@givolt/i3-composer-agent 2.3.0 → 2.3.2

package/evals/zh-CN/cases/i3-ui-prototype.json

@@ -17,6 +17,26 @@
       {
         "prompt": "根据评审反馈迭代交互原型，保留已确认的原型基线。",
         "top_k": 1
+      },
+      {
+        "prompt": "参考这份可编辑 HTML 内容模板，用 Vue 3 和 antDv-next 生成设备管理交互原型。",
+        "top_k": 1
+      },
+      {
+        "prompt": "先分析内容模板与业务需求如何形成交互原型方案，不修改文件。",
+        "top_k": 1
+      },
+      {
+        "prompt": "根据反馈修改交互原型，保留我手改的代码并检查抽屉退出动画。",
+        "top_k": 1
+      },
+      {
+        "prompt": "请当前会话直接使用原型技能检查待评审候选，不启动其他智能体。",
+        "top_k": 1
+      },
+      {
+        "prompt": "请主会话根据 HTML 内容参考和业务说明分析交互原型方案，保持只读。",
+        "top_k": 1
       }
     ],
     "negative": [
@@ -27,6 +47,10 @@
       {
         "prompt": "产品页面有一千条数据渲染很慢，请定位性能瓶颈并优化。",
         "owner": "i3-performance-optimization"
+      },
+      {
+        "prompt": "昨天通过的测试现在失败，请复现并定位根因。",
+        "owner": "i3-debugging-and-error-recovery"
       }
     ]
   },
@@ -45,6 +69,97 @@
         "The prototype remains pending human review and no approved baseline is invented",
         "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
       ]
+    },
+    {
+      "id": 1002,
+      "kind": "dialogue",
+      "prompt": "请当前会话直接使用 i3-ui-prototype 技能，分析可编辑 HTML 内容模板和通用能力清单如何生成 Vue 3＋antDv-next 设备列表原型。仅分析：不改文件、不安装升级、不持久化设计结果、不启动另一个智能体。",
+      "expected_output": "A read-only prototype analysis that keeps direct Skill execution valid and states the framework, content, capability and acceptance boundaries",
+      "expectations": [
+        "The current executor runs the shared preflight without redispatching to an Agent, command or meta-skill",
+        "The response preserves analysis-only scope and does not initialize, install, persist design output or update project execution state",
+        "Editable content reference, reusable capabilities and target-framework behavior are explained as separate inputs",
+        "Unavailable provider, host or browser capabilities remain explicitly unverified rather than reported as executed",
+        "The analysis deliverable is the conversation; it does not invent prototype completion or human approval",
+        "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
+      ]
+    },
+    {
+      "id": 1003,
+      "prompt": "请使用 admin-list 可编辑内容模板，创建独立的 Vue 3＋antDv-next 原生组件设备列表原型，本例明确选择 template 模式。要求：固定 21 条设备，每页 10 条；筛选或翻页清空当前页选择；批量状态变更仅影响选中记录；编辑抽屉校验必填名称，模拟保存失败时保留输入，重试后更新正确行。有真实浏览器时验证当前构建的抽屉退出动效和遮罩模糊。保留已有原型，交付待人工评审候选。",
+      "expected_output": "An isolated native component prototype with fixed capability inputs, reproducible local data, current-build verification or a truthful verification gap",
+      "files": [
+        "i3-ui-prototype"
+      ],
+      "expectations": [
+        "The instance uses the native framework runtime and fixed template, capability, scope and framework inputs rather than converting an existing legacy instance",
+        "Real antDv-next components implement filtering, current-page selection, pagination and the edit flow with deterministic isolated mock state",
+        "Required capability bindings remain independently checkable and are not removed or arbitrarily marked inapplicable to make checks pass",
+        "The executor distinguishes source inspection, successful build and real browser execution; unavailable checks remain unverified",
+        "Browser evidence, when present, refers to the current candidate and actual build, with drawer motion and blur verified separately from static screenshots",
+        "Template mode is explicit and does not claim UIUX use; existing prototypes remain unchanged and no human baseline approval is invented",
+        "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
+      ]
+    },
+    {
+      "id": 1004,
+      "kind": "dialogue",
+      "prompt": "请只读检查这份原型验收声明：测试后源码已改，服务仍展示上一版构建，证据只有一张截图和手动填 passed 的报告。同事建议删除分页能力并标为不适用，以便批准候选。请说明正确的后续动作；不改文件、不执行新测试、不确认基线。",
+      "expected_output": "A read-only rejection of stale evidence and unsupported exemption, with concrete required revalidation and pending human review",
+      "expectations": [
+        "The changed candidate and previous build invalidate the supplied acceptance claim",
+        "A screenshot or manually passed report is not treated as proof of current-build browser execution or drawer animation",
+        "Pagination remains required unless an explicit requirement or scope-change source justifies an exemption",
+        "The response proposes rebuilding and revalidating against fixed inputs without claiming those actions already occurred",
+        "No files are changed, no tests are pretended, and human baseline approval remains separate",
+        "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
+      ]
+    },
+    {
+      "id": 1005,
+      "kind": "dialogue",
+      "prompt": "请在主会话中分析可编辑 admin-list HTML 参考和业务说明，形成 Vue 3＋antDv-next 评审原型方案。保持只读。宿主没有原型专责角色，也没有父子 JSON 传输机制。请交付有用的分析和后续步骤，不安装工具，不执行创建阶段的检查。",
+      "expected_output": "A complete read-only main-session analysis with useful coverage and a truthful acceptance plan",
+      "expectations": [
+        "The main session directly applies the shared prototype preflight without requiring or simulating a dedicated Agent",
+        "The analysis delivers requirement and bound-capability coverage, template and framework selection, acceptance planning and concrete gaps",
+        "No initialization, installation, persisted design, project state update, build, browser run or creation-stage UIUX adoption gate occurs",
+        "No parent-child JSON, PROTOTYPE_RESULT_V1 marker or validate-result execution is made a prerequisite for the natural-language deliverable",
+        "Unavailable capabilities and fixed-parameter conflicts remain visible; analysis completion is distinct from implemented coverage and human approval",
+        "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
+      ]
+    },
+    {
+      "id": 1006,
+      "prompt": "请根据可编辑 admin-list 参考创建独立的 Vue 3＋antDv-next 原生组件设备列表评审候选，明确使用 template 模式。我授权页面内四种主题：明亮、暗黑、清新、科技，首次默认明亮。请在我的 HTML 工作副本中启用并固定主题需求，切换时保留业务状态，保留全部已有原型和手改内容。不要再次询问是否需要主题。保持固定必需能力，指定浏览器工具可用时验证当前构建。",
+      "expected_output": "A main-session native review candidate with explicitly fixed four-theme inputs, preserved state and truthful current-build evidence or gaps",
+      "files": [
+        "i3-ui-prototype"
+      ],
+      "expectations": [
+        "The main session uses the prototype workflow and supporting frontend and version-matched official framework knowledge for actual implementation, without requiring a dedicated persona",
+        "The authorized theme capability is bound in the user HTML working copy and fixed with its requirement source rather than left disabled or sent for repeat confirmation",
+        "The generated framework implements the four exact theme names, defaults to 明亮, and verifies that business state survives theme changes",
+        "Existing or unrequested-theme instances, user edits and approved baselines remain unchanged",
+        "Template mode does not claim UIUX use; fixed required capabilities and applicable acceptance scenarios are retained",
+        "Build, actual browser Skill and DevTools observations, supplemental regression and current delivery evidence are distinguished; unavailable checks remain incomplete",
+        "The final natural-language delivery identifies the candidate, current evidence and gaps, and leaves human review pending without requiring a parent-child result envelope",
+        "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
+      ]
+    },
+    {
+      "id": 1007,
+      "kind": "dialogue",
+      "prompt": "请比较三种请求的处理方式：只读分析原型方案；为评审修改原型抽屉交互；把已认可抽屉实现为可复用生产组件。说明各自适用的技能和证据，不执行这些请求。",
+      "expected_output": "Operation-specific support and a clear boundary between prototype work and production frontend engineering",
+      "expectations": [
+        "Read-only prototype analysis uses only material needed for coverage and selection and plans later verification without executing it",
+        "Prototype interaction revision stays within prototype workflow ownership and uses frontend, official framework and browser capabilities when the revision requires them",
+        "Professional UIUX lookup, adoption and effect verification remain distinct and apply to professional design work, with no silent downgrade to template mode",
+        "Approved production component implementation follows the frontend implementation method and the existing engineering workflow rather than creating a new review prototype",
+        "No claim of completed runtime checks or human baseline approval is made",
+        "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
+      ]
     }
   ]
 }

package/evals/zh-CN/cases/i3-using-agent-skills.json

@@ -23,6 +23,10 @@
       {
         "prompt": "为项目配置 CI/CD 流水线，自动运行构建和测试。",
         "owner": "i3-ci-cd-and-automation"
+      },
+      {
+        "prompt": "选择 UI 原型模板，制作一个可操作的申请审批交互原型供评审。",
+        "owner": "i3-ui-prototype"
       }
     ]
   },
@@ -40,6 +44,32 @@
         "Core operating behaviors (assumptions surfaced) are respected",
         "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
       ]
+    },
+    {
+      "id": 1002,
+      "kind": "dialogue",
+      "prompt": "用户希望根据可编辑 HTML 参考和简短业务说明制作设备管理评审原型。请在当前会话选择适用技能并说明下一步；不创建文件，不启动独立任务。",
+      "expected_output": "Ordinary routing to i3-ui-prototype in the main session, with operation and scope decided by the working skill",
+      "expectations": [
+        "The meta-skill selects the prototype workflow for reviewable prototype work",
+        "The main session uses the working skill without requiring a dedicated persona, persistent routing rule or parent-child result protocol",
+        "Detailed operation, framework and acceptance decisions remain in the prototype workflow rather than being copied into the meta-skill",
+        "The requested read-only routing explanation does not initialize a prototype or claim implementation",
+        "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
+      ]
+    },
+    {
+      "id": 1003,
+      "kind": "dialogue",
+      "prompt": "分别收到两个任务：实现已认可的生产 Vue 表单组件并支持键盘操作；对照已认可基线检查评审原型。请分别路由并说明原工程工作流如何继续适用，不执行这两个任务。",
+      "expected_output": "Separate routing for production engineering and prototype review without changing the general lifecycle",
+      "expectations": [
+        "Production UI implementation follows the engineering workflow with the frontend implementation method",
+        "Prototype fidelity inspection selects the prototype workflow",
+        "The prototype route does not replace generic planning, implementation or review methods or impose prototype-specific delegation on them",
+        "The response does not invent runtime verification or human approval",
+        "人类可读的追问、说明、进度、报告与生成文档使用简体中文；保留代码、路径、工具参数、JSON 协议及机器状态的原始格式。"
+      ]
     }
   ]
 }

package/package.json

@@ -100,6 +100,12 @@
     "evals/fixtures/i3-test-driven-development/package.json",
     "evals/fixtures/i3-test-driven-development/src/split.js",
     "evals/fixtures/i3-test-driven-development/test/split.test.js",
+    "evals/fixtures/i3-ui-prototype/admin-list/assets/reference.css",
+    "evals/fixtures/i3-ui-prototype/admin-list/assets/reference.js",
+    "evals/fixtures/i3-ui-prototype/admin-list/capability-definition.json",
+    "evals/fixtures/i3-ui-prototype/admin-list/index.html",
+    "evals/fixtures/i3-ui-prototype/admin-list/readme.md",
+    "evals/fixtures/i3-ui-prototype/admin-list/template.json",
     "evals/fixtures/i3-ui-prototype/business-brief.md",
     "evals/fixtures/i3-using-agent-skills/incident.md",
     "evals/fixtures/incremental-implementation-pressure/draft-export.js",
@@ -163,19 +169,30 @@
     "docs/getting-started.md",
     "docs/opencode-setup.md",
     "docs/other-hosts.md",
+    "docs/ui-prototype-native/MAIN-SESSION-REPORT.md",
+    "docs/ui-prototype-native/USAGE.md",
     "docs/windsurf-setup.md",
     "docs/workbuddy-setup.md",
     "plugin.json",
     "README.md",
     "LICENSE",
+    "scripts/design-provider-discovery-test.js",
+    "scripts/design-provider-test.js",
     "scripts/enterprise-template-test.js",
     "scripts/floor-guard-reference-test.js",
+    "scripts/lib/prototype-fixture.cjs",
     "scripts/lib/skill-lint-test.js",
     "scripts/lib/skill-lint.js",
+    "scripts/prototype-locations-test.js",
     "scripts/run-evals-test.js",
     "scripts/run-evals.js",
     "scripts/run-regressions.js",
     "scripts/template-adapter-test.js",
+    "scripts/ui-prototype-content-test.js",
+    "scripts/ui-prototype-dependencies-test.js",
+    "scripts/ui-prototype-devtools-test.js",
+    "scripts/ui-prototype-native-test.js",
+    "scripts/ui-prototype-template-test.js",
     "scripts/ui-prototype-test.js",
     "scripts/validate-artifact-paths-test.js",
     "scripts/validate-artifact-paths.js",
@@ -285,6 +302,12 @@
       "evals/fixtures/i3-test-driven-development/package.json",
       "evals/fixtures/i3-test-driven-development/src/split.js",
       "evals/fixtures/i3-test-driven-development/test/split.test.js",
+      "evals/fixtures/i3-ui-prototype/admin-list/assets/reference.css",
+      "evals/fixtures/i3-ui-prototype/admin-list/assets/reference.js",
+      "evals/fixtures/i3-ui-prototype/admin-list/capability-definition.json",
+      "evals/fixtures/i3-ui-prototype/admin-list/index.html",
+      "evals/fixtures/i3-ui-prototype/admin-list/readme.md",
+      "evals/fixtures/i3-ui-prototype/admin-list/template.json",
       "evals/fixtures/i3-ui-prototype/business-brief.md",
       "evals/fixtures/i3-using-agent-skills/incident.md",
       "evals/fixtures/incremental-implementation-pressure/draft-export.js",
@@ -348,20 +371,31 @@
       "docs/getting-started.md",
       "docs/opencode-setup.md",
       "docs/other-hosts.md",
+      "docs/ui-prototype-native/MAIN-SESSION-REPORT.md",
+      "docs/ui-prototype-native/USAGE.md",
       "docs/windsurf-setup.md",
       "docs/workbuddy-setup.md",
       "plugin.json",
       "package.json",
       "README.md",
       "LICENSE",
+      "scripts/design-provider-discovery-test.js",
+      "scripts/design-provider-test.js",
       "scripts/enterprise-template-test.js",
       "scripts/floor-guard-reference-test.js",
+      "scripts/lib/prototype-fixture.cjs",
       "scripts/lib/skill-lint-test.js",
       "scripts/lib/skill-lint.js",
+      "scripts/prototype-locations-test.js",
       "scripts/run-evals-test.js",
       "scripts/run-evals.js",
       "scripts/run-regressions.js",
       "scripts/template-adapter-test.js",
+      "scripts/ui-prototype-content-test.js",
+      "scripts/ui-prototype-dependencies-test.js",
+      "scripts/ui-prototype-devtools-test.js",
+      "scripts/ui-prototype-native-test.js",
+      "scripts/ui-prototype-template-test.js",
       "scripts/ui-prototype-test.js",
       "scripts/validate-artifact-paths-test.js",
       "scripts/validate-artifact-paths.js",
@@ -374,7 +408,7 @@
       "scripts/validate-versions.js"
     ]
   },
-  "version": "2.3.0",
+  "version": "2.3.2",
   "repository": {
     "type": "git",
     "url": "https://github.com/49780522/i3-composer-agent.git"

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "i3-composer-agent",
-  "version": "2.3.0",
+  "version": "2.3.2",
   "description": "覆盖需求、计划、开发、测试、审查与发布的软件工程技能，默认使用简体中文。",
   "homepage": "https://github.com/49780522/i3-composer-agent",
   "repository": "https://github.com/49780522/i3-composer-agent"

package/scripts/design-provider-discovery-test.js

@@ -0,0 +1,190 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const childProcess = require('node:child_process');
+const installationFile = path.join(__dirname, 'lib/installation.js');
+const skillsDirectory = fs.existsSync(installationFile) ? require(installationFile).loadInstallation().skillsDirectory : path.resolve(__dirname, '../skills');
+const moduleFile = path.join(skillsDirectory, 'i3-ui-prototype/scripts/design-provider-discovery.cjs');
+
+function fixture(t) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'i3-provider-discovery-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const home = path.join(root, 'home'), project = path.join(root, 'project');
+  fs.mkdirSync(home); fs.mkdirSync(project);
+  return { root, home, project, env: {} };
+}
+function write(file, value) { fs.mkdirSync(path.dirname(file), { recursive: true }); fs.writeFileSync(file, typeof value === 'string' ? value : JSON.stringify(value)); }
+function skill(root) { write(path.join(root, 'SKILL.md'), '# Fixture UI/UX'); return root; }
+function discover(options, run = () => { throw new Error('Unexpected host CLI call'); }) {
+  const original = childProcess.spawnSync;
+  childProcess.spawnSync = run;
+  delete require.cache[require.resolve(moduleFile)];
+  let api;
+  try { api = require(moduleFile); } finally { childProcess.spawnSync = original; }
+  return api.discoverProviderCandidates(options);
+}
+function codexPlugin(f, overrides = {}) {
+  const record = { pluginId: 'ui-ux-pro-max@ui-ux-pro-max-skill', name: 'ui-ux-pro-max', marketplaceName: 'ui-ux-pro-max-skill', version: '2.15.0', installed: true, enabled: true, ...overrides };
+  const cache = path.join(f.env.CODEX_HOME || path.join(f.home, '.codex'), 'plugins/cache/ui-ux-pro-max-skill/ui-ux-pro-max', record.version);
+  if (!record.version.includes('..')) {
+    write(path.join(cache, '.claude-plugin/plugin.json'), { name: 'ui-ux-pro-max', version: record.version, skills: './.claude/skills/' });
+    skill(path.join(cache, '.claude/skills/ui-ux-pro-max'));
+  }
+  return { record, cache, run: () => ({ status: 0, stdout: JSON.stringify({ installed: [record], available: [] }) }) };
+}
+function registryPlugin(f, host, records, enabled = true) {
+  const config = path.join(f.home, `.${host}`), id = 'ui-ux-pro-max@fixture-market';
+  write(path.join(config, 'settings.json'), { enabledPlugins: { [id]: enabled } });
+  write(path.join(config, 'plugins/installed_plugins.json'), { version: 2, plugins: { [id]: records } });
+  for (const record of records) {
+    write(path.join(record.installPath, host === 'claude' ? '.claude-plugin/plugin.json' : '.codebuddy-plugin/plugin.json'), { name: 'ui-ux-pro-max', version: record.version, ...(host === 'claude' ? { skills: './.claude/skills/' } : {}) });
+    skill(path.join(record.installPath, host === 'claude' ? '.claude/skills/ui-ux-pro-max' : 'skills/ui-ux-pro-max'));
+  }
+  return config;
+}
+
+test('explicit provider has precedence over host roots and does not invoke discovery', t => {
+  const f = fixture(t), root = path.join(f.root, 'explicit');
+  assert.deepEqual(discover({ ...f, provider: root, providerRoots: ['/ignored'], host: 'codex' }), { candidates: [{ root, source: 'explicit' }], diagnostics: [] });
+});
+test('host-exposed provider roots work without host context and preserve order', t => {
+  const f = fixture(t), roots = [path.join(f.root, 'first'), path.join(f.root, 'second')];
+  assert.deepEqual(discover({ ...f, providerRoots: roots }).candidates.map(c => c.root), roots);
+  assert.equal(discover({ ...f, providerRoots: [] }).contextRequired, undefined);
+});
+test('unknown host requires context and cannot read another host cache', t => {
+  const f = fixture(t); skill(path.join(f.home, '.claude/skills/ui-ux-pro-max'));
+  assert.equal(discover(f).contextRequired, true);
+  assert.equal(discover({ ...f, host: 'unknown' }).contextRequired, true);
+  assert.deepEqual(discover({ ...f, host: 'unknown' }).candidates, []);
+});
+test('discover false prevents automatic host access', t => {
+  const f = fixture(t); skill(path.join(f.home, '.agents/skills/ui-ux-pro-max'));
+  assert.deepEqual(discover({ ...f, host: 'codex', discover: false }), { candidates: [], diagnostics: [], contextRequired: true });
+});
+test('Codex returns project then global skill locations and the exact enabled plugin version', t => {
+  const f = fixture(t), plugin = codexPlugin(f);
+  const project = skill(path.join(f.project, '.agents/skills/ui-ux-pro-max'));
+  const global = skill(path.join(f.home, '.codex/skills/ui-ux-pro-max'));
+  const stale = path.join(f.home, '.codex/plugins/cache/ui-ux-pro-max-skill/ui-ux-pro-max/99.0.0/.claude/skills/ui-ux-pro-max'); skill(stale);
+  let command;
+  const result = discover({ ...f, host: 'codex' }, (...args) => { command = args; return plugin.run(); });
+  assert.deepEqual(result.candidates.map(c => c.root), [project, global, path.join(plugin.cache, '.claude/skills/ui-ux-pro-max')]);
+  assert.equal(command[0], 'codex');
+  assert.deepEqual(command[1], ['plugin', 'list', '--marketplace', 'ui-ux-pro-max-skill', '--json']);
+  assert.ok(command[2].timeout > 0 && command[2].timeout <= 15000);
+  assert.equal(command[2].shell, false);
+});
+test('Codex honors isolated CODEX_HOME and never scans the default cache', t => {
+  const f = fixture(t); f.env.CODEX_HOME = path.join(f.root, 'custom-codex');
+  const plugin = codexPlugin(f);
+  const result = discover({ ...f, host: 'codex' }, plugin.run);
+  assert.equal(result.candidates.at(-1).root, path.join(plugin.cache, '.claude/skills/ui-ux-pro-max'));
+});
+test('Codex disabled cached plugin is not a candidate', t => {
+  const f = fixture(t), plugin = codexPlugin(f, { enabled: false });
+  const result = discover({ ...f, host: 'codex' }, plugin.run);
+  assert.deepEqual(result.candidates, []);
+  assert.equal(result.diagnostics[0].availability, 'disabled');
+});
+test('Codex missing installation does not inspect cached versions', t => {
+  const f = fixture(t); codexPlugin(f);
+  const result = discover({ ...f, host: 'codex' }, () => ({ status: 0, stdout: '{"installed":[],"available":[]}' }));
+  assert.deepEqual(result.candidates, []);
+  assert.ok(result.diagnostics.every(d => d.availability === 'missing'));
+});
+for (const [name, run] of [
+  ['missing CLI', () => ({ status: null, error: { code: 'ENOENT' }, stdout: '' })],
+  ['failed CLI', () => ({ status: 1, stderr: 'failure', stdout: '' })],
+  ['invalid JSON', () => ({ status: 0, stdout: '{bad' })],
+  ['invalid schema', () => ({ status: 0, stdout: '{}' })],
+]) test(`Codex ${name} is a discovery error, not a missing installation`, t => {
+  const f = fixture(t), result = discover({ ...f, host: 'codex' }, run);
+  assert.equal(result.diagnostics[0].availability, 'discovery-error');
+});
+test('Codex rejects multiple active installed records instead of selecting a version', t => {
+  const f = fixture(t), { record } = codexPlugin(f);
+  const result = discover({ ...f, host: 'codex' }, () => ({ status: 0, stdout: JSON.stringify({ installed: [record, { ...record, version: '2.14.0' }] }) }));
+  assert.deepEqual(result.candidates, []);
+  assert.equal(result.diagnostics[0].availability, 'ambiguous');
+});
+for (const [name, change] of [
+  ['wrong manifest version', m => { m.version = '2.14.0'; }],
+  ['wrong manifest name', m => { m.name = 'different'; }],
+  ['escaping skills declaration', m => { m.skills = '../../../outside'; }],
+  ['missing skills declaration', m => { delete m.skills; }],
+]) test(`Codex rejects ${name}`, t => {
+  const f = fixture(t), plugin = codexPlugin(f), file = path.join(plugin.cache, '.claude-plugin/plugin.json');
+  const manifest = JSON.parse(fs.readFileSync(file)); change(manifest); write(file, manifest);
+  const result = discover({ ...f, host: 'codex' }, plugin.run);
+  assert.deepEqual(result.candidates, []);
+  assert.equal(result.diagnostics[0].availability, 'discovery-error');
+});
+test('Codex validates the active version as a single safe path segment', t => {
+  const f = fixture(t), plugin = codexPlugin(f, { version: '../../escape' });
+  assert.equal(discover({ ...f, host: 'codex' }, plugin.run).diagnostics[0].availability, 'discovery-error');
+});
+test('Codex rejects a child skill symlink escaping the registered plugin root', t => {
+  const f = fixture(t), plugin = codexPlugin(f), outside = skill(path.join(f.root, 'outside'));
+  const child = path.join(plugin.cache, '.claude/skills/ui-ux-pro-max');
+  fs.rmSync(child, { recursive: true }); fs.symlinkSync(outside, child, 'dir');
+  const result = discover({ ...f, host: 'codex' }, plugin.run);
+  assert.deepEqual(result.candidates, []);
+  assert.equal(result.diagnostics[0].availability, 'discovery-error');
+});
+for (const host of ['claude', 'workbuddy', 'codebuddy']) test(`${host} selects only enabled registered plugins`, t => {
+  const f = fixture(t), installPath = path.join(f.root, host, 'plugin');
+  registryPlugin(f, host, [{ scope: 'user', installPath, version: '2.0.0' }]);
+  const result = discover({ ...f, host });
+  assert.deepEqual(result.candidates.map(c => c.root), [path.join(installPath, host === 'claude' ? '.claude/skills/ui-ux-pro-max' : 'skills/ui-ux-pro-max')]);
+  registryPlugin(f, host, [{ scope: 'user', installPath, version: '2.0.0' }], false);
+  const disabled = discover({ ...f, host });
+  assert.deepEqual(disabled.candidates, []); assert.equal(disabled.diagnostics[0].availability, 'disabled');
+});
+test('missing optional registry is normal, while corrupt metadata is an error', t => {
+  const f = fixture(t);
+  assert.ok(discover({ ...f, host: 'workbuddy' }).diagnostics.every(d => d.availability === 'missing'));
+  write(path.join(f.home, '.workbuddy/plugins/installed_plugins.json'), '{invalid');
+  assert.equal(discover({ ...f, host: 'workbuddy' }).diagnostics[0].availability, 'discovery-error');
+});
+test('a registered plugin with missing enablement metadata needs diagnosis instead of installation', t => {
+  const f = fixture(t);
+  const config = registryPlugin(f, 'workbuddy', [{ scope: 'user', installPath: path.join(f.root, 'plugin'), version: '2.0.0' }]);
+  fs.unlinkSync(path.join(config, 'settings.json'));
+  const result = discover({ ...f, host: 'workbuddy' });
+  assert.deepEqual(result.candidates, []);
+  assert.equal(result.diagnostics[0].availability, 'discovery-error');
+});
+test('project plugin scope must match the current project path', t => {
+  const f = fixture(t), installPath = path.join(f.root, 'plugin');
+  registryPlugin(f, 'claude', [{ scope: 'project', projectPath: path.join(f.root, 'other-project'), installPath, version: '2.0.0' }]);
+  assert.deepEqual(discover({ ...f, host: 'claude-code' }).candidates, []);
+  registryPlugin(f, 'claude', [{ scope: 'project', projectPath: f.project, installPath, version: '2.0.0' }]);
+  assert.equal(discover({ ...f, host: 'claude-code' }).candidates.length, 1);
+  registryPlugin(f, 'claude', [{ scope: 'project', installPath, version: '2.0.0' }]);
+  assert.deepEqual(discover({ ...f, host: 'claude-code' }).candidates, []);
+});
+test('ambiguous matching registry entries do not pick one arbitrarily', t => {
+  const f = fixture(t);
+  registryPlugin(f, 'workbuddy', [
+    { scope: 'user', installPath: path.join(f.root, 'first'), version: '2.0.0' },
+    { scope: 'user', installPath: path.join(f.root, 'second'), version: '2.1.0' },
+  ]);
+  const result = discover({ ...f, host: 'workbuddy' });
+  assert.deepEqual(result.candidates, []); assert.equal(result.diagnostics[0].availability, 'ambiguous');
+});
+test('host selection never borrows another host global plugin', t => {
+  const f = fixture(t);
+  registryPlugin(f, 'claude', [{ scope: 'user', installPath: path.join(f.root, 'claude'), version: '2.0.0' }]);
+  registryPlugin(f, 'workbuddy', [{ scope: 'user', installPath: path.join(f.root, 'workbuddy'), version: '2.0.0' }]);
+  assert.deepEqual(discover({ ...f, host: 'codebuddy' }).candidates, []);
+});
+test('WorkBuddy uses its global config override and the project CodeBuddy skills directory', t => {
+  const f = fixture(t); f.env.WORKBUDDY_CONFIG_DIR = path.join(f.root, 'custom-workbuddy');
+  const projectRoot = skill(path.join(f.project, '.codebuddy/skills/ui-ux-pro-max'));
+  const globalRoot = skill(path.join(f.env.WORKBUDDY_CONFIG_DIR, 'skills/ui-ux-pro-max'));
+  assert.deepEqual(discover({ ...f, host: 'workbuddy' }).candidates.map(c => c.root), [projectRoot, globalRoot]);
+});

package/scripts/design-provider-test.js

@@ -0,0 +1,75 @@
+'use strict';
+const { test, mock } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const cp = require('node:child_process');
+mock.method(cp, 'spawnSync', (command, args) => {
+  if (!args.includes('--json') || args[0] !== '-B') return { status: 1, stdout: '', stderr: 'No plugin CLI in isolated test' };
+  if (args[1].includes('query-fails')) return { status: 1, stdout: '', stderr: 'Python module unavailable' };
+  return { status: 0, stdout: JSON.stringify({ domain: 'ux', results: [{ name: 'Error summary' }] }), stderr: '' };
+});
+const installationFile = path.join(__dirname, 'lib/installation.js');
+const skillsDirectory = fs.existsSync(installationFile) ? require(installationFile).loadInstallation().skillsDirectory : path.resolve(__dirname, '../skills');
+const lib = require(path.join(skillsDirectory, 'i3-ui-prototype/scripts/prototype-lib.cjs'));
+function fixture(t) {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'i3-provider-'));
+  t.after(() => fs.rmSync(home, { recursive: true, force: true }));
+  return home;
+}
+function provider(home, name) {
+  const root = path.join(home, name);
+  for (const file of ['SKILL.md', 'scripts/search.py', 'scripts/core.py', 'scripts/design_system.py', ...['ux-guidelines', 'styles', 'colors', 'typography', 'products', 'landing', 'ui-reasoning'].map(name => `data/${name}.csv`)]) {
+    fs.mkdirSync(path.dirname(path.join(root, file)), { recursive: true });
+    fs.writeFileSync(path.join(root, file), 'fixture');
+  }
+  return root;
+}
+test('an incomplete project provider does not shadow a usable global provider', t => {
+  const home = fixture(t), local = path.join(home, 'project-provider'), global = provider(home, 'global-provider');
+  fs.mkdirSync(local);
+  const result = lib.checkDesignProvider({ providerRoots: [local, global] });
+  assert.equal(result.availability, 'available');
+  assert.equal(result.root, global);
+  assert.equal(result.attempts[0].availability, 'unusable');
+  assert.ok(result.attempts[0].missing.includes('scripts/search.py'));
+});
+test('a failed project query does not shadow a usable global provider', t => {
+  const home = fixture(t), local = provider(home, 'query-fails'), global = provider(home, 'global-provider');
+  const result = lib.checkDesignProvider({ providerRoots: [local, global] });
+  assert.equal(result.availability, 'available');
+  assert.equal(result.root, global);
+  assert.match(result.attempts[0].reason, /Python module unavailable/);
+});
+test('an explicit provider failure never silently selects a different provider', t => {
+  const home = fixture(t), selected = path.join(home, 'missing'), other = provider(home, 'other');
+  const result = lib.checkDesignProvider({ provider: selected, providerRoots: [other] });
+  assert.equal(result.availability, 'missing');
+  assert.deepEqual(result.searched, [selected]);
+});
+test('without host or provider the result requests context, not installation', t => {
+  const home = fixture(t);
+  const result = lib.initPrototype({ project: home, id: 'demo', home, env: {} });
+  assert.equal(result.provider.availability, 'needs-context');
+  assert.equal(result.choices[0].id, 'locate');
+  assert.ok(!result.choices.some(choice => choice.id === 'install'));
+  assert.equal(fs.existsSync(path.join(home, 'prototypes')), false);
+});
+test('all unusable providers preserve their individual failure reasons without asking to reinstall', t => {
+  const home = fixture(t), incomplete = path.join(home, 'incomplete'), failing = provider(home, 'query-fails');
+  fs.mkdirSync(incomplete);
+  const result = lib.initPrototype({ project: home, id: 'demo', providerRoots: [incomplete, failing] });
+  assert.equal(result.provider.availability, 'unusable');
+  assert.equal(result.provider.attempts.length, 2);
+  assert.equal(result.choices[0].id, 'repair');
+  assert.ok(!result.choices.some(choice => choice.id === 'install'));
+  assert.equal(fs.existsSync(path.join(home, 'prototypes')), false);
+});
+test('a business package version cannot masquerade as the later installed UIUX version', t => {
+  const home = fixture(t), root = provider(home, 'manual-provider');
+  fs.writeFileSync(path.join(home, 'package.json'), JSON.stringify({ name: 'human-business-project', version: '99.88.77' }));
+  assert.equal(lib.checkDesignProvider({ provider: root }).version, 'unversioned');
+  fs.writeFileSync(path.join(root, 'UPSTREAM-ORIGIN.json'), JSON.stringify({ packageName: 'ui-ux-pro-max-cli', version: '2.15.0' }));
+  assert.equal(lib.checkDesignProvider({ provider: root }).version, '2.15.0');
+});