@givolt/i3-composer-agent 2.3.0 → 2.3.1

package/.agents/plugins/marketplace.json

@@ -6,7 +6,7 @@
   "plugins": [
     {
       "name": "i3-composer-agent",
-      "version": "2.3.0",
+      "version": "2.3.1",
       "description": "覆盖需求、计划、开发、测试、审查与发布的软件工程技能，默认使用简体中文。",
       "source": {
         "source": "local",

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
   "plugins": [
     {
       "name": "i3-composer-agent",
-      "version": "2.3.0",
+      "version": "2.3.1",
       "source": "./",
       "description": "覆盖需求、计划、开发、测试、审查与发布的软件工程技能，默认使用简体中文。",
       "homepage": "https://github.com/49780522/i3-composer-agent",

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "i3-composer-agent",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "覆盖需求、计划、开发、测试、审查与发布的软件工程技能，默认使用简体中文。",
   "author": {
     "name": "Givolt"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "i3-composer-agent",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "覆盖需求、计划、开发、测试、审查与发布的软件工程技能，默认使用简体中文。",
   "author": {
     "name": "Givolt"

package/README.md

@@ -1,4 +1,4 @@
-# i3 Composer Agent v2.3.0
+# i3 Composer Agent v2.3.1
 
 **Intelligence. Integration. Innovation.**
 

package/docs/other-hosts.md

@@ -6,7 +6,7 @@
 
 ## 使用本地分发目录
 
-以下命令使用完整分发包解压目录里的 CLI，适用于本地测试和离线接入。`/absolute/path/to/package` 均替换为实际解压目录；已发布版本也可使用 `npx @givolt/i3-composer-agent@2.3.0` 的对应入口。
+以下命令使用完整分发包解压目录里的 CLI，适用于本地测试和离线接入。`/absolute/path/to/package` 均替换为实际解压目录；已发布版本也可使用 `npx @givolt/i3-composer-agent@2.3.1` 的对应入口。
 
 ### fx
 

package/package.json

@@ -168,6 +168,8 @@
     "plugin.json",
     "README.md",
     "LICENSE",
+    "scripts/design-provider-discovery-test.js",
+    "scripts/design-provider-test.js",
     "scripts/enterprise-template-test.js",
     "scripts/floor-guard-reference-test.js",
     "scripts/lib/skill-lint-test.js",
@@ -354,6 +356,8 @@
       "package.json",
       "README.md",
       "LICENSE",
+      "scripts/design-provider-discovery-test.js",
+      "scripts/design-provider-test.js",
       "scripts/enterprise-template-test.js",
       "scripts/floor-guard-reference-test.js",
       "scripts/lib/skill-lint-test.js",
@@ -374,7 +378,7 @@
       "scripts/validate-versions.js"
     ]
   },
-  "version": "2.3.0",
+  "version": "2.3.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/49780522/i3-composer-agent.git"

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "i3-composer-agent",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "覆盖需求、计划、开发、测试、审查与发布的软件工程技能，默认使用简体中文。",
   "homepage": "https://github.com/49780522/i3-composer-agent",
   "repository": "https://github.com/49780522/i3-composer-agent"

package/scripts/design-provider-discovery-test.js

@@ -0,0 +1,190 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const childProcess = require('node:child_process');
+const installationFile = path.join(__dirname, 'lib/installation.js');
+const skillsDirectory = fs.existsSync(installationFile) ? require(installationFile).loadInstallation().skillsDirectory : path.resolve(__dirname, '../skills');
+const moduleFile = path.join(skillsDirectory, 'i3-ui-prototype/scripts/design-provider-discovery.cjs');
+
+function fixture(t) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'i3-provider-discovery-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const home = path.join(root, 'home'), project = path.join(root, 'project');
+  fs.mkdirSync(home); fs.mkdirSync(project);
+  return { root, home, project, env: {} };
+}
+function write(file, value) { fs.mkdirSync(path.dirname(file), { recursive: true }); fs.writeFileSync(file, typeof value === 'string' ? value : JSON.stringify(value)); }
+function skill(root) { write(path.join(root, 'SKILL.md'), '# Fixture UI/UX'); return root; }
+function discover(options, run = () => { throw new Error('Unexpected host CLI call'); }) {
+  const original = childProcess.spawnSync;
+  childProcess.spawnSync = run;
+  delete require.cache[require.resolve(moduleFile)];
+  let api;
+  try { api = require(moduleFile); } finally { childProcess.spawnSync = original; }
+  return api.discoverProviderCandidates(options);
+}
+function codexPlugin(f, overrides = {}) {
+  const record = { pluginId: 'ui-ux-pro-max@ui-ux-pro-max-skill', name: 'ui-ux-pro-max', marketplaceName: 'ui-ux-pro-max-skill', version: '2.15.0', installed: true, enabled: true, ...overrides };
+  const cache = path.join(f.env.CODEX_HOME || path.join(f.home, '.codex'), 'plugins/cache/ui-ux-pro-max-skill/ui-ux-pro-max', record.version);
+  if (!record.version.includes('..')) {
+    write(path.join(cache, '.claude-plugin/plugin.json'), { name: 'ui-ux-pro-max', version: record.version, skills: './.claude/skills/' });
+    skill(path.join(cache, '.claude/skills/ui-ux-pro-max'));
+  }
+  return { record, cache, run: () => ({ status: 0, stdout: JSON.stringify({ installed: [record], available: [] }) }) };
+}
+function registryPlugin(f, host, records, enabled = true) {
+  const config = path.join(f.home, `.${host}`), id = 'ui-ux-pro-max@fixture-market';
+  write(path.join(config, 'settings.json'), { enabledPlugins: { [id]: enabled } });
+  write(path.join(config, 'plugins/installed_plugins.json'), { version: 2, plugins: { [id]: records } });
+  for (const record of records) {
+    write(path.join(record.installPath, host === 'claude' ? '.claude-plugin/plugin.json' : '.codebuddy-plugin/plugin.json'), { name: 'ui-ux-pro-max', version: record.version, ...(host === 'claude' ? { skills: './.claude/skills/' } : {}) });
+    skill(path.join(record.installPath, host === 'claude' ? '.claude/skills/ui-ux-pro-max' : 'skills/ui-ux-pro-max'));
+  }
+  return config;
+}
+
+test('explicit provider has precedence over host roots and does not invoke discovery', t => {
+  const f = fixture(t), root = path.join(f.root, 'explicit');
+  assert.deepEqual(discover({ ...f, provider: root, providerRoots: ['/ignored'], host: 'codex' }), { candidates: [{ root, source: 'explicit' }], diagnostics: [] });
+});
+test('host-exposed provider roots work without host context and preserve order', t => {
+  const f = fixture(t), roots = [path.join(f.root, 'first'), path.join(f.root, 'second')];
+  assert.deepEqual(discover({ ...f, providerRoots: roots }).candidates.map(c => c.root), roots);
+  assert.equal(discover({ ...f, providerRoots: [] }).contextRequired, undefined);
+});
+test('unknown host requires context and cannot read another host cache', t => {
+  const f = fixture(t); skill(path.join(f.home, '.claude/skills/ui-ux-pro-max'));
+  assert.equal(discover(f).contextRequired, true);
+  assert.equal(discover({ ...f, host: 'unknown' }).contextRequired, true);
+  assert.deepEqual(discover({ ...f, host: 'unknown' }).candidates, []);
+});
+test('discover false prevents automatic host access', t => {
+  const f = fixture(t); skill(path.join(f.home, '.agents/skills/ui-ux-pro-max'));
+  assert.deepEqual(discover({ ...f, host: 'codex', discover: false }), { candidates: [], diagnostics: [], contextRequired: true });
+});
+test('Codex returns project then global skill locations and the exact enabled plugin version', t => {
+  const f = fixture(t), plugin = codexPlugin(f);
+  const project = skill(path.join(f.project, '.agents/skills/ui-ux-pro-max'));
+  const global = skill(path.join(f.home, '.codex/skills/ui-ux-pro-max'));
+  const stale = path.join(f.home, '.codex/plugins/cache/ui-ux-pro-max-skill/ui-ux-pro-max/99.0.0/.claude/skills/ui-ux-pro-max'); skill(stale);
+  let command;
+  const result = discover({ ...f, host: 'codex' }, (...args) => { command = args; return plugin.run(); });
+  assert.deepEqual(result.candidates.map(c => c.root), [project, global, path.join(plugin.cache, '.claude/skills/ui-ux-pro-max')]);
+  assert.equal(command[0], 'codex');
+  assert.deepEqual(command[1], ['plugin', 'list', '--marketplace', 'ui-ux-pro-max-skill', '--json']);
+  assert.ok(command[2].timeout > 0 && command[2].timeout <= 15000);
+  assert.equal(command[2].shell, false);
+});
+test('Codex honors isolated CODEX_HOME and never scans the default cache', t => {
+  const f = fixture(t); f.env.CODEX_HOME = path.join(f.root, 'custom-codex');
+  const plugin = codexPlugin(f);
+  const result = discover({ ...f, host: 'codex' }, plugin.run);
+  assert.equal(result.candidates.at(-1).root, path.join(plugin.cache, '.claude/skills/ui-ux-pro-max'));
+});
+test('Codex disabled cached plugin is not a candidate', t => {
+  const f = fixture(t), plugin = codexPlugin(f, { enabled: false });
+  const result = discover({ ...f, host: 'codex' }, plugin.run);
+  assert.deepEqual(result.candidates, []);
+  assert.equal(result.diagnostics[0].availability, 'disabled');
+});
+test('Codex missing installation does not inspect cached versions', t => {
+  const f = fixture(t); codexPlugin(f);
+  const result = discover({ ...f, host: 'codex' }, () => ({ status: 0, stdout: '{"installed":[],"available":[]}' }));
+  assert.deepEqual(result.candidates, []);
+  assert.ok(result.diagnostics.every(d => d.availability === 'missing'));
+});
+for (const [name, run] of [
+  ['missing CLI', () => ({ status: null, error: { code: 'ENOENT' }, stdout: '' })],
+  ['failed CLI', () => ({ status: 1, stderr: 'failure', stdout: '' })],
+  ['invalid JSON', () => ({ status: 0, stdout: '{bad' })],
+  ['invalid schema', () => ({ status: 0, stdout: '{}' })],
+]) test(`Codex ${name} is a discovery error, not a missing installation`, t => {
+  const f = fixture(t), result = discover({ ...f, host: 'codex' }, run);
+  assert.equal(result.diagnostics[0].availability, 'discovery-error');
+});
+test('Codex rejects multiple active installed records instead of selecting a version', t => {
+  const f = fixture(t), { record } = codexPlugin(f);
+  const result = discover({ ...f, host: 'codex' }, () => ({ status: 0, stdout: JSON.stringify({ installed: [record, { ...record, version: '2.14.0' }] }) }));
+  assert.deepEqual(result.candidates, []);
+  assert.equal(result.diagnostics[0].availability, 'ambiguous');
+});
+for (const [name, change] of [
+  ['wrong manifest version', m => { m.version = '2.14.0'; }],
+  ['wrong manifest name', m => { m.name = 'different'; }],
+  ['escaping skills declaration', m => { m.skills = '../../../outside'; }],
+  ['missing skills declaration', m => { delete m.skills; }],
+]) test(`Codex rejects ${name}`, t => {
+  const f = fixture(t), plugin = codexPlugin(f), file = path.join(plugin.cache, '.claude-plugin/plugin.json');
+  const manifest = JSON.parse(fs.readFileSync(file)); change(manifest); write(file, manifest);
+  const result = discover({ ...f, host: 'codex' }, plugin.run);
+  assert.deepEqual(result.candidates, []);
+  assert.equal(result.diagnostics[0].availability, 'discovery-error');
+});
+test('Codex validates the active version as a single safe path segment', t => {
+  const f = fixture(t), plugin = codexPlugin(f, { version: '../../escape' });
+  assert.equal(discover({ ...f, host: 'codex' }, plugin.run).diagnostics[0].availability, 'discovery-error');
+});
+test('Codex rejects a child skill symlink escaping the registered plugin root', t => {
+  const f = fixture(t), plugin = codexPlugin(f), outside = skill(path.join(f.root, 'outside'));
+  const child = path.join(plugin.cache, '.claude/skills/ui-ux-pro-max');
+  fs.rmSync(child, { recursive: true }); fs.symlinkSync(outside, child, 'dir');
+  const result = discover({ ...f, host: 'codex' }, plugin.run);
+  assert.deepEqual(result.candidates, []);
+  assert.equal(result.diagnostics[0].availability, 'discovery-error');
+});
+for (const host of ['claude', 'workbuddy', 'codebuddy']) test(`${host} selects only enabled registered plugins`, t => {
+  const f = fixture(t), installPath = path.join(f.root, host, 'plugin');
+  registryPlugin(f, host, [{ scope: 'user', installPath, version: '2.0.0' }]);
+  const result = discover({ ...f, host });
+  assert.deepEqual(result.candidates.map(c => c.root), [path.join(installPath, host === 'claude' ? '.claude/skills/ui-ux-pro-max' : 'skills/ui-ux-pro-max')]);
+  registryPlugin(f, host, [{ scope: 'user', installPath, version: '2.0.0' }], false);
+  const disabled = discover({ ...f, host });
+  assert.deepEqual(disabled.candidates, []); assert.equal(disabled.diagnostics[0].availability, 'disabled');
+});
+test('missing optional registry is normal, while corrupt metadata is an error', t => {
+  const f = fixture(t);
+  assert.ok(discover({ ...f, host: 'workbuddy' }).diagnostics.every(d => d.availability === 'missing'));
+  write(path.join(f.home, '.workbuddy/plugins/installed_plugins.json'), '{invalid');
+  assert.equal(discover({ ...f, host: 'workbuddy' }).diagnostics[0].availability, 'discovery-error');
+});
+test('a registered plugin with missing enablement metadata needs diagnosis instead of installation', t => {
+  const f = fixture(t);
+  const config = registryPlugin(f, 'workbuddy', [{ scope: 'user', installPath: path.join(f.root, 'plugin'), version: '2.0.0' }]);
+  fs.unlinkSync(path.join(config, 'settings.json'));
+  const result = discover({ ...f, host: 'workbuddy' });
+  assert.deepEqual(result.candidates, []);
+  assert.equal(result.diagnostics[0].availability, 'discovery-error');
+});
+test('project plugin scope must match the current project path', t => {
+  const f = fixture(t), installPath = path.join(f.root, 'plugin');
+  registryPlugin(f, 'claude', [{ scope: 'project', projectPath: path.join(f.root, 'other-project'), installPath, version: '2.0.0' }]);
+  assert.deepEqual(discover({ ...f, host: 'claude-code' }).candidates, []);
+  registryPlugin(f, 'claude', [{ scope: 'project', projectPath: f.project, installPath, version: '2.0.0' }]);
+  assert.equal(discover({ ...f, host: 'claude-code' }).candidates.length, 1);
+  registryPlugin(f, 'claude', [{ scope: 'project', installPath, version: '2.0.0' }]);
+  assert.deepEqual(discover({ ...f, host: 'claude-code' }).candidates, []);
+});
+test('ambiguous matching registry entries do not pick one arbitrarily', t => {
+  const f = fixture(t);
+  registryPlugin(f, 'workbuddy', [
+    { scope: 'user', installPath: path.join(f.root, 'first'), version: '2.0.0' },
+    { scope: 'user', installPath: path.join(f.root, 'second'), version: '2.1.0' },
+  ]);
+  const result = discover({ ...f, host: 'workbuddy' });
+  assert.deepEqual(result.candidates, []); assert.equal(result.diagnostics[0].availability, 'ambiguous');
+});
+test('host selection never borrows another host global plugin', t => {
+  const f = fixture(t);
+  registryPlugin(f, 'claude', [{ scope: 'user', installPath: path.join(f.root, 'claude'), version: '2.0.0' }]);
+  registryPlugin(f, 'workbuddy', [{ scope: 'user', installPath: path.join(f.root, 'workbuddy'), version: '2.0.0' }]);
+  assert.deepEqual(discover({ ...f, host: 'codebuddy' }).candidates, []);
+});
+test('WorkBuddy uses its global config override and the project CodeBuddy skills directory', t => {
+  const f = fixture(t); f.env.WORKBUDDY_CONFIG_DIR = path.join(f.root, 'custom-workbuddy');
+  const projectRoot = skill(path.join(f.project, '.codebuddy/skills/ui-ux-pro-max'));
+  const globalRoot = skill(path.join(f.env.WORKBUDDY_CONFIG_DIR, 'skills/ui-ux-pro-max'));
+  assert.deepEqual(discover({ ...f, host: 'workbuddy' }).candidates.map(c => c.root), [projectRoot, globalRoot]);
+});

package/scripts/design-provider-test.js

@@ -0,0 +1,68 @@
+'use strict';
+const { test, mock } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const cp = require('node:child_process');
+mock.method(cp, 'spawnSync', (command, args) => {
+  if (!args.includes('--json') || args[0] !== '-B') return { status: 1, stdout: '', stderr: 'No plugin CLI in isolated test' };
+  if (args[1].includes('query-fails')) return { status: 1, stdout: '', stderr: 'Python module unavailable' };
+  return { status: 0, stdout: JSON.stringify({ domain: 'ux', results: [{ name: 'Error summary' }] }), stderr: '' };
+});
+const installationFile = path.join(__dirname, 'lib/installation.js');
+const skillsDirectory = fs.existsSync(installationFile) ? require(installationFile).loadInstallation().skillsDirectory : path.resolve(__dirname, '../skills');
+const lib = require(path.join(skillsDirectory, 'i3-ui-prototype/scripts/prototype-lib.cjs'));
+function fixture(t) {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'i3-provider-'));
+  t.after(() => fs.rmSync(home, { recursive: true, force: true }));
+  return home;
+}
+function provider(home, name) {
+  const root = path.join(home, name);
+  for (const file of ['SKILL.md', 'scripts/search.py', 'scripts/core.py', 'scripts/design_system.py', ...['ux-guidelines', 'styles', 'colors', 'typography', 'products', 'landing', 'ui-reasoning'].map(name => `data/${name}.csv`)]) {
+    fs.mkdirSync(path.dirname(path.join(root, file)), { recursive: true });
+    fs.writeFileSync(path.join(root, file), 'fixture');
+  }
+  return root;
+}
+test('an incomplete project provider does not shadow a usable global provider', t => {
+  const home = fixture(t), local = path.join(home, 'project-provider'), global = provider(home, 'global-provider');
+  fs.mkdirSync(local);
+  const result = lib.checkDesignProvider({ providerRoots: [local, global] });
+  assert.equal(result.availability, 'available');
+  assert.equal(result.root, global);
+  assert.equal(result.attempts[0].availability, 'unusable');
+  assert.ok(result.attempts[0].missing.includes('scripts/search.py'));
+});
+test('a failed project query does not shadow a usable global provider', t => {
+  const home = fixture(t), local = provider(home, 'query-fails'), global = provider(home, 'global-provider');
+  const result = lib.checkDesignProvider({ providerRoots: [local, global] });
+  assert.equal(result.availability, 'available');
+  assert.equal(result.root, global);
+  assert.match(result.attempts[0].reason, /Python module unavailable/);
+});
+test('an explicit provider failure never silently selects a different provider', t => {
+  const home = fixture(t), selected = path.join(home, 'missing'), other = provider(home, 'other');
+  const result = lib.checkDesignProvider({ provider: selected, providerRoots: [other] });
+  assert.equal(result.availability, 'missing');
+  assert.deepEqual(result.searched, [selected]);
+});
+test('without host or provider the result requests context, not installation', t => {
+  const home = fixture(t);
+  const result = lib.initPrototype({ project: home, id: 'demo', home, env: {} });
+  assert.equal(result.provider.availability, 'needs-context');
+  assert.equal(result.choices[0].id, 'locate');
+  assert.ok(!result.choices.some(choice => choice.id === 'install'));
+  assert.equal(fs.existsSync(path.join(home, 'prototypes')), false);
+});
+test('all unusable providers preserve their individual failure reasons without asking to reinstall', t => {
+  const home = fixture(t), incomplete = path.join(home, 'incomplete'), failing = provider(home, 'query-fails');
+  fs.mkdirSync(incomplete);
+  const result = lib.initPrototype({ project: home, id: 'demo', providerRoots: [incomplete, failing] });
+  assert.equal(result.provider.availability, 'unusable');
+  assert.equal(result.provider.attempts.length, 2);
+  assert.equal(result.choices[0].id, 'repair');
+  assert.ok(!result.choices.some(choice => choice.id === 'install'));
+  assert.equal(fs.existsSync(path.join(home, 'prototypes')), false);
+});

package/scripts/enterprise-template-test.js

@@ -10,6 +10,7 @@ const install = path.join(__dirname, 'lib/installation.js');
 const skills = fs.existsSync(install) ? require(install).loadInstallation().skillsDirectory : path.resolve(__dirname, '../skills');
 const skill = path.join(skills, 'i3-ui-prototype');
 const lib = require(path.join(skill, 'scripts/prototype-lib.cjs'));
+const enterprise = require(path.join(skill, 'scripts/enterprise-template.cjs'));
 const read = (root, file) => JSON.parse(fs.readFileSync(path.join(root, file), 'utf8'));
 function project(t) {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'enterprise-template-'));
@@ -19,6 +20,45 @@ function project(t) {
 function initialize(t, options = {}) {
   return lib.initPrototype({ project: project(t), id: 'enterprise-demo', expertMode: 'template', purpose: 'template-review', ...options }).directory;
 }
+test('runtime branding changes uppercase product text only in runtime HTML and JavaScript', () => {
+  const source = 'EASEL easel-html /easel EASEL 研发';
+  for (const file of ['index.html', 'src/shell/ConsoleShell.html', 'src/models/data.js']) {
+    assert.equal(enterprise.brandRuntimeResource(file, source), 'i3-Composer easel-html /easel i3-Composer 研发');
+  }
+  for (const file of ['origin.json', 'licenses/EASEL.txt', 'qa/REVIEW.md', 'src/styles.css', 'tests/behavior.js', 'app.js']) {
+    const bytes = Buffer.from(source);
+    assert.equal(enterprise.brandRuntimeResource(file, bytes), bytes, file);
+  }
+  assert.ok(Buffer.isBuffer(enterprise.brandRuntimeResource('src/models/data.js', Buffer.from(source))));
+});
+test('generated enterprise runtime uses i3-Composer branding with one final adaptation record per changed source', t => {
+  const dir = initialize(t, { title: 'i3-Composer 品牌验收' });
+  const shell = fs.readFileSync(path.join(dir, 'app/src/shell/ConsoleShell.html'), 'utf8');
+  assert.match(shell, /<strong>i3-Composer<\/strong>/);
+  assert.doesNotMatch(shell, /EASEL/);
+  assert.match(fs.readFileSync(path.join(dir, 'app/index.html'), 'utf8'), /<title>i3-Composer/);
+  const models = fs.readFileSync(path.join(dir, 'app/src/models/data.js'), 'utf8');
+  assert.match(models, /i3-Composer 研发/);
+  assert.doesNotMatch(models, /EASEL/);
+  assert.match(fs.readFileSync(path.join(dir, 'app/src/permissions/MemberEditor.html'), 'utf8'), /i3-Composer 业务角色/);
+  assert.doesNotMatch(read(dir, 'requirements-map.json').scope, /EASEL/);
+  assert.doesNotMatch(fs.readFileSync(path.join(dir, 'mocks/README.md'), 'utf8'), /EASEL/);
+  const origin = enterprise.verifyReference(), source = read(dir, 'design-system/source.json');
+  assert.equal(origin.fileCount, 326);
+  assert.equal(new Set(source.adaptations.map(record => record.file)).size, source.adaptations.length);
+  const adapted = new Map(source.adaptations.map(record => [record.file, record]));
+  for (const [file, expected] of Object.entries(origin.files)) {
+    const generated = crypto.createHash('sha256').update(fs.readFileSync(path.join(dir, 'app', file))).digest('hex');
+    if (generated === expected) continue;
+    const record = adapted.get(file);
+    assert.ok(record, `Unrecorded runtime adaptation: ${file}`);
+    assert.equal(record.source, expected, file);
+    assert.equal(record.generated, generated, file);
+    assert.ok(record.reason, file);
+  }
+  assert.match(adapted.get('index.html').reason, /i3-Composer/);
+  assert.match(adapted.get('src/models/data.js').reason, /i3-Composer/);
+});
 test('four prototype families expose the EASEL enterprise template and explicitly defer the other three', () => {
   const entries = lib.listTemplates();
   assert.deepEqual(entries.map(x => x.id), ['enterprise-admin', 'ai-workbench', 'digital-twin', 'mobile-app']);

package/skills/i3-ui-prototype/SKILL.md

@@ -39,19 +39,19 @@ Skill/Command/Agent 标识、文件路径、命令参数、代码/API 名称、
 
 ### 2. 检测专业能力并继续模板预览
 
-新增原型默认 `professional`（专业增强模式）。从当前宿主实际暴露的技能位置发现 UI/UX Pro Max，再运行本技能 `scripts/check-design-provider.cjs --provider <实际技能根>`。不能硬编码开发者的缓存路径、把另一宿主的安装误当当前可用，或仅凭目录存在判断可执行。需要按宿主目录检测时使用明确的 `--host` 和 `--project`。
+新增原型默认 `professional`（专业增强模式）。优先使用当前宿主暴露的 UI/UX Pro Max 技能位置，运行 `scripts/check-design-provider.cjs --provider <实际技能根>`；也可传入明确的 `--host` 和 `--project` 自动检测项目、全局 Skill 和已启用插件。项目安装的本技能可直接复用同一宿主的全局 UI/UX Pro Max，无需再复制到项目。不能硬编码缓存版本、借用另一宿主安装，或仅凭目录存在判断可执行。明确指定的 provider 失败时报告该路径，不自动换成别的副本。
 
-检测不阻断模板预览，先继续展示模板并记录选择。生成前已可用时自动使用；缺失或不可执行时明确给出安装/修复与“模板模式继续”“先整理需求和模板选择”。用户选择安装后按该宿主的官方方法安装并验证；已有授权或已选择模板模式时不重复确认。安装系统运行环境需根据实际缺项处理，不能静默改动操作系统。
+检测不阻断模板预览，先继续展示模板并记录选择。自动检测遇到不可用项目副本时继续检测全局副本；运行探测通过后使用。缺少宿主信息时补充宿主或实际技能路径；已安装但停用、资源不全、查询失败、发现信息不完整时分别提示启用、修复或定位，不能一律要求重新安装。确认当前宿主未安装时提供安装入口；始终允许明确选择“模板模式继续”或“先整理需求和模板选择”，默认不降级。用户选择安装后按该宿主的官方方法安装并验证；已有授权或已选择模板模式时不重复确认。安装系统运行环境需根据实际缺项处理，不能静默改动操作系统。
 
 模板模式使用 `template`，仍使用同一套业务和浏览器验收标准。不得静默切换，交付记录必须说明实际模式。专业接入的查询与建议适配见 [expert-adapter.md](references/expert-adapter.md)。
 
 ### 3. 选择模板并固定版本
 
-运行 `node <skill-root>/scripts/init-prototype.cjs templates` 查看四类：企业管理后台、AI 工作台、数字孪生大屏、移动端应用。按 availability 区分可操作模板与 planned；不能把待建设类型生成成其他类型。通过 `node <skill-root>/assets/templates/serve-gallery.cjs` 打开选择页。企业后台直接复用 EASEL 完整 HTML 审查版，当前可供人工测试，其余三类待后续实施。已有模板选择时沿用。
+运行 `node <skill-root>/scripts/init-prototype.cjs templates` 查看四类：企业管理后台、AI 工作台、数字孪生大屏、移动端应用。按 availability 区分可操作模板与 planned；不能把待建设类型生成成其他类型。通过 `node <skill-root>/assets/templates/serve-gallery.cjs` 打开选择页。企业后台使用 i3-Composer 品牌的完整 HTML 审查版，当前可供人工测试，其余三类待后续实施。已有模板选择时沿用。
 
 选择页只切换预览，不创建或确认业务实例。可生成模板使用 catalog/manifest 显式指定运行层；未知或缺失 adapter 不回退到 common。资源组织、独立模板扩展与旧实例兼容见 [template-adapters.md](references/template-adapters.md)。
 
-企业后台保留原 EASEL 的全部页面、样式、控件和交互。审查整套模板时显式使用 `--purpose template-review`；为新业务生成时沿用默认 business-prototype，替换项目菜单、字段、状态、角色、数据和需求映射，完成后才将 business.status 标为 adapted。旧 classic-admin、modern-workspace、data-operations 仅保留兼容和历史样例迭代，不再作为新项目首选。框架工程保持既有设计规则，交接包含真实组件映射，HTML 审查版不等于真实 Vue/React 组件工程。
+企业后台保留原 EASEL 的全部页面、样式、控件和交互；预览及新实例的页面标题、导航、示例项目和相关说明统一使用 i3-Composer，来源快照与内部兼容标识保留。审查整套模板时显式使用 `--purpose template-review`；为新业务生成时沿用默认 business-prototype，替换项目菜单、字段、状态、角色、数据和需求映射，完成后才将 business.status 标为 adapted。旧 classic-admin、modern-workspace、data-operations 仅保留兼容和历史样例迭代，不再作为新项目首选。框架工程保持既有设计规则，交接包含真实组件映射，HTML 审查版不等于真实 Vue/React 组件工程。
 
 创建示例：
 
@@ -61,7 +61,7 @@ node <skill-root>/scripts/init-prototype.cjs --project <project-root> --id enter
 node <skill-root>/scripts/init-prototype.cjs --project <project-root> --id enterprise-review --template enterprise-admin --purpose template-review --expert-mode template
 ```
 
-企业后台初始化保留完整 EASEL 示例。template-review 用于本次模板人工审查；business-prototype 初始为 needs-adaptation，未完成实际业务适配时验收守卫拒绝通过。复制的 app/qa 是历史来源材料，本次验收使用原型根 qa/。目标已存在时使用迭代流程，不覆盖。完整复用、来源核对与响应式规则见 [enterprise-admin.md](references/enterprise-admin.md)。
+企业后台初始化保留完整 i3-Composer 示例。template-review 用于本次模板人工审查；business-prototype 初始为 needs-adaptation，未完成实际业务适配时验收守卫拒绝通过。复制的 app/qa 是历史来源材料，本次验收使用原型根 qa/。目标已存在时使用迭代流程，不覆盖。完整复用、来源核对与响应式规则见 [enterprise-admin.md](references/enterprise-admin.md)。
 
 ### 4. 专业设计与业务实现
 

package/skills/i3-ui-prototype/assets/templates/catalog.json

@@ -4,7 +4,8 @@
     {
       "id": "enterprise-admin",
       "name": "企业管理后台",
-      "version": "0.1.0",
+      "brand": "i3-Composer",
+      "version": "0.1.1",
       "availability": "available",
       "reviewStatus": "pending-review",
       "artifactKind": "html-review",
@@ -17,7 +18,7 @@
       ],
       "preview": "enterprise-admin/index.html#/workbench",
       "fixed": [
-        "原 EASEL 设计 token",
+        "既有设计 token",
         "导航和控件规范",
         "权限及状态语义"
       ],

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/design-system.md

@@ -8,7 +8,7 @@
 默认使用简体中文解释、追问及生成报告；用户明确要求其他语言时可切换。原方法正文、引用、阈值和审批条件完整保留。代码标识、路径、命令、工具参数、JSON 键/枚举与原文引用保持原样。
 <!-- i3:zh-guide:end -->
 
-本模板直接复用 EASEL v0.14 的 Antdv Next HTML 审查成果，保留其全部页面、交互、控件、规则测试及来源材料。当前用于人工审查，用户尚未认可本次模板候选。
+本模板统一使用 i3-Composer 品牌，基于 EASEL v0.14 的 Antdv Next HTML 审查成果，保留其全部页面、交互、控件、规则测试及来源材料。当前用于人工审查，用户尚未认可本次模板候选。
 
 ## 设计基础
 
@@ -23,10 +23,10 @@
 
 ## 使用范围
 
-`template-review` 用于审查完整 EASEL 示例；保留示例菜单、业务及演示数据便于对照。`business-prototype` 需要替换目标项目的菜单、页面、字段、角色、状态、模拟数据和需求映射，未完成时记录 needs-adaptation，不能通过业务验收。
+`template-review` 用于审查完整 i3-Composer 示例；保留示例菜单、业务及演示数据便于对照。`business-prototype` 需要替换目标项目的菜单、页面、字段、角色、状态、模拟数据和需求映射，未完成时记录 needs-adaptation，不能通过业务验收。
 
 UI/UX Pro Max 在既有设计规则内提供校核建议，不能擅自替换模板风格。当前验收读取原型根 `qa/`；`app/qa/` 为复制的历史来源记录，不作为本次验收。
 
 ## 内容与滚动
 
-完整保留原 EASEL 内容。窄屏下允许表格和标签栏局部横向滚动，滚动条须清晰可见；不得通过隐藏、删列、裁剪内容满足页面宽度检查。原始 reference 文件保持来源字节，滚动修复放在实例 usability.css 中。
+完整保留原有内容。窄屏下允许表格和标签栏局部横向滚动，滚动条须清晰可见；不得通过隐藏、删列、裁剪内容满足页面宽度检查。原始 reference 文件保持来源字节，品牌文案只在预览响应与生成副本中适配，滚动修复放在实例 usability.css 中。

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/index.html

@@ -3,7 +3,7 @@
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>EASEL · Antdv Next 交互原型 · HTML 模板</title>
+  <title>i3-Composer · 企业管理后台原型</title>
   <link rel="icon" href="data:,">
   <link rel="stylesheet" href="reference/styles/reset.css">
   <link rel="stylesheet" href="reference/styles/antdv.css">

package/skills/i3-ui-prototype/assets/templates/enterprise-admin/manifest.json

@@ -5,5 +5,5 @@
   "resources": {
     "root": "enterprise-admin"
   },
-  "defaultTitle": "企业管理后台 · EASEL 完整示例"
+  "defaultTitle": "i3-Composer · 企业管理后台"
 }

package/skills/i3-ui-prototype/assets/templates/gallery/index.html

@@ -2,7 +2,7 @@
 <html lang="zh-CN">
 <head>
 <meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>选择原型类型 · i3 Composer</title><link rel="icon" href="data:,">
+<title>选择原型类型 · i3-Composer</title><link rel="icon" href="data:,">
 <style>
 *{box-sizing:border-box}html{height:100%}body{height:100vh;height:100dvh;display:flex;flex-direction:column;margin:0;background:#f5f5f5;color:#262626;font:14px/1.5 -apple-system,BlinkMacSystemFont,"PingFang SC","Microsoft YaHei",sans-serif}header{flex:none;padding:20px 24px 16px;background:#fff;border-bottom:1px solid #e8e8e8}h1{font-size:22px;margin:0 0 4px}p{margin:0;color:#595959}.options{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:12px;margin:16px 0}.option{text-align:left;border:1px solid #d9d9d9;border-radius:8px;padding:12px 14px;background:#fff;color:inherit;font:inherit;cursor:pointer}.option strong{display:block;font-size:16px;margin-bottom:4px}.option span{display:block;font-size:13px;color:#595959}.option[aria-pressed=true]{border-color:#1677ff;background:#f0f7ff}.option:disabled{cursor:default;background:#fafafa;color:#8c8c8c}.option:disabled span{color:#8c8c8c}.option:focus-visible,a:focus-visible{outline:3px solid #1677ff;outline-offset:3px}.summary{display:flex;align-items:center;justify-content:space-between;gap:16px;flex-wrap:wrap}.summary a{color:#0958d9;text-decoration:none;white-space:nowrap}.summary a:hover{text-decoration:underline}iframe{display:block;flex:1 0 240px;width:100%;min-height:240px;border:0;background:#fff}.error{color:#cf1322}
 @media(max-width:900px){header{padding:16px}.options{grid-template-columns:repeat(2,minmax(0,1fr));gap:8px}.option{padding:10px}.option strong{font-size:14px}.summary{gap:8px}}
@@ -29,7 +29,7 @@ try{
    const url=new URL(entry.preview,assetRoot);if(url.origin!==location.origin)throw new Error('模板入口必须来自本地资源');
    document.querySelectorAll('.option').forEach(item=>item.setAttribute('aria-pressed',String(item===button)));
    frame.src=url.href;frame.title=entry.name+'完整交互演示';document.querySelector('#open').href=url.href;
-   summary.textContent=entry.name+' · '+entry.version+' · 来源：'+entry.source+'。保留完整示例，当前等待人工评审。';
+   summary.textContent=(entry.brand?entry.brand+' · ':'')+entry.name+' · '+entry.version+'。保留完整示例，当前等待人工评审。';
   });
   document.querySelector('.options').append(button);
   if(!selected&&!button.disabled){button.click();selected=true}

package/skills/i3-ui-prototype/assets/templates/serve-gallery.cjs

@@ -2,6 +2,7 @@
 const http = require('node:http');
 const fs = require('node:fs');
 const path = require('node:path');
+const { brandRuntimeResource } = require('../../scripts/enterprise-template.cjs');
 const root = path.resolve(__dirname);
 const types = { '.html': 'text/html', '.mjs': 'text/javascript', '.js': 'text/javascript', '.css': 'text/css', '.json': 'application/json', '.svg': 'image/svg+xml', '.png': 'image/png', '.jpg': 'image/jpeg', '.webp': 'image/webp' };
 const server = http.createServer((req, res) => {
@@ -11,6 +12,12 @@ const server = http.createServer((req, res) => {
   const file = path.resolve(root, '.' + relative);
   if (!file.startsWith(root + path.sep) || !fs.existsSync(file) || !fs.statSync(file).isFile() || !fs.realpathSync(file).startsWith(root + path.sep)) { res.writeHead(404).end(); return; }
   res.writeHead(200, { 'Content-Type': (types[path.extname(file)] || 'application/octet-stream') + '; charset=utf-8', 'Cache-Control': 'no-store' });
+  const enterpriseReference = path.join(root, 'enterprise-admin/reference');
+  if (file.startsWith(enterpriseReference + path.sep) && /\.(?:html|js|mjs)$/.test(file)) {
+    const relative = path.relative(enterpriseReference, file).split(path.sep).join('/');
+    res.end(brandRuntimeResource(relative, fs.readFileSync(file, 'utf8')));
+    return;
+  }
   fs.createReadStream(file).pipe(res);
 });
 server.listen(Number(process.argv[2] || 0), '127.0.0.1', () => process.stdout.write(`模板预览：http://127.0.0.1:${server.address().port}/\n`));

package/skills/i3-ui-prototype/references/enterprise-admin.md

@@ -8,14 +8,14 @@
 默认使用简体中文解释、追问及生成报告；用户明确要求其他语言时可切换。原方法正文、引用、阈值和审批条件完整保留。代码标识、路径、命令、工具参数、JSON 键/枚举与原文引用保持原样。
 <!-- i3:zh-guide:end -->
 
-企业后台的来源是工作区的 EASEL v0.14 HTML 审查成果。模板完整保留 326 个来源文件：运行页面、控件、样式、图标、规则测试、来源、许可及历史验收材料。原 history/easel-history 目录不修改。
+企业后台模板统一使用 i3-Composer 品牌，来源是工作区的 EASEL v0.14 HTML 审查成果。模板完整保留 326 个来源文件：运行页面、控件、样式、图标、规则测试、来源、许可及历史验收材料。原 history/easel-history 目录不修改。
 
 ## 完整示例与新业务
 
 - 用户要审查原来的整套后台时，使用 enterprise-admin 和 purpose=template-review，保留示例菜单与业务，便于和原版对照。
 - 用户要根据新业务做原型时，使用默认 business-prototype，先明确模块、字段、角色、状态和需求映射，修改原型副本中的相关文件；未适配状态 needs-adaptation 不能通过业务验收。
-- 审查完整示例不代表批准其全部 EASEL 业务，也不代表其他项目已完成业务适配。
-- 模板根 origin.json 保存全部来源文件的 SHA-256。reference/ 是完整来源快照，品牌转换不改写其中内容。实例仅进行明确的启动、设计 token 和本地数据命名空间接入。
+- 审查完整示例不代表批准其全部示例业务，也不代表其他项目已完成业务适配。
+- 模板根 origin.json 保存全部来源文件的 SHA-256。reference/ 是完整来源快照，品牌转换不改写其中内容。预览响应与新生成实例共用品牌适配，页面标题、导航、示例项目及授权说明统一显示 i3-Composer；生成副本同时接入启动、设计 token 和本地数据命名空间。
 - 资源库中的 5 个 Markdown 文件按技能命名规范存放为小写名称，原名到存放路径记录在 origin.storagePaths；内容不变，生成实例时还原原文件名，原文链接继续有效。既有验证器保持原有规则。
 - design-system/source.json 记录本实例的局部接入及用途。app/qa 保存的是来源历史记录，当前验收使用原型根 qa/。
 

package/skills/i3-ui-prototype/references/expert-adapter.md

@@ -8,17 +8,23 @@
 默认使用简体中文解释、追问及生成报告；用户明确要求其他语言时可切换。原方法正文、引用、阈值和审批条件完整保留。代码标识、路径、命令、工具参数、JSON 键/枚举与原文引用保持原样。
 <!-- i3:zh-guide:end -->
 
-专业增强模式对应 professional，模板模式对应 template。依赖在用户实际执行的宿主中检测；推荐先使用宿主暴露的技能根，再使用明确 --host 指定的项目和全局目录。Codex 插件安装应由宿主提供的实际路径传给 --provider，不假设固定缓存版本。
+专业增强模式对应 professional，模板模式对应 template。依赖在用户实际执行的宿主中检测，安装范围互相独立：项目级 i3-ui-prototype 可以直接使用同一宿主全局安装的 UI/UX Pro Max，不要求项目再安装一份。
+
+优先将宿主暴露的实际技能根传给 --provider；明确指定路径时只检查该副本。自动检测传 --host 与 --project，按项目 Skill、全局 Skill、当前宿主已安装且启用的插件顺序检查，不可用副本不会遮蔽后续可用副本。Codex 通过原生 `codex plugin list --marketplace ui-ux-pro-max-skill --json` 核对启用状态与确切安装版本；Claude Code、WorkBuddy 和 CodeBuddy 通过各自 installed_plugins.json 与 enabledPlugins 核对。插件入口按 manifest 定位，不遍历缓存选最高版本，也不读取另一宿主的安装。Cursor、Gemini 保留普通 Skill 目录检测；未覆盖的插件安装方式使用宿主提供的 --provider 路径。
+
+检测输出包含 source、searched、attempts 与 diagnostics。未传宿主/路径返回 needs-context；插件发现失败或安装记录冲突时补充实际路径；停用返回 disabled；文件缺失或真实查询失败返回 unusable。上述情况分别定位、启用或修复，不要求重复安装。自动发现所需 CLI 不可用时，不将其当作“未安装”的证据。
 
 检测 SKILL.md、Python 查询模块与数据库，执行只读 UX 探测。安装版本/资源摘要和当前查询记录保存为来源；探测成功只说明可执行，不意味着业务建议已经采用。
 
-缺失依赖时显示：当前环境不能使用 UI/UX Pro Max，可安装并验证，或选择模板模式继续；也可先整理需求和比较模板。默认不降级。用户已经选择安装或模板模式时沿用选择，不重复请求相同许可。
+确认当前宿主未安装时提示安装并验证；也可选择模板模式继续，或先整理需求和比较模板。默认不降级。用户已经选择安装或模板模式时沿用选择，不重复请求相同许可。
 
 按维护方 [官方安装说明](https://github.com/nextlevelbuilder/ui-ux-pro-max-skill#installation) 选择当前宿主适用入口。对于未实测的宿主只说明已验证方法和限制，不猜测安装路径。选择安装后应安装完整技能，包括 Python 脚本、数据库与必要引用，重新检测可用性。不能只复制 SKILL.md。不自动安装 Python 或其他系统运行环境。
 
 使用已安装专业技能的指令和查询机制，向数据库传递抽象设计问题，不传私有业务数据。整体设计建议用 --design-system；专项交互用 --domain；实际技术栈支持时另查 --stack。HTML 模板不等于 html-tailwind，不为了查询参数而更换原型技术。
 
 ```sh
+node <skill-root>/scripts/check-design-provider.cjs --host codex --project <project-root>
+# 宿主提供实际路径时：
 node <skill-root>/scripts/check-design-provider.cjs --provider <uiux-root> --query "error summary validation" --domain ux
 ```
 

package/skills/i3-ui-prototype/scripts/adapters/easel-html.cjs

@@ -19,8 +19,8 @@ module.exports = {
     const purpose = options.purpose || 'business-prototype';
     const runtime = enterprise.initialize(directory, { ...options, purpose, templateRoot: context.resource('root') });
     return {
-      metadata: { purpose, runtime, business: { status: purpose === 'template-review' ? 'reference-demo' : 'needs-adaptation', source: 'EASEL v0.14 示例业务' } },
-      handoff: `用途：${purpose}。业务适配：${purpose === 'template-review' ? 'reference-demo' : 'needs-adaptation'}。完整保留 EASEL 示例，不能当作其他业务已完成；app/qa 为历史来源证据，当前验收读取根 qa/。\n\n`,
+      metadata: { purpose, runtime, business: { status: purpose === 'template-review' ? 'reference-demo' : 'needs-adaptation', source: 'i3-Composer 示例业务' } },
+      handoff: `用途：${purpose}。业务适配：${purpose === 'template-review' ? 'reference-demo' : 'needs-adaptation'}。完整保留 i3-Composer 示例，不能当作其他业务已完成；app/qa 为历史来源证据，当前验收读取根 qa/。\n\n`,
     };
   },
   validateRuntime(metadata, options = {}) {

package/skills/i3-ui-prototype/scripts/design-provider-discovery.cjs

@@ -0,0 +1,128 @@
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const { spawnSync } = require('node:child_process');
+
+const PROVIDER = 'ui-ux-pro-max';
+const MARKETPLACE = 'ui-ux-pro-max-skill';
+const json = file => JSON.parse(fs.readFileSync(file, 'utf8'));
+const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+const safeSegment = value => typeof value === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9._+-]*$/.test(value) && !value.includes('..');
+function ensure(condition, message) { if (!condition) throw new Error(message); }
+function canonical(file) { return fs.existsSync(file) ? fs.realpathSync(file) : path.resolve(file); }
+
+function pluginRoot(installation, manifests, fallback) {
+  ensure(typeof installation.installPath === 'string' && path.isAbsolute(installation.installPath), 'Plugin installPath must be absolute');
+  ensure(safeSegment(installation.version), 'Installed plugin version is invalid');
+  const root = installation.installPath;
+  const manifestFile = manifests.map(name => path.join(root, name)).find(file => fs.existsSync(file));
+  ensure(manifestFile, 'Installed plugin manifest is missing');
+  const manifest = json(manifestFile);
+  ensure(manifest.name === PROVIDER && manifest.version === installation.version, 'Installed plugin manifest name or version does not match its registration');
+  const declared = manifest.skills === undefined ? fallback : manifest.skills;
+  ensure(typeof declared === 'string' && declared && !path.isAbsolute(declared) && !declared.includes('\\'), 'Plugin skills declaration is missing or invalid');
+  const folder = path.resolve(root, declared), relative = path.relative(path.resolve(root), folder);
+  ensure(relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative), 'Plugin skills declaration escapes its root');
+  if (fs.existsSync(folder)) {
+    const realRelative = path.relative(canonical(root), canonical(folder));
+    ensure(realRelative !== '..' && !realRelative.startsWith(`..${path.sep}`) && !path.isAbsolute(realRelative), 'Plugin skills path escapes its root');
+  }
+  const skill = path.join(folder, PROVIDER);
+  ensure(fs.existsSync(path.join(skill, 'SKILL.md')), 'Installed plugin skill entrypoint is missing');
+  const skillRelative = path.relative(canonical(root), canonical(skill));
+  ensure(skillRelative !== '..' && !skillRelative.startsWith(`..${path.sep}`) && !path.isAbsolute(skillRelative), 'Plugin skill path escapes its root');
+  return skill;
+}
+
+function codexCandidates(config, project, env, add, report) {
+  const source = 'codex-plugin';
+  try {
+    const run = spawnSync('codex', ['plugin', 'list', '--marketplace', MARKETPLACE, '--json'], { cwd: project, env, encoding: 'utf8', timeout: 10000, maxBuffer: 1024 * 1024, shell: false });
+    ensure(!run.error && run.status === 0, `Codex plugin discovery failed${run.error?.code ? ` (${run.error.code})` : ''}`);
+    const data = JSON.parse(run.stdout);
+    ensure(object(data) && Array.isArray(data.installed), 'Codex plugin discovery returned invalid metadata');
+    const records = data.installed.filter(record => record?.pluginId === `${PROVIDER}@${MARKETPLACE}`);
+    if (!records.length) { report(source, 'missing', 'Current Codex host has no registered UI/UX Pro Max plugin'); return; }
+    ensure(records.every(record => record.name === PROVIDER && record.marketplaceName === MARKETPLACE && typeof record.enabled === 'boolean' && typeof record.installed === 'boolean'), 'Codex plugin registration is invalid');
+    const active = records.filter(record => record.installed && record.enabled);
+    if (!active.length) { report(source, records.some(record => record.installed) ? 'disabled' : 'missing', 'UI/UX Pro Max is not enabled in the current Codex host'); return; }
+    if (active.length !== 1) { report(source, 'ambiguous', 'Multiple active Codex UI/UX Pro Max registrations require an explicit provider path'); return; }
+    const record = active[0];
+    ensure(safeSegment(record.version), 'Codex plugin version is invalid');
+    const installPath = path.join(config, 'plugins/cache', MARKETPLACE, PROVIDER, record.version);
+    add(pluginRoot({ installPath, version: record.version }, ['.codex-plugin/plugin.json', '.claude-plugin/plugin.json']), source);
+  } catch (error) { report(source, 'discovery-error', error.message); }
+}
+
+function registeredCandidates(host, config, project, add, report) {
+  const source = `${host}-plugin`, registryFile = path.join(config, 'plugins/installed_plugins.json'), settingsFile = path.join(config, 'settings.json');
+  try {
+    if (!fs.existsSync(registryFile)) { report(source, 'missing', 'Optional host plugin installation registry is absent'); return; }
+    const registry = json(registryFile);
+    ensure(registry.version === 2 && object(registry.plugins), 'Host plugin installation registry has an unsupported or invalid schema');
+    const entries = Object.entries(registry.plugins).filter(([id]) => id.startsWith(`${PROVIDER}@`));
+    if (!entries.length) { report(source, 'missing', 'Current host has no registered UI/UX Pro Max plugin'); return; }
+    ensure(fs.existsSync(settingsFile), 'Registered plugin enablement metadata is missing');
+    const settings = json(settingsFile);
+    ensure(object(settings) && object(settings.enabledPlugins), 'Host plugin enablement metadata is invalid');
+    const active = [];
+    let disabled = false;
+    for (const [id, records] of entries) {
+      ensure(Array.isArray(records), 'Host plugin registration must contain an installation array');
+      if (settings.enabledPlugins[id] !== true) { disabled = true; continue; }
+      for (const record of records) {
+        ensure(object(record), 'Host plugin installation entry is invalid');
+        if (record.scope === 'user') active.push(record);
+        else if (record.scope === 'project') {
+          ensure(typeof record.projectPath === 'string' && path.isAbsolute(record.projectPath), 'Project-scoped plugin requires an absolute projectPath');
+          if (canonical(record.projectPath) === canonical(project)) active.push(record);
+        } else throw new Error('Host plugin installation scope is unsupported');
+      }
+    }
+    if (!active.length) { report(source, disabled ? 'disabled' : 'missing', 'No enabled UI/UX Pro Max installation applies to the current project'); return; }
+    if (active.length !== 1) { report(source, 'ambiguous', 'Multiple applicable plugin installations require an explicit provider path'); return; }
+    const fallback = host === 'workbuddy' || host === 'codebuddy' ? './skills/' : undefined;
+    const manifests = host === 'claude' ? ['.claude-plugin/plugin.json'] : ['.codebuddy-plugin/plugin.json', '.claude-plugin/plugin.json'];
+    add(pluginRoot(active[0], manifests, fallback), source);
+  } catch (error) { report(source, 'discovery-error', error.message); }
+}
+
+function discoverProviderCandidates(options = {}) {
+  const result = { candidates: [], diagnostics: [] }, seen = new Set();
+  const report = (source, availability, reason) => result.diagnostics.push({ source, availability, reason });
+  const add = (root, source) => {
+    ensure(typeof root === 'string' && root, 'Provider root must be a nonempty path');
+    root = path.resolve(root);
+    if (!seen.has(root)) { seen.add(root); result.candidates.push({ root, source }); }
+  };
+  if (options.provider !== undefined) {
+    try { add(options.provider, 'explicit'); } catch (error) { report('explicit', 'discovery-error', error.message); }
+    return result;
+  }
+  if (options.providerRoots !== undefined) {
+    try {
+      ensure(Array.isArray(options.providerRoots), 'Host-exposed providerRoots must be an array');
+      for (const root of options.providerRoots) add(root, 'host-exposed');
+    } catch (error) { report('host-exposed', 'discovery-error', error.message); }
+    return result;
+  }
+  if (options.discover === false) return { ...result, contextRequired: true };
+  const host = options.host === 'claude-code' ? 'claude' : options.host;
+  if (!['codex', 'claude', 'workbuddy', 'codebuddy', 'gemini', 'cursor'].includes(host)) return { ...result, contextRequired: true };
+  const home = options.home || os.homedir(), env = options.env === undefined ? process.env : options.env, project = path.resolve(options.project || '.');
+  const configName = host === 'claude' ? 'CLAUDE_CONFIG_DIR' : `${host.toUpperCase()}_${host === 'codex' ? 'HOME' : 'CONFIG_DIR'}`;
+  const config = path.resolve(env[configName] || path.join(home, `.${host}`));
+  const projectFolder = host === 'codex' ? '.agents' : host === 'workbuddy' ? '.codebuddy' : `.${host}`;
+  const locations = [
+    [path.join(project, projectFolder, 'skills', PROVIDER), 'project-skill'],
+    ...(host === 'codex' ? [[path.join(home, '.agents/skills', PROVIDER), 'global-skill']] : []),
+    [path.join(config, 'skills', PROVIDER), 'global-skill'],
+  ];
+  for (const [root, source] of locations) if (fs.existsSync(path.join(root, 'SKILL.md'))) add(root, source);
+  if (host === 'codex') codexCandidates(config, project, env, add, report);
+  else if (['claude', 'workbuddy', 'codebuddy'].includes(host)) registeredCandidates(host, config, project, add, report);
+  return result;
+}
+
+module.exports = { discoverProviderCandidates };

package/skills/i3-ui-prototype/scripts/enterprise-template.cjs

@@ -29,9 +29,15 @@ function verifyReference(root = assetRoot) {
   assert.equal(hash(fs.readFileSync(path.join(reference, 'assets-manifest.json'))), origin.sourceManifestDigest, 'Invalid source manifest digest');
   return origin;
 }
+function brandRuntimeResource(file, content) {
+  if (file !== 'index.html' && !/^src\/(?:[^/.][^/]*\/)*[^/]+\.(?:js|mjs|html)$/.test(file)) return content;
+  const text = Buffer.isBuffer(content) ? content.toString('utf8') : content;
+  const branded = text.replaceAll('EASEL', 'i3-Composer');
+  return branded === text ? content : Buffer.isBuffer(content) ? Buffer.from(branded, 'utf8') : branded;
+}
 const mapping = {
   schemaVersion: 1,
-  scope: 'EASEL 企业后台完整示例；模板审查范围，不代表其他业务已适配',
+  scope: 'i3-Composer 企业后台完整示例；模板审查范围，不代表其他业务已适配',
   requirements: [
     { id: 'ENT-01', pages: ['#/workbench'], roles: ['演示身份'], actions: ['查看工作台和导航'], scenarios: ['enterprise-navigation'] },
     { id: 'ENT-02', pages: ['#/models'], roles: ['有模型编辑权限的演示身份'], actions: ['新增模型', '校验和保存草稿'], scenarios: ['enterprise-form'] },
@@ -42,7 +48,7 @@ const mapping = {
     { id: 'ENT-07', pages: ['#/models'], roles: ['演示身份'], actions: ['查看空、失败等演示反馈'], scenarios: ['enterprise-feedback'] },
     { id: 'ENT-08', pages: ['app/routes.json'], roles: ['演示身份'], actions: ['打开原版已提供的全部页面入口'], scenarios: ['enterprise-routes'] },
   ],
-  openQuestions: ['新项目的模块、字段、状态、权限及接口需按实际需求替换。原有 EASEL 示例不自动成为新业务规格。'],
+  openQuestions: ['新项目的模块、字段、状态、权限及接口需按实际需求替换。原有 i3-Composer 示例不自动成为新业务规格。'],
 };
 function initialize(directory, { id, title, purpose, templateRoot = assetRoot }) {
   const origin = verifyReference(templateRoot);
@@ -57,20 +63,23 @@ function initialize(directory, { id, title, purpose, templateRoot = assetRoot })
     fs.renameSync(path.join(app, stored), path.join(app, original));
   }
   const adaptations = [];
-  for (const file of inventory(app).filter(name => /\.(?:js|mjs)$/.test(name))) {
+  for (const file of inventory(app).filter(name => name !== 'index.html' && /\.(?:js|mjs|html)$/.test(name))) {
     const location = path.join(app, file), old = fs.readFileSync(location, 'utf8');
-    const next = old.replaceAll('i3-prototype-antdv-', storagePrefix);
+    const reasons = [], branded = brandRuntimeResource(file, old);
+    if (branded !== old) reasons.push('运行时可见品牌与示例数据统一为 i3-Composer');
+    const next = /\.(?:js|mjs)$/.test(file) ? branded.replaceAll('i3-prototype-antdv-', storagePrefix) : branded;
+    if (next !== branded) reasons.push('替换本地演示存储前缀，隔离不同原型实例');
     if (next !== old) {
       fs.writeFileSync(location, next);
-      adaptations.push({ file, reason: '仅替换本地演示存储前缀，隔离不同原型实例', source: origin.files[file], generated: hash(next) });
+      adaptations.push({ file, reason: reasons.join('；'), source: origin.files[file], generated: hash(next) });
     }
   }
   const index = path.join(app, 'index.html'), original = fs.readFileSync(index, 'utf8');
   assert.ok(original.includes('src="app.js"'), 'Review changed EASEL boot entry before adapting');
-  const adapted = original.replace('</head>', '  <link rel="stylesheet" href="tokens.css">\n  <link rel="stylesheet" href="usability.css">\n</head>')
+  const adapted = brandRuntimeResource('index.html', original).replace('</head>', '  <link rel="stylesheet" href="tokens.css">\n  <link rel="stylesheet" href="usability.css">\n</head>')
     .replace('src="app.js"', 'src="enterprise-bootstrap.mjs"');
   fs.writeFileSync(index, adapted);
-  adaptations.push({ file: 'index.html', reason: '接入原有设计 token、实例配置和独立滚动适配，完整保留页面内容', source: origin.files['index.html'], generated: hash(adapted) });
+  adaptations.push({ file: 'index.html', reason: '默认品牌统一为 i3-Composer；接入原有设计 token、实例配置和独立滚动适配，完整保留页面内容', source: origin.files['index.html'], generated: hash(adapted) });
   fs.copyFileSync(path.join(templateRoot, 'usability.css'), path.join(app, 'usability.css'));
   fs.writeFileSync(path.join(app, 'enterprise-bootstrap.mjs'), "const response = await fetch(new URL('./config.json', import.meta.url));\nif (!response.ok) throw new Error('无法读取企业后台实例配置');\nconst config = await response.json();\ndocument.title = config.title;\nawait import('./app.js');\n");
   fs.copyFileSync(path.join(templateRoot, 'serve.cjs'), path.join(app, 'serve.cjs'));
@@ -78,11 +87,11 @@ function initialize(directory, { id, title, purpose, templateRoot = assetRoot })
   fs.writeFileSync(path.join(directory, 'design-system/MASTER.md'), fs.readFileSync(path.join(templateRoot, 'design-system.md')));
   fs.writeFileSync(path.join(directory, 'design-system/source.json'), JSON.stringify({
     schemaVersion: 1, source: origin.source, sourceVersion: origin.sourceVersion, sourceManifestDigest: origin.sourceManifestDigest,
-    sourceFileCount: origin.fileCount, adaptations, purpose, description: '所有来源文件已复制；局部适配仅用于初始化接入。app/qa 是历史来源证据，当前验收使用原型根 qa/。',
+    sourceFileCount: origin.fileCount, adaptations, purpose, description: '所有来源文件已复制；运行时统一使用 i3-Composer 品牌，并保留初始化接入和存储隔离记录。app/qa 是历史来源证据，当前验收使用原型根 qa/。',
   }, null, 2) + '\n');
   fs.mkdirSync(path.join(directory, 'mocks'), { recursive: true });
-  fs.writeFileSync(path.join(directory, 'mocks/README.md'), '# 演示数据\n\n完整 EASEL 示例的数据与规则保留在 app/src/ 各模块中，并使用实例独立的本地存储。它们用于模板审查；新业务需要按需求替换，不能当作真实服务或已完成业务适配。\n');
+  fs.writeFileSync(path.join(directory, 'mocks/README.md'), '# 演示数据\n\n完整 i3-Composer 示例的数据与规则保留在 app/src/ 各模块中，并使用实例独立的本地存储。它们用于模板审查；新业务需要按需求替换，不能当作真实服务或已完成业务适配。\n');
   fs.writeFileSync(path.join(directory, 'requirements-map.json'), JSON.stringify(mapping, null, 2) + '\n');
   return { kind: 'easel-html', entry: 'app/index.html', sourceVersion: origin.sourceVersion, instanceId, storagePrefix };
 }
-module.exports = { verifyReference, initialize };
+module.exports = { verifyReference, initialize, brandRuntimeResource };

package/skills/i3-ui-prototype/scripts/prototype-lib.cjs

@@ -1,10 +1,10 @@
 'use strict';
 const fs = require('node:fs');
 const path = require('node:path');
-const os = require('node:os');
 const crypto = require('node:crypto');
 const { spawnSync } = require('node:child_process');
 const templateRegistry = require('./template-adapters.cjs').createTemplateRegistry();
+const { discoverProviderCandidates } = require('./design-provider-discovery.cjs');
 const hash = value => crypto.createHash('sha256').update(value).digest('hex');
 const json = file => JSON.parse(fs.readFileSync(file, 'utf8'));
 function ensure(condition, message) { if (!condition) throw new Error(message); }
@@ -47,18 +47,9 @@ function tokensCss(tokens) {
   ensure(entries.length && entries.every(([key, value]) => /^[a-z][a-z0-9-]*$/.test(key) && typeof value === 'string' && !/[;{}<>\n\r]/.test(value)), 'Invalid design token values');
   return ':root {\n' + entries.map(([key, value]) => `  --${key}: ${value};`).join('\n') + '\n}\n';
 }
-function providerRoots(options = {}) {
-  if (options.providerRoots) return options.providerRoots;
-  if (options.provider) return [options.provider];
-  if (options.discover === false) return [];
-  const homes = { codex: '.agents', workbuddy: '.workbuddy', codebuddy: '.codebuddy', 'claude-code': '.claude', gemini: '.gemini', cursor: '.cursor' };
-  const folder = homes[options.host];
-  if (!folder) return [];
-  return [options.project && path.join(options.project, folder, 'skills/ui-ux-pro-max'), path.join(os.homedir(), folder, 'skills/ui-ux-pro-max')].filter(Boolean);
-}
 function providerVersion(root) {
   for (let folder = root, i = 0; i < 5; i++, folder = path.dirname(folder)) {
-    for (const name of ['skill.json', '.claude-plugin/plugin.json', 'package.json']) {
+    for (const name of ['skill.json', '.claude-plugin/plugin.json', '.codebuddy-plugin/plugin.json', 'package.json']) {
       const file = path.join(folder, name);
       if (fs.existsSync(file)) { try { const version = json(file).version; if (version) return version; } catch {} }
     }
@@ -68,23 +59,30 @@ function providerVersion(root) {
 function queryProvider(root, query, options = {}) {
   const mode = options.stack ? ['--stack', options.stack] : options.designSystem ? ['--design-system'] : ['--domain', options.domain || 'ux'];
   const run = spawnSync(options.python || 'python3', ['-B', path.join(root, 'scripts/search.py'), query, ...mode, '--json'], { encoding: 'utf8', timeout: 15000, maxBuffer: 5 * 1024 * 1024 });
-  ensure(run.status === 0, `UI/UX Pro Max query unavailable: ${run.error?.code || run.stderr.trim().slice(0, 400)}`);
+  ensure(run.status === 0, `UI/UX Pro Max query unavailable: ${run.error?.code || (run.stderr || '').trim().slice(0, 400)}`);
   return JSON.parse(run.stdout);
 }
 function checkDesignProvider(options = {}) {
-  const roots = providerRoots(options).map(root => path.resolve(root));
-  for (const root of roots) {
-    if (!fs.existsSync(root)) continue;
+  const discovery = discoverProviderCandidates(options);
+  const attempts = [];
+  const roots = discovery.candidates.map(candidate => path.resolve(candidate.root));
+  const diagnostics = discovery.diagnostics;
+  if (discovery.contextRequired) return { availability: 'needs-context', searched: roots, attempts, diagnostics, reason: '请指定当前宿主 --host，或传入宿主实际提供的 --provider 技能路径；尚不能判断是否已安装' };
+  for (const candidate of discovery.candidates) {
+    const root = path.resolve(candidate.root);
+    if (!fs.existsSync(root)) { attempts.push({ root, source: candidate.source, availability: 'missing', reason: '技能路径不存在' }); continue; }
     const required = ['SKILL.md', 'scripts/search.py', 'scripts/core.py', 'scripts/design_system.py', ...['ux-guidelines', 'styles', 'colors', 'typography', 'products', 'landing', 'ui-reasoning'].map(name => `data/${name}.csv`)];
     const missing = required.filter(file => !fs.existsSync(path.join(root, file)));
-    if (missing.length) return { availability: 'unusable', root, missing, reason: '技能资源不完整' };
+    if (missing.length) { attempts.push({ root, source: candidate.source, availability: 'unusable', missing, reason: '技能资源不完整' }); continue; }
     try {
       const probe = queryProvider(root, 'error summary validation', { python: options.python, domain: 'ux' });
       ensure(probe.domain === 'ux' && probe.results?.length, 'No verified UX probe result');
-      return { availability: 'available', root, version: providerVersion(root), digest: hash(required.map(file => hash(fs.readFileSync(path.join(root, file)))).join('\n')) };
-    } catch (error) { return { availability: 'unusable', root, reason: error.message }; }
+      attempts.push({ root, source: candidate.source, availability: 'available' });
+      return { availability: 'available', root, source: candidate.source, version: providerVersion(root), digest: hash(required.map(file => hash(fs.readFileSync(path.join(root, file)))).join('\n')), searched: roots, attempts, diagnostics };
+    } catch (error) { attempts.push({ root, source: candidate.source, availability: 'unusable', reason: error.message }); }
   }
-  return { availability: 'missing', searched: roots, reason: '当前宿主未发现可用的 UI/UX Pro Max；可传入宿主实际提供的 --provider 路径' };
+  const failure = attempts.find(attempt => attempt.availability === 'unusable') || ['ambiguous', 'disabled', 'discovery-error'].map(status => diagnostics.find(item => item.availability === status)).find(Boolean);
+  return { ...(failure || {}), availability: failure?.availability || 'missing', searched: roots, attempts, diagnostics, reason: failure?.reason || (options.provider ? '指定的 UI/UX Pro Max 技能路径不存在，请核对 --provider' : '当前宿主未发现 UI/UX Pro Max；可安装，或传入宿主实际提供的 --provider 技能路径') };
 }
 function initPrototype(options, registry = templateRegistry) {
   const project = path.resolve(options.project || '.');
@@ -94,7 +92,13 @@ function initPrototype(options, registry = templateRegistry) {
   const expertMode = options.expertMode || 'professional';
   ensure(['professional', 'template'].includes(expertMode), 'Mode must be professional or template');
   const provider = expertMode === 'professional' ? checkDesignProvider({ ...options, project }) : null;
-  if (provider && provider.availability !== 'available') return { status: 'needs-design-provider', provider, message: '专业增强模式需要 UI/UX Pro Max。请安装并验证，或明确选择模板模式继续。', choices: [{ id: 'install', label: '安装并继续' }, { id: 'template', label: '模板模式继续' }, { id: 'prepare', label: '先整理需求和模板选择' }] };
+  if (provider && provider.availability !== 'available') {
+    let action = { id: 'locate', label: '提供当前宿主或实际技能路径' };
+    if (provider.availability === 'missing' && !options.provider) action = { id: 'install', label: '安装并继续' };
+    if (provider.availability === 'unusable') action = { id: 'repair', label: '修复已安装技能并重试' };
+    if (provider.availability === 'disabled') action = { id: 'enable', label: '启用已安装插件并重试' };
+    return { status: 'needs-design-provider', provider, message: `专业增强模式需要可用的 UI/UX Pro Max。${provider.reason}。也可明确选择模板模式继续。`, choices: [action, { id: 'template', label: '模板模式继续' }, { id: 'prepare', label: '先整理需求和模板选择' }] };
+  }
   ensure(fs.existsSync(project) && fs.statSync(project).isDirectory(), 'Project directory does not exist');
   const directory = contained(project, `prototypes/${id}`);
   ensure(!fs.existsSync(directory), 'Prototype already exists / 原型已存在，使用 revise 或另选标识');