@mingfuyun/star-allinone 0.4.6 → 0.4.8

package/README.md

@@ -33,7 +33,8 @@ pnpm add @mingfuyun/star-allinone
 AGENTS.md           ← 常驻约定，不要加 .cursor/rules
 .agents/skills/
 ├── shared-*        ← npm 包同步，不能在业务项目直接改
-└── custom-*        ← 业务项目自己维护
+├── custom-entry/   ← 可选：唯一对话入口 + references/project-rules.md
+└── custom-*        ← 其他业务特例（项目自己维护）
 ```
 
 完整约定见 [skills/README.md](skills/README.md)。
@@ -91,7 +92,7 @@ StarLink 示例见 `examples/projects/`。
 pnpm exec star-allinone skills sync
 ```
 
-4. 把真正的业务特例放到 `.agents/skills/custom-*`。审查、提交、发布、单接口、页面生成不要做成 `custom-*`。全量契约重建（若需要）必须 `disable-model-invocation`，并在 `AGENTS.md` 写清命令。
+4. 领域规则放 `.agents/skills/custom-entry/references/`。可用 `custom-entry` 做唯一对话编排入口（内部委托 `shared-*`）。不要再拆第二套审查/提交/发布/单接口/页面入口。全量契约重建（若需要）必须 `disable-model-invocation`，并在 `AGENTS.md` 写清命令。
 
 5. 仓库根放 `AGENTS.md`（可从包内 `examples/AGENTS.md` 复制）。`skills sync` 只在该文件缺失时补一份，不会覆盖已有内容。常驻约定只写这一份，不要加 `.cursor/rules`。
 
@@ -128,7 +129,7 @@ git commit -m "chore(skill): 接入公共 skill"
 使用 $shared-tracking，为本项目接入埋点并全站补齐按钮埋点。
 ```
 
-公共流程用 `shared-*`，项目专属规则用 `custom-*`。`custom-*` 不能再实现一遍 Service/页面生成/审查。全量契约重建若需要，写成不可调用的脚本，并在 `AGENTS.md` 写命令。业务定制需要复用公共流程时，读取对应的 `.agents/skills/shared-*/SKILL.md`，不要再抛一个入口。
+公共流程用 `shared-*`；领域规则优先 `custom-entry/references/`。`custom-entry` 只编排、不复制 shared 正文。全量契约重建若需要，写成不可调用的脚本，并在 `AGENTS.md` 写命令。
 
 ### 业务项目：更新公共 skill
 

package/examples/AGENTS.md

@@ -1,8 +1,8 @@
 # Agent instructions
 
-This is a Umi Max + Ant Design 5 PC admin app. Shared skills live in `.agents/skills/shared-*` and are synced from `@mingfuyun/star-allinone`. Do not edit `shared-*`. Put project-only rules in `.agents/skills/custom-*` or `.agents/project/`.
+This is a Umi Max + Ant Design 5 PC admin app. Shared skills live in `.agents/skills/shared-*` and are synced from `@mingfuyun/star-allinone`. Do not edit `shared-*`. Put project-only rules in `.agents/skills/custom-entry/references/` (preferred) or legacy `.agents/project/`.
 
-Always-on instructions are this file. Do not add `.cursor/rules`.
+Always-on instructions are this file. **Normative sources are only this file and `.agents/skills/**`. Do not add `.cursor/rules`.** Do not use global Codex skills under `~/.codex/skills` as a business entry (including retired names such as `publish-starlink-test`, `review-and-commit`, `i-have-adhd`, `zentao-connect`).
 
 Peer React is **18.3.1**. The npm package does not export a table.
 
@@ -17,14 +17,17 @@ Props for `MFProTable` are in `.agents/skills/shared-project-conventions/referen
 
 ## Default workflow
 
-User-facing shared entries only:
+In business repos, dialogue uses **one entry only**: `$custom-entry`. It reads this file and `custom-entry/references/*`, then delegates to `shared-*` or internal `custom-*`. Do not treat direct `$shared-*` as the production entry.
 
-- One endpoint: `pnpm exec star-allinone gen service --operation "METHOD /path/"` or `$shared-api-to-service`.
-- Pages: `$shared-design-to-page`. Standard lists run `pnpm exec star-allinone gen page` inside that skill.
+- Full requirement / end-to-end flow: intent `flow` (orchestrator `shared-dev-flow` when available; until then: output an implementation plan, wait for `确认方案`, then follow the composite order in `$custom-entry`).
+- One endpoint: via `$custom-entry` → `shared-api-to-service`, or `pnpm exec star-allinone gen service --operation "METHOD /path/"`.
+- Pages: via `$custom-entry` → `shared-design-to-page`. Standard lists run `pnpm exec star-allinone gen page` inside that skill.
 - Project health: `pnpm exec star-allinone doctor`.
-- Review and commit: `$shared-review-and-submit`. Wait for confirmation.
-- Test publish: `$shared-publish-test` after explicit pipeline confirmation.
-- Tracking: `$shared-tracking`. Load the SDK from OSS. Do not commit `tracking-sdk.global.min.js`.
+- Review and commit: via `$custom-entry` → `shared-review-and-submit`. Wait for confirmation (`确认提交` / `确认提交并推送`).
+- Test publish: via `$custom-entry` → `shared-publish-test` after explicit pipeline confirmation (`确认推送流水线` / `发布测试环境`).
+- Tracking: via `$custom-entry` → `shared-tracking`. Load the SDK from OSS. Do not commit `tracking-sdk.global.min.js`.
+
+This `examples/AGENTS.md` seeds new projects. Prefer aligning production repos to `$custom-entry` as above.
 
 ## Hard rules
 
@@ -36,4 +39,4 @@ User-facing shared entries only:
 - After TypeScript changes run `pnpm typecheck`.
 - Do not treat `pnpm test` as unit tests unless that script actually runs a test runner.
 - Heavy modules (`xlsx`, editors, charts) must be `import()`. Do not add them to `src/app.ts`.
-- If `.agents/project/conventions.md` or `.agents/project/review-rules.md` exists, apply them as additions only.
+- Prefer `.agents/skills/custom-entry/references/{project-rules,conventions}.md`; else legacy `.agents/project/{review-rules,conventions}.md`. Apply as additions only.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mingfuyun/star-allinone",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "description": "星系运维前端能力包",
   "main": "dist/index.js",
   "bin": {

package/skills/README.md

@@ -18,21 +18,31 @@ business-app/
     │   ├── shared-publish-test/
     │   ├── shared-project-conventions/   ← 无 SKILL.md，给入口读
     │   ├── shared-i-have-adhd/           ← 无 SKILL.md，给入口读
-    │   └── custom-*                      ← 仅真正的业务特例
-    └── project/
-        ├── conventions.md
-        ├── review-rules.md
+    │   ├── custom-entry/                 ← 可选：唯一对话编排入口 + 领域规则正文
+    │   │   └── references/
+    │   │       ├── project-rules.md
+    │   │       └── conventions.md
+    │   └── custom-*                      ← 其他业务特例（如全量 swagger，勿再拆对外入口）
+    └── project/                          ← legacy；openapi 等仍可放这里
         └── openapi.json
 ```
 
 命名约定：
 
 ```text
-shared-*   公共内容，由 star-allinone 提供，经 CLI 同步后提交到业务仓库
-custom-*   业务定制，由业务项目维护；禁止做成第二套页面/审查/单接口生成入口
+shared-*       公共内容，由 star-allinone 提供，经 CLI 同步后提交到业务仓库
+custom-entry   可选唯一对话入口；领域规则正文在其 references/
+custom-*       其他业务定制；禁止再做成第二套页面/审查/单接口生成入口
 ```
 
-Cursor / Codex 的常驻说明只放仓库根 `AGENTS.md`（模板见 `examples/AGENTS.md`）。项目差异放 `.agents/project/`。不要新增 `.cursor/rules`。
+项目 overlay 探测顺序（存在则应用，只补充不削弱硬规则）：
+
+```text
+review-rules:  custom-entry/references/project-rules.md  →  legacy .agents/project/review-rules.md
+conventions:   custom-entry/references/conventions.md    →  legacy .agents/project/conventions.md
+```
+
+Cursor / Codex 的常驻说明只放仓库根 `AGENTS.md`（模板见 `examples/AGENTS.md`）。不要新增 `.cursor/rules`。
 
 ## npm 包的职责
 
@@ -55,7 +65,7 @@ Cursor / Codex 的常驻说明只放仓库根 `AGENTS.md`（模板见 `examples/
 
 接入或升级后跑 `pnpm exec star-allinone doctor`。
 
-业务项目的 `.agents/project/` 只写差异：路径、权限体系、OpenAPI 位置、领域特例。项目文件可以补充，但不能削弱公共硬规则。
+领域差异优先写 `.agents/skills/custom-entry/references/`。`.agents/project/` 仍可放 OpenAPI 路径等 legacy 文件。项目文件可以补充，但不能削弱公共硬规则。
 
 CLI 只做同步：
 
@@ -95,13 +105,15 @@ git commit -m "chore(skill): 更新公共 skill"
 
 ## 新增或修改业务定制
 
-`custom-*` 只用于真正的业务特例：领域不变量、全量契约脚本、度量。审查、提交、测发、单接口、页面生成都走公共入口。
+推荐用 `custom-entry` 做 **唯一对话编排入口**：先读本仓 `references/project-rules.md`（与可选 `conventions.md`），再 **Read 并执行** 对应 `shared-*`，不要复制 shared 正文。
+
+其他 `custom-*` 只用于真正的业务特例：领域不变量、全量契约脚本、度量。不要再做成第二套审查/提交/测发/单接口/页面入口。
 
 全量契约重建若必须留在 custom：加上 `disable-model-invocation: true`，在 `AGENTS.md` 写清要跑的命令，不要作为用户入口。度量类 custom 不得生成代码。
 
 ## 公共部分和业务定制组合
 
-业务定制需要复用公共流程时，在 `custom-*` 里 **读取** 对应入口的 `SKILL.md`，不要再做一个可 `$` 调用的生成入口。领域规则示例见 `examples/skills/custom-domain-invariants/`。
+`custom-entry`（或其他 `custom-*`）复用公共流程时，**读取** 对应入口的 `SKILL.md` 并原样执行确认门。领域规则示例见 `examples/skills/custom-domain-invariants/`。
 
 ## 项目配置
 

package/skills/shared/api-to-service/references/service-conventions.md

@@ -1,6 +1,6 @@
 # Service Conventions
 
-Read `.star-allinone.json` first. `serviceDir` defaults to `src/services`. Overlay extra domain paths only when `.agents/project/conventions.md` exists.
+Read `.star-allinone.json` first. `serviceDir` defaults to `src/services`. Prefer `.agents/skills/custom-entry/references/conventions.md`; else legacy `.agents/project/conventions.md`. Overlay extra domain paths only when that file exists.
 
 ## Layout
 

package/skills/shared/design-to-page/SKILL.md

@@ -17,7 +17,7 @@ Before implementation, read:
 4. `.agents/skills/shared-project-conventions/references/architecture.md`
 5. [references/tracking.md](references/tracking.md) when `src/utils/tracking/index.ts` exists (or the project tracking path in conventions)
 
-If `.agents/project/conventions.md` exists, use it only for extra paths.
+Prefer `.agents/skills/custom-entry/references/conventions.md`; else legacy `.agents/project/conventions.md`. If either exists, use it only for extra paths.
 
 Inspect the nearest existing page of the same type before proposing files.
 

package/skills/shared/design-to-page/references/page-conventions.md

@@ -1,6 +1,6 @@
 # Page Conventions
 
-Read `.star-allinone.json` first. Use extra component paths or permission helpers from `.agents/project/conventions.md` only when that file exists.
+Read `.star-allinone.json` first. Prefer `.agents/skills/custom-entry/references/conventions.md`; else legacy `.agents/project/conventions.md`. Use extra component paths or permission helpers only when that file exists.
 
 ## Stack and locations
 

package/skills/shared/project-conventions/references/review-checklist.md

@@ -1,6 +1,6 @@
 # Review Checklist
 
-This checklist is complete for shared review and commit. If `.agents/project/review-rules.md` exists, apply extra domain checks only; do not weaken the rules below.
+This checklist is complete for shared review and commit. Prefer `.agents/skills/custom-entry/references/project-rules.md`; else legacy `.agents/project/review-rules.md`. If either exists, apply extra domain checks only; do not weaken the rules below.
 
 ## Permissions
 

package/skills/shared/publish-test/SKILL.md

@@ -56,7 +56,7 @@ before or as part of `max build`. Do not treat `pnpm test` as unit tests; in bus
 - Current HEAD is a named branch, not detached.
 - `origin/<branch>` exists and matches local `HEAD`. Push first when it does not.
 - `YUNXIAO_ACCESS_TOKEN` is available. Request approval for the external Yunxiao CLI call.
-- Never print access tokens.
+- If `YUNXIAO_ACCESS_TOKEN` is unset, the publish script loads `~/.codex/secrets/yunxiao.env` in the same shell when that file exists. Do not ask the user to `export` the token. Never print, copy, or paste the token.
 
 ## After the run
 

package/skills/shared/publish-test/scripts/publish-current-branch.sh

@@ -69,6 +69,16 @@ if [[ "$local_commit" != "$remote_commit" ]]; then
   exit 1
 fi
 
+if [[ -z "${YUNXIAO_ACCESS_TOKEN:-}" ]]; then
+  yunxiao_env="${HOME}/.codex/secrets/yunxiao.env"
+  if [[ -f "$yunxiao_env" ]]; then
+    # Load token for this shell only. Do not print file contents.
+    set -a
+    # shellcheck disable=SC1090
+    source "$yunxiao_env"
+    set +a
+  fi
+fi
 if [[ -z "${YUNXIAO_ACCESS_TOKEN:-}" ]]; then
   echo "error: YUNXIAO_ACCESS_TOKEN is unavailable" >&2
   exit 1

package/skills/shared/review-and-submit/SKILL.md

@@ -9,7 +9,7 @@ User-facing entry for review, submit, and commit. Read the files under `referenc
 
 This is the unified pre-submit entry and is fully shared. Do not mutate Git until the user confirms the exact reviewed scope.
 
-If `.agents/project/review-rules.md` exists, apply extra domain checks only; do not weaken shared hard rules.
+Prefer `.agents/skills/custom-entry/references/project-rules.md`; else legacy `.agents/project/review-rules.md`. If either exists, apply extra domain checks only; do not weaken shared hard rules.
 
 ## Workflow
 
@@ -54,7 +54,7 @@ Then stop and wait. Do not run Git writes.
 
 ## Confirmation gate
 
-Execute the commit phase only after an explicit reply such as `确认` or `确认提交并推送` that authorizes the latest proposal.
+Execute the commit phase only after an explicit reply such as `确认`、`确认提交` or `确认提交并推送` that authorizes the latest proposal.
 
 1. Re-check branch, status, and full diff.
 2. Confirm the review scope did not change.

package/skills/shared/review-and-submit/references/ai-review.md

@@ -8,7 +8,7 @@ Review the current diff plus relevant callers and types. Before reviewing, read:
 2. `.agents/skills/shared-project-conventions/references/quality-checklist.md`
 3. `.agents/skills/shared-tracking/SKILL.md` and `.agents/skills/shared-design-to-page/references/tracking.md` when the project has tracking configured
 
-If `.agents/project/review-rules.md` exists, apply extra domain checks only; do not weaken shared hard rules.
+Prefer `.agents/skills/custom-entry/references/project-rules.md`; else legacy `.agents/project/review-rules.md`. If either exists, apply extra domain checks only; do not weaken shared hard rules.
 
 ## Required checks
 

package/skills/shared/review-and-submit/references/commit.md

@@ -26,7 +26,7 @@ Read:
 3. `.agents/skills/shared-project-conventions/references/architecture.md`
 4. [ai-review.md](ai-review.md)
 
-If `.agents/project/review-rules.md` exists, apply extra domain checks only; do not weaken shared hard rules.
+Prefer `.agents/skills/custom-entry/references/project-rules.md`; else legacy `.agents/project/review-rules.md`. If either exists, apply extra domain checks only; do not weaken shared hard rules.
 
 Classify only concrete security, data-loss, runtime, contract, validation, performance, accessibility, or maintainability risks as P0–P2.
 

package/skills/shared/review-and-submit/references/impact-analysis.md

@@ -11,7 +11,7 @@ Step 1 of `shared-review-and-submit`. Do not modify files.
 5. Classify impact: direct callers, indirect pages, API/permission contracts, build/release risk.
 6. Give a minimal automated and manual regression path for each item. An import is not proof of runtime impact.
 
-Read `.agents/skills/shared-project-conventions/references/review-checklist.md` for shared files that must be expanded. If `.agents/project/review-rules.md` exists, also expand any extra domain files it names.
+Read `.agents/skills/shared-project-conventions/references/review-checklist.md` for shared files that must be expanded. Prefer `.agents/skills/custom-entry/references/project-rules.md`; else legacy `.agents/project/review-rules.md`. If either exists, also expand any extra domain files it names.
 
 ## Output
 

package/skills/shared/review-and-submit/references/verify.md

@@ -8,7 +8,7 @@ Read the current diff, related callers, and:
 2. `.agents/skills/shared-project-conventions/references/architecture.md`
 3. `.agents/skills/shared-tracking/SKILL.md` when the project has `src/utils/tracking/index.ts` (or the tracking path in project conventions)
 
-Do not auto-fix. If `.agents/project/review-rules.md` exists, apply extra domain checks only.
+Do not auto-fix. Prefer `.agents/skills/custom-entry/references/project-rules.md`; else legacy `.agents/project/review-rules.md`. If either exists, apply extra domain checks only.
 
 ## Checks