@givolt/i3-composer-agent 2.3.1 → 2.3.3

package/scripts/ui-prototype-template-test.js

@@ -0,0 +1,261 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const legacyFixture = require('./lib/prototype-fixture.cjs');
+const installationFile = path.join(__dirname, 'lib/installation.js');
+const skillsDirectory = fs.existsSync(installationFile) ? require(installationFile).loadInstallation().skillsDirectory : path.resolve(__dirname, '../skills');
+const contract = require(path.join(skillsDirectory, 'i3-ui-prototype/scripts/template-contract.cjs'));
+
+function fixture(t) {
+  const project = fs.mkdtempSync(path.join(os.tmpdir(), 'i3-ui-template-'));
+  t.after(() => fs.rmSync(project, { recursive: true, force: true }));
+  return legacyFixture.prepareTemplate(contract, { project });
+}
+function edit(directory, change) {
+  const file = path.join(directory, 'index.html');
+  fs.writeFileSync(file, change(fs.readFileSync(file, 'utf8')));
+}
+function parameters(index) {
+  return { definition: index.definition, bindings: index.bindings, regions: index.regions, scope: { requirements: [], exemptions: [] }, decisions: [] };
+}
+test('theme remains optional and its explicit preset binding rejects invalid defaults and identifiers', t => {
+  const { directory, index }=fixture(t);
+  assert.equal(index.bindings.some(binding=>binding.capabilityId==='theme'),false);
+  edit(directory,html=>html.replace(/<!-- OPTIONAL_FOUR_THEMES:[\s\S]*?(<aside[\s\S]*?<\/aside>)\s*-->/,'$1'));
+  const themed=contract.syncTemplate(directory);
+  assert.equal(themed.bindings.filter(binding=>binding.capabilityId==='theme').length,1,'Uncommenting the shipped opt-in snippet must create exactly one binding');
+  assert.equal(contract.projectAdminListContent(contract.loadTemplate(directory)).pageTitle,'设备管理','The opt-in preserves normal HTML content projection');
+  const source={type:'user',reference:'theme-request',statement:'明亮、暗黑、清新、科技，默认明亮'};
+  const inputs=parameters(themed);inputs.scope.requirements=[{id:'THEME-1',text:source.statement,source,capabilities:[{pageId:'devices',regionId:'device-list',capabilityId:'theme'}]}];
+  assert.equal(contract.checkCapabilities(inputs).status,'passed');
+  assert.equal(contract.checkCapabilities(inputs).requiredScenarios.filter(s=>s.id.includes('/theme/')).length,3);
+  for(const values of [{},{defaultTheme:'dark',presets:['light','dark','fresh','tech']},{defaultTheme:'light',presets:['light','dark','fresh',4]},{defaultTheme:'light',presets:['light','dark','fresh','fresh']}]){
+    const broken=structuredClone(inputs);broken.bindings.find(binding=>binding.capabilityId==='theme').parameters=values;
+    assert.equal(contract.checkCapabilities(broken).status,'failed',JSON.stringify(values));
+  }
+});
+test('an enabled theme cannot exempt its required acceptance while retaining the binding', t => {
+  const {directory}=fixture(t);
+  edit(directory,html=>html.replace('<nav class="pagination"',`<aside data-capability-id="theme" data-capability-parameters='{"defaultTheme":"light","presets":["light","dark","fresh","tech"]}'>可选主题</aside><nav class="pagination"`));
+  const index=contract.syncTemplate(directory),fixed=parameters(index),binding=fixed.bindings.find(item=>item.capabilityId==='theme');
+  const scope={requirements:[{id:'THEME-1',text:'四主题',source:{type:'user',reference:'theme-request',statement:'明亮、暗黑、清新、科技'},capabilities:[binding]}],exemptions:[]};
+  const inputRoot=path.join(directory,'fixed-inputs');fs.mkdirSync(inputRoot);
+  const save=()=>{fs.writeFileSync(path.join(inputRoot,'capabilities.json'),JSON.stringify(fixed));fs.writeFileSync(path.join(inputRoot,'scope.json'),JSON.stringify(scope));};
+  save();assert.equal(contract.checkInstanceCapabilities(inputRoot).status,'passed');
+  fixed.decisions=[{bindingId:binding.id,status:'not-applicable',requirementId:'THEME-1'}];
+  scope.exemptions=[{...binding,requirementId:'THEME-1',reason:'Trying to waive acceptance without removing the enabled theme'}];
+  save();const checked=contract.checkInstanceCapabilities(inputRoot);
+  assert.equal(checked.status,'failed');assert.match(checked.errors.join(';'),/enabled theme.*acceptance|主题.*验收/i);
+});
+
+test('pagination supports an explicit adjustable contract without reinterpreting fixedPageSize', t => {
+  const { directory, index } = fixture(t);
+  const legacy = parameters(index);
+  assert.equal(contract.checkCapabilities(legacy).status, 'passed');
+  edit(directory, html => html.replace('"fixedPageSize":10,"minimumTestPages":3', '"mode":"adjustable","defaultPageSize":10,"pageSizeOptions":[10,20,50],"minimumTestPages":3'));
+  const synced = contract.syncTemplate(directory);
+  const binding = synced.bindings.find(entry => entry.capabilityId === 'pagination');
+  assert.deepEqual(binding.parameters, { mode: 'adjustable', defaultPageSize: 10, pageSizeOptions: [10,20,50], minimumTestPages: 3 });
+  assert.equal(contract.checkCapabilities(parameters(synced)).status, 'passed');
+  assert.equal(contract.checkCapabilities(legacy).status, 'passed', 'an existing fixed snapshot remains valid');
+  const oldSnapshot = structuredClone(legacy);
+  const oldPagination = oldSnapshot.definition.capabilities.find(item => item.id === 'pagination');
+  oldSnapshot.definition.version = '1.0.0';
+  oldPagination.parameters = { fixedPageSize: { type: 'integer', required: true, minimum: 1 }, minimumTestPages: { type: 'integer', required: true, minimum: 3 } };
+  assert.equal(contract.checkCapabilities(oldSnapshot).status, 'passed', 'the old fixed-only definition remains independently valid');
+});
+
+test('pagination rejects ambiguous modes and malformed adjustable defaults or options', t => {
+  const { index } = fixture(t);
+  const cases = [
+    { mode: 'automatic', fixedPageSize: 10 },
+    { mode: 10, fixedPageSize: 10 },
+    { mode: 'fixed' },
+    { mode: 'fixed', fixedPageSize: 10, pageSizeOptions: [10,20,50] },
+    { mode: 'fixed', fixedPageSize: 10, defaultPageSize: 10 },
+    { mode: 'adjustable', fixedPageSize: 10, defaultPageSize: 10, pageSizeOptions: [10,20,50] },
+    { mode: 'adjustable', pageSizeOptions: [10,20,50] },
+    { mode: 'adjustable', defaultPageSize: 10 },
+    { mode: 'adjustable', defaultPageSize: 10, pageSizeOptions: [20,50] },
+    { mode: 'adjustable', defaultPageSize: 10, pageSizeOptions: [10,10,50] },
+    { mode: 'adjustable', defaultPageSize: 10, pageSizeOptions: [10,'20',50] },
+    { mode: 'adjustable', defaultPageSize: 10, pageSizeOptions: [10,0,50] },
+    { mode: 'adjustable', defaultPageSize: 10, pageSizeOptions: [10,20.5,50] },
+    { mode: 'adjustable', defaultPageSize: 0, pageSizeOptions: [0,20,50] },
+    { mode: 'adjustable', defaultPageSize: '10', pageSizeOptions: [10,20,50] },
+    { mode: 'adjustable', defaultPageSize: 10, pageSizeOptions: [10] },
+  ];
+  for (const value of cases) {
+    const inputs = parameters(structuredClone(index));
+    inputs.bindings.find(binding => binding.capabilityId === 'pagination').parameters = { ...value, minimumTestPages: 3 };
+    const checked = contract.checkCapabilities(inputs);
+    assert.equal(checked.status, 'failed', JSON.stringify(value));
+    assert.ok(checked.errors.some(error => /pagination/.test(error)));
+  }
+});
+
+test('user owns an offline editable copy and preparing again never overwrites it', t => {
+  const { directory, index, created } = fixture(t);
+  assert.equal(created, true);
+  assert.equal(index.templateId, 'admin-list');
+  assert.equal(contract.loadTemplate(directory).index.digest, index.digest);
+  edit(directory, html => html.replace('设备管理', '客户设备管理'));
+  contract.syncTemplate(directory);
+  const again = legacyFixture.prepareTemplate(contract, { project: path.resolve(directory, '../..') });
+  assert.equal(again.created, false);
+  assert.match(fs.readFileSync(path.join(directory, 'index.html'), 'utf8'), /客户设备管理/);
+  const html = fs.readFileSync(path.join(directory, 'index.html'), 'utf8');
+  assert.doesNotMatch(html, /<script[^>]+type=["']module|(?:src|href)=["'](?:https?:|\/\/)/i);
+  assert.doesNotMatch(fs.readFileSync(path.join(directory, 'assets/reference.js'), 'utf8'), /\bfetch\s*\(|\bimport\s/);
+});
+
+test('template or asset edits invalidate index, and synchronization is deterministic', t => {
+  const { directory, index } = fixture(t);
+  edit(directory, html => html.replace('设备管理', '新设备清单'));
+  assert.throws(() => contract.loadTemplate(directory), /stale|不同步/);
+  const readonly = contract.syncTemplate(directory, { write: false });
+  assert.notEqual(readonly.digest, index.digest);
+  assert.throws(() => contract.loadTemplate(directory), /stale|不同步/);
+  const updated = contract.syncTemplate(directory);
+  assert.equal(updated.digest, contract.syncTemplate(directory, { write: false }).digest);
+  fs.appendFileSync(path.join(directory, 'assets/reference.css'), '\n/* user style */');
+  assert.throws(() => contract.loadTemplate(directory), /stale|不同步/);
+  contract.syncTemplate(directory);
+  assert.ok(contract.loadTemplate(directory).files.every(file => file.encoding === 'base64'));
+});
+
+test('deleted pagination is detected from region mode even when its binding is deleted', t => {
+  const { index } = fixture(t);
+  const inputs = parameters(index);
+  inputs.bindings = inputs.bindings.filter(binding => binding.capabilityId !== 'pagination');
+  const result = contract.checkCapabilities(inputs);
+  assert.equal(result.status, 'failed');
+  assert.ok(result.errors.some(error => error.includes('pagination')));
+});
+
+test('required capability cannot be waived by an unsupported N/A or pending decision', t => {
+  const { index } = fixture(t);
+  const inputs = parameters(index);
+  const binding = index.bindings.find(entry => entry.capabilityId === 'pagination');
+  inputs.decisions = [{ bindingId: binding.id, status: 'not-applicable', reason: 'Prototype only' }];
+  assert.equal(contract.checkCapabilities(inputs).status, 'failed');
+  inputs.decisions[0].status = 'pending';
+  assert.equal(contract.checkCapabilities(inputs).status, 'failed');
+  inputs.decisions[0].status = 'not-applicable';
+  inputs.scope = {
+    requirements: [{ id: 'SCOPE-1', text: 'The user explicitly excluded pagination for this area', source: { type: 'scope-change', reference: 'user-message-12', statement: 'This area contains exactly one fixed record; omit paging.' } }],
+    exemptions: [{ pageId: binding.pageId, regionId: binding.regionId, capabilityId: 'pagination', requirementId: 'SCOPE-1', reason: 'Explicit scope change' }],
+  };
+  inputs.decisions[0].requirementId = 'SCOPE-1';
+  const result = contract.checkCapabilities(inputs);
+  assert.equal(result.status, 'passed', result.errors.join('\n'));
+  assert.ok(!result.requiredBindings.includes(binding.id));
+});
+
+test('each region needs its own capabilities and scenarios', t => {
+  const { index } = fixture(t);
+  const inputs = parameters(index);
+  const original = inputs.regions.find(region => region.mode === 'management-list');
+  inputs.regions.push({ ...original, id: 'second-list' });
+  const result = contract.checkCapabilities(inputs);
+  assert.equal(result.status, 'failed');
+  assert.ok(result.errors.some(error => error.includes('second-list/pagination')));
+});
+
+test('duplicate identity, unknown capability and unbound controls block sync without changing old index', t => {
+  const { directory } = fixture(t);
+  const initial = fs.readFileSync(path.join(directory, 'index.html'), 'utf8');
+  const indexBefore = fs.readFileSync(path.join(directory, 'capabilities.generated.json'), 'utf8');
+  for (const invalid of [
+    initial.replace('</main>', '<section data-page-id="devices"></section></main>'),
+    initial.replace('data-capability-id="pagination"', 'data-capability-id="unknown-widget"'),
+    initial.replace('</main>', '<button>Unmapped action</button></main>'),
+  ]) {
+    fs.writeFileSync(path.join(directory, 'index.html'), invalid);
+    assert.throws(() => contract.syncTemplate(directory), /identity|capability|interaction|身份|能力|交互/);
+    assert.equal(fs.readFileSync(path.join(directory, 'capabilities.generated.json'), 'utf8'), indexBefore);
+  }
+});
+
+test('missing behavior parameters and manually edited index are rejected', t => {
+  const { directory } = fixture(t);
+  const inputs = parameters(contract.loadTemplate(directory).index);
+  inputs.bindings.find(binding => binding.capabilityId === 'selection').parameters = {};
+  assert.equal(contract.checkCapabilities(inputs).status, 'failed');
+  const file = path.join(directory, 'capabilities.generated.json');
+  const edited = JSON.parse(fs.readFileSync(file, 'utf8'));
+  edited.bindings = edited.bindings.filter(binding => binding.capabilityId !== 'pagination');
+  fs.writeFileSync(file, JSON.stringify(edited));
+  assert.throws(() => contract.loadTemplate(directory), /stale|不同步/);
+});
+
+test('a frozen input snapshot is checked independently of current built-ins', t => {
+  const { directory, index } = fixture(t);
+  const inputRoot = path.join(directory, 'fixed-inputs');
+  fs.mkdirSync(inputRoot);
+  fs.writeFileSync(path.join(inputRoot, 'capabilities.json'), JSON.stringify(parameters(index)));
+  fs.writeFileSync(path.join(inputRoot, 'scope.json'), JSON.stringify({ requirements: [], exemptions: [] }));
+  assert.equal(contract.checkInstanceCapabilities(inputRoot).status, 'passed');
+  const frozen = JSON.parse(fs.readFileSync(path.join(inputRoot, 'capabilities.json'), 'utf8'));
+  frozen.bindings = frozen.bindings.filter(binding => binding.capabilityId !== 'pagination');
+  fs.writeFileSync(path.join(inputRoot, 'capabilities.json'), JSON.stringify(frozen));
+  assert.equal(contract.checkInstanceCapabilities(inputRoot).status, 'failed');
+});
+
+test('frozen template regions cannot disappear or change mode in the instance contract', t => {
+  const { directory } = fixture(t);
+  const snapshot = contract.loadTemplate(directory);
+  const inputRoot = path.join(directory, 'fixed-inputs');
+  fs.mkdirSync(inputRoot);
+  fs.writeFileSync(path.join(inputRoot, 'template-snapshot.json'), JSON.stringify(snapshot));
+  const fixed = parameters(snapshot.index);
+  fixed.regions = fixed.regions.filter(region => region.mode !== 'management-list');
+  fixed.bindings = fixed.bindings.filter(binding => binding.regionId !== 'device-list');
+  fs.writeFileSync(path.join(inputRoot, 'capabilities.json'), JSON.stringify(fixed));
+  assert.equal(contract.checkInstanceCapabilities(inputRoot).status, 'failed');
+});
+
+test('remote resources, module scripts and async loads cannot become offline templates', t => {
+  const { directory } = fixture(t);
+  const html = fs.readFileSync(path.join(directory, 'index.html'), 'utf8');
+  for (const invalid of [html.replace('src="assets/reference.js"', 'src="https://example.test/reference.js"'), html.replace('<script src=', '<script type="module" src=')]) {
+    fs.writeFileSync(path.join(directory, 'index.html'), invalid);
+    assert.throws(() => contract.syncTemplate(directory), /offline|离线/);
+  }
+  fs.writeFileSync(path.join(directory, 'index.html'), html);
+  fs.appendFileSync(path.join(directory, 'assets/reference.js'), '\nfetch("parts/table.html")');
+  assert.throws(() => contract.syncTemplate(directory), /offline|离线/);
+});
+
+test('unsafe identifiers and symlinked user template directories never write outside project', t => {
+  const project = fs.mkdtempSync(path.join(os.tmpdir(), 'i3-ui-template-path-'));
+  const other = fs.mkdtempSync(path.join(os.tmpdir(), 'i3-ui-template-other-'));
+  t.after(() => { fs.rmSync(project, { recursive: true, force: true }); fs.rmSync(other, { recursive: true, force: true }); });
+  assert.throws(() => legacyFixture.prepareTemplate(contract, { project, id: '../escape' }), /identifier|标识/);
+  fs.symlinkSync(other, path.join(project, 'ui-templates'), 'dir');
+  assert.throws(() => legacyFixture.prepareTemplate(contract, { project }), /symlink|符号链接/);
+  assert.deepEqual(fs.readdirSync(other), []);
+});
+
+test('content extraction reads visible headings, labels and button text with stable identities', t => {
+  const { directory }=fixture(t);
+  edit(directory,html=>html
+    .replace('<h1>设备管理</h1>','<h1>资产 &amp; 设备</h1>')
+    .replace('data-field-id="device-name">设备名称','data-field-id="device-name">设备显示名称')
+    .replace('设备名称 <span aria-label="必填">*','资产名称 <span aria-label="必填">*')
+    .replace('data-action-id="query" type="button">查询','data-action-id="query" type="button"><strong>检索设备</strong>'));
+  const index=contract.syncTemplate(directory);
+  assert.equal(index.pages[0].title,'资产 & 设备');
+  assert.equal(index.fields.find(item=>item.localId==='device-name').label,'设备显示名称');
+  assert.equal(index.fields.find(item=>item.localId==='edit-name').label,'资产名称');
+  assert.equal(index.fields.find(item=>item.localId==='query-status').label,'设备状态');
+  assert.equal(index.actions.find(item=>item.localId==='query').label,'检索设备');
+  const projected=contract.projectAdminListContent(contract.loadTemplate(directory));
+  assert.equal(projected.pageTitle,'资产 & 设备');
+  assert.equal(projected.fields.name.label,'设备显示名称');
+  assert.equal(projected.fields.editName.label,'资产名称');
+  assert.equal(projected.actions.query,'检索设备');
+});

package/scripts/ui-prototype-test.js

@@ -112,3 +112,13 @@ test('unsafe identifiers and symlinked output parents are rejected before writes
   assert.throws(() => lib.initPrototype({ project, id: 'safe', expertMode: 'template' }), /symlink|符号链接/);
   assert.deepEqual(fs.readdirSync(elsewhere), []);
 });
+test('a real review can reject every recommendation without inventing adoption at freeze', t => {
+  const dir=fixture(t); const metadata=json(dir,'prototype.json');
+  metadata.expertMode='professional'; metadata.expert={status:'reviewed'}; write(dir,'prototype.json',metadata);
+  write(dir,'qa/design-advice.json',{schemaVersion:1,mode:'professional',provider:{digest:'a'.repeat(64)},records:[{decision:'rejected',query:'targeted UX review',resultIdentity:'unit-fixture-result',rationale:'Fixture is intentionally incompatible with locked design',verification:'Reviewed against fixture contract'}]});
+  browserEvidence(dir);
+  const current=lib.contentManifest(dir);
+  assert.equal(lib.checkPrototype(dir,{acceptance:true}).status,'passed');
+  lib.freezeBaseline(dir,{revision:current.revision,digest:current.digest,reviewer:'Fixture reviewer',statement:'Isolated guard test only',source:'unit-test-fixture'});
+  assert.equal(json(dir,'prototype.json').expert.status,'reviewed');
+});

package/scripts/ui-prototype-transcript-auto-test.js

@@ -0,0 +1,67 @@
+'use strict';
+// Synthetic files and in-memory configuration only; never installs or launches a host.
+const fs=require('node:fs'),path=require('node:path'),os=require('node:os'),test=require('node:test'),assert=require('node:assert/strict');
+const prototypeScripts=(()=>{const file=path.join(__dirname,'lib/installation.js');return path.join(fs.existsSync(file)?require(file).loadInstallation().skillsDirectory:path.resolve(__dirname,'../skills'),'i3-ui-prototype/scripts');})();
+const E=require(prototypeScripts+'/execution-evidence.cjs'),C=require(prototypeScripts+'/codebuddy-context.cjs'),R=require(prototypeScripts+'/codebuddy-registration.cjs');
+function fixture(t) {
+ const root=fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(),'i3-transcript-contract-'))),project=path.join(root,'business'),native=path.join(root,'native');
+ fs.mkdirSync(project);fs.mkdirSync(native);t.after(()=>fs.rmSync(root,{recursive:true,force:true}));
+ const rows=[{type:'user',sessionId:'session-a',message:{content:'生成当前原型'}},{type:'assistant',sessionId:'session-a',message:{content:[{type:'tool_use',id:'front-1',name:'Skill',input:{skill:'i3-frontend-ui-engineering'}}]}},{type:'user',sessionId:'session-a',message:{content:[{type:'tool_result',tool_use_id:'front-1',content:'Native fixture instructions'}]}}];
+ const file=path.join(native,'session.txt');fs.writeFileSync(file,rows.map(JSON.stringify).join('\n')+'\n');return {root,project,native,file,rows};
+}
+test('new IDE and CLI registrations default to automatic transcripts in both scopes',()=>{
+ for(const product of ['ide','cli'])for(const scope of ['project','global']) {
+  const base=scope==='project'?'/work/p/.codebuddy':'/users/u/.codebuddy';
+  const change=R.plan({action:'enable',product,scope,base,project:'/work/p',nodePath:'/node',scriptPath:base+'/hooks/i3-prototype.cjs',scriptDigest:'a'.repeat(64)});
+  assert.equal(change.recordAfter.transcriptMode,'auto');assert.deepEqual(change.recordAfter.transcriptRoots,[]);
+ }
+});
+test('manual and legacy root restrictions are retained; empty manual policy is rejected',()=>{
+ const options={action:'enable',product:'ide',scope:'project',base:'/work/p/.codebuddy',project:'/work/p',nodePath:'/node',scriptPath:'/fixed/hook.cjs',scriptDigest:'a'.repeat(64),transcriptRoots:['/native/logs']};
+ const first=R.plan(options);assert.equal(first.recordAfter.transcriptMode,'manual');
+ const legacy=structuredClone(first.recordAfter);delete legacy.transcriptMode;
+ const kept=R.plan({...options,action:'keep',transcriptRoots:undefined,currentText:first.afterText,record:legacy});
+ assert.equal(kept.recordAfter.transcriptMode,'manual');assert.deepEqual(kept.recordAfter.transcriptRoots,['/native/logs']);
+ assert.throws(()=>R.plan({...options,transcriptMode:'manual',transcriptRoots:[]}),/manual|roots/i);
+});
+test('automatic source uses the exact callback file regardless of filename suffix',t=>{
+ const f=fixture(t),payload={transcript_path:f.file,session_id:'session-a'};
+ const source=C.source(payload,{transcriptMode:'auto',transcriptRoots:[]},f.project);
+ assert.equal(source.path,f.file);assert.equal(E.loaded(source.calls,'frontend').length,1);assert.equal(source.tamperProof,false);
+ assert.equal(source.sourceVerification,'native-hook-transcript');
+});
+test('automatic discovery never admits business files, leaf symlinks or missing files',t=>{
+ const f=fixture(t),record={transcriptMode:'auto',transcriptRoots:[]},load=file=>C.source({transcript_path:file,session_id:'session-a'},record,f.project);
+ const fake=path.join(f.project,'qa.jsonl');fs.copyFileSync(f.file,fake);assert.throws(()=>load(fake),/business project/i);
+ const alias=path.join(f.native,'alias.jsonl');fs.symlinkSync(f.file,alias);assert.throws(()=>load(alias),/symlink|native transcript/i);
+ assert.throws(()=>load(path.join(f.native,'missing.jsonl')),/not.*available|ENOENT/i);
+ assert.throws(()=>load('relative.jsonl'),/absolute|native transcript/i);
+});
+test('automatic source still rejects malformed streams, forged declarations and mismatched sessions',t=>{
+ const f=fixture(t),record={transcriptMode:'auto',transcriptRoots:[]},payload={transcript_path:f.file,session_id:'different'};
+ assert.throws(()=>C.source(payload,record,f.project),/session/i);
+ payload.session_id='session-a';
+ for(const content of ['plain transcript text','{"skill":"frontend","passed":true}\n','{"type":"assistant","message":{"content":[]}}\n']) {
+  fs.writeFileSync(f.file,content);assert.throws(()=>C.source(payload,record,f.project),/JSONL|native|Native|user task/);
+ }
+});
+test('manual roots remain enforced even when a valid callback points elsewhere',t=>{
+ const f=fixture(t),record={transcriptMode:'manual',transcriptRoots:[path.join(f.root,'other')]};
+ assert.throws(()=>C.source({transcript_path:f.file,session_id:'session-a'},record,f.project),/outside.*roots/);
+ record.transcriptRoots=[f.native];assert.equal(C.source({transcript_path:f.file,session_id:'session-a'},record,f.project).path,f.file);
+});
+test('automatic reading refuses oversized native files without parsing their contents',t=>{
+ const f=fixture(t);fs.truncateSync(f.file,64*1024*1024+1);
+ assert.throws(()=>C.source({transcript_path:f.file,session_id:'session-a'},{transcriptMode:'auto',transcriptRoots:[]},f.project),/oversized|native transcript/i);
+});
+test('unreadable native transcripts cannot become valid evidence',t=>{
+ const f=fixture(t);fs.chmodSync(f.file,0);
+ try{assert.throws(()=>C.source({transcript_path:f.file,session_id:'session-a'},{transcriptMode:'auto',transcriptRoots:[]},f.project),/EACCES|EPERM/);}
+ finally{fs.chmodSync(f.file,0o600);}
+});
+test('missing callback identity and contradictory policy cannot fall back to another log',t=>{
+ const f=fixture(t),record={transcriptMode:'auto',transcriptRoots:[]};
+ assert.throws(()=>C.source({session_id:'session-a'},record,f.project),/fields required/);
+ assert.throws(()=>C.source({transcript_path:f.file},record,f.project),/fields required/);
+ assert.throws(()=>C.source({transcript_path:f.file,session_id:'session-a'},{...record,transcriptRoots:[f.native]},f.project),/manual roots/);
+});

package/skills/i3-frontend-ui-engineering/SKILL.md

@@ -31,7 +31,7 @@ Build production-quality user interfaces that are accessible, performant, and vi
 
 ## Applicable Prototype Baselines
 
-When the project has `.i3-ui-prototypes.json`, read the prototype entry applicable to the UI module being changed, then its `baseline.json`, `design-system/MASTER.md`, tokens and page rules. Preserve approved design and interaction decisions; explain conflicts with new requirements instead of silently changing them. New pages reuse the selected template and component conventions. Changes to global tokens, navigation, component behavior or business states go through the `i3-ui-prototype` workflow and corresponding review. HTML review prototypes need explicit component mapping when implemented in another framework. Verify affected production pages in the browser; a prototype manifest check alone does not prove production fidelity. Projects without an applicable baseline retain this skill's existing workflow.
+Read the project prototype index at `prototypes/index.json`, falling back to legacy `.i3-ui-prototypes.json` when no new index exists. Select the entry whose `appliesTo` contains the explicit business module ID; an empty array applies to no module, and conflicting indices or multiple matches require resolution before selecting a baseline. New associations are derived from fixed scope.moduleIds by `i3-ui-prototype`, not inferred from a PRD filename. Then read its `baseline.json`, `design-system/MASTER.md`, tokens and page rules. Preserve approved design and interaction decisions; explain conflicts with new requirements instead of silently changing them. New pages reuse the selected template and component conventions. Changes to global tokens, navigation, component behavior or business states go through the `i3-ui-prototype` workflow and corresponding review. HTML review prototypes need explicit component mapping when implemented in another framework. Verify affected production pages in the browser; a prototype manifest check alone does not prove production fidelity. Projects without an applicable baseline retain this skill's existing workflow.
 
 ## Component Architecture
 

package/skills/i3-incremental-implementation/SKILL.md

@@ -194,7 +194,7 @@ Each increment should be independently revertable:
 
 ## UI Slices with Prototype Baselines
 
-For a UI slice, check `.i3-ui-prototypes.json` for an applicable approved prototype. Read its design contract, business mapping and baseline before implementation, and include affected interaction/visual checks in the slice acceptance. Preserve prior snapshots; coordinate contract changes through `i3-ui-prototype`. Backend-only slices and projects without a baseline continue the existing increment workflow.
+For a UI slice, check `prototypes/index.json` (legacy `.i3-ui-prototypes.json` fallback) for an applicable approved prototype. Match explicit module IDs against appliesTo; an empty array is unbound. Resolve conflicting indices or multiple matches instead of applying a prototype globally. New appliesTo values come from fixed scope.moduleIds through `i3-ui-prototype`. Read its design contract, business mapping and baseline before implementation, and include affected interaction/visual checks in the slice acceptance. Preserve prior snapshots; coordinate contract changes through `i3-ui-prototype`. Backend-only slices and projects without a baseline continue the existing increment workflow.
 
 ## Working with Agents