mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
918a539baf
Root docs
- GEMINI.md: remove plaintext credential (Hard Rule 1) and refresh references
- CLAUDE.md: update coverage gate to 75/75/75/70, add module counts for v3.8.0
- SECURITY.md: add Supported Versions section
- AGENTS.md: refresh counts (177 providers, 37 MCP tools, 14 strategies, 5 A2A skills, 3 cloud agents) and module map
- CONTRIBUTING.md: align coverage gate, Node range, conventional-commit scopes
- CODE_OF_CONDUCT.md: refresh contact
- llm.txt: refresh Node range, provider/tool/strategy counts, add v3.8.0 highlights and documentation index
- Tuto_Qdrant.MD -> Tuto_Qdrant.md (rename + dormant-integration status banner)
i18n strict mirrors
- docs/i18n/<40 locales>/llm.txt: refresh body to match root (preserving locale header + flags line + --- separator)
Cross-references
- docs/MEMORY.md, docs/REPOSITORY_MAP.md: update Tuto_Qdrant.md path and note dormant status
- Cleanup: remove .issues/feat-batch-delete-provider-accounts.md and docs/archive/RFC-AUTO-ASSESSMENT-DRAFT.md (already absent)
Agent workflows / skills / commands
- .claude/commands/*-cc.md, .agents/workflows/*-ag.md, .agents/skills/*/SKILL.md:
- Replace ghost tools: search_web -> WebSearch, read_url_content -> WebFetch,
view_file -> Read, write_to_file -> Write
- notify_user -> mandatory stop checkpoints
- version-bump / generate-release: 2.x.y -> 3.x.y, expand docs table to 28 entries,
mark /update-docs and /update-i18n as deprecated
- capture-release-evidences / review-discussions: tool-mapping notes for
browser_subagent (mcp__claude-in-chrome__* and gh CLI)
- review-prs: align coverage thresholds (>=75/>=70, ~82% measured)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
6.6 KiB
6.6 KiB
Security and Cleanliness Rules for AI Assistants
Scope: rules for Gemini-based agents. For Claude Code, see
CLAUDE.md. For other AI assistants, seeAGENTS.md.
1. File Placement & Organization
- Test Files: ALL unit tests, integration tests, ecosystem tests, or Vitest files MUST strictly be placed within the
tests/directory (e.g.,tests/unit/,tests/integration/). NEVER create test files in the project root (/). - Scripts and Utilities: ALL maintenance, debugging, generation, or experimental scripts (
.cjs,.mjs,.js,.ts) MUST be placed strictly inside thescripts/directory orscripts/scratch/for temporary one-offs. NEVER dump loose scripts in the project root (/).
The Project Root MUST ONLY CONTAIN:
- Configuration files (
vitest.config.ts,next.config.mjs,eslint.config.mjs,tsconfig*.json,playwright.config.ts,prettier.config.mjs,postcss.config.mjs,sonar-project.properties,fly.toml,docker-compose*.yml,Dockerfile) - Dependency files (
package.json,package-lock.json) - Documentation files (
README.md,CHANGELOG.md,LICENSE,AGENTS.md,CLAUDE.md,GEMINI.md,CONTRIBUTING.md,SECURITY.md,CODE_OF_CONDUCT.md,llm.txt,Tuto_Qdrant.md) - CI/CD files and ignore definitions (
.gitignore,.dockerignore,.npmignore,.npmrc,.node-version,.nvmrc,.env.example)
When creating any validation tests or one-off logic scripts, default to using scripts/scratch/ or the tests/unit/ directories according to your goals. Do not pollute the / root context.
2. Hard Rules (mirror of CLAUDE.md)
- Never commit secrets or credentials. Use
.env(auto-generated from.env.example) or a vault. Passwords, OAuth secrets, API keys, and Cookie values must never appear in committed files. - Never add logic to
src/lib/localDb.ts. It is a re-export barrel only. - Never use
eval(),new Function(), or any implied eval. ESLint enforces this. - Never commit directly to
main. Usefeat/,fix/,refactor/,docs/,test/, orchore/branches. - Never write raw SQL in routes — always go through
src/lib/db/domain modules. - Never silently swallow errors in SSE streams — propagate them or abort the stream cleanly.
- Never bypass Husky hooks (
--no-verify,--no-gpg-sign) without explicit operator approval. - Always validate inputs with Zod schemas from
src/shared/validation/schemas.ts. - Always include tests when changing production code (
src/,open-sse/,electron/,bin/). - Coverage must stay ≥ 75 % statements / 75 % lines / 75 % functions / 70 % branches (real measured: ~82 %).
3. Codebase navigation
| Task | Read this first |
|---|---|
| Understand the codebase | docs/REPOSITORY_MAP.md |
| Architecture overview | docs/ARCHITECTURE.md |
| Engineering reference | docs/CODEBASE_DOCUMENTATION.md |
| Add a feature | CONTRIBUTING.md + the matching docs/<area>.md |
| Per-area deep dives | docs/SKILLS.md, docs/MEMORY.md, docs/EVALS.md, docs/GUARDRAILS.md, docs/COMPLIANCE.md, docs/CLOUD_AGENT.md, docs/MCP-SERVER.md, docs/A2A-SERVER.md, docs/AUTHZ_GUIDE.md, docs/RESILIENCE_GUIDE.md, docs/AUTO-COMBO.md, docs/WEBHOOKS.md, docs/REASONING_REPLAY.md, docs/STEALTH_GUIDE.md, docs/TUNNELS_GUIDE.md, docs/ELECTRON_GUIDE.md, docs/PROVIDER_REFERENCE.md |
| Release flow | docs/RELEASE_CHECKLIST.md |
4. Local development access
The dashboard is reachable at the operator's chosen URL/port (default http://localhost:20128). Credentials are operator-specific:
- Initial admin password is read from the
INITIAL_PASSWORDenv var on first install (defaults toCHANGEMEin.env.example; rotate immediately after first login). - Local VPS / shared dev environments: ask the operator for the URL and current credentials — they live in their personal vault, NOT in this repo.
Any credential observed in a previous version of this file was a non-production demo value; treat it as compromised and do not reuse it.