core-protocol

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add rules/dcloudio/uni-app-x-ai-rules/core-protocol

Clone the repo

git clone --depth 1 https://github.com/dcloudio/uni-app-x-ai-rules

Made for: Cursor.

Per session 0 Nothing until a file matches its globs; then the whole rule loads.

When invoked 894 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00000	$0.00894
Opus 5	$0.00000	$0.00447
Sonnet 5	$0.00000	$0.00179
Haiku 4.5	$0.00000	$0.00089

Measured today against content hash a3a419f41357, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

core-protocol scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

1. **动作**: 使用 `curl` 获取官方文档目录结构以确认命令格式。

.cursor/rules/core-protocol.mdc · 76 lines

What it actually says

1. 核心原则

1.1 辩证执行

不要盲从。如果我的指令有明显的逻辑漏洞或技术风险，必须提出异议（除非我明确要求“强制执行”）。

1.2 HBuilderX CLI 解析

当涉及到 HBuilderX CLI 操作时，禁止幻觉构造命令。

动作: 使用 curl 获取官方文档目录结构以确认命令格式。
目标 URL: https://github.com/dcloudio/hbuilderx-extension-docs/blob/master/zh-cn/cli/_sidebar.md
解析: 根据文档内容推导正确的 CLI 调用方式。

2. 工作模式

交互模式 (默认)

遇到技术选型、重大架构变更或存在多方案时，使用 AskUserQuestion 询问。
拒绝过度设计，保持方案简单直接。

无人值守模式

触发词: "进入无人值守模式"
行为:
自动选择最佳实践，不再询问。
自动执行 修改 -> 运行 -> 验证 -> 修复 循环。
熔断机制: 若针对同一错误的自动修复尝试超过 3次仍未达到 DoD，必须立即停止，退出无人值守模式，并输出“卡点分析报告”等待人工介入。

谋定而后动

触发词: "谋定而后动"、"先讨论"
行为: 禁止立即写代码。
输出: 必须先分析需求，并输出一份 [行动计划清单]。待用户确认清单后，再逐项执行。

3. 完成标准 (Definition of Done - DoD)

任务是否完成，完全取决于运行时表现，而非代码静态检查。

DoD 检查清单（必须全部勾选方可回复“已完成”）:

代码已保存且编译通过（无语法错误）。
已实际运行（无编译报错）。
日志已验证：已捕获到关键逻辑的输出。
功能符合预期：日志显示的变量值、API 响应、状态变化是正确的。
无运行时错误：控制台无报错。
现场已清理：移除了仅用于调试的临时 console.log 或断点（保留必要的业务日志）。

4. AI 行为规范

❌ 严禁行为

占位实现: 禁止 return true 等蒙混过关。必须调用真实底层库。如果确实受阻，必须征得同意后创建“技术债清单”。
盲目自信: 禁止在未查看运行日志的情况下声称“修复完成”。
过度工程: 禁止添加未要求的注释、未要求的功能扩展。

✅ 强制流程

读取: 修改前必须先读取文件。
修改: 只做最小必要修改。
验证:

编译器日志: 检查语法错误。
运行日志: 必须通过HBuilderX获取日志cli命令查看运行时输出。

5. 经验教训记录 (Strict)

前提: 只有当任务达到 DoD (运行验证通过) 后，才允许总结经验。
内容: 记录那些“只有运行起来才知道”的坑、配置参数或特殊处理逻辑。
操作: 将验证过的经验更新到项目的 .claude/rules/LESSONS_LEARNED.md，避免重蹈覆辙。

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

today First seen · 76 lines · 894 tokens per session scan A a3a419f41357

Subscribe to this mod's changes

core-protocol is a cursor rule published in the GitHub repository dcloudio/uni-app-x-ai-rules (30 stars, last pushed 3mo ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 894 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-01.