@givolt/i3-composer-agent 3.0.0 → 3.1.0

package/hooks/manage.cjs

@@ -8,14 +8,15 @@ const catalog=[
  {id:'session-start',name:'Skill 发现与路由',origin:'upstream',files:['session-start.sh'],events:['SessionStart'],dependencies:['bash','jq'],condition:'明确 skill-routing=hook；原生路由使用 native，避免重复注入'},
  {id:'sdd-cache',name:'官方文档请求缓存',origin:'upstream',files:['sdd-cache-pre.sh','sdd-cache-post.sh'],events:['PreToolUse','PostToolUse'],dependencies:['bash','jq','curl','sha256'],condition:'实际 WebFetch；仅源站 304 复用'},
  {id:'simplify-ignore',name:'代码块简化保护',origin:'upstream',files:['simplify-ignore.sh'],events:['PreToolUse','PostToolUse','Stop'],dependencies:['bash','jq','sha1'],condition:'使用 simplify-ignore 标记；会在运行期间替换标记块并在 Stop 恢复'},
- {id:'prototype',name:'原型执行审计',origin:'i3',events:['SessionStart','UserPromptSubmit','PreToolUse','PostToolUse','Stop'],dependencies:['node'],condition:'CodeBuddy IDE/CLI 与 WorkBuddy；原生回调识别身份和日志，有限补调；真实宿主验收另记'},
 ];
 const digest=value=>crypto.createHash('sha256').update(JSON.stringify(value)).digest('hex');
 const sha=bytes=>crypto.createHash('sha256').update(bytes).digest('hex');
 const json=value=>JSON.stringify(value,null,2)+'\n';
 function selection(value,action='check') {
- const ids=value===undefined?(['check','list'].includes(action)?catalog.map(x=>x.id):['prototype']):value==='all'?catalog.map(x=>x.id):value.split(',');
- assert.ok(ids.length&&ids.every(id=>catalog.some(item=>item.id===id)),'Unknown Hook group; choose session-start,sdd-cache,simplify-ignore,prototype or all');
+ if(action==='enable')assert.ok(value!==undefined,'Choose explicit Hook groups before enabling; no groups are enabled by default');
+ const ids=value===undefined?(['check','list'].includes(action)?catalog.map(x=>x.id):action==='disable'?['prototype']:[]):value==='all'?catalog.map(x=>x.id):value.split(',');
+ assert.ok(ids.every(id=>id==='prototype'||catalog.some(item=>item.id===id)),'Unknown Hook group; choose session-start,sdd-cache,simplify-ignore or all');
+ assert.ok(action!=='enable'||!ids.includes('prototype'),'Prototype audit Hooks are retired and cannot be enabled');
  return [...new Set(ids)];
 }
 function quote(value){assert.ok(typeof value==='string'&&!/[\x00\r\n]/.test(value),'Unsafe Hook argument');return "'"+value.replaceAll("'","'\\''")+"'";}
@@ -82,7 +83,7 @@ function executable(name,env=process.env) {
 }
 function dependencies(){return Object.fromEntries(['bash','jq','curl','shasum','sha256sum','sha1sum'].map(name=>[name,executable(name)]));}
 function location(options) {
- assert.ok(['codebuddy','workbuddy'].includes(options.host||'codebuddy'),'Unified prototype Hooks support CodeBuddy and WorkBuddy');assert.ok(['project','global'].includes(options.scope),'Specify project or global scope');
+ assert.ok(['codebuddy','workbuddy'].includes(options.host||'codebuddy'),'Hook management supports CodeBuddy and WorkBuddy');assert.ok(['project','global'].includes(options.scope),'Specify project or global scope');
  const project=fs.realpathSync(path.resolve(options.project||'.'));assert.ok(fs.statSync(project).isDirectory(),'Project must be a directory');
  return {project,base:options.scope==='project'?path.join(project,'.codebuddy'):modules().P.globalBase(options)};
 }
@@ -103,44 +104,41 @@ function pendingSimplify(base) {
 }
 function prepare(options,runtime={}) {
  const {P,R}=runtime.modules||modules(),{project,base}=runtime.location||location(options),io=R.fileIO,requested=options.action||'keep',ids=selection(options.groups,requested),host=options.host||'codebuddy';
+ const action=requested==='default'?'keep':requested;
  const settingsPath=path.join(base,'settings.json'),recordPath=path.join(base,'state/i3-composer-agent/hooks.json'),prototypePath=path.join(base,'state/i3-prototype/installation.json');
- const before=io.read(settingsPath),recordText=io.read(recordPath),record=recordText?JSON.parse(recordText):null,prototypeText=io.read(prototypePath),prototype=prototypeText?JSON.parse(prototypeText):null;
- const requestedHosts=[...new Set(options.scope==='project'?(options.agents||[host]).filter(h=>['codebuddy','workbuddy'].includes(h)):[host])];
- const disabled=new Set(record?.prototypeDisabledHosts||[]);
- if(requested==='enable'&&ids.includes('prototype'))for(const h of requestedHosts)disabled.delete(h);
- if(requested==='disable'&&ids.includes('prototype'))for(const h of requestedHosts)disabled.add(h);
- const selectedHosts=requested==='default'?requestedHosts.filter(h=>!disabled.has(h)):requestedHosts;
- const action=requested==='default'?(selectedHosts.length&&process.platform!=='win32'?'enable':'keep'):requested;
- const activeHosts=prototype?.hosts||(prototype?['codebuddy']:[]);
- const hosts=action==='disable'?activeHosts.filter(h=>!requestedHosts.includes(h)):[...new Set([...activeHosts,...selectedHosts])].sort();
- if(action!=='disable'&&(action!=='keep'||record||prototype))assert.ok(process.platform!=='win32','Buddy Hook quoting on Windows has not been validated; explicit keep remains available');
- const product='auto',settings=config(before);
- if(action!=='disable'&&(action!=='keep'||record||prototype)) {
+ const before=io.read(settingsPath),recordText=io.read(recordPath),record=recordText?JSON.parse(recordText):null,prototypeText=io.read(prototypePath);
+ const settings=config(before);
+ if(action==='enable') {
+  assert.ok(process.platform!=='win32','Buddy Hook quoting on Windows has not been validated');
   assert.ok(!settings.disableAllHooks&&!settings.allowManagedHooksOnly,'Host policy prevents automatic Hooks; preserve the policy');
+  assert.equal(host,'codebuddy','WorkBuddy upstream Hook adapters are not supported');
+  for(const id of ids)assert.ok(!unmanaged(settings).some(item=>item.id===id),`Unmanaged ${id} Hook already exists; preserve it and resolve the duplicate before enabling`);
  }
- if(host==='workbuddy')assert.ok(ids.every(id=>id==='prototype')||['check','list','keep'].includes(action),'WorkBuddy currently registers the prototype group only; upstream adapters remain CodeBuddy-specific');
- if(action==='enable')for(const id of ids)assert.ok(!unmanaged(settings).some(item=>item.id===id),`Unmanaged ${id} Hook already exists; preserve it and resolve the duplicate before enabling`);
  if(ids.includes('simplify-ignore')&&['enable','disable'].includes(action)) {
   for(const candidate of [...new Set([base,path.join(project,'.codebuddy'),P.globalBase?P.globalBase(options):path.join(options.home||os.homedir(),'.codebuddy')])])assert.equal((runtime.pendingSimplify||pendingSimplify)(candidate).length,0,'Simplify protection is still active; finish the session and restore blocks before changing Hooks');
  }
- const prototypeAction=ids.includes('prototype')?(action==='disable'&&hosts.length?'keep':action):'keep';
- const prototypeChange=action==='disable'&&!ids.includes('prototype')?{unchanged:true}:P.prepare({...options,project,product,hosts,action:prototypeAction,entryPath:path.join(base,'i3-composer-agent/hooks/i3-prototype.cjs'),entrySource:path.join(__dirname,'i3-prototype.cjs')});
+ // Retire the entire prototype group, including shared Buddy registrations.
+ // The legacy planner validates exact ownership; unknown/user-modified entries stop here.
+ const prototypeChange=P.prepare({...options,project,action:'disable',hosts:[],entryPath:path.join(base,'i3-composer-agent/hooks/i3-prototype.cjs')});
  const upstream=planUpstream({...options,base,product:record?.product||options.product,action,record,settingsText:prototypeChange.unchanged?before:prototypeChange.afterText,nodePath:process.execPath,
   hookDirectory:path.join(base,'i3-composer-agent/hooks'),scriptDigest:runtime.scriptDigest||require('./codebuddy-upstream.cjs').bundle(),dependencies:runtime.dependencies||dependencies()});
- if(disabled.size)upstream.recordAfter={...(upstream.recordAfter||{schemaVersion:1,owner:OWNER,base,scope:options.scope,product:record?.product||'auto',groups:{}}),prototypeDisabledHosts:[...disabled].sort()};
- const changes=[{file:settingsPath,before,after:upstream.afterText},{file:recordPath,before:recordText,after:upstream.recordAfter?json(upstream.recordAfter):null},
-  {file:prototypePath,before:prototypeText,after:prototypeChange.unchanged?prototypeText:prototypeChange.recordAfter?json(prototypeChange.recordAfter):null}];
- return {changes,summary:{host,scope:options.scope,base,product,action,requestedAction:requested,groups:ids,enabledHosts:prototypeChange.unchanged?activeHosts:prototypeChange.recordAfter?.hosts||[],disabledHosts:[...disabled].sort(),changed:changes.some(item=>item.before!==item.after),
-  enabledGroups:[...Object.keys(upstream.recordAfter?.groups||{}),...((prototypeChange.unchanged?prototype:prototypeChange.recordAfter)?['prototype']:[])],
-  ...(prototypeChange.summary?.transcript?{transcript:prototypeChange.summary.transcript}:{}),
-  next:'Desktop: reload; CodeBuddy CLI: review /hooks. Host identity, actual Skill invocation and recovery require native validation.'}};
+ const changes=[{file:settingsPath,before,after:upstream.afterText},{file:recordPath,before:recordText,after:upstream.recordAfter?json(upstream.recordAfter):null}];
+ if(prototypeText&&!prototypeChange.unchanged) {
+  const archive=path.join(base,'state/i3-prototype/history','retired-'+sha(prototypeText)+'.json'),previous=io.read(archive);
+  assert.ok(previous===null||previous===prototypeText,'Retired registration history differs; preserve it for review');
+  changes.push({file:archive,before:previous,after:prototypeText});
+ }
+ changes.push({file:prototypePath,before:prototypeText,after:prototypeChange.unchanged?prototypeText:null});
+ return {changes,summary:{host,scope:options.scope,base,product:record?.product||options.product||'auto',action,requestedAction:requested,groups:ids.filter(id=>id!=='prototype'),enabledHosts:[],
+  changed:changes.some(item=>item.before!==item.after),enabledGroups:Object.keys(upstream.recordAfter?.groups||{}),retiredGroups:['prototype'],prototypeRegistrationRemoved:!!prototypeText&&!prototypeChange.unchanged,
+  next:'Prototype audit Hooks are retired. Existing owned callbacks are removed; other Hook groups and user settings are preserved. Reload an affected host after cleanup.'}};
 }
 function check(options) {
  const {P,R}=modules(),{project,base}=location(options),io=R.fileIO,ids=selection(options.groups,options.action||'check'),settingsText=io.read(path.join(base,'settings.json')),settings=config(settingsText),deps=dependencies(),items=[];
  let record=null,error=null;try{record=require('./codebuddy-upstream.cjs').registration(base);}catch(e){error=e.message;}
  for(const id of ids) {
-  const item=catalog.find(x=>x.id===id),entry=path.join(base,'i3-composer-agent/hooks',id==='prototype'?'i3-prototype.cjs':'codebuddy-upstream.cjs');
-  if(id==='prototype'){try{const result=P.check({...options,project});items.push({...item,...result,...(result.effective===false&&result.status!=='failed'?{status:'shadowed'}:{}),entryPath:entry});}catch(e){items.push({...item,status:'failed',reason:e.message,entryPath:entry});}continue;}
+  if(id==='prototype')continue;
+  const item=catalog.find(x=>x.id===id),entry=path.join(base,'i3-composer-agent/hooks','codebuddy-upstream.cjs');
   const missingFiles=[entry,...item.files.map(file=>path.join(base,'i3-composer-agent/hooks',file))].filter(file=>!fs.existsSync(file));
   const row={...item,entryPath:entry,filesPresent:missingFiles.length===0,missingFiles,status:missingFiles.length?'not-installed':'files-present',invocationVerified:false,nativeValidation:'pending-user'};
   try{requirements(id,deps);}catch(e){row.dependencyIssue=e.message;}
@@ -154,12 +152,13 @@ function check(options) {
   }catch(e){row.status='failed';row.reason=e.message;}
   items.push(row);
  }
- return {host:options.host||'codebuddy',scope:options.scope,base,readOnly:true,changed:false,status:items.some(item=>item.status==='failed')?'failed':'checked',hooks:items,unmanagedHooks:unmanaged(settings),
+ const retired=P.check({...options,project});
+ return {host:options.host||'codebuddy',scope:options.scope,base,readOnly:true,changed:false,status:items.some(item=>item.status==='failed')||retired.status==='failed'?'failed':'checked',hooks:items,retiredHooks:[{id:'prototype',...retired}],unmanagedHooks:unmanaged(settings),
   next:'files-present is not enabled; registered is not triggered; triggered is not business acceptance. CLI: review /hooks; IDE: reload.'};
 }
 function configure(options){const change=prepare(options);return options.preview?change.summary:apply(change);}
 function main(argv=process.argv.slice(2)) {
- if(argv.includes('--help'))return {usage:'node manage.cjs list|check|enable|disable --host codebuddy|workbuddy --scope project|global --project <directory> [--groups <ids>|all] [--product auto|ide|cli] [--skill-routing hook] [--transcript-root <native-directory>|auto]',hooks:catalog,default:'Installer defaults prototype, preserving explicit disable; management enable/disable default prototype; list/check default all; identity/transcripts auto for new registrations',nativeValidation:'pending-user'};
+ if(argv.includes('--help'))return {usage:'node manage.cjs list|check|enable|disable --host codebuddy|workbuddy --scope project|global --project <directory> [--groups <ids>|all] [--product auto|ide|cli] [--skill-routing hook] [--transcript-root <native-directory>|auto]',hooks:catalog,default:'No automatic Hook registration. Enable requires explicit upstream groups; prototype audit is retired and its old registrations are cleaned during upgrades',nativeValidation:'pending-user'};
  const options={action:argv.shift()||'list',host:'codebuddy',project:process.cwd()};
  assert.ok(['list','check','enable','disable','keep'].includes(options.action),'Choose list, check, enable or disable');
  while(argv.length){const arg=argv.shift();assert.ok(arg.startsWith('--')&&argv[0]&&!argv[0].startsWith('--'),'Hook option needs a value');const key=arg.slice(2).replace(/-([a-z])/g,(_,c)=>c.toUpperCase());assert.ok(['host','scope','project','product','productVersion','transcriptRoot','groups','skillRouting'].includes(key),'Unknown Hook option');options[key]=argv.shift();}

package/package.json

@@ -56,6 +56,7 @@
     "evals/cases/i3-source-driven-development.json",
     "evals/cases/i3-spec-driven-development.json",
     "evals/cases/i3-test-driven-development.json",
+    "evals/cases/i3-ui-demo.json",
     "evals/cases/i3-ui-prototype.json",
     "evals/cases/i3-using-agent-skills.json",
     "evals/fixtures/i3-api-and-interface-design/service-brief.md",
@@ -102,6 +103,7 @@
     "evals/fixtures/i3-test-driven-development/package.json",
     "evals/fixtures/i3-test-driven-development/src/split.js",
     "evals/fixtures/i3-test-driven-development/test/split.test.js",
+    "evals/fixtures/i3-ui-demo/asset-management.md",
     "evals/fixtures/i3-ui-prototype/admin-list/assets/reference.css",
     "evals/fixtures/i3-ui-prototype/admin-list/assets/reference.js",
     "evals/fixtures/i3-ui-prototype/admin-list/capability-definition.json",
@@ -156,6 +158,7 @@
     "evals/zh-CN/cases/i3-source-driven-development.json",
     "evals/zh-CN/cases/i3-spec-driven-development.json",
     "evals/zh-CN/cases/i3-test-driven-development.json",
+    "evals/zh-CN/cases/i3-ui-demo.json",
     "evals/zh-CN/cases/i3-ui-prototype.json",
     "evals/zh-CN/cases/i3-using-agent-skills.json",
     "docs/adoption-guide.md",
@@ -165,15 +168,27 @@
     "docs/codebuddy-setup.md",
     "docs/codex-setup.md",
     "docs/commandcode-setup.md",
+    "docs/comparison.md",
     "docs/copilot-cli-setup.md",
     "docs/copilot-setup.md",
     "docs/cursor-setup.md",
+    "docs/developer-onboarding.md",
     "docs/gemini-cli-setup.md",
     "docs/getting-started.md",
     "docs/opencode-setup.md",
     "docs/other-hosts.md",
-    "docs/ui-prototype-native/MAIN-SESSION-REPORT.md",
-    "docs/ui-prototype-native/USAGE.md",
+    "docs/skill-anatomy.md",
+    "docs/upstream-repository/AGENTS.md",
+    "docs/upstream-repository/CLAUDE.md",
+    "docs/upstream-repository/CONTRIBUTING.md",
+    "docs/upstream-repository/README.md",
+    "docs/upstream-repository/gitattributes.txt",
+    "docs/upstream-repository/gitignore.txt",
+    "docs/upstream-repository/manifest.json",
+    "docs/upstream-repository/opencode-skills.link",
+    "docs/upstream-repository/skill-gap.yml",
+    "docs/upstream-repository/skills-contributing.md",
+    "docs/upstream-repository/test-plugin-install.yml",
     "docs/windsurf-setup.md",
     "docs/workbuddy-setup.md",
     "plugin.json",
@@ -198,6 +213,9 @@
     "scripts/run-evals.js",
     "scripts/run-regressions.js",
     "scripts/template-adapter-test.js",
+    "scripts/ui-demo-dependencies-test.js",
+    "scripts/ui-demo-mcp-test.js",
+    "scripts/ui-demo-test.js",
     "scripts/ui-prototype-binding-recovery-test.js",
     "scripts/ui-prototype-buddy-lifecycle-test.js",
     "scripts/ui-prototype-codebuddy-hook-test.js",
@@ -241,6 +259,7 @@
     "claude-code"
   ],
   "i3ComposerAgent": {
+    "prototypeAuditHooks": "retired",
     "pluginFiles": [
       "bin",
       "skills",
@@ -279,6 +298,7 @@
       "evals/cases/i3-source-driven-development.json",
       "evals/cases/i3-spec-driven-development.json",
       "evals/cases/i3-test-driven-development.json",
+      "evals/cases/i3-ui-demo.json",
       "evals/cases/i3-ui-prototype.json",
       "evals/cases/i3-using-agent-skills.json",
       "evals/fixtures/i3-api-and-interface-design/service-brief.md",
@@ -325,6 +345,7 @@
       "evals/fixtures/i3-test-driven-development/package.json",
       "evals/fixtures/i3-test-driven-development/src/split.js",
       "evals/fixtures/i3-test-driven-development/test/split.test.js",
+      "evals/fixtures/i3-ui-demo/asset-management.md",
       "evals/fixtures/i3-ui-prototype/admin-list/assets/reference.css",
       "evals/fixtures/i3-ui-prototype/admin-list/assets/reference.js",
       "evals/fixtures/i3-ui-prototype/admin-list/capability-definition.json",
@@ -379,6 +400,7 @@
       "evals/zh-CN/cases/i3-source-driven-development.json",
       "evals/zh-CN/cases/i3-spec-driven-development.json",
       "evals/zh-CN/cases/i3-test-driven-development.json",
+      "evals/zh-CN/cases/i3-ui-demo.json",
       "evals/zh-CN/cases/i3-ui-prototype.json",
       "evals/zh-CN/cases/i3-using-agent-skills.json",
       "docs/adoption-guide.md",
@@ -388,15 +410,27 @@
       "docs/codebuddy-setup.md",
       "docs/codex-setup.md",
       "docs/commandcode-setup.md",
+      "docs/comparison.md",
       "docs/copilot-cli-setup.md",
       "docs/copilot-setup.md",
       "docs/cursor-setup.md",
+      "docs/developer-onboarding.md",
       "docs/gemini-cli-setup.md",
       "docs/getting-started.md",
       "docs/opencode-setup.md",
       "docs/other-hosts.md",
-      "docs/ui-prototype-native/MAIN-SESSION-REPORT.md",
-      "docs/ui-prototype-native/USAGE.md",
+      "docs/skill-anatomy.md",
+      "docs/upstream-repository/AGENTS.md",
+      "docs/upstream-repository/CLAUDE.md",
+      "docs/upstream-repository/CONTRIBUTING.md",
+      "docs/upstream-repository/README.md",
+      "docs/upstream-repository/gitattributes.txt",
+      "docs/upstream-repository/gitignore.txt",
+      "docs/upstream-repository/manifest.json",
+      "docs/upstream-repository/opencode-skills.link",
+      "docs/upstream-repository/skill-gap.yml",
+      "docs/upstream-repository/skills-contributing.md",
+      "docs/upstream-repository/test-plugin-install.yml",
       "docs/windsurf-setup.md",
       "docs/workbuddy-setup.md",
       "plugin.json",
@@ -422,6 +456,9 @@
       "scripts/run-evals.js",
       "scripts/run-regressions.js",
       "scripts/template-adapter-test.js",
+      "scripts/ui-demo-dependencies-test.js",
+      "scripts/ui-demo-mcp-test.js",
+      "scripts/ui-demo-test.js",
       "scripts/ui-prototype-binding-recovery-test.js",
       "scripts/ui-prototype-buddy-lifecycle-test.js",
       "scripts/ui-prototype-codebuddy-hook-test.js",
@@ -450,7 +487,7 @@
       "scripts/validate-versions.js"
     ]
   },
-  "version": "3.0.0",
+  "version": "3.1.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/49780522/i3-composer-agent.git"

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "i3-composer-agent",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "description": "覆盖需求、计划、开发、测试、审查与发布的软件工程技能，默认使用简体中文。",
   "homepage": "https://github.com/49780522/i3-composer-agent",
   "repository": "https://github.com/49780522/i3-composer-agent"

package/scripts/ui-demo-dependencies-test.js

@@ -0,0 +1,228 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const installation = path.join(__dirname, 'lib/installation.js');
+const skills = fs.existsSync(installation) ? require(installation).loadInstallation().skillsDirectory : path.resolve(__dirname, '../skills');
+const deps = require(path.join(skills, 'i3-ui-demo/scripts/dependencies.cjs'));
+const hash = data => crypto.createHash('sha256').update(data).digest('hex');
+function official(t, wrongOutput = false) {
+  const base = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ui-demo-official-'))), root = path.join(base, 'source');
+  t.after(() => fs.rmSync(base, { recursive: true, force: true }));
+  for (const folder of ['data', 'bin', 'dist']) fs.mkdirSync(path.join(root, folder), { recursive: true });
+  const component = { name: 'Table', props: { properties: [{ name: 'rowKey', type: 'string' }], events: [], slots: [], methods: [] } };
+  const data = JSON.stringify({ components: [component] }), index = JSON.stringify({ v1: { '1.6': '1.6.0' } });
+  fs.writeFileSync(path.join(root, 'data/v1.6.0.json'), data);
+  fs.writeFileSync(path.join(root, 'data/versions.json'), index);
+  fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ name: '@antdv-next/cli', version: '0.0.0-beta.6', bin: { antdv: 'bin/antdv.js' } }));
+  const output = { name: 'Table', props: wrongOutput ? [{ name: 'oldVersionProp' }] : component.props.properties, events: [], slots: [], methods: [] };
+  const entry = 'process.stdout.write(' + JSON.stringify(JSON.stringify(output)) + ');';
+  fs.writeFileSync(path.join(root, 'bin/antdv.js'), entry);
+  fs.writeFileSync(path.join(root, 'dist/index.mjs'), '// test executable identity');
+  const expected = { package: '@antdv-next/cli', version: '0.0.0-beta.6', commit: 'fixed-test-snapshot', archiveSha256: 'fixed-test-archive', knowledgeVersion: '1.6.0', knowledgeFile: 'data/v1.6.0.json', knowledgeSha256: hash(data), versionIndexSha256: hash(index) };
+  fs.writeFileSync(path.join(base, 'UPSTREAM-ORIGIN.json'), JSON.stringify({ commit: expected.commit, archiveSha256: expected.archiveSha256, distSha256: hash(fs.readFileSync(path.join(root, 'dist/index.mjs'))) }));
+  return { root, options: { expected, sourceFiles: { 'bin/antdv.js': hash(entry) } } };
+}
+
+test('official probing proves actual fixed data and query results without writing', t => {
+  const { root, options } = official(t);
+  const before = fs.readdirSync(root, { recursive: true });
+  const result = deps.inspectOfficial(root, options);
+  assert.equal(result.availability, 'available');
+  assert.equal(result.knowledgeVersion, '1.6.0');
+  assert.equal(result.exactKnowledgeMatch, true);
+  assert.equal(result.invocationVerified, false);
+  assert.deepEqual(fs.readdirSync(root, { recursive: true }), before);
+});
+
+test('version policy compares prereleases numerically and rejects unknown versions', () => {
+  assert.equal(deps.versionRelation('2.15.0', '2.15.0'), 'same');
+  assert.equal(deps.versionRelation('2.16.0', '2.15.0'), 'higher');
+  assert.equal(deps.versionRelation('2.9.0', '2.15.0'), 'lower');
+  assert.equal(deps.versionRelation('0.0.0-beta.10', '0.0.0-beta.6'), 'higher');
+  assert.equal(deps.versionRelation('0.0.0', '0.0.0-beta.6'), 'higher');
+  assert.equal(deps.versionRelation('unversioned', '2.15.0'), 'unknown');
+});
+
+test('official snapshot preparation respects the unchanged builder engine requirements', () => {
+  for (const version of ['v20.19.5', 'v22.17.1', 'v23.11.0', 'v24.10.0', 'unknown']) assert.equal(deps.supportsBuild(version), false, version);
+  for (const version of ['v22.18.0', 'v22.22.0', 'v24.11.0', 'v24.15.0', 'v26.0.0']) assert.equal(deps.supportsBuild(version), true, version);
+});
+
+test('a compatible higher official CLI is preserved and still queries the fixed 1.6.0 data', t => {
+  const { root, options } = official(t);
+  const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json')));
+  pkg.version = '0.0.0-beta.10';
+  fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify(pkg));
+  const before = fs.readFileSync(path.join(root, 'package.json'));
+  const result = deps.inspectOfficial(root, options);
+  assert.equal(result.availability, 'available', result.reason);
+  assert.equal(result.versionRelation, 'higher');
+  assert.equal(result.snapshot, null, 'A retained old receipt cannot attest the source of a newer CLI');
+  assert.equal(result.knowledgeVersion, '1.6.0');
+  assert.deepEqual(fs.readFileSync(path.join(root, 'package.json')), before);
+});
+
+test('a lower CLI needs upgrading even when it exits successfully', t => {
+  const { root, options } = official(t);
+  const file = path.join(root, 'package.json'), pkg = JSON.parse(fs.readFileSync(file));
+  pkg.version = '0.0.0-beta.1'; fs.writeFileSync(file, JSON.stringify(pkg));
+  const result = deps.inspectOfficial(root, options);
+  assert.equal(result.availability, 'upgrade-required');
+  assert.equal(result.versionRelation, 'lower');
+  assert.equal(result.cliVersion, pkg.version);
+});
+
+test('a higher CLI cannot pass with stale query output', t => {
+  const { root, options } = official(t, true);
+  const file = path.join(root, 'package.json'), pkg = JSON.parse(fs.readFileSync(file));
+  pkg.version = '0.0.0-beta.10'; fs.writeFileSync(file, JSON.stringify(pkg));
+  assert.equal(deps.inspectOfficial(root, options).availability, 'unusable');
+});
+
+function design(t, version) {
+  const project = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ui-demo-design-policy-')));
+  t.after(() => fs.rmSync(project, { recursive: true, force: true }));
+  const root = path.join(project, '.codebuddy/skills/ui-ux-pro-max');
+  fs.mkdirSync(path.join(root, 'scripts'), { recursive: true }); fs.mkdirSync(path.join(root, 'data'));
+  fs.writeFileSync(path.join(root, 'SKILL.md'), '---\nname: ui-ux-pro-max\n---\nOfficial test provider');
+  for (const file of ['core.py', 'design_system.py']) fs.writeFileSync(path.join(root, 'scripts', file), '# fixture\n');
+  fs.writeFileSync(path.join(root, 'scripts/search.py'), 'import json, sys\nvalue = {"design_system":{"style":{},"colors":{},"typography":{}}} if "--design-system" in sys.argv else {"domain":"stack","stack":"vue","results":[{"title":"ref"}]} if "--stack" in sys.argv else {"domain":"ux","results":[{"title":"validation"}]}\nprint(json.dumps(value))\n');
+  for (const name of ['ux-guidelines', 'styles', 'colors', 'typography', 'products', 'landing', 'ui-reasoning']) fs.writeFileSync(path.join(root, 'data', name + '.csv'), 'title\nvalidation\n');
+  fs.writeFileSync(path.join(root, 'UPSTREAM-ORIGIN.json'), JSON.stringify({ packageName: 'ui-ux-pro-max-cli', version }));
+  return { project, root, home: path.join(project, 'home'), host: 'codebuddy', env: {}, tool: path.join(project, 'no-cli') };
+}
+
+for (const [version, relation, availability] of [['2.15.0', 'same', 'available'], ['2.16.0', 'higher', 'available'], ['2.14.0', 'lower', 'upgrade-required'], ['unknown', 'unknown', 'unusable']]) {
+  test(`UI/UX Pro Max ${version} gets ${relation} handling without writes`, t => {
+    const options = design(t, version), before = fs.readdirSync(options.root, { recursive: true });
+    const checked = deps.check(options);
+    assert.equal(checked.design.versionRelation, relation);
+    assert.equal(checked.design.availability, availability);
+    assert.deepEqual(fs.readdirSync(options.root, { recursive: true }), before);
+    assert.equal(fs.existsSync(path.join(options.root, 'scripts/__pycache__')), false);
+  });
+}
+
+test('higher UI/UX Pro Max must support design-system and Vue queries', t => {
+  const options = design(t, '2.16.0');
+  fs.writeFileSync(path.join(options.root, 'scripts/search.py'), 'import json, sys\nif "--design-system" in sys.argv: raise SystemExit(1)\nprint(json.dumps({"domain":"ux","results":[{}]}))\n');
+  const checked = deps.check(options);
+  assert.equal(checked.design.availability, 'unusable');
+  assert.throws(() => deps.assertPreparable(checked), /ui-ux-pro-max.*检查未通过/);
+});
+
+test('higher UI/UX Pro Max returning unrelated successful JSON is incompatible', t => {
+  const options = design(t, '2.16.0');
+  fs.writeFileSync(path.join(options.root, 'scripts/search.py'), 'import json, sys\nprint(json.dumps({"status":"unsupported"} if "--design-system" in sys.argv else {"domain":"ux","results":[{}]}))\n');
+  assert.equal(deps.check(options).design.availability, 'unusable');
+});
+
+test('an unusable provider blocks preparation before any installation writes', async t => {
+  const options = design(t, 'unknown'), before = fs.readdirSync(options.project, { recursive: true });
+  await assert.rejects(deps.prepare({ ...options, accept: true }), /ui-ux-pro-max.*检查未通过/);
+  assert.deepEqual(fs.readdirSync(options.project, { recursive: true }), before);
+});
+
+test('Codex dependency inspection never creates a missing config directory', t => {
+  const options = design(t, '2.15.0');
+  const before = fs.readdirSync(options.project, { recursive: true });
+  const checked = deps.check({ ...options, host: 'codex' });
+  assert.equal(checked.design.availability, 'missing');
+  assert.deepEqual(fs.readdirSync(options.project, { recursive: true }), before);
+  assert.equal(fs.existsSync(path.join(options.home, '.codex')), false);
+});
+
+test('native provider lookup follows the selected host registry, including Cursor shared project skills', t => {
+  const options = design(t, '2.15.0'), location = deps.context({ ...options, host: 'cursor' });
+  const root = path.join(location.projectSkills, 'ui-ux-pro-max');
+  fs.mkdirSync(path.dirname(root), { recursive: true }); fs.renameSync(options.root, root);
+  const checked = deps.check({ ...options, host: 'cursor' });
+  assert.equal(checked.design.availability, 'available', checked.design.reason);
+  assert.equal(checked.design.root, root);
+  assert.equal(checked.design.source, 'project-skill');
+});
+
+test('a broken active project Skill cannot be hidden by a healthy global copy', t => {
+  const options = design(t, '2.15.0');
+  const global = path.join(options.home, '.codebuddy/skills/ui-ux-pro-max');
+  fs.mkdirSync(path.dirname(global), { recursive: true }); fs.cpSync(options.root, global, { recursive: true });
+  fs.unlinkSync(path.join(options.root, 'scripts/core.py'));
+  const checked = deps.check(options);
+  assert.equal(checked.design.availability, 'unusable');
+  assert.equal(checked.design.root, options.root);
+});
+
+test('Codex reuses one registered plugin through read-only metadata without launching its CLI', t => {
+  const options = design(t, '2.16.0'), config = path.join(options.home, '.codex');
+  const plugin = path.join(config, 'plugins/cache/ui-ux-pro-max-skill/ui-ux-pro-max/2.16.0');
+  const root = path.join(plugin, '.claude/skills/ui-ux-pro-max');
+  fs.mkdirSync(path.dirname(root), { recursive: true }); fs.renameSync(options.root, root);
+  fs.mkdirSync(path.join(plugin, '.claude-plugin'));
+  fs.writeFileSync(path.join(plugin, '.claude-plugin/plugin.json'), JSON.stringify({ name: 'ui-ux-pro-max', version: '2.16.0', skills: './.claude/skills/' }));
+  fs.writeFileSync(path.join(config, 'config.toml'), '[plugins."ui-ux-pro-max@ui-ux-pro-max-skill"]\nenabled = true\n');
+  const before = fs.readdirSync(options.home, { recursive: true });
+  const checked = deps.check({ ...options, host: 'codex' });
+  assert.equal(checked.design.availability, 'available', checked.design.reason);
+  assert.equal(checked.design.versionRelation, 'higher');
+  assert.equal(checked.design.root, root);
+  assert.deepEqual(fs.readdirSync(options.home, { recursive: true }), before);
+  fs.writeFileSync(path.join(config, 'config.toml'), '[plugins."ui-ux-pro-max@ui-ux-pro-max-skill"]\nenabled = false\n');
+  assert.equal(deps.check({ ...options, host: 'codex' }).design.availability, 'disabled');
+});
+
+test('a requested version and successful exit do not hide stale CLI output', t => {
+  const { root, options } = official(t, true);
+  const result = deps.inspectOfficial(root, options);
+  assert.equal(result.availability, 'unusable');
+  assert.match(result.reason, /data|query|match/i);
+});
+
+test('official probing rejects missing data, modified source and modified build output', t => {
+  for (const file of ['data/v1.6.0.json', 'bin/antdv.js', 'dist/index.mjs']) {
+    const { root, options } = official(t);
+    fs.writeFileSync(path.join(root, file), 'tampered');
+    assert.equal(deps.inspectOfficial(root, options).availability, 'unusable');
+  }
+});
+
+test('declining required preparation ends the flow with zero project writes', async t => {
+  const project = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ui-demo-decline-')));
+  t.after(() => fs.rmSync(project, { recursive: true, force: true }));
+  const result = await deps.prepare({ project, host: 'codebuddy', decision: 'decline' });
+  assert.equal(result.status, 'declined');
+  assert.equal(result.continue, false);
+  assert.deepEqual(fs.readdirSync(project), []);
+});
+
+test('preparing a design provider preserves an existing Skill before starting installation', async t => {
+  const project = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ui-demo-design-preserve-')));
+  t.after(() => fs.rmSync(project, { recursive: true, force: true }));
+  const location = deps.context({ project, home: project, host: 'codex', scope: 'project' });
+  const destination = path.join(location.skillsDirectory, 'ui-ux-pro-max');
+  fs.mkdirSync(destination, { recursive: true });
+  fs.writeFileSync(path.join(destination, 'manual.txt'), 'manual edits');
+  await assert.rejects(() => deps.prepareDesign(location), /Existing design Skill preserved/);
+  assert.equal(fs.readFileSync(path.join(destination, 'manual.txt'), 'utf8'), 'manual edits');
+  assert.equal(fs.existsSync(deps.toolDirectory(location)), false);
+});
+
+test('design commands point at the final project or global scope, including paths with spaces', t => {
+  const base = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ui-demo-design-path-')));
+  t.after(() => fs.rmSync(base, { recursive: true, force: true }));
+  for (const scope of ['project', 'global']) {
+    const root = path.join(base, scope); fs.mkdirSync(root);
+    const old = '.agents/skills/ui-ux-pro-max/scripts/search.py';
+    fs.writeFileSync(path.join(root, 'SKILL.md'), `Official instructions retained\npython3 ${old} query\n`);
+    fs.writeFileSync(path.join(root, 'UPSTREAM-ORIGIN.json'), JSON.stringify({ version: '2.15.0', pathParameters: { script: old, command: old } }));
+    const project = path.join(base, 'business'), destination = path.join(scope === 'global' ? base + '/private home' : project, '.agents/skills/ui-ux-pro-max');
+    deps.parameterizeDesign(root, { scope, project }, destination);
+    const receipt = JSON.parse(fs.readFileSync(path.join(root, 'UPSTREAM-ORIGIN.json')));
+    assert.equal(receipt.pathParameters.script, (scope === 'global' ? path.join(destination, 'scripts/search.py') : old).split(path.sep).join('/'));
+    assert.ok(fs.readFileSync(path.join(root, 'SKILL.md'), 'utf8').includes('python3 ' + receipt.pathParameters.command + ' query'));
+    assert.ok(fs.readFileSync(path.join(root, 'SKILL.md'), 'utf8').startsWith('Official instructions retained\n'));
+    assert.equal(path.isAbsolute(receipt.pathParameters.script), scope === 'global');
+  }
+});

package/scripts/ui-demo-mcp-test.js

@@ -0,0 +1,95 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const installation = path.join(__dirname, 'lib/installation.js');
+const skills = fs.existsSync(installation) ? require(installation).loadInstallation().skillsDirectory : path.resolve(__dirname, '../skills');
+const mcp = require(path.join(skills, 'i3-ui-demo/scripts/mcp.cjs'));
+function fixture(t) { const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'ui-demo-mcp-'))); t.after(() => fs.rmSync(root, { recursive: true, force: true })); return root; }
+
+test('MCP planning is read-only and applying requires an explicit write flag', t => {
+  const project = fixture(t);
+  const plan = mcp.plan({ project, host: 'codebuddy', scope: 'project' });
+  assert.equal(plan.status, 'needs-configuration');
+  assert.deepEqual(fs.readdirSync(project), []);
+  assert.throws(() => mcp.apply({ project, host: 'codebuddy', scope: 'project', expected: plan.digest }), /write|authorization/);
+  assert.deepEqual(fs.readdirSync(project), []);
+});
+
+test('CodeBuddy configuration preserves unrelated settings and reuses the first existing priority file', t => {
+  const project = fixture(t), file = path.join(project, 'mcp.json');
+  fs.writeFileSync(file, JSON.stringify({ mcpServers: { other: { command: 'other-server' } }, retained: { owner: 'user' } }));
+  const options = { project, host: 'codebuddy', scope: 'project' }, before = mcp.plan(options);
+  assert.equal(before.file, file);
+  const result = mcp.apply({ ...options, write: true, expected: before.digest });
+  assert.equal(result.connectionVerified, false);
+  const after = JSON.parse(fs.readFileSync(file));
+  assert.equal(after.mcpServers.other.command, 'other-server');
+  assert.deepEqual(after.retained, { owner: 'user' });
+  assert.ok(after.mcpServers['chrome-devtools'].args.includes('--isolated'));
+  assert.equal(fs.existsSync(path.join(project, '.mcp.json')), false);
+  assert.equal(mcp.plan(options).status, 'configured-unverified');
+});
+
+test('MCP configuration never overwrites a conflicting server or a concurrent edit', t => {
+  const project = fixture(t), file = path.join(project, '.mcp.json');
+  fs.writeFileSync(file, JSON.stringify({ mcpServers: { 'chrome-devtools': { command: 'custom' } } }));
+  const original = fs.readFileSync(file), options = { project, host: 'codebuddy' };
+  assert.equal(mcp.plan(options).status, 'conflict');
+  assert.throws(() => mcp.apply({ ...options, write: true, expected: mcp.plan(options).digest }), /conflict/);
+  assert.deepEqual(fs.readFileSync(file), original);
+  fs.writeFileSync(file, '{}');
+  const before = mcp.plan(options);
+  fs.writeFileSync(file, '{"later":"user edit"}');
+  assert.throws(() => mcp.apply({ ...options, write: true, expected: before.digest }), /changed/);
+  assert.equal(fs.readFileSync(file, 'utf8'), '{"later":"user edit"}');
+});
+
+test('Codex adds a TOML table while preserving all existing text and distinguishes configuration from connection', t => {
+  const project = fixture(t), directory = path.join(project, '.codex'); fs.mkdirSync(directory);
+  const file = path.join(directory, 'config.toml'), initial = '# user settings\nmodel = "existing"\n\n[mcp_servers.other]\ncommand = "other"\n';
+  fs.writeFileSync(file, initial);
+  const options = { project, host: 'codex' }, before = mcp.plan(options);
+  const after = mcp.apply({ ...options, write: true, expected: before.digest });
+  assert.ok(fs.readFileSync(file, 'utf8').startsWith(initial));
+  assert.match(fs.readFileSync(file, 'utf8'), /\[mcp_servers\.chrome-devtools\]/);
+  assert.equal(after.status, 'configured-unverified');
+  assert.equal(after.connectionVerified, false);
+});
+
+test('MCP preparation refuses symlinks and unsupported host guesses without writing', t => {
+  const project = fixture(t), outside = fixture(t), target = path.join(outside, 'private.json'); fs.writeFileSync(target, '{}');
+  fs.symlinkSync(target, path.join(project, '.mcp.json'));
+  assert.throws(() => mcp.plan({ project, host: 'codebuddy' }), /symlink/);
+  assert.throws(() => mcp.plan({ project, host: 'unknown-host' }), /host|config/);
+  assert.equal(fs.readFileSync(target, 'utf8'), '{}');
+});
+
+test('new MCP filesystem access is scoped to the canonical business project, including paths with spaces', t => {
+  const root = fixture(t), project = path.join(root, 'business project'); fs.mkdirSync(project);
+  for (const host of ['codebuddy', 'codex']) {
+    const options = { project, host }, before = mcp.plan(options);
+    assert.deepEqual(before.server.args.slice(-2), ['--workspace', fs.realpathSync(project)]);
+    mcp.apply({ ...options, write: true, expected: before.digest });
+    const content = fs.readFileSync(before.file, 'utf8');
+    const args = host === 'codebuddy' ? JSON.parse(content).mcpServers['chrome-devtools'].args
+      : JSON.parse(content.match(/^args = (.+)$/m)[1]);
+    assert.deepEqual(args.slice(-2), ['--workspace', fs.realpathSync(project)]);
+    assert.equal(args.includes('--allowUnrestrictedPaths'), false);
+    const original = fs.readFileSync(before.file);
+    mcp.apply({ ...options, write: true, expected: mcp.plan(options).digest });
+    assert.deepEqual(fs.readFileSync(before.file), original);
+  }
+});
+
+test('existing real-browser attachment flags require review and are preserved in JSON and TOML', t => {
+  for (const flag of ['--autoConnect', '--browserUrl=http://localhost:9222', '--browser-url', '--wsEndpoint', '-u', '-w', '--userDataDir']) {
+    const project = fixture(t), file = path.join(project, '.mcp.json');
+    fs.writeFileSync(file, JSON.stringify({ mcpServers: { 'chrome-devtools': { command: 'npx', args: ['chrome-devtools-mcp', flag] } } }));
+    assert.equal(mcp.plan({ project, host: 'codebuddy' }).status, 'conflict', flag);
+    const directory = path.join(project, '.codex'); fs.mkdirSync(directory);
+    fs.writeFileSync(path.join(directory, 'config.toml'), `[mcp_servers.chrome-devtools]\ncommand="npx"\nargs=["chrome-devtools-mcp",${JSON.stringify(flag)}]\n`);
+    assert.equal(mcp.plan({ project, host: 'codex' }).status, 'conflict', flag);
+  }
+});