CursorInitGeneral/.cursor/changelog/entries/nostars/CL-20260727-1322-nostars.md

id: CL-20260727-1322-nostars date: 2026-07-27 13:22 author: nostars author_name: Nostars Developer type: feat merge_source: FOR_Roblox_Main status: active superseded_by: title: 安全接入 Roblox 项目类型 Bundle source_chat: Roblox Bundle 安全接入 tags: - cursor-init - roblox - skills - local-env - open-cloud - security affected_files: - .cursor/bootstrap/catalog.json - .cursor/bootstrap/skills.json - .cursor/bootstrap/tools/cursor_init.py - .cursor/bootstrap/tests/test_cursor_init.py - .cursor/bootstrap/types/roblox/manifest.json - .cursor/bootstrap/types/roblox/fragments/roblox.gitignore - .cursor/bootstrap/types/roblox/fragments/roblox.gitattributes - .cursor/bootstrap/types/roblox/payload/rules/project/roblox-luau-guardrails.mdc - .cursor/bootstrap/types/roblox/payload/skills/roblox-project-initializer/SKILL.md - .cursor/bootstrap/types/roblox/payload/skills/roblox-vibe-project-framework/SKILL.md - .cursor/bootstrap/types/roblox/payload/skills/roblox-ui-producer/SKILL.md - .cursor/bootstrap/types/roblox/payload/skills/building-3d-objects/SKILL.md - .cursor/bootstrap/types/roblox/payload/skills/building-maps/SKILL.md - .cursor/bootstrap/types/roblox/payload/skills/roblox-camera-cinematics/SKILL.md - .cursor/bootstrap/types/roblox/payload/skills/roblox-vfx-designer/SKILL.md - .cursor/bootstrap/types/roblox/payload/skills/roblox-animation-producer/SKILL.md - .cursor/bootstrap/types/roblox/payload/skills/roblox-commonkit-usage/SKILL.md - .cursor/bootstrap/types/roblox/payload/skills/roblox-asset-uploader/SKILL.md - .cursor/bootstrap/types/roblox/payload/skills/roblox-asset-uploader/scripts/upload.py - .cursor/bootstrap/types/roblox/payload/skills/roblox-asset-uploader/scripts/test_upload.py - .cursor/skills/cursor-init/SKILL.md - .cursor/skills/cursor-init/reference.md - .cursor/hooks/tests/test_check_changelog.py - .cursor/pitfalls/pitfalls.md

Roblox 初始化现仅按类型物化安全整改后的项目 Rule 与十个专属 Skill。

将十四个候选整合为一条 Roblox Rule、八个核心 Skill 和两个条件 Skill，并把 Roblox 标记为 ready。 初始化器新增敏感本机字段契约，API key 只在模板中留占位符，真实值不经问卷或命令行采集。 Open Cloud 上传器改为 Python 标准库、零联网 dry-run 和逐次确认，三类型切换与 Hook 扫描均有回归覆盖。

• what: 建立 Roblox 自包含 payload、manifest、Registry 元数据、扫描/Git 片段与类型专属本机字段；去除 Codex 配置、个人路径、项目 API 残留，并合并 Guardrails、Design Consultant 与 Retrospective 的有效能力。
• why: Roblox 候选来自特定 Codex/SwordnWizard 环境，原样接入会提前加载错误 Skill、泄漏环境假设，并让 API key 和外部上传缺少安全边界。
• decisions: Roblox 选择时才物化十个 Skill；CommonKit 与 Asset Uploader 保持条件触发；Guardrails 转 always-on 项目 Rule；敏感字段禁止 --set 且不参与 drift；不保存密码、Cookie 或会话令牌；上传器不新增第三方依赖。
• tests: 初始化 18 项、Hook 7 项、上传器 6 项测试通过；真实 payload 在临时目标完成 Roblox → General → Godot → Roblox 切换并逐段 --check；三个类型实仓 dry-run 无 blocker；敏感 key 命令行输入被拒绝且轮换不改变计划摘要；IDE lint 无错误。
• notes: 验证成功后删除 roblox_skills_waitingforprocessing，.cursor/bootstrap/types/roblox/payload 成为唯一 canonical。另修复 WindowsApps bash.exe 探测可能无限挂起的问题并记录 PF-20260727-1322。