feat: add configurable UI design policy

README.en.md

@@ -172,8 +172,9 @@ By default, `mancode init` creates mancode workflow and platform integration fil
 ├── schema.json
 ├── shared/config.json
 ├── shared/context/project.json
+├── shared/context/design-policy.json # optional; created by design configure
 ├── shared/team/
-└── local/                         # sessions, workflows, manps reports
+└── local/                         # sessions, workflows, scan reports, style cache
 
 .claude/skills/                  # Claude Code: bootstrap + original mode skills
 .cursor/rules/ + commands/       # Cursor: bootstrap + original mode commands
@@ -206,7 +207,7 @@ the original mode entries, never task/session snapshots. `mancode init
 - **Support team context**: use `/manteam` with confirmed typed entities under
   `.mancode/shared/`.
 - **Scan project health**: use `mancode manps` to detect stale TODOs, unused
-  dependencies, risky packages, and hardcoded design values.
+  dependencies, risky packages, mixed icon systems, and hardcoded design values.
 
 ## Best Fit
 
@@ -476,8 +477,12 @@ mancode workflow verify <namespace:ULID> apply --file <verification-ledger.json>
 mancode workflow reframe <local:ULID> --expected-revision <n> --checkpoint-id <ULID> --session <id>
 mancode workflow complete <namespace:ULID> --expected-revision <n> --session <id>
 mancode manps [area]
+mancode design status --json
+mancode design context --json
+mancode design configure --expected-revision <n> [options]
+mancode design disable --expected-revision <n>
 mancode refresh-project
-mancode refresh-style
+mancode refresh-style [--root <relative-path>]
 mancode version
 ```
 
@@ -578,6 +583,53 @@ Outputs:
 .mancode/local/preseason-reports/<timestamp>-<area>.md
 ```
 
+### `mancode design`
+
+Project design policy is opt-in. `mancode init` does not create a policy. When
+the policy is missing, disabled, or corrupt, `design context` safely resolves to
+`preserve`; ordinary coding and workflow recovery continue normally.
+Legacy projects can read this safe context, but only current Continuity projects
+can configure the shared policy.
+
+- `preserve` retains the existing hierarchy, layout, component system, and
+  interaction patterns while making only task-required UI changes.
+- `refine` improves hierarchy, typography, spacing, states, and responsive
+  behavior without changing the product structure.
+- `experimental` permits one coherent, product-appropriate visual direction
+  and more advanced composition or motion, but requires
+  `--confirm-experimental`. It never authorizes new product behavior,
+  information-architecture changes, or broader task scope.
+
+For a new UI surface or aesthetic redesign, if the user has not selected a
+visual direction, the agent first presents 2-3 distinct,
+product-appropriate directions with concise tradeoffs and a recommendation,
+then waits for the user to choose. Scoped UI fixes, changes within an existing
+design system, and tasks with an already selected direction continue directly.
+For brand, campaign, editorial, portfolio, and launch surfaces, `experimental`
+emphasizes a memorable first viewport and a visual motif carried through the
+full page; task-oriented products still prioritize workflow clarity.
+
+The policy stores only strict enums for preset, icons, emoji, motion, and browser
+validation, never free-form prompt text. Agents read code-generated guidance,
+quality gates, and a sanitized style summary through `mancode design context
+--json`. `--icons lucide` does not install Lucide; dependency changes still need
+explicit task approval.
+
+```bash
+mancode design status --json
+mancode design configure --expected-revision 0 --preset refine --icons lucide --emoji forbid-as-interface-icon --motion purposeful --browser-validation when-available
+mancode design context --json
+mancode design disable --expected-revision 1
+
+# experimental always needs an extra confirmation
+mancode design configure --expected-revision 0 --preset experimental --confirm-experimental
+```
+
+The policy lives at `.mancode/shared/context/design-policy.json` and should be
+reviewed and committed like other repository configuration. `configure` and
+`disable` update only the current checkout; they do not publish a git-ref remote
+sync receipt.
+
 ### `mancode refresh-style`
 
 Refreshes the project profile and, when UI assets are detected, rescans design
@@ -588,6 +640,11 @@ tokens. It updates:
 .mancode/shared/context/project.json
 ```
 
+For a monorepo, select one repository-relative UI root explicitly, for example
+`mancode refresh-style --root apps/web`. Absolute paths, traversal, and symlinks
+that escape the repository are rejected. Omitting `--root` preserves the
+whole-repository scan behavior.
+
 Platform adapters are static bootstraps that embed no task or style snapshot, so
 refreshing project facts does not require reinstalling them.
 

README.md

@@ -159,8 +159,9 @@ legacy `state.json` 与当前工作流权威数据。
 ├── schema.json
 ├── shared/config.json
 ├── shared/context/project.json
+├── shared/context/design-policy.json # 可选：design configure 后创建
 ├── shared/team/
-└── local/                         # session、workflow、manps 报告
+└── local/                         # session、workflow、扫描报告和样式缓存
 
 .claude/skills/                  # Claude Code：bootstrap + 原 mode skills
 .cursor/rules/ + commands/       # Cursor：bootstrap + 原 mode commands
@@ -182,7 +183,7 @@ AGENTS.md                        # Codex（ChatGPT 桌面端/CLI）：托管 ins
 - **自由选择执行强度**：计划确认后，可只保留计划、交给默认 `solo` 轻量开发，或继续完整 `/man` 的验证与有界风险审查。
 - **保留工作流产物**：调研、计划、审查报告和总结会保存到 `.mancode/<namespace>/workflows/<ULID>/`。
 - **支持团队上下文**：`/manteam` 通过 `.mancode/shared/` 的类型化实体共享已确认信息。
-- **扫描项目健康度**：`mancode manps` 检测陈旧 TODO、未使用依赖、风险依赖和硬编码设计值。
+- **扫描项目健康度**：`mancode manps` 检测陈旧 TODO、未使用依赖、风险依赖、混用图标系统和硬编码设计值。
 
 ## 适合什么项目？
 
@@ -428,8 +429,12 @@ mancode workflow verify <namespace:ULID> apply --file <verification-ledger.json>
 mancode workflow reframe <local:ULID> --expected-revision <n> --checkpoint-id <ULID> --session <id>
 mancode workflow complete <namespace:ULID> --expected-revision <n> --session <id>
 mancode manps [area]
+mancode design status --json
+mancode design context --json
+mancode design configure --expected-revision <n> [options]
+mancode design disable --expected-revision <n>
 mancode refresh-project
-mancode refresh-style
+mancode refresh-style [--root <relative-path>]
 mancode version
 ```
 
@@ -527,6 +532,35 @@ mancode manps config
 .mancode/local/preseason-reports/<timestamp>-<area>.md
 ```
 
+### `mancode design`
+
+项目设计策略是显式启用功能。`mancode init` 不会创建策略；策略缺失、禁用或损坏时，
+`design context` 会安全降级为 `preserve`，普通编码和工作流恢复不受影响。
+Legacy 项目也可读取这个安全上下文，但只有当前 Continuity 项目能配置共享策略。
+
+- `preserve`：保持现有层级、布局、组件系统和交互模式，只完成任务要求的 UI 改动。
+- `refine`：在不改变产品结构的前提下改善层级、排版、间距、状态和响应式行为。
+- `experimental`：允许一个符合产品语境的统一视觉方向和更高级的构图/动效，但必须显式传入 `--confirm-experimental`；它不授权新增产品功能、改变信息架构或扩大任务范围。
+
+新建 UI 或视觉重做时，如果用户尚未选定视觉方向，Agent 会先给出 2–3 个差异明确、符合产品语境的方向，简述取舍并推荐一个，等待用户选择后再实现。局部 UI 修复、既有设计系统内的改动，以及用户已经选定方向的任务不会被这一步打断。`experimental` 对品牌、活动、编辑、作品集和发布型页面强调首屏记忆点与贯穿全页的视觉母题；对任务型产品仍优先保证工作流清晰度。
+
+策略只保存 preset、图标、表情、动效和浏览器验证的严格枚举，不保存自由文本提示词。
+Agent 通过 `mancode design context --json` 获取代码生成的固定指导、质量门槛和经过清洗的
+样式摘要。`--icons lucide` 不会自动安装 Lucide；依赖变更仍需任务明确授权。
+
+```bash
+mancode design status --json
+mancode design configure --expected-revision 0 --preset refine --icons lucide --emoji forbid-as-interface-icon --motion purposeful --browser-validation when-available
+mancode design context --json
+mancode design disable --expected-revision 1
+
+# experimental 必须额外确认
+mancode design configure --expected-revision 0 --preset experimental --confirm-experimental
+```
+
+策略保存在 `.mancode/shared/context/design-policy.json`，应像其他仓库配置一样审查并提交。
+`configure`/`disable` 只更新当前 checkout，不会发布 git-ref 远端同步回执。
+
 ### `mancode refresh-style`
 
 刷新项目 profile；检测到 UI 资产时，还会重新扫描设计 token。它会更新：
@@ -536,6 +570,9 @@ mancode manps config
 .mancode/shared/context/project.json
 ```
 
+Monorepo 可显式选择一个仓库内 UI 根目录，例如 `mancode refresh-style --root apps/web`。
+绝对路径、路径穿越和逃逸仓库的符号链接会被拒绝；不传 `--root` 时保持整仓扫描行为。
+
 平台 adapter 是不嵌入 task/style 快照的静态 bootstrap，因此刷新项目事实后不需要重装。
 
 ## 项目文件

docs/project-intelligence.md

@@ -33,13 +33,32 @@ mancode refresh-project
 
 ```bash
 mancode refresh-style
+mancode refresh-style --root apps/web
 ```
 
+Monorepo 的 `--root` 必须是仓库内已存在的相对路径。绝对路径、路径穿越和逃逸仓库的符号链接会被拒绝。扫描结果仍写入 `.mancode/local/cache/style-tokens.json`，其中 `scopeRoot` 标记本次扫描范围。
+
 扫描器不解析任意 `theme.json`、Design Tokens Community Group 文件、Figma 或运行时动态主题。Agent 可以人工读取这些资料，但必须标明它们不是自动检测结果。
 
+## 设计策略
+
+设计策略与检测事实分离：样式扫描是 checkout-local、可重建的事实缓存；可选的人类策略保存在 `.mancode/shared/context/design-policy.json`。初始化不会自动创建策略，没有有效策略时始终安全使用 `preserve`。Legacy 项目可以读取安全上下文，但只有当前 Continuity 项目能写入共享策略。
+
+```bash
+mancode design status --json
+mancode design configure --expected-revision 0 --preset refine --icons lucide --emoji forbid-as-interface-icon --motion purposeful --browser-validation when-available
+mancode design context --json
+```
+
+`design context` 只输出代码生成的固定指导、质量门槛和经过大小/字符限制清洗的样式摘要。策略文件只接受严格枚举和独立 revision，拒绝未知字段与自由文本提示词。`experimental` 需要 `--confirm-experimental`，且任何 preset 都不能扩大任务范围、授权产品变更或隐式新增依赖。
+
+对于新建 UI 或视觉重做，如果用户尚未选定方向，固定指导会要求 Agent 先提出 2–3 个差异明确的产品化方向，简述取舍并推荐一个，等待用户选择后再实现；局部 UI 修复、既有设计系统内的改动和已选定方向的任务直接继续。`experimental` 会让品牌型页面把最强视觉信号集中在首屏，并将同一母题延续到全页；任务型产品仍以工作流清晰度优先。
+
+策略命令只修改当前 checkout。共享策略应像仓库配置一样经过 review 和 commit；它不参与 Context Pack 必填字段，也不会伪造 git-ref 远端同步回执。策略文件损坏时，`design context` fail-open 为 `preserve`，普通开发命令不被阻断。
+
 ## Preseason
 
-`mancode manps` 是确定性健康扫描，支持 `all`、`deps`、`security`、`dead-code` 和 `config`。它检查脚本、依赖重叠、TODO、测试、配置、审美、架构和基础安全信号。
+`mancode manps` 是确定性健康扫描，支持 `all`、`deps`、`security`、`dead-code` 和 `config`。它检查脚本、依赖重叠、TODO、测试、配置、审美、架构和基础安全信号。审美检查只在 `package.json` 确实声明两个不同图标系统时产生一个 P2；它不扫描 UI 文案中的表情，避免把合法内容误报为图标问题。
 
 ```bash
 mancode manps deps

src/cli.ts

@@ -16,6 +16,12 @@ import {
   contextShow,
   contextWorktreeRegister,
 } from './commands/context.js';
+import {
+  designConfigure,
+  designContext,
+  designDisable,
+  designStatus,
+} from './commands/design.js';
 import { init } from './commands/init.js';
 import { install } from './commands/install.js';
 import { listPlatforms } from './commands/list-platforms.js';
@@ -981,11 +987,59 @@ program
     process.exitCode = code;
   });
 
+const designProgram = program
+  .command('design')
+  .description('Inspect and configure project UI design policy');
+
+designProgram
+  .command('status')
+  .description('Show the configured and effective project design policy')
+  .option('--json', 'Output as JSON (for scripts)')
+  .action(async (options) => {
+    process.exitCode = await designStatus(process.cwd(), options);
+  });
+
+designProgram
+  .command('context')
+  .description('Emit bounded UI design context for coding agents')
+  .option('--json', 'Output as JSON (for scripts)')
+  .action(async (options) => {
+    process.exitCode = await designContext(process.cwd(), options);
+  });
+
+designProgram
+  .command('configure')
+  .description('CAS-update the optional project design policy')
+  .requiredOption(
+    '--expected-revision <n>',
+    'Current policy revision; use 0 when absent',
+  )
+  .option('--preset <preset>', 'preserve, refine, or experimental')
+  .option('--icons <policy>', 'existing-first or lucide')
+  .option('--emoji <policy>', 'allow or forbid-as-interface-icon')
+  .option('--motion <policy>', 'minimal or purposeful')
+  .option('--browser-validation <mode>', 'off, when-available, or required')
+  .option('--confirm-experimental', 'Explicitly allow the experimental preset')
+  .option('--json', 'Output as JSON (for scripts)')
+  .action(async (options) => {
+    process.exitCode = await designConfigure(process.cwd(), options);
+  });
+
+designProgram
+  .command('disable')
+  .description('Disable the project design policy without deleting it')
+  .requiredOption('--expected-revision <n>', 'Current policy revision')
+  .option('--json', 'Output as JSON (for scripts)')
+  .action(async (options) => {
+    process.exitCode = await designDisable(process.cwd(), options);
+  });
+
 program
   .command('refresh-style')
   .description('Refresh project profile and rescan applicable design tokens')
-  .action(async () => {
-    const code = await refreshStyle(process.cwd());
+  .option('--root <path>', 'Repository-relative UI project root')
+  .action(async (options) => {
+    const code = await refreshStyle(process.cwd(), options);
     process.exitCode = code;
   });