mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
918a539baf
Root docs
- GEMINI.md: remove plaintext credential (Hard Rule 1) and refresh references
- CLAUDE.md: update coverage gate to 75/75/75/70, add module counts for v3.8.0
- SECURITY.md: add Supported Versions section
- AGENTS.md: refresh counts (177 providers, 37 MCP tools, 14 strategies, 5 A2A skills, 3 cloud agents) and module map
- CONTRIBUTING.md: align coverage gate, Node range, conventional-commit scopes
- CODE_OF_CONDUCT.md: refresh contact
- llm.txt: refresh Node range, provider/tool/strategy counts, add v3.8.0 highlights and documentation index
- Tuto_Qdrant.MD -> Tuto_Qdrant.md (rename + dormant-integration status banner)
i18n strict mirrors
- docs/i18n/<40 locales>/llm.txt: refresh body to match root (preserving locale header + flags line + --- separator)
Cross-references
- docs/MEMORY.md, docs/REPOSITORY_MAP.md: update Tuto_Qdrant.md path and note dormant status
- Cleanup: remove .issues/feat-batch-delete-provider-accounts.md and docs/archive/RFC-AUTO-ASSESSMENT-DRAFT.md (already absent)
Agent workflows / skills / commands
- .claude/commands/*-cc.md, .agents/workflows/*-ag.md, .agents/skills/*/SKILL.md:
- Replace ghost tools: search_web -> WebSearch, read_url_content -> WebFetch,
view_file -> Read, write_to_file -> Write
- notify_user -> mandatory stop checkpoints
- version-bump / generate-release: 2.x.y -> 3.x.y, expand docs table to 28 entries,
mark /update-docs and /update-i18n as deprecated
- capture-release-evidences / review-discussions: tool-mapping notes for
browser_subagent (mcp__claude-in-chrome__* and gh CLI)
- review-prs: align coverage thresholds (>=75/>=70, ~82% measured)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
51 lines
6.6 KiB
Markdown
51 lines
6.6 KiB
Markdown
# Security and Cleanliness Rules for AI Assistants
|
|
|
|
> **Scope:** rules for Gemini-based agents. For Claude Code, see `CLAUDE.md`. For other AI assistants, see `AGENTS.md`.
|
|
|
|
## 1. File Placement & Organization
|
|
|
|
- **Test Files**: ALL unit tests, integration tests, ecosystem tests, or Vitest files MUST strictly be placed within the `tests/` directory (e.g., `tests/unit/`, `tests/integration/`). NEVER create test files in the project root (`/`).
|
|
- **Scripts and Utilities**: ALL maintenance, debugging, generation, or experimental scripts (`.cjs`, `.mjs`, `.js`, `.ts`) MUST be placed strictly inside the `scripts/` directory or `scripts/scratch/` for temporary one-offs. NEVER dump loose scripts in the project root (`/`).
|
|
|
|
**The Project Root MUST ONLY CONTAIN:**
|
|
|
|
- Configuration files (`vitest.config.ts`, `next.config.mjs`, `eslint.config.mjs`, `tsconfig*.json`, `playwright.config.ts`, `prettier.config.mjs`, `postcss.config.mjs`, `sonar-project.properties`, `fly.toml`, `docker-compose*.yml`, `Dockerfile`)
|
|
- Dependency files (`package.json`, `package-lock.json`)
|
|
- Documentation files (`README.md`, `CHANGELOG.md`, `LICENSE`, `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, `CONTRIBUTING.md`, `SECURITY.md`, `CODE_OF_CONDUCT.md`, `llm.txt`, `Tuto_Qdrant.md`)
|
|
- CI/CD files and ignore definitions (`.gitignore`, `.dockerignore`, `.npmignore`, `.npmrc`, `.node-version`, `.nvmrc`, `.env.example`)
|
|
|
|
When creating _any_ validation tests or one-off logic scripts, default to using `scripts/scratch/` or the `tests/unit/` directories according to your goals. Do not pollute the `/` root context.
|
|
|
|
## 2. Hard Rules (mirror of `CLAUDE.md`)
|
|
|
|
1. **Never commit secrets or credentials.** Use `.env` (auto-generated from `.env.example`) or a vault. Passwords, OAuth secrets, API keys, and Cookie values must never appear in committed files.
|
|
2. **Never add logic to `src/lib/localDb.ts`.** It is a re-export barrel only.
|
|
3. **Never use `eval()`, `new Function()`, or any implied eval.** ESLint enforces this.
|
|
4. **Never commit directly to `main`.** Use `feat/`, `fix/`, `refactor/`, `docs/`, `test/`, or `chore/` branches.
|
|
5. **Never write raw SQL in routes** — always go through `src/lib/db/` domain modules.
|
|
6. **Never silently swallow errors in SSE streams** — propagate them or abort the stream cleanly.
|
|
7. **Never bypass Husky hooks** (`--no-verify`, `--no-gpg-sign`) without explicit operator approval.
|
|
8. **Always validate inputs with Zod schemas** from `src/shared/validation/schemas.ts`.
|
|
9. **Always include tests when changing production code** (`src/`, `open-sse/`, `electron/`, `bin/`).
|
|
10. **Coverage must stay** ≥ 75 % statements / 75 % lines / 75 % functions / 70 % branches (real measured: ~82 %).
|
|
|
|
## 3. Codebase navigation
|
|
|
|
| Task | Read this first |
|
|
| ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
| Understand the codebase | `docs/REPOSITORY_MAP.md` |
|
|
| Architecture overview | `docs/ARCHITECTURE.md` |
|
|
| Engineering reference | `docs/CODEBASE_DOCUMENTATION.md` |
|
|
| Add a feature | `CONTRIBUTING.md` + the matching `docs/<area>.md` |
|
|
| Per-area deep dives | `docs/SKILLS.md`, `docs/MEMORY.md`, `docs/EVALS.md`, `docs/GUARDRAILS.md`, `docs/COMPLIANCE.md`, `docs/CLOUD_AGENT.md`, `docs/MCP-SERVER.md`, `docs/A2A-SERVER.md`, `docs/AUTHZ_GUIDE.md`, `docs/RESILIENCE_GUIDE.md`, `docs/AUTO-COMBO.md`, `docs/WEBHOOKS.md`, `docs/REASONING_REPLAY.md`, `docs/STEALTH_GUIDE.md`, `docs/TUNNELS_GUIDE.md`, `docs/ELECTRON_GUIDE.md`, `docs/PROVIDER_REFERENCE.md` |
|
|
| Release flow | `docs/RELEASE_CHECKLIST.md` |
|
|
|
|
## 4. Local development access
|
|
|
|
The dashboard is reachable at the operator's chosen URL/port (default `http://localhost:20128`). Credentials are operator-specific:
|
|
|
|
- **Initial admin password** is read from the `INITIAL_PASSWORD` env var on first install (defaults to `CHANGEME` in `.env.example`; rotate immediately after first login).
|
|
- **Local VPS / shared dev environments**: ask the operator for the URL and current credentials — they live in their personal vault, NOT in this repo.
|
|
|
|
> Any credential observed in a previous version of this file was a non-production demo value; treat it as compromised and do not reuse it.
|