@givolt/i3-composer-agent 2.3.7 → 3.1.0

package/package.json

@@ -42,6 +42,7 @@
     "evals/cases/i3-deprecation-and-migration.json",
     "evals/cases/i3-documentation-and-adrs.json",
     "evals/cases/i3-doubt-driven-development.json",
+    "evals/cases/i3-enterprise-sop.json",
     "evals/cases/i3-frontend-ui-engineering.json",
     "evals/cases/i3-git-workflow-and-versioning.json",
     "evals/cases/i3-idea-refine.json",
@@ -55,6 +56,7 @@
     "evals/cases/i3-source-driven-development.json",
     "evals/cases/i3-spec-driven-development.json",
     "evals/cases/i3-test-driven-development.json",
+    "evals/cases/i3-ui-demo.json",
     "evals/cases/i3-ui-prototype.json",
     "evals/cases/i3-using-agent-skills.json",
     "evals/fixtures/i3-api-and-interface-design/service-brief.md",
@@ -76,6 +78,7 @@
     "evals/fixtures/i3-documentation-and-adrs/prose-review/README.md",
     "evals/fixtures/i3-documentation-and-adrs/prose-review/queue.js",
     "evals/fixtures/i3-doubt-driven-development/migration-plan.md",
+    "evals/fixtures/i3-enterprise-sop/brief.md",
     "evals/fixtures/i3-frontend-ui-engineering/Button.tsx",
     "evals/fixtures/i3-frontend-ui-engineering/design-system.md",
     "evals/fixtures/i3-git-workflow-and-versioning/.eval/working-tree.patch",
@@ -100,6 +103,7 @@
     "evals/fixtures/i3-test-driven-development/package.json",
     "evals/fixtures/i3-test-driven-development/src/split.js",
     "evals/fixtures/i3-test-driven-development/test/split.test.js",
+    "evals/fixtures/i3-ui-demo/asset-management.md",
     "evals/fixtures/i3-ui-prototype/admin-list/assets/reference.css",
     "evals/fixtures/i3-ui-prototype/admin-list/assets/reference.js",
     "evals/fixtures/i3-ui-prototype/admin-list/capability-definition.json",
@@ -140,6 +144,7 @@
     "evals/zh-CN/cases/i3-deprecation-and-migration.json",
     "evals/zh-CN/cases/i3-documentation-and-adrs.json",
     "evals/zh-CN/cases/i3-doubt-driven-development.json",
+    "evals/zh-CN/cases/i3-enterprise-sop.json",
     "evals/zh-CN/cases/i3-frontend-ui-engineering.json",
     "evals/zh-CN/cases/i3-git-workflow-and-versioning.json",
     "evals/zh-CN/cases/i3-idea-refine.json",
@@ -153,6 +158,7 @@
     "evals/zh-CN/cases/i3-source-driven-development.json",
     "evals/zh-CN/cases/i3-spec-driven-development.json",
     "evals/zh-CN/cases/i3-test-driven-development.json",
+    "evals/zh-CN/cases/i3-ui-demo.json",
     "evals/zh-CN/cases/i3-ui-prototype.json",
     "evals/zh-CN/cases/i3-using-agent-skills.json",
     "docs/adoption-guide.md",
@@ -162,15 +168,27 @@
     "docs/codebuddy-setup.md",
     "docs/codex-setup.md",
     "docs/commandcode-setup.md",
+    "docs/comparison.md",
     "docs/copilot-cli-setup.md",
     "docs/copilot-setup.md",
     "docs/cursor-setup.md",
+    "docs/developer-onboarding.md",
     "docs/gemini-cli-setup.md",
     "docs/getting-started.md",
     "docs/opencode-setup.md",
     "docs/other-hosts.md",
-    "docs/ui-prototype-native/MAIN-SESSION-REPORT.md",
-    "docs/ui-prototype-native/USAGE.md",
+    "docs/skill-anatomy.md",
+    "docs/upstream-repository/AGENTS.md",
+    "docs/upstream-repository/CLAUDE.md",
+    "docs/upstream-repository/CONTRIBUTING.md",
+    "docs/upstream-repository/README.md",
+    "docs/upstream-repository/gitattributes.txt",
+    "docs/upstream-repository/gitignore.txt",
+    "docs/upstream-repository/manifest.json",
+    "docs/upstream-repository/opencode-skills.link",
+    "docs/upstream-repository/skill-gap.yml",
+    "docs/upstream-repository/skills-contributing.md",
+    "docs/upstream-repository/test-plugin-install.yml",
     "docs/windsurf-setup.md",
     "docs/workbuddy-setup.md",
     "plugin.json",
@@ -195,6 +213,9 @@
     "scripts/run-evals.js",
     "scripts/run-regressions.js",
     "scripts/template-adapter-test.js",
+    "scripts/ui-demo-dependencies-test.js",
+    "scripts/ui-demo-mcp-test.js",
+    "scripts/ui-demo-test.js",
     "scripts/ui-prototype-binding-recovery-test.js",
     "scripts/ui-prototype-buddy-lifecycle-test.js",
     "scripts/ui-prototype-codebuddy-hook-test.js",
@@ -238,6 +259,7 @@
     "claude-code"
   ],
   "i3ComposerAgent": {
+    "prototypeAuditHooks": "retired",
     "pluginFiles": [
       "bin",
       "skills",
@@ -262,6 +284,7 @@
       "evals/cases/i3-deprecation-and-migration.json",
       "evals/cases/i3-documentation-and-adrs.json",
       "evals/cases/i3-doubt-driven-development.json",
+      "evals/cases/i3-enterprise-sop.json",
       "evals/cases/i3-frontend-ui-engineering.json",
       "evals/cases/i3-git-workflow-and-versioning.json",
       "evals/cases/i3-idea-refine.json",
@@ -275,6 +298,7 @@
       "evals/cases/i3-source-driven-development.json",
       "evals/cases/i3-spec-driven-development.json",
       "evals/cases/i3-test-driven-development.json",
+      "evals/cases/i3-ui-demo.json",
       "evals/cases/i3-ui-prototype.json",
       "evals/cases/i3-using-agent-skills.json",
       "evals/fixtures/i3-api-and-interface-design/service-brief.md",
@@ -296,6 +320,7 @@
       "evals/fixtures/i3-documentation-and-adrs/prose-review/README.md",
       "evals/fixtures/i3-documentation-and-adrs/prose-review/queue.js",
       "evals/fixtures/i3-doubt-driven-development/migration-plan.md",
+      "evals/fixtures/i3-enterprise-sop/brief.md",
       "evals/fixtures/i3-frontend-ui-engineering/Button.tsx",
       "evals/fixtures/i3-frontend-ui-engineering/design-system.md",
       "evals/fixtures/i3-git-workflow-and-versioning/.eval/working-tree.patch",
@@ -320,6 +345,7 @@
       "evals/fixtures/i3-test-driven-development/package.json",
       "evals/fixtures/i3-test-driven-development/src/split.js",
       "evals/fixtures/i3-test-driven-development/test/split.test.js",
+      "evals/fixtures/i3-ui-demo/asset-management.md",
       "evals/fixtures/i3-ui-prototype/admin-list/assets/reference.css",
       "evals/fixtures/i3-ui-prototype/admin-list/assets/reference.js",
       "evals/fixtures/i3-ui-prototype/admin-list/capability-definition.json",
@@ -360,6 +386,7 @@
       "evals/zh-CN/cases/i3-deprecation-and-migration.json",
       "evals/zh-CN/cases/i3-documentation-and-adrs.json",
       "evals/zh-CN/cases/i3-doubt-driven-development.json",
+      "evals/zh-CN/cases/i3-enterprise-sop.json",
       "evals/zh-CN/cases/i3-frontend-ui-engineering.json",
       "evals/zh-CN/cases/i3-git-workflow-and-versioning.json",
       "evals/zh-CN/cases/i3-idea-refine.json",
@@ -373,6 +400,7 @@
       "evals/zh-CN/cases/i3-source-driven-development.json",
       "evals/zh-CN/cases/i3-spec-driven-development.json",
       "evals/zh-CN/cases/i3-test-driven-development.json",
+      "evals/zh-CN/cases/i3-ui-demo.json",
       "evals/zh-CN/cases/i3-ui-prototype.json",
       "evals/zh-CN/cases/i3-using-agent-skills.json",
       "docs/adoption-guide.md",
@@ -382,15 +410,27 @@
       "docs/codebuddy-setup.md",
       "docs/codex-setup.md",
       "docs/commandcode-setup.md",
+      "docs/comparison.md",
       "docs/copilot-cli-setup.md",
       "docs/copilot-setup.md",
       "docs/cursor-setup.md",
+      "docs/developer-onboarding.md",
       "docs/gemini-cli-setup.md",
       "docs/getting-started.md",
       "docs/opencode-setup.md",
       "docs/other-hosts.md",
-      "docs/ui-prototype-native/MAIN-SESSION-REPORT.md",
-      "docs/ui-prototype-native/USAGE.md",
+      "docs/skill-anatomy.md",
+      "docs/upstream-repository/AGENTS.md",
+      "docs/upstream-repository/CLAUDE.md",
+      "docs/upstream-repository/CONTRIBUTING.md",
+      "docs/upstream-repository/README.md",
+      "docs/upstream-repository/gitattributes.txt",
+      "docs/upstream-repository/gitignore.txt",
+      "docs/upstream-repository/manifest.json",
+      "docs/upstream-repository/opencode-skills.link",
+      "docs/upstream-repository/skill-gap.yml",
+      "docs/upstream-repository/skills-contributing.md",
+      "docs/upstream-repository/test-plugin-install.yml",
       "docs/windsurf-setup.md",
       "docs/workbuddy-setup.md",
       "plugin.json",
@@ -416,6 +456,9 @@
       "scripts/run-evals.js",
       "scripts/run-regressions.js",
       "scripts/template-adapter-test.js",
+      "scripts/ui-demo-dependencies-test.js",
+      "scripts/ui-demo-mcp-test.js",
+      "scripts/ui-demo-test.js",
       "scripts/ui-prototype-binding-recovery-test.js",
       "scripts/ui-prototype-buddy-lifecycle-test.js",
       "scripts/ui-prototype-codebuddy-hook-test.js",
@@ -444,7 +487,7 @@
       "scripts/validate-versions.js"
     ]
   },
-  "version": "2.3.7",
+  "version": "3.1.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/49780522/i3-composer-agent.git"

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "i3-composer-agent",
-  "version": "2.3.7",
+  "version": "3.1.0",
   "description": "覆盖需求、计划、开发、测试、审查与发布的软件工程技能，默认使用简体中文。",
   "homepage": "https://github.com/49780522/i3-composer-agent",
   "repository": "https://github.com/49780522/i3-composer-agent"

package/scripts/ui-demo-dependencies-test.js

@@ -0,0 +1,228 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const installation = path.join(__dirname, 'lib/installation.js');
+const skills = fs.existsSync(installation) ? require(installation).loadInstallation().skillsDirectory : path.resolve(__dirname, '../skills');
+const deps = require(path.join(skills, 'i3-ui-demo/scripts/dependencies.cjs'));
+const hash = data => crypto.createHash('sha256').update(data).digest('hex');
+function official(t, wrongOutput = false) {
+  const base = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ui-demo-official-'))), root = path.join(base, 'source');
+  t.after(() => fs.rmSync(base, { recursive: true, force: true }));
+  for (const folder of ['data', 'bin', 'dist']) fs.mkdirSync(path.join(root, folder), { recursive: true });
+  const component = { name: 'Table', props: { properties: [{ name: 'rowKey', type: 'string' }], events: [], slots: [], methods: [] } };
+  const data = JSON.stringify({ components: [component] }), index = JSON.stringify({ v1: { '1.6': '1.6.0' } });
+  fs.writeFileSync(path.join(root, 'data/v1.6.0.json'), data);
+  fs.writeFileSync(path.join(root, 'data/versions.json'), index);
+  fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ name: '@antdv-next/cli', version: '0.0.0-beta.6', bin: { antdv: 'bin/antdv.js' } }));
+  const output = { name: 'Table', props: wrongOutput ? [{ name: 'oldVersionProp' }] : component.props.properties, events: [], slots: [], methods: [] };
+  const entry = 'process.stdout.write(' + JSON.stringify(JSON.stringify(output)) + ');';
+  fs.writeFileSync(path.join(root, 'bin/antdv.js'), entry);
+  fs.writeFileSync(path.join(root, 'dist/index.mjs'), '// test executable identity');
+  const expected = { package: '@antdv-next/cli', version: '0.0.0-beta.6', commit: 'fixed-test-snapshot', archiveSha256: 'fixed-test-archive', knowledgeVersion: '1.6.0', knowledgeFile: 'data/v1.6.0.json', knowledgeSha256: hash(data), versionIndexSha256: hash(index) };
+  fs.writeFileSync(path.join(base, 'UPSTREAM-ORIGIN.json'), JSON.stringify({ commit: expected.commit, archiveSha256: expected.archiveSha256, distSha256: hash(fs.readFileSync(path.join(root, 'dist/index.mjs'))) }));
+  return { root, options: { expected, sourceFiles: { 'bin/antdv.js': hash(entry) } } };
+}
+
+test('official probing proves actual fixed data and query results without writing', t => {
+  const { root, options } = official(t);
+  const before = fs.readdirSync(root, { recursive: true });
+  const result = deps.inspectOfficial(root, options);
+  assert.equal(result.availability, 'available');
+  assert.equal(result.knowledgeVersion, '1.6.0');
+  assert.equal(result.exactKnowledgeMatch, true);
+  assert.equal(result.invocationVerified, false);
+  assert.deepEqual(fs.readdirSync(root, { recursive: true }), before);
+});
+
+test('version policy compares prereleases numerically and rejects unknown versions', () => {
+  assert.equal(deps.versionRelation('2.15.0', '2.15.0'), 'same');
+  assert.equal(deps.versionRelation('2.16.0', '2.15.0'), 'higher');
+  assert.equal(deps.versionRelation('2.9.0', '2.15.0'), 'lower');
+  assert.equal(deps.versionRelation('0.0.0-beta.10', '0.0.0-beta.6'), 'higher');
+  assert.equal(deps.versionRelation('0.0.0', '0.0.0-beta.6'), 'higher');
+  assert.equal(deps.versionRelation('unversioned', '2.15.0'), 'unknown');
+});
+
+test('official snapshot preparation respects the unchanged builder engine requirements', () => {
+  for (const version of ['v20.19.5', 'v22.17.1', 'v23.11.0', 'v24.10.0', 'unknown']) assert.equal(deps.supportsBuild(version), false, version);
+  for (const version of ['v22.18.0', 'v22.22.0', 'v24.11.0', 'v24.15.0', 'v26.0.0']) assert.equal(deps.supportsBuild(version), true, version);
+});
+
+test('a compatible higher official CLI is preserved and still queries the fixed 1.6.0 data', t => {
+  const { root, options } = official(t);
+  const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json')));
+  pkg.version = '0.0.0-beta.10';
+  fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify(pkg));
+  const before = fs.readFileSync(path.join(root, 'package.json'));
+  const result = deps.inspectOfficial(root, options);
+  assert.equal(result.availability, 'available', result.reason);
+  assert.equal(result.versionRelation, 'higher');
+  assert.equal(result.snapshot, null, 'A retained old receipt cannot attest the source of a newer CLI');
+  assert.equal(result.knowledgeVersion, '1.6.0');
+  assert.deepEqual(fs.readFileSync(path.join(root, 'package.json')), before);
+});
+
+test('a lower CLI needs upgrading even when it exits successfully', t => {
+  const { root, options } = official(t);
+  const file = path.join(root, 'package.json'), pkg = JSON.parse(fs.readFileSync(file));
+  pkg.version = '0.0.0-beta.1'; fs.writeFileSync(file, JSON.stringify(pkg));
+  const result = deps.inspectOfficial(root, options);
+  assert.equal(result.availability, 'upgrade-required');
+  assert.equal(result.versionRelation, 'lower');
+  assert.equal(result.cliVersion, pkg.version);
+});
+
+test('a higher CLI cannot pass with stale query output', t => {
+  const { root, options } = official(t, true);
+  const file = path.join(root, 'package.json'), pkg = JSON.parse(fs.readFileSync(file));
+  pkg.version = '0.0.0-beta.10'; fs.writeFileSync(file, JSON.stringify(pkg));
+  assert.equal(deps.inspectOfficial(root, options).availability, 'unusable');
+});
+
+function design(t, version) {
+  const project = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ui-demo-design-policy-')));
+  t.after(() => fs.rmSync(project, { recursive: true, force: true }));
+  const root = path.join(project, '.codebuddy/skills/ui-ux-pro-max');
+  fs.mkdirSync(path.join(root, 'scripts'), { recursive: true }); fs.mkdirSync(path.join(root, 'data'));
+  fs.writeFileSync(path.join(root, 'SKILL.md'), '---\nname: ui-ux-pro-max\n---\nOfficial test provider');
+  for (const file of ['core.py', 'design_system.py']) fs.writeFileSync(path.join(root, 'scripts', file), '# fixture\n');
+  fs.writeFileSync(path.join(root, 'scripts/search.py'), 'import json, sys\nvalue = {"design_system":{"style":{},"colors":{},"typography":{}}} if "--design-system" in sys.argv else {"domain":"stack","stack":"vue","results":[{"title":"ref"}]} if "--stack" in sys.argv else {"domain":"ux","results":[{"title":"validation"}]}\nprint(json.dumps(value))\n');
+  for (const name of ['ux-guidelines', 'styles', 'colors', 'typography', 'products', 'landing', 'ui-reasoning']) fs.writeFileSync(path.join(root, 'data', name + '.csv'), 'title\nvalidation\n');
+  fs.writeFileSync(path.join(root, 'UPSTREAM-ORIGIN.json'), JSON.stringify({ packageName: 'ui-ux-pro-max-cli', version }));
+  return { project, root, home: path.join(project, 'home'), host: 'codebuddy', env: {}, tool: path.join(project, 'no-cli') };
+}
+
+for (const [version, relation, availability] of [['2.15.0', 'same', 'available'], ['2.16.0', 'higher', 'available'], ['2.14.0', 'lower', 'upgrade-required'], ['unknown', 'unknown', 'unusable']]) {
+  test(`UI/UX Pro Max ${version} gets ${relation} handling without writes`, t => {
+    const options = design(t, version), before = fs.readdirSync(options.root, { recursive: true });
+    const checked = deps.check(options);
+    assert.equal(checked.design.versionRelation, relation);
+    assert.equal(checked.design.availability, availability);
+    assert.deepEqual(fs.readdirSync(options.root, { recursive: true }), before);
+    assert.equal(fs.existsSync(path.join(options.root, 'scripts/__pycache__')), false);
+  });
+}
+
+test('higher UI/UX Pro Max must support design-system and Vue queries', t => {
+  const options = design(t, '2.16.0');
+  fs.writeFileSync(path.join(options.root, 'scripts/search.py'), 'import json, sys\nif "--design-system" in sys.argv: raise SystemExit(1)\nprint(json.dumps({"domain":"ux","results":[{}]}))\n');
+  const checked = deps.check(options);
+  assert.equal(checked.design.availability, 'unusable');
+  assert.throws(() => deps.assertPreparable(checked), /ui-ux-pro-max.*检查未通过/);
+});
+
+test('higher UI/UX Pro Max returning unrelated successful JSON is incompatible', t => {
+  const options = design(t, '2.16.0');
+  fs.writeFileSync(path.join(options.root, 'scripts/search.py'), 'import json, sys\nprint(json.dumps({"status":"unsupported"} if "--design-system" in sys.argv else {"domain":"ux","results":[{}]}))\n');
+  assert.equal(deps.check(options).design.availability, 'unusable');
+});
+
+test('an unusable provider blocks preparation before any installation writes', async t => {
+  const options = design(t, 'unknown'), before = fs.readdirSync(options.project, { recursive: true });
+  await assert.rejects(deps.prepare({ ...options, accept: true }), /ui-ux-pro-max.*检查未通过/);
+  assert.deepEqual(fs.readdirSync(options.project, { recursive: true }), before);
+});
+
+test('Codex dependency inspection never creates a missing config directory', t => {
+  const options = design(t, '2.15.0');
+  const before = fs.readdirSync(options.project, { recursive: true });
+  const checked = deps.check({ ...options, host: 'codex' });
+  assert.equal(checked.design.availability, 'missing');
+  assert.deepEqual(fs.readdirSync(options.project, { recursive: true }), before);
+  assert.equal(fs.existsSync(path.join(options.home, '.codex')), false);
+});
+
+test('native provider lookup follows the selected host registry, including Cursor shared project skills', t => {
+  const options = design(t, '2.15.0'), location = deps.context({ ...options, host: 'cursor' });
+  const root = path.join(location.projectSkills, 'ui-ux-pro-max');
+  fs.mkdirSync(path.dirname(root), { recursive: true }); fs.renameSync(options.root, root);
+  const checked = deps.check({ ...options, host: 'cursor' });
+  assert.equal(checked.design.availability, 'available', checked.design.reason);
+  assert.equal(checked.design.root, root);
+  assert.equal(checked.design.source, 'project-skill');
+});
+
+test('a broken active project Skill cannot be hidden by a healthy global copy', t => {
+  const options = design(t, '2.15.0');
+  const global = path.join(options.home, '.codebuddy/skills/ui-ux-pro-max');
+  fs.mkdirSync(path.dirname(global), { recursive: true }); fs.cpSync(options.root, global, { recursive: true });
+  fs.unlinkSync(path.join(options.root, 'scripts/core.py'));
+  const checked = deps.check(options);
+  assert.equal(checked.design.availability, 'unusable');
+  assert.equal(checked.design.root, options.root);
+});
+
+test('Codex reuses one registered plugin through read-only metadata without launching its CLI', t => {
+  const options = design(t, '2.16.0'), config = path.join(options.home, '.codex');
+  const plugin = path.join(config, 'plugins/cache/ui-ux-pro-max-skill/ui-ux-pro-max/2.16.0');
+  const root = path.join(plugin, '.claude/skills/ui-ux-pro-max');
+  fs.mkdirSync(path.dirname(root), { recursive: true }); fs.renameSync(options.root, root);
+  fs.mkdirSync(path.join(plugin, '.claude-plugin'));
+  fs.writeFileSync(path.join(plugin, '.claude-plugin/plugin.json'), JSON.stringify({ name: 'ui-ux-pro-max', version: '2.16.0', skills: './.claude/skills/' }));
+  fs.writeFileSync(path.join(config, 'config.toml'), '[plugins."ui-ux-pro-max@ui-ux-pro-max-skill"]\nenabled = true\n');
+  const before = fs.readdirSync(options.home, { recursive: true });
+  const checked = deps.check({ ...options, host: 'codex' });
+  assert.equal(checked.design.availability, 'available', checked.design.reason);
+  assert.equal(checked.design.versionRelation, 'higher');
+  assert.equal(checked.design.root, root);
+  assert.deepEqual(fs.readdirSync(options.home, { recursive: true }), before);
+  fs.writeFileSync(path.join(config, 'config.toml'), '[plugins."ui-ux-pro-max@ui-ux-pro-max-skill"]\nenabled = false\n');
+  assert.equal(deps.check({ ...options, host: 'codex' }).design.availability, 'disabled');
+});
+
+test('a requested version and successful exit do not hide stale CLI output', t => {
+  const { root, options } = official(t, true);
+  const result = deps.inspectOfficial(root, options);
+  assert.equal(result.availability, 'unusable');
+  assert.match(result.reason, /data|query|match/i);
+});
+
+test('official probing rejects missing data, modified source and modified build output', t => {
+  for (const file of ['data/v1.6.0.json', 'bin/antdv.js', 'dist/index.mjs']) {
+    const { root, options } = official(t);
+    fs.writeFileSync(path.join(root, file), 'tampered');
+    assert.equal(deps.inspectOfficial(root, options).availability, 'unusable');
+  }
+});
+
+test('declining required preparation ends the flow with zero project writes', async t => {
+  const project = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ui-demo-decline-')));
+  t.after(() => fs.rmSync(project, { recursive: true, force: true }));
+  const result = await deps.prepare({ project, host: 'codebuddy', decision: 'decline' });
+  assert.equal(result.status, 'declined');
+  assert.equal(result.continue, false);
+  assert.deepEqual(fs.readdirSync(project), []);
+});
+
+test('preparing a design provider preserves an existing Skill before starting installation', async t => {
+  const project = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ui-demo-design-preserve-')));
+  t.after(() => fs.rmSync(project, { recursive: true, force: true }));
+  const location = deps.context({ project, home: project, host: 'codex', scope: 'project' });
+  const destination = path.join(location.skillsDirectory, 'ui-ux-pro-max');
+  fs.mkdirSync(destination, { recursive: true });
+  fs.writeFileSync(path.join(destination, 'manual.txt'), 'manual edits');
+  await assert.rejects(() => deps.prepareDesign(location), /Existing design Skill preserved/);
+  assert.equal(fs.readFileSync(path.join(destination, 'manual.txt'), 'utf8'), 'manual edits');
+  assert.equal(fs.existsSync(deps.toolDirectory(location)), false);
+});
+
+test('design commands point at the final project or global scope, including paths with spaces', t => {
+  const base = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ui-demo-design-path-')));
+  t.after(() => fs.rmSync(base, { recursive: true, force: true }));
+  for (const scope of ['project', 'global']) {
+    const root = path.join(base, scope); fs.mkdirSync(root);
+    const old = '.agents/skills/ui-ux-pro-max/scripts/search.py';
+    fs.writeFileSync(path.join(root, 'SKILL.md'), `Official instructions retained\npython3 ${old} query\n`);
+    fs.writeFileSync(path.join(root, 'UPSTREAM-ORIGIN.json'), JSON.stringify({ version: '2.15.0', pathParameters: { script: old, command: old } }));
+    const project = path.join(base, 'business'), destination = path.join(scope === 'global' ? base + '/private home' : project, '.agents/skills/ui-ux-pro-max');
+    deps.parameterizeDesign(root, { scope, project }, destination);
+    const receipt = JSON.parse(fs.readFileSync(path.join(root, 'UPSTREAM-ORIGIN.json')));
+    assert.equal(receipt.pathParameters.script, (scope === 'global' ? path.join(destination, 'scripts/search.py') : old).split(path.sep).join('/'));
+    assert.ok(fs.readFileSync(path.join(root, 'SKILL.md'), 'utf8').includes('python3 ' + receipt.pathParameters.command + ' query'));
+    assert.ok(fs.readFileSync(path.join(root, 'SKILL.md'), 'utf8').startsWith('Official instructions retained\n'));
+    assert.equal(path.isAbsolute(receipt.pathParameters.script), scope === 'global');
+  }
+});

package/scripts/ui-demo-mcp-test.js

@@ -0,0 +1,95 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const installation = path.join(__dirname, 'lib/installation.js');
+const skills = fs.existsSync(installation) ? require(installation).loadInstallation().skillsDirectory : path.resolve(__dirname, '../skills');
+const mcp = require(path.join(skills, 'i3-ui-demo/scripts/mcp.cjs'));
+function fixture(t) { const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ui-demo-mcp-'))); t.after(() => fs.rmSync(root, { recursive: true, force: true })); return root; }
+
+test('MCP planning is read-only and applying requires an explicit write flag', t => {
+  const project = fixture(t);
+  const plan = mcp.plan({ project, host: 'codebuddy', scope: 'project' });
+  assert.equal(plan.status, 'needs-configuration');
+  assert.deepEqual(fs.readdirSync(project), []);
+  assert.throws(() => mcp.apply({ project, host: 'codebuddy', scope: 'project', expected: plan.digest }), /write|authorization/);
+  assert.deepEqual(fs.readdirSync(project), []);
+});
+
+test('CodeBuddy configuration preserves unrelated settings and reuses the first existing priority file', t => {
+  const project = fixture(t), file = path.join(project, 'mcp.json');
+  fs.writeFileSync(file, JSON.stringify({ mcpServers: { other: { command: 'other-server' } }, retained: { owner: 'user' } }));
+  const options = { project, host: 'codebuddy', scope: 'project' }, before = mcp.plan(options);
+  assert.equal(before.file, file);
+  const result = mcp.apply({ ...options, write: true, expected: before.digest });
+  assert.equal(result.connectionVerified, false);
+  const after = JSON.parse(fs.readFileSync(file));
+  assert.equal(after.mcpServers.other.command, 'other-server');
+  assert.deepEqual(after.retained, { owner: 'user' });
+  assert.ok(after.mcpServers['chrome-devtools'].args.includes('--isolated'));
+  assert.equal(fs.existsSync(path.join(project, '.mcp.json')), false);
+  assert.equal(mcp.plan(options).status, 'configured-unverified');
+});
+
+test('MCP configuration never overwrites a conflicting server or a concurrent edit', t => {
+  const project = fixture(t), file = path.join(project, '.mcp.json');
+  fs.writeFileSync(file, JSON.stringify({ mcpServers: { 'chrome-devtools': { command: 'custom' } } }));
+  const original = fs.readFileSync(file), options = { project, host: 'codebuddy' };
+  assert.equal(mcp.plan(options).status, 'conflict');
+  assert.throws(() => mcp.apply({ ...options, write: true, expected: mcp.plan(options).digest }), /conflict/);
+  assert.deepEqual(fs.readFileSync(file), original);
+  fs.writeFileSync(file, '{}');
+  const before = mcp.plan(options);
+  fs.writeFileSync(file, '{"later":"user edit"}');
+  assert.throws(() => mcp.apply({ ...options, write: true, expected: before.digest }), /changed/);
+  assert.equal(fs.readFileSync(file, 'utf8'), '{"later":"user edit"}');
+});
+
+test('Codex adds a TOML table while preserving all existing text and distinguishes configuration from connection', t => {
+  const project = fixture(t), directory = path.join(project, '.codex'); fs.mkdirSync(directory);
+  const file = path.join(directory, 'config.toml'), initial = '# user settings\nmodel = "existing"\n\n[mcp_servers.other]\ncommand = "other"\n';
+  fs.writeFileSync(file, initial);
+  const options = { project, host: 'codex' }, before = mcp.plan(options);
+  const after = mcp.apply({ ...options, write: true, expected: before.digest });
+  assert.ok(fs.readFileSync(file, 'utf8').startsWith(initial));
+  assert.match(fs.readFileSync(file, 'utf8'), /\[mcp_servers\.chrome-devtools\]/);
+  assert.equal(after.status, 'configured-unverified');
+  assert.equal(after.connectionVerified, false);
+});
+
+test('MCP preparation refuses symlinks and unsupported host guesses without writing', t => {
+  const project = fixture(t), outside = fixture(t), target = path.join(outside, 'private.json'); fs.writeFileSync(target, '{}');
+  fs.symlinkSync(target, path.join(project, '.mcp.json'));
+  assert.throws(() => mcp.plan({ project, host: 'codebuddy' }), /symlink/);
+  assert.throws(() => mcp.plan({ project, host: 'unknown-host' }), /host|config/);
+  assert.equal(fs.readFileSync(target, 'utf8'), '{}');
+});
+
+test('new MCP filesystem access is scoped to the canonical business project, including paths with spaces', t => {
+  const root = fixture(t), project = path.join(root, 'business project'); fs.mkdirSync(project);
+  for (const host of ['codebuddy', 'codex']) {
+    const options = { project, host }, before = mcp.plan(options);
+    assert.deepEqual(before.server.args.slice(-2), ['--workspace', fs.realpathSync(project)]);
+    mcp.apply({ ...options, write: true, expected: before.digest });
+    const content = fs.readFileSync(before.file, 'utf8');
+    const args = host === 'codebuddy' ? JSON.parse(content).mcpServers['chrome-devtools'].args
+      : JSON.parse(content.match(/^args = (.+)$/m)[1]);
+    assert.deepEqual(args.slice(-2), ['--workspace', fs.realpathSync(project)]);
+    assert.equal(args.includes('--allowUnrestrictedPaths'), false);
+    const original = fs.readFileSync(before.file);
+    mcp.apply({ ...options, write: true, expected: mcp.plan(options).digest });
+    assert.deepEqual(fs.readFileSync(before.file), original);
+  }
+});
+
+test('existing real-browser attachment flags require review and are preserved in JSON and TOML', t => {
+  for (const flag of ['--autoConnect', '--browserUrl=http://localhost:9222', '--browser-url', '--wsEndpoint', '-u', '-w', '--userDataDir']) {
+    const project = fixture(t), file = path.join(project, '.mcp.json');
+    fs.writeFileSync(file, JSON.stringify({ mcpServers: { 'chrome-devtools': { command: 'npx', args: ['chrome-devtools-mcp', flag] } } }));
+    assert.equal(mcp.plan({ project, host: 'codebuddy' }).status, 'conflict', flag);
+    const directory = path.join(project, '.codex'); fs.mkdirSync(directory);
+    fs.writeFileSync(path.join(directory, 'config.toml'), `[mcp_servers.chrome-devtools]\ncommand="npx"\nargs=["chrome-devtools-mcp",${JSON.stringify(flag)}]\n`);
+    assert.equal(mcp.plan({ project, host: 'codex' }).status, 'conflict', flag);
+  }
+});