菜单
Use when ready to ship — runs pre-push gates (lint, typecheck, build, tests, security sweep), commits, releases, and pushes. Standalone, never auto-invoked. Push always requires explicit confirmation. Trigger with /hyperflow:deploy, "ship it", "ready to push", "release", "cut a release", "deploy".
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/TuYv/ccpm --skill deploy命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Use when auditing a paid ad account for incremental contribution, wasted spend, or measurement integrity before scaling; runs a typed 20-item ROAS profile with verified vetoes and a SHIP/FIX/BLOCK/UNDECIDED gate on own exported data. Not for campaign structure design — use campaign-architect; not for creative production — use ad-creative-builder. 付费广告账户审计/ROAS评分
Use when the user asks to "write ad copy", "generate RSA headlines", or "build ad creative at volume"; produces ad units — RSA headlines/descriptions, hooks, and an angle matrix — message-matched to the destination landing page. Not for scoring an ad account — use ad-account-auditor; not for the post-click page — use landing-optimizer; not for organic articles — use content-writer. 广告创意/广告文案/RSA标题
Use when the user asks to "design an A/B test", "set up a creative/landing test", "run an incrementality test", or "is this result statistically and practically material?"; produces a hypothesis, variant matrix, sample-size/duration/power plan, and a documented effect/uncertainty read from own exported results. It applies only a precommitted owner-approved action rule; the statistical helper never chooses a business action. Not for producing variants — use ad-creative-builder; not for reading back one shipped change — use paid-measurement-loop. 广告AB测试设计/实验设计/显著性判定/增效测试
基于 SOC 职业分类
正在显示 SKILL.md
| name | deploy |
| description | Use when ready to ship — runs pre-push gates (lint, typecheck, build, tests, security sweep), commits, releases, and pushes. Standalone, never auto-invoked. Push always requires explicit confirmation. Trigger with /hyperflow:deploy, "ship it", "ready to push", "release", "cut a release", "deploy". |
| allowed-tools | Read, Write, Edit, Bash(git:*), Bash(npm:*), Bash(pnpm:*), Bash(./scripts/*:*), Bash(scripts/*:*), Glob, Grep, Agent, AskUserQuestion |
| argument-hint | |
| version | 3.1.3 |
| license | MIT |
| compatibility | Designed for Claude Code |
| tags | ["release","ci","automation","push-gates"] |
No gate skipped, no failure ignored. If any gate fails, halt and report. Never --no-verify. Never bypass.
Failure recovery (rule 14). Worker errors and Quality Gate failures follow the canonical policy in skills/hyperflow/failure-recovery.md. Gate failures are user-surfaced, never auto-fixed — print the failing command + full stderr and halt the push. Never --no-verify, never force-push to main.
| Step | Sub-phase | Workers | Reviewer | Notes |
|---|---|---|---|---|
| 1a | Repo-state scan | Worker A (git status), Worker B (git log) | Reviewer | — |
| 1b | Tool detection | Worker A (profile.md + lockfiles), Worker B (testing.md + devDeps) | Reviewer | — |
| 2a | Lint + typecheck (parallel) | Worker A (linter), Worker B (formatter), Worker C (tsc) | Reviewer | Step 3 (Security Sweep) runs in parallel with Step 2 at orchestrator level; 2a halts chain on any failure before 2b |
| 2b | Build gate | Worker A (prod build), Worker B (dev build) | Reviewer | Depends on 2a PASS |
| 2c | Test gate | Worker A (unit), Worker B (integration/E2E) | Reviewer | Parallel (P1); depends on 2b PASS |
| 3a | Secrets scan | Worker A (diff pattern), Worker B (file pattern) | security-reviewer | Runs in parallel with Step 2 (pre-build; read-only) |
| 3b | Dependency audit | Worker A (CVE audit), Worker B (license check) | vulnerability-reviewer (web-research-first) | — |
| 4 | Commit | single Worker | Reviewer | atomic-exempt (DOCTRINE 12.2) |
| 5a | Release execution | single Worker | Reviewer | atomic-exempt (DOCTRINE 12.2) |
| 5b | Version sync | Worker A (manifests), Worker B (changelog) |
| Reviewer |
| — |
| 6 | Push gate | AskUserQuestion | — | structural gate; atomic-exempt |
| 7 | Output | single print | — | atomic-exempt (§12.1) |
Sub-phases run in parallel (P1).
Two Workers in parallel:
git status --short — uncommitted changes, staged filesgit log origin/<branch>..HEAD --oneline — commits ahead of remote; detect branch nameReviewer — verdict on repo state (clean / has uncommitted / ahead by N). If detached HEAD or no remote configured → halt with reason.
Two Workers in parallel:
.hyperflow/profile.md for package manager and project type; fallback: inspect package.json, pyproject.toml, Cargo.toml, go.mod.hyperflow/testing.md for test runner; fallback: detect from package.json devDependencies (vitest, jest, playwright, pytest, etc.)Reviewer — produce a single tool manifest (package manager, test runner, typed-project flag, build script presence). Used by Step 2 gates.
Step 2 runs in parallel with Step 3 (Security Sweep) at the orchestrator level — both are pre-build, read-only checks. Both must reach PASS before Step 4 (Commit) may proceed. Within Step 2, sub-phases 2a → 2b → 2c run sequentially (2b depends on 2a PASS; 2c depends on 2b PASS). Halt at the first NEEDS_REVISION verdict.
Wall-clock note: default flow runs 3 gates simultaneously (lint + security + typecheck in parallel), then build, then tests — roughly max(lint, security, typecheck) + build + max(unit, integration), versus the old 4× sequential gate duration. Typical saving: ~40% wall-clock reduction. Under --thorough, a standalone final-integration review pass is added after all gates complete, and intra-sub-phase Workers serialize (DOCTRINE §12.2/clarification), so the full saving collapses to 2c's unit + integration pair only.
Print Gate <letter> — <name> before each sub-phase.
Three Workers in parallel (P1). None depend on build output — safe to run alongside Step 3.
npm run lint / pnpm lint / bun run lint / eslint .. On failure: auto-fix via --fix, re-run once; report final error count.prettier --check . / biome check . / equivalent. Report diff count.tsc --noEmit / npm run typecheck. Skip if not a typed project (per Step 1b tool manifest). Also run per-package typecheck if workspace detected (pnpm/yarn workspaces): iterate packages with tsc --noEmit in each.Reviewer — aggregate verdict across all three Workers:
PASS — all clean (or absent/untyped)NEEDS_REVISION — any gate fails → halt before 2b. Report which specific gate(s) failed and why. Do NOT proceed to build.ESCALATE — config errors preventing execution of any gateTwo Workers in parallel:
npm run build / pnpm build / bun run build. Capture output; report size or artifact path if printed.npm run build:dev, vite build --mode development, etc.). Skip if no separate dev-build script.Reviewer — verdict:
PASS — production build succeedsNEEDS_REVISION — production build fails → halt with outputESCALATE — build tool absent or script missing (skip silently, not failure)Two Workers in parallel (P1):
Reviewer — verdict:
PASS — all tests pass (or integration absent)NEEDS_REVISION — failing tests → halt with failing test names. Do NOT skip. Do NOT increase timeout.ESCALATE — runner misconfigured or no tests found and test runner is declaredSee quality-gates.md for gate details.
Runs in parallel with Step 2 at the orchestrator level (P3 — concurrent independent pre-conditions; DOCTRINE §12.2). Both Step 2 and Step 3 are pre-build, read-only checks with no shared state. Both must reach PASS before Step 4 (Commit) may proceed. Halt on SECURITY_VIOLATION immediately — no retry, no 2a must also complete first.
Sub-phases 3a and 3b run in parallel (P1).
Two Workers in parallel:
git diff HEAD~1..HEAD as scan surface.Reviewer — dispatched as the security-reviewer specialist — aggregate findings from 3a Workers. If any secret found → halt immediately with SECURITY_VIOLATION: <file>:<line> — <pattern>. No auto-remediation — user must rotate + remove. (Add compliance-reviewer when the changeset touches PII / regulated data.)
Two Workers in parallel:
npm audit --audit-level=high / pnpm audit / pip-audit / cargo audit. Report critical and high CVEs only..hyperflow/profile.md declares a license policy.Reviewer — dispatched as the vulnerability-reviewer specialist (deploy is a gated flow → web-research-first on current advisories, proving each CVE's applicability to the pinned versions) — verdict:
PASS — no critical/high CVEs; no license violationsNEEDS_REVISION — critical CVE found → halt and surface CVE IDsESCALATE — audit tool absent → skip silently (not a failure); missing license policy → skipAtomic — single Worker → Reviewer pair with no parallel angles. Exempt from sub-phase decomposition per DOCTRINE 12.2 atomic exemption.
Worker-introduced fixes from Step 2 → commit automatically with a conventional commit message.
Pre-existing user-owned uncommitted changes → use AskUserQuestion to confirm inclusion. Per DOCTRINE rule 8, this is a binary action gate — no recommendation marker:
Include uncommitted user changes in this commit?
Include — your local work + the pre-push fixes ship together
Exclude — commit only the worker fixes; user changes stay local
If the popup UI is unavailable on a portable surface (Codex / OpenCode / Grok), print the same inclusion gate as a Hyperflow Question chat block and wait for the user's answer.
Never add Co-Authored-By: Claude in commit messages — see git-workflow.md.
Sub-phases run sequentially (5b depends on 5a output).
Single Worker (no parallel angle — single mechanical action):
scripts/release.sh exists → run it. release-please / changesets detected → use it. "Nothing to release" or no releasable commits → skip and record Release: skipped.Reviewer — capture output: new version string (if bumped) or skip reason. Feed version to Step 5b.
Two Workers in parallel (only runs if 5a produced a new version):
package.json, plugin.json, marketplace.json, any other version-bearing files identified in Step 1b.CHANGELOG.md (or equivalent). Skip if no changelog file.Reviewer — verdict:
PASS — all manifests in sync; changelog updatedNEEDS_REVISION — version mismatch or changelog missing entry → haltRelease: skipped)push pre-election from Scope Step 2.6 · STRUCTURAL GATE when push=ask)Read the push arg from chain args (propagated from Scope Step 2.6 when chain-mode=auto). Three paths:
push=auto — push immediately without asking. Print Push: pre-elected (auto) — pushing branch + tags…. Run git push, then git push --tags if release created tags. Skip the AskUserQuestion call. Per DOCTRINE rule 8, this is NOT an invented skip — the user already gave consent at Scope Step 2.6.
push=never — skip the push step entirely. Print Push: pre-elected (never) — branch held local. Run \git push` manually when ready.Do not callgit push`.
push=ask (default; also fires when no operational pre-election was made — e.g. deploy invoked standalone) — fire the structural-gate AskUserQuestion. Per DOCTRINE rule 8, this is a binary action gate — no recommendation marker on either option.
Push to origin/<branch>?
Push — all gates pass · safe to ship
Hold — keep local; you can push later
push value. push=auto is a plain git push; if the remote rejects it (non-fast-forward), surface the error and stop — do NOT add --force.push=auto) — git push, then git push --tags if release created tags.push=ask, print the push gate as a Hyperflow Question chat block and wait for the user's answer. If no interactive channel is available at all, hold the push and print Push: held — interactive confirmation required.── Ship Result ───────────────────
Branch: <name>
Gates: lint pass · typecheck pass · build pass · tests pass (<n> passed)
Security: pass
Commit: <sha> <message>
Release: v<x.y.z> (or skipped)
Push: confirmed (or held)
──────────────────────────────────
On gate failure:
── Ship Result ───────────────────
Branch: <name>
Gates: lint pass · typecheck fail · build skipped · tests skipped
typecheck: 3 errors in src/auth/middleware.ts
Halted at Step 2a
──────────────────────────────────
Use pass / fail / skipped as plain words — no ✓ / ✗ / — symbols.
--no-verify, --no-gpg-sign, bypassing hooksCo-Authored-By: ClaudeAfter successful ship, append to .hyperflow/memory/patterns.md if any new pattern was confirmed during gates. Skip if nothing new.
Full rules in DOCTRINE.md. Output style in output-style.md.
/hyperflow:deploy runs the pre-push gates (lint + typecheck + security sweep in parallel, then build, then tests), composes any worker-introduced fixes into a clean commit, runs the release script if present, and asks before pushing. Standalone — never auto-invoked from the chain. Push always requires an explicit AskUserQuestion confirmation. Never bypasses hooks, never force-pushes to main, never adds AI attribution to commits.
package.json or via .hyperflow/testing.md. Missing scripts are skipped silently (not failed).scripts/release.sh (or release-please / changesets) optional — if present, runs at Step 5; otherwise release is user-managed.The 7 numbered steps live in Step 1 — Survey State through Step 7 — Output above. Summary:
NEEDS_REVISION.SECURITY_VIOLATION or critical CVE. Both Step 2 and Step 3 must PASS before Step 4.AskUserQuestion for pre-existing uncommitted user changes.push pre-election (auto/never/ask). push=ask fires AskUserQuestion. Never force-push to main.See the ship result block in Step 7 — Output above. Two formats: success (all gates pass, listed inline) and failure (halt at first failing gate, listed in order). Always uses plain words (pass / fail / skipped) — no decorative symbols.
| Failure | Behavior |
|---|---|
| Step 2a — lint fails | Auto-retry once with --fix. Still failing → halt with error count. Do NOT proceed to 2b. |
| Step 2a — typecheck fails | Halt at 2a. No auto-fix — typecheck errors require human eyes. |
| Step 2b — build fails | Halt with build output. Pre-existing build issues likely pre-date the change set. |
| Step 2c — tests fail | Halt with failing test names. Do NOT skip failing tests. Do NOT increase timeout. |
| Security sweep finds secrets | Halt with SECURITY_VIOLATION: marker and the file:line. User decides remediation (revert the secret + rotate the credential). |
scripts/release.sh says "nothing to release" | Skip release; print Release: skipped (nothing to release). Push step still fires for non-release commits. |
| Push rejected (non-fast-forward) | Refuse to force-push. Print: Push rejected — branch is behind origin. Pull/rebase first. |
AskUserQuestion popup unavailable (Codex / OpenCode / Grok) | Print the push or commit-inclusion gate as a Hyperflow Question chat block and wait for the user's answer. |
| Headless / non-interactive | Refuse push step entirely. Print structured result with Push: held — interactive confirmation required. |
| Pre-existing uncommitted user changes | Use AskUserQuestion to ask whether to include or exclude from the commit. Default: include. |
/hyperflow:deploy
Step 2a — Lint + typecheck (parallel with Step 3 security sweep)
Worker A — running lint
Worker B — running formatter check
Worker C — running tsc
Step 3a/3b — security sweep (parallel)
Step 2a Reviewer — all clean
Step 3 Reviewer — no secrets found
Step 2b — Build
Step 2c — Tests (parallel)
? Push to origin/main?
Push — all gates pass · safe to ship
Hold — keep local; you can push later
[user picks Push]
── Ship Result ───────────────────
Branch: main
Gates: lint pass · typecheck pass · build pass · tests pass (147 passed)
Security: pass
Commit: dc38564 fix(skills): marketplace validator compliance
Release: v3.1.2
Push: confirmed
──────────────────────────────────
/hyperflow:deploy
Step 2a — Lint + typecheck (parallel with Step 3 security sweep)
Worker A — running lint
Lint failed: 3 errors in src/auth/middleware.ts
Auto-fix attempted... still failing.
Step 2a Reviewer — NEEDS_REVISION: lint gate failed (3 errors in src/auth/middleware.ts)
Halted at Step 2a. Build and tests skipped.
── Ship Result ───────────────────
Branch: main
Gates: lint fail · typecheck skipped · build skipped · tests skipped
lint: 3 errors in src/auth/middleware.ts (unused vars, missing return type)
Halted at Step 2a
──────────────────────────────────
/hyperflow:deploy
Gates pass: lint · typecheck · build · tests
**Reviewer** — security sweep
SECURITY_VIOLATION: src/config/email.ts:12 — hardcoded SendGrid API key (SG.xxx...)
Halted before commit. Rotate the credential and remove the literal from source before retrying.