fix: align global install guidance to scoped @devcodex/devcodex

After the package rename, bare
pm install -g devcodex no longer
matches the published identity and caused validate-profile warnings.
Update install/update guidance, repair steps, and profile validation to
accept scoped package names, and fix JS regex literals broken by the
slash in @devcodex/devcodex.

Author: rockyshi1993

README.md

@@ -166,7 +166,7 @@ devcodex status
 
 ```bash
 npm install -g @devcodex/devcodex # 安装全局 CLI，并由 postinstall 配置五宿主用户级 adapter
-npm update -g devcodex  # 升级全局包，并由 postinstall 刷新五宿主用户级 adapter
+npm update -g @devcodex/devcodex  # 升级全局包，并由 postinstall 刷新五宿主用户级 adapter
 npm install devcodex    # 仅加入当前项目依赖；不配置宿主，并提示必须使用 -g
 ```
 
@@ -310,7 +310,7 @@ Phase 1 采用“薄 Rule + `host-capability-routing` Skill + 三份 V1 契约/
 | `npm install -g .` | **本地旁路（R1b）**：全局安装当前目录并走 postinstall 刷新 adapter |
 | `npm pack` + `npm install -g ./devcodex-devcodex-*.tgz` | **预发冒烟（R2）**：接近真实 tarball 安装面 |
 | `npm install -g @devcodex/devcodex` | **已发布（R3）**：安装全局 CLI；`postinstall` 自动刷新全局宿主 adapter |
-| `npm update -g devcodex` | **已发布（R3）**：升级全局包并 `postinstall` 刷新 adapter |
+| `npm update -g @devcodex/devcodex` | **已发布（R3）**：升级全局包并 `postinstall` 刷新 adapter |
 | `npm install devcodex` | 仅安装到当前项目依赖；`postinstall` 不写宿主配置并提示必须使用 `-g` |
 | `devcodex update` | **workspace only（R4）**：只刷新当前 `.devcodex` 运行态，不写用户级宿主配置 |
 
@@ -763,4 +763,4 @@ Auto v1.1 当前只在支持 Hook 的宿主里，对显式 `@devcodex-auto`、
 
 ## 许可证
 
-AGPL-3.0-or-later © Rocky / [vextjs](https://github.com/vextjs)
+AGPL-3.0-or-later © Rocky / [DevCodex Labs](https://github.com/devcodex-labs)

RULES.md

@@ -25,7 +25,7 @@ DevCodex 同时支持五宿主的用户级加载路径，规则语义保持一
 - **Hook-First**：VS Code / Claude Code / Codex Hooks 可用时，通过对应宿主 hooks 承载 bootstrap、危险操作护栏和结束前兜底
 - **Instruction-Fallback**：Hooks 不可用时，继续依赖 instructions / skills 承载软约束
 - **当前实现**：npm 全局安装/升级通过 `postinstall` 更新用户级稳定 runtime、共享 full fallback 与 active Skills；共享 `.agents` 由单一事务 Owner 写入。bare `init/update` 只管理 workspace `.devcodex`，fresh workspace 会建立 `workspace-namespace` marker
-- **全局唯一写入口**：`devcodex init --claude`、`devcodex init --codex` 及其他宿主 selector/alias 均返回 `CLI_HOST_CONFIG_GLOBAL_ONLY`。用户级宿主 adapter：源码仓优先 `devcodex global-adapters apply`（或 `npm install -g .` / pack+tarball）；已发布环境 `npm install -g devcodex` / `npm update -g devcodex`（postinstall）
+- **全局唯一写入口**：`devcodex init --claude`、`devcodex init --codex` 及其他宿主 selector/alias 均返回 `CLI_HOST_CONFIG_GLOBAL_ONLY`。用户级宿主 adapter：源码仓优先 `devcodex global-adapters apply`（或 `npm install -g .` / pack+tarball）；已发布环境 `npm install -g @devcodex/devcodex` / `npm update -g @devcodex/devcodex`（postinstall）
 - **就绪分层**：receipt 与文件存在只表示 `configured`；`status` 验证 adapter/静态合同，`doctor` 再验证可用原生 CLI、Grok canonical 唯一 identity、inspect 发现面、已安装 Hook 合同与 MCP initialize。任一合同或原生探针失败时不得标记 `ready`。
 - **受管回执**：receipt 只绑定 DevCodex 管理的 instruction、hook、MCP 与 config segment；用户自有主题或其他宿主设置不构成 adapter 漂移，受管字段变化仍必须 fail closed 并由全局安装刷新。
 - **诊断作用域**：源码仓中的 `status/doctor` 只能形成 `source-candidate-vs-installed-receipts` 候选比较，必须声明 `installedHealthClaim=false`，并抑制已安装包的 `checks/failedChecks/repairSteps`；真实全局健康结论只能由打包并安装后的候选在源码仓外形成。

changelogs/TEMPLATE.md

@@ -91,7 +91,7 @@ npx @devcodex/devcodex status
 # 源码维护者：刷新用户级全局 adapter（不 pack / 不 publish）
 devcodex global-adapters apply
 # 预发冒烟：
-# npm pack && npm install -g ./vextjs-devcodex-<version>.tgz
+# npm pack && npm install -g ./devcodex-devcodex-<version>.tgz
 # 已发布用户：
 # npm update -g @devcodex/devcodex
 # workspace 运行态 only：

changelogs/unreleased.md

@@ -4,6 +4,8 @@
 > **当前**: v1.15.3 已归档到 `changelogs/releases/v1.15.3.md`；本文件仅保留历史锚点索引与镜像供 validate 探针消费。发版后新实现再写入下方「当前未发布」。
 
 ## 当前未发布实现候选
+- **scoped 安装命令收口**：全库 
+pm install|update -g 对齐 @devcodex/devcodex；alidate-profile 识别 scoped 包名；修复正则字面量中 / 截断；managed deployment-manifest package 字段同步。
 - **目录与包身份统一为 devcodex（本地/公开）**：源码目录与 active-root 由 devcodex-v1 对齐为 devcodex；npm 包 @devcodex/devcodex、仓库 devcodex-labs/devcodex、npmjs public 发布配置与 probe/fixtures/Skill 示例同步；isSourceRepo 识别新包名；历史 releases 台账不回溯改写。
 
 - **维护者站点×清单一致性（Fix-1 分母重冻）**：`docs-surface-inventory` npm scripts 下限 **≥113**、scripts/lib **≥102**；基线 `scripts/fixtures/docs-surface-baseline-20260727.json`；intro 能力证据表补 scripts/lib/validation/delivery-honesty 与五宿主 L0 摘要表。需求：`maintainer-site-docs-consistency`。

instructions.md

@@ -767,4 +767,4 @@ DevCodexVisibleEnvelopeV1 · entry-check · [状态] · [semanticDigest]
 
 ---
 
-*本文件由 DevCodex 管理，请勿手动修改。源码仓刷新用户级全局 adapter：`devcodex global-adapters apply`（或 `npm install -g .` / pack+tarball）；已发布环境：`npm update -g devcodex`。workspace `.devcodex` 仅用 bare `devcodex update`（不含 `--host`）。*
+*本文件由 DevCodex 管理，请勿手动修改。源码仓刷新用户级全局 adapter：`devcodex global-adapters apply`（或 `npm install -g .` / pack+tarball）；已发布环境：`npm update -g @devcodex/devcodex`。workspace `.devcodex` 仅用 bare `devcodex update`（不含 `--host`）。*

instructions/17-compliance.instructions.md

@@ -71,7 +71,7 @@ version: 1.15.3
 > - **legacy 父链表面**（可选诊断）：cwd 是 plugin 源仓库且父链上仍存在 `.github/`、`.claude/`、`AGENTS.md`、`.agents/` 或 `.codex/` 时，可扫描但不作为普通 workspace 安装目标
 >
 > 触发动作：
-> - 用户级 adapter 相对源码候选落后 / STALE → ⚠️ 标记；源码仓优先运行 **`devcodex global-adapters apply`**（或次选 `npm install -g .` / `npm pack` + tarball）；已发布环境用 `npm update -g devcodex`
+> - 用户级 adapter 相对源码候选落后 / STALE → ⚠️ 标记；源码仓优先运行 **`devcodex global-adapters apply`**（或次选 `npm install -g .` / `npm pack` + tarball）；已发布环境用 `npm update -g @devcodex/devcodex`
 > - bare `devcodex update` **只刷新 workspace `.devcodex`**，不能替代全局 adapter 刷新；`update --claude/--codex/--host` 仍 fail closed（`CLI_HOST_CONFIG_GLOBAL_ONLY`）
 > - 同步 → ✅
 > - 无用户级 receipt 且无 legacy 父链表面 → N/A 或按 doctor 缺失项提示

instructions/tenants/README.md

@@ -50,7 +50,7 @@ devcodex update --tenant example-tenant
 
 # 用户级全局 adapter（GlobalOnly）：不要用 update --claude/--host
 devcodex global-adapters apply
-# 或：npm install -g . / npm pack && npm install -g ./vextjs-devcodex-*.tgz
+# 或：npm install -g . / npm pack && npm install -g ./devcodex-devcodex-*.tgz
 ```
 
 - 不传 `--tenant`：Copilot/Claude managed set 排除整个 `instructions/tenants/`。

mcp/profile-server.js

@@ -299,7 +299,7 @@ function readRuntimeKernelText() {
   }
   return {
     path: null,
-    content: '（⚠️ user-global DevCodex runtime kernel 未找到；请先执行 npm install -g devcodex）'
+    content: '（⚠️ user-global DevCodex runtime kernel 未找到；请先执行 npm install -g @devcodex/devcodex）'
   }
 }
 

scripts/lib/cli-host-utils.js

@@ -129,7 +129,7 @@ function buildCliHostUtils({ fs, path, isPlainObject, claudeMcpJson }) {
     const profileJs = path.join(root, '.claude', 'mcp', 'profile-server.js')
     return [
       CODEX_MCP_MANAGED_BEGIN,
-      '# Legacy workspace MCP block; user-global adapters are refreshed by npm update -g devcodex.',
+      '# Legacy workspace MCP block; user-global adapters are refreshed by npm update -g @devcodex/devcodex.',
       '[mcp_servers.devcodex-memory]',
       'command = "node"',
       'args = [',

scripts/lib/cli-maintenance-commands.js

@@ -434,7 +434,7 @@ function buildCliMaintenanceCommands(ctx) {
       if (isSrc) {
         console.log(`  ${c.dim('No workspace host artifacts.')} ${c.dim(`This is expected in ${workspaceCleanMode}.`)}`)
       } else {
-        console.log(`  ${c.yellow('Workspace runtime not initialized.')} Run ${c.bold('devcodex init')}; host adapters require ${c.bold('npm install -g devcodex')}.`)
+        console.log(`  ${c.yellow('Workspace runtime not initialized.')} Run ${c.bold('devcodex init')}; host adapters require ${c.bold('npm install -g @devcodex/devcodex')}.`)
       }
     } else {
       console.log(`  ${c.yellow(`${total} legacy workspace host entry files`)} detected; global receipts above are the installation authority`)
@@ -864,7 +864,7 @@ function buildCliMaintenanceCommands(ctx) {
       console.log(`    ${host.host.padEnd(10)} ${state}`)
     }
     if (missingAdapters.length) {
-      console.log(c.yellow(`    Missing adapters: ${missingAdapters.map(host => host.host).join(', ')}. Repair with \`npm install -g devcodex\`.`))
+      console.log(c.yellow(`    Missing adapters: ${missingAdapters.map(host => host.host).join(', ')}. Repair with \`npm install -g @devcodex/devcodex\`.`))
     } else {
       console.log(c.green(sourceRepository
         ? '    No independently missing adapter was found by the source-candidate comparison.'
@@ -908,7 +908,7 @@ function buildCliMaintenanceCommands(ctx) {
         ? '    The source candidate differs from the installed Copilot receipt; installed Copilot adapter health is not asserted.'
         : globalAdapterReady('copilot')
         ? '    Copilot CLI user-global instructions, Hooks, MCP, and Skills are installed by the global adapter.'
-        : '    Copilot CLI user-global instructions, Hooks, MCP, and Skills require `npm install -g devcodex`.')
+        : '    Copilot CLI user-global instructions, Hooks, MCP, and Skills require `npm install -g @devcodex/devcodex`.')
       console.log('    Operational readiness still requires a successful native `copilot --version` deep probe.')
       console.log(`    IDE workspace hooks and per-repository instruction files are not installed in ${workspaceCleanMode}.`)
       console.log()
@@ -922,32 +922,32 @@ function buildCliMaintenanceCommands(ctx) {
     if (platform === 'copilot' && !globalReady('copilot') && !sourceCandidateMismatchSet.has('copilot')) {
       console.log(c.yellow(globalAdapterReady('copilot')
         ? '  ⚠️  Copilot user-global adapter is ready, but the native `copilot --version` probe did not pass — install or repair Copilot CLI, then rerun `devcodex doctor`.'
-        : '  ⚠️  Copilot CLI detected without a ready user-global adapter — run `npm install -g devcodex`.'))
+        : '  ⚠️  Copilot CLI detected without a ready user-global adapter — run `npm install -g @devcodex/devcodex`.'))
       console.log()
     }
     if (platform === 'claude' && !globalReady('claude') && !sourceCandidateMismatchSet.has('claude')) {
       console.log(c.yellow(globalAdapterReady('claude')
         ? '  ⚠️  Claude user-global adapter is ready, but the native `claude --version` probe did not pass — install or repair Claude Code, then rerun `devcodex doctor`.'
-        : '  ⚠️  Claude Code detected without a ready user-global adapter — run `npm install -g devcodex`.'))
+        : '  ⚠️  Claude Code detected without a ready user-global adapter — run `npm install -g @devcodex/devcodex`.'))
       console.log()
     }
     if (platform === 'codex' && !globalReady('codex') && !sourceCandidateMismatchSet.has('codex')) {
       console.log(c.yellow(globalAdapterReady('codex')
         ? '  ⚠️  Codex user-global adapter is ready, but the native `codex --version` probe did not pass — install or repair Codex, then rerun `devcodex doctor`.'
-        : '  ⚠️  Codex detected without a ready user-global adapter — run `npm install -g devcodex`.'))
+        : '  ⚠️  Codex detected without a ready user-global adapter — run `npm install -g @devcodex/devcodex`.'))
       if (!globalAdapterReady('codex')) console.log(c.dim(`      Expected hook command: ${CODEX_HOOK_COMMAND}`))
       console.log()
     }
     if (platform === 'gemini' && !globalReady('gemini') && !sourceCandidateMismatchSet.has('gemini')) {
       console.log(c.yellow(globalAdapterReady('gemini')
         ? '  ⚠️  Gemini user-global adapter is ready, but the native `gemini --version` probe did not pass — install or repair Gemini CLI, then rerun `devcodex doctor`.'
-        : '  ⚠️  Gemini CLI detected without a ready user-global adapter — run `npm install -g devcodex`.'))
+        : '  ⚠️  Gemini CLI detected without a ready user-global adapter — run `npm install -g @devcodex/devcodex`.'))
       console.log()
     }
     if (platform === 'grok' && !globalReady('grok') && !sourceCandidateMismatchSet.has('grok')) {
       console.log(c.yellow(globalAdapterReady('grok')
         ? '  ⚠️  Grok user-global adapter is ready, but the native `grok version` probe did not pass — install or repair Grok, then rerun `devcodex doctor`.'
-        : '  ⚠️  Grok detected without a ready user-global adapter — run `npm install -g devcodex`.'))
+        : '  ⚠️  Grok detected without a ready user-global adapter — run `npm install -g @devcodex/devcodex`.'))
       console.log()
     }
     if (hostParity && !hostParity.hardReady && sourceRepository) {
@@ -982,7 +982,7 @@ function buildCliMaintenanceCommands(ctx) {
       for (const issue of instructionProjection.issues) console.log(c.yellow(`  ⚠️  ${issue.code}`))
       console.log(c.dim(sourceRepository
         ? '      Source-candidate scope does not establish installed adapter failure; validate the packed candidate first.'
-        : '      These are legacy workspace artifacts. Repair the user-global adapter with `npm install -g devcodex`.'))
+        : '      These are legacy workspace artifacts. Repair the user-global adapter with `npm install -g @devcodex/devcodex`.'))
       console.log()
     }
     if ((instructionProjection.warnings || []).length) {
@@ -1048,9 +1048,9 @@ function buildCliMaintenanceCommands(ctx) {
       devcodex global-adapters apply --dry-run  # R1a: plan user-global adapters from source tree
       devcodex global-adapters apply            # R1a: refresh user-global adapters without pack/publish
       npm install -g .                          # R1b: local global install postinstall refresh
-      npm pack && npm install -g ./vextjs-devcodex-*.tgz  # R2: pre-release tarball
-      npm install -g devcodex                   # R3: published install + postinstall adapters
-      npm update -g devcodex                    # R3: published upgrade + postinstall refresh
+      npm pack && npm install -g ./devcodex-devcodex-*.tgz  # R2: pre-release tarball
+      npm install -g @devcodex/devcodex                   # R3: published install + postinstall adapters
+      npm update -g @devcodex/devcodex                    # R3: published upgrade + postinstall refresh
       npm install devcodex                      # Dependency only; prints the required -g guidance
       devcodex init                             # R4: initialize only this workspace .devcodex
       devcodex update                           # R4: refresh only this workspace .devcodex