@bovinphang/craft-common 1.0.1 → 2.0.0

package/localized/zh-CN/skills/cc-cpp-project-standard/references/common/engineering-practices.sources.json

@@ -0,0 +1,377 @@
+{
+  "schemaVersion": 1,
+  "sources": [
+    {
+      "id": "google-review",
+      "publisher": "Google",
+      "title": "Code review standard",
+      "url": "https://google.github.io/eng-practices/review/reviewer/standard.html",
+      "section": "Engineering principles and code health",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living public guidance; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Use evidence and project standards; personal preference alone is not a blocker."
+    },
+    {
+      "id": "ms-playbook",
+      "publisher": "Microsoft ISE",
+      "title": "Test planning",
+      "url": "https://microsoft.github.io/code-with-engineering-playbook/automated-testing/test-planning/",
+      "section": "Risk, test scope and responsibilities",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living ISE playbook; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Team practice, not a company-wide mandate; retain existing tools."
+    },
+    {
+      "id": "ms-faults",
+      "publisher": "Microsoft ISE",
+      "title": "Fault injection testing",
+      "url": "https://microsoft.github.io/code-with-engineering-playbook/automated-testing/fault-injection-testing/",
+      "section": "Controlled failure and observations",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living ISE playbook; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Run scoped, controlled failures; do not infer production reliability from a small example."
+    },
+    {
+      "id": "google-ts",
+      "publisher": "Google",
+      "title": "TS/JS style guide",
+      "url": "https://google.github.io/styleguide/tsguide.html",
+      "section": "Environment caveat; types and exceptions",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Public guide; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Google explicitly notes internal constraints differ; no blanket ban overriding a justified project convention."
+    },
+    {
+      "id": "typescript-publishing",
+      "publisher": "TypeScript",
+      "title": "Publishing declaration files",
+      "url": "https://www.typescriptlang.org/docs/handbook/declaration-files/publishing.html",
+      "section": "Types and declaration dependencies",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living handbook; check installed compiler/module resolution",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Validate the actual packed consumer; do not upgrade compiler or module mode on this basis."
+    },
+    {
+      "id": "rust-api",
+      "publisher": "Rust library team",
+      "title": "Rust API Guidelines",
+      "url": "https://rust-lang.github.io/api-guidelines/",
+      "section": "Type safety, dependability and future proofing",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living recommendations; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Guidance rather than language law; preserve edition and MSRV."
+    },
+    {
+      "id": "tokio-join",
+      "publisher": "Tokio project",
+      "title": "JoinHandle",
+      "url": "https://docs.rs/tokio/latest/tokio/task/struct.JoinHandle.html",
+      "section": "Drop, abort and completion",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Page observed 1.54.1; project runtime/version determines applicability",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Tokio-specific mechanics only when Tokio is already used; no new runtime dependency."
+    },
+    {
+      "id": "uber-go",
+      "publisher": "Uber",
+      "title": "Go Style Guide",
+      "url": "https://github.com/uber-go/guide/blob/master/style.md",
+      "section": "Errors, interfaces and goroutine lifetime",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living master; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Do not import Uber dependencies or turn buffer-size style into a correctness theorem."
+    },
+    {
+      "id": "go-context",
+      "publisher": "Go project",
+      "title": "context package",
+      "url": "https://pkg.go.dev/context",
+      "section": "Cancellation propagation and ownership",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Standard library; check owning go.mod/toolchain",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "A cancellation signal alone does not confirm worker exit."
+    },
+    {
+      "id": "google-java",
+      "publisher": "Google",
+      "title": "Java Style Guide",
+      "url": "https://google.github.io/styleguide/javaguide.html",
+      "section": "Source structure and exception handling",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living public style; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Naming/layout follows local standard; style is distinct from runtime correctness."
+    },
+    {
+      "id": "oracle-resources",
+      "publisher": "Oracle",
+      "title": "Try-with-resources",
+      "url": "https://docs.oracle.com/javase/tutorial/essential/exceptions/tryResourceClose.html",
+      "section": "Closing resources and suppressed exceptions",
+      "checkedAt": "2026-11-08",
+      "versionScope": "JDK8 tutorial; not a source for newer runtime features",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Preserve primary cause and borrowed-resource ownership; check actual API contract."
+    },
+    {
+      "id": "java-executor",
+      "publisher": "Oracle",
+      "title": "ExecutorService",
+      "url": "https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/concurrent/ExecutorService.html",
+      "section": "Shutdown, termination and awaitTermination",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Java SE17 documentation",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Check target JDK; no automatic virtual-thread or JDK migration."
+    },
+    {
+      "id": "google-python",
+      "publisher": "Google",
+      "title": "Python Style Guide",
+      "url": "https://google.github.io/styleguide/pyguide.html",
+      "section": "Imports, exceptions and mutable state",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living public guide; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Keep current formatter/type checker and library responsibilities."
+    },
+    {
+      "id": "python-asyncio",
+      "publisher": "Python project",
+      "title": "Coroutines and tasks",
+      "url": "https://docs.python.org/3/library/asyncio-task.html",
+      "section": "Cancellation and task ownership",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Page observed 3.15.2; feature availability follows project Python",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Newer TaskGroup/timeout features require a supported project version; no upgrade implied."
+    },
+    {
+      "id": "cert-c",
+      "publisher": "CMU SEI",
+      "title": "MEM00-C allocation and release",
+      "url": "https://cmu-sei.github.io/secure-coding-standards/sei-cert-c-coding-standard/recommendations/memory-management-mem/mem00-c/",
+      "section": "MEM00-C memory responsibility",
+      "checkedAt": "2026-11-08",
+      "versionScope": "2016-edition standard family; MEM00-C is a recommendation",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Do not label recommendations as mandatory CERT rules or apply C++ ownership machinery to pure C."
+    },
+    {
+      "id": "cpp-core",
+      "publisher": "C++ Core Guidelines editors",
+      "title": "C++ Core Guidelines",
+      "url": "https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines",
+      "section": "Resource and lifetime interfaces",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Page dated 2026-06-14, living release0.8",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Adapt to existing exception policy and compiler; borrowing does not imply ownership."
+    },
+    {
+      "id": "google-cpp",
+      "publisher": "Google",
+      "title": "C++ Style Guide",
+      "url": "https://google.github.io/styleguide/cppguide.html",
+      "section": "Exceptions and project consistency",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living public guide; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Its exception/standard policy is not universal; preserve the owning project policy and C ABI."
+    },
+    {
+      "id": "ms-sal",
+      "publisher": "Microsoft",
+      "title": "Understanding SAL",
+      "url": "https://learn.microsoft.com/en-us/cpp/code-quality/understanding-sal?view=msvc-170",
+      "section": "Parameter preconditions and output guarantees",
+      "checkedAt": "2026-11-08",
+      "versionScope": "MSVC170 documentation view",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "SAL is an optional toolchain-specific expression, not a portable mandatory annotation."
+    },
+    {
+      "id": "aws-retry",
+      "publisher": "AWS",
+      "title": "Timeouts, retries and backoff with jitter",
+      "url": "https://aws.amazon.com/builders-library/timeouts-retries-and-backoff-with-jitter/",
+      "section": "Timeouts, bounded retries and retry amplification",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Article dated 2019-12-05; official Builder Center redirect",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Retry only semantically safe operations within a total budget; failure classes alone do not grant write replay."
+    },
+    {
+      "id": "aws-idempotency",
+      "publisher": "AWS",
+      "title": "Making retries safe with idempotent APIs",
+      "url": "https://aws.amazon.com/builders-library/making-retries-safe-with-idempotent-APIs/",
+      "section": "Caller intent, duplicate requests and atomic recording",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Builders Library; revision unknown",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "A process-local example does not establish database/multi-process exactly-once."
+    },
+    {
+      "id": "react-effects",
+      "publisher": "React project",
+      "title": "useEffect",
+      "url": "https://react.dev/reference/react/useEffect",
+      "section": "Cleanup and fetching race conditions",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Page observed React19.3; use installed project API",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "Abort and stale-result checks complement each other; no React upgrade implied."
+    },
+    {
+      "id": "react-act",
+      "publisher": "React project",
+      "title": "act",
+      "url": "https://react.dev/reference/react/act",
+      "section": "Applying updates before assertions",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Page observed React19.3; verify sample versions",
+      "licenseStatus": "unknown",
+      "adoption": "adopt",
+      "limits": "DOM simulation is not browser E2E or native desktop execution."
+    },
+    {
+      "id": "vue-watchers",
+      "publisher": "Vue project",
+      "title": "Watchers",
+      "url": "https://vuejs.org/guide/essentials/watchers.html",
+      "section": "Side-effect cleanup",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Vue3; onWatcherCleanup requires3.5+ and synchronous registration",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Use supported callback cleanup on older Vue3; no framework migration."
+    },
+    {
+      "id": "tauri-permissions",
+      "publisher": "Tauri project",
+      "title": "Permissions",
+      "url": "https://v2.tauri.app/security/permissions/",
+      "section": "Command allow/deny and capability scope",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Tauri2 docs; check installed version/configuration",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Rust command-unit tests do not activate webview permissions or prove packaged GUI security."
+    },
+    {
+      "id": "electron-security",
+      "publisher": "Electron project",
+      "title": "Security",
+      "url": "https://www.electronjs.org/docs/latest/tutorial/security",
+      "section": "IPC sender checks and renderer trust",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living docs; match installed Electron",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Handler tests do not prove sandbox/context isolation is active in a packaged app."
+    },
+    {
+      "id": "spring-tests",
+      "publisher": "Spring project",
+      "title": "Testing Spring Boot applications",
+      "url": "https://docs.spring.io/spring-boot/3.5/reference/testing/spring-boot-applications.html",
+      "section": "Test slices and application tests",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Boot3.5 docs observed3.5.16; preserve sample/project versions",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Test scope matters; MVC tests do not establish live DB/transaction or deployment behavior."
+    },
+    {
+      "id": "fastapi-lifespan",
+      "publisher": "FastAPI project",
+      "title": "Lifespan events",
+      "url": "https://fastapi.tiangolo.com/advanced/events/",
+      "section": "Acquire and release application resources",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living FastAPI documentation; match pinned dependencies",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Use actual lifespan execution in tests; import does not own a live connection."
+    },
+    {
+      "id": "gin-binding",
+      "publisher": "Gin project",
+      "title": "Binding",
+      "url": "https://gin-gonic.com/en/docs/binding/",
+      "section": "Binding errors and validation",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living Gin documentation; match pinned module",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Writing/aborting a response does not replace explicit control-flow return in the current handler."
+    },
+    {
+      "id": "axum-extractors",
+      "publisher": "Axum project",
+      "title": "Extractors",
+      "url": "https://docs.rs/axum/latest/axum/extract/",
+      "section": "Extractor order and rejections",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Latest route observed0.8.9; fixed0.8.9 route unavailable via browser tool",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Pinned existing example is authoritative for compilation; do not assume source signatures across releases."
+    },
+    {
+      "id": "drogon-filters",
+      "publisher": "Drogon project",
+      "title": "Middleware and Filter",
+      "url": "https://github.com/drogonframework/drogon/wiki/ENG-05-Middleware-and-Filter",
+      "section": "Filter callbacks and continuation",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Living wiki; match compiled example version",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Synthetic role headers are not authentication; callback lifetime must follow actual ownership."
+    },
+    {
+      "id": "node-typescript",
+      "publisher": "Node.js project",
+      "title": "Modules: TypeScript",
+      "url": "https://nodejs.org/api/typescript.html",
+      "section": "Type-stripping history, enabling, and separate type checking",
+      "checkedAt": "2026-11-08",
+      "versionScope": "Page observed26.13.0; sample>=22.18, actual24.14.1 tested; product Node>=22 unchanged",
+      "licenseStatus": "unknown",
+      "adoption": "conditional",
+      "limits": "Native stripping is not type checking and ignores tsconfig. Missing sample capability is MISSING, not a product runtime upgrade."
+    }
+  ]
+}

package/localized/zh-CN/skills/cc-cpp-project-standard/references/engineering-practices.md

@@ -0,0 +1,106 @@
+---
+practiceCards:
+  - id: "cc-cpp-project-standard:raii-borrowing"
+    level: "required"
+    sourceIds: ["cpp-core"]
+    caseIds: ["EP-CPP-01"]
+    evidence: "case"
+  - id: "cc-cpp-project-standard:exception-abi"
+    level: "conditional"
+    sourceIds: ["cpp-core","google-cpp","cert-c"]
+    caseIds: ["EP-CPP-01","EP-C-01"]
+    evidence: "review-only"
+  - id: "cc-cpp-project-standard:teardown-lifetime"
+    level: "conditional"
+    sourceIds: ["cpp-core","cert-c"]
+    caseIds: ["EP-CPP-01","EP-IPC-01"]
+    evidence: "review-only"
+---
+
+# 本入口工程决策
+
+先定位项目角色、工具链及已有约定，再按需读取[公共原则](common/engineering-practices.md)。下列条件仅约束当前语言/场景；结构检查不证明全部语义或实际运行。
+
+<a id="cc-cpp-project-standard:raii-borrowing"></a>
+## RAII拥有已获取资源，不接管全部指针
+
+级别: required
+
+### 风险
+用默认拥有删除器包装借用指针，可能释放别人的对象。
+
+### 适用
+适用于C++所有权API、构造及错误路径，先区分拥有、借用及共享寿命。
+
+### 决策
+本单元取得资源用RAII，借用值保留非拥有表示；unique_ptr表达独占拥有，shared_ptr需要真实共享寿命契约。
+
+### 例外
+自定义拥有者须配对分配器/删除器；智能指针不使悬挂借用安全，也不消除外部寿命前提。
+
+### 正反示意
+正例：本地unique_ptr拥有新lease，输入仍借用。反例：把所有raw输入转为shared_ptr。
+
+### 验证
+运行借用/部分构造断言；缺陷测试使用调用方堆对象并避免第二次delete，不靠不稳定UB崩溃。
+
+### 来源
+cpp-core — [来源与适用限制](common/engineering-practices.sources.json).
+
+证据标识: EP-CPP-01; case. [本入口可运行案例](../examples/engineering/README.md)。 执行状态及覆盖范围见实际记录；关联ID不证明该卡全部语义。
+
+<a id="cc-cpp-project-standard:exception-abi"></a>
+## 遵循所属项目异常与ABI政策
+
+级别: conditional
+
+### 风险
+全局启用异常或跨外部ABI展开可能破坏已有有效契约。
+
+### 适用
+实际存在异常/FFI边界时适用，Google等项目有意采用不同政策。
+
+### 决策
+先读编译标志和边界契约，启异常时保证部分构造安全；禁异常时沿用显式失败路径；保持C ABI错误/输出契约。
+
+### 例外
+noexcept不会把抛异常分配转成错误码；本地启异常样例只是独立目标，不授权改变用户标志或标准。
+
+### 正反示意
+正例：保留项目错误政策及分配器清理。反例：因指南偏好而启异常或把C迁为C++。
+
+### 验证
+按实际项目政策编译，检查失败转换/清理；样例只证明自己的C++边界，未验证跨ABI展开。
+
+### 来源
+cpp-core, google-cpp, cert-c — [来源与适用限制](common/engineering-practices.sources.json).
+
+证据标识: EP-CPP-01, EP-C-01; review-only.  执行状态及覆盖范围见实际记录；关联ID不证明该卡全部语义。
+
+<a id="cc-cpp-project-standard:teardown-lifetime"></a>
+## 先停止使用方，再释放共享依赖
+
+级别: conditional
+
+### 风险
+即使一个拥有者重置句柄，回调仍可能超出原生对象或插件代码寿命。
+
+### 适用
+适用于并发回调、原生插件和桌面关闭，顺序局部RAII无需引入调度器。
+
+### 决策
+先停新调用，取消/排空并确认所属任务结束，再释放缓冲、回调目标或卸载代码；明确每个join和最终释放方。
+
+### 例外
+引用计数只保护正确建模的所有权，不能防止所有悬挂别名或证明回调静止；强制关闭须明确未完成政策。
+
+### 正反示意
+正例：确认回调结束再卸载插件。反例：重置一个shared_ptr就认为所有借用指针安全失效。
+
+### 验证
+以受控销毁交错及实际原生工具检查，本地部分构造不证明race自由、GUI退出或代码卸载安全。
+
+### 来源
+cpp-core, cert-c — [来源与适用限制](common/engineering-practices.sources.json).
+
+证据标识: EP-CPP-01, EP-IPC-01; review-only.  执行状态及覆盖范围见实际记录；关联ID不证明该卡全部语义。

package/localized/zh-CN/skills/cc-cpp-project-standard/references/practice.md

@@ -0,0 +1,37 @@
+# C++ 工程规范
+
+## 关键检查
+
+1. 选择特性前读取实际 C++ 标准、标准库、编译器矩阵、构建 preset 和导出 ABI。
+
+2. 使用合适 RAII owner 表达所有权，借用指针保持明确借用；不要把外部拥有的裸指针擅自包成共享拥有。
+
+3. 说明异常保证并处理部分构造的资源释放；在明确边界捕获并准确转换失败，保持析构安全。
+
+4. 跨 DLL/FFI 时分配与释放配对，避免异常和不稳定实现类型穿越不支持的 ABI 契约。
+
+5. 审查析构顺序、回调生命周期及卸载同步，测试竞争销毁和错误路径，而不只测成功构造。
+
+6. 在声明平台验证现有构建和可用诊断，缺工具明确报告；编译成功不能证明竞态或生命周期安全。
+
+<a id="scope"></a>
+## 边界与案例
+
+适用场景：
+- 审查 C++ RAII 和异常安全
+- 保持插件 ABI 并明确所有权
+- 整理头文件与模板依赖边界
+- 测试 C++ 析构及部分构造
+
+应用角色按实际证据区分；本语言模块可用于库、CLI、桌面或服务，框架问题另选专项。
+
+## 交付要求
+
+- 已读取的工程/契约证据及变更作用域。
+- 选用方案、关键不变量、资源/错误或失败边界。
+- 实际运行的命令与结果，未运行项及不能证明的结论。
+- 兼容、恢复/回滚或后续处理限制；评审结论须给可核实位置。
+
+## 权威资料
+
+[相关官方/项目资料](https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines)（核验日期：2026-11-06）。实际使用时再匹配项目声明版本，不把参考页的最新版本当作升级授权。

package/localized/zh-CN/skills/cc-electron-project-standard/SKILL.md

@@ -0,0 +1,21 @@
+---
+name: cc-electron-project-standard
+description: 用于 Electron 的 main/preload/renderer 边界、contextBridge IPC、sender 校验、sandbox、导航策略、原生模块、生命周期与桌面打包；没有 Electron 的 Node HTTP 服务不属于本专项。
+---
+
+# Electron 应用工程
+
+定位拥有任务的应用及 main、preload、renderer 入口；JavaScript/TypeScript 不限定浏览器或服务角色。
+
+1. 读取实际 Electron/Node/Chromium 版本、锁、打包工具及平台，保持既有模块和构建约定。
+2. 定义狭窄桥接契约：每个 channel 一个明确操作，校验参数并稳定返回结果；main 在执行权限操作前核对真实 sender/frame。
+3. 联合检查 `contextIsolation`、sandbox、Node integration、preload、协议/CSP、导航及新窗口；隔离的 renderer 仍是不可信 IPC 输入来源。
+4. 明确 handler、监听、窗口、worker 及原生资源的启动/退出所有者；按实际分发产物检查原生模块 ABI、重建和 ASAR/资源路径。
+5. 使用[实践清单](references/practice.md)和[完整最小案例](examples/minimal/README.md)，其中包括三进程契约及显式缺陷版本。
+6. 遵循[验证边界](references/verification.md)：先验证拒绝 sender/参数，再验证真实进程/UI、平台包、更新及签名。
+
+交付进程边界、桥接契约、安全决定、实际验证及平台缺口。Node handler 单测不证明 Electron sandbox 生效或应用签名完成。
+
+## 工程实践
+
+按当前任务读取[本入口工程细则](references/engineering-practices.md)，再按链接选择公共原则。规则级别与例外以实际项目契约为准；不因产品前后端标签限制语言或职责。

package/localized/zh-CN/skills/cc-electron-project-standard/examples/engineering/README.md

@@ -0,0 +1,7 @@
+# Handler生命周期 — EP-IPC-01
+
+复制到独立可写目录，以CRAFT_ENGINEERING_DEFECTIVE=1/0运行node --test --test-reporter=tap ipc-lifecycle.test.cjs。PowerShell设$env:CRAFT_ENGINEERING_DEFECTIVE，POSIX可在命令前赋值。默认受保护，Node22+即可，无Electron下载、父源码或兄弟示例依赖。
+
+真实async handler校验发送者/frame/精确文档及有界输入，拥有AbortController，准备后再查寿命/取消/信任才同步commit。可控Promise故意忽略取消，测试真实关闭/取消后的零commit、允许及拒绝调用。prepare须无特权，commit是main拥有的同步操作；异步或已提交外部写需独立生命周期/事务契约，取消不回滚，也未证明并发活跃调用顺序。
+
+真实应用应接线到窄ipcMain操作及窗口生命周期；既有minimal文件演示另一路接线。Node单元测试不激活GUI、sandbox、隔离、权限、签名或打包，这些仍NOT RUN，需目标环境实证。日志置于源码外。

package/localized/zh-CN/skills/cc-electron-project-standard/examples/engineering/ipc-lifecycle.cjs

@@ -0,0 +1,44 @@
+/** Main-owned handler core. prepare is non-privileged; commit is synchronous. */
+function createTitleHandler({ trustedContentsId, trustedUrl, prepare, commit }) {
+  let closed = false;
+  const owned = new Set();
+  const defective = process.env.CRAFT_ENGINEERING_DEFECTIVE === '1';
+  function trusted(event) {
+    return event?.sender?.id === trustedContentsId &&
+      typeof event.sender.isDestroyed === 'function' && !event.sender.isDestroyed() &&
+      event.senderFrame && event.senderFrame === event.sender.mainFrame &&
+      event.senderFrame.url === trustedUrl;
+  }
+  return {
+    async handle(event, payload, { signal } = {}) {
+      if (!trusted(event)) throw new Error('untrusted sender');
+      if (!payload || typeof payload !== 'object' || Array.isArray(payload) ||
+          Object.keys(payload).length !== 1 || typeof payload.title !== 'string' ||
+          !payload.title.trim() || payload.title.length > 80 || /[\x00-\x1f\x7f]/.test(payload.title)) {
+        throw new Error('invalid title');
+      }
+      if (closed || signal?.aborted) throw new Error('handler closed or cancelled');
+      const title = payload.title;
+      const controller = new AbortController();
+      const cancel = () => controller.abort();
+      owned.add(controller);
+      signal?.addEventListener('abort', cancel, { once: true });
+      try {
+        await prepare({ title }, { signal: controller.signal });
+        if (!defective && (closed || controller.signal.aborted || !trusted(event))) {
+          throw new Error('handler closed or cancelled');
+        }
+        commit(title);
+        return { ok: true };
+      } finally {
+        signal?.removeEventListener('abort', cancel);
+        owned.delete(controller);
+      }
+    },
+    close() {
+      closed = true;
+      for (const controller of owned) controller.abort();
+    },
+  };
+}
+module.exports = { createTitleHandler };

package/localized/zh-CN/skills/cc-electron-project-standard/examples/engineering/ipc-lifecycle.test.cjs

@@ -0,0 +1,44 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { createTitleHandler } = require('./ipc-lifecycle.cjs');
+const trustedUrl = 'app://bundle/index.html';
+function event() {
+  const frame = { url: trustedUrl };
+  return { sender: { id: 7, mainFrame: frame, isDestroyed: () => false }, senderFrame: frame };
+}
+function deferred() {
+  let resolve;
+  const promise = new Promise(done => { resolve = done; });
+  return { promise, resolve };
+}
+test('EP-IPC-01 closed handler cannot produce privileged effects', async () => {
+  const gate = deferred(), effects = [];
+  const handler = createTitleHandler({ trustedContentsId: 7, trustedUrl, prepare: () => gate.promise, commit: title => effects.push(title) });
+  const pending = handler.handle(event(), { title: 'safe' });
+  const rejected = assert.rejects(pending, /closed or cancelled/);
+  handler.close(); gate.resolve(); await rejected;
+  assert.deepEqual(effects, []);
+});
+test('EP-IPC-01 cancelled handler cannot produce privileged effects', async () => {
+  const gate = deferred(), effects = [], cancel = new AbortController();
+  const handler = createTitleHandler({ trustedContentsId: 7, trustedUrl, prepare: () => gate.promise, commit: title => effects.push(title) });
+  const pending = handler.handle(event(), { title: 'safe' }, { signal: cancel.signal });
+  const rejected = assert.rejects(pending, /closed or cancelled/);
+  cancel.abort(); gate.resolve(); await rejected;
+  assert.deepEqual(effects, []);
+});
+test('EP-IPC-01 valid live call commits once', async () => {
+  const effects = [];
+  const handler = createTitleHandler({ trustedContentsId: 7, trustedUrl, prepare: async () => {}, commit: title => effects.push(title) });
+  assert.deepEqual(await handler.handle(event(), { title: 'safe' }), { ok: true });
+  assert.deepEqual(effects, ['safe']);
+  handler.close();
+});
+test('EP-IPC-01 denied sender and malformed payload have zero effects', async () => {
+  const effects = [];
+  const handler = createTitleHandler({ trustedContentsId: 7, trustedUrl, prepare: async () => {}, commit: title => effects.push(title) });
+  const untrusted = event(); untrusted.senderFrame.url = 'https://untrusted.invalid/';
+  await assert.rejects(handler.handle(untrusted, { title: 'safe' }), /untrusted sender/);
+  await assert.rejects(handler.handle(event(), { title: '' }), /invalid title/);
+  assert.deepEqual(effects, []);
+});

package/localized/zh-CN/skills/cc-electron-project-standard/examples/engineering/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "engineering-ipc-lifecycle-example",
+  "version": "0.0.0",
+  "private": true,
+  "type": "commonjs",
+  "engines": { "node": ">=22" },
+  "scripts": { "test": "node --test --test-reporter=tap ipc-lifecycle.test.cjs" }
+}