@givolt/i3-composer-agent 2.3.1 → 2.3.3

package/scripts/ui-prototype-codebuddy-hook-test.js

@@ -0,0 +1,106 @@
+'use strict';
+const prototypeScripts=(()=>{const fs=require('node:fs'),path=require('node:path'),file=path.join(__dirname,'lib/installation.js');return path.join(fs.existsSync(file)?require(file).loadInstallation().skillsDirectory:path.resolve(__dirname,'../skills'),'i3-ui-prototype/scripts');})();
+const test=require('node:test'),assert=require('node:assert/strict');
+const H=require(prototypeScripts+'/codebuddy-hook.cjs'),E=require(prototypeScripts+'/execution-evidence.cjs');
+test('native command parsing handles quoted paths without evaluating shell substitutions or chains',()=>{
+ const c=H.nativeCommand('Bash',{command:"'/node path/node' '/skills path/native-pilot.cjs' execution-begin '/work/prototypes/a b'"},'/work');
+ assert.equal(c.root,'/work/prototypes/a b');assert.equal(c.operation,'execution-begin');
+ for(const command of ['node x; node native-pilot.cjs finalize /x','$(steal) native-pilot.cjs build /x','node x | node native-pilot.cjs finalize /x'])assert.equal(H.nativeCommand('Bash',{command},'/work'),null);
+});
+test('before UI write requires a successful frontend Skill in the same live context and task',()=>{
+ const source={prompts:[{line:1,text:'create prototype'}],calls:[],contextLine:0},binding={entryLine:1,contextLine:0,sessionId:'s1'};
+ const input={event:'PreToolUse',source,binding,tool:'Write',input:{file_path:'/work/prototypes/p/app/src/A.vue'},directory:'/work/prototypes/p'};
+ assert.equal(H.decision(input).deny,true);
+ source.calls=[{skill:'frontend',sessionId:'s1',requestLine:2,resultLine:3,success:true}];assert.equal(H.decision(input).continue,true);
+ source.contextLine=4;assert.equal(H.decision(input).deny,true);
+});
+test('analysis overrides old tasks and Stop feedback is bounded without granting tool permissions',()=>{
+ const source={prompts:[{line:1,text:'先分析，不改代码'}],calls:[],contextLine:0};
+ assert.equal(H.decision({event:'Stop',source,binding:{},deliveryCurrent:false}).feedback,undefined);
+ source.prompts[0].text='implement prototype';
+ source.latestAssistant='已完成，可以交付';
+ assert.equal(H.decision({event:'Stop',source,binding:{},deliveryCurrent:false}).feedback,true);
+ assert.equal(H.decision({event:'Stop',source,binding:{},deliveryCurrent:false,stopHookActive:true}).continue,true);
+ assert.equal(H.decision({event:'Stop',source,binding:{},deliveryCurrent:true}).continue,true);
+ assert.equal(JSON.stringify(H.decision({event:'PreToolUse',source,tool:'Read',directory:'/p'})).includes('permissionDecision'),false);
+});
+test('native compact boundaries invalidate loads and mixed-session results are rejected',()=>{
+ const rows=[{type:'user',sessionId:'s1',message:{content:'create prototype'}},{type:'assistant',sessionId:'s1',message:{content:[{type:'tool_use',id:'f',name:'Skill',input:{skill:'i3-frontend-ui-engineering'}}]}},{type:'user',sessionId:'s2',message:{content:[{type:'tool_result',tool_use_id:'f',content:'loaded'}]}}];
+ assert.throws(()=>E.parse(rows.map(r=>JSON.stringify(r)).join('\n')),/session/);
+ rows[2].sessionId='s1';rows.push({type:'system',subtype:'compact_boundary'});
+ assert.equal(E.describe(rows.map(r=>JSON.stringify(r)).join('\n')).contextLine,4);
+});
+test('effective binding differs by IDE override and CLI merge without writing any settings',()=>{
+ const C=require(prototypeScripts+'/codebuddy-context.cjs'),path=require('node:path');
+ const texts=new Map(),records=new Map(),project='/work/p',home='/home/user',projectBase=path.join(project,'.codebuddy'),globalBase=path.join(home,'.codebuddy');
+ const args={project,home,readText:file=>texts.get(file)||null,loadRegistration:base=>records.get(base)||null};
+ records.set(globalBase,{base:globalBase,product:'ide'});texts.set(path.join(projectBase,'settings.json'),'{}');
+ assert.equal(C.select({...args,product:'ide'}),null,'IDE cannot fall back through shadowing project settings');
+ records.set(globalBase,{base:globalBase,product:'cli'});assert.equal(C.select({...args,product:'cli'}).base,globalBase);
+ records.set(projectBase,{base:projectBase,product:'cli'});assert.equal(C.select({...args,product:'cli'}).base,projectBase);
+ texts.set(path.join(projectBase,'settings.local.json'),'{"hooks":{}}');assert.throws(()=>C.select({...args,product:'cli'}),/overrides/);
+ assert.notEqual(C.projectKey('/work/p'),C.projectKey('/other/p'));
+});
+test('read-only intent does not confuse business pause buttons with cancelling implementation',()=>{
+ const C=require(prototypeScripts+'/codebuddy-context.cjs');
+ assert.equal(C.readOnly('先分析，不改代码'),true);assert.equal(C.readOnly('先检查再实现原型'),false);
+ assert.equal(C.readOnly('增加暂停按钮，不改业务逻辑'),false);assert.equal(C.readOnly('暂停当前修改'),true);
+});
+test('a Hook payload must resolve to the actual current native request rather than a model-written begin',()=>{
+ const source={prompts:[{line:1,text:'create prototype'}],calls:[{name:'Bash',toolCallId:'native-begin',input:{command:'node native-pilot.cjs execution-begin /p'},requestLine:3}]};
+ const payload={hook_event_name:'PreToolUse',tool_name:'Bash',tool_input:{command:'node native-pilot.cjs execution-begin /p'}};
+ assert.equal(H.eventCall(payload,source).toolCallId,'native-begin');
+ assert.throws(()=>H.eventCall({...payload,tool_input:{command:'fabricated begin'}},source),/uniquely/);
+ source.calls[0].resultLine=4;assert.throws(()=>H.eventCall(payload,source),/uniquely/);
+});
+test('project-scope callbacks use their registered root when tools run in a subdirectory',()=>{
+ const payload={cwd:'/business/p/src'},real=p=>p;
+ assert.equal(H.safeProject(payload,{scope:'project',base:'/business/p/.codebuddy'},{},real),'/business/p');
+ assert.equal(H.safeProject(payload,{scope:'global',base:'/custom/codebuddy'},{CODEBUDDY_PROJECT_DIR:'/business/p'},real),'/business/p');
+ assert.equal(H.safeProject({hook_event_name:'SessionStart'},{scope:'global',base:'/custom/codebuddy'},{},real,'/business/p'),'/business/p');
+ assert.throws(()=>H.safeProject({cwd:'/other'},{scope:'project',base:'/business/p/.codebuddy'},{},real),/outside/);
+});
+test('the frontend gate blocks project-relative native Write calls before any run binding',()=>{
+ const result=H.decision({event:'PreToolUse',source:{prompts:[{line:1,text:'实现原型'}],calls:[],contextLine:0},tool:'Write',input:{file_path:'prototypes/p/app/src/Probe.vue'},directory:'/work/prototypes/p',cwd:'/work'});
+ assert.equal(result.deny,true);assert.match(result.reason,/frontend/);
+ const ide=H.decision({event:'PreToolUse',source:{prompts:[{line:1,text:'实现原型'}],calls:[],contextLine:0},tool:'Write',input:{filePath:'/work/prototypes/p/app/src/Probe.vue'},directory:'/work/prototypes/p',cwd:'/work'});
+ assert.equal(ide.deny,true);
+});
+test('IDE streaming requests correlate only within the exact native generation and unique call',()=>{
+ const source={format:'codebuddy-ide-index-v1',prompts:[{line:1}],calls:[{name:'Write',toolCallId:'actual-ide-call',nativeRequestId:'generation-1',input:{content:'<template>'},requestLine:2}]};
+ const payload={hook_event_name:'PreToolUse',client:'CodeBuddyIDE',generation_id:'generation-1',tool_name:'Write',tool_input:{filePath:'/work/p/app/src/A.vue',content:'<template><p>A</p></template>'}};
+ assert.equal(H.eventCall(payload,source).toolCallId,'actual-ide-call');
+ assert.throws(()=>H.eventCall({...payload,generation_id:'other'},source),/uniquely/);
+ assert.throws(()=>H.eventCall({...payload,client:'other'},source),/uniquely/);
+ assert.throws(()=>H.eventCall({...payload,tool_input:{content:'unrelated'}},source),/uniquely/);
+ source.calls.push({...source.calls[0],toolCallId:'second-call'});assert.throws(()=>H.eventCall(payload,source),/uniquely/);
+});
+test('IDE transient reads retry while wrong generations and mismatched pending requests stay rejected',()=>{
+ const payload={hook_event_name:'PreToolUse',client:'CodeBuddyIDE',generation_id:'g1',tool_name:'Write',tool_input:{content:'ui'}};
+ const pending={format:'codebuddy-ide-index-v1',prompts:[{line:1,nativeRequestId:'g1'}],calls:[{name:'Write',toolCallId:'w1',nativeRequestId:'g1',input:{content:'ui'},requestLine:2}]};
+ let reads=0,waits=0;
+ const readSource=()=>{if(++reads<3)throw new Error('native index write in progress');return pending;};
+ const result=H.eventSource(payload,{product:'ide'},'/work',{readSource,pause:ms=>{assert.equal(ms,100);waits++;}});
+ assert.equal(result.calls[0].toolCallId,'w1');assert.equal(result.nativeReadAttempts,3);assert.equal(waits,2);
+ reads=0;assert.throws(()=>H.eventSource({...payload,generation_id:'g2'},{product:'ide'},'/work',{readSource:()=>{reads++;return pending;},pause:()=>{}}),/generation/);assert.equal(reads,8);
+ assert.throws(()=>H.eventSource({...payload,tool_input:{content:'different'}},{product:'ide'},'/work',{readSource:()=>pending,pause:()=>{}}),/uniquely/);
+ reads=0;assert.throws(()=>H.eventSource({...payload,client:'cli'},{product:'cli'},'/work',{readSource:()=>{reads++;return {...pending,calls:[]};},pause:()=>assert.fail('CLI must not retry')}),/uniquely/);assert.equal(reads,1);
+});
+test('IDE defers current callback evidence until the host persists it and never invents Skill success',()=>{
+ const source={format:'codebuddy-ide-index-v1',prompts:[{line:1,nativeRequestId:'g1',text:'implement prototype'}],calls:[],contextLine:0};
+ const payload={hook_event_name:'PreToolUse',client:'CodeBuddyIDE',generation_id:'g1',tool_name:'Write',tool_input:{filePath:'/work/prototypes/p/app/src/A.vue'}};
+ const result=H.eventSource(payload,{product:'ide'},'/work',{readSource:()=>source});
+ assert.equal(result.nativeRequestStatus,'deferred-until-native-persistence');assert.deepEqual(result.calls,[]);
+ assert.equal(H.decision({event:'PreToolUse',source:result,binding:{entryLine:1,contextLine:0,sessionId:'s1'},tool:'Write',input:payload.tool_input,directory:'/work/prototypes/p'}).deny,true);
+ assert.throws(()=>E.reference(result.calls,{toolCallId:'made-up'}),/Successful native/);
+ assert.throws(()=>H.eventSource(payload,{product:'ide'},'/work',{readSource:()=>({...source,prompts:[{line:1,nativeRequestId:'old'}]}),pause:()=>{}}),/generation/);
+});
+test('only the observed project IDE root-cwd sentinel is mapped to the registered project',()=>{
+ const options={scope:'project',base:'/business/p/.codebuddy',product:'ide'},payload={cwd:'/',client:'CodeBuddyIDE'};
+ assert.equal(H.safeProject(payload,options,{},p=>p),'/business/p');
+ assert.throws(()=>H.safeProject({...payload,cwd:'/other'},options,{},p=>p),/outside/);
+ assert.throws(()=>H.safeProject(payload,{...options,product:'cli'},{},p=>p),/outside/);
+ assert.equal(H.safeProject({...payload,transcript_path:'/native/index.json',session_id:'s1'},{scope:'global',product:'ide'},{},p=>p,'/ignored',(file,session)=>{assert.equal(file,'/native/index.json');assert.equal(session,'s1');return '/business/p';}),'/business/p');
+ const cwd=H.toolCwd(payload,{product:'ide'},'/business/p');assert.equal(cwd,'/business/p');
+ assert.equal(H.nativeCommand('Bash',{command:'node /skills/native-pilot.cjs execution-begin prototypes/p'},cwd).root,'/business/p/prototypes/p');
+});

package/scripts/ui-prototype-content-test.js

@@ -0,0 +1,123 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const installation = path.join(__dirname, 'lib/installation.js');
+const skills = fs.existsSync(installation) ? require(installation).loadInstallation().skillsDirectory : path.resolve(__dirname, '../skills');
+const root = path.join(skills, 'i3-ui-prototype');
+const contract = require(path.join(root, 'scripts/template-contract.cjs'));
+const native = require(path.join(root, 'scripts/native-pilot-lib.cjs'));
+const read = (directory, file) => JSON.parse(fs.readFileSync(path.join(directory, file), 'utf8'));
+const write = (directory, file, data) => fs.writeFileSync(path.join(directory, file), JSON.stringify(data, null, 2));
+const files = directory => Object.fromEntries(fs.readdirSync(directory, { recursive: true }).filter(file => fs.statSync(path.join(directory, file)).isFile()).sort().map(file => [file, crypto.createHash('sha256').update(fs.readFileSync(path.join(directory, file))).digest('hex')]));
+function fixture(t, { prepare = true } = {}) {
+  const project = fs.mkdtempSync(path.join(os.tmpdir(), 'i3-full-content-'));
+  t.after(() => fs.rmSync(project, { recursive: true, force: true }));
+  const template = prepare ? contract.prepareTemplate({ project }) : null;
+  const scope = { schemaVersion: 1, title: '资产审核', pages: [{ id: 'assets', title: '资产台账', referencePage: 'models-page',
+    regions: [{ id: 'list', mode: 'management-list' }, { id: 'editor', mode: 'edit-form' }] }],
+    requirements: [{ id: 'ASSET-01', text: '查询、选择和修改资产', pages: ['assets'], source: { type: 'prd', reference: 'PRD.md#ASSET-01', statement: '按资产字段实现清单与编辑；使用模板通用能力约定。' } }], exemptions: [] };
+  write(project, 'scope.json', scope);
+  const create = options => native.createPrototype({ project, id: 'assets', expertMode: 'template', scope: path.join(project, 'scope.json'), ...(template ? { templateRoot: template.directory } : {}), ...options });
+  return { project, template, scope, create };
+}
+test('explicit legacy preparation uses the complete offline reference and never overwrites a working copy', t => {
+  const { project, template } = fixture(t);
+  const snapshot = contract.loadTemplate(template.directory);
+  assert.equal(snapshot.kind, 'content-reference'); assert.equal(snapshot.id, 'enterprise-admin');
+  assert.equal(snapshot.index.pages.length, 35); assert.equal(snapshot.index.routes.length, 44); assert.equal(snapshot.index.htmlFragments.length, 93);
+  assert.deepEqual(Object.keys(snapshot.index.extractor.files).sort(), ['content-template.cjs', 'template-contract.cjs']);
+  const file = path.join(template.directory, 'index.html');
+  fs.writeFileSync(file, fs.readFileSync(file, 'utf8').replace('<h1>模型管理</h1>', '<h1>资产参考内容</h1>'));
+  assert.throws(() => contract.loadTemplate(template.directory), /stale|不同步/);
+  const index = contract.syncTemplate(template.directory);
+  assert.equal(index.pages.find(page => page.id === 'models-page').title, '资产参考内容');
+  const content = require(path.join(root, 'scripts/content-template.cjs')).pageContent(contract.loadTemplate(template.directory), 'models-page');
+  assert.ok(content.html.includes('<h1>资产参考内容</h1>')); assert.equal(content.readOnly, true);
+  assert.equal(contract.prepareTemplate({ project }).created, false);
+  assert.ok(fs.readFileSync(file, 'utf8').includes('资产参考内容'));
+});
+test('default creation reads the released template without preparing a business template directory or modifying Skill assets', t => {
+  const { project, create } = fixture(t, { prepare: false });
+  const builtin = path.join(root, 'assets/templates/enterprise-admin');
+  const before = files(builtin);
+  const created = create();
+  assert.equal(fs.existsSync(path.join(project, 'ui-templates')), false);
+  assert.equal(fs.existsSync(path.join(project, '.prototype-preparation')), false);
+  assert.deepEqual(files(builtin), before);
+  assert.equal(native.inspect(created.directory).status, 'passed');
+  const snapshot = read(created.directory, 'inputs/template-snapshot.json');
+  assert.equal(snapshot.id, 'enterprise-admin'); assert.equal(snapshot.index.pages.length, 35);
+  assert.deepEqual(snapshot, contract.loadBundledTemplate());
+  assert.deepEqual(read(created.directory, 'inputs/scope.json'), read(project, 'scope.json'));
+});
+test('an existing edited template copy is preserved and used only when explicitly selected', t => {
+  const { project, template, create } = fixture(t);
+  const entry = path.join(template.directory, 'index.html');
+  fs.writeFileSync(entry, fs.readFileSync(entry, 'utf8').replace('<h1>模型管理</h1>', '<h1>用户维护的旧模板</h1>'));
+  contract.syncTemplate(template.directory);
+  const before = files(template.directory);
+  const current = create({ id: 'current', templateRoot: undefined });
+  const legacy = create({ id: 'legacy' });
+  assert.notEqual(read(current.directory, 'inputs/template-snapshot.json').digest, read(legacy.directory, 'inputs/template-snapshot.json').digest);
+  assert.equal(read(legacy.directory, 'inputs/template-snapshot.json').index.pages.find(page => page.id === 'models-page').title, '用户维护的旧模板');
+  assert.deepEqual(files(template.directory), before);
+});
+test('new business generation requires a sourced scope and does not silently generate a device list', t => {
+  const { project, create } = fixture(t);
+  assert.throws(() => create({ scope: undefined }), /scope|需求/i);
+  assert.equal(fs.existsSync(path.join(project, 'prototypes')), false);
+  const created = create(), meta = read(created.directory, 'prototype.json');
+  assert.equal(meta.runtime.contentReference, true); assert.equal(meta.business.status, 'needs-adaptation');
+  assert.equal(native.inspect(created.directory).status, 'passed');
+  assert.match(native.inspect(created.directory, { acceptance: true }).errors.join('; '), /implementation pending|scaffold/);
+  const config = read(created.directory, 'app/public/prototype-config.json');
+  assert.deepEqual(config.pages, [{ id: 'assets', title: '资产台账' }]);
+  assert.deepEqual(config.theme, { defaultTheme: 'light', presets: ['light', 'dark', 'fresh', 'tech'] });
+  assert.equal(config.content, undefined); assert.equal(read(created.directory, 'mocks/contract.json').count, undefined);
+  assert.equal(fs.existsSync(path.join(created.directory, 'app/src/domain/devices.ts')), false);
+  const state = native.state(created.directory, {});
+  assert.equal(state.nextAction, 'implement-business'); assert.equal(state.commands.browser, undefined); assert.ok(state.commands.recordRun);
+});
+test('the complete content reference yields fixed common capabilities for the selected business regions', t => {
+  const { create } = fixture(t), directory = create().directory;
+  const fixed = read(directory, 'inputs/capabilities.json'), acceptance = read(directory, 'inputs/acceptance.json');
+  for (const id of ['filter', 'selection', 'pagination', 'bulk', 'feedback']) assert.ok(fixed.bindings.some(binding => binding.id === `assets/list/${id}`));
+  assert.ok(fixed.bindings.some(binding => binding.id === 'assets/editor/edit'));
+  assert.ok(fixed.bindings.some(binding => binding.id === 'app-shell/appearance/theme'));
+  assert.ok(acceptance.requiredScenarios.includes('assets/list/pagination/pages'));
+  assert.ok(acceptance.requiredScenarios.includes('app-shell/appearance/theme/persistence'));
+  assert.equal(acceptance.requiredScenarios.some(id => id.startsWith('devices/')), false);
+  fixed.bindings = fixed.bindings.filter(binding => binding.capabilityId !== 'selection'); write(directory, 'inputs/capabilities.json', fixed);
+  const candidate = native.manifest(directory);
+  assert.throws(() => native.revise(directory, { revision: 'r002', expectedRevision: candidate.revision, expectedDigest: candidate.digest, acceptInputs: true }), /binding|capabilit|合同/i);
+});
+test('business page and requirement references must remain explicit and unambiguous', t => {
+  const { project, scope, create } = fixture(t);
+  for (const modify of [
+    value => { value.pages[0].referencePage = 'missing-page'; },
+    value => { value.pages.push(structuredClone(value.pages[0])); },
+    value => { value.requirements.push(structuredClone(value.requirements[0])); },
+    value => { value.requirements[0].source = {}; },
+    value => { value.requirements[0].pages = ['other-business']; },
+    value => { value.pages[0].regions[0].mode = 'unknown-mode'; },
+  ]) {
+    const broken = structuredClone(scope); modify(broken); write(project, 'scope.json', broken);
+    assert.throws(() => create()); assert.equal(fs.existsSync(path.join(project, 'prototypes')), false);
+  }
+});
+test('offline reference synchronization rejects missing runtime resources and module loading', t => {
+  const { template } = fixture(t), file = path.join(template.directory, 'index.html'), html = fs.readFileSync(file, 'utf8');
+  fs.writeFileSync(file, html.replace('src="offline.js"', 'src="missing.js"')); assert.throws(() => contract.syncTemplate(template.directory), /resource missing/);
+  fs.writeFileSync(file, html.replace('<script src="offline.js"', '<script type="module" src="offline.js"')); assert.throws(() => contract.syncTemplate(template.directory), /modules/);
+  fs.writeFileSync(file, html); fs.appendFileSync(path.join(template.directory, 'offline.js'), '\nfetch("parts.html")'); assert.throws(() => contract.syncTemplate(template.directory), /Offline runtime/);
+});
+test('the historical device regression runner refuses a business contract before writing evidence', async t => {
+  const { create } = fixture(t), directory = create().directory;
+  const before = fs.readdirSync(path.join(directory, 'qa'));
+  await assert.rejects(require(path.join(root, 'scripts/native-browser.cjs')).main(directory), /historical device-list/);
+  assert.deepEqual(fs.readdirSync(path.join(directory, 'qa')), before);
+});

package/scripts/ui-prototype-dependencies-test.js

@@ -0,0 +1,213 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const installation = path.join(__dirname, 'lib/installation.js');
+const skills = fs.existsSync(installation) ? require(installation).loadInstallation().skillsDirectory : path.resolve(__dirname, '../skills');
+const deps = require(path.join(skills, 'i3-ui-prototype/scripts/prototype-dependencies.cjs'));
+const installer = require(path.join(skills, 'i3-ui-prototype/scripts/optional-skill-install.cjs'));
+function workspace(t) {
+  const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'i3-optional-deps-')));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const project = path.join(root, 'business'), home = path.join(root, 'home');
+  fs.mkdirSync(project); fs.mkdirSync(home);
+  return { project, home, env: {
+    ...process.env,
+    HOME: home, USERPROFILE: home,
+    XDG_CONFIG_HOME: path.join(home, '.config'),
+    CODEBUDDY_CONFIG_DIR: path.join(home, '.codebuddy'),
+    WORKBUDDY_CONFIG_DIR: path.join(home, '.workbuddy'),
+    CLAUDE_CONFIG_DIR: path.join(home, '.claude'),
+    CODEX_HOME: path.join(home, '.codex'),
+  } };
+}
+test('missing optional Skills do not fail read-only inspection or write files', t => {
+  const options = workspace(t), before = fs.readdirSync(options.project);
+  const result = deps.check(options);
+  assert.equal(result.status, 'checked');
+  assert.equal(result.professionalReady, false);
+  assert.equal(result.antdv.skill.availability, 'missing');
+  assert.equal(result.antdv.tool.availability, 'missing');
+  assert.deepEqual(fs.readdirSync(options.project), before);
+});
+test('later installed antDv Skill is detected without reinstalling i3 or claiming the CLI ready', t => {
+  const options = workspace(t);
+  assert.equal(deps.check(options).antdv.skill.availability, 'missing');
+  const root = path.join(options.project, '.codebuddy/skills/antdv');
+  fs.mkdirSync(root, { recursive: true }); fs.writeFileSync(path.join(root, 'SKILL.md'), 'official Skill fixture');
+  const result = deps.check(options);
+  assert.equal(result.antdv.skill.root, root);
+  assert.equal(result.antdv.skill.availability, 'available');
+  assert.equal(result.antdv.skill.invocationVerified, false);
+  assert.equal(result.antdv.tool.availability, 'missing');
+});
+test('CodeBuddy global antDv is reusable and current project entry has precedence', t => {
+  const options = workspace(t);
+  options.env.CODEBUDDY_CONFIG_DIR = path.join(options.home, 'legacy CodeBuddy config');
+  const global = path.join(options.env.CODEBUDDY_CONFIG_DIR, 'skills/antdv');
+  fs.mkdirSync(global, { recursive: true }); fs.writeFileSync(path.join(global, 'SKILL.md'), 'global');
+  assert.equal(deps.skillAt(options.project, 'antdv', options).source, 'global-skill');
+  const local = path.join(options.project, '.codebuddy/skills/antdv');
+  fs.mkdirSync(local, { recursive: true }); fs.writeFileSync(path.join(local, 'SKILL.md'), 'local');
+  assert.equal(deps.skillAt(options.project, 'antdv', options).root, local);
+});
+test('global UIUX detection reuses enabled user plugins, preserves disabled status and excludes business plugins', t => {
+  const options = { ...workspace(t), host: 'codebuddy', scope: 'global' }, config = path.join(options.home, '.codebuddy');
+  const plugin = path.join(options.home, 'uiux-plugin'), root = path.join(plugin, 'skills/ui-ux-pro-max'), id = 'ui-ux-pro-max@fixture';
+  const write = (file, content) => { fs.mkdirSync(path.dirname(file), { recursive: true }); fs.writeFileSync(file, typeof content === 'string' ? content : JSON.stringify(content)); };
+  write(path.join(plugin, '.codebuddy-plugin/plugin.json'), { name: 'ui-ux-pro-max', version: '2.15.0' });
+  for (const file of ['SKILL.md', 'scripts/core.py', 'scripts/design_system.py', ...['ux-guidelines','styles','colors','typography','products','landing','ui-reasoning'].map(name => `data/${name}.csv`)]) write(path.join(root, file), 'synthetic fixture');
+  write(path.join(root, 'scripts/search.py'), 'import json\nprint(json.dumps({"domain":"ux","results":[{"id":"synthetic-probe-only"}]}))\n');
+  write(path.join(config, 'settings.json'), { enabledPlugins: { [id]: true } });
+  const record = { scope: 'user', installPath: plugin, version: '2.15.0' };
+  write(path.join(config, 'plugins/installed_plugins.json'), { version: 2, plugins: { [id]: [record] } });
+  const result = deps.check(options);
+  assert.equal(result.uiux.root, root);
+  assert.equal(result.uiux.availability, 'available');
+  assert.equal(result.uiux.source, 'codebuddy-plugin');
+  write(path.join(config, 'settings.json'), { enabledPlugins: { [id]: false } });
+  assert.equal(deps.check(options).uiux.availability, 'disabled');
+  write(path.join(config, 'settings.json'), { enabledPlugins: { [id]: true } });
+  write(path.join(config, 'plugins/installed_plugins.json'), { version: 2, plugins: { [id]: [{ ...record, scope: 'project', projectPath: options.project }] } });
+  assert.equal(deps.check(options).uiux.availability, 'missing');
+});
+test('dependency CLI rejects unintended writes and unrelated hosts', () => {
+  assert.throws(() => deps.parse(['check', '--force']), /Invalid option/);
+  assert.throws(() => deps.check({ host: 'not-a-host' }), /Unknown host/);
+  assert.throws(() => deps.parse(['update']), /check or install/);
+});
+function officialFixture(name, folder) {
+  const skill = path.join(folder, 'skill'), tool = path.join(folder, 'tool');
+  fs.mkdirSync(skill); fs.mkdirSync(tool);
+  fs.writeFileSync(path.join(skill, 'SKILL.md'), `---\nname: ${name === 'uiux' ? 'ui-ux-pro-max' : 'antdv'}\n---\nOfficial fixture; not host invocation evidence.\n`);
+  if (name === 'uiux') {
+    for (const file of ['scripts/search.py', 'scripts/core.py', 'scripts/design_system.py', 'data/ux-guidelines.csv']) {
+      fs.mkdirSync(path.dirname(path.join(skill, file)), { recursive: true }); fs.writeFileSync(path.join(skill, file), 'fixture');
+    }
+  } else {
+    const pkg = path.join(tool, 'node_modules/@antdv-next/cli'); fs.mkdirSync(pkg, { recursive: true });
+    fs.writeFileSync(path.join(pkg, 'package.json'), JSON.stringify({ name: '@antdv-next/cli', version: '0.0.0-beta.1', bin: { antdv: 'cli.cjs' } }));
+    fs.writeFileSync(path.join(pkg, 'cli.cjs'), 'process.stdout.write(JSON.stringify({name:"Table",props:[]}));');
+  }
+  return { skill, tool };
+}
+test('explicit skip never downloads, writes or permanently disables dependencies', async t => {
+  const options = workspace(t), before = fs.readdirSync(options.project);
+  const result = await installer.install({ ...options, skills: 'none' }, { prepare() { throw new Error('Unexpected download'); } });
+  assert.equal(result.status, 'skipped');
+  assert.deepEqual(fs.readdirSync(options.project), before);
+  assert.deepEqual(installer.selection('uiux,antdv'), ['uiux', 'antdv']);
+  assert.throws(() => installer.selection('none,uiux'), /Choose/);
+});
+test('optional antDv installation preserves user files and a later invocation reuses the Skill', async t => {
+  const options = workspace(t);
+  fs.writeFileSync(path.join(options.project, 'PRD.md'), 'human requirements');
+  const services = { prepare: officialFixture, progress() {} };
+  const result = await installer.install({ ...options, skills: 'antdv' }, services);
+  assert.equal(result.status, 'installed');
+  assert.equal(result.detection.antdv.skill.availability, 'available');
+  assert.equal(fs.readFileSync(path.join(options.project, 'PRD.md'), 'utf8'), 'human requirements');
+  const skillFile = path.join(options.project, '.codebuddy/skills/antdv/SKILL.md');
+  fs.appendFileSync(skillFile, 'user edit'); const before = fs.readFileSync(skillFile);
+  const again = await installer.install({ ...options, skills: 'antdv' }, { prepare() { throw new Error('Existing tool must not be replaced'); } });
+  assert.equal(again.status, 'reused');
+  assert.deepEqual(fs.readFileSync(skillFile), before);
+});
+test('a failed second preparation publishes neither selected Skill and removes temporary files', async t => {
+  const options = workspace(t);
+  await assert.rejects(installer.install({ ...options, skills: 'uiux,antdv' }, {
+    progress() {}, prepare(name, folder) { if (name === 'antdv') throw new Error('simulated network failure'); return officialFixture(name, folder); },
+  }), /simulated network failure/);
+  assert.deepEqual(fs.readdirSync(options.project), []);
+});
+test('antDv error text or error JSON with exit zero is not successful knowledge', async t => {
+  const options = workspace(t);
+  await installer.install({ ...options, skills: 'antdv' }, { prepare: officialFixture, progress() {} });
+  const file = path.join(resultTool(options), 'node_modules/@antdv-next/cli/cli.cjs');
+  for (const output of ['Error: Table knowledge missing', JSON.stringify({ error: 'Table knowledge missing' })]) {
+    fs.writeFileSync(file, `process.stdout.write(${JSON.stringify(output)});`);
+    assert.equal(deps.check(options).antdv.tool.availability, 'unusable');
+  }
+});
+function resultTool(options) { return path.join(deps.check(options).locations.toolsDirectory, 'antdv-cli'); }
+for (const host of ['codebuddy', 'workbuddy', 'codex', 'claude-code']) for (const scope of ['project', 'global']) {
+  test(`${host} ${scope} optional installation keeps all tools inside the selected host root`, async t => {
+    const options = { ...workspace(t), host, scope };
+    const result = await installer.install({ ...options, skills: 'antdv' }, { prepare: officialFixture, progress() {} });
+    assert.equal(result.detection.antdv.tool.source, `${scope}-tool`);
+    assert.ok(fs.existsSync(path.join(resultTool(options), 'node_modules/@antdv-next/cli/package.json')));
+    assert.equal(fs.existsSync(path.join(options.project, '.prototype-tools')), false);
+    assert.equal(fs.existsSync(path.join(options.project, 'package.json')), false);
+    if (scope === 'global') assert.deepEqual(fs.readdirSync(options.project), []);
+  });
+}
+test('an available global tool is reused by a later project without project writes', async t => {
+  const options = workspace(t);
+  await installer.install({ ...options, host: 'codex', scope: 'global', skills: 'antdv' }, { prepare: officialFixture, progress() {} });
+  const result = await installer.install({ ...options, host: 'codex', skills: 'antdv' }, { prepare() { throw new Error('No download expected'); } });
+  assert.equal(result.status, 'reused');
+  assert.equal(result.detection.antdv.tool.source, 'global-tool');
+  assert.deepEqual(fs.readdirSync(options.project), []);
+});
+test('legacy independent tools stay readable until an explicit owned migration', async t => {
+  const options = workspace(t), legacy = path.join(options.project, '.prototype-tools/antdv-cli');
+  const stage = path.join(options.project, 'fixture'); fs.mkdirSync(stage);
+  const prepared = officialFixture('antdv', stage);
+  fs.mkdirSync(path.dirname(legacy)); fs.renameSync(prepared.tool, legacy); fs.rmSync(stage, { recursive: true });
+  fs.writeFileSync(path.join(legacy, 'UPSTREAM-ORIGIN.json'), JSON.stringify({ ...require(path.join(skills, 'i3-ui-prototype/assets/optional-skills/sources.json')).antdv, installer: 'i3 optional dependency preparation; official Skill body unchanged' }));
+  assert.equal(deps.check(options).antdv.tool.source, 'legacy-project-tool');
+  await installer.install({ ...options, skills: 'antdv' }, { prepare: officialFixture, progress() {} });
+  assert.equal(fs.existsSync(legacy), true);
+  fs.writeFileSync(path.join(options.project, '.prototype-tools/user-note.txt'), 'keep this location');
+  await installer.install({ ...options, scope: 'global', skills: 'antdv' }, { prepare: officialFixture, progress() {} });
+  assert.equal(deps.check(options).antdv.tool.source, 'global-tool', 'normal lookup prefers a current global tool over legacy');
+  const result = await installer.install({ ...options, skills: 'antdv', migrateTools: true }, { prepare() { throw new Error('No download expected'); } });
+  assert.equal(result.status, 'migrated');
+  assert.equal(result.detection.antdv.tool.source, 'project-tool');
+  assert.equal(fs.existsSync(legacy), false);
+  assert.equal(fs.readFileSync(path.join(options.project, '.prototype-tools/user-note.txt'), 'utf8'), 'keep this location');
+});
+test('legacy mixed tools without i3 ownership remain untouched by migration', async t => {
+  const options = workspace(t), stage = path.join(options.project, 'fixture'); fs.mkdirSync(stage);
+  const prepared = officialFixture('antdv', stage), legacy = path.join(options.project, '.prototype-tools/antdv-cli');
+  fs.mkdirSync(path.dirname(legacy)); fs.renameSync(prepared.tool, legacy); fs.rmSync(stage, { recursive: true });
+  await assert.rejects(installer.install({ ...options, skills: 'antdv', migrateTools: true }, { prepare() { throw new Error('No download expected'); } }), /ownership|来源|归属/);
+  assert.equal(deps.check(options).antdv.tool.source, 'legacy-project-tool');
+});
+test('a broken project tool is reported instead of silently borrowing a healthy global tool', async t => {
+  const options = workspace(t);
+  await installer.install({ ...options, scope: 'global', skills: 'antdv' }, { prepare: officialFixture, progress() {} });
+  const local = path.join(options.project, '.codebuddy/tools/i3-prototype/antdv-cli/node_modules/@antdv-next/cli');
+  fs.mkdirSync(local, { recursive: true }); fs.writeFileSync(path.join(local, 'package.json'), '{broken');
+  assert.equal(deps.check(options).antdv.tool.availability, 'unusable');
+  assert.equal(deps.check({ ...options, scope: 'global' }).antdv.tool.availability, 'available');
+  await assert.rejects(installer.install({ ...options, skills: 'antdv' }), /Existing tool unusable/);
+  assert.equal(fs.readFileSync(path.join(local, 'package.json'), 'utf8'), '{broken');
+});
+test('failed post-migration execution restores the old location and removes newly created destinations', async t => {
+  const options = workspace(t), stage = path.join(options.project, 'fixture'); fs.mkdirSync(stage);
+  const prepared = officialFixture('antdv', stage), legacy = path.join(options.project, '.prototype-tools/antdv-cli');
+  fs.mkdirSync(path.dirname(legacy)); fs.renameSync(prepared.tool, legacy); fs.rmSync(stage, { recursive: true });
+  const file = path.join(legacy, 'node_modules/@antdv-next/cli/cli.cjs');
+  fs.writeFileSync(file, 'if(__dirname.includes("tools/i3-prototype"))process.exit(1);process.stdout.write(JSON.stringify({name:"Table",props:[]}));');
+  fs.writeFileSync(path.join(legacy, 'UPSTREAM-ORIGIN.json'), JSON.stringify({ ...require(path.join(skills, 'i3-ui-prototype/assets/optional-skills/sources.json')).antdv, installer: 'i3 optional dependency preparation; official Skill body unchanged' }));
+  await assert.rejects(installer.install({ ...options, skills: 'antdv', migrateTools: true }, { prepare: officialFixture, progress() {} }), /tool query failed/);
+  assert.equal(deps.check(options).antdv.tool.source, 'legacy-project-tool');
+  assert.equal(fs.existsSync(path.join(options.project, '.codebuddy')), false);
+  assert.ok(fs.existsSync(file));
+});
+test('unusable existing UIUX resources are preserved without attempting a download', async t => {
+  const options = workspace(t), target = path.join(options.project, '.codebuddy/skills/ui-ux-pro-max');
+  fs.mkdirSync(target, { recursive: true }); fs.writeFileSync(path.join(target, 'SKILL.md'), 'human-owned incomplete skill');
+  await assert.rejects(installer.install({ ...options, skills: 'uiux' }, { prepare() { throw new Error('must not download'); } }), /Existing Skill preserved/);
+  assert.equal(fs.readFileSync(path.join(target, 'SKILL.md'), 'utf8'), 'human-owned incomplete skill');
+});
+test('optional installer rejects symlink escapes, including dangling targets, and bad download bytes', async t => {
+  const options = workspace(t), outside = path.join(options.project, 'outside');
+  fs.symlinkSync(outside, path.join(options.project, '.codebuddy'), 'dir');
+  await assert.rejects(installer.install({ ...options, skills: 'antdv' }, { prepare: officialFixture }), /symlink/);
+  assert.equal(fs.existsSync(outside), false);
+  assert.throws(() => installer.verify(Buffer.from('altered'), '0'.repeat(64)), /integrity mismatch/);
+});

package/scripts/ui-prototype-devtools-test.js

@@ -0,0 +1,53 @@
+'use strict';
+const test=require('node:test'),assert=require('node:assert/strict'),fs=require('node:fs'),path=require('node:path'),os=require('node:os');
+const installationFile=path.join(__dirname,'lib/installation.js');
+const skills=fs.existsSync(installationFile)?require(installationFile).loadInstallation().skillsDirectory:path.resolve(__dirname,'../skills');
+const review=require(path.join(skills,'i3-ui-prototype/scripts/native-devtools.cjs'));
+// Synthetic contract fixtures only; none is browser or host invocation evidence.
+function fixture(t){
+ const directory=fs.mkdtempSync(path.join(os.tmpdir(),'devtools-review-'));t.after(()=>fs.rmSync(directory,{recursive:true,force:true}));
+ const write=(file,value)=>{const full=path.join(directory,file);fs.mkdirSync(path.dirname(full),{recursive:true});fs.writeFileSync(full,Buffer.isBuffer(value)||typeof value==='string'?value:JSON.stringify(value));};
+ const current={revision:'r001',digest:'a'.repeat(64)},build={buildId:'b-fixture',buildDigest:'b'.repeat(64)};
+ write('inputs/acceptance.json',{browserReview:review.policy()});
+ const png=Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+ip1sAAAAASUVORK5CYII=','base64');
+ const observations={};for(const kind of review.KINDS){const evidence=`qa/fixture/${kind}.${kind==='screenshot'?'png':kind==='performance'?'json':'txt'}`;write(evidence,kind==='screenshot'?png:kind==='performance'?{traceEvents:[{name:'synthetic-fixture',ts:1}]}:`Synthetic ${kind} fixture; not executed`);observations[kind]={status:'passed',summary:'Synthetic guard fixture, not executed',evidence};}
+ const report={schemaVersion:1,status:'passed',revision:current.revision,candidateDigest:current.digest,...build,executor:'synthetic-unit-fixture',startedAt:'2026-10-17T00:00:00.000Z',completedAt:'2026-10-17T00:00:01.000Z',previewBaseURL:'http://127.0.0.1:4173/',skill:{name:review.policy().skill,toolCallId:'fixture-skill',evidence:'synthetic-fixture only'},mcp:{name:'chrome-devtools-mcp',version:'1.11.0',evidence:'synthetic-fixture only',calls:['evaluate_script','take_screenshot','list_console_messages','list_network_requests','take_snapshot','performance_start_trace','performance_stop_trace'].map((name,index)=>({tool:`mcp__chrome-devtools__${name}`,toolCallId:`fixture-${index}`}))},observations,openItems:[]};
+ const lib={manifest:()=>current,verifyBuild:(_root,id)=>{assert.equal(id,build.buildId);return build;},claim:()=>{},release:()=>{}};
+ return {directory,write,current,build,report,lib};
+}
+test('new DevTools policy is explicit; old fixed inputs remain read-only and not required',t=>{
+ const f=fixture(t);assert.equal(review.check(f.directory,f.lib).status,'not-run');
+ f.write('inputs/acceptance.json',{});const before=fs.readdirSync(f.directory);assert.deepEqual(review.check(f.directory,f.lib),{status:'not-required',required:false});assert.deepEqual(fs.readdirSync(f.directory),before);
+});
+test('fixed framework inputs retain all six DevTools observations and reject policy removal',t=>{
+ const f=fixture(t);f.write('inputs/framework.json',{acceptance:{browserReview:review.policy()}});
+ for(const mutate of [value=>delete value.browserReview,value=>value.browserReview.required=false,value=>value.browserReview.observations.pop()]){
+  const input={browserReview:review.policy()};mutate(input);f.write('inputs/acceptance.json',input);
+  assert.equal(review.check(f.directory,f.lib).status,'failed');assert.throws(()=>review.record(f.directory,f.report,f.lib),/policy|observations|opt out/);
+ }
+});
+test('a review binds six actual-format evidence files to current candidate and build without attesting invocation',t=>{
+ const f=fixture(t),before=f.current.digest;const result=review.record(f.directory,f.report,f.lib);
+ assert.equal(result.status,'passed');assert.equal(result.invocationVerified,false);assert.equal(f.current.digest,before);
+ const checked=review.check(f.directory,f.lib);assert.equal(checked.status,'current');assert.equal(Object.keys(checked.evidenceDigests).length,6);
+ assert.match(checked.limitations,/host transcript/);
+});
+test('missing observation, stale identity and substituted evidence cannot pass the review gate',t=>{
+ const f=fixture(t);
+ for(const mutate of [r=>delete r.observations.network,r=>r.observations.console.status='not-run',r=>r.candidateDigest='c'.repeat(64),r=>r.buildDigest='c'.repeat(64),r=>r.skill.name='other-skill',r=>r.mcp.calls=r.mcp.calls.filter(c=>!c.tool.endsWith('performance_stop_trace')),r=>r.observations.network.evidence=r.observations.dom.evidence]){
+  const report=structuredClone(f.report);mutate(report);assert.throws(()=>review.record(f.directory,report,f.lib));assert.equal(fs.existsSync(path.join(f.directory,'qa/devtools-review.json')),false);
+ }
+ review.record(f.directory,f.report,f.lib);f.write(f.report.observations.network.evidence,'changed QA artifact');assert.equal(review.check(f.directory,f.lib).status,'failed');
+});
+test('Playwright ZIP and mislabeled screenshots do not become DevTools trace or PNG evidence',t=>{
+ const f=fixture(t);f.write(f.report.observations.performance.evidence,Buffer.from('PK\x03\x04fake-playwright-trace'));assert.throws(()=>review.record(f.directory,f.report,f.lib),/trace|JSON/);
+ f.write(f.report.observations.performance.evidence,{traceEvents:[{name:'fixture'}]});f.write(f.report.observations.screenshot.evidence,'not a PNG');assert.throws(()=>review.record(f.directory,f.report,f.lib),/PNG/);
+});
+test('a truncated PNG header is not a complete screenshot artifact',t=>{
+ const f=fixture(t),fake=Buffer.alloc(24);Buffer.from([137,80,78,71,13,10,26,10]).copy(fake);fake.write('IHDR',12);fake.writeUInt32BE(1,16);fake.writeUInt32BE(1,20);f.write(f.report.observations.screenshot.evidence,fake);
+ assert.throws(()=>review.record(f.directory,f.report,f.lib),/PNG/);
+});
+test('evidence paths cannot escape QA through traversal or symlinks',t=>{
+ const f=fixture(t),r=structuredClone(f.report);r.observations.dom.evidence='../outside.txt';assert.throws(()=>review.record(f.directory,r,f.lib),/QA|path/);
+ const link=path.join(f.directory,'qa/link.txt');fs.symlinkSync(path.join(f.directory,f.report.observations.dom.evidence),link);r.observations.dom.evidence='qa/link.txt';assert.throws(()=>review.record(f.directory,r,f.lib),/symlink/);
+});

package/scripts/ui-prototype-execution-evidence-test.js

@@ -0,0 +1,62 @@
+'use strict';
+const prototypeScripts=(()=>{const fs=require('node:fs'),path=require('node:path'),file=path.join(__dirname,'lib/installation.js');return path.join(fs.existsSync(file)?require(file).loadInstallation().skillsDirectory:path.resolve(__dirname,'../skills'),'i3-ui-prototype/scripts');})();
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const E = require(prototypeScripts+'/execution-evidence.cjs');
+const use = (id, name, input) => ({ type: 'assistant', message: { role: 'assistant', content: [{ type: 'tool_use', id, name, input }] } });
+const result = (id, content, is_error = false) => ({ type: 'user', message: { role: 'user', content: [{ type: 'tool_result', tool_use_id: id, content, is_error }] } });
+const raw = rows => rows.map(row => JSON.stringify(row)).join('\n') + '\n';
+test('paired native results distinguish loaded skills from attempts and failures', () => {
+  const stream = raw([use('f1', 'Skill', { skill: 'i3-frontend-ui-engineering' }), result('f1', 'Full skill instructions'),
+    use('f2', 'Skill', { skill: 'antdv' }), result('f2', 'Not available', true), use('f3', 'Skill', { skill: 'ui-ux-pro-max' })]);
+  const calls = E.parse(stream);
+  assert.equal(calls[0].skill, 'frontend'); assert.equal(calls[0].success, true);
+  assert.equal(calls[1].success, false); assert.equal(calls[2].success, false);
+  assert.equal(E.loaded(calls, 'frontend').length, 1); assert.equal(E.loaded(calls, 'antdv').length, 0);
+});
+test('Read, forged names, zero-exit errors and duplicate IDs do not become valid skill loads', () => {
+  const calls = E.parse(raw([use('r1', 'Read', { file_path: 'SKILL.md' }), result('r1', 'instructions'),
+    use('b1', 'Bash', { command: 'node antdv info' }), result('b1', JSON.stringify({ exitCode: 0, stdout: 'Error: missing knowledge' }))]));
+  assert.equal(E.loaded(calls, 'frontend').length, 0); assert.equal(calls[1].success, false);
+  assert.throws(() => E.parse(raw([use('a', 'Skill', { skill: 'antdv' }), use('a', 'Skill', { skill: 'antdv' })])), /Duplicate/);
+  assert.throws(() => E.parse(raw([result('unknown', 'success')])), /unmatched|Unmatched/);
+});
+test('evidence references must resolve to the actual response and retain original order', () => {
+  const calls = E.parse(raw([use('a', 'Skill', { skill: 'antdv' }), result('a', 'official skill'), use('b', 'Bash', { command: 'node cli info Drawer' }), result('b', 'Drawer API') ]));
+  assert.equal(E.reference(calls, { toolCallId: 'b', resultDigest: calls[1].resultDigest }).name, 'Bash');
+  assert.throws(() => E.reference(calls, { toolCallId: 'b', resultDigest: '0'.repeat(64) }), /digest/);
+  assert.throws(() => E.reference(calls, { toolCallId: 'not-real' }), /missing/);
+  assert.ok(calls[0].resultLine < calls[1].requestLine);
+});
+test('malformed streams and model-written audit JSON are not accepted as native transcripts', () => {
+  assert.throws(() => E.parse('{broken\n'), /JSON/);
+  assert.throws(() => E.parse(JSON.stringify({ skill: 'frontend', used: true, passed: true })), /native|Native/);
+});
+// Structure captured from a real CodeBuddy Code 2.169.0 installation smoke run.
+// Skill instruction bodies are replaced; identities, pairing and status remain.
+const modern = (id='native-1', status='completed') => [
+  {type:'message',role:'user',sessionId:'session-169',content:[{type:'input_text',text:'请验收安装并加载前端 Skill'}]},
+  {type:'function_call',name:'Skill',callId:id,arguments:'{"skill":"i3-frontend-ui-engineering"}',sessionId:'session-169',message:{usage:{}}},
+  {type:'function_call_result',name:'Skill',callId:id,status,output:{type:'text',text:'Full frontend Skill instructions'},sessionId:'session-169'},
+  {type:'message',role:'assistant',sessionId:'session-169',content:[{type:'output_text',text:'安装检查已完成'}]},
+];
+test('CodeBuddy 2.169 flat messages and function calls retain native ordering and session evidence', () => {
+  const text=raw(modern()),calls=E.parse(text),description=E.describe(text);
+  assert.equal(E.loaded(calls,'frontend').length,1);
+  assert.equal(calls[0].sessionId,'session-169');
+  assert.equal(calls[0].requestLine,2);assert.equal(calls[0].resultLine,3);
+  assert.equal(description.prompts[0].text,'请验收安装并加载前端 Skill');
+  assert.equal(description.latestAssistant,'安装检查已完成');
+});
+test('flat failed, pending, empty and Read results cannot satisfy a frontend Skill gate', () => {
+  for(const status of ['failed','pending','cancelled'])assert.equal(E.loaded(E.parse(raw(modern('a',status))),'frontend').length,0);
+  const empty=modern();empty[2].output.text='';assert.equal(E.loaded(E.parse(raw(empty)),'frontend').length,0);
+  const read=modern();read[1].name=read[2].name='Read';read[1].arguments='{"file_path":"SKILL.md"}';
+  assert.equal(E.loaded(E.parse(raw(read)),'frontend').length,0);
+});
+test('flat native calls reject mismatched identity, malformed arguments and cross-session results', () => {
+  const wrong=modern();wrong[2].name='Read';assert.throws(()=>E.parse(raw(wrong)),/name|identity/i);
+  const bad=modern();bad[1].arguments='{broken';assert.throws(()=>E.parse(raw(bad)),/argument|JSON/i);
+  const session=modern();session[2].sessionId='other';assert.throws(()=>E.parse(raw(session)),/session/i);
+  const duplicate=modern();duplicate.splice(2,0,duplicate[1]);assert.throws(()=>E.parse(raw(duplicate)),/Duplicate/);
+});