@mingfuyun/star-allinone 0.1.6 → 0.1.8

package/skills/shared/commit-current-changes/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: {{sharedSkillName}}
+description: Review the active frontend project's changes and prepare a confirmation-gated Conventional Commit and optional push. Use when the user asks to review current changes, submit code, or commit and push. Never commit before explicit confirmation.
+---
+
+# Commit Current Changes
+
+This skill is fully shared. Review user-authorized working-tree changes, report findings and a commit proposal, and mutate Git only after explicit confirmation.
+
+## Write-operation gate
+
+Git writes are forbidden until both gates are complete in the current turn:
+
+1. **Review gate**: deliver a report with findings or `No issues found.`
+2. **Confirmation gate**: present exact file paths and the exact commit subject, then receive affirmative confirmation of that proposal. “提交代码” is not confirmation before the proposal exists.
+
+Before `git add`, `git commit`, or `git push`, re-check status and diff. If scope changed, stop and issue a new proposal. Never infer confirmation from urgency or a previous turn.
+
+## Workflow
+
+### 1. Scope
+
+Run `git status --short --branch`, `git diff --stat`, and `git diff`. Inspect cached diffs when staged changes exist. Do not include unrelated user-owned files. Follow recent `git log` language and naming.
+
+### 2. Review
+
+Read:
+
+1. `.agents/skills/shared-project-conventions/references/review-checklist.md`
+2. `.agents/skills/shared-project-conventions/references/quality-checklist.md`
+3. `.agents/skills/shared-project-conventions/references/architecture.md`
+
+This skill is fully shared. If `.agents/project/review-rules.md` exists, apply extra domain checks only; do not weaken shared hard rules.
+
+Classify only concrete security, data-loss, runtime, contract, validation, performance, accessibility, or maintainability risks as P0–P2.
+
+```text
+[P1] Short finding title — src/path/file.tsx:42
+Impact and reproduction/contract evidence.
+Fix: focused direction, without unrelated redesign.
+```
+
+### 3. Validate
+
+Always run `git diff --check`. Then run focused Prettier, ESLint, TypeScript, and the project's documented build in proportion to risk. Do not auto-fix. Do not propose commit while an unresolved P0/P1 or a current-change validation failure remains.
+
+### 4. Proposal
+
+Lead with findings. Then present optional improvements, validation results, change summary, exact files, branch/remote, and a concise Chinese Conventional Commit message (`feat` / `fix` / `refactor` / `chore` / `docs` / `test` / `style` / `perf` / `build` / `ci`). Stop and wait.
+
+### 5. After confirmation
+
+1. Re-inspect the working tree. If the diff changed, propose again.
+2. Stage only confirmed paths.
+3. Commit without `--no-verify` unless the user explicitly authorizes it. Do not amend unless requested.
+4. Push to upstream, or `git push -u origin HEAD` when none exists. Never force-push.
+5. Report hash, subject, files, validation, and remote branch.
+
+## Safety
+
+- Never expose credentials from diffs; stop if secrets are present.
+- Never use destructive Git commands to clean the working tree.
+- If push is rejected, report the reason and do not rewrite history without separate authorization.

package/skills/shared/design-to-page/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: {{sharedSkillName}}
+description: Implement frontend pages from designs using the active project's React, Umi, Ant Design Pro, service, permission, routing, and component conventions. Use when translating Figma, screenshots, wireframes, or UI specs into page code.
+---
+
+# Design to Page
+
+Translate a design into repository-native code. Reuse existing architecture; do not invent a parallel stack.
+
+Before implementation, read:
+
+1. `.star-allinone.json`
+2. [references/page-conventions.md](references/page-conventions.md)
+3. [references/overlays.md](references/overlays.md) for any modal, drawer, or confirmation
+4. `.agents/skills/shared-project-conventions/references/architecture.md`
+
+If `.agents/project/conventions.md` exists, use it only for extra paths.
+
+Inspect the nearest existing page of the same type before proposing files.
+
+## Workflow
+
+1. List visible states: default, loading, empty, error, disabled, overflow, permission, and narrow-screen.
+2. Resolve ambiguities that affect APIs, route ownership, permissions, or component boundaries. For minor visual gaps, follow the closest precedent and state the assumption.
+3. Write a short implementation contract: route, sections, query fields, columns, actions, APIs, permissions, states, and files.
+4. Implement the smallest complete vertical slice. Keep columns and actions outside render. Keep overlay concerns in focused components.
+5. API-backed pages include types, `MFRequest` methods, aggregate exports, and page consumption in the same change. Use `.agents/skills/shared-api-to-service/SKILL.md` for missing services. Use `.agents/skills/shared-api-mock/SKILL.md` for deterministic data. Do not embed production fake data.
+6. Compare desktop and narrow layouts against the design. Fix structure and spacing before decoration.
+7. Run focused verification. Do not claim visual fidelity without inspecting the rendered page.
+
+## Hard rules
+
+- React function components, TypeScript, Ant Design 5, Pro Components, Less.
+- `ProForm` for business forms. `MFProTable` for management lists.
+- Overlays from `@mingfuyun/star-allinone`: `CustomDrawer`, `BaseModal`, `HocModal`.
+- Every `await` uses `try-catch`; loading restores in `finally`; `validateFields()` failures are logged and stop the request.
+- Mutations guard duplicate submit, show feedback, and reload affected lists.
+- Do not add a UI library, state library, or CSS-in-JS system without approval.
+- Do not refactor unrelated code.
+
+## Verification
+
+```bash
+pnpm exec prettier --check <changed-files>
+pnpm exec tsc --noEmit
+```
+
+Run `pnpm lint` for broad or shared changes. Run the project's documented build command when routes, entry, or multiple pages change.

package/skills/shared/design-to-page/references/overlays.md

@@ -0,0 +1,73 @@
+# Overlays
+
+Use this reference for every modal, confirmation dialog, and drawer. Import `@mingfuyun/star-allinone/dist/styles.css` once from the application entry, not from feature components.
+
+## Required components
+
+- `CustomDrawer` for create, edit, detail, or configuration drawers.
+- `BaseModal` for forms, selections, confirmations, previews, and other dialogs.
+- Wrap feature overlays with `HocModal` so pages open them through a ref.
+- Keep Ant Design and Pro Components for overlay content.
+- Use `ProForm` for every editable overlay form.
+
+Do not add new direct feature-level imports of Ant Design `Drawer`, `Modal`, or `Modal.confirm`.
+
+## Ref contract
+
+```tsx
+export interface ItemDrawerRef {
+  show: (args?: { record?: DOMAIN_API.Item }) => void;
+  hide: () => void;
+}
+```
+
+The wrapped component receives `visible`, `handleCancel`, and the args passed to `show`. Render the overlay once and open it from the page:
+
+```tsx
+const drawerRef = useRef<ItemDrawerRef>(null);
+drawerRef.current?.show({ record });
+<ItemDrawer ref={drawerRef} reload={() => tableRef.current?.reload()} />;
+```
+
+Do not duplicate open/visible, selected-record, and close state in the page when `HocModal` can own it.
+
+## Drawer pattern
+
+Use `CustomDrawer` confirmation controls and disable the ProForm submitter. Reset or initialize fields whenever the overlay becomes visible.
+
+```tsx
+const handleConfirm = async () => {
+  try {
+    const values = await formRef.current?.validateFields();
+    setLoading(true);
+    await saveItem(values);
+    message.success('操作成功');
+    reload();
+    handleCancel();
+  } catch (error) {
+    console.error('提交失败:', error);
+  } finally {
+    setLoading(false);
+  }
+};
+```
+
+Validation failure must stop the request. Restore confirmation loading in `finally`. Never leave an empty `catch`.
+
+## Modal pattern
+
+Use `BaseModal` with `visible`, `onOk`, `onCancel`, and `confirmLoading`. Use `footer={null}` for read-only dialogs. Use `destroyOnClose` when stale internal state would leak across openings.
+
+## Responsibilities
+
+- Page: table refs, business entry points, and opening an overlay.
+- Overlay: visibility, selected record, form initialization, validation, submitting state, feedback, close, and reload callback.
+- Service: requests and API types.
+- Feature constants: columns and action definitions; never overlay state.
+
+## Verification
+
+- Open the same overlay for create, edit, close, and reopen; confirm no stale values remain.
+- Confirm validation prevents closing and duplicate submission.
+- Confirm async failure leaves the overlay open and restores the action button.
+- Check long content, narrow screens, footer visibility, mask behavior, and keyboard closing.

package/skills/shared/design-to-page/references/page-conventions.md

@@ -0,0 +1,85 @@
+# Page Conventions
+
+Read `.star-allinone.json` first. Use extra component paths or permission helpers from `.agents/project/conventions.md` only when that file exists.
+
+## Stack and locations
+
+- Umi Max, React function components, TypeScript, Ant Design 5, Ant Design Pro Components, Less.
+- Pages: `src/pages/<Feature>/`.
+- Shared components: `src/components/`.
+- Shared hooks: `src/hooks/`.
+- Routes: `config/route.ts`.
+- Services: `src/services/index.ts` via `import Service from '@/services'`.
+- Import application modules through `@/`; use relative imports inside the same feature.
+
+## File split
+
+Keep the smallest complete vertical slice. A standard query-form plus table page usually looks like:
+
+```text
+src/pages/<Feature>/
+├── index.tsx
+├── index.less
+└── components/ or sibling files
+    ├── List.tsx        # optional when the page is large
+    └── const.tsx       # columns, actions, toolbar, maps
+```
+
+Put substantial columns, action builders, status maps, and select options outside render functions. Do not create a second `const.tsx` inside a child component when the page already has one.
+
+Styles live in the current page directory. Reuse shared mixins such as `@/styles/proTable.less`; do not import another feature's Less file.
+
+## Tables
+
+- Prefer `MFProTable` for management lists. Use Ant Design `Table` only for a deliberately simple static shell.
+- Extract `fetchData` as an `async` method. Do not inline request logic in JSX props.
+- Wrap `await` in `try-catch` and return a table-safe empty shape on failure.
+- Adapt backend pagination to the table contract. Common backend shapes are `{ results, count }` or `{ list, total }`; the table adapter is typically `{ code, data: { list, total } }`. Follow the nearest page.
+- Use a stable `rowKey`. Wide tables use `scroll` with `x: 'max-content'`.
+- Render missing display values as `'-'` unless the design requires another empty state.
+- Keep the latest normalized query values available when export or secondary actions reuse them.
+- Watch falsy bugs such as `value || fallback` when `0`, `false`, or `''` is valid.
+
+If the table persists column visibility, order, or fixed state, use the project's column-state hook. Do not read or write `localStorage` in page code. Register new storage keys in the project's cache-reset UI when one exists.
+
+## Forms
+
+- Use `ProForm` as the business form container in pages, drawers, and modals.
+- Prefer `ProFormText`, `ProFormSelect`, `ProFormTextArea`, and related fields.
+- Ant Design `Form` may provide `useForm`, `useWatch`, or `ProForm.Item` integration. Do not introduce a rendered `<Form>` container.
+- Default overlay forms to `layout="horizontal"` with a stable label width. Toolbar query forms stay `layout="inline"`.
+- Normalize submitted values before calling services. Do not send empty strings, `undefined`, or presentation-only fields unless the API requires them.
+- Reset both form controls and the active query state.
+
+## Overlays
+
+Follow [overlays.md](overlays.md). Use `CustomDrawer`, `BaseModal`, and `HocModal` from `@mingfuyun/star-allinone`. Do not add new feature-level Ant Design `Modal` or `Drawer` shells.
+
+## Permissions and routes
+
+- Preserve runtime menu and button permissions with the project's wrappers (`WithPermission`, `TablePermissionActions`, `withAuth`, `actionColumn.permission`, or the equivalent named in project conventions).
+- Do not treat hidden buttons as authorization. Backend enforcement must remain.
+- Add explicit routes in `config/route.ts` when the page needs navigation. Preserve `/403`, `/404`, and nested menu behavior.
+
+## Async behavior
+
+- Every `await` lives in `try-catch`, including handlers, loaders, and submissions.
+- Put `validateFields()` inside the `try`. Log the caught error with `console.error` and do not continue to the request.
+- Restore loading in `finally`. Never use an empty `catch`.
+- Mutations disable or guard duplicate submission, show user-facing feedback, and reload affected lists.
+- Destructive actions require confirmation. Use `BaseModal` + `HocModal`. Do not use `Modal.confirm`.
+- Close overlays must clear form values, loading, selected records, and other async state.
+
+## Service integration
+
+- API-backed pages include types, service methods, aggregate exports, and page consumption in the same change.
+- Do not embed production fake data or invented response fields.
+- If the backend contract is unavailable, label proposed methods, paths, and fields as proposed.
+- Pair missing services with `.agents/skills/shared-api-to-service/SKILL.md`. Pair missing deterministic data with `.agents/skills/shared-api-mock/SKILL.md`.
+
+## Styling and fidelity
+
+- Scope Less below a feature class. Use `:global` only for library internals.
+- Do not add a UI library, state library, or CSS-in-JS system without approval.
+- Cover loading, empty, error, disabled, permission, overflow, duplicate-submit, and narrow-screen behavior.
+- Do not claim visual fidelity without inspecting the rendered page; otherwise say verification was static only.

package/skills/shared/impact-analysis/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: {{sharedSkillName}}
+description: Analyze frontend Git changes and trace affected routes, pages, services, permissions, shared components, mocks, and regression checks. Read-only. Use for PR or pre-submit impact analysis.
+---
+
+# Impact Analysis
+
+This skill does not modify files.
+
+## Workflow
+
+1. Read `git status`, `git diff --stat`, `git diff`, and changed files. Include staged diffs when present.
+2. For each changed file, trace static imports, service calls, route references (`config/route.ts`), and permission references.
+3. Expand shared files: `MFProTable`, `src/services/request.tsx`, permission components, column-state hooks, overlay shells, and app bootstrap.
+4. Check matching `typings.d.ts`, mocks, drawers/modals, table columns, and menu/route config.
+5. Classify impact: direct callers, indirect pages, API/permission contracts, build/release risk.
+6. Give a minimal automated and manual regression path for each item. An import is not proof of runtime impact.
+
+Read `.agents/skills/shared-project-conventions/references/review-checklist.md` for shared files that must be expanded. If `.agents/project/review-rules.md` exists, also expand any extra domain files it names.
+
+## Output
+
+- Change summary
+- Direct files and pages
+- Possibly affected APIs, permissions, and mocks
+- High-risk shared components and their callers
+- Recommended automated checks and manual paths
+- Risks that cannot be confirmed statically, with why
+
+Use repository facts only. Do not invent backend behavior.

package/skills/shared/project-conventions/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: {{sharedSkillName}}
+description: Apply the active frontend project's architecture, API, business, permission, performance, testing, and naming conventions to generated or reviewed code.
+---
+
+# Project Conventions
+
+Use this skill for every non-trivial change. Preserve existing patterns and make the smallest scoped change.
+
+Read in this order:
+
+1. `.star-allinone.json`
+2. [references/architecture.md](references/architecture.md)
+3. [references/review-checklist.md](references/review-checklist.md)
+
+Shared rules are complete for review, commit, mock, and service generation. If `.agents/project/conventions.md` exists, use it only for extra paths or domain invariants. It must not weaken the shared hard rules below.
+
+## Hard rules
+
+- Pages consume `import Service from '@/services'`. No direct axios or request-helper calls from pages.
+- DTOs live in `src/services/<Domain>/typings.d.ts`. Pages do not redefine them.
+- Reuse `MFProTable`, `ProForm`, `CustomDrawer`, `BaseModal`, `HocModal`, and existing permission wrappers.
+- Backend field names stay in service types. Convert only at an adapter boundary.
+- Async surfaces handle loading, empty, error, retry, unauthorized, and duplicate-submit.
+- No unexplained `any`, `as any`, `@ts-ignore`, or `Record<string, any>` when the contract is known.
+- No new UI/state library without approval.
+
+## Completion
+
+Report changed files, API operations used, states covered, validation commands and results, and remaining gaps.

package/skills/shared/project-conventions/references/architecture.md

@@ -0,0 +1,43 @@
+# Architecture
+
+Apply these rules to every non-trivial frontend change. Shared review, commit, mock, and service generation do not require a project-local conventions file.
+
+## Architecture
+
+- Use React function components and TypeScript.
+- Put transport code in `src/services`. Pages must not call axios or the request helper directly.
+- Keep API DTOs in the domain `typings.d.ts`. Use named types and adapters instead of `any`.
+- Reuse `MFProTable`, `BaseModal`, `CustomDrawer`, `HocModal`, permission wrappers, table cells, hooks, and shared styles before adding abstractions.
+- Use `@/` imports for application modules and keep feature-local imports relative.
+- Do not add a UI/state library or duplicate an existing component without explicit approval.
+- Prefer feature-level code splitting for Excel, editors, charts, drag-and-drop, and other heavy modules.
+
+## Business behavior
+
+- Every async page handles loading, empty, error, retry, and unauthorized states where applicable.
+- Mutations disable or guard duplicate submission, show a user-facing result, and refresh affected data.
+- Destructive actions require confirmation and must not silently discard edits.
+- Preserve backend field names in service types; convert only at a clear adapter boundary.
+- Permission checks exist in the UI and remain enforced by the backend. Never infer permission from button visibility alone.
+- Tables that persist columns use the project's column-state hook and register the key in the project's cache-reset UI when one exists.
+
+## Type and quality
+
+- Do not introduce new `Record<string, any>`, `Promise<any>`, or unexplained `any` / `as any` / `@ts-ignore` when the contract is known.
+- Do not leave `console.log` or sensitive payloads in production paths.
+- Keep constants, columns, schemas, and render adapters outside large render functions.
+- Make the smallest scoped change. Do not refactor unrelated code.
+
+## Validation
+
+Identify commands that prove the changed surface is valid. At minimum:
+
+```bash
+git diff --check
+pnpm exec prettier --check <changed-files>
+pnpm exec tsc --noEmit
+```
+
+Run `pnpm lint` for broad or shared changes. Run `pnpm run build` when routes, entry behavior, shared runtime, or multiple page modules change. If `.star-allinone.json` documents a TypeScript `baseUrl` or build script, use that command.
+
+Distinguish failures introduced by the current change from pre-existing or environment failures.

package/skills/shared/project-conventions/references/quality-checklist.md

@@ -0,0 +1,19 @@
+# Quality Checklist
+
+## Correctness and TypeScript
+
+Check null/undefined access, partial responses, pagination, truthiness errors, enum drift, stale field names, state mutation, date/timezone handling, number/string ID comparison, and unsafe non-null assertions. Flag `any`, `@ts-ignore`, broad records, and repeated casts when a project or API type can express the boundary.
+
+## Resilience, accessibility, styling, and security
+
+Review loading, empty, partial, error, retry, permissions, network failure, and malformed responses. Avoid duplicate error toasts when `MFRequest` already reports the same failure.
+
+Check semantic controls, keyboard access, focus return, labels, disabled/loading behavior, color-only status, tooltip-only information, and destructive confirmations. Prefer Ant Design primitives over clickable `div` or `span`.
+
+Follow scoped Less and nearby conventions. Flag global leakage, arbitrary z-index escalation, long-text breakage, missing overflow, and hardcoded values where theme constants exist.
+
+Check unsafe HTML, URL construction, upload/download names, sensitive logs/storage, visual-only permissions, redirects, and dynamic scripts.
+
+## Testing
+
+Request tests for concrete regression boundaries such as transformations, races, conditional validation, reusable hooks, complex transitions, or likely recurring bugs. Run focused Prettier, TypeScript, lint, `git diff --check`, and a production build in proportion to risk.

package/skills/shared/project-conventions/references/review-checklist.md

@@ -0,0 +1,42 @@
+# Review Checklist
+
+This checklist is complete for shared review and commit. If `.agents/project/review-rules.md` exists, apply extra domain checks only; do not weaken the rules below.
+
+## Permissions
+
+- New routes, menus, and action buttons must stay in sync with the project's permission source.
+- Destructive actions (delete, disable, export, assign, recycle) go through the project's permission wrappers.
+- Do not treat hidden buttons as authorization. Review both the request and the UI permission.
+
+## API and types
+
+- Production requests go through `MFRequest` in `src/services/request.tsx`.
+- Types live in `src/services/<Domain>/typings.d.ts`. Pages must not redefine DTOs.
+- Changing a service or type requires checking `src/services/index.ts`, callers, and mocks.
+- Do not invent fields, HTTP methods, or response shapes when OpenAPI/Swagger is unclear.
+- Do not add unexplained `any`, `as any`, or `@ts-ignore`.
+- Service callers are typed against unwrapped `data`. Mock JSON keeps the full `{ code, message, data }` envelope unless the project documents another envelope.
+
+## Pages and forms
+
+- Management lists prefer `MFProTable`. Column and toolbar configuration belong outside the render function.
+- Business forms use `ProForm`. Drawers use `CustomDrawer`. Dialogs use `BaseModal` / `HocModal`.
+- Successful mutations refresh the parent list. Closing an overlay clears form, loading, selected record, and other async state.
+- Every `await` has error handling. Loading restores in `finally`.
+- Check loading, empty, error, disabled, long content, and narrow-screen layout.
+- Table empty values render `'-'` unless the design requires another value.
+
+## Shared components and regression
+
+- Changes to `MFProTable`, permission components, the request wrapper, or shared hooks must list direct callers.
+- A shared-component change must not be verified on a single page. Cover at least two unrelated features.
+- Separate correctness issues from optional refactors. Report P0/P1/P2 with reproduction or contract evidence.
+
+## Severity
+
+- **P0**: security/privacy breach, data loss, critical crash, or destructive behavior.
+- **P1**: user-visible regression, broken primary workflow, invalid API/auth contract, stale submitted data, or reliable runtime exception.
+- **P2**: credible performance, accessibility, type-safety, lifecycle, race, or maintainability defect.
+- **P3**: minor actionable cleanup; include only when useful.
+
+Do not inflate style preferences or speculative memoization into bugs.

package/skills/shared/publish-test/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: {{sharedSkillName}}
+description: Publish the current frontend Git branch to the project's Yunxiao test pipeline. Use when the user asks to publish, deploy, release, or run the test environment pipeline, especially 发布测试环境, 发布测试云效流水线, or 以当前分支发布.
+---
+
+# Publish Test Environment
+
+This skill is fully shared. The only project-specific value is `publishPipelineId` in `.star-allinone.json`.
+
+From the business repository root, run:
+
+```bash
+bash .agents/skills/{{sharedSkillName}}/scripts/publish-current-branch.sh
+```
+
+Do not look for a project-local deploy script under `scripts/`. Do not substitute another pipeline. Do not use or merge `rancher-test`.
+
+## Config
+
+Read `.star-allinone.json` before running. `publishPipelineId` is required:
+
+```json
+{
+  "project": "starscope-frontend",
+  "publishPipelineId": "5108336"
+}
+```
+
+Never ask the user to repeat the pipeline ID. Never copy another project's pipeline ID.
+
+## Preconditions
+
+- Current HEAD is a named branch, not detached.
+- `origin/<branch>` exists and matches local `HEAD`. Push first when it does not.
+- `YUNXIAO_ACCESS_TOKEN` is available. Request approval for the external Yunxiao CLI call.
+- Never print access tokens.
+
+## After the run
+
+Report branch, commit subject, pipeline ID, run ID, status, and commit verification. Do not expose the full commit SHA in the dashboard comment or final report.
+
+If Yunxiao selected a different branch or commit, the script stops the run. That is a failure; do not claim publication succeeded.
+
+A missing current-commit field is not a failure. `commit_verification=unavailable` is acceptable when Yunxiao has not yet returned a commit.
+
+The dashboard comment is `BUILD_REMARK` and contains branch, commit subject, and `来源: Codex`. A missing top-level `comment` field is not a publication failure.

package/skills/shared/publish-test/scripts/publish-current-branch.sh

@@ -0,0 +1,174 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DEFAULT_ORG_ID="61762c5110204867ecfd5ca4"
+
+root="$(git rev-parse --show-toplevel)"
+config_file="$root/.star-allinone.json"
+if [[ ! -f "$config_file" ]]; then
+  echo "error: missing project config: $config_file" >&2
+  exit 1
+fi
+
+pipeline_id="$(python3 - "$config_file" <<'PY'
+import json
+import sys
+
+cfg = json.load(open(sys.argv[1]))
+variables = cfg.get("variables") or {}
+value = cfg.get("publishPipelineId") or variables.get("publishPipelineId") or ""
+print(str(value).strip())
+PY
+)"
+if [[ -z "$pipeline_id" ]]; then
+  echo "error: .star-allinone.json is missing publishPipelineId" >&2
+  exit 1
+fi
+
+organization_id="$(python3 - "$config_file" "$DEFAULT_ORG_ID" <<'PY'
+import json
+import sys
+
+cfg = json.load(open(sys.argv[1]))
+variables = cfg.get("variables") or {}
+value = cfg.get("yunxiaoOrganizationId") or variables.get("yunxiaoOrganizationId") or sys.argv[2]
+print(str(value).strip())
+PY
+)"
+
+repository_url="$(python3 - "$(git remote get-url origin)" <<'PY'
+import sys
+
+url = sys.argv[1].strip()
+if url.startswith("git@"):
+    host, path = url.split(":", 1)
+    host = host.split("@", 1)[1]
+    print(f"https://{host}/{path}")
+else:
+    print(url)
+PY
+)"
+
+branch="${1:-$(git branch --show-current)}"
+if [[ -z "$branch" ]]; then
+  echo "error: detached HEAD; check out the branch to publish" >&2
+  exit 1
+fi
+
+local_commit="$(git rev-parse HEAD)"
+if ! remote_commit="$(git ls-remote origin "refs/heads/$branch" | awk 'NR == 1 { print $1 }')"; then
+  echo "error: failed to query origin/$branch" >&2
+  exit 1
+fi
+if [[ -z "$remote_commit" ]]; then
+  echo "error: origin/$branch is unavailable; push it before publishing" >&2
+  exit 1
+fi
+if [[ "$local_commit" != "$remote_commit" ]]; then
+  echo "error: branch '$branch' is not synchronized with 'origin/$branch'" >&2
+  exit 1
+fi
+
+if [[ -z "${YUNXIAO_ACCESS_TOKEN:-}" ]]; then
+  echo "error: YUNXIAO_ACCESS_TOKEN is unavailable" >&2
+  exit 1
+fi
+
+commit_message="$(git log -1 --format='%s')"
+run_comment="发布分支: $branch | 提交内容: $commit_message | 来源: Codex"
+params="$(python3 -c 'import json,sys; print(json.dumps({"runningBranchs": {sys.argv[1]: sys.argv[2]}, "branchModeBranchs": sys.argv[2], "comment": sys.argv[3]}))' "$repository_url" "$branch" "$run_comment")"
+
+export ALIBABA_CLOUD_YUNXIAO_ACCESS_TOKEN="$YUNXIAO_ACCESS_TOKEN"
+export ALIBABA_CLOUD_YUNXIAO_ORGANIZATION_ID="$organization_id"
+
+run_id="$(aliyun devops flow-create-pipeline-run \
+  --pipeline-id "$pipeline_id" \
+  --params "$params")"
+run_id="$(printf '%s' "$run_id" | tr -d '[:space:]')"
+
+details=""
+for _ in {1..20}; do
+  details="$(aliyun devops flow-get-pipeline-run \
+    --pipeline-id "$pipeline_id" \
+    --pipeline-run-id "$run_id")"
+  has_source="$(DETAILS="$details" python3 - <<'PY'
+import json
+import os
+
+details = json.loads(os.environ["DETAILS"])
+params = {item.get("key"): item.get("value") for item in details.get("globalParams", [])}
+if params.get("CI_SOURCE_BRANCHES"):
+    print("yes")
+elif details.get("sources"):
+    print("yes")
+else:
+    print("no")
+PY
+)"
+  [[ "$has_source" == "yes" ]] && break
+  sleep 3
+done
+
+source_result="$(DETAILS="$details" python3 - "$branch" <<'PY'
+import json
+import os
+import sys
+
+details = json.loads(os.environ["DETAILS"])
+wanted = sys.argv[1]
+params = {item.get("key"): item.get("value") for item in details.get("globalParams", [])}
+branches_raw = params.get("CI_SOURCE_BRANCHES") or "[]"
+try:
+    branches = json.loads(branches_raw)
+except json.JSONDecodeError:
+    branches = []
+item = branches[0] if branches else {}
+actual_branch = item.get("CI_COMMIT_REF_NAME") or ""
+actual_commit = str(item.get("CI_COMMIT_ID") or "")
+
+if not actual_branch:
+    sources = details.get("sources") or []
+    source = next((entry for entry in sources if (entry.get("data") or {}).get("branch") == wanted), sources[0] if sources else None)
+    data = (source or {}).get("data") or {}
+    actual_branch = str(data.get("branch") or "")
+    actual_commit = next(
+        (str(data[key]) for key in ("commit", "commitId", "revision", "checkoutCommit", "checkoutCommitId") if data.get(key)),
+        "",
+    )
+
+print(f"{actual_branch}\t{actual_commit}")
+PY
+)"
+IFS=$'\t' read -r actual_branch actual_commit <<<"$source_result"
+
+stop_run() {
+  aliyun devops flow-update-pipeline-run \
+    --pipeline-id "$pipeline_id" \
+    --pipeline-run-id "$run_id" >/dev/null || true
+}
+
+if [[ -n "$actual_branch" && "$actual_branch" != "$branch" ]]; then
+  stop_run
+  echo "error: stopped run $run_id because Yunxiao selected '${actual_branch}' instead of '$branch'" >&2
+  exit 2
+fi
+
+commit_verification="unavailable"
+short_commit="$(git rev-parse --short=8 HEAD)"
+if [[ -n "$actual_commit" ]]; then
+  if [[ "$actual_commit" == "$local_commit" || "$actual_commit" == "$short_commit"* ]]; then
+    commit_verification="verified"
+  else
+    stop_run
+    echo "error: stopped run $run_id because Yunxiao selected a different commit" >&2
+    exit 4
+  fi
+fi
+
+status="$(aliyun devops flow-get-pipeline-run \
+  --pipeline-id "$pipeline_id" \
+  --pipeline-run-id "$run_id" \
+  --cli-query 'status' | tr -d '"[:space:]')"
+
+printf 'branch=%s\ncommit_message=%s\ncomment=%s\npipeline_id=%s\nrun_id=%s\nstatus=%s\ncommit_verification=%s\n' \
+  "$branch" "$commit_message" "$run_comment" "$pipeline_id" "$run_id" "$status" "$commit_verification"