@givolt/i3-composer-agent 2.3.0 → 2.3.2

package/scripts/enterprise-template-test.js

@@ -10,6 +10,7 @@ const install = path.join(__dirname, 'lib/installation.js');
 const skills = fs.existsSync(install) ? require(install).loadInstallation().skillsDirectory : path.resolve(__dirname, '../skills');
 const skill = path.join(skills, 'i3-ui-prototype');
 const lib = require(path.join(skill, 'scripts/prototype-lib.cjs'));
+const enterprise = require(path.join(skill, 'scripts/enterprise-template.cjs'));
 const read = (root, file) => JSON.parse(fs.readFileSync(path.join(root, file), 'utf8'));
 function project(t) {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'enterprise-template-'));
@@ -19,6 +20,45 @@ function project(t) {
 function initialize(t, options = {}) {
   return lib.initPrototype({ project: project(t), id: 'enterprise-demo', expertMode: 'template', purpose: 'template-review', ...options }).directory;
 }
+test('runtime branding changes uppercase product text only in runtime HTML and JavaScript', () => {
+  const source = 'EASEL easel-html /easel EASEL 研发';
+  for (const file of ['index.html', 'src/shell/ConsoleShell.html', 'src/models/data.js']) {
+    assert.equal(enterprise.brandRuntimeResource(file, source), 'i3-Composer easel-html /easel i3-Composer 研发');
+  }
+  for (const file of ['origin.json', 'licenses/EASEL.txt', 'qa/REVIEW.md', 'src/styles.css', 'tests/behavior.js', 'app.js']) {
+    const bytes = Buffer.from(source);
+    assert.equal(enterprise.brandRuntimeResource(file, bytes), bytes, file);
+  }
+  assert.ok(Buffer.isBuffer(enterprise.brandRuntimeResource('src/models/data.js', Buffer.from(source))));
+});
+test('generated enterprise runtime uses i3-Composer branding with one final adaptation record per changed source', t => {
+  const dir = initialize(t, { title: 'i3-Composer 品牌验收' });
+  const shell = fs.readFileSync(path.join(dir, 'app/src/shell/ConsoleShell.html'), 'utf8');
+  assert.match(shell, /<strong>i3-Composer<\/strong>/);
+  assert.doesNotMatch(shell, /EASEL/);
+  assert.match(fs.readFileSync(path.join(dir, 'app/index.html'), 'utf8'), /<title>i3-Composer/);
+  const models = fs.readFileSync(path.join(dir, 'app/src/models/data.js'), 'utf8');
+  assert.match(models, /i3-Composer 研发/);
+  assert.doesNotMatch(models, /EASEL/);
+  assert.match(fs.readFileSync(path.join(dir, 'app/src/permissions/MemberEditor.html'), 'utf8'), /i3-Composer 业务角色/);
+  assert.doesNotMatch(read(dir, 'requirements-map.json').scope, /EASEL/);
+  assert.doesNotMatch(fs.readFileSync(path.join(dir, 'mocks/README.md'), 'utf8'), /EASEL/);
+  const origin = enterprise.verifyReference(), source = read(dir, 'design-system/source.json');
+  assert.equal(origin.fileCount, 326);
+  assert.equal(new Set(source.adaptations.map(record => record.file)).size, source.adaptations.length);
+  const adapted = new Map(source.adaptations.map(record => [record.file, record]));
+  for (const [file, expected] of Object.entries(origin.files)) {
+    const generated = crypto.createHash('sha256').update(fs.readFileSync(path.join(dir, 'app', file))).digest('hex');
+    if (generated === expected) continue;
+    const record = adapted.get(file);
+    assert.ok(record, `Unrecorded runtime adaptation: ${file}`);
+    assert.equal(record.source, expected, file);
+    assert.equal(record.generated, generated, file);
+    assert.ok(record.reason, file);
+  }
+  assert.match(adapted.get('index.html').reason, /i3-Composer/);
+  assert.match(adapted.get('src/models/data.js').reason, /i3-Composer/);
+});
 test('four prototype families expose the EASEL enterprise template and explicitly defer the other three', () => {
   const entries = lib.listTemplates();
   assert.deepEqual(entries.map(x => x.id), ['enterprise-admin', 'ai-workbench', 'digital-twin', 'mobile-app']);
@@ -64,11 +104,37 @@ test('generated enterprise instances isolate their local demo storage and retain
   const source = fs.readFileSync(path.join(dir, 'app/src/shared/session.js'), 'utf8');
   assert.match(source, /i3-enterprise-enterprise-demo-/);
   assert.doesNotMatch(source, /i3-prototype-antdv-/);
-  assert.match(fs.readFileSync(path.join(dir, 'app/index.html'), 'utf8'), /enterprise-bootstrap\.mjs/);
+  assert.match(fs.readFileSync(path.join(dir, 'app/index.html'), 'utf8'), /src="offline\.js"/);
+  assert.ok(fs.existsSync(path.join(dir, 'app/enterprise-bootstrap.mjs')), 'Retain the historical module bootstrap for compatibility');
   assert.match(fs.readFileSync(path.join(dir, 'app/index.html'), 'utf8'), /tokens\.css/);
   const other = initialize(t);
   assert.notEqual(read(dir, 'prototype.json').runtime.storagePrefix, read(other, 'prototype.json').runtime.storagePrefix);
 });
+test('offline entry carries every editable HTML fragment and routes without changing the reference', t => {
+  const root = path.join(skill, 'assets/templates/enterprise-admin');
+  const build = read(root, 'offline-build.json');
+  for (const [file, expected] of Object.entries(build.files)) {
+    assert.equal(crypto.createHash('sha256').update(fs.readFileSync(path.join(root, file))).digest('hex'), expected, file);
+  }
+  const html = fs.readFileSync(path.join(root, 'index.html'), 'utf8');
+  assert.equal([...html.matchAll(/<template data-source=/g)].length, build.htmlFragmentCount);
+  const routes = JSON.parse(html.match(/id="prototype-offline-routes">([\s\S]*?)<\/script>/)[1]);
+  assert.deepEqual(routes, read(root, 'reference/routes.json'));
+  for (const component of new Set(routes.map(route => route.component).filter(Boolean))) {
+    const source = fs.readFileSync(path.resolve(root, 'reference', component), 'utf8');
+    const fragment = source.match(/template: new URL\('\.\/([^']+\.html)'/)[1];
+    assert.ok(html.includes(`data-source="reference/${path.posix.dirname(component).replace(/^\.\//, '')}/${fragment}"`), component);
+  }
+  assert.doesNotMatch(html, /type="module"/);
+  assert.doesNotMatch(fs.readFileSync(path.join(root, 'offline.js'), 'utf8'), /\bfetch\s*\(|\bimport\s*\(|import\.meta/);
+  const dir = initialize(t, { title: '离线配置 <安全标题>' });
+  const instance = fs.readFileSync(path.join(dir, 'app/index.html'), 'utf8');
+  assert.equal(JSON.parse(instance.match(/id="prototype-offline-config">([\s\S]*?)<\/script>/)[1]).title, '离线配置 <安全标题>');
+  assert.equal(read(dir, 'prototype.json').runtime.offlineVersion, 1);
+  assert.equal(lib.checkPrototype(dir).status, 'passed');
+  fs.unlinkSync(path.join(dir, 'app/offline.js'));
+  assert.equal(lib.checkPrototype(dir).status, 'failed', 'A new offline instance must require its runtime');
+});
 test('missing enterprise runtime imports are rejected while declarative data-bind attributes remain valid', t => {
   const dir = initialize(t);
   assert.equal(lib.checkPrototype(dir).status, 'passed');

package/scripts/lib/prototype-fixture.cjs

@@ -0,0 +1,17 @@
+'use strict';
+// Historical admin-list input for regression tests only; no public template entry.
+const fs = require('node:fs');
+const path = require('node:path');
+function prepareTemplate(contract, { project, id = 'admin-list' }) {
+  if (!/^[a-z][a-z0-9-]{0,63}$/.test(id)) throw new Error('Invalid identifier');
+  const directory = path.resolve(project, 'ui-templates', id);
+  if (fs.existsSync(path.join(project, 'ui-templates')) && fs.lstatSync(path.join(project, 'ui-templates')).isSymbolicLink()) throw new Error('Refusing symlink');
+  if (fs.existsSync(directory)) return { directory, created: false, index: contract.loadTemplate(directory).index };
+  fs.cpSync(path.resolve(__dirname, '../../evals/fixtures/i3-ui-prototype/admin-list'), directory, { recursive: true });
+  const file = path.join(directory, 'template.json');
+  const manifest = JSON.parse(fs.readFileSync(file));
+  manifest.id = id;
+  fs.writeFileSync(file, JSON.stringify(manifest, null, 2) + '\n');
+  return { directory, created: true, index: contract.syncTemplate(directory) };
+}
+module.exports = { prepareTemplate };

package/scripts/prototype-locations-test.js

@@ -0,0 +1,58 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const installation = path.join(__dirname, 'lib/installation.js');
+const skills = fs.existsSync(installation) ? require(installation).loadInstallation().skillsDirectory : path.resolve(__dirname, '../skills');
+const locations = require(path.join(skills, 'i3-ui-prototype/scripts/prototype-locations.cjs'));
+function workspace(t) {
+  const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'i3-tool-locations-')));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const project = path.join(root, 'business'), home = path.join(root, 'home');
+  fs.mkdirSync(project); fs.mkdirSync(home);
+  return { project, home, env: {} };
+}
+test('all registered project and global targets keep tools under their host base without writes', t => {
+  const options = workspace(t);
+  for (const agent of locations.registry.agents) {
+    const local = locations.resolveLocations({ ...options, host: agent.id });
+    assert.equal(local.skillsDirectory, path.resolve(options.project, agent.projectSkillsDir));
+    const toolBase = path.dirname(local.skillsDirectory) === options.project ? path.join(options.project, `.${agent.id}`) : path.dirname(local.skillsDirectory);
+    assert.equal(local.toolsDirectory, path.join(toolBase, 'tools/i3-prototype'));
+    assert.notEqual(local.toolsDirectory, path.join(options.project, 'tools/i3-prototype'));
+    if (agent.globalSkillsDir) {
+      const global = locations.resolveLocations({ ...options, host: agent.id, scope: 'global' });
+      assert.equal(global.toolsDirectory, path.join(path.dirname(global.skillsDirectory), 'tools/i3-prototype'));
+      assert.ok(global.base.startsWith(options.home + path.sep));
+    } else assert.throws(() => locations.resolveLocations({ ...options, host: agent.id, scope: 'global' }), /project installation only/);
+  }
+  assert.deepEqual(fs.readdirSync(options.project), []);
+  assert.deepEqual(fs.readdirSync(options.home), []);
+});
+test('CodeBuddy and WorkBuddy share project tools but use separate global roots; Codex follows agents', t => {
+  const options = workspace(t), get = (host, scope = 'project') => locations.resolveLocations({ ...options, host, scope });
+  assert.equal(get('codebuddy').toolsDirectory, get('workbuddy').toolsDirectory);
+  assert.notEqual(get('codebuddy', 'global').toolsDirectory, get('workbuddy', 'global').toolsDirectory);
+  assert.equal(get('codex').base, path.join(options.project, '.agents'));
+  assert.equal(get('codex', 'global').base, path.join(options.home, '.agents'));
+});
+test('configuration roots and aliases follow installer mapping and explicit global checks exclude business paths', t => {
+  const options = workspace(t);
+  const context = locations.resolveLocations({ ...options, host: 'claude', scope: 'global', env: { CLAUDE_CONFIG_DIR: path.join(options.home, 'custom claude') } });
+  assert.equal(context.base, path.join(options.home, 'custom claude'));
+  assert.equal(context.host, 'claude-code');
+  const opencode = locations.resolveLocations({ ...options, host: 'opencode', env: { XDG_CONFIG_HOME: path.join(options.home, 'config') }, scope: 'global' });
+  assert.equal(opencode.base, path.join(options.home, 'config/opencode'));
+  assert.ok(locations.toolCandidates(context).every(item => !item.root.startsWith(options.project + path.sep)));
+  assert.throws(() => locations.resolveLocations({ ...options, host: 'unknown' }), /Unknown host/);
+  assert.throws(() => locations.resolveLocations({ ...options, scope: 'all' }), /scope/);
+});
+test('new project and global tools precede both legacy layouts', t => {
+  const options = workspace(t), context = locations.resolveLocations({ ...options, host: 'codex' });
+  const paths = locations.toolCandidates(context);
+  assert.deepEqual(paths.map(item => item.source), ['project-tool', 'global-tool', 'legacy-project-tool', 'legacy-project-tool']);
+  assert.ok(paths[0].root.includes('/.agents/tools/i3-prototype/antdv-cli/'));
+  assert.ok(paths.at(-1).root.includes('/.prototype-tools/node_modules/'));
+});

package/scripts/ui-prototype-content-test.js

@@ -0,0 +1,123 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const installation = path.join(__dirname, 'lib/installation.js');
+const skills = fs.existsSync(installation) ? require(installation).loadInstallation().skillsDirectory : path.resolve(__dirname, '../skills');
+const root = path.join(skills, 'i3-ui-prototype');
+const contract = require(path.join(root, 'scripts/template-contract.cjs'));
+const native = require(path.join(root, 'scripts/native-pilot-lib.cjs'));
+const read = (directory, file) => JSON.parse(fs.readFileSync(path.join(directory, file), 'utf8'));
+const write = (directory, file, data) => fs.writeFileSync(path.join(directory, file), JSON.stringify(data, null, 2));
+const files = directory => Object.fromEntries(fs.readdirSync(directory, { recursive: true }).filter(file => fs.statSync(path.join(directory, file)).isFile()).sort().map(file => [file, crypto.createHash('sha256').update(fs.readFileSync(path.join(directory, file))).digest('hex')]));
+function fixture(t, { prepare = true } = {}) {
+  const project = fs.mkdtempSync(path.join(os.tmpdir(), 'i3-full-content-'));
+  t.after(() => fs.rmSync(project, { recursive: true, force: true }));
+  const template = prepare ? contract.prepareTemplate({ project }) : null;
+  const scope = { schemaVersion: 1, title: '资产审核', pages: [{ id: 'assets', title: '资产台账', referencePage: 'models-page',
+    regions: [{ id: 'list', mode: 'management-list' }, { id: 'editor', mode: 'edit-form' }] }],
+    requirements: [{ id: 'ASSET-01', text: '查询、选择和修改资产', pages: ['assets'], source: { type: 'prd', reference: 'PRD.md#ASSET-01', statement: '按资产字段实现清单与编辑；使用模板通用能力约定。' } }], exemptions: [] };
+  write(project, 'scope.json', scope);
+  const create = options => native.createPrototype({ project, id: 'assets', expertMode: 'template', scope: path.join(project, 'scope.json'), ...(template ? { templateRoot: template.directory } : {}), ...options });
+  return { project, template, scope, create };
+}
+test('explicit legacy preparation uses the complete offline reference and never overwrites a working copy', t => {
+  const { project, template } = fixture(t);
+  const snapshot = contract.loadTemplate(template.directory);
+  assert.equal(snapshot.kind, 'content-reference'); assert.equal(snapshot.id, 'enterprise-admin');
+  assert.equal(snapshot.index.pages.length, 35); assert.equal(snapshot.index.routes.length, 44); assert.equal(snapshot.index.htmlFragments.length, 93);
+  assert.deepEqual(Object.keys(snapshot.index.extractor.files).sort(), ['content-template.cjs', 'template-contract.cjs']);
+  const file = path.join(template.directory, 'index.html');
+  fs.writeFileSync(file, fs.readFileSync(file, 'utf8').replace('<h1>模型管理</h1>', '<h1>资产参考内容</h1>'));
+  assert.throws(() => contract.loadTemplate(template.directory), /stale|不同步/);
+  const index = contract.syncTemplate(template.directory);
+  assert.equal(index.pages.find(page => page.id === 'models-page').title, '资产参考内容');
+  const content = require(path.join(root, 'scripts/content-template.cjs')).pageContent(contract.loadTemplate(template.directory), 'models-page');
+  assert.ok(content.html.includes('<h1>资产参考内容</h1>')); assert.equal(content.readOnly, true);
+  assert.equal(contract.prepareTemplate({ project }).created, false);
+  assert.ok(fs.readFileSync(file, 'utf8').includes('资产参考内容'));
+});
+test('default creation reads the released template without preparing a business template directory or modifying Skill assets', t => {
+  const { project, create } = fixture(t, { prepare: false });
+  const builtin = path.join(root, 'assets/templates/enterprise-admin');
+  const before = files(builtin);
+  const created = create();
+  assert.equal(fs.existsSync(path.join(project, 'ui-templates')), false);
+  assert.equal(fs.existsSync(path.join(project, '.prototype-preparation')), false);
+  assert.deepEqual(files(builtin), before);
+  assert.equal(native.inspect(created.directory).status, 'passed');
+  const snapshot = read(created.directory, 'inputs/template-snapshot.json');
+  assert.equal(snapshot.id, 'enterprise-admin'); assert.equal(snapshot.index.pages.length, 35);
+  assert.deepEqual(snapshot, contract.loadBundledTemplate());
+  assert.deepEqual(read(created.directory, 'inputs/scope.json'), read(project, 'scope.json'));
+});
+test('an existing edited template copy is preserved and used only when explicitly selected', t => {
+  const { project, template, create } = fixture(t);
+  const entry = path.join(template.directory, 'index.html');
+  fs.writeFileSync(entry, fs.readFileSync(entry, 'utf8').replace('<h1>模型管理</h1>', '<h1>用户维护的旧模板</h1>'));
+  contract.syncTemplate(template.directory);
+  const before = files(template.directory);
+  const current = create({ id: 'current', templateRoot: undefined });
+  const legacy = create({ id: 'legacy' });
+  assert.notEqual(read(current.directory, 'inputs/template-snapshot.json').digest, read(legacy.directory, 'inputs/template-snapshot.json').digest);
+  assert.equal(read(legacy.directory, 'inputs/template-snapshot.json').index.pages.find(page => page.id === 'models-page').title, '用户维护的旧模板');
+  assert.deepEqual(files(template.directory), before);
+});
+test('new business generation requires a sourced scope and does not silently generate a device list', t => {
+  const { project, create } = fixture(t);
+  assert.throws(() => create({ scope: undefined }), /scope|需求/i);
+  assert.equal(fs.existsSync(path.join(project, 'prototypes')), false);
+  const created = create(), meta = read(created.directory, 'prototype.json');
+  assert.equal(meta.runtime.contentReference, true); assert.equal(meta.business.status, 'needs-adaptation');
+  assert.equal(native.inspect(created.directory).status, 'passed');
+  assert.match(native.inspect(created.directory, { acceptance: true }).errors.join('; '), /implementation pending|scaffold/);
+  const config = read(created.directory, 'app/public/prototype-config.json');
+  assert.deepEqual(config.pages, [{ id: 'assets', title: '资产台账' }]);
+  assert.deepEqual(config.theme, { defaultTheme: 'light', presets: ['light', 'dark', 'fresh', 'tech'] });
+  assert.equal(config.content, undefined); assert.equal(read(created.directory, 'mocks/contract.json').count, undefined);
+  assert.equal(fs.existsSync(path.join(created.directory, 'app/src/domain/devices.ts')), false);
+  const state = native.state(created.directory, {});
+  assert.equal(state.nextAction, 'implement-business'); assert.equal(state.commands.browser, undefined); assert.ok(state.commands.recordRun);
+});
+test('the complete content reference yields fixed common capabilities for the selected business regions', t => {
+  const { create } = fixture(t), directory = create().directory;
+  const fixed = read(directory, 'inputs/capabilities.json'), acceptance = read(directory, 'inputs/acceptance.json');
+  for (const id of ['filter', 'selection', 'pagination', 'bulk', 'feedback']) assert.ok(fixed.bindings.some(binding => binding.id === `assets/list/${id}`));
+  assert.ok(fixed.bindings.some(binding => binding.id === 'assets/editor/edit'));
+  assert.ok(fixed.bindings.some(binding => binding.id === 'app-shell/appearance/theme'));
+  assert.ok(acceptance.requiredScenarios.includes('assets/list/pagination/pages'));
+  assert.ok(acceptance.requiredScenarios.includes('app-shell/appearance/theme/persistence'));
+  assert.equal(acceptance.requiredScenarios.some(id => id.startsWith('devices/')), false);
+  fixed.bindings = fixed.bindings.filter(binding => binding.capabilityId !== 'selection'); write(directory, 'inputs/capabilities.json', fixed);
+  const candidate = native.manifest(directory);
+  assert.throws(() => native.revise(directory, { revision: 'r002', expectedRevision: candidate.revision, expectedDigest: candidate.digest, acceptInputs: true }), /binding|capabilit|合同/i);
+});
+test('business page and requirement references must remain explicit and unambiguous', t => {
+  const { project, scope, create } = fixture(t);
+  for (const modify of [
+    value => { value.pages[0].referencePage = 'missing-page'; },
+    value => { value.pages.push(structuredClone(value.pages[0])); },
+    value => { value.requirements.push(structuredClone(value.requirements[0])); },
+    value => { value.requirements[0].source = {}; },
+    value => { value.requirements[0].pages = ['other-business']; },
+    value => { value.pages[0].regions[0].mode = 'unknown-mode'; },
+  ]) {
+    const broken = structuredClone(scope); modify(broken); write(project, 'scope.json', broken);
+    assert.throws(() => create()); assert.equal(fs.existsSync(path.join(project, 'prototypes')), false);
+  }
+});
+test('offline reference synchronization rejects missing runtime resources and module loading', t => {
+  const { template } = fixture(t), file = path.join(template.directory, 'index.html'), html = fs.readFileSync(file, 'utf8');
+  fs.writeFileSync(file, html.replace('src="offline.js"', 'src="missing.js"')); assert.throws(() => contract.syncTemplate(template.directory), /resource missing/);
+  fs.writeFileSync(file, html.replace('<script src="offline.js"', '<script type="module" src="offline.js"')); assert.throws(() => contract.syncTemplate(template.directory), /modules/);
+  fs.writeFileSync(file, html); fs.appendFileSync(path.join(template.directory, 'offline.js'), '\nfetch("parts.html")'); assert.throws(() => contract.syncTemplate(template.directory), /Offline runtime/);
+});
+test('the historical device regression runner refuses a business contract before writing evidence', async t => {
+  const { create } = fixture(t), directory = create().directory;
+  const before = fs.readdirSync(path.join(directory, 'qa'));
+  await assert.rejects(require(path.join(root, 'scripts/native-browser.cjs')).main(directory), /historical device-list/);
+  assert.deepEqual(fs.readdirSync(path.join(directory, 'qa')), before);
+});

package/scripts/ui-prototype-dependencies-test.js

@@ -0,0 +1,213 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const installation = path.join(__dirname, 'lib/installation.js');
+const skills = fs.existsSync(installation) ? require(installation).loadInstallation().skillsDirectory : path.resolve(__dirname, '../skills');
+const deps = require(path.join(skills, 'i3-ui-prototype/scripts/prototype-dependencies.cjs'));
+const installer = require(path.join(skills, 'i3-ui-prototype/scripts/optional-skill-install.cjs'));
+function workspace(t) {
+  const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'i3-optional-deps-')));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const project = path.join(root, 'business'), home = path.join(root, 'home');
+  fs.mkdirSync(project); fs.mkdirSync(home);
+  return { project, home, env: {
+    ...process.env,
+    HOME: home, USERPROFILE: home,
+    XDG_CONFIG_HOME: path.join(home, '.config'),
+    CODEBUDDY_CONFIG_DIR: path.join(home, '.codebuddy'),
+    WORKBUDDY_CONFIG_DIR: path.join(home, '.workbuddy'),
+    CLAUDE_CONFIG_DIR: path.join(home, '.claude'),
+    CODEX_HOME: path.join(home, '.codex'),
+  } };
+}
+test('missing optional Skills do not fail read-only inspection or write files', t => {
+  const options = workspace(t), before = fs.readdirSync(options.project);
+  const result = deps.check(options);
+  assert.equal(result.status, 'checked');
+  assert.equal(result.professionalReady, false);
+  assert.equal(result.antdv.skill.availability, 'missing');
+  assert.equal(result.antdv.tool.availability, 'missing');
+  assert.deepEqual(fs.readdirSync(options.project), before);
+});
+test('later installed antDv Skill is detected without reinstalling i3 or claiming the CLI ready', t => {
+  const options = workspace(t);
+  assert.equal(deps.check(options).antdv.skill.availability, 'missing');
+  const root = path.join(options.project, '.codebuddy/skills/antdv');
+  fs.mkdirSync(root, { recursive: true }); fs.writeFileSync(path.join(root, 'SKILL.md'), 'official Skill fixture');
+  const result = deps.check(options);
+  assert.equal(result.antdv.skill.root, root);
+  assert.equal(result.antdv.skill.availability, 'available');
+  assert.equal(result.antdv.skill.invocationVerified, false);
+  assert.equal(result.antdv.tool.availability, 'missing');
+});
+test('CodeBuddy global antDv is reusable and current project entry has precedence', t => {
+  const options = workspace(t);
+  options.env.CODEBUDDY_CONFIG_DIR = path.join(options.home, 'legacy CodeBuddy config');
+  const global = path.join(options.env.CODEBUDDY_CONFIG_DIR, 'skills/antdv');
+  fs.mkdirSync(global, { recursive: true }); fs.writeFileSync(path.join(global, 'SKILL.md'), 'global');
+  assert.equal(deps.skillAt(options.project, 'antdv', options).source, 'global-skill');
+  const local = path.join(options.project, '.codebuddy/skills/antdv');
+  fs.mkdirSync(local, { recursive: true }); fs.writeFileSync(path.join(local, 'SKILL.md'), 'local');
+  assert.equal(deps.skillAt(options.project, 'antdv', options).root, local);
+});
+test('global UIUX detection reuses enabled user plugins, preserves disabled status and excludes business plugins', t => {
+  const options = { ...workspace(t), host: 'codebuddy', scope: 'global' }, config = path.join(options.home, '.codebuddy');
+  const plugin = path.join(options.home, 'uiux-plugin'), root = path.join(plugin, 'skills/ui-ux-pro-max'), id = 'ui-ux-pro-max@fixture';
+  const write = (file, content) => { fs.mkdirSync(path.dirname(file), { recursive: true }); fs.writeFileSync(file, typeof content === 'string' ? content : JSON.stringify(content)); };
+  write(path.join(plugin, '.codebuddy-plugin/plugin.json'), { name: 'ui-ux-pro-max', version: '2.15.0' });
+  for (const file of ['SKILL.md', 'scripts/core.py', 'scripts/design_system.py', ...['ux-guidelines','styles','colors','typography','products','landing','ui-reasoning'].map(name => `data/${name}.csv`)]) write(path.join(root, file), 'synthetic fixture');
+  write(path.join(root, 'scripts/search.py'), 'import json\nprint(json.dumps({"domain":"ux","results":[{"id":"synthetic-probe-only"}]}))\n');
+  write(path.join(config, 'settings.json'), { enabledPlugins: { [id]: true } });
+  const record = { scope: 'user', installPath: plugin, version: '2.15.0' };
+  write(path.join(config, 'plugins/installed_plugins.json'), { version: 2, plugins: { [id]: [record] } });
+  const result = deps.check(options);
+  assert.equal(result.uiux.root, root);
+  assert.equal(result.uiux.availability, 'available');
+  assert.equal(result.uiux.source, 'codebuddy-plugin');
+  write(path.join(config, 'settings.json'), { enabledPlugins: { [id]: false } });
+  assert.equal(deps.check(options).uiux.availability, 'disabled');
+  write(path.join(config, 'settings.json'), { enabledPlugins: { [id]: true } });
+  write(path.join(config, 'plugins/installed_plugins.json'), { version: 2, plugins: { [id]: [{ ...record, scope: 'project', projectPath: options.project }] } });
+  assert.equal(deps.check(options).uiux.availability, 'missing');
+});
+test('dependency CLI rejects unintended writes and unrelated hosts', () => {
+  assert.throws(() => deps.parse(['check', '--force']), /Invalid option/);
+  assert.throws(() => deps.check({ host: 'not-a-host' }), /Unknown host/);
+  assert.throws(() => deps.parse(['update']), /check or install/);
+});
+function officialFixture(name, folder) {
+  const skill = path.join(folder, 'skill'), tool = path.join(folder, 'tool');
+  fs.mkdirSync(skill); fs.mkdirSync(tool);
+  fs.writeFileSync(path.join(skill, 'SKILL.md'), `---\nname: ${name === 'uiux' ? 'ui-ux-pro-max' : 'antdv'}\n---\nOfficial fixture; not host invocation evidence.\n`);
+  if (name === 'uiux') {
+    for (const file of ['scripts/search.py', 'scripts/core.py', 'scripts/design_system.py', 'data/ux-guidelines.csv']) {
+      fs.mkdirSync(path.dirname(path.join(skill, file)), { recursive: true }); fs.writeFileSync(path.join(skill, file), 'fixture');
+    }
+  } else {
+    const pkg = path.join(tool, 'node_modules/@antdv-next/cli'); fs.mkdirSync(pkg, { recursive: true });
+    fs.writeFileSync(path.join(pkg, 'package.json'), JSON.stringify({ name: '@antdv-next/cli', version: '0.0.0-beta.1', bin: { antdv: 'cli.cjs' } }));
+    fs.writeFileSync(path.join(pkg, 'cli.cjs'), 'process.stdout.write(JSON.stringify({name:"Table",props:[]}));');
+  }
+  return { skill, tool };
+}
+test('explicit skip never downloads, writes or permanently disables dependencies', async t => {
+  const options = workspace(t), before = fs.readdirSync(options.project);
+  const result = await installer.install({ ...options, skills: 'none' }, { prepare() { throw new Error('Unexpected download'); } });
+  assert.equal(result.status, 'skipped');
+  assert.deepEqual(fs.readdirSync(options.project), before);
+  assert.deepEqual(installer.selection('uiux,antdv'), ['uiux', 'antdv']);
+  assert.throws(() => installer.selection('none,uiux'), /Choose/);
+});
+test('optional antDv installation preserves user files and a later invocation reuses the Skill', async t => {
+  const options = workspace(t);
+  fs.writeFileSync(path.join(options.project, 'PRD.md'), 'human requirements');
+  const services = { prepare: officialFixture, progress() {} };
+  const result = await installer.install({ ...options, skills: 'antdv' }, services);
+  assert.equal(result.status, 'installed');
+  assert.equal(result.detection.antdv.skill.availability, 'available');
+  assert.equal(fs.readFileSync(path.join(options.project, 'PRD.md'), 'utf8'), 'human requirements');
+  const skillFile = path.join(options.project, '.codebuddy/skills/antdv/SKILL.md');
+  fs.appendFileSync(skillFile, 'user edit'); const before = fs.readFileSync(skillFile);
+  const again = await installer.install({ ...options, skills: 'antdv' }, { prepare() { throw new Error('Existing tool must not be replaced'); } });
+  assert.equal(again.status, 'reused');
+  assert.deepEqual(fs.readFileSync(skillFile), before);
+});
+test('a failed second preparation publishes neither selected Skill and removes temporary files', async t => {
+  const options = workspace(t);
+  await assert.rejects(installer.install({ ...options, skills: 'uiux,antdv' }, {
+    progress() {}, prepare(name, folder) { if (name === 'antdv') throw new Error('simulated network failure'); return officialFixture(name, folder); },
+  }), /simulated network failure/);
+  assert.deepEqual(fs.readdirSync(options.project), []);
+});
+test('antDv error text or error JSON with exit zero is not successful knowledge', async t => {
+  const options = workspace(t);
+  await installer.install({ ...options, skills: 'antdv' }, { prepare: officialFixture, progress() {} });
+  const file = path.join(resultTool(options), 'node_modules/@antdv-next/cli/cli.cjs');
+  for (const output of ['Error: Table knowledge missing', JSON.stringify({ error: 'Table knowledge missing' })]) {
+    fs.writeFileSync(file, `process.stdout.write(${JSON.stringify(output)});`);
+    assert.equal(deps.check(options).antdv.tool.availability, 'unusable');
+  }
+});
+function resultTool(options) { return path.join(deps.check(options).locations.toolsDirectory, 'antdv-cli'); }
+for (const host of ['codebuddy', 'workbuddy', 'codex', 'claude-code']) for (const scope of ['project', 'global']) {
+  test(`${host} ${scope} optional installation keeps all tools inside the selected host root`, async t => {
+    const options = { ...workspace(t), host, scope };
+    const result = await installer.install({ ...options, skills: 'antdv' }, { prepare: officialFixture, progress() {} });
+    assert.equal(result.detection.antdv.tool.source, `${scope}-tool`);
+    assert.ok(fs.existsSync(path.join(resultTool(options), 'node_modules/@antdv-next/cli/package.json')));
+    assert.equal(fs.existsSync(path.join(options.project, '.prototype-tools')), false);
+    assert.equal(fs.existsSync(path.join(options.project, 'package.json')), false);
+    if (scope === 'global') assert.deepEqual(fs.readdirSync(options.project), []);
+  });
+}
+test('an available global tool is reused by a later project without project writes', async t => {
+  const options = workspace(t);
+  await installer.install({ ...options, host: 'codex', scope: 'global', skills: 'antdv' }, { prepare: officialFixture, progress() {} });
+  const result = await installer.install({ ...options, host: 'codex', skills: 'antdv' }, { prepare() { throw new Error('No download expected'); } });
+  assert.equal(result.status, 'reused');
+  assert.equal(result.detection.antdv.tool.source, 'global-tool');
+  assert.deepEqual(fs.readdirSync(options.project), []);
+});
+test('legacy independent tools stay readable until an explicit owned migration', async t => {
+  const options = workspace(t), legacy = path.join(options.project, '.prototype-tools/antdv-cli');
+  const stage = path.join(options.project, 'fixture'); fs.mkdirSync(stage);
+  const prepared = officialFixture('antdv', stage);
+  fs.mkdirSync(path.dirname(legacy)); fs.renameSync(prepared.tool, legacy); fs.rmSync(stage, { recursive: true });
+  fs.writeFileSync(path.join(legacy, 'UPSTREAM-ORIGIN.json'), JSON.stringify({ ...require(path.join(skills, 'i3-ui-prototype/assets/optional-skills/sources.json')).antdv, installer: 'i3 optional dependency preparation; official Skill body unchanged' }));
+  assert.equal(deps.check(options).antdv.tool.source, 'legacy-project-tool');
+  await installer.install({ ...options, skills: 'antdv' }, { prepare: officialFixture, progress() {} });
+  assert.equal(fs.existsSync(legacy), true);
+  fs.writeFileSync(path.join(options.project, '.prototype-tools/user-note.txt'), 'keep this location');
+  await installer.install({ ...options, scope: 'global', skills: 'antdv' }, { prepare: officialFixture, progress() {} });
+  assert.equal(deps.check(options).antdv.tool.source, 'global-tool', 'normal lookup prefers a current global tool over legacy');
+  const result = await installer.install({ ...options, skills: 'antdv', migrateTools: true }, { prepare() { throw new Error('No download expected'); } });
+  assert.equal(result.status, 'migrated');
+  assert.equal(result.detection.antdv.tool.source, 'project-tool');
+  assert.equal(fs.existsSync(legacy), false);
+  assert.equal(fs.readFileSync(path.join(options.project, '.prototype-tools/user-note.txt'), 'utf8'), 'keep this location');
+});
+test('legacy mixed tools without i3 ownership remain untouched by migration', async t => {
+  const options = workspace(t), stage = path.join(options.project, 'fixture'); fs.mkdirSync(stage);
+  const prepared = officialFixture('antdv', stage), legacy = path.join(options.project, '.prototype-tools/antdv-cli');
+  fs.mkdirSync(path.dirname(legacy)); fs.renameSync(prepared.tool, legacy); fs.rmSync(stage, { recursive: true });
+  await assert.rejects(installer.install({ ...options, skills: 'antdv', migrateTools: true }, { prepare() { throw new Error('No download expected'); } }), /ownership|来源|归属/);
+  assert.equal(deps.check(options).antdv.tool.source, 'legacy-project-tool');
+});
+test('a broken project tool is reported instead of silently borrowing a healthy global tool', async t => {
+  const options = workspace(t);
+  await installer.install({ ...options, scope: 'global', skills: 'antdv' }, { prepare: officialFixture, progress() {} });
+  const local = path.join(options.project, '.codebuddy/tools/i3-prototype/antdv-cli/node_modules/@antdv-next/cli');
+  fs.mkdirSync(local, { recursive: true }); fs.writeFileSync(path.join(local, 'package.json'), '{broken');
+  assert.equal(deps.check(options).antdv.tool.availability, 'unusable');
+  assert.equal(deps.check({ ...options, scope: 'global' }).antdv.tool.availability, 'available');
+  await assert.rejects(installer.install({ ...options, skills: 'antdv' }), /Existing tool unusable/);
+  assert.equal(fs.readFileSync(path.join(local, 'package.json'), 'utf8'), '{broken');
+});
+test('failed post-migration execution restores the old location and removes newly created destinations', async t => {
+  const options = workspace(t), stage = path.join(options.project, 'fixture'); fs.mkdirSync(stage);
+  const prepared = officialFixture('antdv', stage), legacy = path.join(options.project, '.prototype-tools/antdv-cli');
+  fs.mkdirSync(path.dirname(legacy)); fs.renameSync(prepared.tool, legacy); fs.rmSync(stage, { recursive: true });
+  const file = path.join(legacy, 'node_modules/@antdv-next/cli/cli.cjs');
+  fs.writeFileSync(file, 'if(__dirname.includes("tools/i3-prototype"))process.exit(1);process.stdout.write(JSON.stringify({name:"Table",props:[]}));');
+  fs.writeFileSync(path.join(legacy, 'UPSTREAM-ORIGIN.json'), JSON.stringify({ ...require(path.join(skills, 'i3-ui-prototype/assets/optional-skills/sources.json')).antdv, installer: 'i3 optional dependency preparation; official Skill body unchanged' }));
+  await assert.rejects(installer.install({ ...options, skills: 'antdv', migrateTools: true }, { prepare: officialFixture, progress() {} }), /tool query failed/);
+  assert.equal(deps.check(options).antdv.tool.source, 'legacy-project-tool');
+  assert.equal(fs.existsSync(path.join(options.project, '.codebuddy')), false);
+  assert.ok(fs.existsSync(file));
+});
+test('unusable existing UIUX resources are preserved without attempting a download', async t => {
+  const options = workspace(t), target = path.join(options.project, '.codebuddy/skills/ui-ux-pro-max');
+  fs.mkdirSync(target, { recursive: true }); fs.writeFileSync(path.join(target, 'SKILL.md'), 'human-owned incomplete skill');
+  await assert.rejects(installer.install({ ...options, skills: 'uiux' }, { prepare() { throw new Error('must not download'); } }), /Existing Skill preserved/);
+  assert.equal(fs.readFileSync(path.join(target, 'SKILL.md'), 'utf8'), 'human-owned incomplete skill');
+});
+test('optional installer rejects symlink escapes, including dangling targets, and bad download bytes', async t => {
+  const options = workspace(t), outside = path.join(options.project, 'outside');
+  fs.symlinkSync(outside, path.join(options.project, '.codebuddy'), 'dir');
+  await assert.rejects(installer.install({ ...options, skills: 'antdv' }, { prepare: officialFixture }), /symlink/);
+  assert.equal(fs.existsSync(outside), false);
+  assert.throws(() => installer.verify(Buffer.from('altered'), '0'.repeat(64)), /integrity mismatch/);
+});

package/scripts/ui-prototype-devtools-test.js

@@ -0,0 +1,53 @@
+'use strict';
+const test=require('node:test'),assert=require('node:assert/strict'),fs=require('node:fs'),path=require('node:path'),os=require('node:os');
+const installationFile=path.join(__dirname,'lib/installation.js');
+const skills=fs.existsSync(installationFile)?require(installationFile).loadInstallation().skillsDirectory:path.resolve(__dirname,'../skills');
+const review=require(path.join(skills,'i3-ui-prototype/scripts/native-devtools.cjs'));
+// Synthetic contract fixtures only; none is browser or host invocation evidence.
+function fixture(t){
+ const directory=fs.mkdtempSync(path.join(os.tmpdir(),'devtools-review-'));t.after(()=>fs.rmSync(directory,{recursive:true,force:true}));
+ const write=(file,value)=>{const full=path.join(directory,file);fs.mkdirSync(path.dirname(full),{recursive:true});fs.writeFileSync(full,Buffer.isBuffer(value)||typeof value==='string'?value:JSON.stringify(value));};
+ const current={revision:'r001',digest:'a'.repeat(64)},build={buildId:'b-fixture',buildDigest:'b'.repeat(64)};
+ write('inputs/acceptance.json',{browserReview:review.policy()});
+ const png=Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+ip1sAAAAASUVORK5CYII=','base64');
+ const observations={};for(const kind of review.KINDS){const evidence=`qa/fixture/${kind}.${kind==='screenshot'?'png':kind==='performance'?'json':'txt'}`;write(evidence,kind==='screenshot'?png:kind==='performance'?{traceEvents:[{name:'synthetic-fixture',ts:1}]}:`Synthetic ${kind} fixture; not executed`);observations[kind]={status:'passed',summary:'Synthetic guard fixture, not executed',evidence};}
+ const report={schemaVersion:1,status:'passed',revision:current.revision,candidateDigest:current.digest,...build,executor:'synthetic-unit-fixture',startedAt:'2026-10-17T00:00:00.000Z',completedAt:'2026-10-17T00:00:01.000Z',previewBaseURL:'http://127.0.0.1:4173/',skill:{name:review.policy().skill,toolCallId:'fixture-skill',evidence:'synthetic-fixture only'},mcp:{name:'chrome-devtools-mcp',version:'1.11.0',evidence:'synthetic-fixture only',calls:['evaluate_script','take_screenshot','list_console_messages','list_network_requests','take_snapshot','performance_start_trace','performance_stop_trace'].map((name,index)=>({tool:`mcp__chrome-devtools__${name}`,toolCallId:`fixture-${index}`}))},observations,openItems:[]};
+ const lib={manifest:()=>current,verifyBuild:(_root,id)=>{assert.equal(id,build.buildId);return build;},claim:()=>{},release:()=>{}};
+ return {directory,write,current,build,report,lib};
+}
+test('new DevTools policy is explicit; old fixed inputs remain read-only and not required',t=>{
+ const f=fixture(t);assert.equal(review.check(f.directory,f.lib).status,'not-run');
+ f.write('inputs/acceptance.json',{});const before=fs.readdirSync(f.directory);assert.deepEqual(review.check(f.directory,f.lib),{status:'not-required',required:false});assert.deepEqual(fs.readdirSync(f.directory),before);
+});
+test('fixed framework inputs retain all six DevTools observations and reject policy removal',t=>{
+ const f=fixture(t);f.write('inputs/framework.json',{acceptance:{browserReview:review.policy()}});
+ for(const mutate of [value=>delete value.browserReview,value=>value.browserReview.required=false,value=>value.browserReview.observations.pop()]){
+  const input={browserReview:review.policy()};mutate(input);f.write('inputs/acceptance.json',input);
+  assert.equal(review.check(f.directory,f.lib).status,'failed');assert.throws(()=>review.record(f.directory,f.report,f.lib),/policy|observations|opt out/);
+ }
+});
+test('a review binds six actual-format evidence files to current candidate and build without attesting invocation',t=>{
+ const f=fixture(t),before=f.current.digest;const result=review.record(f.directory,f.report,f.lib);
+ assert.equal(result.status,'passed');assert.equal(result.invocationVerified,false);assert.equal(f.current.digest,before);
+ const checked=review.check(f.directory,f.lib);assert.equal(checked.status,'current');assert.equal(Object.keys(checked.evidenceDigests).length,6);
+ assert.match(checked.limitations,/host transcript/);
+});
+test('missing observation, stale identity and substituted evidence cannot pass the review gate',t=>{
+ const f=fixture(t);
+ for(const mutate of [r=>delete r.observations.network,r=>r.observations.console.status='not-run',r=>r.candidateDigest='c'.repeat(64),r=>r.buildDigest='c'.repeat(64),r=>r.skill.name='other-skill',r=>r.mcp.calls=r.mcp.calls.filter(c=>!c.tool.endsWith('performance_stop_trace')),r=>r.observations.network.evidence=r.observations.dom.evidence]){
+  const report=structuredClone(f.report);mutate(report);assert.throws(()=>review.record(f.directory,report,f.lib));assert.equal(fs.existsSync(path.join(f.directory,'qa/devtools-review.json')),false);
+ }
+ review.record(f.directory,f.report,f.lib);f.write(f.report.observations.network.evidence,'changed QA artifact');assert.equal(review.check(f.directory,f.lib).status,'failed');
+});
+test('Playwright ZIP and mislabeled screenshots do not become DevTools trace or PNG evidence',t=>{
+ const f=fixture(t);f.write(f.report.observations.performance.evidence,Buffer.from('PK\x03\x04fake-playwright-trace'));assert.throws(()=>review.record(f.directory,f.report,f.lib),/trace|JSON/);
+ f.write(f.report.observations.performance.evidence,{traceEvents:[{name:'fixture'}]});f.write(f.report.observations.screenshot.evidence,'not a PNG');assert.throws(()=>review.record(f.directory,f.report,f.lib),/PNG/);
+});
+test('a truncated PNG header is not a complete screenshot artifact',t=>{
+ const f=fixture(t),fake=Buffer.alloc(24);Buffer.from([137,80,78,71,13,10,26,10]).copy(fake);fake.write('IHDR',12);fake.writeUInt32BE(1,16);fake.writeUInt32BE(1,20);f.write(f.report.observations.screenshot.evidence,fake);
+ assert.throws(()=>review.record(f.directory,f.report,f.lib),/PNG/);
+});
+test('evidence paths cannot escape QA through traversal or symlinks',t=>{
+ const f=fixture(t),r=structuredClone(f.report);r.observations.dom.evidence='../outside.txt';assert.throws(()=>review.record(f.directory,r,f.lib),/QA|path/);
+ const link=path.join(f.directory,'qa/link.txt');fs.symlinkSync(path.join(f.directory,f.report.observations.dom.evidence),link);r.observations.dom.evidence='qa/link.txt';assert.throws(()=>review.record(f.directory,r,f.lib),/symlink/);
+});