@givolt/i3-composer-agent 2.3.2 → 2.3.4

package/scripts/ui-prototype-execution-evidence-test.js

@@ -0,0 +1,62 @@
+'use strict';
+const prototypeScripts=(()=>{const fs=require('node:fs'),path=require('node:path'),file=path.join(__dirname,'lib/installation.js');return path.join(fs.existsSync(file)?require(file).loadInstallation().skillsDirectory:path.resolve(__dirname,'../skills'),'i3-ui-prototype/scripts');})();
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const E = require(prototypeScripts+'/execution-evidence.cjs');
+const use = (id, name, input) => ({ type: 'assistant', message: { role: 'assistant', content: [{ type: 'tool_use', id, name, input }] } });
+const result = (id, content, is_error = false) => ({ type: 'user', message: { role: 'user', content: [{ type: 'tool_result', tool_use_id: id, content, is_error }] } });
+const raw = rows => rows.map(row => JSON.stringify(row)).join('\n') + '\n';
+test('paired native results distinguish loaded skills from attempts and failures', () => {
+  const stream = raw([use('f1', 'Skill', { skill: 'i3-frontend-ui-engineering' }), result('f1', 'Full skill instructions'),
+    use('f2', 'Skill', { skill: 'antdv' }), result('f2', 'Not available', true), use('f3', 'Skill', { skill: 'ui-ux-pro-max' })]);
+  const calls = E.parse(stream);
+  assert.equal(calls[0].skill, 'frontend'); assert.equal(calls[0].success, true);
+  assert.equal(calls[1].success, false); assert.equal(calls[2].success, false);
+  assert.equal(E.loaded(calls, 'frontend').length, 1); assert.equal(E.loaded(calls, 'antdv').length, 0);
+});
+test('Read, forged names, zero-exit errors and duplicate IDs do not become valid skill loads', () => {
+  const calls = E.parse(raw([use('r1', 'Read', { file_path: 'SKILL.md' }), result('r1', 'instructions'),
+    use('b1', 'Bash', { command: 'node antdv info' }), result('b1', JSON.stringify({ exitCode: 0, stdout: 'Error: missing knowledge' }))]));
+  assert.equal(E.loaded(calls, 'frontend').length, 0); assert.equal(calls[1].success, false);
+  assert.throws(() => E.parse(raw([use('a', 'Skill', { skill: 'antdv' }), use('a', 'Skill', { skill: 'antdv' })])), /Duplicate/);
+  assert.throws(() => E.parse(raw([result('unknown', 'success')])), /unmatched|Unmatched/);
+});
+test('evidence references must resolve to the actual response and retain original order', () => {
+  const calls = E.parse(raw([use('a', 'Skill', { skill: 'antdv' }), result('a', 'official skill'), use('b', 'Bash', { command: 'node cli info Drawer' }), result('b', 'Drawer API') ]));
+  assert.equal(E.reference(calls, { toolCallId: 'b', resultDigest: calls[1].resultDigest }).name, 'Bash');
+  assert.throws(() => E.reference(calls, { toolCallId: 'b', resultDigest: '0'.repeat(64) }), /digest/);
+  assert.throws(() => E.reference(calls, { toolCallId: 'not-real' }), /missing/);
+  assert.ok(calls[0].resultLine < calls[1].requestLine);
+});
+test('malformed streams and model-written audit JSON are not accepted as native transcripts', () => {
+  assert.throws(() => E.parse('{broken\n'), /JSON/);
+  assert.throws(() => E.parse(JSON.stringify({ skill: 'frontend', used: true, passed: true })), /native|Native/);
+});
+// Structure captured from a real CodeBuddy Code 2.169.0 installation smoke run.
+// Skill instruction bodies are replaced; identities, pairing and status remain.
+const modern = (id='native-1', status='completed') => [
+  {type:'message',role:'user',sessionId:'session-169',content:[{type:'input_text',text:'请验收安装并加载前端 Skill'}]},
+  {type:'function_call',name:'Skill',callId:id,arguments:'{"skill":"i3-frontend-ui-engineering"}',sessionId:'session-169',message:{usage:{}}},
+  {type:'function_call_result',name:'Skill',callId:id,status,output:{type:'text',text:'Full frontend Skill instructions'},sessionId:'session-169'},
+  {type:'message',role:'assistant',sessionId:'session-169',content:[{type:'output_text',text:'安装检查已完成'}]},
+];
+test('CodeBuddy 2.169 flat messages and function calls retain native ordering and session evidence', () => {
+  const text=raw(modern()),calls=E.parse(text),description=E.describe(text);
+  assert.equal(E.loaded(calls,'frontend').length,1);
+  assert.equal(calls[0].sessionId,'session-169');
+  assert.equal(calls[0].requestLine,2);assert.equal(calls[0].resultLine,3);
+  assert.equal(description.prompts[0].text,'请验收安装并加载前端 Skill');
+  assert.equal(description.latestAssistant,'安装检查已完成');
+});
+test('flat failed, pending, empty and Read results cannot satisfy a frontend Skill gate', () => {
+  for(const status of ['failed','pending','cancelled'])assert.equal(E.loaded(E.parse(raw(modern('a',status))),'frontend').length,0);
+  const empty=modern();empty[2].output.text='';assert.equal(E.loaded(E.parse(raw(empty)),'frontend').length,0);
+  const read=modern();read[1].name=read[2].name='Read';read[1].arguments='{"file_path":"SKILL.md"}';
+  assert.equal(E.loaded(E.parse(raw(read)),'frontend').length,0);
+});
+test('flat native calls reject mismatched identity, malformed arguments and cross-session results', () => {
+  const wrong=modern();wrong[2].name='Read';assert.throws(()=>E.parse(raw(wrong)),/name|identity/i);
+  const bad=modern();bad[1].arguments='{broken';assert.throws(()=>E.parse(raw(bad)),/argument|JSON/i);
+  const session=modern();session[2].sessionId='other';assert.throws(()=>E.parse(raw(session)),/session/i);
+  const duplicate=modern();duplicate.splice(2,0,duplicate[1]);assert.throws(()=>E.parse(raw(duplicate)),/Duplicate/);
+});

package/scripts/ui-prototype-execution-gates-test.js

@@ -0,0 +1,90 @@
+'use strict';
+const prototypeScripts=(()=>{const fs=require('node:fs'),path=require('node:path'),file=path.join(__dirname,'lib/installation.js');return path.join(fs.existsSync(file)?require(file).loadInstallation().skillsDirectory:path.resolve(__dirname,'../skills'),'i3-ui-prototype/scripts');})();
+const test=require('node:test'),assert=require('node:assert/strict');
+const P=require(prototypeScripts+'/execution-policy.cjs');
+const E=require(prototypeScripts+'/execution-evidence.cjs');
+const G=require(prototypeScripts+'/execution-gates.cjs');
+test('native UI writes resolve relative paths from the actual tool cwd',()=>{
+ assert.equal(G.uiWrite({name:'Write',cwd:'/work',input:{file_path:'prototypes/orders/app/src/Probe.vue'}},'/work/prototypes/orders'),true);
+ assert.equal(G.uiWrite({name:'Write',cwd:'/work/prototypes/orders/app',input:{file_path:'src/Probe.vue'}},'/work/prototypes/orders'),true);
+ assert.equal(G.uiWrite({name:'Write',cwd:'/work',input:{file_path:'other/app/src/Probe.vue'}},'/work/prototypes/orders'),false);
+ assert.equal(G.uiWrite({name:'Write',input:{filePath:'/work/prototypes/orders/app/src/Probe.vue'}},'/work/prototypes/orders'),true);
+});
+function fixture() {
+ const file='/work/prototypes/orders/app/src/Orders.vue',bytes='<Table />';
+ const call=(toolCallId,name,input,result,line,skill)=>({toolCallId,name,input,result,requestLine:line,resultLine:line+1,success:true,resultDigest:E.sha(result),sessionId:'s1',contextLine:0,skill});
+ const calls=[call('front','Skill',{},'frontend instructions',3,'frontend'),call('ant','Skill',{},'antdv instructions',5,'antdv'),call('query','Bash',{command:'antdv info Table'},'Table API: rowSelection',7),call('version','Read',{file_path:'/work/app/node_modules/antdv-next/package.json'},'{"version":"1.5.3"}',9),call('write','Write',{file_path:file},'saved',11)];
+ const policy=P.create({mode:'template'}),current={digest:'candidate',inputDigest:'input',revision:'r001'};
+ const binding={schemaVersion:1,runId:'r1',sessionId:'s1',projectKey:'p1',directory:'/work/prototypes/orders',instanceId:'instance',policyDigest:policy.digest,inputDigest:'input',entryLine:1};
+ const proof={schemaVersion:1,runId:'r1',sessionId:'s1',projectKey:'p1',policyDigest:policy.digest,candidateDigest:'candidate',inputDigest:'input',revision:'r001',frontend:{toolCallId:'front',files:[{path:'app/src/Orders.vue',sha256:E.sha(bytes)}],requirementIds:['R1']},official:{skill:{toolCallId:'ant'},version:{toolCallId:'version',quote:'"version":"1.5.3"'},queries:[{component:'Table',toolCallId:'query',quote:'Table API: rowSelection'}]},templateChoice:{quote:'template mode'}};
+ return {policy,current,binding,proof,source:{calls,contextLine:0,prompts:[{line:1,text:'generate prototype in template mode',digest:'prompt'}]},scope:{requirements:[{id:'R1'}]},files:{'app/src/Orders.vue':bytes},implementation:{bindings:[{status:'implemented',components:['Table'],files:[{path:'app/src/Orders.vue'}]}]},frameworkVersion:'1.5.3'};
+}
+test('a native frontend load is required before the first actual UI write in both modes',()=>{
+ const f=fixture();assert.equal(G.evaluate(f,'implementation').status,'passed');
+ f.source.calls[0].success=false;assert.equal(G.evaluate(f,'implementation').status,'failed');
+ f.source.calls[0].success=true;f.source.calls[0].resultLine=12;assert.match(G.evaluate(f,'implementation').errors.join(),/before/);
+});
+test('IDE relative write evidence uses its bound workspace while legacy evidence keeps its contract',()=>{
+ const f=fixture();f.source.format='codebuddy-ide-index-v1';f.binding.project='/work';f.source.calls.find(c=>c.name==='Write').input.file_path='prototypes/orders/app/src/Orders.vue';
+ assert.equal(G.evaluate(f,'implementation').status,'passed');
+});
+test('current context, task and artifact identities reject replay and changed inputs',()=>{
+ for(const mutate of [f=>f.proof.runId='other',f=>f.proof.inputDigest='old',f=>f.source.contextLine=10,f=>f.source.calls[0].sessionId='s2',f=>f.binding.entryLine=20]){const f=fixture();mutate(f);assert.equal(G.evaluate(f,'implementation').status,'failed');}
+});
+test('reading a skill, adapted metadata, or incomplete review mappings cannot pass',()=>{
+ const f=fixture();f.source.calls[0].skill=null;assert.equal(G.evaluate(f,'implementation').status,'failed');
+ const g=fixture();g.proof.frontend.files=[];assert.equal(G.evaluate(g,'implementation').status,'failed');
+ const h=fixture();h.proof.frontend.requirementIds=[];assert.equal(G.evaluate(h,'implementation').status,'failed');
+});
+test('new WorkBuddy implementation uses the shared design gate and rechecks recovery references',()=>{
+ const f=fixture();f.policy=P.create({id:P.AUTO_ID,host:'workbuddy',mode:'template'});
+ Object.assign(f.binding,{host:'workbuddy',identitySource:'native-client',policyDigest:f.policy.digest});f.proof.policyDigest=f.policy.digest;
+ assert.equal(G.evaluate(f,'implementation').status,'passed');
+ f.binding.recovery={status:'recovered',invocations:[{skill:'frontend',toolCallId:'front',resultDigest:f.source.calls[0].resultDigest,requestLine:3,resultLine:4,feedbackLine:1}],retry:{toolCallId:'write'}};
+ assert.equal(G.evaluate(f,'implementation').status,'passed');
+ f.binding.recovery.retry.toolCallId='invented';assert.equal(G.evaluate(f,'implementation').status,'failed');
+ delete f.binding.recovery;f.source.calls.find(call=>call.skill==='antdv').success=false;
+ assert.equal(G.evaluate(f,'implementation').status,'failed','Official loading cannot wait until finalization in the new policy');
+});
+function stageRecoveryFixture(){
+ const f=fixture(),result='native build succeeded';
+ f.source.calls.push({toolCallId:'retry-build',name:'Bash',input:{command:'node /skills/native-pilot.cjs build /work/prototypes/orders'},result,requestLine:13,resultLine:14,success:true,resultDigest:E.sha(result),sessionId:'s1'});
+ f.binding.recovery={status:'recovered',invocations:[],retry:{toolCallId:'retry-build',resultDigest:E.sha(result),kind:'stage',stage:'implementation',operation:'build',feedbackLine:12}};
+ return f;
+}
+test('the shared gate accepts an actual matching successful stage retry after recovery',()=>{
+ const f=stageRecoveryFixture();const result=G.evaluate(f,'implementation');assert.equal(result.status,'passed',result.errors?.join('; '));
+});
+test('stage recovery rejects a wrong operation, stage, root, unsafe command or failed native result',()=>{
+ for(const change of [f=>f.binding.recovery.retry.operation='finalize',f=>f.binding.recovery.retry.stage='delivery',f=>f.source.calls.at(-1).input.command='node /skills/native-pilot.cjs build /other/prototypes/orders',f=>f.source.calls.at(-1).input.command+='; echo fake',f=>f.source.calls.at(-1).success=false,f=>f.binding.recovery.retry.kind='ui-write',f=>f.binding.recovery.retry.feedbackLine=14]){
+  const f=stageRecoveryFixture();change(f);assert.equal(G.evaluate(f,'implementation').status,'failed');
+ }
+});
+test('official query references must be successful, relevant, and version checked',()=>{
+ const f=fixture();assert.equal(G.evaluate(f,'design').status,'passed');
+ f.proof.official.queries[0].quote='invented';assert.equal(G.evaluate(f,'design').status,'failed');
+ const g=fixture();g.source.calls[2].input.command='antdv probe';assert.equal(G.evaluate(g,'design').status,'failed');
+ const h=fixture();h.source.calls[3].result='{"version":"1.5.2"}';assert.equal(G.evaluate(h,'design').status,'failed');
+});
+test('professional requires actual UIUX execution; explicit template choice cannot be invented',()=>{
+ const f=fixture();f.policy=P.create({mode:'professional'});f.binding.policyDigest=f.proof.policyDigest=f.policy.digest;assert.match(G.evaluate(f,'design').errors.join(),/UIUX/);
+ const g=fixture();g.proof.templateChoice.quote='use template now';assert.equal(G.evaluate(g,'design').status,'failed');
+ const h=fixture();h.proof.templateChoice.quote='template';h.source.prompts[0].text='参考 template 制作专业增强原型';assert.equal(G.evaluate(h,'design').status,'failed');
+});
+test('missing current build, fake browser IDs, and self-written passed booleans cannot finish',()=>{
+ const f=fixture();f.proof.build={toolCallId:'query'};assert.equal(G.evaluate(f,'build').status,'failed');
+ f.proof.browser={passed:true};assert.equal(G.evaluate(f,'browser').status,'failed');assert.equal(G.evaluate(f,'delivery').status,'failed');
+});
+test('the shared gate can correlate a complete synthetic chain and rejects unrelated native facts',()=>{
+ const f=fixture(),call=(toolCallId,name,input,result,line,skill)=>({toolCallId,name,input,result,requestLine:line,resultLine:line+1,success:true,resultDigest:E.sha(result),sessionId:'s1',contextLine:0,skill});
+ f.build={buildId:'b1',buildDigest:'bytes',candidateDigest:'candidate'};
+ f.source.calls.push(call('build','Bash',{command:'node /skills/native-pilot.cjs build /work/prototypes/orders'},'{"buildId":"b1","buildDigest":"bytes"}',15),call('browser','Skill',{},'browser instructions',17,'browser'),call('preview','mcp__chrome_devtools__navigate_page',{url:'http://127.0.0.1:4173/'},'opened',19),call('fact','mcp__chrome_devtools__evaluate_script',{function:'() => document.title'},'{"candidate":"candidate","saved":true}',21));
+ f.proof.build={toolCallId:'build'};f.business={previewBaseURL:'http://127.0.0.1:4173/',journeys:[{id:'save'}]};
+ const methods={dom:'evaluate_script',screenshot:'take_screenshot',console:'list_console_messages',network:'list_network_requests',accessibility:'take_snapshot',performance:'performance_stop_trace'};
+ const refs=Object.fromEntries(Object.entries(methods).map(([kind,method],i)=>{const id=kind==='dom'?'fact':kind;if(kind!=='dom')f.source.calls.push(call(id,`mcp__chrome_devtools__${method}`,{},'synthetic observation',24+i*2));return [kind,{toolCallId:id,quote:kind==='dom'?'candidate':'synthetic observation'}];}));
+ f.devtools={skill:{toolCallId:'browser'},mcp:{calls:Object.entries(methods).map(([kind,method])=>({toolCallId:refs[kind].toolCallId,tool:`mcp__chrome_devtools__${method}`}))}};
+ f.proof.browser={skill:{toolCallId:'browser'},preview:{toolCallId:'preview'},identity:{toolCallId:'fact',quote:'candidate'},observations:refs,facts:[{scenarioId:'save',checkIndex:0,toolCallId:'fact',quote:'"saved":true'}]};
+ f.assertions={schemaVersion:1,scenarios:[{scenarioId:'save',checks:[{method:'evaluate_script',pointer:'/saved',operator:'equals',expected:true}]}]};
+ assert.equal(G.evaluate(f,'delivery').status,'passed');
+ f.source.calls.find(c=>c.toolCallId==='fact').result='{"candidate":"candidate","saved":false}';f.proof.browser.facts[0].quote='"saved":false';assert.equal(G.evaluate(f,'delivery').status,'failed');
+});

package/scripts/ui-prototype-execution-policy-test.js

@@ -0,0 +1,53 @@
+'use strict';
+const prototypeScripts=(()=>{const fs=require('node:fs'),path=require('node:path'),file=path.join(__dirname,'lib/installation.js');return path.join(fs.existsSync(file)?require(file).loadInstallation().skillsDirectory:path.resolve(__dirname,'../skills'),'i3-ui-prototype/scripts');})();
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const P = require(prototypeScripts+'/execution-policy.cjs');
+test('CodeBuddy policy defaults never confuse a PRD scope file with project/global installation scope',()=>{
+ const options={host:'codebuddy',scope:'/work/prototypes/.preparation/orders/scope.json'};
+ const result=P.creationOptions(options,{name:'i3-composer-agent',scope:'global',agents:['codebuddy']});
+ assert.equal(result.scope,options.scope);assert.equal(result.executionPolicy,P.AUTO_ID);
+ assert.equal(P.creationOptions({host:'codex'},{name:'i3-composer-agent'}).executionPolicy,undefined);
+ assert.equal(P.creationOptions({},null).executionPolicy,undefined);
+ assert.equal(P.creationOptions({},{name:'i3-composer-agent',agents:['workbuddy']}).executionPolicy,P.AUTO_ID);
+ assert.throws(()=>P.creationOptions({},{name:'i3-composer-agent',agents:['codebuddy','workbuddy']}),/actual --host/);
+});
+test('new Buddy policy supports WorkBuddy without changing the legacy policy',()=>{
+ const old=P.create();assert.equal(old.id,'codebuddy-ab-v1');assert.equal(old.schemaVersion,1);
+ const policy=P.create({host:'workbuddy',id:P.AUTO_ID});assert.equal(policy.host,'workbuddy');
+ assert.equal(P.validate(policy).id,'buddy-ab-v2');assert.deepEqual(policy.recovery,{perMissing:2,total:6});
+ assert.ok(P.requirements(policy,'implementation').includes('antdv'));
+ assert.throws(()=>P.create({host:'workbuddy',id:P.ID}),/legacy|CodeBuddy/);
+});
+
+test('analysis and inspection never acquire implementation requirements', () => {
+  for (const operation of ['analyze', 'inspect', 'confirm-baseline']) {
+    const policy = P.create({ operation });
+    assert.deepEqual(P.requirements(policy, 'implementation-entry'), []);
+    assert.equal(policy.readOnly, true);
+  }
+});
+test('both generation modes require frontend loading before implementation', () => {
+  for (const operation of ['create', 'revise']) for (const mode of ['professional', 'template']) {
+    const policy = P.create({ operation, mode });
+    assert.ok(P.requirements(policy, 'implementation-entry').includes('frontend'));
+    assert.ok(P.requirements(policy, 'browser-entry').includes('browser'));
+    assert.equal(P.requirements(policy, 'design').includes('uiux'), mode === 'professional');
+  }
+});
+test('official framework fallback is explicit and cannot invent a native invocation', () => {
+  assert.ok(P.requirements(P.create({ officialCallable: true }), 'design').includes('antdv'));
+  assert.ok(P.requirements(P.create({ officialCallable: false }), 'design').includes('official-source'));
+  assert.equal(P.skillKey('fake-i3-frontend-ui-engineering'), null);
+  assert.equal(P.skillKey('i3-frontend-ui-engineering'), 'frontend');
+  assert.equal(P.skillKey('ui-ux-pro-max:ui-ux-pro-max'),'uiux');
+  assert.equal(P.skillKey('arbitrary:ui-ux-pro-max'),null);
+});
+test('policy changes are detected and unsupported hosts cannot silently acquire CodeBuddy support', () => {
+  const policy = P.create({ mode: 'template' });
+  assert.equal(P.validate(policy).digest, policy.digest);
+  assert.throws(() => P.validate({ ...policy, mode: 'professional' }), /policy|Policy/);
+  assert.throws(() => P.create({ host: 'codex' }), /CodeBuddy/);
+  assert.throws(() => P.create({ operation: 'write-anything' }), /operation/);
+  assert.throws(() => P.create({ mode: 'basic' }), /mode/);
+});

package/scripts/ui-prototype-execution-runtime-test.js

@@ -0,0 +1,27 @@
+'use strict';
+const prototypeScripts=(()=>{const fs=require('node:fs'),path=require('node:path'),file=path.join(__dirname,'lib/installation.js');return path.join(fs.existsSync(file)?require(file).loadInstallation().skillsDirectory:path.resolve(__dirname,'../skills'),'i3-ui-prototype/scripts');})();
+const test=require('node:test'),assert=require('node:assert/strict'),fs=require('node:fs'),path=require('node:path'),os=require('node:os');
+const lib=require(prototypeScripts+'/native-pilot-lib.cjs'),X=require(prototypeScripts+'/execution-runtime.cjs'),A=require(prototypeScripts+'/execution-assertions.cjs');
+function fixture(t){const project=fs.mkdtempSync(path.join(os.tmpdir(),'i3-execution-source-fixture-'));t.after(()=>fs.rmSync(project,{recursive:true,force:true}));const scope={schemaVersion:1,title:'Synthetic orders fixture',pages:[{id:'orders',title:'Orders',referencePage:'models-page',regions:[{id:'list',mode:'management-list'},{id:'editor',mode:'edit-form'}]}],requirements:[{id:'R1',text:'Synthetic source contract only',pages:['orders'],source:{type:'prd',reference:'fixture/R1',statement:'Synthetic fixture, not actual browser acceptance'}}],exemptions:[]};const scopeFile=path.join(project,'scope.json');fs.writeFileSync(scopeFile,JSON.stringify(scope));return {project,scope:scopeFile,expertMode:'template'};}
+test('new execution inputs freeze complete scenario expectations without changing legacy candidates',t=>{
+ const options=fixture(t),legacy=lib.createPrototype({...options,id:'old'}),before=lib.manifest(legacy.directory);
+ assert.equal(X.policy(legacy.directory),null);assert.equal(X.check(legacy.directory,'delivery',lib).status,'not-required');
+ const assertions=A.template(options);assert.ok(assertions.scenarios.length>20);for(const scenario of assertions.scenarios)scenario.checks=[{method:'evaluate_script',pointer:'/synthetic',operator:'equals',expected:true}];
+ const file=path.join(options.project,'assertions.json');fs.writeFileSync(file,JSON.stringify(assertions));
+ const fresh=lib.createPrototype({...options,id:'strict',host:'codebuddy',executionPolicy:'codebuddy-ab-v1',executionAssertions:file});
+ assert.equal(X.policy(fresh.directory).id,'codebuddy-ab-v1');assert.equal(lib.inspect(fresh.directory).status,'passed');
+ assert.equal(X.check(fresh.directory,'delivery',lib).status,'failed');assert.throws(()=>X.requireStage(fresh.directory,'implementation',lib),/binding|execution-begin/);
+ assert.deepEqual(lib.manifest(legacy.directory),before);assert.deepEqual(fs.readdirSync(options.project).sort(),['assertions.json','prototypes','scope.json']);
+});
+test('missing or incomplete fixed facts cannot silently create a strict artifact or affect legacy state',t=>{
+ const options=fixture(t);assert.throws(()=>lib.createPrototype({...options,id:'missing',host:'codebuddy',executionPolicy:'codebuddy-ab-v1'}),/execution-assertions/);
+ assert.equal(fs.existsSync(path.join(options.project,'prototypes/missing')),false);
+ const assertions=A.template(options);assert.throws(()=>A.validate(assertions,assertions.scenarios.map(s=>s.scenarioId)),/actual result/);
+});
+test('native values are extracted and compared with fixed inputs instead of a self-written passed flag',()=>{
+ const check={method:'evaluate_script',pointer:'/form/errors',operator:'equals',expected:1};
+ A.compare(A.extract(A.resultData('### Result\n```json\n{"form":{"errors":1}}\n```'),check.pointer),check);
+ assert.throws(()=>A.compare(A.extract(A.resultData('{"passed":true,"form":{"errors":0}}'),check.pointer),check),/differs/);
+ assert.throws(()=>A.extract({passed:true},check.pointer),/absent/);
+ assert.throws(()=>A.resultData('passed'),/JSON/);
+});

package/scripts/ui-prototype-ide-source-test.js

@@ -0,0 +1,73 @@
+'use strict';
+const prototypeScripts=(()=>{const fs=require('node:fs'),path=require('node:path'),file=path.join(__dirname,'lib/installation.js');return path.join(fs.existsSync(file)?require(file).loadInstallation().skillsDirectory:path.resolve(__dirname,'../skills'),'i3-ui-prototype/scripts');})();
+const test=require('node:test'),assert=require('node:assert/strict'),fs=require('node:fs'),path=require('node:path'),os=require('node:os');
+const E=require(prototypeScripts+'/execution-evidence.cjs'),C=require(prototypeScripts+'/codebuddy-context.cjs');
+function fixture(t){
+ const root=fs.mkdtempSync(path.join(os.tmpdir(),'i3-ide-index-'));t.after(()=>fs.rmSync(root,{recursive:true,force:true}));
+ const sessionId='a'.repeat(32),requestId='b'.repeat(32),directory=path.join(root,sessionId);fs.mkdirSync(path.join(directory,'messages'),{recursive:true});
+ const rows=[
+  {id:'1'.repeat(32),role:'user',message:JSON.stringify({role:'user',content:[{type:'text',text:'injected context'}]}),extra:JSON.stringify({requestId,isHelperMessage:false,sourceContentBlocks:[{type:'text',text:'请实现原型'}]})},
+  {id:'2'.repeat(32),role:'assistant',message:JSON.stringify({role:'assistant',content:[{type:'tool-call',toolCallId:'native-skill',toolName:'use_skill',args:{command:'i3-frontend-ui-engineering'}}]}),extra:JSON.stringify({requestId})},
+  {id:'3'.repeat(32),role:'tool',message:JSON.stringify({role:'tool',content:[{type:'tool-result',toolCallId:'native-skill',toolName:'use_skill',result:{status:'success',success:true,result:{message:'Actual Skill instructions'}},isError:false}]}),extra:JSON.stringify({requestId})},
+  {id:'4'.repeat(32),role:'assistant',message:JSON.stringify({role:'assistant',content:[{type:'text',text:'已完成'}]}),extra:JSON.stringify({requestId})},
+ ];
+ const index={messages:rows.map(row=>({id:row.id,role:row.role,type:'text',isComplete:false})),requests:[{id:requestId,type:'craft',messages:rows.map(row=>row.id),state:'running'}]};
+ const file=path.join(directory,'index.json');
+ const save=()=>{fs.writeFileSync(file,JSON.stringify(index));for(const row of rows)fs.writeFileSync(path.join(directory,'messages',row.id+'.json'),JSON.stringify(row));};save();
+ return {file,root,sessionId,rows,index,save,read:()=>E.readSource(file,[root])};
+}
+test('observed IDE index resolves only referenced messages and pairs a real use_skill result',t=>{
+ const f=fixture(t),s=f.read();assert.equal(s.format,'codebuddy-ide-index-v1');
+ assert.equal(E.loaded(s.calls,'frontend').length,1);assert.equal(s.calls[0].sessionId,f.sessionId);
+ assert.equal(s.calls[0].name,'Skill');assert.deepEqual(s.calls[0].input,{command:'i3-frontend-ui-engineering'});
+ assert.equal(s.prompts[0].text,'请实现原型');assert.equal(s.latestAssistant,'已完成');
+ fs.writeFileSync(path.join(path.dirname(f.file),'messages','unreferenced.json'),'{broken');assert.equal(E.loaded(f.read().calls,'frontend').length,1);
+});
+test('IDE stable evidence cursor survives streaming text and state updates but detects changed facts',t=>{
+ const f=fixture(t),s=f.read();f.index.requests[0].state='completed';
+ f.rows[3].message=JSON.stringify({role:'assistant',content:[{type:'text',text:'已完成验收'}]});f.save();
+ C.prefix(f.file,s.bytes,s.digest);
+ const message=JSON.parse(f.rows[2].message);message.content[0].result.result.message='edited';f.rows[2].message=JSON.stringify(message);f.save();
+ assert.throws(()=>C.prefix(f.file,s.bytes,s.digest),/prefix changed|truncated/);
+});
+test('IDE failed use_skill and successful reads do not become frontend invocation evidence',t=>{
+ const f=fixture(t),message=JSON.parse(f.rows[2].message);message.content[0].result.success=false;f.rows[2].message=JSON.stringify(message);f.save();
+ assert.equal(E.loaded(f.read().calls,'frontend').length,0);
+ const g=fixture(t);for(const i of [1,2]){const row=JSON.parse(g.rows[i].message);row.content[0].toolName='read_file';g.rows[i].message=JSON.stringify(row);}g.save();
+ assert.equal(E.loaded(g.read().calls,'frontend').length,0);
+});
+test('IDE index traversal, missing files, duplicate references and wrong request identity fail closed',t=>{
+ const traversal=fixture(t);traversal.index.messages[0].id='../outside';traversal.save();assert.throws(()=>traversal.read(),/ID/);
+ const missing=fixture(t);fs.unlinkSync(path.join(path.dirname(missing.file),'messages',missing.rows[1].id+'.json'));assert.throws(()=>missing.read(),/ENOENT/);
+ const duplicate=fixture(t);duplicate.index.messages.push(duplicate.index.messages[0]);duplicate.save();assert.throws(()=>duplicate.read(),/Duplicate/);
+ const wrong=fixture(t);wrong.rows[1].extra=JSON.stringify({requestId:'f'.repeat(32)});wrong.save();assert.throws(()=>wrong.read(),/request identity/);
+});
+test('IDE symlinked message files and session mismatch cannot satisfy source verification',t=>{
+ const f=fixture(t),file=path.join(path.dirname(f.file),'messages',f.rows[1].id+'.json'),bytes=fs.readFileSync(file),other=path.join(f.root,'other.json');
+ fs.writeFileSync(other,bytes);fs.unlinkSync(file);fs.symlinkSync(other,file);assert.throws(()=>f.read(),/history file/);
+ const g=fixture(t);assert.throws(()=>C.source({transcript_path:g.file,session_id:'different'},{transcriptRoots:[g.root]},'/business'),/session identity/);
+});
+test('pending IDE argument serialization is excluded from the immutable completed prefix',t=>{
+ const f=fixture(t),result=f.rows.splice(2,1)[0];
+ const changeIndex=()=>{f.index.messages=f.rows.map(row=>({id:row.id,role:row.role,type:'text',isComplete:false}));f.index.requests[0].messages=f.rows.map(row=>row.id);f.save();};
+ f.rows[1].message=JSON.stringify({role:'assistant',content:[{type:'tool-call',toolCallId:'native-skill',toolName:'use_skill',args:{command:'i3-front'}}]});changeIndex();
+ const pending=f.read();assert.equal(pending.stableThroughLine,1);assert.equal(E.loaded(pending.calls,'frontend').length,0);
+ assert.equal(pending.calls[0].nativeRequestId,'b'.repeat(32));
+ f.rows[1].message=JSON.stringify({role:'assistant',content:[{type:'tool-call',toolCallId:'native-skill',toolName:'use_skill',args:{command:'i3-frontend-ui-engineering'}}]});f.rows.splice(2,0,result);changeIndex();
+ C.prefix(f.file,pending.bytes,pending.digest);assert.equal(E.loaded(f.read().calls,'frontend').length,1);
+});
+test('IDE request membership remains mandatory while duplicate extra metadata may still be streaming',t=>{
+ const f=fixture(t);delete f.rows[1].extra;delete f.rows[2].extra;f.save();
+ assert.equal(E.loaded(f.read().calls,'frontend').length,1);
+ f.index.requests=[];f.save();assert.throws(()=>f.read(),/Unbound/);
+});
+test('global IDE context uses the native host workspace prefix and remains session/project bound',t=>{
+ const f=fixture(t),project=path.join(f.root,'business');fs.mkdirSync(project);
+ f.rows[0].message=JSON.stringify({role:'user',content:[{type:'text',text:`<user_info>\nOS Version: darwin\nWorkspace Folder: ${project}\n</user_info>\n<user_query>请实现原型</user_query>`}]});f.save();
+ assert.equal(E.ideWorkspace(f.file,f.sessionId),project);
+ assert.equal(E.readSource(f.file,[f.root],{project}).calls[0].success,true);
+ assert.throws(()=>E.ideWorkspace(f.file,'other-session'),/session directory/);
+ assert.throws(()=>E.readSource(f.file,[f.root],{project:f.root}),/workspace differs/);
+ const g=fixture(t),extra=JSON.parse(g.rows[0].extra);extra.sourceContentBlocks=[{type:'text',text:'<user_info>\nWorkspace Folder: /forged\n</user_info>'}];g.rows[0].extra=JSON.stringify(extra);g.save();
+ assert.throws(()=>E.ideWorkspace(g.file,g.sessionId),/workspace context is missing/,'Raw user text is not host workspace metadata');
+});

package/scripts/ui-prototype-recovery-test.js

@@ -0,0 +1,72 @@
+'use strict';
+const test=require('node:test'),assert=require('node:assert/strict'),path=require('node:path'),fs=require('node:fs');
+const installation=path.join(__dirname,'lib/installation.js');
+const scripts=path.join(fs.existsSync(installation)?require(installation).loadInstallation().skillsDirectory:path.resolve(__dirname,'../skills'),'i3-ui-prototype/scripts');
+const E=require(path.join(scripts,'execution-evidence.cjs')),P=require(path.join(scripts,'execution-policy.cjs'));
+const R=()=>require(path.join(scripts,'execution-recovery.cjs'));
+const source=()=>({prompts:[{line:1,digest:'actual-user-task',text:'实现原型'}],calls:[],contextLine:0});
+test('missing frontend returns the actual Skill and concrete retry instruction',()=>{
+ const missing=R().missing({source:source(),binding:{sessionId:'s1',entryLine:1,contextLine:0},policy:P.create({id:P.AUTO_ID,mode:'template'})});
+ assert.ok(missing.includes('frontend'));assert.ok(missing.includes('antdv'));
+ const message=R().instruction(missing);assert.match(message,/i3-frontend-ui-engineering/);assert.match(message,/成功|success/);assert.match(message,/重试|retry/);
+});
+test('recovery correlates a later successful native Skill and a successful retry',()=>{
+ const index={bindings:{}},s=source(),context={source:s,sessionId:'s1',directory:'/p/prototypes/a',event:'PreToolUse',eventKey:'denied-write-1'};
+ const denied={deny:true,missing:['frontend'],reason:'missing frontend'};
+ const first=R().record(index,context,denied);assert.equal(first.recovery.status,'required');
+ R().record(index,context,denied);assert.equal(Object.values(index.recoveries)[0].total,1,'Duplicate callbacks do not spend another attempt');
+ const rows=[{type:'user',sessionId:'s1',message:{content:'实现原型'}},{type:'assistant',sessionId:'s1',message:{content:[{type:'tool_use',id:'real-front',name:'Skill',input:{skill:'i3-frontend-ui-engineering'}}]}},{type:'user',sessionId:'s1',message:{content:[{type:'tool_result',tool_use_id:'real-front',content:'Skill loaded successfully'}]}}];
+ s.calls=E.parse(rows.map(row=>JSON.stringify(row)).join('\n'));
+ const ready=R().record(index,{...context,eventKey:'retry-2'},{continue:true});assert.equal(ready.recovery.status,'ready-to-retry');
+ const recovered=R().record(index,{...context,event:'PostToolUse',eventKey:'retry-2-result',retrySucceeded:true,retry:{toolCallId:'retry-write',requestLine:4,resultLine:5}},{continue:true});
+ assert.equal(recovered.recovery.status,'recovered');assert.equal(recovered.recovery.invocations[0].toolCallId,'real-front');
+});
+test('failed and stale Skill results do not recover and Stop correction is bounded across begin calls',()=>{
+ const index={bindings:{}},s=source(),context={source:s,sessionId:'s1',directory:'/p/prototypes/a',event:'Stop'};
+ s.calls=[{skill:'frontend',sessionId:'s1',requestLine:2,resultLine:3,success:false}];
+ const feedback={feedback:true,missing:['frontend'],reason:'load frontend'};
+ for(let n=1;n<=2;n++)assert.equal(R().record(index,{...context,eventKey:'stop-'+n},feedback).feedback,true);
+ index.bindings={};
+ const exhausted=R().record(index,{...context,eventKey:'stop-3'},feedback);assert.equal(exhausted.feedback,undefined);assert.equal(exhausted.recovery.status,'blocked');assert.match(exhausted.context,/阻塞/);
+ const denied=R().record(index,{...context,event:'PreToolUse',eventKey:'write-3'},{deny:true,missing:['frontend'],reason:'load frontend'});assert.equal(denied.deny,true);
+ s.contextLine=10;s.calls=[{skill:'frontend',sessionId:'s1',requestLine:2,resultLine:3,success:true}];
+ assert.notEqual(R().record(index,{...context,eventKey:'old-load'},{continue:true}).recovery.status,'recovered');
+});
+test('flat native Hook feedback remains metadata and cannot reset the human task or recovery budget',()=>{
+ const rows=[{type:'message',role:'user',sessionId:'s1',content:[{type:'input_text',text:'实现原型'}]},{type:'message',role:'user',sessionId:'s1',providerData:{isMeta:true},content:[{type:'input_text',text:'补调 frontend 后继续'}]}];
+ const text=rows.map(row=>JSON.stringify(row)).join('\n');
+ assert.equal(E.describe(text).prompts.length,1);assert.equal(E.describe(text).prompts[0].text,'实现原型');
+});
+test('a missing Skill has one budget even when the set of other missing Skills changes',()=>{
+ const index={},context={source:source(),sessionId:'s1',directory:'/p/prototypes/a',event:'Stop'};
+ for(const [n,missing] of [['1',['frontend','antdv']],['2',['frontend']]])assert.equal(R().record(index,{...context,eventKey:n},{feedback:true,missing}).feedback,true);
+ const third=R().record(index,{...context,eventKey:'3'},{feedback:true,missing:['frontend','uiux']});
+ assert.equal(third.recovery.status,'blocked');assert.equal(third.feedback,undefined);assert.equal(third.recovery.counts.frontend,2);
+});
+test('native output resumes Stop for recovery and shows the user an exhausted-budget warning',()=>{
+ const format=require(path.join(scripts,'hosts/codebuddy.cjs')).format;
+ assert.deepEqual(format({feedback:true,reason:'补调'},'Stop').output,{continue:false,reason:'补调'});
+ const blocked=format({context:'当前仍被阻塞',recovery:{status:'blocked'}},'Stop').output;
+ assert.equal(blocked.continue,true);assert.equal(blocked.systemMessage,'当前仍被阻塞');
+ assert.equal(format({deny:true,reason:'缺 Skill'},'PreToolUse').output.hookSpecificOutput.permissionDecision,'deny');
+ assert.equal(format({continue:true,context:'实施前加载'},'UserPromptSubmit').output.hookSpecificOutput.additionalContext,'实施前加载');
+});
+test('a stage evidence recovery requires the same verified stage and its successful native retry',()=>{
+ const index={},context={source:source(),sessionId:'s1',directory:'/p/prototypes/a',event:'PreToolUse',eventKey:'denied-build',stage:'implementation'};
+ R().record(index,context,{deny:true,missing:['execution-evidence']});
+ const other=R().record(index,{...context,eventKey:'another-stage',stage:'browser-entry',resolved:['execution-evidence'],retrySucceeded:true,event:'PostToolUse'},{continue:true});
+ assert.equal(other.recovery.status,'required');
+ const ready=R().record(index,{...context,eventKey:'verified-build',resolved:['execution-evidence']},{continue:true});
+ assert.equal(ready.recovery.status,'ready-to-retry');
+ const retry=R().record(index,{...context,eventKey:'successful-build',resolved:['execution-evidence'],retrySucceeded:true,event:'PostToolUse',retry:{toolCallId:'actual-build-result',requestLine:4,resultLine:5}},{continue:true});
+ assert.equal(retry.recovery.status,'recovered');assert.equal(retry.recovery.retry.toolCallId,'actual-build-result');
+});
+test('an old successful callback cannot recover a later stage denial',()=>{
+ const s=source();s.calls=[{toolCallId:'old',requestLine:2,resultLine:3,success:true}];
+ const index={},context={source:s,sessionId:'s1',directory:'/p/prototypes/a',stage:'implementation'};
+ R().record(index,{...context,event:'PreToolUse',eventKey:'deny'},{deny:true,missing:['execution-evidence']});
+ const stale=R().record(index,{...context,event:'PostToolUse',eventKey:'old-result',resolved:['execution-evidence'],retrySucceeded:true,retry:s.calls[0]},{continue:true});
+ assert.equal(stale.recovery.status,'ready-to-retry');
+ const current=R().record(index,{...context,event:'PostToolUse',eventKey:'new-result',resolved:['execution-evidence'],retrySucceeded:true,retry:{toolCallId:'new',requestLine:4,resultLine:5}},{continue:true});
+ assert.equal(current.recovery.status,'recovered');assert.equal(current.recovery.retry.feedbackLine,3);
+});

package/scripts/ui-prototype-registration-test.js

@@ -0,0 +1,53 @@
+'use strict';
+const prototypeScripts=(()=>{const fs=require('node:fs'),path=require('node:path'),file=path.join(__dirname,'lib/installation.js');return path.join(fs.existsSync(file)?require(file).loadInstallation().skillsDirectory:path.resolve(__dirname,'../skills'),'i3-ui-prototype/scripts');})();
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const R = require(prototypeScripts+'/codebuddy-registration.cjs');
+const options = { action: 'enable', scope: 'project', product: 'ide', base: '/work/project/.codebuddy',
+  project: '/work/project', nodePath: '/runtime with spaces/node', scriptPath: '/work/project/.codebuddy/skills/i3-ui-prototype/scripts/hosts/codebuddy.cjs', scriptDigest: 'a'.repeat(64) };
+test('registration planning preserves unrelated hooks and never grants permissions', () => {
+  const before = { theme: 'dark', hooks: { PreToolUse: [{ matcher: 'Write', hooks: [{ type: 'command', command: 'original-check' }] }] } };
+  const result = R.plan({ ...options, currentText: JSON.stringify(before) });
+  const after = JSON.parse(result.afterText);
+  assert.equal(after.theme, 'dark'); assert.deepEqual(after.hooks.PreToolUse[0], before.hooks.PreToolUse[0]);
+  assert.ok(result.summary.events.includes('PostToolUse'));
+  assert.match(after.hooks.PreToolUse[1].hooks[0].command, /'\/runtime with spaces\/node'/);
+  assert.equal(result.recordAfter.active, undefined);
+  assert.equal(result.summary.status, 'registered');
+});
+test('repeated enable is idempotent, disable removes only owned groups', () => {
+  const first = R.plan({ ...options, currentText: '{"userOption":42}' });
+  const again = R.plan({ ...options, currentText: first.afterText, record: first.recordAfter });
+  assert.equal(again.afterText, first.afterText);
+  const removed = R.plan({ ...options, action: 'disable', currentText: again.afterText, record: again.recordAfter });
+  assert.equal(JSON.parse(removed.afterText).userOption, 42);
+  assert.equal(Object.values(JSON.parse(removed.afterText).hooks).flat().length, 0);
+});
+test('missing ownership and modified owned hooks cannot be force adopted', () => {
+  const first = R.plan({ ...options, currentText: '{}' });
+  assert.throws(() => R.plan({ ...options, currentText: first.afterText }), /ownership|Ownership/);
+  const edited = JSON.parse(first.afterText); edited.hooks.Stop[0].hooks[0].timeout = 9;
+  assert.throws(() => R.plan({ ...options, currentText: JSON.stringify(edited), record: first.recordAfter }), /modified|changed/);
+  assert.throws(() => R.plan({ ...options, currentText: '{broken' }), /JSON/);
+});
+test('global CLI registration and defaults remain separate from actual activation', () => {
+  const keep = R.plan({ ...options, action: 'keep', currentText: null });
+  assert.equal(keep.afterText, null); assert.equal(keep.summary.status, 'not-enabled');
+  const global = R.plan({ ...options, scope: 'global', base: '/user/.codebuddy', product: 'cli', currentText: '{}' });
+  assert.equal(global.summary.status, 'pending-host-review');
+  assert.match(global.recordAfter.groups.Stop.hooks[0].command, /--scope' 'global/);
+  assert.throws(() => R.plan({ ...options, product: 'workbuddy' }), /product/);
+});
+test('configuration transaction refuses stale previews and restores only its own failed write in memory', () => {
+  const change = R.plan({ ...options, currentText: '{}' });
+  const files = new Map([[change.settingsPath, '{}']]); let fail = true;
+  const io = { read: file => files.get(file) ?? null, write(file, text) {
+    if (file === change.recordPath && fail) { fail = false; throw new Error('record write failed'); }
+    if (text === null) files.delete(file); else files.set(file, text);
+  } };
+  assert.throws(() => R.apply(change, io), /record write failed/);
+  assert.equal(files.get(change.settingsPath), '{}');
+  files.set(change.settingsPath, '{"userEdit":true}');
+  assert.throws(() => R.apply(change, io), /changed after preview/);
+  assert.equal(files.get(change.settingsPath), '{"userEdit":true}');
+});

package/scripts/ui-prototype-transcript-auto-test.js

@@ -0,0 +1,67 @@
+'use strict';
+// Synthetic files and in-memory configuration only; never installs or launches a host.
+const fs=require('node:fs'),path=require('node:path'),os=require('node:os'),test=require('node:test'),assert=require('node:assert/strict');
+const prototypeScripts=(()=>{const file=path.join(__dirname,'lib/installation.js');return path.join(fs.existsSync(file)?require(file).loadInstallation().skillsDirectory:path.resolve(__dirname,'../skills'),'i3-ui-prototype/scripts');})();
+const E=require(prototypeScripts+'/execution-evidence.cjs'),C=require(prototypeScripts+'/codebuddy-context.cjs'),R=require(prototypeScripts+'/codebuddy-registration.cjs');
+function fixture(t) {
+ const root=fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(),'i3-transcript-contract-'))),project=path.join(root,'business'),native=path.join(root,'native');
+ fs.mkdirSync(project);fs.mkdirSync(native);t.after(()=>fs.rmSync(root,{recursive:true,force:true}));
+ const rows=[{type:'user',sessionId:'session-a',message:{content:'生成当前原型'}},{type:'assistant',sessionId:'session-a',message:{content:[{type:'tool_use',id:'front-1',name:'Skill',input:{skill:'i3-frontend-ui-engineering'}}]}},{type:'user',sessionId:'session-a',message:{content:[{type:'tool_result',tool_use_id:'front-1',content:'Native fixture instructions'}]}}];
+ const file=path.join(native,'session.txt');fs.writeFileSync(file,rows.map(JSON.stringify).join('\n')+'\n');return {root,project,native,file,rows};
+}
+test('new IDE and CLI registrations default to automatic transcripts in both scopes',()=>{
+ for(const product of ['ide','cli'])for(const scope of ['project','global']) {
+  const base=scope==='project'?'/work/p/.codebuddy':'/users/u/.codebuddy';
+  const change=R.plan({action:'enable',product,scope,base,project:'/work/p',nodePath:'/node',scriptPath:base+'/hooks/i3-prototype.cjs',scriptDigest:'a'.repeat(64)});
+  assert.equal(change.recordAfter.transcriptMode,'auto');assert.deepEqual(change.recordAfter.transcriptRoots,[]);
+ }
+});
+test('manual and legacy root restrictions are retained; empty manual policy is rejected',()=>{
+ const options={action:'enable',product:'ide',scope:'project',base:'/work/p/.codebuddy',project:'/work/p',nodePath:'/node',scriptPath:'/fixed/hook.cjs',scriptDigest:'a'.repeat(64),transcriptRoots:['/native/logs']};
+ const first=R.plan(options);assert.equal(first.recordAfter.transcriptMode,'manual');
+ const legacy=structuredClone(first.recordAfter);delete legacy.transcriptMode;
+ const kept=R.plan({...options,action:'keep',transcriptRoots:undefined,currentText:first.afterText,record:legacy});
+ assert.equal(kept.recordAfter.transcriptMode,'manual');assert.deepEqual(kept.recordAfter.transcriptRoots,['/native/logs']);
+ assert.throws(()=>R.plan({...options,transcriptMode:'manual',transcriptRoots:[]}),/manual|roots/i);
+});
+test('automatic source uses the exact callback file regardless of filename suffix',t=>{
+ const f=fixture(t),payload={transcript_path:f.file,session_id:'session-a'};
+ const source=C.source(payload,{transcriptMode:'auto',transcriptRoots:[]},f.project);
+ assert.equal(source.path,f.file);assert.equal(E.loaded(source.calls,'frontend').length,1);assert.equal(source.tamperProof,false);
+ assert.equal(source.sourceVerification,'native-hook-transcript');
+});
+test('automatic discovery never admits business files, leaf symlinks or missing files',t=>{
+ const f=fixture(t),record={transcriptMode:'auto',transcriptRoots:[]},load=file=>C.source({transcript_path:file,session_id:'session-a'},record,f.project);
+ const fake=path.join(f.project,'qa.jsonl');fs.copyFileSync(f.file,fake);assert.throws(()=>load(fake),/business project/i);
+ const alias=path.join(f.native,'alias.jsonl');fs.symlinkSync(f.file,alias);assert.throws(()=>load(alias),/symlink|native transcript/i);
+ assert.throws(()=>load(path.join(f.native,'missing.jsonl')),/not.*available|ENOENT/i);
+ assert.throws(()=>load('relative.jsonl'),/absolute|native transcript/i);
+});
+test('automatic source still rejects malformed streams, forged declarations and mismatched sessions',t=>{
+ const f=fixture(t),record={transcriptMode:'auto',transcriptRoots:[]},payload={transcript_path:f.file,session_id:'different'};
+ assert.throws(()=>C.source(payload,record,f.project),/session/i);
+ payload.session_id='session-a';
+ for(const content of ['plain transcript text','{"skill":"frontend","passed":true}\n','{"type":"assistant","message":{"content":[]}}\n']) {
+  fs.writeFileSync(f.file,content);assert.throws(()=>C.source(payload,record,f.project),/JSONL|native|Native|user task/);
+ }
+});
+test('manual roots remain enforced even when a valid callback points elsewhere',t=>{
+ const f=fixture(t),record={transcriptMode:'manual',transcriptRoots:[path.join(f.root,'other')]};
+ assert.throws(()=>C.source({transcript_path:f.file,session_id:'session-a'},record,f.project),/outside.*roots/);
+ record.transcriptRoots=[f.native];assert.equal(C.source({transcript_path:f.file,session_id:'session-a'},record,f.project).path,f.file);
+});
+test('automatic reading refuses oversized native files without parsing their contents',t=>{
+ const f=fixture(t);fs.truncateSync(f.file,64*1024*1024+1);
+ assert.throws(()=>C.source({transcript_path:f.file,session_id:'session-a'},{transcriptMode:'auto',transcriptRoots:[]},f.project),/oversized|native transcript/i);
+});
+test('unreadable native transcripts cannot become valid evidence',t=>{
+ const f=fixture(t);fs.chmodSync(f.file,0);
+ try{assert.throws(()=>C.source({transcript_path:f.file,session_id:'session-a'},{transcriptMode:'auto',transcriptRoots:[]},f.project),/EACCES|EPERM/);}
+ finally{fs.chmodSync(f.file,0o600);}
+});
+test('missing callback identity and contradictory policy cannot fall back to another log',t=>{
+ const f=fixture(t),record={transcriptMode:'auto',transcriptRoots:[]};
+ assert.throws(()=>C.source({session_id:'session-a'},record,f.project),/fields required/);
+ assert.throws(()=>C.source({transcript_path:f.file},record,f.project),/fields required/);
+ assert.throws(()=>C.source({transcript_path:f.file,session_id:'session-a'},{...record,transcriptRoots:[f.native]},f.project),/manual roots/);
+});

package/skills/i3-frontend-ui-engineering/SKILL.md

@@ -31,7 +31,7 @@ Build production-quality user interfaces that are accessible, performant, and vi
 
 ## Applicable Prototype Baselines
 
-When the project has `.i3-ui-prototypes.json`, read the prototype entry applicable to the UI module being changed, then its `baseline.json`, `design-system/MASTER.md`, tokens and page rules. Preserve approved design and interaction decisions; explain conflicts with new requirements instead of silently changing them. New pages reuse the selected template and component conventions. Changes to global tokens, navigation, component behavior or business states go through the `i3-ui-prototype` workflow and corresponding review. HTML review prototypes need explicit component mapping when implemented in another framework. Verify affected production pages in the browser; a prototype manifest check alone does not prove production fidelity. Projects without an applicable baseline retain this skill's existing workflow.
+Read the project prototype index at `prototypes/index.json`, falling back to legacy `.i3-ui-prototypes.json` when no new index exists. Select the entry whose `appliesTo` contains the explicit business module ID; an empty array applies to no module, and conflicting indices or multiple matches require resolution before selecting a baseline. New associations are derived from fixed scope.moduleIds by `i3-ui-prototype`, not inferred from a PRD filename. Then read its `baseline.json`, `design-system/MASTER.md`, tokens and page rules. Preserve approved design and interaction decisions; explain conflicts with new requirements instead of silently changing them. New pages reuse the selected template and component conventions. Changes to global tokens, navigation, component behavior or business states go through the `i3-ui-prototype` workflow and corresponding review. HTML review prototypes need explicit component mapping when implemented in another framework. Verify affected production pages in the browser; a prototype manifest check alone does not prove production fidelity. Projects without an applicable baseline retain this skill's existing workflow.
 
 ## Component Architecture
 

package/skills/i3-incremental-implementation/SKILL.md

@@ -194,7 +194,7 @@ Each increment should be independently revertable:
 
 ## UI Slices with Prototype Baselines
 
-For a UI slice, check `.i3-ui-prototypes.json` for an applicable approved prototype. Read its design contract, business mapping and baseline before implementation, and include affected interaction/visual checks in the slice acceptance. Preserve prior snapshots; coordinate contract changes through `i3-ui-prototype`. Backend-only slices and projects without a baseline continue the existing increment workflow.
+For a UI slice, check `prototypes/index.json` (legacy `.i3-ui-prototypes.json` fallback) for an applicable approved prototype. Match explicit module IDs against appliesTo; an empty array is unbound. Resolve conflicting indices or multiple matches instead of applying a prototype globally. New appliesTo values come from fixed scope.moduleIds through `i3-ui-prototype`. Read its design contract, business mapping and baseline before implementation, and include affected interaction/visual checks in the slice acceptance. Preserve prior snapshots; coordinate contract changes through `i3-ui-prototype`. Backend-only slices and projects without a baseline continue the existing increment workflow.
 
 ## Working with Agents