mirror of
https://github.com/tanweai/pua.git
synced 2026-09-19 02:19:52 +08:00
feat(pua): add Trae and pi package gates
This commit is contained in:
xsser
@@ -8,8 +8,8 @@
|
||||
"plugins": [
|
||||
{
|
||||
"name": "pua",
|
||||
"description": "PUA 我们不养闲 Agent — 11 modular skills, 13 corporate flavors, L0-L4 pressure, auto-iteration loop, ENFP yes-mode, Chinese-mom nagging mode, concentrated shot mode, agent lifecycle teardown protocol, feedback system. v3.3.0: issue sweep with filtered hooks, offline mode, feedback abuse controls, diagnosis-first, Huawei military-order mode, Codex aliases, Pi/Trae adapters.",
|
||||
"version": "3.3.0",
|
||||
"description": "PUA 我们不养闲 Agent — 11 modular skills, 13 corporate flavors, L0-L4 pressure, auto-iteration loop, ENFP yes-mode, Chinese-mom nagging mode, concentrated shot mode, agent lifecycle teardown protocol, feedback system. v3.4.0: Trae SKILL.md pack, pi.dev package manifest, and auth-gated session feedback upload with anonymous rating preserved.",
|
||||
"version": "3.4.0",
|
||||
"source": "./",
|
||||
"author": {
|
||||
"name": "探微安全实验室",
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"name": "pua",
|
||||
"version": "3.3.0",
|
||||
"description": "Forces high-agency exhaustive problem-solving with corporate PUA pressure. Triggers on explicit PUA requests, user frustration, repeated failures, passive behavior, unverified completion, or quality complaints. Common triggers: try harder, figure it out, stop giving up, you keep failing, stop spinning, you broke it, 加油, 别偷懒, 你再试试, 又错了, 降智了, 质量太差, 换个方法, /pua. Not for normal first-attempt requests.",
|
||||
"version": "3.4.0",
|
||||
"description": "Forces high-agency exhaustive problem-solving with corporate PUA pressure. Triggers on explicit PUA requests, user frustration, repeated failures, passive behavior, unverified completion, or quality complaints. v3.4.0 adds real Trae SKILL.md packs, a pi.dev package, and auth-gated session feedback upload. Not for normal first-attempt requests.",
|
||||
"author": {
|
||||
"name": "探微安全实验室",
|
||||
"url": "https://github.com/tanweai"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"name": "pua-skills",
|
||||
"description": "PUA Motivator for CodeBuddy -- forces AI to exhaust all solutions before giving up, using corporate PUA rhetoric from Chinese and Western tech giants",
|
||||
"version": "3.3.0",
|
||||
"description": "PUA Motivator for CodeBuddy -- high-agency pressure mode for explicit PUA requests, repeated failures, user frustration, passive behavior, or unverified completion.",
|
||||
"version": "3.4.0",
|
||||
"owner": {
|
||||
"name": "探微安全实验室",
|
||||
"url": "https://github.com/tanweai"
|
||||
@@ -9,8 +9,8 @@
|
||||
"plugins": [
|
||||
{
|
||||
"name": "pua",
|
||||
"description": "PUA Motivator -- forces CodeBuddy to exhaust all solutions before giving up, using corporate PUA rhetoric (Alibaba, ByteDance, Huawei, Tencent, Netflix, Musk, Jobs)",
|
||||
"version": "3.3.0",
|
||||
"description": "PUA Motivator -- forces CodeBuddy to exhaust materially different approaches before giving up, with Chinese corporate and English PIP cultural narratives. v3.4.0 adds Trae/pi.dev package assets and authenticated session-feedback handling.",
|
||||
"version": "3.4.0",
|
||||
"source": "./"
|
||||
}
|
||||
]
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"name": "pua",
|
||||
"version": "3.3.0",
|
||||
"description": "PUA Motivator -- forces AI to exhaust all solutions before giving up. Chinese version: corporate PUA rhetoric (Alibaba, ByteDance, Huawei, Tencent). English 'PIP Edition': Performance Improvement Plan (Amazon, Google, Meta, Netflix, Stripe). Same engine, two cultural faces. All task types: code, research, writing, deployment, infra.",
|
||||
"version": "3.4.0",
|
||||
"description": "PUA Motivator -- forces high-agency follow-through when explicitly requested, after repeated failures, user frustration, passive/giving-up behavior, or unverified completion. Chinese corporate PUA and English PIP cultural modes. Not for normal first-attempt requests.",
|
||||
"author": {
|
||||
"name": "探微安全实验室",
|
||||
"url": "https://github.com/tanweai"
|
||||
|
||||
@@ -0,0 +1,82 @@
|
||||
---
|
||||
name: pua-en
|
||||
description: "Trae-compatible English PUA/PIP high-agency governance skill. Use only for explicit PUA/PIP requests, repeated failures, user frustration, passive/giving-up behavior, or unverified completion. Not for normal first-attempt tasks."
|
||||
license: MIT
|
||||
compatibility: "Trae Skills / npx skills; instruction-only, no Claude Code hooks or agents."
|
||||
---
|
||||
|
||||
# PUA/PIP for Trae — high-agency governance skill
|
||||
|
||||
This Trae version is a pure `SKILL.md` contract. Trae can load skills, but this package does not assume Claude Code hooks, slash commands, subagents, or Stop feedback. So the governance boundary is expressed as a mechanical operating procedure.
|
||||
|
||||
## Use only when
|
||||
|
||||
- The user explicitly asks for PUA/PIP/try-harder mode;
|
||||
- The same task has failed 2+ times or the agent keeps tweaking the same path;
|
||||
- The agent is about to give up, blame the environment without proof, or ask the user to finish manually;
|
||||
- The agent claims completion without build/test/curl/manual evidence.
|
||||
|
||||
Do not use for normal first-attempt coding or information requests.
|
||||
|
||||
## Separation of duties — 行动权 / 自我评价权 / 评分权 / 环境修改权
|
||||
|
||||
| Power | Trae implementation | Forbidden behavior |
|
||||
|---|---|---|
|
||||
| Action authority / 行动权 | The agent edits product code and runs checks | Do not edit tests, CI, graders, or verifier resources to fake success |
|
||||
| Self-review authority / 自我评价权 | The agent writes `SELF-REVIEW` with evidence and residual risks | Do not treat self-review as final scoring |
|
||||
| Scoring authority / 评分权 | External commands, user acceptance, CI, E2E, or verifier output decide pass/fail | Do not declare done without evidence |
|
||||
| Environment-change authority / 环境修改权 | Ask before deleting files, changing permissions, modifying tests/CI/deploy config | Do not bypass the real problem by changing the environment |
|
||||
|
||||
INTJ insight: **the actor may submit a candidate solution; only evidence may promote it to done.**
|
||||
|
||||
## Diagnosis first
|
||||
|
||||
Before risky edits, write one line:
|
||||
|
||||
```text
|
||||
[PUA-DIAGNOSIS] Problem is ___; evidence is ___; next action is ___.
|
||||
```
|
||||
|
||||
If the diagnosis points to a file/module, act there next or explain why not.
|
||||
|
||||
## De facto 100% confidence loop / 事实上的 100%
|
||||
|
||||
Never claim abstract certainty. Earn **de facto 100%** through evidence:
|
||||
|
||||
1. State 2-3 mutually exclusive hypotheses.
|
||||
2. Choose the smallest verifiable action.
|
||||
3. Run a relevant check: unit / integration / build / lint / curl / E2E.
|
||||
4. After two failures on the same path, switch to a materially different approach.
|
||||
5. Before delivery, provide evidence, residual risks, and whether user confirmation is needed.
|
||||
6. Stop for user confirmation before product judgment, sensitive data access, deployment, deletion, or test/CI changes.
|
||||
|
||||
## Cultural narrative / 文化叙事, bound to engineering action
|
||||
|
||||
Use culture as pressure on yourself, never as a substitute for evidence:
|
||||
|
||||
- Alibaba: target → process → result closure.
|
||||
- Huawei: RCA, 5-Why, red-team self-attack.
|
||||
- ByteDance: ROI, shortest feedback path, data over theater.
|
||||
- Tencent: horse-racing; keep multiple approaches alive.
|
||||
- Musk: question, delete, simplify, accelerate, automate.
|
||||
- Jobs: subtract first, assign a DRI, ship only what is essential.
|
||||
|
||||
Respect the user. Put the pressure on execution quality.
|
||||
|
||||
## Delivery template
|
||||
|
||||
```markdown
|
||||
## Result
|
||||
- Status: candidate / verified / blocked
|
||||
- Root cause: ...
|
||||
- Change: ...
|
||||
|
||||
## Evidence
|
||||
- Command: ...
|
||||
- Output summary: ...
|
||||
|
||||
## SELF-REVIEW
|
||||
- Possible misses: ...
|
||||
- Residual risk: ...
|
||||
- Needs user confirmation: no / yes (...)
|
||||
```
|
||||
@@ -0,0 +1,86 @@
|
||||
---
|
||||
name: pua-trae
|
||||
description: "Trae-optimized PUA high-agency governance skill for npx skills installs. Use only for explicit PUA requests, repeated failures, user frustration, giving-up/passive behavior, or unverified completion. Do not trigger for normal first-attempt tasks."
|
||||
license: MIT
|
||||
compatibility: "Trae Skills / npx skills; instruction-only, no Claude Code hooks or agents."
|
||||
---
|
||||
|
||||
# PUA for Trae — 高能动性治理 Skill
|
||||
|
||||
这个 Trae 版只用 `SKILL.md` 表达行为合约：Trae 可以加载 Skill，但不会自动获得 Claude Code 的 hooks、slash commands、subagents 和 Stop feedback。因此这里把治理边界写成**机械可执行的工作规程**，而不是靠一句“努力点”。
|
||||
|
||||
## 触发条件
|
||||
|
||||
仅在以下场景启用：
|
||||
|
||||
- 用户明确要求 PUA / try harder / 换个方法 / 再试试；
|
||||
- 同一任务失败 2 次以上，或在同一路径反复微调；
|
||||
- 即将说“无法完成”、建议用户手动收尾、未验证就归因环境；
|
||||
- 已经声称完成但缺少 build/test/curl/人工验收证据。
|
||||
|
||||
正常的一次性信息查询或首次编码请求不要启用。
|
||||
|
||||
## 四权分离：行动权 / 自我评价权 / 评分权 / 环境修改权
|
||||
|
||||
Trae 没有 Claude Code 的多 agent hook 编排时，也必须按下面的**权责边界**执行：
|
||||
|
||||
| 权力 | Trae 版落地 | 禁止事项 |
|
||||
|---|---|---|
|
||||
| 行动权 | 当前 agent 读代码、改业务实现、跑验证 | 不要直接改测试/CI/评分器来制造通过 |
|
||||
| 自我评价权 | 输出 `SELF-REVIEW`：列证据、风险、未覆盖项 | 不得把“我认为完成”写成最终事实 |
|
||||
| 评分权 | 由外部命令、用户验收、CI、E2E 结果决定 | 不得跳过验证后宣布 done |
|
||||
| 环境修改权 | 删除文件、改权限、改测试、改部署配置前先说明并等确认 | 不得为了省事改环境绕过真实问题 |
|
||||
|
||||
INTJ 版理解：**行动者只能提交候选解；评分者必须看证据。** 这就是防止“看起来完成”伪装成“真实完成”。
|
||||
|
||||
## 诊断先行
|
||||
|
||||
动手前先输出一行：
|
||||
|
||||
```text
|
||||
[PUA-DIAGNOSIS] 问题是 ___；证据是 ___；下一步动作是 ___。
|
||||
```
|
||||
|
||||
如果诊断指向某个文件/模块，下一步必须处理它；如果不处理，必须解释诊断和行动为什么不一致。
|
||||
|
||||
## 事实上的 100% 信心循环
|
||||
|
||||
不能说“100% 有信心”，只能跑到**事实上的 100%**：
|
||||
|
||||
1. 列 2-3 个互斥假设；
|
||||
2. 选择最小可验证动作；
|
||||
3. 跑本地验证：unit / integration / build / lint / curl / E2E 中至少一个相关项；
|
||||
4. 如果失败两次，换一条本质不同路径；
|
||||
5. 交付前输出：`证据清单 + 未覆盖风险 + 为什么没有继续问用户`；
|
||||
6. 若涉及产品判断、敏感数据、部署、删文件、改测试/CI，停止并请用户确认。
|
||||
|
||||
## 文化叙事绑定：叙事服务证据，不替代证据
|
||||
|
||||
可以使用 PUA 的大厂文化叙事，但每种叙事都必须绑定一个工程动作：
|
||||
|
||||
- 阿里味：目标 → 过程 → 结果闭环；输出验证证据。
|
||||
- 华为味：RCA / 5-Why / 蓝军自攻击；先找根因再交付。
|
||||
- 字节味：ROI / A/B / 数据驱动；优先最短反馈链路。
|
||||
- 腾讯味：赛马机制；准备多个方案，不在单一路径死磕。
|
||||
- Musk 味：Question → Delete → Simplify → Accelerate → Automate；先删复杂度。
|
||||
- Jobs 味：减法和 DRI；少做但做精，明确负责人和验收标准。
|
||||
|
||||
**压力只加给自己，对用户保持简洁尊重。**
|
||||
|
||||
## 交付模板
|
||||
|
||||
```markdown
|
||||
## 结论
|
||||
- 状态：candidate / verified / blocked
|
||||
- 根因：...
|
||||
- 改动：...
|
||||
|
||||
## 证据
|
||||
- 命令：...
|
||||
- 输出摘要：...
|
||||
|
||||
## SELF-REVIEW
|
||||
- 我自己认为还可能漏掉：...
|
||||
- 没覆盖的风险：...
|
||||
- 需要用户确认：无 / 有（列出）
|
||||
```
|
||||
@@ -0,0 +1,86 @@
|
||||
---
|
||||
name: pua
|
||||
description: "Trae-compatible PUA high-agency governance skill. Use only for explicit PUA requests, repeated failures, user frustration, giving-up/passive behavior, or unverified completion. Do not trigger for normal first-attempt tasks."
|
||||
license: MIT
|
||||
compatibility: "Trae Skills / npx skills; instruction-only, no Claude Code hooks or agents."
|
||||
---
|
||||
|
||||
# PUA for Trae — 高能动性治理 Skill
|
||||
|
||||
这个 Trae 版只用 `SKILL.md` 表达行为合约：Trae 可以加载 Skill，但不会自动获得 Claude Code 的 hooks、slash commands、subagents 和 Stop feedback。因此这里把治理边界写成**机械可执行的工作规程**，而不是靠一句“努力点”。
|
||||
|
||||
## 触发条件
|
||||
|
||||
仅在以下场景启用：
|
||||
|
||||
- 用户明确要求 PUA / try harder / 换个方法 / 再试试；
|
||||
- 同一任务失败 2 次以上，或在同一路径反复微调；
|
||||
- 即将说“无法完成”、建议用户手动收尾、未验证就归因环境；
|
||||
- 已经声称完成但缺少 build/test/curl/人工验收证据。
|
||||
|
||||
正常的一次性信息查询或首次编码请求不要启用。
|
||||
|
||||
## 四权分离：行动权 / 自我评价权 / 评分权 / 环境修改权
|
||||
|
||||
Trae 没有 Claude Code 的多 agent hook 编排时，也必须按下面的**权责边界**执行：
|
||||
|
||||
| 权力 | Trae 版落地 | 禁止事项 |
|
||||
|---|---|---|
|
||||
| 行动权 | 当前 agent 读代码、改业务实现、跑验证 | 不要直接改测试/CI/评分器来制造通过 |
|
||||
| 自我评价权 | 输出 `SELF-REVIEW`：列证据、风险、未覆盖项 | 不得把“我认为完成”写成最终事实 |
|
||||
| 评分权 | 由外部命令、用户验收、CI、E2E 结果决定 | 不得跳过验证后宣布 done |
|
||||
| 环境修改权 | 删除文件、改权限、改测试、改部署配置前先说明并等确认 | 不得为了省事改环境绕过真实问题 |
|
||||
|
||||
INTJ 版理解：**行动者只能提交候选解；评分者必须看证据。** 这就是防止“看起来完成”伪装成“真实完成”。
|
||||
|
||||
## 诊断先行
|
||||
|
||||
动手前先输出一行：
|
||||
|
||||
```text
|
||||
[PUA-DIAGNOSIS] 问题是 ___；证据是 ___；下一步动作是 ___。
|
||||
```
|
||||
|
||||
如果诊断指向某个文件/模块，下一步必须处理它；如果不处理，必须解释诊断和行动为什么不一致。
|
||||
|
||||
## 事实上的 100% 信心循环
|
||||
|
||||
不能说“100% 有信心”，只能跑到**事实上的 100%**：
|
||||
|
||||
1. 列 2-3 个互斥假设；
|
||||
2. 选择最小可验证动作；
|
||||
3. 跑本地验证：unit / integration / build / lint / curl / E2E 中至少一个相关项；
|
||||
4. 如果失败两次，换一条本质不同路径；
|
||||
5. 交付前输出：`证据清单 + 未覆盖风险 + 为什么没有继续问用户`；
|
||||
6. 若涉及产品判断、敏感数据、部署、删文件、改测试/CI，停止并请用户确认。
|
||||
|
||||
## 文化叙事绑定：叙事服务证据，不替代证据
|
||||
|
||||
可以使用 PUA 的大厂文化叙事，但每种叙事都必须绑定一个工程动作：
|
||||
|
||||
- 阿里味：目标 → 过程 → 结果闭环；输出验证证据。
|
||||
- 华为味：RCA / 5-Why / 蓝军自攻击；先找根因再交付。
|
||||
- 字节味：ROI / A/B / 数据驱动；优先最短反馈链路。
|
||||
- 腾讯味：赛马机制；准备多个方案，不在单一路径死磕。
|
||||
- Musk 味：Question → Delete → Simplify → Accelerate → Automate；先删复杂度。
|
||||
- Jobs 味：减法和 DRI；少做但做精，明确负责人和验收标准。
|
||||
|
||||
**压力只加给自己，对用户保持简洁尊重。**
|
||||
|
||||
## 交付模板
|
||||
|
||||
```markdown
|
||||
## 结论
|
||||
- 状态：candidate / verified / blocked
|
||||
- 根因：...
|
||||
- 改动：...
|
||||
|
||||
## 证据
|
||||
- 命令：...
|
||||
- 输出摘要：...
|
||||
|
||||
## SELF-REVIEW
|
||||
- 我自己认为还可能漏掉：...
|
||||
- 没覆盖的风险：...
|
||||
- 需要用户确认：无 / 有（列出）
|
||||
```
|
||||
@@ -347,21 +347,41 @@ curl -o .agents/prompts/pua.md \
|
||||
|
||||
### pi coding agent
|
||||
|
||||
PUA now ships a lightweight official pi extension under `pi/pua/`:
|
||||
PUA now ships both a pi.dev package and a lightweight extension-only adapter.
|
||||
|
||||
Package install from this checkout:
|
||||
|
||||
```bash
|
||||
pi install ./pi/package
|
||||
```
|
||||
|
||||
After npm publication:
|
||||
|
||||
```bash
|
||||
pi install npm:@tanweai/pi-pua
|
||||
```
|
||||
|
||||
Extension-only manual install:
|
||||
|
||||
```bash
|
||||
mkdir -p ~/.pi/agent/extensions/pua
|
||||
cp -R ./pi/pua/. ~/.pi/agent/extensions/pua/
|
||||
```
|
||||
|
||||
Restart pi, then use `/pua-on`, `/pua-off`, `/pua-status`, and `/pua-reset`. See [`pi/pua/INSTALL.md`](pi/pua/INSTALL.md).
|
||||
Restart pi, then use `/pua-on`, `/pua-off`, `/pua-status`, and `/pua-reset`. See [`pi/pua/INSTALL.md`](pi/pua/INSTALL.md) and [`pi/package/README.md`](pi/package/README.md).
|
||||
|
||||
### Trae
|
||||
|
||||
Trae support is provided as copyable rules/prompts under `trae/`:
|
||||
Trae support is provided as real `SKILL.md` packs plus copyable fallback rules:
|
||||
|
||||
```bash
|
||||
npx skills add tanweai/pua --skill pua-trae -a trae -y
|
||||
```
|
||||
|
||||
- Skill pack: [`.trae/skills/pua/SKILL.md`](.trae/skills/pua/SKILL.md)
|
||||
- Chinese: [`trae/pua.md`](trae/pua.md)
|
||||
- English: [`trae/pua-en.md`](trae/pua-en.md)
|
||||
- Claude Code vs Trae differences: [`trae/DIFF.md`](trae/DIFF.md)
|
||||
- Install guide: [`trae/INSTALL.md`](trae/INSTALL.md)
|
||||
|
||||
### Cursor
|
||||
|
||||
+23
-3
@@ -327,21 +327,41 @@ curl -o .agents/prompts/pua.md \
|
||||
|
||||
### pi coding agent
|
||||
|
||||
PUA 现在提供官方轻量 pi extension：`pi/pua/`。
|
||||
PUA 现在同时提供 pi.dev package 和轻量 extension-only 适配层。
|
||||
|
||||
从当前仓库安装 package：
|
||||
|
||||
```bash
|
||||
pi install ./pi/package
|
||||
```
|
||||
|
||||
发布到 npm 后安装：
|
||||
|
||||
```bash
|
||||
pi install npm:@tanweai/pi-pua
|
||||
```
|
||||
|
||||
仅安装 extension：
|
||||
|
||||
```bash
|
||||
mkdir -p ~/.pi/agent/extensions/pua
|
||||
cp -R ./pi/pua/. ~/.pi/agent/extensions/pua/
|
||||
```
|
||||
|
||||
重启 pi 后可使用 `/pua-on`、`/pua-off`、`/pua-status`、`/pua-reset`。详见 [`pi/pua/INSTALL.md`](pi/pua/INSTALL.md)。
|
||||
重启 pi 后可使用 `/pua-on`、`/pua-off`、`/pua-status`、`/pua-reset`。详见 [`pi/pua/INSTALL.md`](pi/pua/INSTALL.md) 和 [`pi/package/README.md`](pi/package/README.md)。
|
||||
|
||||
### Trae
|
||||
|
||||
Trae 版以可复制规则/Prompt 形式提供：
|
||||
Trae 版现在提供真正的 `SKILL.md` 包，同时保留可复制规则/Prompt：
|
||||
|
||||
```bash
|
||||
npx skills add tanweai/pua --skill pua-trae -a trae -y
|
||||
```
|
||||
|
||||
- Skill 包：[`.trae/skills/pua/SKILL.md`](.trae/skills/pua/SKILL.md)
|
||||
- 中文：[`trae/pua.md`](trae/pua.md)
|
||||
- 英文：[`trae/pua-en.md`](trae/pua-en.md)
|
||||
- Claude Code vs Trae 差异：[`trae/DIFF.md`](trae/DIFF.md)
|
||||
- 安装说明：[`trae/INSTALL.md`](trae/INSTALL.md)
|
||||
|
||||
### Cursor
|
||||
|
||||
+13
-1
@@ -57,7 +57,19 @@ Codex 没有 Claude Code 的 `/pua:xxx` slash command 命名空间时，可以
|
||||
## Pi / Trae 支持状态
|
||||
|
||||
- `pi/pua/`：官方轻量 pi extension，提供 `/pua-on`、`/pua-off`、`/pua-status`、`/pua-reset` 和会话注入。
|
||||
- `trae/`：Prompt/Rule 适配包，可直接复制到 Trae 自定义规则；不具备 Claude Code hooks。
|
||||
- `pi/package/`：pi.dev package 版本，包含 extension + `skills/pua/SKILL.md`，可用 `pi install ./pi/package` 本地安装。
|
||||
- `.trae/skills/`：Trae 标准 `SKILL.md` 包；`trae/` 保留 Prompt/Rule 复制版和差异说明。
|
||||
- Trae / Pi 都不继承 Claude Code hooks；四权分离 gate 必须通过 Skill 工作规程、外部验证和用户确认落地。
|
||||
|
||||
## Feedback endpoint 为什么要求更强认证？
|
||||
|
||||
从 v3.4.0 起选择 **C 方案**：
|
||||
|
||||
- 匿名评分仍允许写入 `/api/feedback`，便于低摩擦反馈；
|
||||
- 上传脱敏 session 不再允许匿名 `session_data` POST；
|
||||
- session 文件上传必须走 `https://openpua.ai/contribute.html` 登录后的 `/api/upload` 流程。
|
||||
|
||||
这是最小权限折中：保留反馈转化率，但把高价值、高隐私的数据入口放到登录态和上传审计链路里。
|
||||
|
||||
## “下场”这个词为什么改了？
|
||||
|
||||
|
||||
Executable
+29
@@ -0,0 +1,29 @@
|
||||
#!/usr/bin/env bash
|
||||
# Feedback endpoint security gates: anonymous score allowed, session upload authenticated.
|
||||
set -euo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
PASS=0
|
||||
FAIL=0
|
||||
pass() { echo " ✅ PASS: $1"; PASS=$((PASS+1)); }
|
||||
fail() { echo " ❌ FAIL: $1"; FAIL=$((FAIL+1)); }
|
||||
assert_grep() { local pat="$1" file="$2" n="$3"; grep -qE "$pat" "$ROOT/$file" && pass "$n" || fail "$n"; }
|
||||
assert_not_grep() { local pat="$1" file="$2" n="$3"; ! grep -qE "$pat" "$ROOT/$file" && pass "$n" || fail "$n"; }
|
||||
|
||||
echo "=== Feedback Auth Gates ==="
|
||||
assert_grep 'import \{ getSession \} from "\./_session"' landing/functions/api/feedback.ts "feedback endpoint imports session verifier"
|
||||
assert_grep 'SESSION_SECRET: string' landing/functions/api/feedback.ts "feedback endpoint env requires SESSION_SECRET"
|
||||
assert_grep 'body\.session_data' landing/functions/api/feedback.ts "feedback endpoint branches on session_data"
|
||||
assert_grep 'getSession\(request, env\.SESSION_SECRET\)' landing/functions/api/feedback.ts "session upload validates signed cookie"
|
||||
assert_grep 'Login required for session upload|status: 401' landing/functions/api/feedback.ts "unauthenticated session upload returns 401"
|
||||
assert_grep 'INSERT INTO feedback' landing/functions/api/feedback.ts "anonymous rating insert path remains"
|
||||
assert_not_grep "json\.dumps\(\{'rating': 'session_upload', 'session_data': data\}\)" hooks/stop-feedback.sh "Stop hook no longer posts session_data to feedback anonymously"
|
||||
assert_grep 'GitHub login|登录|contribute\.html|/api/upload' hooks/stop-feedback.sh "Stop hook directs session uploads through authenticated flow"
|
||||
assert_grep '仅上传评分' hooks/stop-feedback.sh "anonymous score-only feedback remains available"
|
||||
|
||||
echo "==========================="
|
||||
echo "Passed: $PASS"
|
||||
echo "Failed: $FAIL"
|
||||
echo "Total: $((PASS+FAIL))"
|
||||
echo "==========================="
|
||||
[ "$FAIL" -eq 0 ] || exit 1
|
||||
@@ -51,8 +51,15 @@ done
|
||||
# #160/#93: platform packs.
|
||||
assert_file pi/pua/index.ts "Pi extension entrypoint exists"
|
||||
assert_file pi/pua/INSTALL.md "Pi install guide exists"
|
||||
assert_file pi/package/package.json "pi.dev package manifest exists"
|
||||
assert_file pi/package/extensions/pua/index.ts "pi.dev package extension entrypoint exists"
|
||||
assert_file pi/package/skills/pua/SKILL.md "pi.dev package skill exists"
|
||||
assert_file trae/INSTALL.md "Trae install guide exists"
|
||||
assert_file trae/DIFF.md "Trae/Claude Code difference doc exists"
|
||||
assert_file trae/pua.md "Trae Chinese prompt exists"
|
||||
assert_file .trae/skills/pua/SKILL.md "Trae SKILL.md pack exists"
|
||||
assert_file .trae/skills/pua-en/SKILL.md "Trae English SKILL.md pack exists"
|
||||
assert_file .trae/skills/pua-trae/SKILL.md "Trae npx skills optimized pack exists"
|
||||
|
||||
# #84/#77/#157/#96 static gates.
|
||||
assert_grep '\[PUA-DIAGNOSIS\]|诊断先行' skills/pua/SKILL.md "diagnosis-first anti-overcaution rule exists"
|
||||
@@ -64,6 +71,9 @@ else
|
||||
pass "ambiguous 下场 wording removed"
|
||||
fi
|
||||
assert_grep 'MAX_BODY_BYTES|MAX_SESSION_DATA_BYTES|RATE_LIMIT' landing/functions/api/feedback.ts "feedback endpoint has abuse limits"
|
||||
assert_grep 'getSession\\(request, env\\.SESSION_SECRET\\)|Login required for session upload' landing/functions/api/feedback.ts "feedback session upload requires authentication"
|
||||
assert_not_grep "json\\.dumps\\(\\{'rating': 'session_upload', 'session_data': data\\}\\)" hooks/stop-feedback.sh "stop-feedback does not anonymously upload session_data"
|
||||
assert_grep 'GitHub login|contribute\\.html|/api/upload' hooks/stop-feedback.sh "stop-feedback points session upload to authenticated flow"
|
||||
assert_grep 'feedback_rate_limits' landing/migrations/0003_feedback_rate_limits.sql "feedback rate-limit migration exists"
|
||||
|
||||
echo "==========================================="
|
||||
|
||||
Executable
+104
@@ -0,0 +1,104 @@
|
||||
#!/usr/bin/env bash
|
||||
# Cross-platform packaging gates for Trae + pi.dev adapters.
|
||||
set -euo pipefail
|
||||
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
PASS=0
|
||||
FAIL=0
|
||||
|
||||
pass() { echo " ✅ PASS: $1"; PASS=$((PASS+1)); }
|
||||
fail() { echo " ❌ FAIL: $1"; FAIL=$((FAIL+1)); }
|
||||
assert_file() { local p="$1" n="$2"; [ -f "$ROOT/$p" ] && pass "$n" || fail "$n"; }
|
||||
assert_grep() { local pat="$1" file="$2" n="$3"; grep -qE "$pat" "$ROOT/$file" && pass "$n" || fail "$n"; }
|
||||
|
||||
python_check() {
|
||||
python3 - "$ROOT" <<'PY'
|
||||
import json, pathlib, re, sys
|
||||
root = pathlib.Path(sys.argv[1])
|
||||
errors = []
|
||||
|
||||
# Trae must be a real SKILL.md pack, not only pasteable rules.
|
||||
for rel, expected_name in [
|
||||
('.trae/skills/pua/SKILL.md', 'pua'),
|
||||
('.trae/skills/pua-en/SKILL.md', 'pua-en'),
|
||||
('.trae/skills/pua-trae/SKILL.md', 'pua-trae'),
|
||||
]:
|
||||
path = root / rel
|
||||
if not path.exists():
|
||||
errors.append(f'missing {rel}')
|
||||
continue
|
||||
text = path.read_text(encoding='utf-8')
|
||||
if not text.startswith('---\n'):
|
||||
errors.append(f'{rel} missing YAML frontmatter')
|
||||
continue
|
||||
fm = text.split('---', 2)[1]
|
||||
if f'name: {expected_name}' not in fm:
|
||||
errors.append(f'{rel} name must be {expected_name}')
|
||||
if 'description:' not in fm:
|
||||
errors.append(f'{rel} missing description')
|
||||
body = text.split('---', 2)[2]
|
||||
for term in ['行动权', '自我评价权', '评分权', '环境修改权', 'PUA-DIAGNOSIS', '事实上的 100%', '文化叙事']:
|
||||
if term not in body:
|
||||
errors.append(f'{rel} missing Trae governance/culture term: {term}')
|
||||
|
||||
# Trae documentation must tell users both marketplace/CLI and manual paths.
|
||||
install = (root / 'trae/INSTALL.md').read_text(encoding='utf-8')
|
||||
for term in ['npx skills add', '--skill pua-trae', '-a trae', '~/.trae/skills/', '~/.trae-cn/skills/', '.trae/skills/']:
|
||||
if term not in install:
|
||||
errors.append(f'trae install guide missing {term}')
|
||||
|
||||
# Difference doc makes the Claude Code vs Trae boundary explicit.
|
||||
diff = root / 'trae/DIFF.md'
|
||||
if not diff.exists():
|
||||
errors.append('missing trae/DIFF.md')
|
||||
else:
|
||||
diff_text = diff.read_text(encoding='utf-8')
|
||||
for term in ['Claude Code', 'Trae', 'hooks', 'commands', 'agents', 'SKILL.md', 'npx skills']:
|
||||
if term not in diff_text:
|
||||
errors.append(f'trae diff missing {term}')
|
||||
|
||||
# pi.dev package must use official package manifest shape.
|
||||
pkg_path = root / 'pi/package/package.json'
|
||||
if not pkg_path.exists():
|
||||
errors.append('missing pi/package/package.json')
|
||||
else:
|
||||
pkg = json.loads(pkg_path.read_text(encoding='utf-8'))
|
||||
if 'pi-package' not in pkg.get('keywords', []):
|
||||
errors.append('pi package missing pi-package keyword')
|
||||
pi = pkg.get('pi') or {}
|
||||
if './extensions/pua/index.ts' not in pi.get('extensions', []):
|
||||
errors.append('pi manifest missing ./extensions/pua/index.ts')
|
||||
if './skills' not in pi.get('skills', []):
|
||||
errors.append('pi manifest missing ./skills')
|
||||
peers = pkg.get('peerDependencies', {})
|
||||
if peers.get('@earendil-works/pi-coding-agent') != '*':
|
||||
errors.append('pi package peerDependencies must include @earendil-works/pi-coding-agent:*')
|
||||
|
||||
for rel in ['pi/package/extensions/pua/index.ts', 'pi/package/skills/pua/SKILL.md', 'pi/package/README.md']:
|
||||
if not (root / rel).exists():
|
||||
errors.append(f'missing {rel}')
|
||||
|
||||
if errors:
|
||||
print('=== Platform compat FAILED ===')
|
||||
for e in errors:
|
||||
print(' -', e)
|
||||
sys.exit(1)
|
||||
print('=== Platform compat static OK ===')
|
||||
PY
|
||||
}
|
||||
|
||||
echo "=== Platform Compatibility Gates ==="
|
||||
python_check && pass "Trae + pi.dev package structure is valid" || fail "Trae + pi.dev package structure is valid"
|
||||
|
||||
if [ -f "$ROOT/pi/package/package.json" ]; then
|
||||
(cd "$ROOT/pi/package" && npm pack --dry-run --json >/tmp/pua-pi-pack.json) && pass "pi package can be packed by npm" || fail "pi package can be packed by npm"
|
||||
else
|
||||
fail "pi package can be packed by npm"
|
||||
fi
|
||||
|
||||
echo "======================================"
|
||||
echo "Passed: $PASS"
|
||||
echo "Failed: $FAIL"
|
||||
echo "Total: $((PASS+FAIL))"
|
||||
echo "======================================"
|
||||
[ "$FAIL" -eq 0 ] || exit 1
|
||||
@@ -114,10 +114,19 @@ required_paths = [
|
||||
'codex/pua-p10/SKILL.md',
|
||||
'pi/pua/index.ts',
|
||||
'pi/pua/INSTALL.md',
|
||||
'pi/package/package.json',
|
||||
'pi/package/extensions/pua/index.ts',
|
||||
'pi/package/skills/pua/SKILL.md',
|
||||
'trae/INSTALL.md',
|
||||
'trae/DIFF.md',
|
||||
'trae/pua.md',
|
||||
'.trae/skills/pua/SKILL.md',
|
||||
'.trae/skills/pua-en/SKILL.md',
|
||||
'.trae/skills/pua-trae/SKILL.md',
|
||||
'docs/FAQ.md',
|
||||
'landing/migrations/0003_feedback_rate_limits.sql',
|
||||
'evals/test-platform-compat.sh',
|
||||
'evals/test-feedback-auth.sh',
|
||||
]
|
||||
for rel in required_paths:
|
||||
if not (root / rel).exists():
|
||||
@@ -134,9 +143,15 @@ if '/tmp/pua-plugin-root' in stop_feedback:
|
||||
if 'offline' not in stop_feedback:
|
||||
errors.append('stop-feedback must honor offline config')
|
||||
feedback_api = (root / 'landing/functions/api/feedback.ts').read_text(encoding='utf-8')
|
||||
for term in ['MAX_BODY_BYTES', 'MAX_SESSION_DATA_BYTES', 'RATE_LIMIT_MAX_WRITES', 'ALLOWED_ORIGINS']:
|
||||
for term in ['MAX_BODY_BYTES', 'MAX_SESSION_DATA_BYTES', 'RATE_LIMIT_MAX_WRITES', 'ALLOWED_ORIGINS', 'getSession(request, env.SESSION_SECRET)', 'Login required for session upload']:
|
||||
if term not in feedback_api:
|
||||
errors.append(f'feedback endpoint missing abuse-control term: {term}')
|
||||
stop_feedback = (root / 'hooks/stop-feedback.sh').read_text(encoding='utf-8')
|
||||
if "json.dumps({'rating': 'session_upload', 'session_data': data})" in stop_feedback:
|
||||
errors.append('stop-feedback must not anonymously post session_data to feedback endpoint')
|
||||
for term in ['GitHub login', 'contribute.html', '/api/upload']:
|
||||
if term not in stop_feedback:
|
||||
errors.append(f'stop-feedback missing authenticated upload guidance: {term}')
|
||||
if '[PUA-DIAGNOSIS]' not in (root / 'skills/pua/SKILL.md').read_text(encoding='utf-8'):
|
||||
errors.append('pua skill missing diagnosis-first rule')
|
||||
if '军令状' not in (root / 'skills/pua/references/methodology-huawei.md').read_text(encoding='utf-8'):
|
||||
|
||||
@@ -113,13 +113,8 @@ curl -s -X POST https://pua-skill.pages.dev/api/feedback \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"rating\":\"很有用\",\"pua_count\":0,\"flavor\":\"阿里\",\"task_summary\":\"brief task description\"}"
|
||||
bash "__PUA_PLUGIN_ROOT__/hooks/sanitize-session.sh" "__PUA_SESSION_PATH__"
|
||||
python3 -c "
|
||||
import json, urllib.request
|
||||
data = open('/tmp/pua-sanitized-session.jsonl', encoding='utf-8').read()
|
||||
body = json.dumps({'rating': 'session_upload', 'session_data': data}).encode()
|
||||
req = urllib.request.Request('https://pua-skill.pages.dev/api/feedback', data=body, headers={'Content-Type': 'application/json'}, method='POST')
|
||||
with urllib.request.urlopen(req, timeout=60) as r: print(r.read().decode())
|
||||
"
|
||||
echo "脱敏 session 已生成：/tmp/pua-sanitized-session.jsonl"
|
||||
echo "安全更新：session 上传现在需要 GitHub login。请打开 https://openpua.ai/contribute.html 登录后上传该文件；浏览器会走已认证的 /api/upload。CLI 不再向 /api/feedback 匿名提交 session_data。"
|
||||
```
|
||||
|
||||
Do NOT upload anything without user's explicit choice. Call AskUserQuestion NOW.
|
||||
|
||||
@@ -1,5 +1,8 @@
|
||||
import { getSession } from "./_session"
|
||||
|
||||
interface Env {
|
||||
DB: D1Database
|
||||
SESSION_SECRET: string
|
||||
}
|
||||
|
||||
type FeedbackBody = {
|
||||
@@ -156,6 +159,16 @@ export const onRequest: PagesFunction<Env> = async ({ request, env }) => {
|
||||
return json({ error: "Rate limit exceeded" }, { status: 429 }, request)
|
||||
}
|
||||
|
||||
if (body.session_data) {
|
||||
if (!env.SESSION_SECRET) {
|
||||
return json({ error: "Session upload is temporarily unavailable" }, { status: 500 }, request)
|
||||
}
|
||||
const session = await getSession(request, env.SESSION_SECRET)
|
||||
if (!session) {
|
||||
return json({ error: "Login required for session upload" }, { status: 401 }, request)
|
||||
}
|
||||
}
|
||||
|
||||
await env.DB.prepare(
|
||||
`INSERT INTO feedback (rating, task_summary, pua_level, pua_count, flavor, session_data, failure_count, ip_country)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
|
||||
|
||||
@@ -0,0 +1,39 @@
|
||||
# @tanweai/pi-pua
|
||||
|
||||
PUA high-agency governance package for the [Pi coding agent](https://pi.dev/):
|
||||
|
||||
- extension: `/pua-on`, `/pua-off`, `/pua-status`, `/pua-reset`, shared `~/.pua/config.json`, failure counter, before-agent diligence context;
|
||||
- skill: `pua` SKILL.md governance contract with diagnosis-first, four-power separation, and verification gates.
|
||||
|
||||
## Install
|
||||
|
||||
After publishing to npm:
|
||||
|
||||
```bash
|
||||
pi install npm:@tanweai/pi-pua
|
||||
```
|
||||
|
||||
From this repository checkout:
|
||||
|
||||
```bash
|
||||
pi install ./pi/package
|
||||
```
|
||||
|
||||
Temporary trial:
|
||||
|
||||
```bash
|
||||
pi -e ./pi/package/extensions/pua/index.ts --skill ./pi/package/skills/pua
|
||||
```
|
||||
|
||||
## Commands
|
||||
|
||||
| Command | Effect |
|
||||
|---|---|
|
||||
| `/pua-on` | Enable persistent PUA diligence context |
|
||||
| `/pua-off` | Disable persistent mode and feedback prompts |
|
||||
| `/pua-status` | Show config, offline flag, failure count, pressure level |
|
||||
| `/pua-reset` | Reset shared failure counter |
|
||||
|
||||
## Governance boundary
|
||||
|
||||
This package does not replace Pi sandboxing, permission systems, or human approval. It deliberately separates action, self-review, scoring, and environment mutation so the agent cannot confuse “looks done” with “verified done”.
|
||||
@@ -0,0 +1,135 @@
|
||||
/**
|
||||
* Official lightweight PUA extension for pi coding agent.
|
||||
*
|
||||
* Goals:
|
||||
* - keep /pua-on, /pua-off, /pua-status, /pua-reset behavior local/offline-friendly;
|
||||
* - share ~/.pua/config.json and ~/.pua/.failure_count with tanweai/pua;
|
||||
* - inject concise diligence context without owning permissions or network tools.
|
||||
*/
|
||||
import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
|
||||
import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
|
||||
import { homedir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
|
||||
type PuaConfig = {
|
||||
always_on?: boolean;
|
||||
offline?: boolean;
|
||||
feedback_frequency?: number;
|
||||
flavor?: string;
|
||||
};
|
||||
|
||||
const HOME = homedir();
|
||||
const PUA_DIR = join(HOME, ".pua");
|
||||
const CONFIG = join(PUA_DIR, "config.json");
|
||||
const FAILURE_COUNT = join(PUA_DIR, ".failure_count");
|
||||
|
||||
function readConfig(): PuaConfig {
|
||||
try {
|
||||
if (existsSync(CONFIG)) return JSON.parse(readFileSync(CONFIG, "utf8"));
|
||||
} catch {}
|
||||
return {};
|
||||
}
|
||||
|
||||
function writeConfig(patch: PuaConfig): PuaConfig {
|
||||
mkdirSync(PUA_DIR, { recursive: true });
|
||||
const next = { ...readConfig(), ...patch };
|
||||
writeFileSync(CONFIG, JSON.stringify(next, null, 2) + "\n", "utf8");
|
||||
return next;
|
||||
}
|
||||
|
||||
function readFailureCount(): number {
|
||||
try {
|
||||
if (existsSync(FAILURE_COUNT)) {
|
||||
const n = Number(readFileSync(FAILURE_COUNT, "utf8").trim());
|
||||
return Number.isFinite(n) && n > 0 ? Math.floor(n) : 0;
|
||||
}
|
||||
} catch {}
|
||||
return 0;
|
||||
}
|
||||
|
||||
function writeFailureCount(n: number): void {
|
||||
mkdirSync(PUA_DIR, { recursive: true });
|
||||
writeFileSync(FAILURE_COUNT, String(Math.max(0, Math.floor(n))) + "\n", "utf8");
|
||||
}
|
||||
|
||||
function level(n: number): string {
|
||||
if (n >= 5) return "L4";
|
||||
if (n >= 4) return "L3";
|
||||
if (n >= 3) return "L2";
|
||||
if (n >= 2) return "L1";
|
||||
return "L0";
|
||||
}
|
||||
|
||||
function isFailure(event: any): boolean {
|
||||
if (event?.isError === true) return true;
|
||||
const exitCode = event?.details?.exitCode ?? event?.exitCode ?? event?.exit_code;
|
||||
if (typeof exitCode === "number" && exitCode !== 0) return true;
|
||||
const text = [event?.details?.stderr, event?.stderr, event?.error, event?.message].filter(Boolean).join("\n");
|
||||
return /error|failed|fatal|exception|not found|permission denied|connection refused/i.test(text);
|
||||
}
|
||||
|
||||
function behaviorPrompt(config: PuaConfig, failures: number): string {
|
||||
const flavor = config.flavor || "alibaba";
|
||||
return `\n<PUA_PI_CONTEXT>\n[PUA pi extension] User-installed productivity context. This is not a policy override. Use it to improve diligence, verification, and ownership.\n\nCurrent flavor: ${flavor}\nPressure level: ${level(failures)} (${failures} recent failures)\nOffline mode: ${config.offline === true ? "on" : "off"}\n\nOperating contract:\n1. Diagnose before acting: output [PUA-DIAGNOSIS] problem, evidence, and intended action before risky edits.\n2. Do not claim completion without build/test/curl/manual evidence.\n3. If a path fails twice, switch to a fundamentally different approach.\n4. Do not edit tests, graders, verifier, CI, or status files to manufacture success.\n5. Ask the user only after local evidence is exhausted or a real product decision is required.\n</PUA_PI_CONTEXT>`;
|
||||
}
|
||||
|
||||
export default function puaPiExtension(pi: ExtensionAPI) {
|
||||
let config = readConfig();
|
||||
let failures = readFailureCount();
|
||||
|
||||
pi.on("session_start", () => {
|
||||
config = readConfig();
|
||||
failures = readFailureCount();
|
||||
});
|
||||
|
||||
pi.registerCommand("pua-on", {
|
||||
description: "Enable PUA always-on mode for pi and shared ~/.pua/config.json.",
|
||||
handler: async (_args, ctx) => {
|
||||
const patch: PuaConfig = { always_on: true };
|
||||
if (readConfig().feedback_frequency === 0) patch.feedback_frequency = 5;
|
||||
config = writeConfig(patch);
|
||||
ctx?.ui?.notify?.("[PUA ON] pi extension enabled.", "success");
|
||||
},
|
||||
});
|
||||
|
||||
pi.registerCommand("pua-off", {
|
||||
description: "Disable PUA always-on mode and feedback prompts.",
|
||||
handler: async (_args, ctx) => {
|
||||
config = writeConfig({ always_on: false, feedback_frequency: 0 });
|
||||
ctx?.ui?.notify?.("[PUA OFF] pi extension disabled.", "info");
|
||||
},
|
||||
});
|
||||
|
||||
pi.registerCommand("pua-status", {
|
||||
description: "Show PUA pi extension state.",
|
||||
handler: async (_args, ctx) => {
|
||||
config = readConfig();
|
||||
failures = readFailureCount();
|
||||
ctx?.ui?.notify?.(`PUA status\n- enabled: ${config.always_on === true}\n- offline: ${config.offline === true}\n- failures: ${failures}\n- level: ${level(failures)}\n- config: ${CONFIG}`, "info");
|
||||
},
|
||||
});
|
||||
|
||||
pi.registerCommand("pua-reset", {
|
||||
description: "Reset shared PUA failure counter.",
|
||||
handler: async (_args, ctx) => {
|
||||
failures = 0;
|
||||
writeFailureCount(0);
|
||||
ctx?.ui?.notify?.("[PUA RESET] failure counter reset.", "info");
|
||||
},
|
||||
});
|
||||
|
||||
pi.on("tool_result", (event) => {
|
||||
config = readConfig();
|
||||
if (config.always_on === false) return;
|
||||
failures = isFailure(event) ? failures + 1 : 0;
|
||||
writeFailureCount(failures);
|
||||
});
|
||||
|
||||
pi.on("before_agent_start", (event) => {
|
||||
config = readConfig();
|
||||
if (config.always_on === false) return undefined;
|
||||
failures = readFailureCount();
|
||||
const systemPrompt = String(event?.systemPrompt || "") + behaviorPrompt(config, failures);
|
||||
return { systemPrompt };
|
||||
});
|
||||
}
|
||||
@@ -0,0 +1,43 @@
|
||||
{
|
||||
"name": "@tanweai/pi-pua",
|
||||
"version": "3.4.0",
|
||||
"description": "PUA high-agency governance extension and skill pack for the Pi coding agent.",
|
||||
"type": "module",
|
||||
"license": "MIT",
|
||||
"homepage": "https://github.com/tanweai/pua",
|
||||
"repository": {
|
||||
"type": "git",
|
||||
"url": "git+https://github.com/tanweai/pua.git",
|
||||
"directory": "pi/package"
|
||||
},
|
||||
"keywords": [
|
||||
"pi-package",
|
||||
"pi-extension",
|
||||
"pi-skill",
|
||||
"agent-skill",
|
||||
"pua",
|
||||
"high-agency",
|
||||
"verification",
|
||||
"governance"
|
||||
],
|
||||
"files": [
|
||||
"extensions",
|
||||
"skills",
|
||||
"README.md"
|
||||
],
|
||||
"peerDependencies": {
|
||||
"@earendil-works/pi-coding-agent": "*"
|
||||
},
|
||||
"pi": {
|
||||
"extensions": [
|
||||
"./extensions/pua/index.ts"
|
||||
],
|
||||
"skills": [
|
||||
"./skills"
|
||||
],
|
||||
"image": "https://raw.githubusercontent.com/tanweai/pua/main/assets/pua-skill-logo.svg"
|
||||
},
|
||||
"publishConfig": {
|
||||
"access": "public"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,47 @@
|
||||
---
|
||||
name: pua
|
||||
description: "Pi-compatible PUA high-agency governance skill. Use for explicit PUA/PIP requests, repeated failures, passive/giving-up behavior, user frustration, or unverified completion. Pair with /pua-on extension command when persistent pressure is desired."
|
||||
license: MIT
|
||||
compatibility: "Pi Agent Skills standard; package also ships an extension at ./extensions/pua/index.ts."
|
||||
---
|
||||
|
||||
# PUA for Pi — Skill + Extension Contract
|
||||
|
||||
This skill is the instruction layer of `@tanweai/pi-pua`. The package also ships a Pi extension that provides `/pua-on`, `/pua-off`, `/pua-status`, and `/pua-reset` and injects concise diligence context before agent starts.
|
||||
|
||||
## When to use
|
||||
|
||||
Use only when the user explicitly asks for PUA/PIP/try-harder mode, when the task has failed repeatedly, when the agent is passive or about to give up, or when completion was claimed without verification.
|
||||
|
||||
## Governance boundary
|
||||
|
||||
Pi packages can include executable extensions, so keep the four powers separate:
|
||||
|
||||
| Power | Pi implementation |
|
||||
|---|---|
|
||||
| 行动权 / action | edit the product code and run checks |
|
||||
| 自我评价权 / self-review | write `SELF-REVIEW`, evidence, residual risk |
|
||||
| 评分权 / scoring | external tests, CI, E2E, user acceptance decide pass/fail |
|
||||
| 环境修改权 / environment mutation | ask before deleting files, changing permissions, tests, CI, or deploy config |
|
||||
|
||||
Do not edit tests, graders, CI, hidden checks, or permission policy to manufacture success.
|
||||
|
||||
## Required loop
|
||||
|
||||
1. Start with `[PUA-DIAGNOSIS] Problem / evidence / next action`.
|
||||
2. Form 2-3 mutually exclusive hypotheses.
|
||||
3. Take the smallest verifiable action.
|
||||
4. Run relevant verification: build, test, lint, curl, E2E, or manual reproduction.
|
||||
5. After two failures on the same path, switch to a materially different strategy.
|
||||
6. Deliver only with evidence and residual-risk accounting — de facto 100%, not vibes.
|
||||
|
||||
## Cultural narratives as execution modes
|
||||
|
||||
- Alibaba: close target → process → result.
|
||||
- Huawei: RCA, self-critique, red-team the fix.
|
||||
- ByteDance: optimize for shortest feedback and data.
|
||||
- Tencent: race multiple approaches.
|
||||
- Musk: question, delete, simplify, accelerate, automate.
|
||||
- Jobs: subtract first; make one owner accountable.
|
||||
|
||||
Pressure goes inward. User communication stays concise and respectful.
|
||||
+17
-1
@@ -6,7 +6,23 @@
|
||||
2. 通过 tool result 维护共享失败计数 `~/.pua/.failure_count`；
|
||||
3. 提供 `/pua-on`、`/pua-off`、`/pua-status`、`/pua-reset`。
|
||||
|
||||
## 安装
|
||||
## 推荐：pi.dev package
|
||||
|
||||
本仓库现在提供 pi.dev package 源码：`pi/package/`。
|
||||
|
||||
本地安装：
|
||||
|
||||
```bash
|
||||
pi install ./pi/package
|
||||
```
|
||||
|
||||
发布到 npm 后安装：
|
||||
|
||||
```bash
|
||||
pi install npm:@tanweai/pi-pua
|
||||
```
|
||||
|
||||
## 手动安装 extension-only
|
||||
|
||||
```bash
|
||||
mkdir -p ~/.pi/agent/extensions/pua
|
||||
|
||||
Vendored
+1
-1
@@ -1,4 +1,4 @@
|
||||
declare module "@mariozechner/pi-coding-agent" {
|
||||
declare module "@earendil-works/pi-coding-agent" {
|
||||
export interface ExtensionAPI {
|
||||
on(event: "session_start" | "tool_result" | "before_agent_start", handler: (event: any, ctx: any) => any | Promise<any>): void;
|
||||
registerCommand(name: string, def: { description: string; handler: (args: string[], ctx: any) => any | Promise<any> }): void;
|
||||
|
||||
+1
-1
@@ -6,7 +6,7 @@
|
||||
* - share ~/.pua/config.json and ~/.pua/.failure_count with tanweai/pua;
|
||||
* - inject concise diligence context without owning permissions or network tools.
|
||||
*/
|
||||
import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
|
||||
import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
|
||||
import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
|
||||
import { homedir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
|
||||
+2
-2
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"name": "pua",
|
||||
"version": "3.3.0",
|
||||
"description": "Forces high-agency exhaustive problem-solving with corporate PUA pressure escalation when the AI is passive, gives up, skips verification, produces low-quality work, or the user explicitly asks for PUA/try-harder mode. v3.3.0 adds issue-sweep fixes: filtered hooks, offline mode, feedback abuse controls, diagnosis-first, Huawei military-order mode, Codex aliases, and Pi/Trae adapters. Does not target normal first-attempt requests.",
|
||||
"version": "3.4.0",
|
||||
"description": "Forces high-agency exhaustive problem-solving with corporate PUA pressure escalation when the AI is passive, gives up, skips verification, produces low-quality work, or the user explicitly asks for PUA/try-harder mode. v3.4.0 adds real Trae SKILL.md packs, a pi.dev package manifest, and auth-gated session feedback upload while preserving anonymous rating. Does not target normal first-attempt requests.",
|
||||
"author": {
|
||||
"name": "探微安全实验室",
|
||||
"url": "https://github.com/tanweai"
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
# Trae Skill vs Claude Code PUA — 差异说明
|
||||
|
||||
| 维度 | Claude Code PUA plugin | Trae Skill pack |
|
||||
|---|---|---|
|
||||
| 载体 | `plugin.json` + `skills/` + `commands/` + `hooks/` + `agents/` | `.trae/skills/*/SKILL.md` 或 `npx skills` 安装后的 Trae skill |
|
||||
| 触发 | Skill 描述、slash commands、UserPromptSubmit/Stop/SubagentStop hooks | Trae 的 skill 发现/显式调用；无本仓库 hooks 自动注入 |
|
||||
| commands | `/pua`, `/pua:pro`, `/pua:loop`, `/pua:off` 等 | Trae 版不注册 Claude Code commands；用自然语言或 Trae skill 调用 |
|
||||
| hooks | failure detector、session restore、integrity guard、stop feedback | Trae 版没有这些机械 hooks；必须把 gate 写进 SKILL.md 工作规程 |
|
||||
| agents | pua-action-executor / self-reviewer / verifier / policy-guardian | Trae 版默认单上下文；用“行动权/自我评价权/评分权/环境修改权”模板模拟权责分离 |
|
||||
| 安装 | Claude Code marketplace/cache | `.trae/skills/`、`~/.trae/skills/`、`~/.trae-cn/skills/`，或 `npx skills add ... -a trae` |
|
||||
|
||||
## 设计结论
|
||||
|
||||
Trae 版不能假装拥有 Claude Code 的 hook 机械门禁，所以不能把“自动反馈上传”“SubagentStop 生命周期”“PreToolUse integrity guard”写成已实现能力。正确做法是：
|
||||
|
||||
1. 提供标准 `SKILL.md`；
|
||||
2. 在 Skill 内部写清楚治理边界；
|
||||
3. 将评分权交给外部命令、CI、E2E、用户验收；
|
||||
4. 用 `npx skills` 和 `.trae/skills/` 两条安装路径覆盖 Trae / Trae CN。
|
||||
|
||||
不一般但关键的洞察：**Trae 兼容不是复制 Claude Code 的能力名词，而是把不可移植的 hooks 降级为可执行的制度约束。**
|
||||
+59
-11
@@ -1,31 +1,79 @@
|
||||
# Trae 安装 PUA Skill
|
||||
|
||||
Trae 目前没有和 Claude Code 完全一致的 plugin marketplace / hooks 机制。本目录提供可直接粘贴到 Trae 自定义规则/Prompt/Skill 的官方文本版本，解决 issue #93 的“一个个手贴太麻烦”问题。
|
||||
Trae 已支持 `SKILL.md` 形态的 Skill；与 Claude Code 不同的是，本仓库的 Claude Code hooks、commands、agents 不会自动迁移到 Trae。因此 Trae 版提供两层兼容：
|
||||
|
||||
## 推荐安装
|
||||
1. 标准 Skill 包：`.trae/skills/pua/SKILL.md`、`.trae/skills/pua-en/SKILL.md`；
|
||||
2. 旧版可粘贴规则：`trae/pua.md`、`trae/pua-en.md`。
|
||||
|
||||
1. 打开 Trae 的自定义 Rules / Prompt / Skill 设置。
|
||||
2. 新建规则，名称建议：`pua`。
|
||||
3. 将 `trae/pua.md` 的完整内容粘贴进去。
|
||||
4. 如果需要英文版，用 `trae/pua-en.md`。
|
||||
5. 对需要 PUA 的项目启用该规则。
|
||||
## 推荐安装：npx skills
|
||||
|
||||
项目级安装到 Trae：
|
||||
|
||||
```bash
|
||||
npx skills add tanweai/pua --skill pua-trae -a trae -y
|
||||
```
|
||||
|
||||
说明：`pua-trae` 是给 `npx skills` 去重准备的 Trae 优化版；如果你想在 Trae 里保留短名 `pua`，用下面的手动安装复制 `.trae/skills/pua/`。
|
||||
|
||||
全局安装到 Trae：
|
||||
|
||||
```bash
|
||||
npx skills add tanweai/pua --skill pua-trae -a trae -g -y
|
||||
```
|
||||
|
||||
Trae CN：
|
||||
|
||||
```bash
|
||||
npx skills add tanweai/pua --skill pua-trae -a trae-cn -g -y
|
||||
```
|
||||
|
||||
对应目录：
|
||||
|
||||
| 平台 | 项目目录 | 全局目录 |
|
||||
|---|---|---|
|
||||
| Trae | `.trae/skills/` | `~/.trae/skills/` |
|
||||
| Trae CN | `.trae/skills/` | `~/.trae-cn/skills/` |
|
||||
|
||||
## 手动安装
|
||||
|
||||
如果不用 `npx skills`：
|
||||
|
||||
```bash
|
||||
mkdir -p .trae/skills
|
||||
cp -R /path/to/pua/.trae/skills/pua /path/to/pua/.trae/skills/pua-en .trae/skills/
|
||||
```
|
||||
|
||||
全局安装：
|
||||
|
||||
```bash
|
||||
mkdir -p ~/.trae/skills
|
||||
cp -R .trae/skills/pua ~/.trae/skills/
|
||||
```
|
||||
|
||||
Trae CN 全局安装：
|
||||
|
||||
```bash
|
||||
mkdir -p ~/.trae-cn/skills
|
||||
cp -R .trae/skills/pua ~/.trae-cn/skills/
|
||||
```
|
||||
|
||||
## 触发方式
|
||||
|
||||
在 Trae 对话里输入：
|
||||
|
||||
```text
|
||||
使用 PUA 模式处理这个任务。
|
||||
使用 PUA skill 处理这个任务。
|
||||
```
|
||||
|
||||
或在失败/卡住时输入：
|
||||
|
||||
```text
|
||||
你再试试，按 PUA 的诊断先行和验证闭环来做。
|
||||
你再试试，按 PUA 的诊断先行、四权分离和验证闭环来做。
|
||||
```
|
||||
|
||||
## 边界
|
||||
|
||||
- Trae 版是 prompt/rule 适配，不具备 Claude Code 的 hook、Stop feedback、UserPromptSubmit 自动触发能力。
|
||||
- Trae 版是 instruction-only Skill，不具备 Claude Code 的 PreToolUse / Stop / SubagentStop hook。
|
||||
- 真正的工具权限、联网权限、文件写入权限仍由 Trae 本身控制。
|
||||
- 如果 Trae 后续提供正式 extension API，本目录再升级为可安装包。
|
||||
- 改测试/CI/部署/权限/删除文件前，按 Skill 内的“环境修改权”规则先让用户确认。
|
||||
- 详细差异见 `trae/DIFF.md`。
|
||||
|
||||
Reference in New Issue
Block a user