同步本包或重新判定。只读 `inspect` 输入变化后重新 `task`；`apply` 完成正常业务修改后可用同 runId 做实际复扫，但规则、配置或版本变化仍需重新判定。
 
 单包只读取自身公开能力；多包复用同 runId 并各存各的证据。`matched/ready/ok=true` 仅说明判定或调用成功，是否完成以实际 `executionStatus/validationStatus/checkedFiles` 为准。未接入或不适用的项目不借父目录规则；宿主发现、模型读取、反馈展示没有真实证据时继续标记未验证。
+
+维护边界、结构化执行和防漂移验收：[维护契约](docs/maintenance-contract.md)。

package/bin/__tests__/dependency-security.test.mjs

@@ -0,0 +1,78 @@
+import assert from 'node:assert/strict'
+import { mkdtempSync, writeFileSync, existsSync, readdirSync, rmSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import test from 'node:test'
+
+// Commitizen and cz-customizable still use external-editor 3.x. Verify the
+// patched tmp dependency against their real sync, callback and cleanup APIs.
+const require = createRequire(import.meta.url)
+const commitizenRequire = createRequire(require.resolve('commitizen'))
+const inquirerRequire = createRequire(commitizenRequire.resolve('inquirer'))
+const editorEntry = inquirerRequire.resolve('external-editor')
+const editorRequire = createRequire(editorEntry)
+const { ExternalEditor, editAsync } = editorRequire(editorEntry)
+const tmp = editorRequire('tmp')
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), 'wl-ui-editor-api-'))
+  const editor = join(root, 'editor.cjs')
+  writeFileSync(editor, "require('node:fs').writeFileSync(process.argv[2], 'edited value', 'utf8')\n")
+  return { root, editor, cleanup: () => rmSync(root, { recursive: true, force: true }) }
+}
+
+test('patched tmp keeps external-editor sync creation, editing and cleanup', () => {
+  const f = fixture()
+  try {
+    assert.equal(editorRequire('tmp/package.json').version, '0.2.7')
+    const editor = new ExternalEditor('initial value', { dir: f.root, prefix: 'input-' })
+    editor.editor = { bin: process.execPath, args: [f.editor] }
+    assert.equal(existsSync(editor.tempFile), true)
+    assert.equal(editor.run(), 'edited value')
+    assert.equal(editor.lastExitStatus, 0)
+    editor.cleanup()
+    assert.equal(existsSync(editor.tempFile), false)
+  } finally {
+    f.cleanup()
+  }
+})
+
+test('patched tmp keeps external-editor async callback and automatic cleanup', async () => {
+  const f = fixture()
+  const previousVisual = process.env.VISUAL
+  try {
+    process.env.VISUAL = `${process.execPath} ${f.editor}`
+    const value = await new Promise((resolve, reject) => {
+      editAsync('initial value', (error, result) => error ? reject(error) : resolve(result), {
+        dir: f.root,
+        prefix: 'input-',
+      })
+    })
+    assert.equal(value, 'edited value')
+    assert.deepEqual(readdirSync(f.root), ['editor.cjs'])
+  } finally {
+    if (previousVisual === undefined) delete process.env.VISUAL
+    else process.env.VISUAL = previousVisual
+    f.cleanup()
+  }
+})
+
+test('patched tmp file callback retains idempotent cleanup within the fixture', async () => {
+  const f = fixture()
+  try {
+    const result = await new Promise((resolve, reject) => {
+      tmp.file({ dir: f.root, discardDescriptor: true }, (error, name, fd, cleanup) => {
+        if (error) reject(error)
+        else resolve({ name, fd, cleanup })
+      })
+    })
+    assert.equal(existsSync(result.name), true)
+    assert.equal(result.fd, undefined)
+    await new Promise((resolve, reject) => result.cleanup(error => error ? reject(error) : resolve()))
+    result.cleanup()
+    assert.equal(existsSync(result.name), false)
+  } finally {
+    f.cleanup()
+  }
+})

package/bin/__tests__/protocol-cli.test.mjs

@@ -22,12 +22,13 @@ function tempRoot() {
   return root;
 }
 
-test("describe 返回协议版本、能力目录与五个统一操作", () => {
+test("describe 返回协议版本、能力目录与六个统一操作", () => {
   const described = protocol.describe();
   assert.equal(described.protocolVersion, 1);
   assert.equal(described.package, pkg.name);
   assert.ok(Array.isArray(described.capabilities) && described.capabilities.length > 0);
-  assert.deepEqual(described.operations.map((operation) => operation.id), ["route", "explain", "task", "status", "doctor-host"]);
+  assert.deepEqual(described.operations.map((operation) => operation.id), ["route", "explain", "task", "status", "doctor-host", "execute"]);
+  assert.ok(described.features.includes("executor-invoke-v1"));
   assert.ok(described.errorCodes.includes("unsupported-protocol"));
 });
 

package/bin/__tests__/protocol-execute.test.mjs

@@ -0,0 +1,168 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+const repo = path.resolve(import.meta.dirname, "../..");
+const pkg = JSON.parse(fs.readFileSync(path.join(repo, "package.json"), "utf8"));
+const cli = path.join(repo, "bin/wl-ui.js");
+const selected = "src/views/Selected/index.vue";
+
+function fixture(callback) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "wl-ui-public-execute-"));
+  try {
+    fs.writeFileSync(path.join(root, "package.json"), JSON.stringify({ private: true, devDependencies: { [pkg.name]: pkg.version, vue: "^3.4.0" } }));
+    fs.mkdirSync(path.join(root, "node_modules/@agile-team"), { recursive: true });
+    fs.symlinkSync(repo, path.join(root, "node_modules", pkg.name), "dir");
+    fs.mkdirSync(path.dirname(path.join(root, selected)), { recursive: true });
+    fs.writeFileSync(path.join(root, selected), '<template><el-table><el-table-column prop="name" align="center"/></el-table></template>\n');
+    const installed = spawnSync(process.execPath, [cli, "init", "--editor", "all", "--profile", "native-element"], { cwd: root, encoding: "utf8", timeout: 30000 });
+    assert.equal(installed.status, 0, installed.stderr || installed.stdout);
+    callback(root);
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+}
+
+function request(root, input) {
+  const file = path.join(root, "request.json");
+  fs.writeFileSync(file, JSON.stringify({ projectRoot: root, ...input }));
+  const called = spawnSync(process.execPath, [cli, "protocol", "request", "--input-file", file, "--json"], { cwd: root, encoding: "utf8", timeout: 30000 });
+  assert.equal(called.signal, null, called.stderr);
+  return { ...JSON.parse(called.stdout), cliExitCode: called.status };
+}
+
+function plan(root, runId, task = "检查当前 Vue 代码") {
+  const planned = request(root, { operation: "task", task, runId, targets: [selected] });
+  assert.equal(planned.ok, true);
+  return planned.result;
+}
+
+function execute(root, runId, extra = {}) {
+  return request(root, { operation: "execute", runId, executorId: "scan", parameters: { targets: [selected], rules: ["R001"] }, ...extra });
+}
+
+test("公开 execute 复用原 scan：规则子集与真实失败保留，同 runId 状态回查", () => fixture(root => {
+  const source = fs.readFileSync(path.join(root, selected));
+  assert.ok(plan(root, "passed").integration.allowedExecutors.includes("scan"));
+  const passed = execute(root, "passed");
+  assert.equal(passed.ok, true, JSON.stringify(passed));
+  assert.equal(passed.cliExitCode, 0);
+  assert.equal(passed.result.execution.exitCode, 0);
+  assert.equal(passed.result.execution.signal, null);
+  assert.equal(passed.result.integration.runId, "passed");
+  assert.equal(passed.result.integration.executionStatus, "completed");
+  assert.deepEqual(fs.readFileSync(path.join(root, selected)), source);
+  const report = JSON.parse(passed.result.execution.stdout);
+  assert.equal(report.summary.fileCount, 1);
+  assert.equal(report.issues.length, 0);
+  const status = request(root, { operation: "status", runId: "passed" });
+  assert.equal(status.result.integration.executionStatus, passed.result.integration.executionStatus);
+  assert.equal(status.result.tools[0].tool, "scan");
+  assert.deepEqual(status.result.tools[0].checkedFiles.map(file => file.path), [selected]);
+  assert.deepEqual(status.result.tools[0].summary.rules.map(rule => rule.id), ["R001"]);
+  fs.writeFileSync(path.join(root, selected), '<template><el-table><el-table-column prop="name"/></el-table></template>\n');
+  plan(root, "failed");
+  const failed = execute(root, "failed");
+  assert.equal(failed.ok, true, JSON.stringify(failed));
+  assert.equal(failed.result.execution.exitCode, 1);
+  assert.equal(failed.result.integration.executionStatus, "failed");
+  assert.equal(failed.result.integration.validationStatus, "failed");
+  assert.ok(JSON.parse(failed.result.execution.stdout).issues.some(issue => issue.rule === "R001"));
+}));
+
+test("execute 省略 rules 沿用计划 R 子集，不调用或显示计划外 R038", () => fixture(root => {
+  fs.writeFileSync(path.join(root, selected), '<template><el-table><el-table-column prop="name" align="center"/></el-table><el-button>新增</el-button></template>\n');
+  const planned = plan(root, "default-plan-rules");
+  const expected = planned.integration.ruleRefs.map(rule => rule.legacyId).filter(id => /^R\d{3}$/.test(id)).sort();
+  assert.ok(expected.includes("R001"));
+  assert.equal(expected.includes("R038"), false);
+  const called = execute(root, "default-plan-rules", { parameters: { targets: [selected] } });
+  assert.equal(called.ok, true, JSON.stringify(called));
+  assert.equal(called.result.execution.exitCode, 0);
+  const report = JSON.parse(called.result.execution.stdout);
+  assert.equal(report.issues.some(issue => issue.rule === "R038"), false);
+  assert.deepEqual(called.result.tools[0].summary.rules.map(rule => rule.id).sort(), expected);
+  assert.equal(called.result.tools[0].checks.some(check => check.id === "R038"), false);
+}));
+
+test("execute 未知执行器、计划外规则/目标与额外字段在原 scanner 前拒绝，计划不变", () => fixture(root => {
+  const planned = plan(root, "rejected");
+  const planFile = path.join(root, planned.recordPath);
+  const files = fs.readdirSync(path.dirname(planFile));
+  const before = fs.readFileSync(planFile);
+  const cases = [
+    [{ executorId: "unknown" }, "unsupported-executor"],
+    [{ parameters: { targets: [] } }, "invalid-executor-input"],
+    [{ parameters: { targets: [selected], rules: ["R999"] } }, "rule-mismatch"],
+    [{ parameters: { targets: [selected], rules: ["R038"] } }, "rule-mismatch"],
+    [{ parameters: { targets: ["src/views/Other/index.vue"] } }, "target-mismatch"],
+    [{ parameters: { targets: [selected], command: "fix" } }, "invalid-executor-input"],
+    [{ targets: [selected] }, "invalid-executor-input"],
+  ];
+  for (const [input, code] of cases) {
+    const rejected = execute(root, "rejected", input);
+    assert.equal(rejected.ok, false, JSON.stringify(input));
+    assert.equal(rejected.cliExitCode, 2);
+    assert.equal(rejected.error.code, code);
+    assert.deepEqual(fs.readFileSync(planFile), before);
+    assert.deepEqual(fs.readdirSync(path.dirname(planFile)), files);
+    assert.equal(request(root, { operation: "status", runId: "rejected" }).result.executionStatus, "not-executed");
+  }
+}));
+
+test("execute 需要本项目有效检查计划：解释、过期、禁用与未知 runId 均拒绝", () => fixture(root => {
+  plan(root, "explain", "解释当前 Vue 样式，不要检查");
+  assert.equal(execute(root, "explain").ok, false);
+  plan(root, "stale");
+  fs.appendFileSync(path.join(root, selected), "<!-- changed after inspect -->\n");
+  assert.equal(execute(root, "stale").ok, false);
+  assert.equal(request(root, { operation: "status", runId: "stale" }).result.executionStatus, "not-executed");
+  plan(root, "disabled");
+  fs.writeFileSync(path.join(root, ".wl-skills-scope.json"), JSON.stringify({ schemaVersion: 1, projectType: "pc", packages: { ui: false } }));
+  assert.equal(execute(root, "disabled").ok, false);
+  assert.equal(execute(root, "unknown-run").ok, false);
+  assert.equal(fs.existsSync(path.join(root, ".wl-skills-ui/runs/unknown-run")), false);
+}));
+
+test("公开 execute 在原 scanner 前拒绝目录中越界的 Vue 叶子，任务回执零新增", () => fixture(root => {
+  const outsideRoot = fs.mkdtempSync(path.join(os.tmpdir(), "wl-ui-external-source-"));
+  try {
+    const external = path.join(outsideRoot, "Outside.vue");
+    const source = '<template><el-table-column prop="external"/></template>';
+    fs.writeFileSync(external, source);
+    fs.symlinkSync(external, path.join(root, "src/views/Selected/Outside.vue"));
+    const target = "src/views/Selected";
+    const planned = request(root, { operation: "task", task: "检查当前 Vue 代码", targets: [target], runId: "external-leaf" });
+    assert.equal(planned.ok, true);
+    const record = path.join(root, planned.result.recordPath);
+    const bytes = fs.readFileSync(record);
+    const files = fs.readdirSync(path.dirname(record));
+    const rejected = execute(root, "external-leaf", { parameters: { targets: [target] } });
+    assert.equal(rejected.ok, false, JSON.stringify(rejected));
+    assert.equal(rejected.error.code, "invalid-executor-input");
+    assert.deepEqual(fs.readFileSync(record), bytes);
+    assert.deepEqual(fs.readdirSync(path.dirname(record)), files);
+    assert.equal(fs.readFileSync(external, "utf8"), source);
+  } finally { fs.rmSync(outsideRoot, { recursive: true, force: true }); }
+}));
+
+test("复制项目不能重用原根任务计划：status 过期、execute 身份拒绝且零新回执", () => fixture(root => {
+  const planned = plan(root, "copied-plan");
+  const copy = fs.mkdtempSync(path.join(os.tmpdir(), "wl-ui-copied-project-"));
+  try {
+    fs.cpSync(root, copy, { recursive: true, verbatimSymlinks: true });
+    const record = path.join(copy, planned.recordPath);
+    const bytes = fs.readFileSync(record);
+    const files = fs.readdirSync(path.dirname(record));
+    const status = request(copy, { operation: "status", runId: "copied-plan" });
+    assert.equal(status.result.planStale, true);
+    assert.equal(status.result.ready, false);
+    assert.equal(status.result.integration.ready, false);
+    const rejected = execute(copy, "copied-plan");
+    assert.equal(rejected.ok, false);
+    assert.equal(rejected.error.code, "identity-mismatch");
+    assert.deepEqual(fs.readFileSync(record), bytes);
+    assert.deepEqual(fs.readdirSync(path.dirname(record)), files);
+  } finally { fs.rmSync(copy, { recursive: true, force: true }); }
+}));

package/bin/__tests__/readiness-compatibility.test.mjs

@@ -0,0 +1,133 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {spawnSync} from "node:child_process";
+
+const repo = path.resolve(import.meta.dirname, '../..');
+const pkg = JSON.parse(fs.readFileSync(path.join(repo, "package.json"), "utf8"));
+const cli = path.join(repo, "bin", 'wl-ui.js');
+const key = 'ui';
+const manifestName = key === "kit" ? ".wl-skills-manifest.json" : ".wl-skills-ui-manifest.json";
+const selected = "src/views/Example/index.vue";
+
+function fixture() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), `wl-${key}-ready-`));
+  fs.writeFileSync(path.join(root, "package.json"), JSON.stringify({private: true, devDependencies: {[pkg.name]: pkg.version, vue: "^3.4.0"}}));
+  fs.mkdirSync(path.join(root, "node_modules/@agile-team"), {recursive: true});
+  fs.symlinkSync(repo, path.join(root, "node_modules", pkg.name), "dir");
+  fs.mkdirSync(path.dirname(path.join(root, selected)), {recursive: true});
+  fs.writeFileSync(path.join(root, selected), "<template><div>example</div></template>\n");
+  const initialized = spawnSync(process.execPath, [cli, "init", ...(key === "ui" ? ["--editor", "all", "--profile", "native-element"] : [])], {cwd: root, encoding: "utf8", timeout: 30000});
+  assert.equal(initialized.status, 0, initialized.stderr || initialized.stdout);
+  return root;
+}
+
+function request(root, transport, operation, input = {}) {
+  let args;
+  if (transport === "protocol") {
+    const file = path.join(root, "request.json");
+    fs.writeFileSync(file, JSON.stringify({operation, projectRoot: root, ...input}));
+    args = ["protocol", "request", "--input-file", file, "--json"];
+  } else {
+    args = [operation, ...(input.task ? [input.task] : []), ...(input.targets || []).flatMap(target => ["--target", target]), ...(input.runId ? ["--run-id", input.runId] : []), "--json"];
+  }
+  const processResult = spawnSync(process.execPath, [cli, ...args], {cwd: root, encoding: "utf8", timeout: 30000});
+  assert.equal(processResult.status, 0, processResult.stderr || processResult.stdout);
+  const result = JSON.parse(processResult.stdout);
+  if (transport === "protocol") {assert.equal(result.ok, true);return result.result;}
+  return result;
+}
+
+function readiness(result, ready, status, runtime) {
+  const decision = result.decision || result;
+  assert.equal(result.ready, ready, "legacy ready must express effective admission");
+  if (status) assert.equal(decision.status, status);
+  if (result.status && result.decision) assert.equal(result.status, decision.status, "flattened task status agrees with its recorded decision");
+  if (runtime) assert.equal(result.notice.runtime.status, runtime);
+  if (result.integration) {
+    assert.equal(result.integration.ready, ready);
+    if (!ready) assert.deepEqual(result.integration.allowedExecutors, []);
+  }
+}
+
+test("legacy 与公开协议：真实版本漂移拒绝且 task/status/route/explain 的 ready 一致", () => {
+  const root = fixture();
+  try {
+    for (const transport of ["legacy", "protocol"]) {
+      for (const operation of ["route", "explain", "task"]) {
+        const input = {task: "检查当前 Vue 代码", targets: [selected], ...(operation === "task" ? {runId: `aligned-${transport}`} : {})};
+        readiness(request(root, transport, operation, input), true, "baseline", "aligned");
+      }
+      readiness(request(root, transport, "status", {runId: `aligned-${transport}`}), true, "baseline", "aligned");
+    }
+    const manifest = path.join(root, manifestName);
+    const bytes = fs.readFileSync(manifest);
+    const old = JSON.parse(bytes);old.version = key === "kit" ? "2.30.0" : "1.19.0";
+    fs.writeFileSync(manifest, JSON.stringify(old));
+    for (const transport of ["legacy", "protocol"]) {
+      for (const operation of ["route", "explain", "task"]) {
+        const input = {task: "检查当前 Vue 代码", targets: [selected], ...(operation === "task" ? {runId: `drift-${transport}`} : {})};
+        const result = request(root, transport, operation, input);
+        readiness(result, false, "gap", "mismatch");
+        assert.equal((result.decision || result).scope.status, "applicable");
+        assert.ok((result.decision || result).gaps.some(gap => gap.code === "runtime-mismatch"));
+      }
+      readiness(request(root, transport, "status", {runId: `aligned-${transport}`}), false, "gap", "mismatch");
+      readiness(request(root, transport, "status", {runId: `drift-${transport}`}), false, "gap", "mismatch");
+    }
+    fs.writeFileSync(manifest, bytes);
+    readiness(request(root, "protocol", "task", {task: "检查当前 Vue 代码", targets: [selected], runId: "replanned"}), true, "baseline", "aligned");
+    readiness(request(root, "protocol", "status", {runId: "replanned"}), true, "baseline", "aligned");
+  } finally {fs.rmSync(root, {recursive: true, force: true});}
+});
+
+test("规则资产存在不能替代适用scope、无歧义与计划新鲜度", () => {
+  const root = fixture();
+  try {
+    for (const transport of ["legacy", "protocol"]) {
+      readiness(request(root, transport, "route", {task: "帮我写诗"}), false, "not-applicable");
+      readiness(request(root, transport, "route", {task: "闲聊"}), false, "needs-context");
+      readiness(request(root, transport, "route", {task: key === "kit" ? "创建页面并自动修复" : "检查表格和表单", targets: [selected]}), false, "ambiguous");
+      readiness(request(root, transport, "status", {runId: "absent"}), false);
+    }
+    const owned = key === "kit" ? path.join(root, ".wl-skills/standards/03-comments.md") : path.join(root, "node_modules", pkg.name);
+    const bytes = key === "kit" ? fs.readFileSync(owned) : null;
+    fs.unlinkSync(owned);
+    for (const transport of ["legacy", "protocol"]) {
+      const result = request(root, transport, "route", {task: "检查当前 Vue 代码", targets: [selected]});
+      readiness(result, false, "gap");
+      assert.ok((result.decision || result).missingInputs.length > 0);
+    }
+    if (key === "kit") fs.writeFileSync(owned, bytes);
+    else fs.symlinkSync(repo, owned, "dir");
+    readiness(request(root, "legacy", "task", {task: "检查当前 Vue 代码", targets: [selected], runId: "freshness"}), true, "baseline");
+    fs.appendFileSync(path.join(root, selected), "<!-- modified after inspect plan -->\n");
+    for (const transport of ["legacy", "protocol"]) {
+      const result = request(root, transport, "status", {runId: "freshness"});
+      assert.equal(result.planStale, true);readiness(result, false, "baseline");
+    }
+    fs.writeFileSync(path.join(root, ".wl-skills-scope.json"), JSON.stringify({schemaVersion: 1, projectType: "pc", packages: {[key]: false}}));
+    for (const transport of ["legacy", "protocol"]) {
+      const result = request(root, transport, "status", {runId: "freshness"});
+      assert.equal(result.currentScope.status, "not-applicable");readiness(result, false);
+      readiness(request(root, transport, "task", {task: "检查当前 Vue 代码", targets: [selected], runId: "disabled"}), false, "not-applicable");
+    }
+  } finally {fs.rmSync(root, {recursive: true, force: true});}
+});
+
+test("未接入和移动项目即使有Vue任务对象也不准入，不新建任务记录", () => {
+  for (const mobile of [false, true]) {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), `wl-${key}-excluded-`));
+    try {
+      fs.writeFileSync(path.join(root, "package.json"), JSON.stringify({private: true, devDependencies: {vue: "^3.4.0", ...(mobile ? {[pkg.name]: pkg.version, "@dcloudio/uni-app": "*"} : {})}}));
+      for (const transport of ["legacy", "protocol"]) {
+        const result = request(root, transport, "task", {task: "检查当前 Vue 代码", targets: [selected], runId: "excluded"});
+        readiness(result, false, "not-applicable");
+        assert.deepEqual(result.requiredRules, []);
+      }
+      assert.equal(fs.existsSync(path.join(root, key === "kit" ? ".wl-skills/runs" : ".wl-skills-ui/runs")), false);
+    } finally {fs.rmSync(root, {recursive: true, force: true});}
+  }
+});

package/bin/executor-cli.mjs

@@ -0,0 +1,13 @@
+import path from "node:path";
+import processCore from "./executor-process.cjs";
+
+// 复用原 scanner CLI，避免 wl-ui 包装器的同步二次子进程。
+// 规则与参数归本包维护；共享协议先验证计划、规则子集与目标范围。
+export function invokeExecutor({ executor, parameters, projectRoot, runId, plan }) {
+  if (executor.id !== "scan") throw new Error(`UI 未实现执行器：${executor.id}`);
+  const rules = parameters.rules || plan.ruleRefs.map(rule => rule.legacyId).filter(id => /^R\d{3}$/.test(id));
+  if (!rules.length) throw new Error("当前计划没有可执行的 UI R 规则，不能默认扩大扫描范围");
+  const args = ["scan", "--project", projectRoot, `--target=${parameters.targets[0]}`, "--run-id", runId, "--output", "json", "--fail-on-error"];
+  args.push("--only", rules.join(","));
+  return processCore.invokeCli({ cli: path.resolve(import.meta.dirname, "../scanner/index.mjs"), args, projectRoot });
+}