npx skills add https://github.com/boshu2/agentops --skill implement快速参考: 端到端执行单个问题。输出:代码变更 + 提交 + 已关闭的问题。
你必须执行此工作流程。不要仅仅描述它。
从头到尾执行单个问题。
CLI 依赖项: bd(问题跟踪),ao(棘轮门)。两者都是可选的——有关备用方案,请参阅 skills/shared/SKILL.md。如果 bd 不可用,则直接使用问题描述并通过 TaskList 跟踪进度,而不是使用 beads。
给定 /implement <issue-id-or-description>:
有关恢复协议的详细信息,请阅读 skills/implement/references/resume-protocol.md。
有关棘轮门控检查和事前门控的详细信息,请阅读 skills/implement/references/gate-checks.md。
# 拉取与此问题相关的知识(如果 ao 可用)
ao lookup --bead <issue-id> --limit 3 2>/dev/null || true
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
如果提供了 beads 问题 ID(例如,gt-123):
bd show <issue-id> 2>/dev/null
如果提供了纯描述: 将其用作任务描述。
如果没有参数: 检查是否有就绪的工作:
bd ready 2>/dev/null | head -3
bd update <issue-id> --status in_progress 2>/dev/null
if command -v ao &>/dev/null; then
ao context assemble --task='<issue title and description>'
fi
这会在 .agents/rpi/briefing-current.md 生成一份 5 部分的简报(目标、历史、情报、任务、协议),其中机密信息已脱敏。在收集额外上下文之前请先阅读它。
使用 TASK 工具 探索相关代码:
Tool: Task
Parameters:
subagent_type: "Explore"
description: "收集上下文用于:<issue title>"
prompt: |
查找与以下内容相关的代码:<issue description>
1. 搜索相关文件(Glob)
2. 搜索相关关键词(Grep)
3. 阅读关键文件以理解当前实现
4. 确定需要进行更改的位置
返回:
- 要修改的文件(路径)
- 当前实现摘要
- 建议的方法
- 任何风险或顾虑
在实现任何新函数或工具之前,先在代码库中搜索现有实现:
# 搜索你即将创建的函数名称模式
grep -rn "<function-name-pattern>" --include="*.go" --include="*.py" --include="*.ts" .
原因: 在 context-orchestration-leverage 中,一个工作程序创建了一个重复的 estimateTokens 函数,而该函数已存在于 context.go 中。一次 5 秒的 grep 搜索本可以防止这种重复以及后续整合所需的重做工作。
如果找到现有实现,请重用。如果需要修改,请就地修改,而不是创建并行版本。
在实现之前,编写定义预期行为的测试:
# 运行测试 - 所有新测试必须失败
# Python: pytest tests/test_<feature>.py -v
# Go: go test ./path/to/... -run TestNew
# Node: npm test -- --grep "new feature"
测试级别选择: 根据金字塔级别对每个测试进行分类(参见标准技能中的测试金字塔标准(standards 中的 test-pyramid.md)):
如果问题包含来自 /plan 的 test_levels 元数据,则使用这些级别。否则,默认使用 L1 加上上述决策树中任何适用的更高级别。
错误查找级别选择(与 L0–L3 一起):
如果实现涉及外部边界(API、数据库、文件 I/O):
如果实现包括数据转换(解析、渲染、序列化):
如果实现生成输出文件(配置、报告、清单):
参考:/standards 中的测试金字塔标准以获取完整的工具矩阵。
跳过条件(满足以下任何一条即可绕过步骤 3.5):
/crank --test-first 调用——测试已存在)chore、docs 或 ci--no-tdd 标志注意: 此处编写的测试是可变的——与 GREEN 模式的不可变测试不同,如果在实现过程中发现初始测试设计有误,你可以调整这些测试。目标是在编码之前思考行为,而不是僵化不变。
CI 安全测试: 如果被测试的函数调用了外部 CLI(bd、ao、gh),则不要测试包装器。而是测试执行可测试工作的底层函数(事件发射、状态变更、文件 I/O)。有关示例,请参阅 Go 标准(测试部分)。
GREEN 模式检查: 如果提供了测试文件(由 /crank --test-first 调用):
根据收集的上下文:
如果项目有 Go cmd/ 目录或带有 build 目标的 Makefile,请在继续测试之前运行构建验证:
# 检测 CLI 仓库
if [ -f go.mod ] && ls cmd/*/main.go &>/dev/null; then
echo "检测到 CLI 仓库 — 正在运行构建验证..."
# 构建
go build ./cmd/... 2>&1
if [ $? -ne 0 ]; then
echo "构建失败 — 在继续之前修复编译错误"
# 不要继续步骤 5
fi
# Vet
go vet ./cmd/... 2>&1
# 冒烟测试:使用 --help 运行二进制文件
BINARY=$(ls -t cmd/*/main.go | head -1 | xargs dirname | xargs basename)
if [ -f "bin/$BINARY" ]; then
./bin/$BINARY --help > /dev/null 2>&1
echo "冒烟测试:$BINARY --help 通过"
fi
fi
如果构建失败: 修复编译错误并在继续之前重新运行。不要在构建损坏的情况下跳转到验证。
如果不是 CLI 仓库: 此步骤为无操作——直接继续步骤 5。
在进行功能验证之前,检查修改后的代码中是否存在常见安全问题:
| 检查项 | 需要查找的内容 | 操作 |
|---|---|---|
| 输入验证 | 未经验证就使用用户/外部输入 | 在入口点添加验证 |
| 输出转义 | HTML/模板中的原始数据(innerHTML、document.write、dangerouslySetInnerHTML) | 使用框架自动转义或显式清理 |
| 路径安全 | 通过 .. 序列进行路径遍历;来自用户输入的文件路径未经清理 | 拒绝 ..、绝对路径;使用 filepath.Clean() 或等效方法;验证路径保持在允许的目录内 |
| 身份验证门控 | 端点/处理程序缺少身份验证或授权检查 | 添加中间件或守卫子句 |
| Content-Type | HTTP 响应没有显式的 Content-Type 头 | 设置 Content-Type 以防止 MIME 嗅探攻击 |
| CORS | 过于宽松的 CORS 配置(* origin, credentials: true) | 限制为已知来源;切勿将通配符与凭据结合使用 |
| CSRF 令牌 | 状态更改端点(POST/PUT/DELETE)没有反 CSRF 令牌 | 添加反 CSRF 令牌验证;不要仅依赖 cookie 进行身份验证 |
| 速率限制 | 身份验证、API 和上传端点没有速率限制 | 添加速率限制中间件;返回 429 并附带 Retry-After 头 |
跳过时机: 变更不涉及 HTTP 处理程序、面向用户的输入、文件系统操作或模板渲染。纯内部重构、仅测试变更和文档编辑跳过此步骤。
如果发现问题: 在继续步骤 5 之前进行修复。在提交消息中记录修复。
成功标准(必须全部通过):
检查测试文件并运行它们:
# 查找测试
ls *test* tests/ test/ __tests__/ 2>/dev/null | head -5
# 运行测试(根据项目类型调整)
# Python: pytest
# Go: go test ./...
# Node: npm test
# Rust: cargo test
如果测试存在: 所有测试必须通过。任何失败 = 验证失败。
如果没有测试: 需要手动验证:
如果验证失败: 不要继续步骤 5a。首先修复问题。
铁律: 没有新的验证证据,不得声称完成
在报告成功之前,你必须:
没有新鲜验证证据时禁止使用的短语:
| 借口 | 现实 |
|---|---|
| "太简单了,无需验证" | 简单的代码也会出错。验证只需 10 秒。 |
| "我刚运行过" | 再运行一次。仅限新鲜输出。 |
| "测试之前通过了" | 现在运行它们。状态会变化。 |
| "显然它能工作" | 没有什么是显然的。要么提供证据,要么保持沉默。 |
| "编辑看起来正确" | 看起来正确 != 能工作。运行代码。 |
存储检查点:
bd update <issue-id> --append-notes "检查点:步骤 5a 验证于 $(date -Iseconds) 通过" 2>/dev/null
当由 /crank 使用 --test-first 调用时,工作程序会收到:
GREEN 模式规则:
验证(GREEN 模式):
测试不可变性强制执行:
在提交之前,对本次会话中修改的所有文件运行修复-验证循环(最多 3 次迭代):
第 N 次迭代:
git diff --name-only HEAD_ = err 或空的 catch 块)循环终止:
--force-commit 允许在记录高严重性问题的情况下继续(仅限显式选择加入)输出: 记录迭代次数、每次迭代的发现以及剩余项。
如果没有修改文件或首次扫描未发现问题,则直接继续步骤 6。
如果变更完成且已验证:
git add <modified-files>
git commit -m "<descriptive message>
Implements: <issue-id>"
bd update <issue-id> --status closed 2>/dev/null
成功关闭问题后,在棘轮中记录:
# 检查 ao CLI 是否可用
if command -v ao &>/dev/null; then
# 获取提交哈希作为输出工件
COMMIT_HASH=$(git rev-parse HEAD 2>/dev/null || echo "")
CHANGED_FILES=$(git diff --name-only HEAD~1 2>/dev/null | tr '\n' ',' | sed 's/,$//')
if [ -n "$COMMIT_HASH" ]; then
# 记录成功的实施
ao ratchet record implement \
--output "$COMMIT_HASH" \
--files "$CHANGED_FILES" \
--issue "<issue-id>" \
2>&1 | tee -a .agents/ratchet.log
if [ $? -eq 0 ]; then
echo "棘轮:实施已记录(提交:${COMMIT_HASH:0:8})"
else
echo "棘轮:记录失败 - chain.jsonl 可能需要修复"
fi
else
echo "棘轮:未找到提交 - 跳过记录"
fi
else
echo "棘轮:ao CLI 不可用 - 实施未记录"
echo " 手动运行:ao ratchet record implement --output <commit>"
fi
失败/阻塞时: 在棘轮中记录阻塞:
if command -v ao &>/dev/null; then
ao ratchet record implement \
--status blocked \
--reason "<blocker description>" \
2>/dev/null
fi
备用方案: 如果 ao 不可用,问题仍会通过 bd 关闭,但不会在棘轮链中跟踪。技能正常继续。
实施完成后:
if command -v ao &>/dev/null; then
ao ratchet record implement --output "<issue-id>" 2>/dev/null || true
fi
告诉用户:"实施完成。在推送之前运行 /vibe 进行验证。"
告诉用户:
输出完成标记:
<promise>完成</promise>
如果阻塞或未完成:
<promise>阻塞</promise>
原因:<阻塞原因>
<promise>部分完成</promise>
剩余:<剩余内容>
--no-tdd 跳过)如果 bd CLI 不可用:
用户说: /implement ag-5k2
发生的情况:
middleware/auth.go 以添加令牌验证go test ./middleware/... —— 所有测试通过bd update ag-5k2 --status closed 关闭问题结果: 问题已实施、验证、提交并关闭。棘轮已记录。
用户说: /implement
发生的情况:
bd ready —— 找到 ag-3b7(第一个未阻塞的问题)bd update ag-3b7 --status in_progress 认领问题结果: 从就绪队列中自主拾取并完成工作。
用户说: /implement ag-8h3(由 /crank --test-first 调用)
发生的情况:
结果: 由测试驱动的最小化实现,无过度设计。
| 问题 | 原因 | 解决方案 |
|---|---|---|
| 找不到问题 | 问题 ID 不存在或本地状态看起来过时 | 运行 bd show <id> 验证;仅在需要 Dolt 状态时使用 bd vc status |
| GREEN 模式违规 | 编辑了与问题范围无关的文件 | 撤销无关更改。GREEN 模式将编辑限制在与问题相关的文件上 |
| 验证门控失败 | 实施后测试失败或构建中断 | 阅读验证输出,修复特定的失败,重新运行验证 |
| "阻塞"状态 | GREEN 模式下契约与测试矛盾或不完整 | 写出具体原因的阻塞,不要修改测试 |
| 缺少新鲜验证 | 代理声称成功但未运行验证命令 | 在声称完成之前必须运行验证命令并附带完整的新鲜输出 |
| 棘轮记录失败 | ao CLI 不可用或 chain.jsonl 损坏 | 实施仍会通过 bd 关闭,但棘轮链需要手动修复 |
每周安装次数
269
仓库
GitHub 星标数
220
首次出现
2026年2月2日
安全审计
安装于
opencode266
codex262
github-copilot261
gemini-cli261
amp259
kimi-cli259
Quick Ref: Execute single issue end-to-end. Output: code changes + commit + closed issue.
YOU MUST EXECUTE THIS WORKFLOW. Do not just describe it.
Execute a single issue from start to finish.
CLI dependencies: bd (issue tracking), ao (ratchet gates). Both optional — see skills/shared/SKILL.md for fallback table. If bd is unavailable, use the issue description directly and track progress via TaskList instead of beads.
Given /implement <issue-id-or-description>:
For resume protocol details, readskills/implement/references/resume-protocol.md.
For ratchet gate checks and pre-mortem gate details, readskills/implement/references/gate-checks.md.
# Pull knowledge scoped to this issue (if ao available)
ao lookup --bead <issue-id> --limit 3 2>/dev/null || true
If beads issue ID provided (e.g., gt-123):
bd show <issue-id> 2>/dev/null
If plain description provided: Use that as the task description.
If no argument: Check for ready work:
bd ready 2>/dev/null | head -3
bd update <issue-id> --status in_progress 2>/dev/null
if command -v ao &>/dev/null; then
ao context assemble --task='<issue title and description>'
fi
This produces a 5-section briefing (GOALS, HISTORY, INTEL, TASK, PROTOCOL) at .agents/rpi/briefing-current.md with secrets redacted. Read it before gathering additional context.
USE THE TASK TOOL to explore relevant code:
Tool: Task
Parameters:
subagent_type: "Explore"
description: "Gather context for: <issue title>"
prompt: |
Find code relevant to: <issue description>
1. Search for related files (Glob)
2. Search for relevant keywords (Grep)
3. Read key files to understand current implementation
4. Identify where changes need to be made
Return:
- Files to modify (paths)
- Current implementation summary
- Suggested approach
- Any risks or concerns
Before implementing any new function or utility, grep the codebase for existing implementations:
# Search for the function name pattern you're about to create
grep -rn "<function-name-pattern>" --include="*.go" --include="*.py" --include="*.ts" .
Why: In context-orchestration-leverage, a worker created a duplicate estimateTokens function that already existed in context.go. A 5-second grep would have prevented the duplication and the rework needed to consolidate it.
If you find an existing implementation, reuse it. If it needs modification, modify it in place rather than creating a parallel version.
Before implementing, write tests that define the expected behavior:
# Run tests - ALL new tests must FAIL
# Python: pytest tests/test_<feature>.py -v
# Go: go test ./path/to/... -run TestNew
# Node: npm test -- --grep "new feature"
Test level selection: Classify each test by pyramid level (see the test pyramid standard (test-pyramid.md in the standards skill)):
If the issue includes test_levels metadata from /plan, use those levels. Otherwise, default to L1 + any applicable higher levels from the decision tree above.
Bug-Finding Level Selection (alongside L0–L3):
If the implementation touches external boundaries (APIs, databases, file I/O):
If the implementation includes data transformations (parse, render, serialize):
If the implementation generates output files (configs, reports, manifests):
Reference: the test pyramid standard in /standards for full tooling matrix.
Skip conditions (any of these bypasses Step 3.5):
/crank --test-first — tests already exist)chore, docs, or ci--no-tdd flag is setNote: Tests written here are MUTABLE — unlike GREEN mode's immutable tests, you may adjust these tests during implementation if you discover the initial test design was wrong. The goal is to think about behavior before code, not to be rigid.
CI-safe tests: If the function under test shells out to an external CLI (bd, ao, gh), do NOT test the wrapper. Instead, test the underlying function that performs the testable work (event emission, state mutation, file I/O). See the Go standards (Testing section) for examples.
GREEN Mode check: If test files were provided (invoked by /crank --test-first):
Based on the context gathered:
If the project has a Go cmd/ directory or a Makefile with a build target, run build verification before proceeding to tests:
# Detect CLI repo
if [ -f go.mod ] && ls cmd/*/main.go &>/dev/null; then
echo "CLI repo detected — running build verification..."
# Build
go build ./cmd/... 2>&1
if [ $? -ne 0 ]; then
echo "BUILD FAILED — fix compilation errors before proceeding"
# Do NOT proceed to Step 5
fi
# Vet
go vet ./cmd/... 2>&1
# Smoke test: run the binary with --help
BINARY=$(ls -t cmd/*/main.go | head -1 | xargs dirname | xargs basename)
if [ -f "bin/$BINARY" ]; then
./bin/$BINARY --help > /dev/null 2>&1
echo "Smoke test: $BINARY --help passed"
fi
fi
If build fails: Fix compilation errors and re-run before proceeding. Do NOT skip to verification with a broken build.
If not a CLI repo: This step is a no-op — proceed directly to Step 5.
Before proceeding to functional verification, check for common security issues in modified code:
| Check | What to Look For | Action |
|---|---|---|
| Input validation | User/external input used without validation | Add validation at entry points |
| Output escaping | Raw data in HTML/templates (innerHTML, document.write, dangerouslySetInnerHTML) | Use framework auto-escaping or explicit sanitization |
| Path safety | Path traversal via .. sequences; file paths from user input without sanitization | Reject .., absolute paths; use filepath.Clean() or equivalent; verify path stays within allowed directory |
| Auth gates | Endpoints/handlers missing authentication or authorization checks | Add middleware or guard clauses |
| Content-Type | HTTP responses without explicit Content-Type headers | Set Content-Type to prevent MIME-sniffing attacks |
Skip when: The change does not involve HTTP handlers, user-facing input, file system operations, or template rendering. Pure internal refactors, test-only changes, and documentation edits skip this step.
If issues found: Fix before proceeding to Step 5. Log fixes in the commit message.
Success Criteria (all must pass):
Check for test files and run them:
# Find tests
ls *test* tests/ test/ __tests__/ 2>/dev/null | head -5
# Run tests (adapt to project type)
# Python: pytest
# Go: go test ./...
# Node: npm test
# Rust: cargo test
If tests exist: All tests must pass. Any failure = verification failed.
If no tests exist: Manual verification required:
If verification fails: Do NOT proceed to Step 5a. Fix the issue first.
THE IRON LAW: NO COMPLETION CLAIMS WITHOUT FRESH VERIFICATION EVIDENCE
Before reporting success, you MUST:
Forbidden phrases without fresh verification evidence:
| Excuse | Reality |
|---|---|
| "Too simple to verify" | Simple code breaks. Verification takes 10 seconds. |
| "I just ran it" | Run it AGAIN. Fresh output only. |
| "Tests passed earlier" | Run them NOW. State changes. |
| "It's obvious it works" | Nothing is obvious. Evidence or silence. |
| "The edit looks correct" | Looking != working. Run the code. |
Store checkpoint:
bd update <issue-id> --append-notes "CHECKPOINT: Step 5a verification passed at $(date -Iseconds)" 2>/dev/null
When invoked by /crank with --test-first, the worker receives:
GREEN Mode Rules:
Verification (GREEN Mode):
Test Immutability Enforcement:
Before committing, run a fix-verify loop on all files modified in this session (max 3 iterations):
Iteration N:
git diff --name-only HEAD_ = err or empty catch blocks)Loop termination:
--force-commit allows proceeding with documented HIGHs (explicit opt-in only)Output: Record iteration count, findings per iteration, and remaining items.
If no modified files or sweep finds zero issues on first pass, proceed directly to Step 6.
If the change is complete and verified:
git add <modified-files>
git commit -m "<descriptive message>
Implements: <issue-id>"
bd update <issue-id> --status closed 2>/dev/null
After successful issue closure, record in ratchet:
# Check if ao CLI is available
if command -v ao &>/dev/null; then
# Get the commit hash as output artifact
COMMIT_HASH=$(git rev-parse HEAD 2>/dev/null || echo "")
CHANGED_FILES=$(git diff --name-only HEAD~1 2>/dev/null | tr '\n' ',' | sed 's/,$//')
if [ -n "$COMMIT_HASH" ]; then
# Record successful implementation
ao ratchet record implement \
--output "$COMMIT_HASH" \
--files "$CHANGED_FILES" \
--issue "<issue-id>" \
2>&1 | tee -a .agents/ratchet.log
if [ $? -eq 0 ]; then
echo "Ratchet: Implementation recorded (commit: ${COMMIT_HASH:0:8})"
else
echo "Ratchet: Failed to record - chain.jsonl may need repair"
fi
else
echo "Ratchet: No commit found - skipping record"
fi
else
echo "Ratchet: ao CLI not available - implementation NOT recorded"
echo " Run manually: ao ratchet record implement --output <commit>"
fi
On failure/blocker: Record the blocker in ratchet:
if command -v ao &>/dev/null; then
ao ratchet record implement \
--status blocked \
--reason "<blocker description>" \
2>/dev/null
fi
Fallback: If ao is not available, the issue is still closed via bd but won't be tracked in the ratchet chain. The skill continues normally.
After implementation is complete:
if command -v ao &>/dev/null; then
ao ratchet record implement --output "<issue-id>" 2>/dev/null || true
fi
Tell user: "Implementation complete. Run /vibe to validate before pushing."
Tell the user:
Output completion marker:
<promise>DONE</promise>
If blocked or incomplete:
<promise>BLOCKED</promise>
Reason: <why blocked>
<promise>PARTIAL</promise>
Remaining: <what's left>
--no-tdd)If bd CLI not available:
User says: /implement ag-5k2
What happens:
middleware/auth.go to add token validationgo test ./middleware/... — all tests passbd update ag-5k2 --status closedResult: Issue implemented, verified, committed, and closed. Ratchet recorded.
User says: /implement
What happens:
bd ready — finds ag-3b7 (first unblocked issue)bd update ag-3b7 --status in_progressResult: Autonomous work pickup and completion from ready queue.
User says: /implement ag-8h3 (invoked by /crank --test-first)
What happens:
Result: Minimal implementation driven by tests, no over-engineering.
| Problem | Cause | Solution |
|---|---|---|
| Issue not found | Issue ID doesn't exist or local state looks stale | Run bd show <id> to verify; use bd vc status only if you need Dolt state |
| GREEN mode violation | Edited a file not related to the issue scope | Revert unrelated changes. GREEN mode restricts edits to files relevant to the issue |
| Verification gate fails | Tests fail or build breaks after implementation | Read the verification output, fix the specific failures, re-run verification |
| "BLOCKED" status | Contract contradicts tests or is incomplete in GREEN mode | Write BLOCKED with specific reason, do NOT modify tests |
| Fresh verification missing | Agent claims success without running verification command | MUST run verification command fresh with full output before claiming completion |
| Ratchet record failed | ao CLI unavailable or chain.jsonl corrupted |
Weekly Installs
269
Repository
GitHub Stars
220
First Seen
Feb 2, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykPass
Installed on
opencode266
codex262
github-copilot261
gemini-cli261
amp259
kimi-cli259
agent-browser 浏览器自动化工具 - Vercel Labs 命令行网页操作与测试
140,500 周安装
| CORS | Overly permissive CORS configuration (* origin, credentials: true) | Restrict to known origins; never combine wildcard with credentials |
| CSRF tokens | State-changing endpoints (POST/PUT/DELETE) without anti-CSRF tokens | Add anti-CSRF token validation; do not rely solely on cookies for auth |
| Rate limiting | Authentication, API, and upload endpoints without rate limits | Add rate-limit middleware; return 429 with Retry-After header |
| Implementation still closes via bd, but ratchet chain needs manual repair |