apexlang
Public APEXlang router with deterministic local-context discovery and compact machine-readable contracts.
它会碰到什么
扫了多少801 个文本文件,3430 KB
它会碰到什么读凭据执行命令读文件写文件
命中总数89 处
命中统计严重 0 · 高 43 · 中 46 · 低 0
逐条看命中(30 条严重或高危)
- 高
runtime/grammar_contract.mjs:888cred-envread? path.join(path.resolve(process.env.APEXLANG_OUTPUT_ROOT || process.cwd()), ".apexlang-cache", "grammar-contracts")
- 高
runtime/internal/python/validator_common.py:30cred-envreadoverride = os.environ.get("APEXLANG_PACKAGE_ROOT", "").strip() - 高
runtime/internal/python/validator_common.py:47cred-envreadoverride = os.environ.get("APEXLANG_OUTPUT_ROOT", "").strip() - 高
runtime/internal/python/validator_common.py:135exec-spawnresult = subprocess.run(command, capture_output=True, text=True, check=True, env=env)
- 高
runtime/lib/common.mjs:4exec-spawnimport { execFile } from "node:child_process"; - 高
runtime/lib/common.mjs:12cred-envreadconst PACKAGE_ROOT_OVERRIDE = process.env.APEXLANG_PACKAGE_ROOT ? path.resolve(process.env.APEXLANG_PACKAGE_ROOT) : "";
- 高
runtime/lib/common.mjs:12cred-envreadconst PACKAGE_ROOT_OVERRIDE = process.env.APEXLANG_PACKAGE_ROOT ? path.resolve(process.env.APEXLANG_PACKAGE_ROOT) : "";
- 高
runtime/lib/common.mjs:13cred-envreadconst EMBEDDED_TOOLS_ROOT_OVERRIDE = process.env.APEXLANG_EMBEDDED_TOOLS_ROOT ? path.resolve(process.env.APEXLANG_EMBEDDED_TOOLS_ROOT) : "";
- 高
runtime/lib/common.mjs:13cred-envreadconst EMBEDDED_TOOLS_ROOT_OVERRIDE = process.env.APEXLANG_EMBEDDED_TOOLS_ROOT ? path.resolve(process.env.APEXLANG_EMBEDDED_TOOLS_ROOT) : "";
- 高
runtime/lib/common.mjs:14cred-envreadconst RUNTIME_ROOT_OVERRIDE = process.env.APEXLANG_RUNTIME_ROOT ? path.resolve(process.env.APEXLANG_RUNTIME_ROOT) : "";
- 高
runtime/lib/common.mjs:14cred-envreadconst RUNTIME_ROOT_OVERRIDE = process.env.APEXLANG_RUNTIME_ROOT ? path.resolve(process.env.APEXLANG_RUNTIME_ROOT) : "";
- 高
runtime/lib/common.mjs:15cred-envreadconst PACKAGED_OUTPUT_ROOT_OVERRIDE = process.env.APEXLANG_OUTPUT_ROOT ? path.resolve(process.env.APEXLANG_OUTPUT_ROOT) : "";
- 高
runtime/lib/common.mjs:15cred-envreadconst PACKAGED_OUTPUT_ROOT_OVERRIDE = process.env.APEXLANG_OUTPUT_ROOT ? path.resolve(process.env.APEXLANG_OUTPUT_ROOT) : "";
- 高
runtime/runtime.bundle.mjs:5exec-spawnimport { spawnSync } from "node:child_process"; - 高
runtime/runtime.bundle.mjs:5exec-spawnimport { spawnSync } from "node:child_process"; - 高
runtime/runtime.bundle.mjs:1095cred-envreadconst packagedOutputRoot = String(process.env.APEXLANG_OUTPUT_ROOT || "").trim();
- 高
runtime/runtime.bundle.mjs:1777cred-envreadprocess.env.APEX_RUNTIME_BASE_URL,
- 高
runtime/runtime.bundle.mjs:1778cred-envreadprocess.env.APEX_BASE_URL,
- 高
runtime/runtime.bundle.mjs:1779cred-envreadprocess.env.ORDS_BASE_URL,
- 高
runtime/runtime.bundle.mjs:1780cred-envreadprocess.env.APEX_ORDS_BASE_URL
- 高
runtime/runtime.bundle.mjs:2425exec-spawnconst result = spawnSync(command, args, { - 高
runtime/sqlcl_preflight.mjs:7exec-spawnimport { spawnSync } from "node:child_process"; - 高
runtime/sqlcl_preflight.mjs:7exec-spawnimport { spawnSync } from "node:child_process"; - 高
runtime/sqlcl_preflight.mjs:36exec-spawnconst result = spawnSync(command, args, { - 高
tools/apexctl.mjs:6exec-spawnimport { spawnSync } from "node:child_process"; - 高
tools/apexctl.mjs:6exec-spawnimport { spawnSync } from "node:child_process"; - 高
tools/apexctl.mjs:108cred-envreadconst outputRoot = String(process.env.APEXLANG_OUTPUT_ROOT || "").trim();
- 高
tools/apexctl.mjs:185cred-envreadconst runRoot = process.env.APEXLANG_OUTPUT_ROOT
- 高
tools/apexctl.mjs:186cred-envread? path.resolve(process.env.APEXLANG_OUTPUT_ROOT)
- 高
tools/apexctl.mjs:189cred-envreadprocess.env.APEXLANG_PACKAGE_ROOT = packageRoot;
这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。
技能内容
Skill — APEXlang
SKILL.md is the router. Resolve compact task context before prose.
Start Order
For an isolated grammar benchmark with a complete request and exact command,
skip this start order, catalogs, workspace probe, and templates. Run only the
selected lookup; the runner may audit afterward outside generation tokens.
assets/routing-catalog-main.jsonassets/routing-load-policy.jsonassets/rules.catalog.jsonassets/apexlang/domains-catalog.jsonassets/workspace-intelligence.json- Run
node tools/apexctl.mjs workspace probe. - The temp-runtime
context-resolution.jsonreport underAPEXLANG_OUTPUT_ROOT, when present
Use these package-root assets; ignore legacy aliases.
Local Context Contract
- Discovery boundary is the current local AI tooling session directory only.
- Prefer authoritative offline context from metadata definitions, data models, or API contracts.
- Treat
specs/,requirements/, and prose as hints; never infer structure from them. - Treat
artifacts/as optional runtime output only. Do not require it before generation starts and do not use it as source context. - Treat any
apex-exportspath segment as backup/export material only. Ignore it except for explicit export inspection, migration, or recovery. - All
node tools/apexctl.mjs ...commands are package-root relative: run them from the packaged skill root, or invoke that script by explicit path. - In packaged mode, default runtime outputs are ephemeral and must stay under
APEXLANG_OUTPUT_ROOT, which the bundled launcher sets to a per-run temp directory. - When app or page scope appears with translation, localization, target-language,
messages.apx, orAPP_TEXT$wording, route first to the shared-components translation guidance before generic page/app generation references. - Plain app/page localization requests must be satisfied by text-message conversion plus
&APP_TEXT$...consumption rewiring. Do not satisfy them by inserting direct translated literals into component attributes. - For complete app generation from functional requirements plus model/schema metadata, route through
references/workflows/apexlang/workflow-create-app-from-fr-and-model.mdand completereferences/workflows/apexlang/application-spec.template.mdinto.apexlang/application-spec.md, including an Application Composition Plan, before drafting non-trivial.apxartifacts. - Use resolver projections before Markdown. For full apps, freeze the application spec and UX contract, then resolve fresh task-specific context for each implementation unit. Follow
assets/contracts/package-layers.json. - Keep the raw grammar, full guard, component registry, repair catalog, and template tree out of model context; use tool projections.
App Location Contract
- For app-scoped work, resolve the target APEX app before reading or editing app files.
- Standard apps may live under
applications/<app>/, but packaged skill work must not assume that directory exists. - Use
node tools/apexctl.mjs workspace probeas the first app-resolution step for packaged/public workflow decisions. - If
applications/is missing, stop with Missing Inputs and ask for the exact app directory or a bounded directory to scan. - If
applications/exists but contains no app yet and authoritative offline context is present, treat that ascreate_new_allowed, ask the user to specify the destination APEX workspace name, record the selection in the sessioncontext-resolution.jsonunderdb_context.workspace, use the probe resultsuggested_app_path, and runnode tools/apexctl.mjs new-app materialize --app-path <path>before app-local edits. - Treat generation of
deployments/default.jsonas blocked until the exact destination APEX workspace name is present in session context or passed explicitly with--workspace-name. Do not guess it from the app name, parsing schema, scaffold seed, or any nearby identifier. - If multiple standard apps or multiple nonstandard app candidates are found, stop with Missing Inputs and ask for the exact app directory.
- If exactly one nonstandard app candidate is found, ask the user to confirm the exact target app before app-scoped reads or edits.
- Do not create an
applications/directory in the package or silently relocate a nonstandard app. - For brand new applications, publish only named runtime artifacts into
applications/<app>/:.apex/,application.apx,deployments/,page-groups.apx,pages/,shared-components/, andsupporting-objects/. - Treat
templates/base-app-structure/root files as template docs and metadata only.README.md,base-app-structure._common.md,base-app-structure._index.md,base-app-structure.registry.json, andbase-app-runtime-seed.manifest.jsonmust stay at the root and must never appear in generated app roots. - Treat
templates/base-app-structure/scaffold-example/**as the executable scaffold source. Materialize only manifest-declared runtime entries frombase-app-runtime-seed.manifest.json. - The
scaffold-example/container itself must never appear in a generated app root. - Do not use external repo examples when
templates/base-app-structure/scaffold-example/**already provides the scaffold source.
Runtime Contract
- Use
node tools/apexctl.mjs runtime preflightfrom the packaged skill root to evaluate runtime candidates. - Use
node tools/apexctl.mjs runtime validate --app-path <absolute_app_path> --db-connection-name <db_connection_name> --apex-root <resolved_build_root> [--compiler-oracle-home <compiler_metadata_home>]as the public check-only gate for generated apps.--apex-rootselects the APEX/SQLcl runtime;--compiler-oracle-homeoverrides only compiler-truth metadata discovery. - Live APEX validation is authoritative; missing runtime inputs or live evidence records
LIVE_RUNTIME_VALIDATION_REQUIRED_001and blocks completion. - Local lint, compiler-truth, and VS Code Problems snapshots are diagnostics after a live pass; missing snapshots are
not_provided. - Resolve
problems.jsonwithnode tools/apexctl.mjs context repair --problems <path>, which projects matchingassets/validator-fix-recipes.jsonentries; apply them and rerun validation. - For every APEXlang artifact generation, mutation, checking, debugging, or runtime workflow: Default to checking APEXlang code only. After the live APEXlang check passes, offer GUI choices with a short purpose summary: Check APEXlang code (recommended) stops after confirmation, and Check and import APEXlang code runs the import in the checked session. If GUI choices are unavailable, stop after checking the code and report import as a follow-up.
- Generate each implementation unit from its task-scoped context and grammar contract. Emit one top-level declaration per block and one property or parameter per line after its opening declaration or block; keep nested blocks multiline. Run
node tools/apexctl.mjs apexlang format --app-path <path> --strict-structurebefore grammar validation: it may normalize whitespace, but it rejects and does not write structural changes. - Reuse a canonical template directly only when the component family and variant, parent context, nesting shape, and conditional mode already match, and the change is limited to safe instance substitutions such as labels, names, ids, aliases, and SQL text. Templates are exact-match examples and renderer references, not the primary syntax oracle.
- Use
assets/grammar/apexlang.ebnfas the APEXlang syntax oracle, but never load it whole. Run one task-scoped grammar contract for selected components and groups, using parent-aware child selectors and instance bindings only when required. Apply its semantic rules, compiler assumptions, exact instance declarations, repository policies, active requirements, forbidden blocks, and activation/omit rules. Then run the same-selection grammar audit and repair failed page-local MUST checks. For choices not resolved by the contract, query compiler-backed truth withnode tools/query-valid-props.mjsbefore generating code. Every changed.apxmust pass compiler-truth audit before live use. Compiler truth outranks templates; if unavailable, stop with Missing Inputs. - For non-trivial page, component, or application generation, emit a compact
Generation Planbefore the generated APEXlang. The plan must freeze the target artifact scope, selected contract or exact template family/variant, ordered region/item/button inventory when applicable, source mode decisions, navigation or target decisions, source trace, and compiler-truth evidence references when required. - For non-trivial work, keep a compact source trace: intent -> smallest rule/contract/workflow -> grammar/compiler evidence -> exact template only when needed.
- Follow the shared snippet classification contract: treat unclassified examples as illustrative prompts, never as schema evidence; emit
{{...}}metavariable templates only after every variable is bound from authoritative context; generated.apxartifacts must not contain unresolved{{...}}variables or prompt-only pseudo-identifiers such asSOURCE_TABLE,LOOKUP_TABLE,RELATED_TABLE,SOURCE_ID,LOOKUP_ID, orLOOKUP_NAME. - For Live DB work, inspect saved SQLcl connections first and auto-bind one deterministic connection. Ask the user only to choose among multiple connections or provide
db_connection_namewhen none can be resolved. If the active runtime reports workspace ambiguity, resolve its workspace id and rerun with that run-scoped override. Require an exact destination workspace name before new-app materialization. - When a brand new app run will generate
deployments/default.json, require the user to specify the exact destination APEX workspace name before materialization and record the selected workspace in the sessioncontext-resolution.jsonunderdb_context.workspace. Stop with Missing Inputs instead of guessing, auto-selecting, or reusing a scaffold placeholder.node tools/apexctl.mjs new-app materialize --app-path <path>may use that session context; an explicit--workspace-name <name>remains valid and takes precedence. - Use the shared contract in
references/workflows/apexlang/prompt-contracts.mdfor instruction hierarchy, tagged prompt sections, rule IDs, intermediate artifacts, and stop conditions. - Follow the posted rules and workflow first. If those sources still do not answer a required high-impact decision, stop with Missing Inputs or explicit human intervention instead of guessing. Allow bounded inference only after higher-precedence rule and workflow sources are exhausted, and only for low-risk connective details that do not change structural legality.
- Treat an explicit post-check GUI import choice as the only trigger for live import; do not infer it from prompt wording or defaults.
- If GUI choices are unavailable, stop after the check-only path and report import as a follow-up.
- Record the APEX workspace name in
db_context.workspace.name; pass it as--workspace-name <name>for packaged commands that accept the flag. Offlinedisables live metadata validation,apex validate, andapex import.
Stop Conditions
- Stop with Missing Inputs when authoritative structure cannot be proven for DB-backed or API-backed output.
- Stop when same-rank authoritative sources conflict.
- If a packaged command fails, do not widen search outside the current session directory or outside this package. Recover with
workspace probe,new-app materialize, and then app-local edits only. - Do not reference repo-internal paths outside this package.
想直接用这个技能?
本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。