create-yss-spec 3.4.10 → 3.5.2

package/src/commands/skills.js

@@ -0,0 +1,253 @@
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { runInTransaction } = require("../filesystem/transaction-runner");
+const { applyManagedOperation } = require("../filesystem/apply-plan");
+const { pathKind, targetPath } = require("../filesystem/path-utils");
+const { assertTargetFamily } = require("../family-runtime");
+const { assertTargetWorkingTreeWritable } = require("../validation/security");
+const { readTemplateSnapshot, loadTemplateMetadata, writeTemplateMetadata, buildDesiredManagedOperations, BUNDLED_TEMPLATE_ROOT, fileHash } = require("../template/instance-runtime");
+const { RUNTIMES, assertRuntime, readDistributionRegistry, requiredSkills, renderInstanceDesignSkillFile } = require("../template/distribution-runtime");
+const { ASSET_PROFILE, STAGES } = require("../template/asset-runtime");
+const { refreshGeneratedProjectInstance, verifyGeneratedProjectInstance } = require("../template/verification-runtime");
+
+function parseSkillArgs(argv) {
+  const options = { names: [], triggers: [], targetDir: "." };
+  for (let index = 0; index < argv.length; index++) {
+    const arg = argv[index];
+    if (arg === "--plan") options.plan = true;
+    else if (arg === "--apply") options.apply = true;
+    else if (arg === "--target-dir" || arg === "--when") {
+      const value = argv[++index];
+      if (!value || value.startsWith("--")) throw new Error(`${arg} 需要一个值`);
+      if (arg === "--target-dir") options.targetDir = value;
+      else options.triggers.push(value);
+    } else if (arg.startsWith("--")) throw new Error(`不支持的参数：${arg}`);
+    else options.names.push(arg);
+  }
+  if (options.plan && options.apply) throw new Error("--plan 与 --apply 互斥");
+  if (!options.plan && !options.apply) throw new Error("skills 命令必须显式选择 --plan 或 --apply");
+  return options;
+}
+
+function listFiles(directory, prefix = "") {
+  const files = [];
+  for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+    const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) files.push(...listFiles(path.join(directory, entry.name), relative));
+    else if (entry.isFile()) files.push(relative);
+  }
+  return files;
+}
+
+function addManagedTree(metadata, targetDir, relativeDir) {
+  for (const file of listFiles(targetPath(targetDir, relativeDir))) {
+    const relative = `${relativeDir}/${file}`;
+    metadata.managedFiles[relative] = { type: "copy", contentHash: fileHash(targetPath(targetDir, relative)) };
+  }
+}
+
+function context(targetDir) {
+  assertTargetFamily(targetDir);
+  const { metadata } = loadTemplateMetadata(targetDir);
+  if (metadata.metadataSchemaVersion !== 3 || metadata.distribution?.mode !== "selected") {
+    throw new Error("按需 Skill 命令仅适用于 v3 精简实例；v2 实例继续 legacy-all 分发");
+  }
+  const snapshot = readTemplateSnapshot();
+  if (metadata.templateCommit !== snapshot.templateCommit || metadata.snapshotHash !== snapshot.snapshotHash) {
+    throw new Error("CLI 快照与实例模板提交不一致，请先运行 create-yss-spec sync");
+  }
+  const lockPath = targetPath(targetDir, "skills-lock.json");
+  const lock = JSON.parse(fs.readFileSync(lockPath, "utf8"));
+  if (JSON.stringify(lock.projectionRoots) !== JSON.stringify(metadata.distribution.runtimes.map((name) => RUNTIMES[name]))) {
+    throw new Error("实例 Skill 锁与元数据的平台选择不一致");
+  }
+  return { metadata, lock, lockPath };
+}
+
+function runAssetSelection({ targetDir, requestedSkills = [], triggers = [], stage = null, plan = false }) {
+  const { metadata, lock, lockPath } = context(targetDir);
+  const distribution = metadata.distribution;
+  if (distribution.assetProfile !== ASSET_PROFILE) {
+    throw new Error("阶段资产命令仅适用于新建的按阶段分发实例；旧实例保持原分发范围");
+  }
+  if (stage && !Object.hasOwn(STAGES, stage)) throw new Error(`未知生命周期阶段：${stage}`);
+  const stageSkills = stage ? STAGES[stage].skills : [];
+  const registry = readDistributionRegistry(BUNDLED_TEMPLATE_ROOT);
+  const requested = [...new Set([...requestedSkills, ...stageSkills])];
+  const addStage = stage && !distribution.installedStages.includes(stage) ? stage : null;
+  const variables = { ...metadata.variables };
+  const before = buildDesiredManagedOperations(targetDir, { ...variables, distribution }, "init");
+  for (const operation of before) {
+    if (metadata.managedFiles[operation.relativePath] && pathKind(operation.targetPath) === "missing") {
+      throw new Error(`实例受管资产缺失，请先运行 create-yss-spec sync：${operation.relativePath}`);
+    }
+  }
+  let names, missingSkills, nextDistribution, after;
+  for (let attempt = 0; attempt <= 50; attempt++) {
+    names = requiredSkills(registry.text, requested, triggers, BUNDLED_TEMPLATE_ROOT);
+    missingSkills = names.filter((name) => !distribution.installedSkills.includes(name));
+    nextDistribution = {
+      ...distribution,
+      installedSkills: [...distribution.installedSkills, ...missingSkills].sort(),
+      installedStages: addStage ? [...distribution.installedStages, addStage] : [...distribution.installedStages],
+      resourceSkills: [...new Set([...distribution.resourceSkills, ...missingSkills])].sort(),
+    };
+    try {
+      after = buildDesiredManagedOperations(targetDir, { ...variables, distribution: nextDistribution }, "init");
+      break;
+    } catch (error) {
+      if (!error.requiredSkill || requested.includes(error.requiredSkill) || attempt === 50) throw error;
+      requested.push(error.requiredSkill);
+    }
+  }
+  const beforePaths = new Set(before.map((operation) => operation.relativePath));
+  const newOperations = after.filter((operation) => !beforePaths.has(operation.relativePath) && operation.relativePath !== "skills-lock.json");
+  const paths = newOperations.map((operation) => operation.relativePath);
+  for (const relative of paths) {
+    if (pathKind(targetPath(targetDir, relative)) !== "missing") throw new Error(`目标阶段资产路径已存在，拒绝覆盖：${relative}`);
+  }
+  if (plan) {
+    console.log(JSON.stringify({ operation: stage ? "assets ensure" : "skills ensure", targetDir, requested: stage || requestedSkills,
+      dependencies: names, addSkills: missingSkills, addStage, paths }, null, 2));
+    return;
+  }
+  if (!addStage && !missingSkills.length && !paths.length) {
+    verifyGeneratedProjectInstance(targetDir);
+    console.log("阶段资产已满足，无需写入");
+    return;
+  }
+  assertTargetWorkingTreeWritable(targetDir, { packageRoot: path.resolve(__dirname, "../..") });
+  const sourceLock = JSON.parse(fs.readFileSync(path.join(BUNDLED_TEMPLATE_ROOT, "skills-lock.json"), "utf8"));
+  runInTransaction({
+    targetDir, operation: stage ? "assets" : "skills", affectedPaths: [...paths, "skills-lock.json", ".yss-template.json"],
+    execute(transaction) {
+      const nextMetadata = structuredClone(metadata);
+      const nextLock = structuredClone(lock);
+      for (const operation of newOperations) {
+        applyManagedOperation(operation, transaction);
+        nextMetadata.managedFiles[operation.relativePath] = { type: operation.type, contentHash: fileHash(operation.targetPath) };
+      }
+      for (const name of missingSkills) {
+        if (!sourceLock.skills.shared[name]) throw new Error(`CLI 快照缺少 Skill 锁记录：${name}`);
+        nextLock.skills.shared[name] = { ...sourceLock.skills.shared[name], targets: [".agents/skills", ...nextLock.projectionRoots] };
+      }
+      nextMetadata.distribution = nextDistribution;
+      transaction.writeFile(lockPath, `${JSON.stringify(nextLock, null, 2)}\n`);
+      refreshGeneratedProjectInstance(targetDir);
+      nextMetadata.managedFiles["skills-lock.json"] = { type: "render", contentHash: fileHash(lockPath) };
+      verifyGeneratedProjectInstance(targetDir);
+      writeTemplateMetadata(targetDir, nextMetadata, transaction);
+    },
+  });
+  console.log(stage ? `已安装阶段资产 ${stage}` : `已补装 ${missingSkills.join(", ")}`);
+}
+
+function runAssets(argv = []) {
+  const [command, stage, ...rest] = argv;
+  if (command !== "ensure" || !stage || stage.startsWith("--")) throw new Error("用法：assets ensure <stage-id> --plan|--apply");
+  const options = parseSkillArgs(rest);
+  if (options.names.length || options.triggers.length) throw new Error("assets ensure 只接受一个阶段 ID");
+  runAssetSelection({ targetDir: path.resolve(options.targetDir), stage, plan: Boolean(options.plan) });
+}
+
+function runSkills(argv = []) {
+  const [command, maybeAction, ...rest] = argv;
+  const runtimeAdd = command === "runtime" && maybeAction === "add";
+  if (command !== "ensure" && !runtimeAdd) throw new Error("用法：skills ensure <skill-id...> --plan|--apply，或 skills runtime add <runtime> --plan|--apply");
+  const options = parseSkillArgs(runtimeAdd ? rest : [maybeAction, ...rest].filter((value) => value !== undefined));
+  if (!options.names.length) throw new Error(runtimeAdd ? "runtime add 需要平台名" : "ensure 需要至少一个 Skill ID");
+  if (runtimeAdd && options.names.length !== 1) throw new Error("runtime add 一次只接受一个平台");
+  const targetDir = path.resolve(options.targetDir);
+  const { metadata, lock, lockPath } = context(targetDir);
+  const distribution = metadata.distribution;
+  if (!runtimeAdd && distribution.assetProfile === ASSET_PROFILE) {
+    runAssetSelection({ targetDir, requestedSkills: options.names, triggers: options.triggers, plan: Boolean(options.plan) });
+    return;
+  }
+  const registry = readDistributionRegistry(BUNDLED_TEMPLATE_ROOT);
+  const names = runtimeAdd ? [] : requiredSkills(registry.text, options.names, options.triggers, BUNDLED_TEMPLATE_ROOT);
+  const runtime = runtimeAdd ? assertRuntime(options.names[0]) : null;
+  const missing = names.filter((name) => !distribution.installedSkills.includes(name));
+  const addedRuntime = runtime && !distribution.runtimes.includes(runtime) ? runtime : null;
+  const roots = distribution.runtimes.map((name) => RUNTIMES[name]);
+  const runtimeFiles = addedRuntime ? buildDesiredManagedOperations(targetDir, {
+    ...metadata.variables,
+    distribution: { mode: "selected", runtimes: [...distribution.runtimes, addedRuntime], installedSkills: distribution.installedSkills },
+  }, "init").filter((operation) => {
+    const runtimeRoot = RUNTIMES[addedRuntime].split("/")[0];
+    return (operation.relativePath.startsWith(`${runtimeRoot}/`) || (addedRuntime === "cursor" && operation.relativePath === ".cursorrules")) &&
+      !distribution.installedSkills.some((name) => operation.relativePath.startsWith(`${RUNTIMES[addedRuntime]}/${name}/`));
+  }) : [];
+  const paths = ["skills-lock.json", ".yss-template.json"];
+  for (const name of missing) {
+    paths.push(`.agents/skills/${name}`, ...roots.map((root) => `${root}/${name}`));
+  }
+  if (addedRuntime) paths.push(...Object.keys(lock.skills.shared).map((name) => `${RUNTIMES[addedRuntime]}/${name}`), ...runtimeFiles.map((operation) => operation.relativePath));
+  for (const relative of paths.slice(2)) {
+    if (pathKind(targetPath(targetDir, relative)) !== "missing") throw new Error(`目标 Skill 路径已存在，拒绝覆盖：${relative}`);
+  }
+  if (options.plan) {
+    console.log(JSON.stringify({ operation: runtimeAdd ? "runtime add" : "ensure", targetDir, requested: options.names, dependencies: names, addSkills: missing, addRuntime: addedRuntime, paths }, null, 2));
+    return;
+  }
+  if (!missing.length && !addedRuntime) {
+    verifyGeneratedProjectInstance(targetDir);
+    console.log("Skill 分发已满足，无需写入");
+    return;
+  }
+  assertTargetWorkingTreeWritable(targetDir, { packageRoot: path.resolve(__dirname, "../..") });
+  const sourceLock = JSON.parse(fs.readFileSync(path.join(BUNDLED_TEMPLATE_ROOT, "skills-lock.json"), "utf8"));
+  runInTransaction({
+    targetDir, operation: "skills", affectedPaths: paths,
+    execute(transaction) {
+      const nextMetadata = structuredClone(metadata);
+      const nextLock = structuredClone(lock);
+      if (addedRuntime) {
+        nextMetadata.distribution.runtimes.push(addedRuntime);
+        nextLock.projectionRoots.push(RUNTIMES[addedRuntime]);
+      }
+      for (const name of missing) {
+        const source = path.join(BUNDLED_TEMPLATE_ROOT, ".agents/skills", name);
+        if (pathKind(source) !== "directory" || !sourceLock.skills.shared[name]) throw new Error(`CLI 快照缺少 Skill：${name}`);
+        transaction.copyFile(source, targetPath(targetDir, `.agents/skills/${name}`));
+        for (const root of roots) transaction.copyFile(source, targetPath(targetDir, `${root}/${name}`));
+        if (name === "yss-design-system") {
+          for (const root of [".agents/skills", ...roots]) {
+            for (const file of ["SKILL.md", "references/data-quality-theme.md"]) {
+              const target = targetPath(targetDir, `${root}/${name}/${file}`);
+              transaction.writeFile(target, renderInstanceDesignSkillFile(fs.readFileSync(target, "utf8")));
+            }
+          }
+        }
+        nextMetadata.distribution.installedSkills.push(name);
+        nextLock.skills.shared[name] = { ...sourceLock.skills.shared[name], targets: [".agents/skills", ...nextLock.projectionRoots] };
+        addManagedTree(nextMetadata, targetDir, `.agents/skills/${name}`);
+        for (const root of roots) addManagedTree(nextMetadata, targetDir, `${root}/${name}`);
+      }
+      if (addedRuntime) {
+        const root = RUNTIMES[addedRuntime];
+        for (const name of Object.keys(nextLock.skills.shared)) {
+          const source = targetPath(targetDir, `.agents/skills/${name}`);
+          transaction.copyFile(source, targetPath(targetDir, `${root}/${name}`));
+          if (nextMetadata.distribution.installedSkills.includes(name)) addManagedTree(nextMetadata, targetDir, `${root}/${name}`);
+        }
+        for (const operation of runtimeFiles) {
+          transaction.copyFile(operation.sourcePath, operation.targetPath);
+          nextMetadata.managedFiles[operation.relativePath] = { type: operation.type, contentHash: fileHash(operation.targetPath) };
+        }
+      }
+      for (const record of Object.values(nextLock.skills.shared)) record.targets = [".agents/skills", ...nextLock.projectionRoots];
+      nextMetadata.distribution.installedSkills.sort();
+      transaction.writeFile(lockPath, `${JSON.stringify(nextLock, null, 2)}\n`);
+      refreshGeneratedProjectInstance(targetDir);
+      nextMetadata.managedFiles["skills-lock.json"] = { type: "render", contentHash: fileHash(lockPath) };
+      verifyGeneratedProjectInstance(targetDir);
+      writeTemplateMetadata(targetDir, nextMetadata, transaction);
+    },
+  });
+  console.log(runtimeAdd ? `已增加平台 ${runtime}` : `已补装 ${missing.join(", ")}`);
+}
+
+module.exports = { runSkills, runAssets };

package/src/commands/sync.js

@@ -56,6 +56,9 @@ function printSyncDryRun(context) {
     syncPlan.updated,
     (operation) => `update: ${operation.relativePath}`,
   );
+  if ([...syncPlan.updated, ...syncPlan.added].some((operation) => operation.relativePath === "skills-lock.json")) {
+    console.log("提示：skills-lock.json 为生成文件；最终校验后内容一致时不会重新写入。");
+  }
   printLimitedOperations(
     syncPlan.added,
     (operation) => `add: ${operation.relativePath}`,
@@ -85,6 +88,7 @@ function runSync(argv = []) {
   const context = buildSyncContext({
     targetDir: options.targetDir || ".",
     force: Boolean(options.force),
+    migrateLayout: Boolean(options.migrateLayout),
   });
 
   if (options.json) {

package/src/family-identity.js

@@ -36,7 +36,7 @@ const FAMILIES = [
   },
 ];
 
-const PROFILE_PATH = "docs/process/harness-profile.yaml";
+const PROFILE_PATH = ".template-spec/process/harness-profile.yaml";
 
 function statOrMissing(file) {
   try {
@@ -283,7 +283,7 @@ function createFamilyGuard(_packageRoot, expectedName) {
         Object.hasOwn(value, "metadataSchemaVersion") &&
         (!Number.isInteger(value.metadataSchemaVersion) ||
           value.metadataSchemaVersion < 1 ||
-          value.metadataSchemaVersion > (expectedName === "create-yss-spec" ? 2 : 1))
+          value.metadataSchemaVersion > (expectedName === "create-yss-spec" ? 3 : 1))
       ) {
         throw new Error("身份 metadata schema 版本非法或不支持");
       }

package/src/template/asset-runtime.js

@@ -0,0 +1,228 @@
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+const ASSET_PROFILE = "stage-selective";
+const INITIAL_STAGES = ["stage.entry-triage", "stage.plan"];
+const TEMPLATE_ONLY_IMPORTS = new Set(["scripts/lib/maintenance-intensity.mjs"]);
+const RENDERED_SKILL_SCRIPTS = Object.freeze({ "yss-design-system": ["scripts/design-md"] });
+const SKILL_ASSET_PREFIXES = Object.freeze({ "yss-design-system": [".template-spec/design/tokens/"] });
+
+// Paths here are the entry points for each stage. Relative JavaScript imports
+// are included by moduleClosure; files named by an explicitly installed Skill
+// are included by skillReferences. The CLI snapshot retains every source file.
+const COMMON = {
+  files: [
+    ".template-spec/agents/yss-skill-registry.yaml",
+    ".template-spec/agents/digital-human-roles.yaml",
+    ".template-spec/agents/digital-human-roles.md",
+    ".template-spec/agents/issue-tracker.md",
+    ".template-spec/agents/triage-labels.md",
+    ".template-spec/agents/domain.md",
+    ".template-spec/process/lifecycle-registry.yaml",
+    ".template-spec/process/lifecycle-registry-baseline.json",
+    ".template-spec/process/lifecycle-registry-baseline-v1.json",
+    ".template-spec/process/lifecycle-artifact-map.md",
+    ".template-spec/process/harness-process-tailoring.md",
+    ".template-spec/process/document-writing.md",
+    ".template-spec/process/contract-reading.md",
+    ".template-spec/process/stage-tracking.md",
+    ".template-spec/process/schemas/context-reconciliation.schema.json",
+    ".template-spec/process/schemas/digital-human-task-package.schema.json",
+    ".template-spec/process/schemas/lifecycle-checkpoint.schema.json",
+    ".template-spec/process/schemas/stage-tracking.schema.json",
+    ".template-spec/process/schemas/user-decision.schema.json",
+    ".template-spec/process/templates/context-reconciliation-template.yaml",
+    ".template-spec/process/templates/lifecycle-checkpoint-template.yaml",
+    ".template-spec/process/templates/stage-checkpoint-template.md",
+    ".template-spec/process/templates/user-decision-template.yaml",
+    ".template-spec/templates/local-parent-ticket-template.md",
+    ".template-spec/templates/approval-record-template.yaml",
+    ".template-spec/templates/review-report-template.md",
+    ".template-spec/user-guide/用户手册.md",
+  ],
+  scripts: [
+    "scripts/verify-project-instance",
+    "scripts/sync-skills",
+    "scripts/update-skill-lock",
+    "scripts/verify-context-contract",
+    "scripts/verify-context-reconciliation",
+    "scripts/verify-digital-human-roles",
+    "scripts/verify-digital-human-task-package",
+    "scripts/verify-lifecycle-checkpoint",
+    "scripts/verify-user-decision",
+    "scripts/verify-approval-record",
+    "scripts/query-lifecycle-context",
+    "scripts/contract",
+    "scripts/stage-tracking",
+    "scripts/gitworks",
+  ],
+};
+
+const STAGES = Object.freeze({
+  "stage.entry-triage": { files: [], scripts: [], skills: [] },
+  "stage.plan": {
+    prefixes: [".template-spec/plan/"],
+    files: [".template-spec/process/plan-migration.md"],
+    scripts: ["scripts/verify-plan-spec-entry"],
+    skills: [],
+  },
+  "stage.spec-architecture": {
+    files: [
+      ".template-spec/templates/spec-template.md",
+      ".template-spec/templates/spec-delta-template.md",
+      ".template-spec/architecture/templates/business-architecture-template.md",
+      ".template-spec/architecture/templates/functional-architecture-template.md",
+    ],
+    scripts: [],
+    skills: [],
+  },
+  "stage.product-design": {
+    prefixes: [".template-spec/design/"],
+    files: [],
+    scripts: ["scripts/design-md"],
+    skills: ["yss-prototype-stage"],
+  },
+  "stage.system-data-engineering": {
+    prefixes: [".template-spec/engineering/"],
+    files: [
+      ".template-spec/process/implementation-repo-integration.md",
+      ".template-spec/process/existing-backend-architecture.md",
+      ".template-spec/process/existing-ui-baseline.md",
+      ".template-spec/process/frontend-backend-delivery.md",
+      ".template-spec/templates/implementation-repo-registry-template.md",
+    ],
+    scripts: [
+      "scripts/backend-platforms",
+      "scripts/backend-delivery",
+      "scripts/repository-scope-policy",
+      "scripts/verify-scaffold-architecture-decisions",
+    ],
+    skills: ["yss-implementation-contract-compiler"],
+  },
+  "stage.ticket-formalization": {
+    files: [".template-spec/templates/vertical-slice-ticket-template.md", ".template-spec/templates/cross-repo-slice-template.md"],
+    scripts: ["scripts/dispatch-slice-task", "scripts/slice-contract"],
+    skills: [],
+  },
+  "stage.vertical-slice-implementation": {
+    files: [".template-spec/templates/verification-record-template.md"],
+    scripts: ["scripts/implementation-path-policy", "scripts/complete-backend-delivery"],
+    skills: [],
+  },
+  "stage.verification-release-retrospective": {
+    files: [
+      ".template-spec/process/delivery-preflight.md",
+      ".template-spec/templates/release-note-template.md",
+      ".template-spec/templates/retro-report-template.md",
+      ".template-spec/templates/review-bundle-template.yaml",
+    ],
+    scripts: ["scripts/preflight-delivery"],
+    skills: [],
+  },
+});
+
+function sourceFile(root, ref) {
+  const file = path.join(root, ref);
+  if (!fs.existsSync(file) || !fs.statSync(file).isFile()) throw new Error(`CLI 快照缺少阶段资产：${ref}`);
+  return file;
+}
+
+function addFile(root, result, ref) {
+  sourceFile(root, ref);
+  result.add(ref);
+}
+
+function addPrefix(root, result, prefix) {
+  const directory = path.join(root, prefix);
+  if (!fs.existsSync(directory) || !fs.statSync(directory).isDirectory()) throw new Error(`CLI 快照缺少阶段目录：${prefix}`);
+  for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+    const ref = `${prefix}${entry.name}`;
+    if (entry.isDirectory()) addPrefix(root, result, `${ref}/`);
+    else if (entry.isFile()) result.add(ref);
+  }
+}
+
+function moduleClosure(root, result, ref, selectedSkills) {
+  if (result.has(ref)) return;
+  const source = fs.readFileSync(sourceFile(root, ref), "utf8");
+  result.add(ref);
+  const expressions = [
+    /\b(?:import|export)\s+(?:[^'"\n]*?\s+from\s*)?['"]([^'"]+)['"]/g,
+    /\b(?:require|import)\s*\(\s*['"]([^'"]+)['"]\s*\)/g,
+  ];
+  for (const expression of expressions) {
+    for (const match of source.matchAll(expression)) {
+      if (!match[1].startsWith(".")) continue;
+      const resolved = path.posix.normalize(path.posix.join(path.posix.dirname(ref), match[1]));
+      const candidate = [resolved, `${resolved}.mjs`, `${resolved}.js`].find((name) => fs.existsSync(path.join(root, name)));
+      if (!candidate && TEMPLATE_ONLY_IMPORTS.has(resolved)) continue;
+      if (candidate?.startsWith(".agents/skills/")) {
+        const skill = candidate.split("/")[2];
+        if (!selectedSkills.has(skill)) {
+          const error = new Error(`阶段脚本依赖未安装 Skill：${ref} -> ${skill}`);
+          error.requiredSkill = skill;
+          throw error;
+        }
+        continue;
+      }
+      if (!candidate || !candidate.startsWith("scripts/")) throw new Error(`阶段脚本依赖未分发：${ref} -> ${match[1]}`);
+      moduleClosure(root, result, candidate, selectedSkills);
+    }
+  }
+}
+
+function skillReferences(root, result, skillId, selectedSkills) {
+  const skillRoot = path.join(root, ".agents/skills", skillId);
+  if (!fs.existsSync(skillRoot)) throw new Error(`CLI 快照缺少 Skill：${skillId}`);
+  function visit(directory) {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const file = path.join(directory, entry.name);
+      if (entry.isDirectory()) visit(file);
+      else if (entry.isFile() && /\.(?:md|yaml|json)$/.test(entry.name)) {
+        const source = fs.readFileSync(file, "utf8");
+        for (const match of source.matchAll(/(?:\.template-spec|scripts)\/[\p{L}\p{N}_.\/-]+/gu)) {
+          const ref = match[0].replace(/[.,;]+$/, "");
+          if (!fs.existsSync(path.join(root, ref)) || !fs.statSync(path.join(root, ref)).isFile()) continue;
+          if (ref.startsWith("scripts/")) moduleClosure(root, result, ref, selectedSkills);
+          else addFile(root, result, ref);
+        }
+      }
+    }
+  }
+  visit(skillRoot);
+  for (const prefix of SKILL_ASSET_PREFIXES[skillId] || []) addPrefix(root, result, prefix);
+  for (const ref of RENDERED_SKILL_SCRIPTS[skillId] || []) moduleClosure(root, result, ref, selectedSkills);
+}
+
+function assetPaths(root, distribution) {
+  if (distribution.mode !== "selected" || distribution.assetProfile !== ASSET_PROFILE) return null;
+  const lifecycle = fs.readFileSync(sourceFile(root, ".template-spec/process/lifecycle-registry.yaml"), "utf8");
+  const stageIds = [...lifecycle.matchAll(/^  - id: (stage\.[a-z0-9-]+)\s*$/gm)].map((match) => match[1]).sort();
+  if (JSON.stringify(stageIds) !== JSON.stringify(Object.keys(STAGES).sort())) {
+    throw new Error("CLI 阶段资产映射与生命周期注册表阶段 ID 不一致");
+  }
+  const result = new Set();
+  const selectedSkills = new Set(distribution.installedSkills);
+  for (const ref of COMMON.files) {
+    if (ref === ".template-spec/process/lifecycle-registry-baseline-v1.json" &&
+        !fs.existsSync(path.join(root, ref))) {
+      const baseline = JSON.parse(fs.readFileSync(sourceFile(root, ".template-spec/process/lifecycle-registry-baseline.json"), "utf8"));
+      if (baseline.schema_version === 1) continue;
+    }
+    addFile(root, result, ref);
+  }
+  for (const ref of COMMON.scripts) moduleClosure(root, result, ref, selectedSkills);
+  for (const stage of distribution.installedStages) {
+    const bundle = STAGES[stage];
+    if (!bundle) throw new Error(`未知生命周期阶段：${stage}`);
+    for (const prefix of bundle.prefixes || []) addPrefix(root, result, prefix);
+    for (const ref of bundle.files || []) addFile(root, result, ref);
+    for (const ref of bundle.scripts || []) moduleClosure(root, result, ref, selectedSkills);
+  }
+  for (const skill of distribution.resourceSkills || []) skillReferences(root, result, skill, selectedSkills);
+  return result;
+}
+
+module.exports = { ASSET_PROFILE, INITIAL_STAGES, STAGES, assetPaths };

package/src/template/attach-planner.js

@@ -41,7 +41,7 @@ function classifyAttachOperations({
       continue;
     }
 
-    if (operation.relativePath === "docs/agents/issue-tracker.md") {
+    if (operation.relativePath === ".template-spec/agents/issue-tracker.md") {
       matched.push({ ...operation, reason: "project-owned-tracker-configuration" });
       continue;
     }