@mingfuyun/star-allinone 0.1.7 → 0.1.9

package/skills/shared/project-conventions/references/architecture.md

@@ -0,0 +1,43 @@
+# Architecture
+
+Apply these rules to every non-trivial frontend change. Shared review, commit, mock, and service generation do not require a project-local conventions file.
+
+## Architecture
+
+- Use React function components and TypeScript.
+- Put transport code in `src/services`. Pages must not call axios or the request helper directly.
+- Keep API DTOs in the domain `typings.d.ts`. Use named types and adapters instead of `any`.
+- Reuse `MFProTable`, `BaseModal`, `CustomDrawer`, `HocModal`, permission wrappers, table cells, hooks, and shared styles before adding abstractions.
+- Use `@/` imports for application modules and keep feature-local imports relative.
+- Do not add a UI/state library or duplicate an existing component without explicit approval.
+- Prefer feature-level code splitting for Excel, editors, charts, drag-and-drop, and other heavy modules.
+
+## Business behavior
+
+- Every async page handles loading, empty, error, retry, and unauthorized states where applicable.
+- Mutations disable or guard duplicate submission, show a user-facing result, and refresh affected data.
+- Destructive actions require confirmation and must not silently discard edits.
+- Preserve backend field names in service types; convert only at a clear adapter boundary.
+- Permission checks exist in the UI and remain enforced by the backend. Never infer permission from button visibility alone.
+- Tables that persist columns use the project's column-state hook and register the key in the project's cache-reset UI when one exists.
+
+## Type and quality
+
+- Do not introduce new `Record<string, any>`, `Promise<any>`, or unexplained `any` / `as any` / `@ts-ignore` when the contract is known.
+- Do not leave `console.log` or sensitive payloads in production paths.
+- Keep constants, columns, schemas, and render adapters outside large render functions.
+- Make the smallest scoped change. Do not refactor unrelated code.
+
+## Validation
+
+Identify commands that prove the changed surface is valid. At minimum:
+
+```bash
+git diff --check
+pnpm exec prettier --check <changed-files>
+pnpm exec tsc --noEmit
+```
+
+Run `pnpm lint` for broad or shared changes. Run `pnpm run build` when routes, entry behavior, shared runtime, or multiple page modules change. If `.star-allinone.json` documents a TypeScript `baseUrl` or build script, use that command.
+
+Distinguish failures introduced by the current change from pre-existing or environment failures.

package/skills/shared/project-conventions/references/quality-checklist.md

@@ -0,0 +1,19 @@
+# Quality Checklist
+
+## Correctness and TypeScript
+
+Check null/undefined access, partial responses, pagination, truthiness errors, enum drift, stale field names, state mutation, date/timezone handling, number/string ID comparison, and unsafe non-null assertions. Flag `any`, `@ts-ignore`, broad records, and repeated casts when a project or API type can express the boundary.
+
+## Resilience, accessibility, styling, and security
+
+Review loading, empty, partial, error, retry, permissions, network failure, and malformed responses. Avoid duplicate error toasts when `MFRequest` already reports the same failure.
+
+Check semantic controls, keyboard access, focus return, labels, disabled/loading behavior, color-only status, tooltip-only information, and destructive confirmations. Prefer Ant Design primitives over clickable `div` or `span`.
+
+Follow scoped Less and nearby conventions. Flag global leakage, arbitrary z-index escalation, long-text breakage, missing overflow, and hardcoded values where theme constants exist.
+
+Check unsafe HTML, URL construction, upload/download names, sensitive logs/storage, visual-only permissions, redirects, and dynamic scripts.
+
+## Testing
+
+Request tests for concrete regression boundaries such as transformations, races, conditional validation, reusable hooks, complex transitions, or likely recurring bugs. Run focused Prettier, TypeScript, lint, `git diff --check`, and a production build in proportion to risk.

package/skills/shared/project-conventions/references/review-checklist.md

@@ -0,0 +1,42 @@
+# Review Checklist
+
+This checklist is complete for shared review and commit. If `.agents/project/review-rules.md` exists, apply extra domain checks only; do not weaken the rules below.
+
+## Permissions
+
+- New routes, menus, and action buttons must stay in sync with the project's permission source.
+- Destructive actions (delete, disable, export, assign, recycle) go through the project's permission wrappers.
+- Do not treat hidden buttons as authorization. Review both the request and the UI permission.
+
+## API and types
+
+- Production requests go through `MFRequest` in `src/services/request.tsx`.
+- Types live in `src/services/<Domain>/typings.d.ts`. Pages must not redefine DTOs.
+- Changing a service or type requires checking `src/services/index.ts`, callers, and mocks.
+- Do not invent fields, HTTP methods, or response shapes when OpenAPI/Swagger is unclear.
+- Do not add unexplained `any`, `as any`, or `@ts-ignore`.
+- Service callers are typed against unwrapped `data`. Mock JSON keeps the full `{ code, message, data }` envelope unless the project documents another envelope.
+
+## Pages and forms
+
+- Management lists prefer `MFProTable`. Column and toolbar configuration belong outside the render function.
+- Business forms use `ProForm`. Drawers use `CustomDrawer`. Dialogs use `BaseModal` / `HocModal`.
+- Successful mutations refresh the parent list. Closing an overlay clears form, loading, selected record, and other async state.
+- Every `await` has error handling. Loading restores in `finally`.
+- Check loading, empty, error, disabled, long content, and narrow-screen layout.
+- Table empty values render `'-'` unless the design requires another value.
+
+## Shared components and regression
+
+- Changes to `MFProTable`, permission components, the request wrapper, or shared hooks must list direct callers.
+- A shared-component change must not be verified on a single page. Cover at least two unrelated features.
+- Separate correctness issues from optional refactors. Report P0/P1/P2 with reproduction or contract evidence.
+
+## Severity
+
+- **P0**: security/privacy breach, data loss, critical crash, or destructive behavior.
+- **P1**: user-visible regression, broken primary workflow, invalid API/auth contract, stale submitted data, or reliable runtime exception.
+- **P2**: credible performance, accessibility, type-safety, lifecycle, race, or maintainability defect.
+- **P3**: minor actionable cleanup; include only when useful.
+
+Do not inflate style preferences or speculative memoization into bugs.

package/skills/shared/publish-test/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: {{sharedSkillName}}
+description: Publish the current frontend Git branch to the project's Yunxiao test pipeline only after explicit confirmation such as 确认推送流水线 or 发布测试环境. Never run the pipeline automatically after git push.
+---
+
+# Publish Test Environment
+
+This skill is fully shared. The only project-specific value is `publishPipelineId` in `.star-allinone.json`.
+
+Do not run the pipeline script after a git push. Git push, `确认提交并推送`, and `确认` are not pipeline authorization.
+
+Run the script only after an explicit pipeline confirmation in this conversation, such as:
+
+- `确认推送流水线`
+- `发布测试环境`
+- `发布测试云效流水线`
+- `以当前分支发布`
+
+If the user has not said one of these, stop and ask whether to publish the test pipeline. Do not infer yes from a prior commit or push.
+
+From the business repository root, run:
+
+```bash
+bash .agents/skills/{{sharedSkillName}}/scripts/publish-current-branch.sh
+```
+
+Do not look for a project-local deploy script under `scripts/`. Do not substitute another pipeline. Do not use or merge `rancher-test`.
+
+## Config
+
+Read `.star-allinone.json` before running. `publishPipelineId` is required:
+
+```json
+{
+  "project": "starscope-frontend",
+  "publishPipelineId": "5108336"
+}
+```
+
+Never ask the user to repeat the pipeline ID. Never copy another project's pipeline ID.
+
+## Preconditions
+
+- Current HEAD is a named branch, not detached.
+- `origin/<branch>` exists and matches local `HEAD`. Push first when it does not.
+- `YUNXIAO_ACCESS_TOKEN` is available. Request approval for the external Yunxiao CLI call.
+- Never print access tokens.
+
+## After the run
+
+Report branch, commit subject, pipeline ID, run ID, status, and commit verification. Do not expose the full commit SHA in the dashboard comment or final report.
+
+If Yunxiao selected a different branch or commit, the script stops the run. That is a failure; do not claim publication succeeded.
+
+A missing current-commit field is not a failure. `commit_verification=unavailable` is acceptable when Yunxiao has not yet returned a commit.
+
+The dashboard comment is `BUILD_REMARK` and contains branch, commit subject, and `来源: Codex`. A missing top-level `comment` field is not a publication failure.

package/skills/shared/publish-test/scripts/publish-current-branch.sh

@@ -0,0 +1,174 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DEFAULT_ORG_ID="61762c5110204867ecfd5ca4"
+
+root="$(git rev-parse --show-toplevel)"
+config_file="$root/.star-allinone.json"
+if [[ ! -f "$config_file" ]]; then
+  echo "error: missing project config: $config_file" >&2
+  exit 1
+fi
+
+pipeline_id="$(python3 - "$config_file" <<'PY'
+import json
+import sys
+
+cfg = json.load(open(sys.argv[1]))
+variables = cfg.get("variables") or {}
+value = cfg.get("publishPipelineId") or variables.get("publishPipelineId") or ""
+print(str(value).strip())
+PY
+)"
+if [[ -z "$pipeline_id" ]]; then
+  echo "error: .star-allinone.json is missing publishPipelineId" >&2
+  exit 1
+fi
+
+organization_id="$(python3 - "$config_file" "$DEFAULT_ORG_ID" <<'PY'
+import json
+import sys
+
+cfg = json.load(open(sys.argv[1]))
+variables = cfg.get("variables") or {}
+value = cfg.get("yunxiaoOrganizationId") or variables.get("yunxiaoOrganizationId") or sys.argv[2]
+print(str(value).strip())
+PY
+)"
+
+repository_url="$(python3 - "$(git remote get-url origin)" <<'PY'
+import sys
+
+url = sys.argv[1].strip()
+if url.startswith("git@"):
+    host, path = url.split(":", 1)
+    host = host.split("@", 1)[1]
+    print(f"https://{host}/{path}")
+else:
+    print(url)
+PY
+)"
+
+branch="${1:-$(git branch --show-current)}"
+if [[ -z "$branch" ]]; then
+  echo "error: detached HEAD; check out the branch to publish" >&2
+  exit 1
+fi
+
+local_commit="$(git rev-parse HEAD)"
+if ! remote_commit="$(git ls-remote origin "refs/heads/$branch" | awk 'NR == 1 { print $1 }')"; then
+  echo "error: failed to query origin/$branch" >&2
+  exit 1
+fi
+if [[ -z "$remote_commit" ]]; then
+  echo "error: origin/$branch is unavailable; push it before publishing" >&2
+  exit 1
+fi
+if [[ "$local_commit" != "$remote_commit" ]]; then
+  echo "error: branch '$branch' is not synchronized with 'origin/$branch'" >&2
+  exit 1
+fi
+
+if [[ -z "${YUNXIAO_ACCESS_TOKEN:-}" ]]; then
+  echo "error: YUNXIAO_ACCESS_TOKEN is unavailable" >&2
+  exit 1
+fi
+
+commit_message="$(git log -1 --format='%s')"
+run_comment="发布分支: $branch | 提交内容: $commit_message | 来源: Codex"
+params="$(python3 -c 'import json,sys; print(json.dumps({"runningBranchs": {sys.argv[1]: sys.argv[2]}, "branchModeBranchs": sys.argv[2], "comment": sys.argv[3]}))' "$repository_url" "$branch" "$run_comment")"
+
+export ALIBABA_CLOUD_YUNXIAO_ACCESS_TOKEN="$YUNXIAO_ACCESS_TOKEN"
+export ALIBABA_CLOUD_YUNXIAO_ORGANIZATION_ID="$organization_id"
+
+run_id="$(aliyun devops flow-create-pipeline-run \
+  --pipeline-id "$pipeline_id" \
+  --params "$params")"
+run_id="$(printf '%s' "$run_id" | tr -d '[:space:]')"
+
+details=""
+for _ in {1..20}; do
+  details="$(aliyun devops flow-get-pipeline-run \
+    --pipeline-id "$pipeline_id" \
+    --pipeline-run-id "$run_id")"
+  has_source="$(DETAILS="$details" python3 - <<'PY'
+import json
+import os
+
+details = json.loads(os.environ["DETAILS"])
+params = {item.get("key"): item.get("value") for item in details.get("globalParams", [])}
+if params.get("CI_SOURCE_BRANCHES"):
+    print("yes")
+elif details.get("sources"):
+    print("yes")
+else:
+    print("no")
+PY
+)"
+  [[ "$has_source" == "yes" ]] && break
+  sleep 3
+done
+
+source_result="$(DETAILS="$details" python3 - "$branch" <<'PY'
+import json
+import os
+import sys
+
+details = json.loads(os.environ["DETAILS"])
+wanted = sys.argv[1]
+params = {item.get("key"): item.get("value") for item in details.get("globalParams", [])}
+branches_raw = params.get("CI_SOURCE_BRANCHES") or "[]"
+try:
+    branches = json.loads(branches_raw)
+except json.JSONDecodeError:
+    branches = []
+item = branches[0] if branches else {}
+actual_branch = item.get("CI_COMMIT_REF_NAME") or ""
+actual_commit = str(item.get("CI_COMMIT_ID") or "")
+
+if not actual_branch:
+    sources = details.get("sources") or []
+    source = next((entry for entry in sources if (entry.get("data") or {}).get("branch") == wanted), sources[0] if sources else None)
+    data = (source or {}).get("data") or {}
+    actual_branch = str(data.get("branch") or "")
+    actual_commit = next(
+        (str(data[key]) for key in ("commit", "commitId", "revision", "checkoutCommit", "checkoutCommitId") if data.get(key)),
+        "",
+    )
+
+print(f"{actual_branch}\t{actual_commit}")
+PY
+)"
+IFS=$'\t' read -r actual_branch actual_commit <<<"$source_result"
+
+stop_run() {
+  aliyun devops flow-update-pipeline-run \
+    --pipeline-id "$pipeline_id" \
+    --pipeline-run-id "$run_id" >/dev/null || true
+}
+
+if [[ -n "$actual_branch" && "$actual_branch" != "$branch" ]]; then
+  stop_run
+  echo "error: stopped run $run_id because Yunxiao selected '${actual_branch}' instead of '$branch'" >&2
+  exit 2
+fi
+
+commit_verification="unavailable"
+short_commit="$(git rev-parse --short=8 HEAD)"
+if [[ -n "$actual_commit" ]]; then
+  if [[ "$actual_commit" == "$local_commit" || "$actual_commit" == "$short_commit"* ]]; then
+    commit_verification="verified"
+  else
+    stop_run
+    echo "error: stopped run $run_id because Yunxiao selected a different commit" >&2
+    exit 4
+  fi
+fi
+
+status="$(aliyun devops flow-get-pipeline-run \
+  --pipeline-id "$pipeline_id" \
+  --pipeline-run-id "$run_id" \
+  --cli-query 'status' | tr -d '"[:space:]')"
+
+printf 'branch=%s\ncommit_message=%s\ncomment=%s\npipeline_id=%s\nrun_id=%s\nstatus=%s\ncommit_verification=%s\n' \
+  "$branch" "$commit_message" "$run_comment" "$pipeline_id" "$run_id" "$status" "$commit_verification"

package/skills/shared/review-and-submit/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: {{sharedSkillName}}
+description: Run the frontend pre-submit workflow: impact analysis, verification, then confirmation-gated commit review. Use when the user asks for the full submit flow or says 使用完整流程提交代码. Never stage, commit, or push before explicit confirmation.
+---
+
+# Review and Submit
+
+This is the unified pre-submit entry and is fully shared. Do not mutate Git until the user confirms the exact reviewed scope.
+
+If `.agents/project/review-rules.md` exists, apply extra domain checks only; do not weaken shared hard rules.
+
+## Workflow
+
+Execute in this order.
+
+### 1. Impact analysis
+
+Follow `.agents/skills/shared-impact-analysis/SKILL.md`. Output:
+
+- Change summary
+- Direct callers and affected pages
+- Related services, types, mocks, routes, and permissions
+- Shared-component blast radius
+- Recommended automated and manual regression paths
+
+### 2. Verification
+
+Follow `.agents/skills/shared-verify/SKILL.md`. Output:
+
+- P0/P1/P2 blockers
+- Completeness of route, permission, API, types, mock, and page states
+- Async, loading, overlay, and list-reload behavior
+- Prettier, TypeScript, lint, and build results
+- Uncovered risks
+
+If the current change introduced P0/P1 issues or validation failures, stop. Do not enter commit review.
+
+### 3. Commit review
+
+Follow `.agents/skills/shared-commit-current-changes/SKILL.md`. Output:
+
+- Findings sorted P0–P2
+- Optional improvements
+- Validation results and residual risk
+- Change summary
+- Suggested Chinese Conventional Commit message
+- Current branch and target remote
+- Exact file paths to submit
+
+Then stop and wait. Do not run Git writes.
+
+## Confirmation gate
+
+Execute the commit phase only after an explicit reply such as `确认` or `确认提交并推送` that authorizes the latest proposal.
+
+1. Re-check branch, status, and full diff.
+2. Confirm the review scope did not change.
+3. Stage only the confirmed paths.
+4. Create the confirmed commit message.
+5. Push only if the user asked to push.
+6. Report commit, remote branch, and workspace status.
+7. Stop. Do not run `$shared-publish-test` or the pipeline script after git push.
+
+Git push confirmation is not pipeline confirmation. Run the pipeline only after a separate explicit reply such as `确认推送流水线` or `发布测试环境`. Then follow `.agents/skills/shared-publish-test/SKILL.md`.
+
+If the user only says `确认` but the scope is unclear, do not commit; ask for the exact files and message.
+
+If the user says `提交代码` before a review proposal exists, run the three steps above first. Do not skip review.
+
+## Related skills
+
+| Skill | Purpose |
+| --- | --- |
+| `$shared-impact-analysis` | Read-only impact analysis |
+| `$shared-verify` | Convention and command verification |
+| `$shared-commit-current-changes` | Review plus confirmation-gated commit |
+| `$shared-ai-review` | Standalone review without commit |
+| `$shared-publish-test` | Publish to the test pipeline only after a separate `确认推送流水线`. Never run it automatically after git push. |

package/skills/shared/verify/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: {{sharedSkillName}}
+description: Verify generated or manually changed frontend code against shared conventions, API contracts, permissions, async behavior, and validation commands. Use after API, mock, page, or refactor work. Do not generate business code.
+---
+
+# Frontend Verification
+
+This skill is fully shared. Read the current diff, related callers, and:
+
+1. `.agents/skills/shared-project-conventions/references/review-checklist.md`
+2. `.agents/skills/shared-project-conventions/references/architecture.md`
+
+Do not auto-fix. If `.agents/project/review-rules.md` exists, apply extra domain checks only.
+
+## Checks
+
+1. Route, service, namespace types, `src/services/index.ts`, mocks, and permissions updated as a set.
+2. Pages follow `MFProTable`, `ProForm`, `CustomDrawer` / `BaseModal` / `HocModal`, and `@/services`.
+3. Every `await` has `try-catch`; loading restores in `finally`; overlays clear state on close; successful mutations reload lists.
+4. Scan new `any`, `as any`, `@ts-ignore`, direct Ant Design `Modal` / `Drawer` / `<Form>` containers, and production fake data.
+5. Empty table values, duplicate-submit guards, permission wrappers, and narrow-screen overflow.
+
+## Commands
+
+Choose by risk. Do not auto-fix to make a command pass.
+
+```bash
+git diff --check
+pnpm exec prettier --check <changed-files>
+pnpm exec eslint <changed-files>
+pnpm exec tsc --noEmit
+pnpm lint
+```
+
+Run the project's build script when routes, entry, or shared runtime change.
+
+## Output
+
+1. Blocking issues P0–P2, with file, line, impact, and fix direction.
+2. Completeness: route, permission, API, types, mock, page states.
+3. Command results, distinguishing new, existing, and environment failures.
+4. Regression list: affected pages, suggested manual paths, uncovered risks.
+
+If there are no blockers, write `未发现阻断问题`. Do not report only that commands passed.