code-workspace-zhuiyi 0.1.0-beta.9 → 1.0.0-beta.2

package/README.md

@@ -37,7 +37,7 @@ Use `--tools claude`, `--tools codex`, or `--tools none` to override the default
 
 Initialization writes only Workspace-owned state and integrations:
 
-- `.code-workspace/config.yaml`, its referenced project configuration file (default: `.code-workspace/config-projects.yaml`), and `.code-workspace/state.json`
+- `.codew/config.yaml`, its referenced project configuration file (default: `.codew/config-projects.yaml`), and `.codew/state.json`
 - `USER_GUIDE.md`
 - `CLAUDE.md` and/or `AGENTS.md`
 - Workspace-specific commands and skills whose names start with `code-workspace-` or use the `/code-workspace` namespace
@@ -45,31 +45,42 @@ Initialization writes only Workspace-owned state and integrations:
 
 It does not create `openspec/`, install native `/opsx` commands, or install native `openspec-*` skills.
 
-### Experimental built-in extensions
+### Experimental extensions
 
-`init` can install integrations from the versioned `extensions/` repository shipped inside this npm package. Select extension names interactively, or pass a comma-separated name list non-interactively. The dedicated install command accepts one or more names; without names it opens the built-in extension multiselect, where ESC exits without changes:
+Ordinary extensions are published to the configured `@codew-ext` Nexus Registry and installed into the verified local Extension Store. Interactive `init` opens the shared Nexus picker: type in the search field, press Tab or Enter to focus the list, use Space to select, ←/→ to move between the visible pages, and press Enter to confirm (ESC cancels without changes). The picker marks installed latest versions as disabled and offers installed older versions as updates. If Nexus is unavailable or a page request fails, the ordinary-extension step can be skipped while core initialization continues. The package-local `extensions/` directory contains only the system-managed `codew-workspace-guard`:
 
 ```bash
-codew init . --extensions zhuiyi-jira-mcp --yes
-codew init . --extensions zhuiyi-opensvn-mcp --yes
+codew init . --extensions monitor --yes
 codew init . --extensions none --yes
 codew extension install
-codew extension install zhuiyi-jira-mcp --yes
-codew extension install zhuiyi-opensvn-mcp --yes
-codew extension uninstall zhuiyi-jira-mcp --yes
+codew extension install monitor --yes
+codew extension uninstall monitor --yes
+codew extension search jira --json
+codew extension info zhuiyi-jira-mcp --json
+codew extension install zhuiyi-jira-mcp --version 1.1.0 --yes
+codew extension install zhuiyi-jira-mcp --offline --version 1.1.0 --yes
+codew extension upgrade zhuiyi-jira-mcp --yes
 ```
 
 The Workspace operation lock shared by init, extension install, and extension uninstall is configured in the Code Workspace project's `.env` (not in the target Workspace). `CODE_WORKSPACE_INIT_LOCK_UPDATE_MS` defaults to `5000`, and `CODE_WORKSPACE_INIT_LOCK_STALE_MS` defaults to `30000`; process environment variables take precedence. See `.env.example` for the project configuration names.
 
-Users select names, not versions; `zhuiyi-jira-mcp@0.1.0` is intentionally rejected. Code Workspace resolves the highest extension SemVer implemented against a Host-supported Extension Spec before confirmation. A new non-interactive Workspace installs no extensions unless `--extensions` is provided. Re-initializing an existing Workspace defaults to its installed extensions and upgrades them when a newer supported built-in version exists. `none` skips extension work and does not uninstall existing artifacts.
+Users select names, not `name@version` positions. A default install resolves the highest compatible stable, non-deprecated version from the configured `@codew-ext` Nexus Registry and the verified local Store. A single-target install may instead pass an exact SemVer with `--version`; prereleases require that exact form, and a deprecated version additionally requires `--allow-deprecated`. `--offline` disables Registry access and resolves only local facts. `codew-workspace-guard` is the system extension containing the Workspace Guard, `codew-add-projects`, and `codew-resolve-branch`: `init` installs or upgrades it automatically, it is hidden from extension selection, and it cannot be managed through `extension install/uninstall/upgrade`. A new non-interactive Workspace installs no ordinary extensions unless `--extensions` is provided; `init` does not implicitly query Nexus. `none` skips ordinary extension work and does not uninstall existing artifacts or disable system extension processing.
 
-`extension install` does not rerun core Workspace initialization. In JSON, non-TTY, or `--yes` mode, at least one extension name is required. Multiple names are installed in order with one confirmation boundary and independent transactions; any failure makes the install command fail while later extensions still run.
+`extension install` does not rerun core Workspace initialization. In JSON, non-TTY, or `--yes` mode, at least one extension name is required. Multiple names are installed in order with one confirmation boundary and independent transactions; any failure makes the install command fail while later extensions still run. When the Registry is configured and a default resolution cannot obtain the remote metadata, installation fails before Workspace writes instead of silently using an older package.
 
-The bundled `zhuiyi-jira-mcp` and `zhuiyi-opensvn-mcp` extensions configure the Jira and OpenSVN MCP services for the selected Agent tools. They do not create an `openspec/` directory or install native OpenSpec commands.
+`extension info` remains a Workspace-independent Registry read. In a TTY, `extension search` opens the same paged picker as `init`; selecting an uninstalled extension installs it, while selecting an outdated installed extension updates it. The picker hides system extensions and disables installed latest versions. JSON, non-TTY, or `--yes` search remains read-only and returns the Registry result envelope. `extension upgrade` accepts one or more installed ordinary extensions, freezes the default target for each, confirms once, and reuses the same per-extension transaction and rollback as install. An already-current target is skipped.
 
-`zhuiyi-opensvn-mcp` accesses OpenSVN static resources through `opssvn.in.wezhuiyi.com`. Its bundled configuration sets `SVN_OUTPUT_DIR` to `.mcp-cache-opensvn`, requires `SVN_AUTHORIZATION`, and defaults `SVN_MAX_RESOURCES` to `200`; credentials are not stored in the extension package and should be supplied through local configuration or the runtime environment.
+`extension pack` creates a Nexus/npm-ready `codew-ext-<extension-id>-<version>.tgz` from an extension package directory:
 
-Extension entries run in separate Node processes and generate files in temporary staging directories. The host rejects undeclared, missing, symbolic-link, non-file, path-escaping, conflicting, and checksum-mismatched artifacts before transactionally installing them. Per-Workspace state is stored in `.code-workspace/ext-manifest.json`. A failed extension is reported as a warning and does not roll back successful core initialization or stop later extensions; a failed upgrade restores and retains the previous installed version.
+```bash
+code-workspace extension pack /path/to/extension/1.0.0 --output dist/extensions --json
+```
+
+The command is Workspace-independent, creates a missing output directory recursively, never executes extension or npm lifecycle code, and reopens the generated tarball to verify the npm envelope, manifest, entry digest, and unchanged `packageSha256` before atomically committing it. Existing outputs are never overwritten. It does not publish or store Registry credentials; CI can pass the verified tarball to `npm publish --registry`.
+
+The system-managed `codew-workspace-guard` extension is installed or upgraded automatically by `init`; it is hidden from ordinary extension selection and cannot be installed, upgraded, or uninstalled manually. Ordinary extension packages are downloaded from Nexus, verified, and cached in the user-level Extension Store.
+
+Extension entries run in separate Node processes and generate files in temporary staging directories. The host rejects undeclared, missing, symbolic-link, non-file, path-escaping, conflicting, and checksum-mismatched artifacts before transactionally installing them. Per-Workspace state is stored in `.codew/ext-manifest.json`. A failed extension is reported as a warning and does not roll back successful core initialization or stop later extensions; a failed upgrade restores and retains the previous installed version.
 
 Extensions may own complete files or declare Host-managed abstract Hooks. Codex and Claude
 adaptors render those declarations into each provider's native configuration and dynamically plug
@@ -78,7 +89,7 @@ verified by Code Workspace; extensions never patch the real Workspace directly.
 recorded installed state and does not execute extension code. Unknown changes to extension-owned
 files or contributions stop the operation instead of being overwritten.
 
-This is fault isolation, not a malicious-code security sandbox. The experimental release trusts only extension code shipped with Code Workspace; network sources, external extension directories, dependencies, arbitrary patches, force uninstall, disable commands, and automatic extension updates through `codew update` are not supported. The developer contract is in `docs/extensions.md`.
+This is fault isolation, not a malicious-code security sandbox. The experimental release trusts system extension code shipped with Code Workspace and ordinary extension code downloaded from the configured company Nexus after archive, identity, manifest, entry, runtime, and package-digest verification. External extension directories, dependencies, arbitrary patches, force uninstall, disable commands, and automatic extension updates through `codew update` are not supported. The developer contract is in `docs/extensions.md`; a step-by-step guide is in `docs/extension-development/extension-development-guide.zh-CN.md`.
 
 ## Register projects
 
@@ -91,10 +102,10 @@ code-workspace project inspect /absolute/path/to/project --json
 Claude Code users can invoke:
 
 ```text
-/code-workspace:add-projects /absolute/path/to/project-a /absolute/path/to/project-b
+/codew:add-projects /absolute/path/to/project-a /absolute/path/to/project-b
 ```
 
-Codex users can invoke `$code-workspace-add-projects` with the same explicit paths. For low-level automation, pass complete project records through stdin:
+Codex users can invoke `$codew-add-projects` with the same explicit paths. For low-level automation, pass complete project records through stdin:
 
 ```bash
 cat projects.json | code-workspace project add --stdin --yes --json
@@ -104,10 +115,10 @@ cat projects.json | code-workspace project add --stdin --yes --json
 
 The registry stores each project's name, real location, registered branch, type, and context. The registered branch is the Code Workspace expected state; the actual branch is observed from the selected Git worktree. Workspace never guesses a path from a conversation or automatically decides which branch is authoritative.
 
-Project registration is always stored in a separate file in the `.code-workspace` directory. Initialization uses `config-projects.yaml` by default, while `projects.ref` may name any safe regular filename in that directory:
+Project registration is always stored in a separate file in the `.codew` directory. Initialization uses `config-projects.yaml` by default, while `projects.ref` may name any safe regular filename in that directory:
 
 ```yaml
-# .code-workspace/config.yaml
+# .codew/config.yaml
 projects:
   ref: config-projects.yaml
 ```
@@ -115,7 +126,7 @@ projects:
 The referenced file uses this format:
 
 ```yaml
-# .code-workspace/config-projects.yaml
+# .codew/config-projects.yaml
 schemaVersion: 1
 projects:
   - name: payments
@@ -126,9 +137,9 @@ projects:
       Service ownership and navigation context.
 ```
 
-`projects.ref` is resolved relative to `config.yaml`. It must be one safe regular filename in the same `.code-workspace` directory; URLs, globs, absolute paths, path traversal, and inline `projects` arrays are not supported. Existing project command arguments and behavior remain compatible, `project add` additionally supports `--stdin`, and project data is still read from and written to the referenced file. The `.code-workspace/` directory is ignored by default, so Git history for this local registry requires an explicit repository policy.
+`projects.ref` is resolved relative to `config.yaml`. It must be one safe regular filename in the same `.codew` directory; URLs, globs, absolute paths, path traversal, and inline `projects` arrays are not supported. Existing project command arguments and behavior remain compatible, `project add` additionally supports `--stdin`, and project data is still read from and written to the referenced file. The `.codew/` directory is ignored by default, so Git history for this local registry requires an explicit repository policy.
 
-For example, `ref: team-projects.yaml` makes the project registry `.code-workspace/team-projects.yaml`; the default remains `config-projects.yaml`.
+For example, `ref: team-projects.yaml` makes the project registry `.codew/team-projects.yaml`; the default remains `config-projects.yaml`.
 
 ## Daily commands
 
@@ -154,10 +165,10 @@ The two reconciliation directions are deliberately separate:
 
 Both commands detect plan drift and verify postconditions. `project branch update-latest` is the separate, opt-in path for projects with `updateLatest: true`; it only fetches the configured upstream and fast-forwards a clean matching branch. Code Workspace never creates or downloads a branch and never performs stash, reset, rebase, non-fast-forward merge, production-code edits, or conflict resolution.
 
-Users may manually set the optional project policy in the file named by `projects.ref` (default: `.code-workspace/config-projects.yaml`):
+Users may manually set the optional project policy in the file named by `projects.ref` (default: `.codew/config-projects.yaml`):
 
 ```yaml
-# .code-workspace/config-projects.yaml
+# .codew/config-projects.yaml
 schemaVersion: 1
 projects:
   - name: payments
@@ -185,7 +196,7 @@ code-workspace language --json
 
 ## Monitor
 
-Monitor ships as the built-in `monitor` extension. Install it into a workspace and run its dashboard through the generic extension runtime:
+Monitor is an ordinary Nexus extension. Install it into a workspace and run its dashboard through the generic extension runtime:
 
 ```bash
 code-workspace extension install monitor --yes

package/README.zh-CN.md

@@ -37,7 +37,7 @@ code-workspace init . \
 
 初始化只写入 Workspace 自有状态和集成：
 
-- `.code-workspace/config.yaml`、其引用的项目配置文件（默认：`.code-workspace/config-projects.yaml`）与 `.code-workspace/state.json`
+- `.codew/config.yaml`、其引用的项目配置文件（默认：`.codew/config-projects.yaml`）与 `.codew/state.json`
 - `USER_GUIDE.md`
 - `CLAUDE.md` 和/或 `AGENTS.md`
 - 名称以 `code-workspace-` 开头或使用 `/code-workspace` 命名空间的 Workspace 专用命令与 Skill
@@ -45,38 +45,49 @@ code-workspace init . \
 
 它不会创建 `openspec/`，不会安装原生 `/opsx` 命令，也不会安装原生 `openspec-*` Skill。
 
-### 试验性内置扩展
+### 试验性扩展
 
-`init` 可以从 npm 包内随附的版本化 `extensions/` 仓库安装集成。交互模式按扩展名多选；非交互模式传入逗号分隔的扩展名。独立安装命令接受一个或多个扩展名；不传名称时打开内置扩展多选，按 ESC 可无修改退出：
+普通扩展发布到配置的 `@codew-ext` Nexus Registry，并安装到经过验证的本地 Extension Store。`init` 和独立安装命令从 Nexus/Store 选择普通扩展；npm 包内的 `extensions/` 目录只保留系统扩展 `codew-workspace-guard`。交互选择按 ESC 可无修改退出：
 
 ```bash
-codew init . --extensions zhuiyi-jira-mcp --yes
-codew init . --extensions zhuiyi-opensvn-mcp --yes
+codew init . --extensions monitor --yes
 codew init . --extensions none --yes
 codew extension install
-codew extension install zhuiyi-jira-mcp --yes
-codew extension install zhuiyi-opensvn-mcp --yes
-codew extension uninstall zhuiyi-jira-mcp --yes
+codew extension install monitor --yes
+codew extension uninstall monitor --yes
+codew extension search jira --json
+codew extension info zhuiyi-jira-mcp --json
+codew extension install zhuiyi-jira-mcp --version 1.1.0 --yes
+codew extension install zhuiyi-jira-mcp --offline --version 1.1.0 --yes
+codew extension upgrade zhuiyi-jira-mcp --yes
 ```
 
 `init`、扩展安装和扩展卸载共享的 Workspace 操作锁配置在 Code Workspace 项目自身的 `.env` 中（不在目标 Workspace 中）。`CODE_WORKSPACE_INIT_LOCK_UPDATE_MS` 默认值为 `5000`，`CODE_WORKSPACE_INIT_LOCK_STALE_MS` 默认值为 `30000`；进程环境变量优先于 `.env`。配置项名称见 `.env.example`。
 
-用户只选择扩展名，不能选择版本；`zhuiyi-jira-mcp@0.1.0` 会被明确拒绝。Code Workspace 在确认前，从 Host 明确支持的 Extension Spec 实现中解析最高扩展 SemVer。新 Workspace 非交互初始化时，未传 `--extensions` 就不安装扩展；已有 Workspace 重新初始化时，默认选择已安装扩展，并在存在更高受支持内置版本时升级。`none` 只跳过本次扩展初始化，不会卸载已有制品。
+用户选择扩展名，不使用 `name@version` 位置语法。默认安装会从已配置的 `@codew-ext` Nexus Registry 和已验证本地 Store 中选择最高的兼容、稳定、非 deprecated 版本。单目标安装可用 `--version` 指定精确 SemVer； prerelease 必须通过精确版本请求，deprecated 版本还必须加 `--allow-deprecated`。`--offline` 禁止 Registry 访问，只基于本地事实解析。`codew-workspace-guard` 是包含 Workspace Guard、`codew-add-projects` 和 `codew-resolve-branch` 的系统扩展，由 `init` 自动安装或升级，不出现在扩展选择列表中，也不能通过 `extension install/uninstall/upgrade` 手动管理。新 Workspace 非交互初始化时，未传 `--extensions` 就不安装普通扩展；`init` 不会隐式查询 Nexus。`none` 只跳过本次普通扩展初始化，不会卸载已有制品，也不会取消系统扩展处理。
 
-`extension install` 不会重新执行 Workspace 核心初始化。在 JSON、非 TTY 或 `--yes` 模式下，必须至少提供一个扩展名。多个名称按顺序安装，只确认一次且各自使用独立事务；任一扩展失败会使安装命令失败，但后续扩展仍会继续执行。
+`extension install` 不会重新执行 Workspace 核心初始化。在 JSON、非 TTY 或 `--yes` 模式下，必须至少提供一个扩展名。多个名称按顺序安装，只确认一次且各自使用独立事务；任一扩展失败会使安装命令失败，但后续扩展仍会继续执行。Registry 已配置且默认解析无法取得远端 metadata 时，安装会在 Workspace 写入前失败，不会静默选择旧包。
 
-当前随包提供的内置扩展包括 `zhuiyi-jira-mcp` 和 `zhuiyi-opensvn-mcp`，分别用于为选中的 Agent 工具配置 Jira MCP 与 OpenSVN MCP 服务；它们不会创建 `openspec/` 目录，也不会安装 OpenSpec 原生命令。
+`extension info` 仍是与 Workspace 无关的 Registry 读取命令。在 TTY 中，`extension search` 会打开与 `init` 相同的分页扩展选择器；选择未安装扩展会执行安装，选择已安装但过期的扩展会执行更新。系统扩展不会出现在列表中，已是最新版的扩展不可选择。JSON、非 TTY 或使用 `--yes` 时，search 保持只读并返回 Registry 结果 envelope。`extension upgrade` 接受一个或多个已安装普通扩展，逐个冻结默认目标，统一确认后复用安装的逐扩展事务和回滚；已是当前版本的目标返回 skipped。
 
-`zhuiyi-opensvn-mcp` 使用 `opssvn.in.wezhuiyi.com` 访问 OpenSVN 静态资源。内置配置将 `SVN_OUTPUT_DIR` 设为 `.mcp-cache-opensvn`，运行时必须提供 `SVN_AUTHORIZATION`，`SVN_MAX_RESOURCES` 默认为 `200`；认证信息不会写入扩展包，应通过本地配置或运行环境注入。
+`extension pack` 可以从扩展包目录生成可交给 Nexus/npm 的 `codew-ext-<extension-id>-<version>.tgz`：
 
-扩展入口在独立 Node 进程中运行，只向临时 staging 目录生成文件。Host 会在事务安装前拒绝未声明、缺失、符号链接、非文件、路径逃逸、目标冲突和 hash 不匹配的制品。Workspace 状态存放在 `.code-workspace/ext-manifest.json`。扩展失败以 warning 报告，不回滚已成功的核心初始化，也不阻止后续扩展；升级失败会恢复并保留旧的已安装版本。
+```bash
+code-workspace extension pack /path/to/extension/1.1.0 --output dist/extensions --json
+```
+
+该命令与 Workspace 无关，会在输出目录缺失时递归创建，不执行扩展入口或任何 npm 生命周期脚本；生成 tarball 后会重新读取并验证 npm envelope、manifest、入口摘要和未变化的 `packageSha256`，再原子提交。目标文件已存在时拒绝覆盖。命令本身不发布、不保存 Registry 凭证；CI 可将已验证的 tarball 交给 `npm publish --registry`。
+
+系统管理的 `codew-workspace-guard` 由 `init` 自动安装或升级，不出现在普通扩展选择列表中，也不能手动安装、升级或卸载。普通扩展包从 Nexus 下载、验证，并缓存到用户级 Extension Store。
+
+扩展入口在独立 Node 进程中运行，只向临时 staging 目录生成文件。Host 会在事务安装前拒绝未声明、缺失、符号链接、非文件、路径逃逸、目标冲突和 hash 不匹配的制品。Workspace 状态存放在 `.codew/ext-manifest.json`。扩展失败以 warning 报告，不回滚已成功的核心初始化，也不阻止后续扩展；升级失败会恢复并保留旧的已安装版本。
 
 扩展可以独占完整文件，也可以声明由 Host 管理的抽象 Hook。Host 通过 Codex/Claude adaptor
 把声明转换为各自的原生配置，并在扩展安装、升级和卸载时动态插拔；共享目标由 Code
 Workspace 合成和验证，扩展不会直接 patch 真实 Workspace。卸载只使用已安装状态，不执行
 扩展代码；扩展所有的文件或贡献存在未知修改时会拒绝覆盖或删除。
 
-这是故障隔离，不是恶意代码安全沙箱。试验版本只信任随 Code Workspace 发布的扩展代码；暂不支持网络源、外部扩展目录、扩展依赖、任意 patch、强制卸载、禁用命令，也不会通过 `codew update` 自动更新扩展。开发契约见 `docs/extensions.zh-CN.md`。
+这是故障隔离，不是恶意代码安全沙箱。试验版本信任随 Code Workspace 发布的系统扩展代码，以及从已配置公司 Nexus 下载并通过归档、身份、manifest、入口、runtime 和 package digest 验证的普通扩展包。外部扩展目录、扩展依赖、任意 patch、强制卸载、禁用命令和通过 `codew update` 自动更新扩展仍不支持。开发契约见 `docs/extensions.zh-CN.md`；从目录结构到打包发布的完整流程见 `docs/extension-development/extension-development-guide.zh-CN.md`。
 
 ## 注册项目
 
@@ -89,10 +100,10 @@ code-workspace project inspect /absolute/path/to/project --json
 Claude Code 用户可显式调用：
 
 ```text
-/code-workspace:add-projects /absolute/path/to/project-a /absolute/path/to/project-b
+/codew:add-projects /absolute/path/to/project-a /absolute/path/to/project-b
 ```
 
-Codex 用户可对相同的显式路径调用 `$code-workspace-add-projects`。底层自动化可通过 stdin 一次传入完整项目记录：
+Codex 用户可对相同的显式路径调用 `$codew-add-projects`。底层自动化可通过 stdin 一次传入完整项目记录：
 
 ```bash
 cat projects.json | code-workspace project add --stdin --yes --json
@@ -102,10 +113,10 @@ cat projects.json | code-workspace project add --stdin --yes --json
 
 注册表保存项目名称、真实路径、注册分支、类型和上下文。注册分支是 Code Workspace 的期望状态，实际分支是从选中 Git worktree 观测到的状态。Workspace 不会根据对话猜测路径，也不会自动判断哪一侧分支更权威。
 
-项目注册配置始终独立保存于 `.code-workspace` 目录下的单独文件。初始化默认使用 `config-projects.yaml`，但 `projects.ref` 可以引用该目录下任意安全的普通文件名：
+项目注册配置始终独立保存于 `.codew` 目录下的单独文件。初始化默认使用 `config-projects.yaml`，但 `projects.ref` 可以引用该目录下任意安全的普通文件名：
 
 ```yaml
-# .code-workspace/config.yaml
+# .codew/config.yaml
 projects:
   ref: config-projects.yaml
 ```
@@ -113,7 +124,7 @@ projects:
 引用文件使用以下格式：
 
 ```yaml
-# .code-workspace/config-projects.yaml
+# .codew/config-projects.yaml
 schemaVersion: 1
 projects:
   - name: payments
@@ -124,9 +135,9 @@ projects:
       服务职责和代码导航上下文。
 ```
 
-`projects.ref` 相对于 `config.yaml` 解析，必须是同一 `.code-workspace` 目录下的安全普通文件名。不支持 URL、glob、绝对路径、路径逃逸或内联 `projects` 数组。项目命令的现有参数和行为保持兼容，`project add` 额外支持 `--stdin`；项目数据仍只读取和写入引用文件。`.code-workspace/` 默认被忽略；如需 Git 历史，需要显式制定仓库策略。
+`projects.ref` 相对于 `config.yaml` 解析，必须是同一 `.codew` 目录下的安全普通文件名。不支持 URL、glob、绝对路径、路径逃逸或内联 `projects` 数组。项目命令的现有参数和行为保持兼容，`project add` 额外支持 `--stdin`；项目数据仍只读取和写入引用文件。`.codew/` 默认被忽略；如需 Git 历史，需要显式制定仓库策略。
 
-例如，`ref: team-projects.yaml` 会将项目注册表放在 `.code-workspace/team-projects.yaml`；默认名称仍为 `config-projects.yaml`。
+例如，`ref: team-projects.yaml` 会将项目注册表放在 `.codew/team-projects.yaml`；默认名称仍为 `config-projects.yaml`。
 
 ## 日常命令
 
@@ -152,10 +163,10 @@ code-workspace doctor --json
 
 两条命令都会检查计划漂移并验证后置条件。`project branch update-latest` 是独立的显式配置路径：仅当项目 `updateLatest: true` 时，才对干净且分支一致的 worktree fetch upstream 并 fast-forward。Code Workspace 不会创建或下载分支，也不会执行 stash、reset、rebase、非 fast-forward merge、生产代码编辑或冲突处理。
 
-用户可以手动在 `projects.ref` 指定的文件（默认：`.code-workspace/config-projects.yaml`）中设置项目策略：
+用户可以手动在 `projects.ref` 指定的文件（默认：`.codew/config-projects.yaml`）中设置项目策略：
 
 ```yaml
-# .code-workspace/config-projects.yaml
+# .codew/config-projects.yaml
 schemaVersion: 1
 projects:
   - name: payments
@@ -183,7 +194,7 @@ code-workspace language --json
 
 ## 监控
 
-监控以内置 `monitor` 扩展的形式提供。先在 Workspace 中安装扩展，再通过通用扩展运行时启动面板：
+监控以 Nexus 中的 `monitor` 扩展提供。先在 Workspace 中安装扩展，再通过通用扩展运行时启动面板：
 
 ```bash
 code-workspace extension install monitor --yes

package/artifacts/manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 2,
-  "releaseVersion": "0.1.0-beta.9",
+  "releaseVersion": "1.0.0-beta.2",
   "requirements": {
     "node": ">=20.19.0"
   },
@@ -13,13 +13,13 @@
       "id": "workspace-user-guide-en-US",
       "kind": "asset",
       "path": "templates/user-guide/en-US.md",
-      "sha256": "a91d45e4fc11b4f3eb3c651a4fcee6d981b0d076d93063e0480c5c3e377ea5d2"
+      "sha256": "7babab78319aa76329e159753d7110a8bbc8a5b5f349eef9a7779e6b4172a6af"
     },
     {
       "id": "workspace-user-guide-zh-CN",
       "kind": "asset",
       "path": "templates/user-guide/zh-CN.md",
-      "sha256": "43bfd67f0725c4834cf33bb7ab96cbe090db6f4373f0b58d01276db293cb9598"
+      "sha256": "aca3fc5997adc41bc44a64e0c3d7aed9470e343087da40303dad1e39f6cdbffb"
     }
   ],
   "managedFiles": [
@@ -39,127 +39,6 @@
       "provenance": {
         "kind": "template"
       }
-    },
-    {
-      "id": "workspace-claude-instructions",
-      "target": "CLAUDE.md",
-      "tools": [
-        "claude"
-      ],
-      "allowMissing": true,
-      "desired": {
-        "source": "templates/agents/WORKSPACE_GUARD.md.template",
-        "sha256": "bddb8e2ee25b7a63614b4297453e5803d2740fc475d97f5d8489dbaf17380c2c"
-      },
-      "render": {
-        "variables": [
-          "ADD_PROJECTS_INVOCATION"
-        ],
-        "values": {
-          "ADD_PROJECTS_INVOCATION": "/code-workspace:add-projects /absolute/path/to/project"
-        }
-      },
-      "provenance": {
-        "kind": "template"
-      }
-    },
-    {
-      "id": "workspace-codex-instructions",
-      "target": "AGENTS.md",
-      "tools": [
-        "codex"
-      ],
-      "allowMissing": true,
-      "desired": {
-        "source": "templates/agents/WORKSPACE_GUARD.md.template",
-        "sha256": "bddb8e2ee25b7a63614b4297453e5803d2740fc475d97f5d8489dbaf17380c2c"
-      },
-      "render": {
-        "variables": [
-          "ADD_PROJECTS_INVOCATION"
-        ],
-        "values": {
-          "ADD_PROJECTS_INVOCATION": "$code-workspace-add-projects /absolute/path/to/project"
-        }
-      },
-      "provenance": {
-        "kind": "template"
-      }
-    },
-    {
-      "id": "workspace-claude-add-projects-command",
-      "target": ".claude/commands/code-workspace/add-projects.md",
-      "tools": [
-        "claude"
-      ],
-      "allowMissing": true,
-      "desired": {
-        "source": "templates/claude/commands/code-workspace/add-projects.md",
-        "sha256": "177fbebf35383e1499c274007a2c577a7cd2f727407bcd0a0ca0511f4666dd6e"
-      },
-      "provenance": {
-        "kind": "template"
-      }
-    },
-    {
-      "id": "workspace-claude-add-projects-skill",
-      "target": ".claude/skills/code-workspace-add-projects/SKILL.md",
-      "tools": [
-        "claude"
-      ],
-      "allowMissing": true,
-      "desired": {
-        "source": "templates/codex/skills/code-workspace-add-projects/SKILL.md",
-        "sha256": "1b3a10870bd748244d85945b9a2562b7b30a8792bcd6163d8d53ed73cd9ef619"
-      },
-      "provenance": {
-        "kind": "template"
-      }
-    },
-    {
-      "id": "workspace-codex-add-projects-skill",
-      "target": ".codex/skills/code-workspace-add-projects/SKILL.md",
-      "tools": [
-        "codex"
-      ],
-      "allowMissing": true,
-      "desired": {
-        "source": "templates/codex/skills/code-workspace-add-projects/SKILL.md",
-        "sha256": "1b3a10870bd748244d85945b9a2562b7b30a8792bcd6163d8d53ed73cd9ef619"
-      },
-      "provenance": {
-        "kind": "template"
-      }
-    },
-    {
-      "id": "workspace-claude-resolve-branch-skill",
-      "target": ".claude/skills/code-workspace-resolve-branch/SKILL.md",
-      "tools": [
-        "claude"
-      ],
-      "allowMissing": true,
-      "desired": {
-        "source": "templates/agents/skills/code-workspace-resolve-branch/SKILL.md",
-        "sha256": "df8c65fbadf917b7247bbd1f40144da8c904a95f2b3ee905a4d2d6176e0a5f1b"
-      },
-      "provenance": {
-        "kind": "template"
-      }
-    },
-    {
-      "id": "workspace-codex-resolve-branch-skill",
-      "target": ".codex/skills/code-workspace-resolve-branch/SKILL.md",
-      "tools": [
-        "codex"
-      ],
-      "allowMissing": true,
-      "desired": {
-        "source": "templates/agents/skills/code-workspace-resolve-branch/SKILL.md",
-        "sha256": "df8c65fbadf917b7247bbd1f40144da8c904a95f2b3ee905a4d2d6176e0a5f1b"
-      },
-      "provenance": {
-        "kind": "template"
-      }
     }
   ]
 }

package/artifacts/templates/user-guide/en-US.md

@@ -7,13 +7,13 @@ A short reminder for using Code Workspace after initialization.
 Codex:
 
 ```text
-$code-workspace-add-projects /absolute/path/to/project-a /absolute/path/to/project-b
+$codew-add-projects /absolute/path/to/project-a /absolute/path/to/project-b
 ```
 
 Claude Code:
 
 ```text
-/code-workspace:add-projects /absolute/path/to/project-a /absolute/path/to/project-b
+/codew:add-projects /absolute/path/to/project-a /absolute/path/to/project-b
 ```
 
 Review the project records and confirm once. The add-projects skill uses one read-only collection to inspect every path independently; a failed project reports its diagnostic without stopping the remaining paths or being silently ignored. After confirmation, all valid records are sent to `project add` through stdin in one operation, with no temporary JSON file and no default second verify.
@@ -39,7 +39,7 @@ codew init --language en-US
 codew language
 ```
 
-The selected preference is stored at `workspace.language` in `.code-workspace/config.yaml`. Change an initialized workspace with:
+The selected preference is stored at `workspace.language` in `.codew/config.yaml`. Change an initialized workspace with:
 
 ```bash
 codew update --language en-US
@@ -64,7 +64,7 @@ Use another port when necessary:
 codew ext monitor serve --port 8080
 ```
 
-The extension reports to the URL recorded in `.code-workspace/monitor-reporting.json`. After installation, review and trust the project hooks with `/hooks` in Codex.
+The extension reports to the URL recorded in `.codew/monitor-reporting.json`. After installation, review and trust the project hooks with `/hooks` in Codex.
 
 ## Practical commands
 
@@ -89,10 +89,33 @@ Add `--json` when a query result is consumed by Codex or a script.
 
 ## Workspace skills
 
-- `$code-workspace-add-projects` — inspect and register local Git projects with concise AI-generated navigation context.
-- `$code-workspace-resolve-branch` — safely resolve a selected project's branch mismatch and confirm branch alignment.
+Installed by default during Workspace initialization:
+
+- `$codew-add-projects` — inspect and register local Git projects with concise AI-generated navigation context.
+- `$codew-resolve-branch` — safely resolve a selected project's branch mismatch and confirm branch alignment.
+
+The following skills are distributed as independent extensions. They are not installed by `init` or `update`; install or uninstall each one explicitly. The interactive extension picker starts with no extensions selected, and each choice shows the extension name and a short description:
+
+```bash
+codew extension install zhuiyi-jira-prd-analysis --yes
+codew extension install zhuiyi-jira-task-breakdown --yes
+codew extension install zhuiyi-jira-issue-fix-summary --yes
+codew extension install zhuiyi-guangda-coding-spec --yes
+codew extension uninstall zhuiyi-jira-prd-analysis --yes
+```
+
+- `$zhuiyi-jira-prd-analysis` — confirm Jira scope, then analyze requirement clarity, consistency, and code feasibility.
+- `$zhuiyi-jira-task-breakdown` — split a confirmed Jira requirement into executable frontend, backend, and test tasks.
+- `$zhuiyi-jira-issue-fix-summary` — summarize a completed fix and, after confirmation, publish it as a Jira comment.
+- `$zhuiyi-guangda-coding-spec` — apply research, security, testing, and release rules by risk area, only for China Everbright Bank customer projects.
+
+These extensions install skill instructions only. Install the `zhuiyi-jira-mcp` extension separately when the Jira-related skills require Jira access; the Guangda coding spec requires no MCP service.
 
 | Purpose | Codex | Claude Code |
 | --- | --- | --- |
-| Add workspace projects | `$code-workspace-add-projects` | `/code-workspace:add-projects` |
-| Resolve a project branch mismatch | `$code-workspace-resolve-branch` | `/code-workspace-resolve-branch` |
+| Add workspace projects | `$codew-add-projects` | `/codew:add-projects` |
+| Resolve a project branch mismatch | `$codew-resolve-branch` | `/codew-resolve-branch` |
+| Analyze a Jira requirement | `$zhuiyi-jira-prd-analysis` | `$zhuiyi-jira-prd-analysis` |
+| Break down Jira tasks | `$zhuiyi-jira-task-breakdown` | `$zhuiyi-jira-task-breakdown` |
+| Summarize an issue fix | `$zhuiyi-jira-issue-fix-summary` | `$zhuiyi-jira-issue-fix-summary` |
+| Apply the Guangda coding spec | `$zhuiyi-guangda-coding-spec` | `$zhuiyi-guangda-coding-spec` |

package/artifacts/templates/user-guide/zh-CN.md

@@ -7,13 +7,13 @@
 Codex：
 
 ```text
-$code-workspace-add-projects /absolute/path/to/project-a /absolute/path/to/project-b
+$codew-add-projects /absolute/path/to/project-a /absolute/path/to/project-b
 ```
 
 Claude Code：
 
 ```text
-/code-workspace:add-projects /absolute/path/to/project-a /absolute/path/to/project-b
+/codew:add-projects /absolute/path/to/project-a /absolute/path/to/project-b
 ```
 
 根据提示检查项目记录并只确认一次。add-projects skill 会用一次只读采集逐项检查路径；某个项目失败时会报告具体诊断并继续检查其他项目，不会静默忽略失败项。确认后，所有有效记录通过 stdin 一次交给 `project add`，不需要临时 JSON 文件，也不会默认追加第二次 verify。
@@ -39,7 +39,7 @@ codew init --language zh-CN
 codew language
 ```
 
-所选偏好保存在 `.code-workspace/config.yaml` 的 `workspace.language`。已有工作区可通过以下命令切换语言：
+所选偏好保存在 `.codew/config.yaml` 的 `workspace.language`。已有工作区可通过以下命令切换语言：
 
 ```bash
 codew update --language zh-CN
@@ -64,7 +64,7 @@ codew ext monitor
 codew ext monitor serve --port 8080
 ```
 
-扩展会向 `.code-workspace/monitor-reporting.json` 中记录的 URL 上报。安装后，请在 Codex 中使用 `/hooks` 检查并信任项目 Hook。
+扩展会向 `.codew/monitor-reporting.json` 中记录的 URL 上报。安装后，请在 Codex 中使用 `/hooks` 检查并信任项目 Hook。
 
 ## 实用命令
 
@@ -89,10 +89,33 @@ codew project verify <project-name>
 
 ## Workspace Skills
 
-- `$code-workspace-add-projects` — 检查并注册本地 Git 项目，同时生成供 AI 导航使用的简洁 context。
-- `$code-workspace-resolve-branch` — 安全解决选中项目的分支不一致问题，并确认分支对齐。
+默认随 Workspace 初始化安装：
+
+- `$codew-add-projects` — 检查并注册本地 Git 项目，同时生成供 AI 导航使用的简洁 context。
+- `$codew-resolve-branch` — 安全解决选中项目的分支不一致问题，并确认分支对齐。
+
+以下 Skill 以独立扩展提供，不会随 `init` 或 `update` 自动安装。需要时按名称安装，也可以单独卸载；交互式扩展选择默认不勾选任何扩展，每个选项会显示扩展名称和简短描述：
+
+```bash
+codew extension install zhuiyi-jira-prd-analysis --yes
+codew extension install zhuiyi-jira-task-breakdown --yes
+codew extension install zhuiyi-jira-issue-fix-summary --yes
+codew extension install zhuiyi-guangda-coding-spec --yes
+codew extension uninstall zhuiyi-jira-prd-analysis --yes
+```
+
+- `$zhuiyi-jira-prd-analysis` — 在确认 Jira 范围后分析需求清晰度、一致性和代码可行性。
+- `$zhuiyi-jira-task-breakdown` — 将已确认的 Jira 需求按前端、后端、测试拆分为可执行任务。
+- `$zhuiyi-jira-issue-fix-summary` — 总结已完成的问题修复，并在确认后发布到 Jira 评论。
+- `$zhuiyi-guangda-coding-spec` — 仅在项目属于中国光大银行客户项目时，按本次任务的风险域落实研发、安全、测试与投产规范。
+
+这些扩展只安装 Skill 指令。Jira 相关扩展需要实际访问 Jira 时，还应安装 `zhuiyi-jira-mcp` 扩展；光大规范扩展不依赖任何 MCP 服务。
 
 | 用途 | Codex | Claude Code |
 | --- | --- | --- |
-| 添加工作区项目 | `$code-workspace-add-projects` | `/code-workspace:add-projects` |
-| 解决项目分支不一致 | `$code-workspace-resolve-branch` | `/code-workspace-resolve-branch` |
+| 添加工作区项目 | `$codew-add-projects` | `/codew:add-projects` |
+| 解决项目分支不一致 | `$codew-resolve-branch` | `/codew-resolve-branch` |
+| 分析 Jira 需求 | `$zhuiyi-jira-prd-analysis` | `$zhuiyi-jira-prd-analysis` |
+| 拆分 Jira 任务 | `$zhuiyi-jira-task-breakdown` | `$zhuiyi-jira-task-breakdown` |
+| 总结问题修复 | `$zhuiyi-jira-issue-fix-summary` | `$zhuiyi-jira-issue-fix-summary` |
+| 落实光大研发规范 | `$zhuiyi-guangda-coding-spec` | `$zhuiyi-guangda-coding-spec` |