What is core-protocol?

A set of working rules for an AI coding assistant, including how to question risky instructions, handle HBuilderX commands, and validate changes.

It is for guiding coding tasks that need explicit planning, runtime verification, and controlled automated fixes.

It reduces the risk of following flawed instructions, inventing commands, or declaring work complete without running and checking it.

core-protocol — Cursor rule for Cursor by dcloudio/uni-app-x-ai-rules

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/dcloudio/uni-app-x-ai-rules

Made for: Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/rules/dcloudio/uni-app-x-ai-rules/core-protocol/github.svg)](https://agentmods.dev/rules/dcloudio/uni-app-x-ai-rules/core-protocol)

Your own site

<a href="https://agentmods.dev/rules/dcloudio/uni-app-x-ai-rules/core-protocol"><img src="https://agentmods.dev/badge/rules/dcloudio/uni-app-x-ai-rules/core-protocol/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/rules/dcloudio/uni-app-x-ai-rules/core-protocol"><img src="https://agentmods.dev/badge/rules/dcloudio/uni-app-x-ai-rules/core-protocol.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 0 Nothing until a file matches its globs; then the whole rule loads.

When invoked 894 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00000	$0.00894
Opus 5.5	$0.00000	$0.00358
Sonnet 5.5	$0.00000	$0.00179
Haiku 4.5	$0.00000	$0.00089

Measured 1mo ago against content hash a3a419f41357, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

core-protocol scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

1. **动作**: 使用 `curl` 获取官方文档目录结构以确认命令格式。

.cursor/rules/core-protocol.mdc · 76 lines

What it actually says

1. 核心原则

1.1 辩证执行

不要盲从。如果我的指令有明显的逻辑漏洞或技术风险，必须提出异议（除非我明确要求“强制执行”）。

1.2 HBuilderX CLI 解析

当涉及到 HBuilderX CLI 操作时，禁止幻觉构造命令。

动作: 使用 curl 获取官方文档目录结构以确认命令格式。
目标 URL: https://github.com/dcloudio/hbuilderx-extension-docs/blob/master/zh-cn/cli/_sidebar.md
解析: 根据文档内容推导正确的 CLI 调用方式。

2. 工作模式

交互模式 (默认)

遇到技术选型、重大架构变更或存在多方案时，使用 AskUserQuestion 询问。
拒绝过度设计，保持方案简单直接。

无人值守模式

触发词: "进入无人值守模式"
行为:
自动选择最佳实践，不再询问。
自动执行 修改 -> 运行 -> 验证 -> 修复 循环。
熔断机制: 若针对同一错误的自动修复尝试超过 3次仍未达到 DoD，必须立即停止，退出无人值守模式，并输出“卡点分析报告”等待人工介入。

谋定而后动

触发词: "谋定而后动"、"先讨论"
行为: 禁止立即写代码。
输出: 必须先分析需求，并输出一份 [行动计划清单]。待用户确认清单后，再逐项执行。

3. 完成标准 (Definition of Done - DoD)

任务是否完成，完全取决于运行时表现，而非代码静态检查。

DoD 检查清单（必须全部勾选方可回复“已完成”）:

代码已保存且编译通过（无语法错误）。
已实际运行（无编译报错）。
日志已验证：已捕获到关键逻辑的输出。
功能符合预期：日志显示的变量值、API 响应、状态变化是正确的。
无运行时错误：控制台无报错。
现场已清理：移除了仅用于调试的临时 console.log 或断点（保留必要的业务日志）。

4. AI 行为规范

❌ 严禁行为

占位实现: 禁止 return true 等蒙混过关。必须调用真实底层库。如果确实受阻，必须征得同意后创建“技术债清单”。
盲目自信: 禁止在未查看运行日志的情况下声称“修复完成”。
过度工程: 禁止添加未要求的注释、未要求的功能扩展。

✅ 强制流程

读取: 修改前必须先读取文件。
修改: 只做最小必要修改。
验证:

编译器日志: 检查语法错误。
运行日志: 必须通过HBuilderX获取日志cli命令查看运行时输出。

5. 经验教训记录 (Strict)

前提: 只有当任务达到 DoD (运行验证通过) 后，才允许总结经验。
内容: 记录那些“只有运行起来才知道”的坑、配置参数或特殊处理逻辑。
操作: 将验证过的经验更新到项目的 .claude/rules/LESSONS_LEARNED.md，避免重蹈覆辙。

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 76 lines · 894 tokens per session scan A a3a419f41357

Subscribe to this mod's changes

core-protocol is a cursor rule published in the GitHub repository dcloudio/uni-app-x-ai-rules (32 stars, last pushed 5mo ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 894 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-01.

Debugging Planning

error-handling-and-validation

A code-quality guide for handling errors, invalid inputs, edge cases, preconditions, logging, and user-friendly error messages.

holtwood/awesome-cursorrules-zh · 185 tokens

css-render-blocking-diagnosis

Cursor rule "css-render-blocking-diagnosis" from adobecom/da-express-milo, covering css render-blocking diagnosis & resolution, critical learning from 98 pagespeed achievement, primary diagnostic protocol, step 1: css blocking symptom recognition and step 2: css loading sequence audit.

adobecom/da-express-milo · 1,102 tokens

core-protocol