fix(attribution): HTTP 云函数 Skill 缺少路径映射和网关路径处理的关键说明 (issue_mo1hkx69_frhv2z)

Author: CodeBuddy Attribution Bot

config/source/guideline/cloudbase/SKILL.md

@@ -38,6 +38,8 @@ If a skill points to its own `references/...` files, keep following those relati
 - Always specify `EnvId` explicitly in code, configuration, and command examples when initializing CloudBase clients or manager operations. Do not rely on the current CLI-selected environment, implicit defaults, or copied local state.
 - For HTTP Functions, keep the public gateway path and the in-function router path as separate layers. Do not write gateway prefixes such as `/api/httpDemo` into the function router itself.
 - Creating an HTTP Function does not guarantee a browser/public URL exists. If the task needs external access, create gateway access only when required and confirm the actual exposed path with `queryGateway(action="getAccess")` instead of assuming it is `/{functionName}`.
+- If the task explicitly says no HTTP access service is needed, do not create gateway access just to mirror the function name. Keep direct function invocation and gateway routing as separate delivery choices.
+- When a gateway path is created later, keep the path mapping separate: a public prefix such as `/api/httpDemo` should still map to in-function routes like `/`, `/health`, and `/users` instead of rewriting handlers to `/api/httpDemo/...`.
 - If an external HTTP invocation may be anonymous, or the caller reports `EXCEED_AUTHORITY`, inspect the function permission rule first and only widen access when the product requirement really needs anonymous callers.
 - Keep scenario-specific pitfall lists in the matching child skills instead of expanding this entry file.
 

scripts/skills-repo-template/cloudbase-guidelines/SKILL.md

@@ -27,6 +27,11 @@ If a skill points to its own `references/...` files, keep following those relati
 - Use MCP or mcporter first for CloudBase management tasks, and inspect tool schemas before execution.
 - If the task includes UI, read `ui-design` first and output the design specification before interface code.
 - If the task includes login, registration, or auth configuration, read `auth-tool` first and enable required providers before frontend implementation.
+- For HTTP Functions, keep the public gateway path and the in-function router path as separate layers. Do not write gateway prefixes such as `/api/httpDemo` into the function router itself.
+- Creating an HTTP Function does not guarantee a browser/public URL exists. If the task needs external access, create gateway access only when required and confirm the actual exposed path with `queryGateway(action="getAccess")` instead of assuming it is `/{functionName}`.
+- If the task explicitly says no HTTP access service is needed, do not create gateway access just to mirror the function name. Keep direct function invocation and gateway routing as separate delivery choices.
+- When a gateway path is created later, keep the path mapping separate: a public prefix such as `/api/httpDemo` should still map to in-function routes like `/`, `/health`, and `/users` instead of rewriting handlers to `/api/httpDemo/...`.
+- If an external HTTP invocation may be anonymous, or the caller reports `EXCEED_AUTHORITY`, inspect the function permission rule first and only widen access when the product requirement really needs anonymous callers.
 
 ### High-priority routing
 

tests/build-allinone-skill.test.js

@@ -92,6 +92,8 @@ test.skipIf(!hasNode24ViaNvm())(
     expect(mainSkill).toContain('references/auth-web/SKILL.md');
     expect(mainSkill).toContain('## Activation Contract');
     expect(mainSkill).toContain('Provider status and publishable key');
+    expect(mainSkill).toContain('do not create gateway access just to mirror the function name');
+    expect(mainSkill).toContain('should still map to in-function routes like `/`, `/health`, and `/users`');
   },
 );
 

tests/build-skills-repo.test.js

@@ -31,4 +31,11 @@ test('build-skills-repo publishes skills and guideline from minimal sources', ()
   const readme = fs.readFileSync(path.join(OUTPUT_DIR, 'README.md'), 'utf8');
   expect(readme).toContain('cloudbase-guidelines');
   expect(readme).toContain('auth-web');
+
+  const guideline = fs.readFileSync(
+    path.join(OUTPUT_DIR, 'skills', 'cloudbase-guidelines', 'SKILL.md'),
+    'utf8',
+  );
+  expect(guideline).toContain('do not create gateway access just to mirror the function name');
+  expect(guideline).toContain('should still map to in-function routes like `/`, `/health`, and `/users`');
 });